mirror of
https://github.com/lunchcat/sif.git
synced 2026-03-12 21:23:04 -07:00
feat: add built-in yaml modules for security scanning
This commit is contained in:
vmfunc
49
modules/http/lfi-basic.yaml
Normal file
49
modules/http/lfi-basic.yaml
Normal file
@@ -0,0 +1,49 @@
|
||||
# Basic LFI Detection Module
|
||||
|
||||
id: lfi-basic
|
||||
info:
|
||||
name: Basic LFI Detection
|
||||
author: sif
|
||||
severity: high
|
||||
description: Detects basic Local File Inclusion vulnerabilities
|
||||
tags: [lfi, injection, file-inclusion, owasp-top10]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}/?file={{payload}}"
|
||||
- "{{BaseURL}}/?page={{payload}}"
|
||||
- "{{BaseURL}}/?path={{payload}}"
|
||||
- "{{BaseURL}}/?include={{payload}}"
|
||||
- "{{BaseURL}}/?doc={{payload}}"
|
||||
- "{{BaseURL}}/?template={{payload}}"
|
||||
|
||||
payloads:
|
||||
- "../../../../../../../etc/passwd"
|
||||
- "....//....//....//....//....//etc/passwd"
|
||||
- "..%2f..%2f..%2f..%2f..%2fetc/passwd"
|
||||
- "/etc/passwd"
|
||||
- "../../../../../../../etc/shadow"
|
||||
- "../../../../../../../windows/system32/drivers/etc/hosts"
|
||||
|
||||
threads: 10
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
part: body
|
||||
regex:
|
||||
- "root:.*:0:0:"
|
||||
- "daemon:.*:1:1:"
|
||||
- "nobody:.*:65534:"
|
||||
- "127\\.0\\.0\\.1\\s+localhost"
|
||||
condition: or
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: detected_file
|
||||
part: body
|
||||
regex:
|
||||
- "(root|daemon|nobody):.*:[0-9]+:[0-9]+:"
|
||||
group: 0
|
||||
66
modules/http/sqli-error.yaml
Normal file
66
modules/http/sqli-error.yaml
Normal file
@@ -0,0 +1,66 @@
|
||||
# SQL Injection Error-Based Detection Module
|
||||
|
||||
id: sqli-error-based
|
||||
info:
|
||||
name: SQL Injection (Error-Based)
|
||||
author: sif
|
||||
severity: high
|
||||
description: Detects SQL injection via database error messages
|
||||
tags: [sqli, injection, database, owasp-top10]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}/?id={{payload}}"
|
||||
- "{{BaseURL}}/?user={{payload}}"
|
||||
- "{{BaseURL}}/?search={{payload}}"
|
||||
- "{{BaseURL}}/?q={{payload}}"
|
||||
- "{{BaseURL}}/?query={{payload}}"
|
||||
- "{{BaseURL}}/?cat={{payload}}"
|
||||
|
||||
payloads:
|
||||
- "'"
|
||||
- "''"
|
||||
- "1'"
|
||||
- "1' OR '1'='1"
|
||||
- "1' OR '1'='1'--"
|
||||
- "1' OR '1'='1'/*"
|
||||
- "1; DROP TABLE--"
|
||||
- "' UNION SELECT NULL--"
|
||||
- "1 AND 1=1"
|
||||
- "1 AND 1=2"
|
||||
|
||||
threads: 10
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
part: body
|
||||
regex:
|
||||
- "SQL syntax.*MySQL"
|
||||
- "Warning.*mysql_"
|
||||
- "MySqlException"
|
||||
- "valid MySQL result"
|
||||
- "ORA-[0-9]+"
|
||||
- "Oracle.*Driver"
|
||||
- "Oracle.*Error"
|
||||
- "PostgreSQL.*ERROR"
|
||||
- "pg_query.*failed"
|
||||
- "Microsoft SQL Server"
|
||||
- "ODBC SQL Server Driver"
|
||||
- "SQLite3::"
|
||||
- "sqlite_query"
|
||||
- "SQLite/JDBCDriver"
|
||||
- "SQL Server.*Driver"
|
||||
- "Unclosed quotation mark"
|
||||
- "quoted string not properly terminated"
|
||||
condition: or
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: db_type
|
||||
part: body
|
||||
regex:
|
||||
- "(MySQL|PostgreSQL|Oracle|MSSQL|SQLite|MariaDB)"
|
||||
group: 1
|
||||
41
modules/http/xss-reflected.yaml
Normal file
41
modules/http/xss-reflected.yaml
Normal file
@@ -0,0 +1,41 @@
|
||||
# Reflected XSS Detection Module
|
||||
|
||||
id: xss-reflected
|
||||
info:
|
||||
name: Reflected XSS Detection
|
||||
author: sif
|
||||
severity: medium
|
||||
description: Detects reflected Cross-Site Scripting vulnerabilities
|
||||
tags: [xss, injection, javascript, owasp-top10]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}/?q={{payload}}"
|
||||
- "{{BaseURL}}/?search={{payload}}"
|
||||
- "{{BaseURL}}/?name={{payload}}"
|
||||
- "{{BaseURL}}/?input={{payload}}"
|
||||
- "{{BaseURL}}/?message={{payload}}"
|
||||
- "{{BaseURL}}/?text={{payload}}"
|
||||
|
||||
payloads:
|
||||
- "<script>alert('XSS')</script>"
|
||||
- "'><script>alert('XSS')</script>"
|
||||
- "\"><script>alert('XSS')</script>"
|
||||
- "<img src=x onerror=alert('XSS')>"
|
||||
- "<svg onload=alert('XSS')>"
|
||||
- "javascript:alert('XSS')"
|
||||
- "<body onload=alert('XSS')>"
|
||||
|
||||
threads: 10
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- "<script>alert('XSS')</script>"
|
||||
- "<img src=x onerror=alert('XSS')>"
|
||||
- "<svg onload=alert('XSS')>"
|
||||
condition: or
|
||||
35
modules/info/cms-drupal.yaml
Normal file
35
modules/info/cms-drupal.yaml
Normal file
@@ -0,0 +1,35 @@
|
||||
# Drupal CMS Detection Module
|
||||
|
||||
id: cms-drupal
|
||||
info:
|
||||
name: Drupal Detection
|
||||
author: sif
|
||||
severity: info
|
||||
description: Detects Drupal CMS installations
|
||||
tags: [cms, drupal, detection, info]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: all
|
||||
words:
|
||||
- "Drupal.settings"
|
||||
- "X-Drupal-Cache"
|
||||
- "/sites/default/files"
|
||||
- "drupal.js"
|
||||
condition: or
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: drupal_version
|
||||
part: body
|
||||
regex:
|
||||
- 'Drupal ([0-9.]+)'
|
||||
- 'content="Drupal ([0-9.]+)"'
|
||||
group: 1
|
||||
37
modules/info/cms-wordpress.yaml
Normal file
37
modules/info/cms-wordpress.yaml
Normal file
@@ -0,0 +1,37 @@
|
||||
# WordPress CMS Detection Module
|
||||
|
||||
id: cms-wordpress
|
||||
info:
|
||||
name: WordPress Detection
|
||||
author: sif
|
||||
severity: info
|
||||
description: Detects WordPress CMS installations
|
||||
tags: [cms, wordpress, detection, info]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}"
|
||||
- "{{BaseURL}}/wp-login.php"
|
||||
- "{{BaseURL}}/wp-admin/"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- "wp-content"
|
||||
- "wp-includes"
|
||||
- "wp-json"
|
||||
- "wordpress"
|
||||
condition: or
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: wp_version
|
||||
part: body
|
||||
regex:
|
||||
- 'content="WordPress ([0-9.]+)"'
|
||||
- 'wp-includes/js/wp-embed.min.js\?ver=([0-9.]+)'
|
||||
group: 1
|
||||
50
modules/info/security-headers.yaml
Normal file
50
modules/info/security-headers.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
# Security Headers Check Module
|
||||
# Checks for missing or misconfigured security headers
|
||||
|
||||
id: security-headers
|
||||
info:
|
||||
name: Security Headers Analysis
|
||||
author: sif
|
||||
severity: info
|
||||
description: Checks for presence and configuration of security headers
|
||||
tags: [headers, security, info, owasp]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}"
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
part: header
|
||||
regex:
|
||||
- "X-Frame-Options"
|
||||
- "X-Content-Type-Options"
|
||||
- "Strict-Transport-Security"
|
||||
- "Content-Security-Policy"
|
||||
- "X-XSS-Protection"
|
||||
condition: or
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: x_frame_options
|
||||
part: header
|
||||
regex:
|
||||
- "X-Frame-Options: (.+)"
|
||||
group: 1
|
||||
|
||||
- type: regex
|
||||
name: content_security_policy
|
||||
part: header
|
||||
regex:
|
||||
- "Content-Security-Policy: (.+)"
|
||||
group: 1
|
||||
|
||||
- type: regex
|
||||
name: strict_transport_security
|
||||
part: header
|
||||
regex:
|
||||
- "Strict-Transport-Security: (.+)"
|
||||
group: 1
|
||||
45
modules/recon/backup-files.yaml
Normal file
45
modules/recon/backup-files.yaml
Normal file
@@ -0,0 +1,45 @@
|
||||
# Backup Files Detection Module
|
||||
|
||||
id: backup-files
|
||||
info:
|
||||
name: Backup Files Detection
|
||||
author: sif
|
||||
severity: medium
|
||||
description: Detects common backup files that may expose sensitive information
|
||||
tags: [backup, exposure, misconfiguration, recon]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}/backup.sql"
|
||||
- "{{BaseURL}}/backup.zip"
|
||||
- "{{BaseURL}}/backup.tar.gz"
|
||||
- "{{BaseURL}}/database.sql"
|
||||
- "{{BaseURL}}/db.sql"
|
||||
- "{{BaseURL}}/dump.sql"
|
||||
- "{{BaseURL}}/.env"
|
||||
- "{{BaseURL}}/.env.backup"
|
||||
- "{{BaseURL}}/config.php.bak"
|
||||
- "{{BaseURL}}/web.config.bak"
|
||||
- "{{BaseURL}}/wp-config.php.bak"
|
||||
- "{{BaseURL}}/settings.py.bak"
|
||||
|
||||
threads: 5
|
||||
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
||||
- type: regex
|
||||
part: body
|
||||
regex:
|
||||
- "CREATE TABLE"
|
||||
- "INSERT INTO"
|
||||
- "DB_PASSWORD"
|
||||
- "APP_KEY"
|
||||
- "SECRET_KEY"
|
||||
- "database_password"
|
||||
condition: or
|
||||
39
modules/recon/git-exposed.yaml
Normal file
39
modules/recon/git-exposed.yaml
Normal file
@@ -0,0 +1,39 @@
|
||||
# Exposed Git Repository Detection Module
|
||||
|
||||
id: git-exposed
|
||||
info:
|
||||
name: Exposed Git Repository
|
||||
author: sif
|
||||
severity: high
|
||||
description: Detects exposed .git directories that may leak source code
|
||||
tags: [git, exposure, source-code, misconfiguration]
|
||||
|
||||
type: http
|
||||
|
||||
http:
|
||||
method: GET
|
||||
paths:
|
||||
- "{{BaseURL}}/.git/HEAD"
|
||||
- "{{BaseURL}}/.git/config"
|
||||
- "{{BaseURL}}/.git/index"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- "ref: refs/"
|
||||
- "[core]"
|
||||
- "repositoryformatversion"
|
||||
condition: or
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
name: git_branch
|
||||
part: body
|
||||
regex:
|
||||
- "ref: refs/heads/(.+)"
|
||||
group: 1
|
||||
Reference in New Issue
Block a user