Update printers-info-leak template with improved metadata and structure

- Added proper impact and remediation sections
- Enhanced description with PJL context
- Added vendor and product metadata fields
- Added shodan-query for better discoverability
- Added pjl tag for better categorization
- Added additional reference for PJL documentation
- Enhanced template structure following review guidelines

http/exposed-panels/ysoft/safeq-panel.yaml

@@ -1,63 +0,0 @@
-id: ysoft-safeq-panel
-
-info:
-  name: YSoft SafeQ - Panel Exposure
-  author: matejsmycka
-  severity: info
-  description: |
-    YSoft SafeQ is a comprehensive print management solution used by many organizations to manage printer infrastructure. An exposed YSoft SafeQ panel may reveal sensitive organizational information and provide unauthorized access to print management capabilities.
-  impact: |
-    Exposed YSoft SafeQ panels can lead to unauthorized access to print management systems, potentially allowing attackers to monitor print activities, access sensitive documents, or disrupt printing services.
-  remediation: |
-    Ensure YSoft SafeQ panels are only accessible from internal networks or properly secured with authentication and access controls. Consider implementing VPN access for remote administration.
-  reference:
-    - https://www.ysoft.com/safeq
-    - https://1617882505.rsc.cdn77.org/YSoft_SAFEQ_Cloud_documentation.pdf
-  metadata:
-    verified: true
-    max-request: 2
-    shodan-query:
-      - title:"YSoft SafeQ"
-      - title:"SafeQ®"
-      - http.favicon.hash:-608698287
-      - http.favicon.hash:93381563
-    fofa-query:
-      - title="YSoft SafeQ"
-      - title="SafeQ®"
-      - icon_hash="-608698287"
-      - icon_hash="93381563"
-    zoomeye-query:
-      - title:"YSoft SafeQ"
-      - title:"SafeQ"
-  tags: panel,ysoft,safeq,exposure,misconfig
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-      - "{{BaseURL}}/login"
-
-    stop-at-first-match: true
-    host-redirects: true
-    max-redirects: 2
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "YSoft SafeQ"
-          - "Y Soft Corporation, a.s."
-        condition: or
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - 'YSoft (?:SafeQ|Framework) v?([0-9\.]+)'
-        name: version

network/misconfig/printers-info-leak.yaml

@@ -5,23 +5,34 @@ info:
   author: pussycat0x
   severity: info
   description: |
-    Unauthorized access to printers allows attackers to print, eavesdrop sensitive documents.
+    Unauthorized access to printers allows attackers to print, eavesdrop on sensitive documents, and potentially execute commands through PJL (Printer Job Language).
+  impact: |
+    Attackers can gain access to sensitive printed documents, manipulate print jobs, and potentially compromise printer security.
+  remediation: |
+    Implement proper network segmentation, disable unnecessary printer services, and ensure printers are not directly accessible from untrusted networks.
   reference:
     - https://book.hacktricks.xyz/pentesting/9100-pjl
+    - https://en.wikipedia.org/wiki/Printer_Job_Language
   metadata:
     max-request: 1
-  tags: network,iot,printer,misconfig,tcp
+    vendor: generic
+    product: printer
+    shodan-query: port:9100
+  tags: network,iot,printer,misconfig,tcp,pjl
 tcp:
   - inputs:
-      - data: "@PJL INFO STATUS\n"
+      - data: "@PJL INFO ID\n"
     host:
       - "{{Hostname}}"
     port: 9100
 
     matchers:
-      - type: word
-        words:
-          - "CODE="
-          - "PJL INFO STATUS"
-        condition: and
-# digest: 4a0a00473045022100e5cd3caafcba367256fc02a088505cf294ceb9eba20a33e032ce2aca6b16c8110220510d9b154b7130143030f9f441ed0a1ea44c52053a2fb945d9a603d59c122f95:922c64590222798bb761d5b6d8e72950
+      - type: binary
+        binary:
+          - "40504a4c20494e464f2049440d0a22"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - '"([^"]+)"'