Skip to content

Commit 4480f4e

Browse files
securestep9securestep9
authored
Merge branch 'master' into master
2 parents c326796 + 625b507 commit 4480f4e

10 files changed

+295
-6
lines changed

‎lib/payloads/wordlists/wp_plugin_small.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ placester
145145
plugin-dir
146146
plugin-newsletter
147147
post-highlights
148+
post-smtp
148149
premium_gallery_manager
149150
pretty-link
150151
profiles

‎modules/scan/citrix_lastpatcheddate.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
info:
2+
name: citrix_lastpatcheeddate_scan
3+
author: OWASP Nettacker Team
4+
severity: 3
5+
description: Citrix Netscaler Gateway Last Patched Date Scan
6+
reference:
7+
profiles:
8+
- scan
9+
- http
10+
- citrix
11+
- low_severity
12+
13+
payloads:
14+
- library: http
15+
steps:
16+
- method: head
17+
timeout: 3
18+
headers:
19+
User-Agent: "{user_agent}"
20+
allow_redirects: false
21+
ssl: false
22+
url:
23+
nettacker_fuzzer:
24+
input_format: "{{schema}}://{target}:{{ports}}/epa/scripts/win/nsepa_setup.exe"
25+
prefix: ""
26+
suffix: ""
27+
interceptors:
28+
data:
29+
schema:
30+
- "http"
31+
- "https"
32+
ports:
33+
- 80
34+
- 443
35+
response:
36+
condition_type: and
37+
log: "response_dependent['headers']['Last-Modified']"
38+
conditions:
39+
status_code:
40+
regex: "200"
41+
reverse: false
42+
headers:
43+
Last-Modified:
44+
regex: .*
45+
reverse: false

‎modules/scan/http_html_title.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
info:
2+
name: http_html_title_scan
3+
author: OWASP Nettacker Team
4+
severity: 3
5+
description: HTTP HTML Title scan - extracts the TITLE tag which can help identify the application running on the server
6+
reference:
7+
profiles:
8+
- scan
9+
- http
10+
- low_severity
11+
12+
payloads:
13+
- library: http
14+
steps:
15+
- method: get
16+
timeout: 3
17+
headers:
18+
User-Agent: "{user_agent}"
19+
allow_redirects: true
20+
ssl: false
21+
url:
22+
nettacker_fuzzer:
23+
input_format: "{{schema}}://{target}:{{ports}}"
24+
prefix: ""
25+
suffix: ""
26+
interceptors:
27+
data:
28+
schema:
29+
- "http"
30+
- "https"
31+
ports:
32+
- 80
33+
- 443
34+
response:
35+
condition_type: or
36+
log: "response_dependent['status_code'] response_dependent['content']"
37+
conditions:
38+
status_code:
39+
regex: \d\d\d
40+
reverse: false
41+
content:
42+
regex: <title>(.+?)</title>
43+
reverse: false

‎modules/scan/ivanti_epmm_lastpatcheddate.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
info:
2+
name: ivanti_epmm_lastpatcheddate_scan
3+
author: OWASP Nettacker Team
4+
severity: 3
5+
description: Ivanti EPMM Last Patched Date Scan
6+
reference:
7+
profiles:
8+
- scan
9+
- http
10+
- ivanti
11+
- low_severity
12+
13+
payloads:
14+
- library: http
15+
steps:
16+
- method: head
17+
timeout: 3
18+
headers:
19+
User-Agent: "{user_agent}"
20+
allow_redirects: false
21+
ssl: false
22+
url:
23+
nettacker_fuzzer:
24+
input_format: "{{schema}}://{target}:{{ports}}/mifs/css/pages/userlogin.css"
25+
prefix: ""
26+
suffix: ""
27+
interceptors:
28+
data:
29+
schema:
30+
- "http"
31+
- "https"
32+
ports:
33+
- 80
34+
- 443
35+
response:
36+
condition_type: and
37+
log: "response_dependent['headers']['Last-Modified']"
38+
conditions:
39+
status_code:
40+
regex: "200"
41+
reverse: false
42+
headers:
43+
Last-Modified:
44+
regex: .*
45+
reverse: false
46+
Content-Type:
47+
regex: "css"
48+
reverse: false

‎modules/scan/ivanti_ics_lastpatcheddate.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
info:
2+
name: ivanti_ics_lastpatcheddate_scan
3+
author: OWASP Nettacker Team
4+
severity: 3
5+
description: Ivanti ICS Last Patched Date Scan
6+
reference:
7+
profiles:
8+
- scan
9+
- http
10+
- ivanti
11+
- low_severity
12+
13+
payloads:
14+
- library: http
15+
steps:
16+
- method: head
17+
timeout: 3
18+
headers:
19+
User-Agent: "{user_agent}"
20+
allow_redirects: false
21+
ssl: false
22+
url:
23+
nettacker_fuzzer:
24+
input_format: "{{schema}}://{target}:{{ports}}/dana-na/css/ds.js"
25+
prefix: ""
26+
suffix: ""
27+
interceptors:
28+
data:
29+
schema:
30+
- "http"
31+
- "https"
32+
ports:
33+
- 80
34+
- 443
35+
response:
36+
condition_type: and
37+
log: "response_dependent['headers']['Last-Modified']"
38+
conditions:
39+
status_code:
40+
regex: "200"
41+
reverse: false
42+
headers:
43+
Last-Modified:
44+
regex: .*
45+
reverse: false
46+
Content-Type:
47+
regex: "javascript"
48+
reverse: false

‎modules/vuln/ivanti_epmm_cve_2023_35082.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
info:
2+
name: ivanti_epmm_cve_2023_35082_vuln
3+
author: OWASP Nettacker team
4+
severity: 9.8
5+
description: CVE-2023-35082 is an authentication bypass in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core
6+
reference:
7+
- https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older
8+
- https://www.cisa.gov/news-events/alerts/2024/01/18/cisa-adds-one-known-exploited-vulnerability-catalog
9+
- https://www.helpnetsecurity.com/2024/01/19/exploited-cve-2023-35082/
10+
- https://www.rapid7.com/blog/post/2023/08/02/cve-2023-35082-mobileiron-core-unauthenticated-api-access-vulnerability/
11+
profiles:
12+
- vuln
13+
- vulnerability
14+
- http
15+
- high_severity
16+
- cve
17+
- ivanti
18+
- ivanti_epmm
19+
- cisa_kev
20+
21+
payloads:
22+
- library: http
23+
steps:
24+
- method: get
25+
timeout: 3
26+
headers:
27+
User-Agent: "{user_agent}"
28+
allow_redirects: false
29+
ssl: false
30+
url:
31+
nettacker_fuzzer:
32+
input_format: "{{schema}}://{target}:{{ports}}/{{paths}}"
33+
prefix: ""
34+
suffix: ""
35+
interceptors:
36+
data:
37+
paths:
38+
- "mifs/asfV3/api/v2/ping"
39+
schema:
40+
- "http"
41+
- "https"
42+
ports:
43+
- 80
44+
- 443
45+
response:
46+
condition_type: and
47+
conditions:
48+
status_code:
49+
regex: "200"
50+
reverse: false
51+
content:
52+
regex: "vspVersion"
53+
reverse: false

‎modules/vuln/ivanti_ics_cve_2023_46805.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ payloads:
2222
- method: get
2323
timeout: 3
2424
headers:
25-
User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138 Safari/537.36"
25+
User-Agent: "{user_agent}"
2626
allow_redirects: false
2727
ssl: false
2828
url:
@@ -44,8 +44,8 @@ payloads:
4444
condition_type: and
4545
conditions:
4646
status_code:
47-
regex: '403'
47+
regex: "403"
4848
reverse: false
4949
content:
50-
regex: '<html>'
50+
regex: "<html>"
5151
reverse: true

‎modules/vuln/wp_plugin_cve_2023_6875.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
info:
2+
name: wp_plugin_cve_2023_6875_vuln
3+
author: Captain-T2004
4+
severity: 9
5+
description: POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 – Unauthenticated Stored Cross-Site Scripting via device
6+
reference:
7+
- https://nvd.nist.gov/vuln/detail/CVE-2023-6875
8+
- https://www.wordfence.com/blog/2024/01/type-juggling-leads-to-two-vulnerabilities-in-post-smtp-mailer-wordpress-plugin/
9+
- https://www.cve.org/CVERecord?id=CVE-2023-6875
10+
profiles:
11+
- vuln
12+
- vulnerability
13+
- http
14+
- critical_severity
15+
- cve2023
16+
- cve
17+
- wordpress
18+
- wp_plugin
19+
20+
payloads:
21+
- library: http
22+
steps:
23+
- method: post
24+
timeout: 3
25+
headers:
26+
User-Agent: "{user_agent}"
27+
allow_redirects: false
28+
ssl: false
29+
url:
30+
nettacker_fuzzer:
31+
input_format: "{{schema}}://{target}:{{ports}}/wp-json/post-smtp/v1/connect-app"
32+
prefix: ""
33+
suffix: ""
34+
interceptors:
35+
data:
36+
schema:
37+
- "http"
38+
- "https"
39+
ports:
40+
- 80
41+
- 443
42+
response:
43+
success_conditions: content
44+
condition_type: and
45+
conditions:
46+
content:
47+
regex: "fcm_token"
48+
reverse: false
49+
status_code:
50+
regex: "200"
51+
reverse: false

‎requirements.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ ipaddr==2.2.0
44
requests==2.31.0
55
aiohttp==3.9.1
66
asyncio==3.4.3
7-
paramiko==3.3.1
7+
paramiko==3.4.0
88
texttable==1.6.7
99
PySocks==1.7.1 # library_name=socks # module name is not equal to socks name; this is required to be checked on startup
1010
pyOpenSSL==23.2.0 # library_name=OpenSSL
11-
flask==3.0.0
11+
flask==3.0.1
1212
SQLAlchemy>=1.4.43 # library_name=sqlalchemy
1313
py3DNS==4.0.0 # library_name=DNS
1414
numpy==1.26.2

‎version.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.3.2 TRENT
1+
0.3.3 TRENT

0 commit comments

Comments
 (0)