service.cfg

{
	"auxiliary/scanner/ftp/anonymous": {
		"initMsg": ["220 Welcome to ftp server\r\n"],
		"defaultPort": [21, 20],
		"seq": [
			["starts", "USER "],
			["331 Need password\r\n"],
			["starts", "PASS "],
			["200 Logged in\r\n"],
			["starts", "PASV"],
			["227 Entering Passive Mode (127,0,0,1,0,20)\r\n"],
			["regex", "^(LIST|STOR|RETR)"],
			["150 Ready\r\n", ["action", ["sendFile", "secret.txt"], ["send", "200 transfer completed\r\n"]]],
			["any"],
			["200 Success!\r\n"]
		]
	},
	"auxiliary/scanner/ftp/konica_ftp_traversal": {
		"follow": "auxiliary/scanner/ftp/anonymous",
		"defaultPort": [21, 20]
	},
	"auxiliary/scanner/ftp/pcman_ftp_traversal": {
		"follow": "auxiliary/scanner/ftp/anonymous",
		"defaultPort": [21, 20]
	},
	"auxiliary/scanner/ftp/titanftp_xcrc_traversal": {
		"follow": "auxiliary/scanner/ftp/anonymous",
		"initMsg": ["220 Welcome to titan ftp server\n"],
		"defaultPort": [21, 20],
		"seq": [
			["regex", "XCRC .*9999999999"],
			["501 Syntax error in parameters or arguments. EndPos of 9999999999 is larger than file size 20.\r\n"],
			["regex", "XCRC .* (\\d+)\\r\\n"],
			["250 ", ["crc32", "hello world you all!!\n"], "\r\n"]
		]
	},

	"exploits/windows/iis/ms01_023_printer": {
		"desc": "",
		"extraCmds": "set payload windows/shell_reverse_tcp\r\nsetg LHOST 127.0.0.1",
		"defaultPort": [80],
		"seq": [
			["regex", "GET http:\/\/.*\/NULL.printer?"],
			["HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n", ["action", ["connect", ":4444"]]]

		]
	},
	"auxiliary/scanner/http/a10networks_ax_directory_traversal": {
		"defaultPort": [80],
		"extraCmds": "set CONFIRM_DELETE true",
		"seq": [
			["starts", "GET /xml/downloads/?filename="],
			["HTTP/1.1 200 OK\r\nContent-Length: 11\r\n\r\nmy secrete\n"]
		]
	},
	"auxiliary/scanner/http/adobe_xml_inject": {
		"defaultPort": [8400],
		"seq": [
			["starts", "POST /flex2gateway/"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 15\r\n\r\nUnknown systax\n"]
		]
	},
	"auxiliary/scanner/http/allegro_rompager_misfortune_cookie": {
		"defaultPort": [80],
		"seq": [
			["regex", "Cookie:\\s*(\\S+)"],
			["HTTP/1.1 404 Not Found\r\nSet-Cookie: SID=1234567;\r\nContent-Length: $\r\n\r\n", ["eval", "$1"]],
			["starts", "GET "],
			["HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n"]
		]
	},
	"auxiliary/scanner/http/apache_mod_cgi_bash_env": {
		"defaultPort": [80],
		"extraCmds": "set TARGETURI /",
		"seq": [
			["regex", "User-Agent: \\(\\).*echo.*\\)(.*?)\""],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", ["eval", "$1$1$1"]]
		]
	},
	"auxiliary/scanner/http/apache_userdir_enum": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /~admin"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["any"],
			["HTTP/1.1 404 Not Found\r\nContent-Length: 10\r\n\r\nTry again!!"]
		]
	},
	"auxiliary/scanner/http/bitweaver_overlay_type_traversal": {
		"desc": "TODO: need to have a good content in loot",
		"defaultPort": [80],
		"seq": [
			["starts", "GET /bitweaver/gmap/view_overlay.php?overlay_type=../../../../../../../../../../etc/passwd"],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", "Notice:\r\nadmin:pass123\njdole:letmein\n"]
		]
	},
	"auxiliary/scanner/http/bmc_trackit_passwd_reset": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /PasswordReset"],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", "<title>Track-It! Password Reset Build=11.3"],
			["substr", "updatequesChk="],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", "{\"success\":true,\"data\":{\"userUpdated\":true}}" ],
			["substr", "newPassword="],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", "{\"success\":true,\"data\":{\"PasswordResetStatus\":0}}"]
		]
	},
	"auxiliary/scanner/http/brute_dirs": {
		"defaultPort": [80],
		"seq": [
			["regex", "GET \\/[^\\s]{5,5}\\/ "],
			["HTTP/1.1 404 Not Found\r\nContent-Length: 12\r\n\r\ngina de error"],
			["starts", "GET /ab/"],
			["HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\ngina de error"],
			["any"],
			["HTTP/1.1 404 Not Found\r\nContent-Length: 16\r\n\r\nit's unavailable"]
		]
	},
	"auxiliary/scanner/http/canon_wireless": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 85\r\n\r\n", "<html><body><input name=\"LAN_OPT1\" checked=\"true\" value=\"1\">222</input></body></html>"]
		]
	},
	"auxiliary/scanner/http/caidao_bruteforce_login": {
		"defaultPort": [80],
		"seq": [
			["split", "\\\""],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize",2], "\r\n\r\n", ["eval", "$results[3]$results[1]$results[5]"]]
		]
	},
	"auxiliary/scanner/http/cisco_device_manager": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /exec/show/version/CR"],
			["HTTP/1.1 200 OK\r\nContent-Length: 44\r\n\r\nCisco Internetwork Operating System Software"],
			["starts", "GET /exec/show/config/CR"],
			["HTTP/1.1 200 OK\r\nContent-Length: 45\r\n\r\n<FORM METHOD=\"POST\">enable password 0 ABCDEF01</FORM>"]
		]
	},
	"auxiliary/scanner/http/cisco_ios_auth_bypass": {
		"defaultPort": [80],
		"seq": [
			["regex", "GET .*version\/CR"],
			["HTTP/1.1 200 OK\r\nContent-Length: 44\r\n\r\nCisco Internetwork Operating System Software"],
			["regex", "GET .*config/CR"],
			["HTTP/1.1 200 OK\r\nContent-Length: 45\r\n\r\n<FORM METHOD=\"POST\">some fields here!!</FORM>"]
		]
	},
	"auxiliary/scanner/http/concrete5_member_list": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /index.php/members"],
			["HTTP/1.1 200 OK\r\nContent-Length: 176\r\n\r\n<div class=\"ccm-profile-member-username\">/view/123/<a href=\"profiles/123\">john</a></div><div class=\"ccm-profile-member-username\">/view/345/<a href=\"profiles/345\">mary</a></div>"]
		]
	},
	"auxiliary/scanner/http/copy_of_file": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
		]
	},
	"auxiliary/scanner/http/clansphere_traversal": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 112\r\n\r\n<div id=\"bottom\">\n<div id=\"bottom\">\nall my secret1 here\n     UTC  <div id=\"bottom\">\nall my secret2 here\n     UTC"]
		]
	},
	"auxiliary/scanner/http/coldfusion_version": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: IIS 10.8\r\nContent-Length: 172\r\n\r\n<title>ColdFusionAdministrator</title><strong>Version:6.9</strong><br />", ["repeat", " ", 100]]
		]
	},
	"auxiliary/scanner/http/coldfusion_locale_traversal": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: IIS 10.8\r\nContent-Length: 170\r\n\r\n<title>ColdFusionAdministrator</title><strong>Version:9</strong><br />", ["repeat", " ", 100]]
		]
	},
	"auxiliary/scanner/http/dir_webdav_unicode_bypass": {
		"defaultPort": [80],
		"seq": [
			["regex", "PROPFIND /.+~tracking/"],
			["HTTP/1.1 207 OK\r\nContent-Length: 12\r\n\r\nhere you are"],
			["starts", "PROPFIND /~"],
			["HTTP/1.1 401 Not Authorized\r\nContent-Length: 8\r\n\r\nGot it!!"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
		]
	},
	"auxiliary/scanner/http/dlink_dir_300_615_http_login": {
		"defaultPort": [80],
		"seq": [
			["substr", "LOGIN_USER=admin&LOGIN_PASSWD=admin"],
			["HTTP/1.1 200 OK\r\nContent-Length: 52\r\n\r\n<META HTTP-EQUIV=Refresh CONTENT='0; url=index.php'>"],
			["starts", "POST "],
			["HTTP/1.1 404 Not Found\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["any"],
			["HTTP/1.1 200 OK\r\nServer: Mathopd/1.5p6\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
		]
	},
	"auxiliary/scanner/http/dlink_dir_615h_http_login": {
		"defaultPort": [80],
		"seq": [
			["substr", "sel_userid=admin&userid=&passwd=password"],
			["HTTP/1.1 200 OK\r\nContent-Length: 61\r\n\r\n<script langauge=\"javascript\">showMainTabs(\"setup\");</script>"],
			["starts", "POST /"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nfailed!!!!"],
			["starts", "GET /gconfig.htm"],
			["HTTP/1.1 200 OK\r\nServer: Mathopd/1.5p6\r\nContent-Length: 28\r\n\r\nvar systemName='DLINK-DIR615"]
		]
	},
	"auxiliary/scanner/http/dlink_dir_session_cgi_http_login": {
		"defaultPort": [80],
		"seq": [
			["substr", "USER=admin&PASSWD=password"],
			["HTTP/1.1 200 OK\r\nContent-Length: 24\r\n\r\n<RESULT>SUCCESS</RESULT>"],
			["starts", "POST "],
			["HTTP/1.1 404 Not Found\r\nContent-Length: 10\r\n\r\nfailed!!!!"],
			["starts", "GET /session.cgi"],
			["HTTP/1.1 200 OK\r\nServer: Linux, HTTP/1.1, DIR-111 Ver 2.9\r\nContent-Length: 28\r\n\r\nvar systemName='DLINK-DIR615"]
		]
	},
	"auxiliary/scanner/http/dlink_user_agent_backdoor": {
		"defaultPort": [80],
		"seq": [
			["substr", "xmlset_roodkcableoj28840ybtide"],
			["HTTP/1.1 200 OK\r\nServer: alpha\r\nContent-Length: 21\r\n\r\nHome/bsc_internet.htm"],
			["starts", "GET /"],
			["HTTP/1.1 200 OK\r\nServer: alpha\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/dolibarr_login": {
		"defaultPort": [80],
		"seq": [
			["starts", "POST /"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["substr", "username=connect&password=letmein"],
			["HTTP/1.1 301 Moved\r\nLocation: /retry/admin\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["starts", "GET /"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: DOLSESSID_G=1234;\r\nContent-Length: 41\r\n\r\ntype=\"hidden\" name=\"token\" value=\"567789\""]
		]
	},
	"auxiliary/scanner/http/drupal_views_user_enum": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /?q=admin/views/ajax/autocomplete/user/b "],
			["HTTP/1.1 200 OK\r\nContent-Length: 28\r\n\r\n[\"tblack\", \"jbarry\",\"mBoys\"]"],
			["starts", "GET /?q=admin/views/ajax/autocomplete/user"],
			["HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\n[  ]"]
		]
	},
	"auxiliary/scanner/http/error_sql_injection": {
		"defaultPort": [80],
		"extraCmds": "set QUERY q=123",
		"seq": [
			["substr", "'& HTTP/1.1\r\n"],
			["HTTP/1.1 200 OK\r\nContent-Length: 50\r\n\r\nUnclosed quotation mark after the character string"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/etherpad_duo_login": {
		"defaultPort": [80],
		"seq": [
			["substr", "Authorization: Basic cm9vdDpwYXNzd29yZA=="],
			["HTTP/1.1 200 OK\r\nServer: EtherPAD\r\nContent-Length: 9\r\n\r\nHome Page"],
			["substr", "Authorization: Basic"],
			["HTTP/1.1 401 Authentication Needed\r\nServer: EtherPAD\r\nContent-Length: 12\r\n\r\nEtherPAD Duo"],
			["any"],
			["HTTP/1.1 200 OK\r\nServer: EtherPAD\r\nContent-Length: 12\r\n\r\nEtherPAD Duo"]
		]
	},
	"auxiliary/scanner/http/drupal_views_user_enum": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /?q=admin/views/ajax/autocomplete/user/b "],
			["HTTP/1.1 200 OK\r\nContent-Length: 16\r\n\r\n[\"bob\", \"barry\"]"],
			["starts", "GET /?q=admin/views/ajax/autocomplete/user/j "],
			["HTTP/1.1 200 OK\r\nContent-Length: 15\r\n\r\n[\"john\", \"joe\"]"],
			["starts", "GET /?q=admin/views/ajax/autocomplete/user/"],
			["HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\n[  ]"]
		]
	},
	"auxiliary/scanner/http/ektron_cms400net": {
		"defaultPort": [80],
		"seq": [
			["substr", "username=Admin2&password=Admin2"],
			["HTTP/1.1 200 OK\r\nContent-Length: 18\r\n\r\nLoginSuceededPanel"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/enum_wayback": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/f5_bigip_virtual_server": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: BigIP\r\nContent-Length: 21\r\n\r\n<title>BIG-IP</title>"]
		]	
	},
	"auxiliary/scanner/http/frontpage_login": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: frontSrv 2.3\r\nContent-Length: 43\r\n\r\nFPVersion=\"2.3\" FPAuthorScriptUrl=/tryagain"]
		]
	},
	"auxiliary/scanner/http/gitlab_login": {
		"defaultPort": [80],
		"seq": [
			["starts", "POST "],
			["HTTP/1.1 302 Moved\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 41\r\n\r\n{\"username\": \"john\", \"name\": \"John Dole\"}"],
			["any"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 79\r\n\r\nuser[login]  <input name=\"authenticity_token\" type=\"hidden\" value=\"abcdef1234\">"]
		]
	},
	"auxiliary/scanner/http/gitlab_user_enum": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /api/v3/internal/discover?key_id=4 "],
			["HTTP/1.1 200 OK\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 41\r\n\r\n{\"username\": \"john\", \"name\": \"John Dole\"}"],
			["any"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 47\r\n\r\n{\"gitlab_version\": \"12.3\", \"gitlab_rev\": \"223\"}"]
		]
	},
	"auxiliary/scanner/http/buffalo_login": {
		"defaultPort": [80],
		"seq": [
			["substr", "Login&user=root&password=password"],
			["HTTP/1.1 200 OK\r\nContent-Length: 17\r\n\r\n{\"success\": true}"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 18\r\n\r\n{\"success\": false}"]
		]
	},
	"auxiliary/scanner/http/git_scanner": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /.git/index"],
			["HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\nDIRC", ["N", 12], ["N", 200]],
			["starts", "GET /.git/config"],
			["HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\nDIRC[remote]"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/goahead_traversal": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: GoAhead\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/groupwise_agents_http_traversal": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: GroupWise\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/host_header_injection": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nevil.com!!"]
		]
	},
	"auxiliary/scanner/http/http_header": {
		"defaultPort": [80],
		"seq": [
			["starts", "HEAD / HTTP/1.1"],
			["HTTP/1.1 200 OK\r\nServer: Rapid7\r\nContent-Length: 0\r\n\r\n"]
		]
	},
	"auxiliary/scanner/http/http_login": {
		"defaultPort": [80],
		"seq": [
			["substr", "Authorization: Basic YWRtaW46cGFzc3dvcmQ="],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["starts", "GET /"],
			["HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"myRealm\"\r\nContent-Length: 0\r\n\r\n"]
		]
	},
	"auxiliary/scanner/http/http_put": {
		"defaultPort": [80],
		"seq": [
			["starts", "PUT /", "saveHttpBody"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["starts", "GET /"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["saved"]]
		]
	},
	"auxiliary/scanner/http/http_traversal": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/http_version": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/iis_internal_ip": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 301 Moved\r\nLocation: http://10.11.12.13/login?\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/ipboard_login": {
		"defaultPort": [80],
		"seq": [
			["substr", "ips_username=admin&ips_password=admin"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: ipsconnect=coppa;\r\nContent-Length: $\r\n\r\nWelcome"],
			["starts", "GET /forum"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nname='auth_key' value='abc123'"],
			["any"],
			["HTTP/1.1 401 Unauthorized\r\nContent-Length: $\r\n\r\nPlease try again"]
		]
	},
	"auxiliary/scanner/http/jboss_vulnscan": {
		"defaultPort": [80],
		"seq": [
			["starts", "HEAD /"],
			["http://10.11.12.13/login?\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["starts", "GET /"],
			["HTTP/1.1 401 Unauthorized\r\nContent-Length: $\r\n\r\nJBoss 2.0: Please try again"]
		]
	},
	"auxiliary/scanner/http/jenkins_command": {
		"defaultPort": [80],
		"seq": [
			["starts", "POST /jenkin"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=12345678;\r\nContent-Length: $\r\n\r\n<pre>Jenkins.instance.pluginManager.plugins</pre><pre>java.plugin: ver2.0</pre>"],
			["starts", "GET /jenkins/systemInfo HTTP"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=12345678;\r\nContent-Length: $\r\n\r\nSystem Properties\nEnvironment Variables\nRemember me on this computer\n\".crumb\", \"abcd1234\"\nos.name<td>Windows7\nos.version"]
		]
	},
	"auxiliary/scanner/http/jenkins_enum": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /jenkins"],
			["HTTP/1.1 200 OK\r\nX-Jenkins: 2.0\r\nSet-Cookie: JSESSIONID=12345678;\r\nContent-Length: $\r\n\r\nSystem Properties\nEnvironment Variables\nRemember me on this computer\n\".crumb\", \"abcd1234\"\nos.name<td>Windows7\nos.version</td>"]
		]
	},
	"auxiliary/scanner/http/joomla_bruteforce_login": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /login"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: JSID=12345;\r\nContent-Length: $\r\n\r\n<form action=abc.php method=\"post\" id=\"form-login\"><input type=\"hidden\" value=\"1\"/><input type=\"hidden\" value=\"2\"/><input type=\"hidden\" value=\"3\"/><input type=\"hidden\" value=\"4\"/><input type=\"hidden\" value=\"5\"/><input type=\"hidden\" name=\"id6\" value=\"6\"/><input type=\"hidden\" name=\"id7\" value=\"7\"/></form>"],
			["substr", "username=vagrant&passwd=vagrant"],
			["HTTP/1.1 302 Moved\r\nLocation: /main.html\r\nContent-Length: $\r\n\r\n"],
			["any"],
			["HTTP/1.1 302 Moved\r\nLocation: /login\r\nContent-Length: $\r\n\r\nmod-login-username"]
		]
	},
	"auxiliary/scanner/http/joomla_ecommercewd_sqli_scanner": {
		"defaultPort": [80],
		"seq": [
			["regex", "CONCAT\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["H*", "$1"],["H*", "$2"],["H*", "$3"]]
		]
	},
	"auxiliary/scanner/http/joomla_gallerywd_sqli_scanner": {
		"defaultPort": [80],
		"seq": [
			["regex", "CONCAT\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["H*", "$1"],["H*", "$2"],["H*", "$3"]]
		]
	},
	"auxiliary/scanner/http/joomla_pages": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /admin/ HTTP/1.1"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nadministration console\n"],
			["any"],
			["HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n"]
		]
	},
	"auxiliary/scanner/http/joomla_plugins": {
		"desc": "there is a bug in this module, raised the issue in #7854",
		"defaultPort": [80],
		"seq": [
			["starts", "GET / "],
			["HTTP/1.1 200 Ok\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["any"],
			["HTTP/1.1 200 Ok\r\nContent-Length: 15\r\n\r\nfoundit plugin!"]
		]
	},
	"auxiliary/scanner/http/joomla_version": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /administrator/manifests/files/joomla.xml"],
			["HTTP/1.1 200 OK\r\nServer: joomla 2.0\r\nContent-Length: $\r\n\r\n<version>ver2.0</version>"],
			["starts", "GET / "],
			["HTTP/1.1 200 OK\r\nServer: joomla 2.0\r\nContent-Length: $\r\n\r\n<html><body><META content=\"joomla!\"></body></html>"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/linknat_vos_traversal": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/linksys_e1500_traversal": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: httpd\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/litespeed_source_disclosure": {
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: LiteSpeed\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/lucky_punch": {
		"desc": "the code is not complete, just send the req.",
		"defaultPort": [80],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: LiteSpeed\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/cisco_asa_asdm": {
		"defaultPort": [443],
		"seq": [
			["starts", "GET "],
			["HTTP/1.1 401 Not Authorized\r\nWWW-Authenticate: NTLM\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["starts", "POST "],
			["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nSSL VPN Service Success success!"]
		]
	},
	"auxiliary/scanner/http/owa_login": {
		"defaultPort": [443],
		"extraCmds": "set USERPASS_FILE userpass.lst",
		"seq": [
			["starts", "GET /aspnet_client"],
			["HTTP/1.1 401 Not Authorized\r\nWWW-Authenticate:NTLM TlRMTVNTUAACAAAADAAMADAAAAABAoEAAAABI0VnZXhhbXBsZQAAAAAAYgBiADwAAAAAAEQATwBNAEEASQBOAAIADABEAE8ATQBBAAAASQBOAAEADABTAEUAUgBWAEUAUgAEABQAAABkAG8AbQBhAGkAbgAuAGMAbwBtAAMAIgAAAHMAZQByAHYAZQByAC4AZABvAG0AYQBpAAAAbgAuAGMAbwBtAAAAAAA=\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["substr", "username=DOMA\\root&password=password"],
			["HTTP/1.1 301 Redirect\r\nLocation: /expiredpassword\r\nContent-Length: 0\r\n\r\n"],
			["starts", "POST /owa/auth.owa"],
			["HTTP/1.1 301 Redirecte\r\nLocation: /login?reason=mismatch\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
		]
	},
	"auxiliary/scanner/http/cisco_ironport_enum": {
		"defaultPort": [443],
		"seq": [
			["starts", "GET / "],
			["HTTP/1.1 200 OK\r\nSet-Cookie: sessid=123;\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["starts", "GET /help/wwhelp/wwhimpl/common"],
			["HTTP/1.1 200 OK\r\nContent-Length: 77\r\n\r\n<title>Cisco IronPort AsyncOS 10.2 for Security Management Appliances</title>"],
			["substr", "username=admin&password=ironport"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: authenticated=1;\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
		]
	},
	"auxiliary/scanner/http/chef_webui_login": {
		"defaultPort": [443],
		"seq": [
			["starts", "GET /users/login"],
			["HTTP/1.1 200 OK\r\nContent-Length: 87\r\n\r\n<title>Chef Server</title><input name=\"authenticity_token\" type=\"hidden\" value=\"12345\">"],
			["starts", "GET /users/admin/edit"],
			["HTTP/1.1 200 OK\r\nContent-Length: 25\r\n\r\nNew password for the User"],
			["substr", "name=admin&password=admin"],
			["HTTP/1.1 302 Moved\r\nContent-Length: 25\r\n\r\nNew password for the User"],
			["starts", "POST /users/login_exec"],
			["HTTP/1.1 200 OK\r\nContent-Length: 25\r\n\r\nNew password for the User"]
		]
	},
	"auxiliary/scanner/http/cisco_nac_manager_traversal": {
		"defaultPort": [443],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: $\r\n\r\n{\"message\": \"success\"}"]
		]
	},
	"auxiliary/scanner/http/cisco_ssl_vpn": {
		"defaultPort": [443],
		"seq": [
			["substr", "password=cisco"],
			["HTTP/1.1 200 OK\r\nContent-Length: 29\r\n\r\nSSL VPN Service,webvpn_logout"],
			["substr", "fcadbadd=1 HTTP"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwebvpnlogin"],
			["starts", "GET /+CSCOE+/logon.html"],
			["HTTP/1.1 302 Moved\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
			
		]
	},
	"auxiliary/scanner/http/cisco_ssl_vpn_priv_esc": {
		"defaultPort": [443],
		"seq": [
			["starts", "GET /admin/exec/show+version"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: webvpn=1234;\r\nContent-Length: 55\r\n\r\nCisco Adaptive Security Appliance Software Version 10.87"],
			["substr", "password=clientless"],
			["HTTP/1.1 200 OK\r\nSet-Cookie: webvpn=1234;\r\nContent-Length: 29\r\n\r\nSSL VPN Service,webvpn_logout"],
			["substr", "fcadbadd=1 HTTP"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwebvpnlogin"],
			["starts", "GET /+CSCOE+/logon.html"],
			["HTTP/1.1 302 Moved\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
			
		]
	},
	"auxiliary/scanner/http/dell_idrac": {
		"defaultPort": [443],
		"seq": [
			["starts", "GET "],
			["HTTP/1.1 200 OK\r\nContent-Length: 13\r\n\r\n<authResult>1"],
			["substr", "password=calvin"],
			["HTTP/1.1 200 OK\r\nContent-Length: 26\r\n\r\n<authResult>0<\/authResult>"],
			["starts", "POST "],
			["HTTP/1.1 200 OK\r\nContent-Length: 26\r\n\r\n<authResult>6<\/authResult>"]
		]
	},
	"auxiliary/scanner/http/http_hsts": {
		"defaultPort": [443],
		"seq": [
			["starts", "GET / HTTP/1.1"],
			["HTTP/1.1 200 OK\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Length: 0\r\n\r\n"]
		]
	},
	"auxiliary/scanner/http/infovista_enum": {
		"defaultPort": [443],
		"seq": [
			["starts", "GET /VPortal/ HTTP/1.1"],
			["HTTP/1.1 200 OK\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Length: 0\r\n\r\n", "InfoVista VistaPortal\nPORTAL_VERSION = 2.0"],
			["starts", "POST /VPortal/mgtconsole/CheckPassword.jsp"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nlocation.href AdminFrame.jsp"]
		]
	},
	"auxiliary/scanner/http/glassfish_login": {
		"defaultPort": [4848],
		"seq": [
			["starts", "GET /common/applications/uploadFrame.jsf"],
			["HTTP/1.1 200 OK\r\nServer: GlassFish v3\r\nContent-Length: 37\r\n\r\n<title>Deploy Applications or Modules"],
			["substr", "j_username=root&j_password=password"],
			["HTTP/1.1 302 Moved\r\nServer: GlassFish v3\r\nContent-Length: 45\r\n\r\n<title>Deploy Enterprise Applications/Modules"],
			["starts", "POST /j_security_check"],
			["HTTP/1.1 404 Not Found\r\nServer: GlassFish v3\r\nContent-Length: 45\r\n\r\n<title>Deploy Enterprise Applications/Modules"],
			["starts", "GET /login.jsf"],
			["HTTP/1.1 302 Moved\r\nServer: GlassFish Server 3.2\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["starts", "GET /common/index.jsf"],
			["HTTP/1.1 200 OK\r\nServer: GlassFish v2\r\nContent-Length: 10\r\n\r\nwelcome!!!"],
			["any"],
			["HTTP/1.1 404 Not Found\r\nServer: GlassFish v2\r\nContent-Length: 10\r\n\r\nTry again!"]
		]
	},
	"auxiliary/scanner/x11/open_x11": {
		"defaultPort": [6000],
		"seq": [
			["equal", ["H*", "6c000b000000000000000000"]],
			[["C", 1], ["repeat", " ", 23], ["v", 12], ["repeat", " ", 14], "rapid7rocks!"]
		]
	},
	"auxiliary/scanner/http/manageengine_deviceexpert_traversal": {
		"defaultPort": [6060],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"auxiliary/scanner/http/manageengine_deviceexpert_user_creds": {
		"defaultPort": [6060],
		"seq": [
			["starts", "GET /ReadUsersFromMasterServlet"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n<discoverydata><username>john</username><password>vZnXhXX9w+nNPeTeHKGW2g</password><userrole>admin</userrole><emailid>john@abc.com</emailid><saltvalue>deadface</saltvalue></discoverydata>"]
		]
	},
	"auxiliary/scanner/http/appletv_login": {
		"defaultPort": [7000],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"]
		]
	},
	"auxiliary/scanner/http/groupwise_agents_http_traversal": {
		"defaultPort": [7181],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nServer: GroupWise\r\nContent-Length: 10\r\n\r\nwelcome!!!"]
		]
	},
	"exploit/linux/http/tr064_ntpserver_cmdinject": {
		"defaultPort": [7547],
		"seq": [
			["starts", "GET /globe"],
			["HTTP/1.1 404 OK\r\nContent-Length: 12\r\n\r\nhome_wan.htm"],
			["substr", "SetNTPServers"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["substr", "GetSecurityKeys"],
			["HTTP/1.1 200 OK\r\nContent-Length: 42\r\n\r\nNewPreSharedKey>987654321<\/NewPreSharedKey"]
		]
	},
	"auxiliary/scanner/http/barracuda_directory_traversal": {
		"defaultPort": [8000],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", ["append", "<html>", ["repeat", " ", 100], "<div src=\"barracuda.css\"></div>hello world</html>"]]
		]
	},
	"auxiliary/scanner/http/chromecast_webserver": {
		"defaultPort": [8008],
		"seq": [
			["substr", "j_username=admin&j_password=admin&"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", "{\"name\": \"jon\", \"ssid\": \"myPrivateSSID\"}"]
		]
	},
	"auxiliary/scanner/http/manageengine_desktop_central_login": {
		"defaultPort": [8020],
		"seq": [
			["substr", "j_username=admin&j_password=admin&"],
			["HTTP/1.1 302 Moved\r\nLocation: /main.html\r\nContent-Length: 0\r\n\r\n"],
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nManageEngine Desktop Central"]
		]
	},
	"auxiliary/scanner/http/axis_local_file_include": {
		"defaultPort": [8080],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", "axisconfig<div>parameter name=\"userName\">jdole</div><div>parameter name=\"password\">pass123</div>"]
		]
	},
	"auxiliary/scanner/http/hp_imc_bims_downloadservlet_traversal": {
		"defaultPort": [8080],
		"seq": [
			["starts", "GET /imc/login.jsf"],
			["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"],
			["starts", "GET /imc/bimsDownload?fileName=../.."],
			["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: 10\r\n\r\nmy secrete"]
		]
	},
	"auxiliary/scanner/http/hp_imc_faultdownloadservlet_traversal": {
		"defaultPort": [8080],
		"seq": [
			["starts", "GET /imc/login.jsf"],
			["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"],
			["starts", "GET /imc/tmp/fault/download?fileName=../../"],
			["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: 10\r\n\r\nmy secrete"]
		]
	},
	"auxiliary/scanner/http/hp_imc_ictdownloadservlet_traversal": {
		"defaultPort": [8080],
		"seq": [
			["starts", "GET /imc/login.jsf"],
			["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"],
			["starts", "GET /imc/tmp/ict/download?fileName=../../"],
			["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: 10\r\n\r\nmy secrete"]
		]
	},
	"auxiliary/scanner/http/hp_imc_reportimgservlt_traversal": {
		"seq": [
			["starts", "GET /imc/login.jsf"],
			["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"],
			["starts", "GET /imc/reportImg?path=../.."],
			["HTTP/1.1 200 OK\r\nContent-Type: image/png\r\nContent-Length: 10\r\n\r\nmy secrete"]
		]
	},
	"auxiliary/scanner/http/hp_imc_som_file_download": {
		"defaultPort": [8080],
		"seq": [
			["starts", "GET /servicedesk/ServiceDesk.jsp"],
			["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: $\r\n\r\nservicedesk/servicedesk"],
			["starts", "GET /servicedesk/servicedesk/fileDownload?OperType"],
			["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: $\r\n\r\nMy secret, hahaha"]
		]
	},
	"auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess": {
		"defaultPort": [8080],
		"seq": [
			["starts", "GET /SiteScope/services/APISiteScopeImpl HTTP"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nWelcome"],
			["substr", "testme.rapid7.com"],
			["HTTP/1.1 200 OK\r\nContent-Type: multipart; boundary=\"123456789\"\r\nContent-Length: $\r\n\r\ngetFileInternalReturn href=\"cid:DEADFACE\"\r\nDEADFACE>\r\n\r\n", ["gzip", "my secrets are all here!!"], "\r\n--123456789"],
			["starts", "POST /SiteScope/services/"],
			["HTTP/1.1 500 Internal Error\r\nContent-Length: $\r\n\r\n<ns3:hostname xmlns:ns3=\"http://xml.apache.org/axis/\">testme.rapid7.com</ns3:hostname>"]
		]
	},
	"auxiliary/scanner/http/hp_sitescope_getsitescopeconfiguration": {
		"defaultPort": [8080],
		"seq": [
			["starts", "GET /SiteScope/services/APISiteScopeImpl HTTP"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nWelcome"],
			["starts", "POST /SiteScope/services/APISiteScopeImpl"],
			["HTTP/1.1 200 OK\r\nContent-Type: multipart; boundary=\"123456789\"\r\nContent-Length: $\r\n\r\ngetSiteScopeConfigurationReturn href=\"cid:DEADFACE\"\r\nDEADFACE>\r\n\r\n", ["gzip", "my secrets are all here!!"], "\r\n--123456789"]
		]
	},
	"auxiliary/scanner/http/hp_sitescope_loadfilecontent_fileaccess": {
		"defaultPort": [8080],
		"seq": [
			["starts", "GET /SiteScope/services/APIMonitorImpl HTTP"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nWelcome"],
			["starts", "POST /SiteScope/services/APIMonitorImpl"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n<loadFileContentReturn xsi:type=\"xsd:string\">This is my secret hahahah!!!</loadFileContentReturn>"]
		]
	},
	"auxiliary/scanner/http/jboss_status": {
		"defaultPort": [8080],
		"seq": [
			["any"],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\n<title>Tomcat Status</title><strong></strong></td><td>1<\/td><td>2<\/td><td>3<\/td><td>4<\/td><td nowrap>50<\/td><td nowrap>60<\/td><\/tr><strong></strong></td><td>1b<\/td><td>2b<\/td><td>3b<\/td><td>4b<\/td><td nowrap>50b<\/td><td nowrap>60b<\/td><\/tr>"]
		]
	},
	"auxiliary/scanner/http/jenkins_login": {
		"defaultPort": [8080],
		"seq": [
			["substr", "j_username=admin&j_password=admin"],
			["HTTP/1.1 302 Moved\r\nLocation: /index.html\r\nContent-Length: $\r\n\r\n<title>Tomcat Status</title>"],
			["any"],
			["HTTP/1.1 302 Moved\r\nLocation: /loginError\r\nContent-Length: $\r\n\r\n<title>Tomcat Status</title>"]
		]
	},
	"auxiliary/scanner/http/influxdb_enum": {
		"defaultPort": [8086],
		"seq": [
			["starts", "GET /db HTTP"],
			["HTTP/1.1 200 OK\r\nX-Influxdb-Version: 2.0\r\nContent-Length: $\r\n\r\n", "{\"user\": \"admin\", \"password\": \"letmein\"}"]
		]
	},
	"auxiliary/scanner/http/apache_activemq_traversal": {
		"defaultPort": [8161],
		"seq": [
			["starts", "GET /\\.."],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", ["file", "secret.txt"]]
		]
	},
	"auxiliary/scanner/http/apache_activemq_source_disclosure": {
		"defaultPort": [8161],
		"seq": [
			["starts", "GET /admin/index.jsp"],
			["HTTP/1.1 200 OK\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", ["file", "secret.txt"]]
		]
	},
	"auxiliary/scanner/http/atlassian_crowd_fileaccess": {
		"defaultPort": [8095],
		"seq": [
			["starts", "GET "],
			["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"],
			["starts", "POST /crowd/services"],
			["HTTP/1.1 500 Server Internal Error\r\nContent-Length: ", ["nsize", 2], "\r\n\r\n", "<faultstring>Invalid boolean value: ?9876543210haha</faultstring>"]
		]
	},
	"auxiliary/scanner/http/elasticsearch_traversal": {
		"defaultPort": [9200],
		"seq": [
			["substr", "location\":\"dsr"],
			["HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\ntrue"],
			["starts", "GET _snapshot/pwn/ev1l"],
			["HTTP/1.1 400 Error\r\nContent-Length: 41\r\n\r\n{\"error\": \"32x32x115x101x99x114x101x116\"}"]
		]
	}, 
	"exploit/linux/http/atutor_filemanager_traversal": {
		"defaultPort": [80],
		"seq": [
			["starts", "GET /ATutor/mods/"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nGot it", ["action", ["connect", ":4444"]]],
			["starts", "GET "],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n<b>/root/jscripts/ATutor_js.php</b> "],
			["starts", "POST /ATutor/mods/_standard/tests/question_import.php"],
			["HTTP/1.1 302 Moved\r\nLocation: question_db.php\r\nContent-Length: 4\r\n\r\ntrue"],
			["any"],
			["HTTP/1.1 302 Moved\r\nLocation: bounce.php?course=0\r\nSet-Cookie: ATutorID=123a; ATutorID=123b; ATutorID=123c; ATutorID=123d;\r\nContent-Length: 4\r\n\r\ntrue"]
		]
	}, 
	"exploit/linux/http/kloxo_sqli": {
		"defaultPort": [7778],
		"seq": [
			["starts", "GET /display.php"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n<input type=hidden name=\"frm_subaction\" value =\"commandcenter\">\n<input type=hidden name=\"frm_o_o[5][class]\" value =\"adminuser\">\n<input type=hidden name=\"frm_o_o[5][nname]\" value =\"letmein\"> "],
			["starts", "POST /display.php"],
			["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nGot it", ["action", ["connect", ":4444"]]],
			["starts", "POST /htmllib/phplib/"],
			["HTTP/1.1 302 Moved\r\nLocation: question_db.php\r\nSet-Cookie: sessionid=10001\r\nContent-Length: 4\r\n\r\ntrue"],
			["starts", "GET /lbin/webcommand.php?login"],
			[["function", "kloxo_sqli"]],
			["starts", "GET /lbin/webcommand.php"],
			["HTTP/1.1 200\r\nContent-Length: $\r\n\r\n__error_only_clients_and_auxiliary_allowed_to_login"]
		]
	}
}