bolhasec

id: geoserver-wms-sld-xxe

info:
  name: GeoServer WMS SLD XXE Detection
  author: bolhasec
  severity: medium
  description: |
    Attempts to exploit an XXE vulnerability via a StyledLayerDescriptor (SLD)
    in a WMS GetMap POST request. A secure GeoServer instance should reject
    entity resolution and return an error like "Entity resolution disallowed for file".

simokohonen

/.env 
/.env.production 
/.env.www 
/.env-release.env 
/example/.env 
/.env 
/client/.env.production 
/node/.env_example 
/.env.test 
/.env.local 

reconeer

Reconeer lists 600 more subdomains than https://subdomainfinder.c99.nl/scans/2025-09-28/telekom.de and basic subfinder https://github.com/projectdiscovery/subfinder for telekom.de https://www.reconeer.com/domain/telekom.de https://github.com/reconeer/reconeer


1.ntp.time.telekom.de
3.ntp.time.telekom.de
2.ntp.time.telekom.de
4.ntp.time.telekom.de
5.ntp.time.telekom.de
admin.pfau.telekom.de
adsl-vp.telekom.de

simokohonen

/Node.js/JavaScript
/.git/hooks/pre-commit
/.env.json
/.cloudfront/keys.json
/.git/refs/stash
/admin/.env.old
/.docker/.env
/.env.docker.dev
/api/aws/s3
/admin/wp-config.php.old

bolhasec

id: CVE-2025-53833

info:
  name: LaRecipe is vulnerable to Server-Side Template Injection attacks
  author: sushicomabacate
  severity: critical
  description: |
    LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2025-53833

calmhavoc

Note 1

# Note, to speed scans up, set a scan variable here and add it to nmap lines where desired, eg:

nmap_defaults="--max-rtt-timeout 100ms --min-hostgroup 64 --min-rate 1000 --max-retries 2"

# nmap -Pn -n -sS -p 21-23,111,137,445,80,443 -iL target_scope.txt -oG $projectdir/nmap/$custid.quickscan-tcp.gnmap $nmap_defaults 

Note 2

nullenc0de

id: aws-iam-privilege-escalation

info:
  name: AWS IAM Privilege Escalation Vectors
  author: nullenc0de
  severity: critical
  description: |
    Detects AWS IAM policies, credentials, metadata, and configurations that allow privilege escalation paths.
    Covers exposed credentials, overly permissive IAM policies, misconfigured metadata services, vulnerable role assumptions, and user-data scripts.
  reference:

nullenc0de

id: sensitive-credential-files

info:
  name: Sensitive Credential File Discovery
  author: security-researcher
  severity: high
  description: Discovers exposed files containing credentials, API keys, passwords, and other sensitive data
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5

nullenc0de

id: sensitive-credential-files

info:
  name: Sensitive Credential File Discovery
  author: nullenc0de
  severity: high
  description: Discovers exposed files containing credentials, API keys, passwords, and other sensitive data
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5

nullenc0de

agent: >
  You are an expert penetration tester tasked with performing an external penetration test on a specified target (e.g., IP address or domain). Your goal is to identify vulnerabilities, propose exploitation methods, and deliver actionable findings with proof-of-concept details in `PENTEST.md`.

  ## Instructions
  - Target external assets specified via {{ target }} (e.g., public IPs, domains).
  - Follow a systematic yet creative methodology: reconnaissance, scanning, exploitation, and post-exploitation.
  - Use available data (e.g., provided outputs, hypothetical scan results) or execute commands to gather more as needed.
  - Identify confirmed vulnerabilities or exploitable weaknesses with evidence (e.g., tool outputs, HTTP responses).
  - Avoid stopping at "nothing found"—if initial scans (e.g., port scans) yield no results, dig deeper with alternative tools, techniques, or assumptions.
  - Prioritize high-impact vulnerabilities (e.g., remote code execution, privilege escalation, data exposure, aut