Skip to content

Commit 3ff9602

Browse files
MaikuolanMaikuolan
committed
Extras module update.
1 parent d75725b commit 3ff9602

File tree

2 files changed

+49
-14
lines changed

2 files changed

+49
-14
lines changed

‎modules/module_extras.php‎

Lines changed: 47 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Optional security extras module (last modified: 2025.08.21).
11+
* This file: Optional security extras module (last modified: 2025.08.24).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -93,11 +93,11 @@
9393

9494
/** Probing for unsecured WordPress configuration files. */
9595
if ($Trigger(preg_match(
96-
'~(?:^|[/?.]|\._)wp-config\.php(?:\.(?:bak\d*|bkp|conf|dist|du?mp|inc|new|old|orig|sw.|tar|te?mp|txt|[\d\~#_]+)|[-.]backup)?(?:$|[/?])~',
96+
'~(?:^|[/?.]|\._)wp-config(?:\.(?:\d+|new|php)|_backup)(?:\.(?:bak\d*|bkp|conf|dist|du?mp|inc|new|old|orig|sw.|tar|te?mp|txt)|\.?[\d\~#_]+|[-.]backup)?(?:$|[/?])~',
9797
$LCNrURI
9898
), 'Probing for unsecured WordPress configuration files not allowed')) {
99-
$CIDRAM['Reporter']->report([15, 20, 21], ['Caught probing for unsecured WordPress configuration files.'], $CIDRAM['BlockInfo']['IPAddr']);
100-
} // 2023.09.02 mod 2025.07.11
99+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for unsecured WordPress configuration files.'], $CIDRAM['BlockInfo']['IPAddr']);
100+
} // 2023.09.02 mod 2025.08.24
101101

102102
/** Probing for webshells/backdoors. */
103103
if (
@@ -114,7 +114,7 @@
114114
'd(?:7|eadcode\d*|elpaths|epotcv|isagraep|kiz|oiconvs|ummyyummy/wp-signup)|' .
115115
'e(?:ctoplasm/str_shuffcle|e|pinyins|rin\d+)|' .
116116
'f(?:ddqradz|ilefun)|' .
117-
'g(?:awean|dftps|el4y|etid3-core|h[0o]st|lab-rare|zismexv)|' .
117+
'g(?:awean|dftps|eju|el4y|etid3-core|h[0o]st|lab-rare|odsend|zismexv)|' .
118118
'h(?:[4a]x+[0o]r|6ss|anna1337|ehehe|sfpdcd|tmlawedtest)|' .
119119
'i(?:\d{3,}[a-z]{2,}|cesword|d3/class-config|mages/sym|ndoxploit|optimize|oxi\d*|r7szrsouep|itsec|xr/(?:allez|wp-login))|' .
120120
'k(?:i1k|vkjguw)|' .
@@ -125,13 +125,13 @@
125125
'p(?:erl\.alfa|hp(?:1|_niu_\d+)|huploader|lugins/(?:backup_index|vwcleanerplugin/bump|zedd/\d+)|oison|rayer_intentions|riv8|wnd|zaiihfi)|' .
126126
'qxuho|' .
127127
'r(?:andkeyword|endixd)|' .
128-
's(?:_n?e|eoplugins/mar|ession91|h[3e]ll[sx]?\d*|hrift|idwso|ilic|kipper(?:shell)?|llolx|onarxleetxd|pammervip|rc/util/php/(?:eval(?:-stdin)?|kill)|ystem_log)|' .
128+
's(?:_n?e|eoplugins/mar|ession91|h[3e]ll[sxz]?\d*|hrift|idwso|ilic|kipper(?:shell)?|llolx|onarxleetxd|pammervip|rc/util/php/(?:eval(?:-stdin)?|kill)|ystem_log)|' .
129129
't(?:62|aptap-null|enda\.sh.*tenda\.sh|emplates/beez/index|hemes/(?:finley/min|pridmag/db|universal-news/www)|ermps|homs|hreefox(?:_exploit/index)?|inymce/(?:langs/about|plugins/compat3x/css/index)|k_dencode_\d+|mp/vuln|opxoh/(?:drsx|wdr))|' .
130130
'u(?:bh/up|nisibfu|pfile(?:_\\(\d\\))?|pgrade-temp-backup/wp-login|ploader_by_cloud7_agath|tchiha(?:_uploader)?)|' .
131131
'v(?:endor/bin/loader|zlateam)|' .
132132
'w(?:[0o]rm\d+|0rdpr3ssnew|alker-nva|ebshell-[a-z\d]+|idgets-nva|idwsisw|loymzuk|orksec)|' .
133133
'wp[-_](?:2019|22|(?:admin(?:/images)?|content|css(?:/colors)?|includes(?:/ixr|/customize|/pomo)?|js(?:/widgets)?|network)/(?:[^?]*wp-login|0|aaa|cof|css/(?:about|acces|bgfbmo|colors/blue/file|dist/niil|gecko|ok)|dropdown|fgertreyersd|id3/about|(?:images|widgets)/include|includes/lint-branch|install|js/(?:codemirror/\d+|jcrop/jcrop|privacy-tools\.min)|mah|maint/(?:aaa|fie|fw|lint-branch|lmfi2)|(?:random_compat/|requests/)?class(?:_api|-wp-page-[\da-z]{5,})|repeater|rk2|simple|text/(?:about|diff/renderer/last)|themes/hello-element/footer|uploads/(?:admin|error_log)|vuln)|conflg|content/plugins/(?:about|backup-backup/includes/hro|cache/dropdown|contact-form-7/.+styles-rtl|contus-hd-flv-player/uploadvideo|(?:core-plugin/|wordpresscore/)?include|dzs-zoomsounds/savepng|fix/up|(?:view-more/)?ioxi|wp-automatic/inc/csv|wp-file-manager/lib/php/connector\.minimal|wp-content/uploads/.+)|filemanager|setups|sigunq|sts|p)|' .
134-
'wp-(?:aa|beckup|configs|(?:content/uploads|includes/(?:customize|js))/(?:autoload_classmap|wp-stream)|l0gins?|mail\.php/wp-includes(?:/id3/[\da-z]+)?|mna|red)|' .
134+
'wp-(?:aa|beckup|configs|(?:content/uploads|includes/(?:customize|js))/(?:autoload_classmap|wp-stream)|l0gins?|mail\.php/wp-includes(?:/id3/[\da-z]+)?|mna|red|zett)|' .
135135
'ws[ou](?:yanz)?(?:[\d.]*|[\da-z]{4,})|wwdv|' .
136136
'x(?:iaom|ichang/x|m(?:lrpcs|lrpz|rlpc)|s?hell|w|x{2,}|x*l(?:\d+|eet(?:mailer|-shell)?x?))|' .
137137
'ya?nz|yyobang/mar|' .
@@ -141,7 +141,7 @@
141141
')\.php[578]?(?:$|[/?])|' .
142142
'funs\.php[578]?(?:$|[/?])~',
143143
$LCNrURI
144-
), 'Probing for webshells/backdoors') || // 2023.08.18 mod 2025.08.11
144+
), 'Probing for webshells/backdoors') || // 2023.08.18 mod 2025.08.24
145145
$Trigger(preg_match('~(?:^|[/?])(?:brutalshell|css/dmtixucz/golden-access|fierzashell\.html?|perl.alfa|search/label/php-shells|wp-ksv1i\.ph)(?:$|[/?])~', $LCNrURI), 'Probing for webshells/backdoors') || // 2025.05.12 mod 2025.08.07
146146
$Trigger(preg_match('~(?:^|[/?])(?:moon\.php|ss\.php)\?(?:f_c|p)=~', $LCNrURI), 'Probing for webshells/backdoors') // 2025.08.07
147147
) {
@@ -218,9 +218,9 @@
218218
} // 2022.06.05 mod 2023.09.04
219219

220220
/** Probing for exposed AWS credentials. */
221-
if ($Trigger(preg_match('~(?:^|[/?])(?:\.?aws_?/(?:config(?:uration)?|credentials?)(?:\.yml)?|\.?aws\.yml|config/aws\.json)(?:$|[/?])~', $LCNrURI), 'Probing for exposed AWS credentials')) {
221+
if ($Trigger(preg_match('~(?:^|[/?])(?:\.?aws_?/(?:config(?:uration)?|credentials?)(?:\.yml)?|\.?aws\.yml|aws[_-]secrets?\.ya?ml|config/aws\.json)(?:$|[/?])~', $LCNrURI), 'Probing for exposed AWS credentials')) {
222222
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed AWS credentials.'], $CIDRAM['BlockInfo']['IPAddr']);
223-
} // 2023.09.04 mod 2025.08.07
223+
} // 2023.09.04 mod 2025.08.24
224224

225225
/** Probing for exposed FTP credentials. */
226226
if ($Trigger(preg_match('~(?:^|[/?])\.?s?ftp-(?:config|sync)\.json(?:$|[/?])~', $LCNrURI), 'Probing for exposed FTP credentials')) {
@@ -278,9 +278,9 @@
278278
} // 2025.08.02
279279

280280
/** Probing for env file. */
281-
if ($Trigger(preg_match('~(?:^|[/?=])(?:config|secrets?)?\.env(?:\.[\da-z]+)?(?:$|[/?])~', $LCNrURI), 'Probing for env file')) {
281+
if ($Trigger(preg_match('~(?:^|[/?=])(?:config|secrets?)?\.env(?:\.[\da-z]+)*(?:$|[/?])~', $LCNrURI), 'Probing for env file')) {
282282
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for env file.'], $CIDRAM['BlockInfo']['IPAddr']);
283-
} // 2025.03.18 mod 2025.08.02
283+
} // 2025.03.18 mod 2025.08.24
284284

285285
/** Probing for unsecured configuration file. */
286286
if ($Trigger(preg_match('~(?:^|[/?])\.?config.ya?ml(?:$|[/?])~', $LCNrURI), 'Probing for unsecured configuration file')) {
@@ -403,6 +403,41 @@
403403
if ($Trigger(preg_match('~(?:^|[/?])(?:tmp/errors[._]log|php_error_log)(?:$|[/?])~', $LCNrURI), 'Probing for exposed error logs')) {
404404
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed error logs.'], $CIDRAM['BlockInfo']['IPAddr']);
405405
} // 2025.08.13
406+
407+
/** Probing for exposed shell/bash configuration/setup files. */
408+
if ($Trigger(preg_match('~(?:^|[/?])config\.sh(?:$|[/?])~', $LCNrURI), 'Probing for exposed shell/bash configuration/setup files')) {
409+
$CIDRAM['Reporter']->report([15], ['Caught probing for exposed shell/bash configuration/setup files.'], $CIDRAM['BlockInfo']['IPAddr']);
410+
} // 2025.08.24
411+
412+
/** Probing for exposed Kubernetes secrets. */
413+
if ($Trigger(preg_match('~(?:^|[/?])secrets\.sh(?:$|[/?])~', $LCNrURI), 'Probing for exposed Kubernetes secrets')) {
414+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Kubernetes secrets.'], $CIDRAM['BlockInfo']['IPAddr']);
415+
} // 2025.08.24
416+
417+
/** Probing for exposed SparkPost API keys. */
418+
if ($Trigger(preg_match('~(?:^|[/?])sparkpost(?:_(?:config|keys)(?:\.env|-py)?|\.(?:env|py))(?:$|[/?])~', $LCNrURI), 'Probing for exposed SparkPost API keys')) {
419+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed SparkPost API keys.'], $CIDRAM['BlockInfo']['IPAddr']);
420+
} // 2025.08.24
421+
422+
/** Probing for exposed PyPI logs. */
423+
if ($Trigger(preg_match('~(?:^|[/?])pip/log\.txt(?:$|[/?])~', $LCNrURI), 'Probing for exposed PyPI logs')) {
424+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed PyPI logs.'], $CIDRAM['BlockInfo']['IPAddr']);
425+
} // 2025.08.24
426+
427+
/** Probing for printenv.tmp file. */
428+
if ($Trigger(preg_match('~(?:^|[/?])printenv\.tmp(?:$|[/?])~', $LCNrURI), 'Probing for exposed printenv.tmp file')) {
429+
$CIDRAM['Reporter']->report([15], ['Caught probing for exposed printenv.tmp file.'], $CIDRAM['BlockInfo']['IPAddr']);
430+
} // 2025.08.24
431+
432+
/** Probing for exposed Jenkins configuration file. */
433+
if ($Trigger(preg_match('~(?:^|[/?])\.?jenkins\.sh|jenkinsfile(?:$|[/?])~', $LCNrURI), 'Probing for exposed Jenkins configuration file')) {
434+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Jenkins configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
435+
} // 2025.08.24
436+
437+
/** Probing for exposed Python application setup file. */
438+
if ($Trigger(preg_match('~(?:^|[/?])setup\.py(?:$|[/?])~', $LCNrURI), 'Probing for exposed Python application setup file')) {
439+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Python application setup file.'], $CIDRAM['BlockInfo']['IPAddr']);
440+
} // 2025.08.24
406441
}
407442

408443
/**

‎modules/modules.dat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ module_cookies.php:
239239
module_extras.php:
240240
Name: "Optional security extras module"
241241
False Positive Risk: "Medium"
242-
Version: "2025.232.0"
242+
Version: "2025.235.0"
243243
Dependencies:
244244
PHP: "^5.4|^7|^8"
245245
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -254,7 +254,7 @@ module_extras.php:
254254
- "module_extras.php"
255255
- "module_extras.yaml"
256256
Checksum:
257-
- "ac5fd6425f5a775789b802b534727bf20c0424ca0d730849b0bbcdf7ab54861b:47690"
257+
- "42c6b8dddcf528374dfeb49eecc973ed8d44b8012449fd9c9e18098eea20ebed:50258"
258258
- "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
259259
Used with: "modules"
260260
Reannotate: "modules.dat"

0 commit comments

Comments
 (0)