The Template and the Target — The Web Scanner Is Public Too

TI-2026-069B · Series: 🧰 The Open Armory · TLP:WHITE · 2026-07-09

069A showed the password list is a public repo. This is the web half: every exploit path hammering our HTTP edge is a public YAML template — ranked by exploitability — sitting in our own library beside the attacker's copy.

📋 The Short Version

The credential attack (069A) runs on SecLists. The web attack runs on Nuclei — ProjectDiscovery's open-source scanning engine, a corpus of YAML templates each describing one exploit or exposure, complete with CVSS, CWE and EPSS exploitability scores. We hold it in our OSINT library. So does every attacker.

One file in that library, nuclei-0013, is the "Git Configuration - Detect" template — path: {{BaseURL}}/.git/config. And we watch 569 IPs fire exactly that path at us. The template and the scan are the same object.

Across the edge we observed 2,010 distinct exploit paths, and they group with almost no residue into named public template families. The attacker's web arsenal isn't a secret. It's a repository — and it comes pre-ranked so the operator knows which exploits to try first.

Confidence: HIGH on the observed paths and the library holdings. MEDIUM that a given scan used Nuclei specifically rather than an interchangeable public scanner.

1. A Library File Is the Exploit

Here is nuclei-0013.txt from our library, unedited:

info:
  name: Git Configuration - Detect
  severity: medium
  classification:
    cvss-score: 5.3
    cwe-id: CWE-200
  tags: config,git,exposure,vuln
http:
  - method: GET
    path:
      - "{{BaseURL}}/.git/config"
    matchers:
      - type: word
        part: body
        words: ["[core]"]

That is not a description of an attack. It is the attack — a machine-runnable definition of a path to request and a response to match. And it is the path 569 IPs requested against us (/.git/config, /api/.git/config; 3,101 hits). We are reading the weapon and watching it fire from the same shelf.

2. The 2,010 Paths Are Named Public Templates

Group everything the edge saw, and the residue is near zero — each cluster is a public template or template pack:

2,010 distinct exploit/exposure paths in total — every one of them a line in a public template. The Spring Actuator cluster is the Actuator exposure pack (its 36 endpoints); the ProxyShell cluster is CVE-2021-34473; the .action cluster is Struts. Nothing here was invented for us. It was downloaded.

3. The Breadth Belongs to the Template, Not the Attacker

Look at the .env row: 1,758 distinct paths from 539 IPs. That number can look like meticulous, creative reconnaissance. It is the opposite.

It is a single template's built-in enumeration of every place a framework might leak secrets — /.env, /api/.env, /api/v1/.env, /api/v2/.env, /api/v3/.env, /.env.local, /.env.backup, /.env.bak, /.env.dev, /.env.prod, /backend/.env, and 1,700 more — fired exhaustively by a loop. The operator did not think of 1,758 paths. They ran one file that contains them.

Do not mistake a wide scan for a skilled attacker. Breadth is a downloaded capability now, available to anyone who can type nuclei -u.

4. The Arsenal Comes Pre-Ranked

This is the detail that separates the modern armory from a dusty exploit list: the templates carry their own targeting intelligence.

Library file nuclei-0012 is CVE-2025-32395 (Vite path traversal) — a current-year template already in the corpus, and it ships with an EPSS exploitability percentile and Shodan/FOFA dorks to find vulnerable hosts. Every template embeds CVSS, CWE, EPSS and severity. So the scanner does not just carry exploits; it carries a ranking of which exploits are most likely to succeed right now.

The attacker inherits the prioritization for free. The barrier to competent web exploitation has fallen to near zero: the tool picks the high-probability targets itself.

5. Templates Outlive Their Patches

We still see ProxyShell (/ecp/Current/exporttool/…, CVE-2021-34473) probed by 73 IPs, and Struts /login.action by 59 — years after disclosure, patch, and news cycle.

That is not attacker stupidity. It is template persistence. Once a CVE is templated, it stays in the public corpus forever and keeps being fired at every host that might still be unpatched — and some always are. The operational lifetime of an exploit is set by the template, not the vulnerability's age. Old CVEs never stop being scanned; they just wait.

6. Why This Matters — and the Honest Limit

For defense. The exposure corpus is the detection ruleset. You can load the same Nuclei templates the attacker runs and (a) audit your own estate against them before they do, and (b) alert on any source that traverses the corpus against you. The paths are public; your advantage is running them first, on yourself.

The honest limit. Nuclei and Exploit-DB are defenders' tools — auditors and blue teams live in them. Holding or running a template proves nothing about intent, exactly as a SecLists wordlist didn't in 069A. What is hostile is executing the exposure corpus against a stranger's production edge. The template is neutral. Aiming the whole library at someone else's site is the act.

Same doctrine, third time from a new angle: judge the behavior, not the artifact. The Open Armory has one shelf left worth walking — the exploit proofs (Exploit-DB) and the CVE catalog as the attacker's changelog — and the same rule will hold there.

Investigation Metadata

Cross-references: TI-2026-069A (The Open Armory — the credential dictionary) · TI-2026-059A (The Secret Harvest — the .env template in action) · TI-2026-067A (The Steady State — templated scans are one of the four fixed shapes) · TI-2026-059B (The Azure Shell Game — the filemanager/webshell templates).