Implement 9 new Nuclei Templates for ASVS 4.0.3 Compliance Checks

.github/workflows/syntax-checking.yml

@@ -0,0 +1,20 @@
+name: ❄️ YAML Lint
+
+on: 
+  push:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Yamllint
+        uses: karancode/[email protected]
+        with:
+          yamllint_config_filepath: .yamllint
+          yamllint_strict: false
+          yamllint_comment: true

.github/workflows/template-validate.yml

@@ -0,0 +1,30 @@
+name: 🛠 Template Validate
+
+on:
+  push:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: 
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.21.x
+
+      - name: nuclei install
+        run: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+
+      - name: Template Validation
+        run: |
+          cp -r ${{ github.workspace }}/templates /home/runner/nuclei-templates
+          nuclei -duc -validate -allow-local-file-access
+          nuclei -duc -validate -allow-local-file-access -w /home/runner/nuclei-templates/workflows

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "Vulnerable-Pages"]
+	path = Vulnerable-Pages
+	url = https://github.com/Snbig/Vulnerable-Pages
+	branch = main

.yamllint

@@ -0,0 +1,25 @@
+---
+extends: default
+
+ignore: |
+  .pre-commit-config.yml
+  .github/
+  .git/
+  *.yml
+
+rules:
+  document-start: disable
+  line-length: disable
+  new-lines: disable
+  new-line-at-end-of-file: disable
+  truthy: disable
+  comments:
+    require-starting-space: true
+    ignore-shebangs: true
+    min-spaces-from-content: 1
+  empty-lines:
+    max: 5
+  braces:
+    forbid: true
+  brackets:
+    forbid: true

CONTRIBUTING.md

@@ -0,0 +1,16 @@
+
+## Contributing
+
+If you have any idea to improve templates or want to share experience and give feedback on this project, we'd love to hear from you in following ways:
+
+
+### Asking Questions
+You can use either Github [Discussions](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/discussions) or our [Slack channel](https://owasp.slack.com/archives/C052939BZ43) to ask questions.
+
+### Create issues
+
+Before raising pull requests, please create an [Issue](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/issues) first to be discussed for missing requirements, content or errors. Please explain the issue in detail including references if available and suggest where it could be added.
+
+### Open a Pull Request
+-  Your pull request may be merged after review.
+-   Commits must be [signed off](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt--s) to indicate agreement with [Developer Certificate of Origin (DCO)](https://developercertificate.org/).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 OWASP
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,34 @@
+[![❄️ YAML Lint](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/actions/workflows/syntax-checking.yml/badge.svg)](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/actions/workflows/syntax-checking.yml)
+[![🛠 Template Validate](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/actions/workflows/template-validate.yml/badge.svg)](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/actions/workflows/template-validate.yml)
+[![Vulnerable Pages](https://img.shields.io/website?labelColor=3D444C&link=https://vulnerable-pages.onrender.com/&label=%F0%9F%8E%AFVulnerable%20Pages&url=https://vulnerable-pages.onrender.com/)](https://vulnerable-pages.onrender.com/)
+
+<p align="center">
+<img src="https://github.com/user-attachments/assets/8f0b666e-a54c-45e9-9f33-4fa414fb122e">
+</p>
+
+# OWASP ASVS Security Evaluation Templates with Nuclei
+
+
+This project aims to develop  [Nuclei](https://github.com/projectdiscovery/nuclei) templates for evaluating OWASP Application Security Verification Standard ([ASVS](https://owasp.org/www-project-application-security-verification-standard/)) on websites and will involve creating templates that can be used to evaluate ASVS on websites, documenting the use of the templates, and designing and implementing a user interface for easy navigation and use of the templates. 
+
+ The goal is to provide security professionals with an easy-to-use set of tools to test their web applications and identify potential vulnerabilities.
+#### It's important to note that:
+- Since the implementation methods and frameworks used in web application design are very diverse, in this project we will consider the existing best practice designs and develop nuclei templates based on them :)
+- Also while these Nuclei templates are designed to help automate the process of evaluating web applications against ASVS requirements, they should not be considered a substitute for manual testing or other security best practices.
+- Some templates are developed for a limited or specific scenario and should be modified and perfected according to the needs of the evaluator/user.
+
+## Licensing
+[![alt-text](https://img.shields.io/github/license/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei)](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/blob/main/LICENSE)
+
+This program is free software: You can redistribute it and/or modify it under the terms of the MIT License.
+
+## Contributing
+
+Contributions to this repository are welcome and encouraged. If you have created new Nuclei templates that evaluate additional ASVS requirements or have any idea about current templates, we'd love to hear from you in project Github [Discussions](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/discussions) or our [Slack channel](https://owasp.slack.com/archives/C052939BZ43). 
+
+For detailed information and guidelines about contributing in developing template for ASVS evaluation, please check [CONTRIBUTING.md](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/blob/main/CONTRIBUTING.md)
+
+#### Core Team
+The project current core team are:
+- [Hamed Salimain](https://github.com/Snbig)  (Project Leader)
+

index.md

@@ -2,21 +2,18 @@
 
 layout: col-sidebar
 title: OWASP ASVS Security Evaluation Templates with Nuclei
-tags: example-tag
+tags: asvs-security-evaluation-templates-with-nuclei nuclei nuclei-templates asvs asvs-evaluation PoC-generator vulnerablity 
 level: 2
-type: 
-pitch: A very brief, one-line description of your project
+type: tool
+pitch: This project aims to develop nuclei templates for evaluating OWASP Application Security Verification Standard (ASVS) on websites.
 
 ---
 
-This is an example of a Project or Chapter Page.  Please change these items to indicate the actual information you wish to present.  In addition to this information, the 'front-matter' above this text should be modified to reflect your actual information.  An explanation of each of the front-matter items is below:
+This project aims to develop nuclei templates for evaluating OWASP Application Security Verification Standard (ASVS) on websites and will involve creating templates that can be used to evaluate ASVS on websites, documenting the use of the templates, and designing and implementing a user interface for easy navigation and use of the templates. The templates and user interface will be tested for accuracy and usability, and once finalized, they will be made available for use. User feedback and usage of the templates and user interface will be monitored and analyzed, and updates will be made to the templates and user interface based on this feedback and usage. Finally, the project will be documented for future reference.
 
-layout: This is the layout used by project and chapter pages.  You should leave this value as col-sidebar
+It's important to note that Since the implementation methods and frameworks used in web application design are very diverse, in this project, we will consider the existing best practice designs and develop nuclei templates based on them.
 
-title: This is the title of your project or chapter page, usually the name.  For example, OWASP Zed Attack Proxy or OWASP Baltimore
+## Licensing
+[![alt-text](https://img.shields.io/github/license/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei)](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/blob/main/LICENSE)
 
-tags: This is a space-delimited list of tags you associate with your project or chapter.  If you are using tabs, at least one of these tags should be unique in order to be used in the tabs files (an example tab is included in this repo) 
-
-level: For projects, this is your project level (2 - Incubator, 3 - Lab, 3.5 - Production, 4 - Flagship)
-
-type: code, tool, documentation, or other
+This program is free software: You can redistribute it and/or modify it under the terms of the MIT License.

info.md

@@ -1,16 +1,22 @@
-### ASVS Security Evaluation Templates with Nuclei Information
+### Project Information
 * [Incubator Project](#)
-* [Type of Project](#)
 * [Version 0.0.0](#)
-* [Builder](#)
-* [Breaker](#)
+
+### Classification
+* <i class="fas fa-tools" style="color:#233e81;"></i> Tool
 
-### Downloads or Social Links
-* [Download](#)
-* [Meetup](#)
+### Audience
+* <i class="fas fa-shield-alt" style="color:#233e81;"></i> Defender
+* <i class="fas fa-hammer" style="color:#233e81;"></i> Breaker
+
+### Community
+* [Slack Channel](https://owasp.slack.com/archives/C052939BZ43)
+
+### Statistics
+* [Daily Project Stats](#)
 
 ### Code Repository
-* [repo](#)
+* [repo](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei)
 
 ### Change Log
 * [changes](#)

tab_contributing.md

@@ -0,0 +1,17 @@
+---
+title: Contributing
+layout:  null
+tab: true
+order: 1
+tags: asvs-security-evaluation-templates-with-nuclei
+---
+
+## Contributing
+
+If you are interested in contributing to this project by sharing ideas to improve templates or giving feedback we will be happy to hear from you in project Github [Discussions](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/discussions) or our [Slack channel](https://owasp.slack.com/archives/C052939BZ43). 
+
+For detailed information and guidelines about contributing in "ASVS evaluation template development" please check [CONTRIBUTING.md](https://github.com/OWASP/www-project-asvs-security-evaluation-templates-with-nuclei/blob/main/CONTRIBUTING.md)
+
+### Core Team
+The project current core team are:
+- [Hamed Salimain](https://github.com/Snbig)  (Project Leader)

templates/.gitkeep

@@ -0,0 +1 @@
+

templates/12.1.1.yaml

@@ -0,0 +1,64 @@
+id: ASVS-4-0-3-V12-1-1
+
+info:
+  name: ASVS 12.1.1 Check
+  author: Hamed Salimian
+  severity: medium
+  classification:
+    cwe-id: CWE-400
+  reference:
+    - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods
+    - https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
+    - https://snbig.github.io/Vulnerable-Pages/ASVS_12_1_1/index.html
+  tags: asvs,12.1.1
+  description: |
+    Verify that the application will not accept large files that could fill up storage or cause a denial of service.
+
+
+variables:
+  large_file_size: 10000000
+  small_file_size: 100
+  file_type: "text/plain"
+  file_ext: "txt"
+
+http:
+  - raw:
+      - |
+        POST {{BaseURL}} HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryiugABg7zoMAxIKId
+
+        ------WebKitFormBoundaryiugABg7zoMAxIKId
+        Content-Disposition: form-data; name="file"; filename="{{randstr}}.{{file_ext}}"
+        Content-Type: {{file_type}}
+
+        {{rand_text_alpha({{small_file_size}})}}
+        ------WebKitFormBoundaryiugABg7zoMAxIKId--
+
+      - |
+        POST {{BaseURL}} HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryiugABg7zoMAxIKId
+
+        ------WebKitFormBoundaryiugABg7zoMAxIKId
+        Content-Disposition: form-data; name="file"; filename="{{randstr}}.{{file_ext}}"
+        Content-Type: {{file_type}}
+
+        {{rand_text_alpha({{large_file_size}})}}
+        ------WebKitFormBoundaryiugABg7zoMAxIKId--
+
+    extractors:
+      - type: dsl
+        name: status code of large file upload.
+        dsl:
+          - status_code_2
+
+    matchers:
+      - type: dsl
+        name: status_code
+        condition: and
+        dsl:
+          - status_code_2 < 210 && status_code_2 >= 200
+          - status_code_2 == status_code

templates/12.6.1.yaml

@@ -0,0 +1,58 @@
+id: ASVS-4-0-3-V12-6-1
+
+info:
+  name: ASVS 12.6.1 Check
+  author: AmirHossein Raeisi
+  severity: high
+  classification:
+    cwe-id: CWE-918
+  reference:
+    - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/19-Testing_for_Server-Side_Request_Forgery
+    - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
+    - https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/vulnerabilities/ssrf/blind-ssrf.yaml
+    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+    - https://snbig.github.io/Vulnerable-Pages/ASVS_12_6_1/
+  tags: asvs,12.6.1
+  description: |
+    Verify that the web or application server is configured with an allow list of resources or systems to which the server can send requests or load data/files from.
+
+http:
+  - pre-condition:
+      - type: dsl
+        dsl:
+          - 'method == "GET"'
+
+    payloads:
+      ssrf:
+        - "{{interactsh-url}}"
+        - "{{FQDN}}.{{interactsh-url}}"
+        - "{{RDN}}.{{interactsh-url}}"
+        - "{{FQDN}}@{{interactsh-url}}"
+        - "{{RDN}}@{{interactsh-url}}"
+
+    fuzzing:
+      - part: query
+        mode: single
+        fuzz:
+          - "https://{{ssrf}}"
+          - "{{ssrf}}:80"
+
+      - part: body
+        mode: single
+        fuzz:
+          - "https://{{ssrf}}"
+          - "{{ssrf}}:80"
+
+      - part: header
+        mode: single
+        fuzz:
+          - "https://{{ssrf}}"
+          - "{{ssrf}}:80"
+
+    stop-at-first-match: true
+    matchers:
+      - type: word
+        part: interactsh_protocol  # Confirms the HTTP Interaction
+        words:
+          - "http"
+          - "dns"