MQ-xz

reNgine full scan engine (subdomains + passive & active)
# YOYO model: passive discovery -> active enumeration/validation -> passive re-check/cleanup
# This engine performs subdomain enumeration, URL fetching, passive scans first,
# then active follow-ups (port scan, aggressive dir fuzzing, active vuln templates),
# then a final passive validation pass to reduce false positives and re-collect endpoints.
# Drop this file in web/config/default_scan_engines/ and load with the update scripts/management commands.

custom_header: {
  'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0',
}

bolhasec

id: geoserver-wms-sld-xxe

info:
  name: GeoServer WMS SLD XXE Detection
  author: bolhasec
  severity: medium
  description: |
    Attempts to exploit an XXE vulnerability via a StyledLayerDescriptor (SLD)
    in a WMS GetMap POST request. A secure GeoServer instance should reject
    entity resolution and return an error like "Entity resolution disallowed for file".

simokohonen

/.env 
/.env.production 
/.env.www 
/.env-release.env 
/example/.env 
/.env 
/client/.env.production 
/node/.env_example 
/.env.test 
/.env.local 

reconeer

Reconeer lists 600 more subdomains than https://subdomainfinder.c99.nl/scans/2025-09-28/telekom.de and basic subfinder https://github.com/projectdiscovery/subfinder for telekom.de https://www.reconeer.com/domain/telekom.de https://github.com/reconeer/reconeer


1.ntp.time.telekom.de
3.ntp.time.telekom.de
2.ntp.time.telekom.de
4.ntp.time.telekom.de
5.ntp.time.telekom.de
admin.pfau.telekom.de
adsl-vp.telekom.de

simokohonen

/Node.js/JavaScript
/.git/hooks/pre-commit
/.env.json
/.cloudfront/keys.json
/.git/refs/stash
/admin/.env.old
/.docker/.env
/.env.docker.dev
/api/aws/s3
/admin/wp-config.php.old

bolhasec

id: CVE-2025-53833

info:
  name: LaRecipe is vulnerable to Server-Side Template Injection attacks
  author: sushicomabacate
  severity: critical
  description: |
    LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2025-53833

calmhavoc

Note 1

# Note, to speed scans up, set a scan variable here and add it to nmap lines where desired, eg:

nmap_defaults="--max-rtt-timeout 100ms --min-hostgroup 64 --min-rate 1000 --max-retries 2"

# nmap -Pn -n -sS -p 21-23,111,137,445,80,443 -iL target_scope.txt -oG $projectdir/nmap/$custid.quickscan-tcp.gnmap $nmap_defaults 

Note 2

nullenc0de

id: aws-iam-privilege-escalation

info:
  name: AWS IAM Privilege Escalation Vectors
  author: nullenc0de
  severity: critical
  description: |
    Detects AWS IAM policies, credentials, metadata, and configurations that allow privilege escalation paths.
    Covers exposed credentials, overly permissive IAM policies, misconfigured metadata services, vulnerable role assumptions, and user-data scripts.
  reference:

nullenc0de

id: sensitive-credential-files

info:
  name: Sensitive Credential File Discovery
  author: security-researcher
  severity: high
  description: Discovers exposed files containing credentials, API keys, passwords, and other sensitive data
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5

nullenc0de

id: sensitive-credential-files

info:
  name: Sensitive Credential File Discovery
  author: nullenc0de
  severity: high
  description: Discovers exposed files containing credentials, API keys, passwords, and other sensitive data
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5