Bug Bounty

What would you like to happen?
The sections 4.7.11.1 Testing for Local File Inclusion & 4.7.11.2 Testing for Remote File Inclusion address two attack vectors that are very similar one to the other. Given this situation and the few documentation on the Remote injection one, my proposal would be to merge both in a single section called Testing for File Injection.

Is subdomains hosted at discourse is vulnerable to takeover or not?

Here is a simple template for the default administration password on ZyXEL devices. I tested it only on two different ZyXEL devices, the authentication flow and the resulting page may differ on other models, so it needs more tests.

id: zyxel-default-password

info:
  name: ZyXEL Default Password
  author: wtzu
  severity: high
  tags: zyxel

requests:
  - raw:
      - |