deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Microsoft Windows SMB to LDAP Relay
Type: auxiliary
Path: modules/auxiliary/server/relay/smb_to_ldap.rb

Description:
This module supports running an SMB server which validates credentials, and
          then attempts to execute a relay attack against an LDAP server on the
          configured RHOSTS hosts.

          It is not possible to relay NTLMv2 to LDAP due to the Message Integrity Check
          (MIC). As a result, this will only work with NTLMv1. The module takes care of
          removing the relevant flags to bypass signing.

          If the relay succeeds, an LDAP session to the target will be created. This can
          be used by any modules that support LDAP sessions, like `admin/ldap/rbcd` or
          `auxiliary/gather/ldap_query`.

          Supports SMBv2, SMBv3, and captures NTLMv1 as well as NTLMv2 hashes.
          SMBv1 is not supported - please see https://github.com/rapid7/metasploit-framework/issues/16261
Metasploit Module: Native DNS Server (Example)
Type: auxiliary
Path: modules/auxiliary/server/dns/native_server.rb
Authors: RageLtMan <rageltman[at]sempervictus>

Description:
This module provides a Rex based DNS service which can store static entries,
          resolve names over pivots, and serve DNS requests across routed session comms.
          DNS tunnels can operate across the Rex switchboard, and DNS other modules
          can use this as a template. Setting static records via hostfile allows for DNS
          spoofing attacks without direct traffic manipulation at the handlers. handlers
          for requests and responses provided here mimic the internal Rex functionality,
          but utilize methods within this module's namespace to output content processed
          in the Proc contexts via vprint_status.
Metasploit Module: DNS Spoofing Helper Service
Type: auxiliary
Path: modules/auxiliary/server/dns/spoofhelper.rb
Authors: hdm

Description:
This module provides a DNS service that returns TXT
        records indicating information about the querying service.
        Based on Dino Dai Zovi DNS code from Karma.
Metasploit Module: HTTP Client Basic Authentication Credential Collector
Type: auxiliary
Path: modules/auxiliary/server/capture/http_basic.rb
Authors: saint patrick <saintpatrick[at]l1pht.com>

Description:
This module responds to all requests for resources with a HTTP 401.  This should
          cause most browsers to prompt for a credential.  If the user enters Basic Auth creds
          they are sent to the console.

          This may be helpful in some phishing expeditions where it is possible to embed a
          resource into a page.

          This attack is discussed in Chapter 3 of The Tangled Web by Michal Zalewski.
Metasploit Module: Printjob Capture Service
Type: auxiliary
Path: modules/auxiliary/server/capture/printjob_capture.rb
Authors: Chris John Riley
References: URL-http://blog.c22.cc/toolsscripts/prn-2-me/, URL-http://www.ghostscript.com

Description:
This module is designed to listen for PJL or PostScript print
        jobs. Once a print job is detected it is saved to loot. The
        captured printjob can then be forwarded on to another printer
        (required for LPR printjobs). Resulting PCL/PS files can be
        read with GhostScript/GhostPCL.

        Note, this module does not yet support IPP connections.
Metasploit Module: Authentication Capture: FTP
Type: auxiliary
Path: modules/auxiliary/server/capture/ftp.rb
Authors: ddz

Description:
This module provides a fake FTP service that
        is designed to capture authentication credentials.
Metasploit Module: HTTP Client MS Credential Catcher
Type: auxiliary
Path: modules/auxiliary/server/capture/http_ntlm.rb

Description:
This module attempts to quietly catch NTLM/LM Challenge hashes.
Metasploit Module: Authentication Capture: SMTP
Type: auxiliary
Path: modules/auxiliary/server/capture/smtp.rb
Authors: ddz
References: URL-https://www.samlogic.net/articles/smtp-commands-reference-auth.htm, URL-https://datatracker.ietf.org/doc/html/rfc5321, URL-http://fehcom.de/qmail/smtpauth.html

Description:
This module provides a fake SMTP service that
      is designed to capture authentication credentials.
Metasploit Module: Authentication Capture: LDAP
Type: auxiliary
Path: modules/auxiliary/server/capture/ldap.rb
Authors: JustAnda7

Description:
This module mocks an LDAP service to capture authentication
        information of a client trying to authenticate against an LDAP service
Metasploit Module: Authentication Capture: PostgreSQL
Type: auxiliary
Path: modules/auxiliary/server/capture/postgresql.rb
Authors: Dhiru Kholia <dhiru[at]openwall.com>

Description:
This module provides a fake PostgreSQL service that is designed to
        capture clear-text authentication credentials.
Metasploit Module: Authentication Capture: Telnet
Type: auxiliary
Path: modules/auxiliary/server/capture/telnet.rb
Authors: kris katterjohn

Description:
This module provides a fake Telnet service that
      is designed to capture authentication credentials.  DONTs
      and WONTs are sent to the client for all option negotiations,
      except for ECHO at the time of the password prompt since
      the server controls that for a bit more realism.
Metasploit Module: Authentication Capture: SMB
Type: auxiliary
Path: modules/auxiliary/server/capture/smb.rb

Description:
This module provides a SMB service that can be used to capture the challenge-response
        password NTLMv1 & NTLMv2 hashes used with SMB1, SMB2, or SMB3 client systems.
        Responses sent by this service by default use a random 8 byte challenge string.
        A specific value (such as `[PII_REDACTED]`) can be set using the CHALLENGE option,
        allowing for easy cracking using John the Ripper (with jumbo patch).

        To exploit this, the target system must try to authenticate to this
        module. One way to force an SMB authentication attempt is by embedding
        a UNC path (\\\\SERVER\\SHARE) into a web page or email message. When
        the victim views the web page or email, their system will
        automatically connect to the server specified in the UNC share (the IP
        address of the system running this module) and attempt to
        authenticate. Another option is using auxiliary/spoof/{nbns,llmnr
Metasploit Module: Authentication Capture: HTTP
Type: auxiliary
Path: modules/auxiliary/server/capture/http.rb
Authors: ddz

Description:
This module provides a fake HTTP service that
      is designed to capture authentication credentials.
Metasploit Module: Authentication Capture: IMAP
Type: auxiliary
Path: modules/auxiliary/server/capture/imap.rb
Authors: ddz

Description:
This module provides a fake IMAP service that
      is designed to capture authentication credentials.
Metasploit Module: Authentication Capture: MySQL
Type: auxiliary
Path: modules/auxiliary/server/capture/mysql.rb
Authors: Patrik Karlsson <patrik[at]cqure.net>

Description:
This module provides a fake MySQL service that is designed to
        capture authentication credentials. It captures	challenge and
        response pairs that can be supplied to JtR for cracking.
Metasploit Module: Authentication Capture: DRDA (DB2, Informix, Derby)
Type: auxiliary
Path: modules/auxiliary/server/capture/drda.rb
Authors: Patrik Karlsson <patrik[at]cqure.net>

Description:
This module provides a fake DRDA (DB2, Informix, Derby) server
      that is designed to capture authentication credentials.
Metasploit Module: Authentication Capture: POP3
Type: auxiliary
Path: modules/auxiliary/server/capture/pop3.rb
Authors: ddz

Description:
This module provides a fake POP3 service that
      is designed to capture authentication credentials.
Metasploit Module: Authentication Capture: MSSQL
Type: auxiliary
Path: modules/auxiliary/server/capture/mssql.rb
Authors: Patrik Karlsson <patrik[at]cqure.net>

Description:
This module provides a fake MSSQL service that
      is designed to capture authentication credentials. The modules
      supports both the weak encoded database logins as well as Windows
      logins (NTLM).
Metasploit Module: Capture: HTTP JavaScript Keylogger
Type: auxiliary
Path: modules/auxiliary/server/capture/http_javascript_keylogger.rb
Authors: Marcus J. Carey <mjc[at]threatagent.com>

Description:
This modules runs a web server that demonstrates keystroke
          logging through JavaScript. The DEMO option can be set to enable
          a page that demonstrates this technique. Future improvements will
          allow for a configurable template to be used with this module.
          To use this module with an existing web page, simply add a
          script source tag pointing to the URL of this service ending
          in the .js extension. For example, if URIPATH is set to "test",
          the following URL will load this script into the calling site:
          http://server:port/test/anything.js
Metasploit Module: Authentication Capture: VNC
Type: auxiliary
Path: modules/auxiliary/server/capture/vnc.rb
Authors: Patrik Karlsson <patrik[at]cqure.net>

Description:
This module provides a fake VNC service that
      is designed to capture authentication credentials.
Metasploit Module: Authentication Capture: SIP
Type: auxiliary
Path: modules/auxiliary/server/capture/sip.rb
Authors: Patrik Karlsson <patrik[at]cqure.net>

Description:
This module provides a fake SIP service that is designed to
        capture authentication credentials. It captures	challenge and
        response pairs that can be supplied to JtR for cracking.
Metasploit Module: NetBIOS Name Service Spoofer
Type: auxiliary
Path: modules/auxiliary/spoof/nbns/nbns_response.rb
References: URL-http://www.packetstan.com/2011/03/nbns-spoofing-on-your-way-to-world.html

Description:
This module forges NetBIOS Name Service (NBNS) responses. It will listen for NBNS requests
        sent to the local subnet's broadcast address and spoof a response, redirecting the querying
        machine to an IP of the attacker's choosing. Combined with auxiliary/server/capture/smb or
        auxiliary/server/capture/http_ntlm it is a highly effective means of collecting crackable
        hashes on common networks.

        This module must be run as root and will bind to udp/137 on all interfaces.
Metasploit Module: Native DNS Spoofer (Example)
Type: auxiliary
Path: modules/auxiliary/spoof/dns/native_spoofer.rb
Authors: RageLtMan <rageltman[at]sempervictus>

Description:
This module provides a Rex based DNS service to resolve queries intercepted
          via the capture mixin. Configure STATIC_ENTRIES to contain host-name mappings
          desired for spoofing using a hostsfile or space/semicolon separated entries.
          In the default configuration, the service operates as a normal native DNS server
          with the exception of consuming from and writing to the wire as opposed to a
          listening socket. Best when compromising routers or spoofing L2 in order to
          prevent return of the real reply which causes a race condition. The method
          by which replies are filtered is up to the user (though iptables works fine).
Metasploit Module: DNS BailiWicked Domain Attack
Type: auxiliary
Path: modules/auxiliary/spoof/dns/bailiwicked_domain.rb
Disclosure date: 2008-07-21
References: CVE-2008-1447, OSVDB-46776, US-CERT-VU-800113, URL-http://web.archive.org/web/[PII_REDACTED]5835/http://www.caughq.org/exploits/CAU-EX-2008-0003.txt

Description:
This exploit attacks a fairly ubiquitous flaw in DNS implementations which
          Dan Kaminsky found and disclosed ~Jul 2008.  This exploit replaces the target
          domains nameserver entries in a vulnerable DNS cache server. This attack works
          by sending random hostname queries to the target DNS server coupled with spoofed
          replies to those queries from the authoritative nameservers for that domain.
          Eventually, a guessed ID will match, the spoofed packet will get accepted, and
          the nameserver entries for the target domain will be replaced by the server
          specified in the NEWDNS option of this exploit.

Check method (fingerprinting):
targ = rhost

    srv_sock = Rex::Socket.create_udp(
      'PeerHost' => targ,
      'PeerPort' => 53
    )

    random = false
    ports = {}
    lport = nil
    reps = 0

    1.upto(30) do |i|
      req = Resolv::DNS::Message.new
      txt = "spoofprobe-check-#{i}-#{$PROCESS_ID}#{(rand * 1000000).to_i}.red.metasploit.com"
      req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
      req.rd = 1

      srv_sock.put(req.encode)
      res, = srv_sock.recvfrom(65535, 1.0)

      if res && !res.empty?
        reps += 1
        res = Resolv::DNS::Message.decode(res)
        res.each_answer do |name, _ttl, data|
          next unless (name.to_s == txt) && data.strings.join('') =~ (/^([^\s]+)\s+.*red\.metasploit\.com/m)

          t_addr, t_port = ::Regexp.last_match(1).split(':')

          vprint_status(" >> ADDRESS: #{t_addr}  PORT: #{t_port}")
          t_port = t_port.to_i
          if lport && (lport != t_port)
            random = true
          end
          lport = t_port
          ports[t_port] ||= 0
          ports[t_port] += 1
        end
      end

      if (i > 5) && ports.keys.empty?
        break
      end
    end

    srv_sock.close

    if ports.keys.empty?
      vprint_error('ERROR: This server is not replying to recursive requests')
      return Exploit::CheckCode::Unknown('Server is not replying to recursive requests')
    end

    if (reps < 30)
      vprint_warning('WARNING: This server did not reply to all of our requests')
    end

    if random
      po
Metasploit Module: DNS Lookup Result Comparison
Type: auxiliary
Path: modules/auxiliary/spoof/dns/compare_results.rb
Disclosure date: 2008-07-21

Description:
This module can be used to determine differences
          in the cache entries between two DNS servers. This is
          primarily useful for detecting cache poisoning attacks,
          but can also be used to detect geo-location load balancing.
Metasploit Module: DNS BailiWicked Host Attack
Type: auxiliary
Path: modules/auxiliary/spoof/dns/bailiwicked_host.rb
Disclosure date: 2008-07-21
References: CVE-2008-1447, OSVDB-46776, US-CERT-VU-800113, URL-http://web.archive.org/web/[PII_REDACTED]0102/http://www.caughq.org:80/exploits/CAU-EX-2008-0002.txt

Description:
This exploit attacks a fairly ubiquitous flaw in DNS implementations which
          Dan Kaminsky found and disclosed ~Jul 2008.  This exploit caches a single
          malicious host entry into the target nameserver by sending random hostname
          queries to the target DNS server coupled with spoofed replies to those
          queries from the authoritative nameservers for that domain. Eventually, a
          guessed ID will match, the spoofed packet will get accepted, and due to the
          additional hostname entry being within bailiwick constraints of the original
          request the malicious host entry will get cached.

Check method (fingerprinting):
targ = rhost

    srv_sock = Rex::Socket.create_udp(
      'PeerHost' => targ,
      'PeerPort' => 53
    )

    random = false
    ports = {}
    lport = nil
    reps = 0

    1.upto(30) do |i|
      req = Resolv::DNS::Message.new
      txt = "spoofprobe-check-#{i}-#{$PROCESS_ID}#{(rand * 1000000).to_i}.red.metasploit.com"
      req.add_question(txt, Resolv::DNS::Resource::IN::TXT)
      req.rd = 1

      srv_sock.put(req.encode)
      res, = srv_sock.recvfrom(65535, 1.0)

      if res && !res.empty?
        reps += 1
        res = Resolv::DNS::Message.decode(res)
        res.each_answer do |name, _ttl, data|
          next unless (name.to_s == txt) && data.strings.join('') =~ (/^([^\s]+)\s+.*red\.metasploit\.com/m)

          t_addr, t_port = ::Regexp.last_match(1).split(':')

          vprint_status(" >> ADDRESS: #{t_addr}  PORT: #{t_port}")
          t_port = t_port.to_i
          if lport && (lport != t_port)
            random = true
          end
          lport = t_port
          ports[t_port] ||= 0
          ports[t_port] += 1
        end
      end

      if (i > 5) && ports.keys.empty?
        break
      end
    end

    srv_sock.close

    if ports.keys.empty?
      vprint_error('ERROR: This server is not replying to recursive requests')
      return Exploit::CheckCode::Unknown('Server is not replying to recursive requests')
    end

    if (reps < 30)
      vprint_warning('WARNING: This server did not reply to all of our requests')
    end

    unless random
Metasploit Module: LLMNR Spoofer
Type: auxiliary
Path: modules/auxiliary/spoof/llmnr/llmnr_response.rb
References: URL-http://www.ietf.org/rfc/rfc4795.txt

Description:
LLMNR (Link-local Multicast Name Resolution) is the successor of NetBIOS (Windows Vista and up) and is used to
          resolve the names of neighboring computers. This module forges LLMNR responses by listening for LLMNR requests
          sent to the LLMNR multicast address (224.0.0.252) and responding with a user-defined spoofed IP address.
Metasploit Module: mDNS Spoofer
Type: auxiliary
Path: modules/auxiliary/spoof/mdns/mdns_response.rb
References: URL-https://tools.ietf.org/html/rfc6762

Description:
This module will listen for mDNS multicast requests on 5353/udp for A and AAAA record queries, and respond with a spoofed IP address (assuming the request matches our regex).
Metasploit Module: Send Cisco Discovery Protocol (CDP) Packets
Type: auxiliary
Path: modules/auxiliary/spoof/cisco/cdp.rb
Authors: Fatih Ozavci
References: URL-https://en.wikipedia.org/wiki/CDP_Spoofing

Description:
This module sends Cisco Discovery Protocol (CDP) packets. Note that any responses
        to the CDP packets broadcast from this module will need to be analyzed with an
        external packet analysis tool, such as tcpdump or Wireshark in order to learn more
        about the Cisco switch and router environment.
Metasploit Module: Forge Cisco DTP Packets
Type: auxiliary
Path: modules/auxiliary/spoof/cisco/dtp.rb

Description:
This module forges DTP packets to initialize a trunk port.
Metasploit Module: ARP Spoof
Type: auxiliary
Path: modules/auxiliary/spoof/arp/arp_poisoning.rb
Disclosure date: Dec 22 1999
References: OSVDB-11169, CVE-1999-0667, URL-https://en.wikipedia.org/wiki/ARP_spoofing

Description:
Spoof ARP replies and poison remote ARP caches to conduct IP address spoofing or a denial of service.
Metasploit Module: VSploit Zeus DNS Query Module
Type: auxiliary
Path: modules/auxiliary/vsploit/malware/dns/dns_zeus.rb
Authors: MJC
References: URL-https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

Description:
This module queries known Zeus Botnet DNS records.
Metasploit Module: VSploit DNS Beaconing Emulation
Type: auxiliary
Path: modules/auxiliary/vsploit/malware/dns/dns_query.rb
Authors: MJC

Description:
This module takes a list of domains and emulates malicious DNS beaconing.
Metasploit Module: VSploit Mariposa DNS Query Module
Type: auxiliary
Path: modules/auxiliary/vsploit/malware/dns/dns_mariposa.rb
Authors: MJC
References: URL-http://www.defintel.com/docs/Mariposa_Analysis.pdf

Description:
This module queries known Mariposa Botnet DNS records.
Metasploit Module: VSploit Email PII
Type: auxiliary
Path: modules/auxiliary/vsploit/pii/email_pii.rb
Authors: willis

Description:
This auxiliary reads from a file and sends data which
          should be flagged via an internal or external SMTP server.
Metasploit Module: Telegram Message Client
Type: auxiliary
Path: modules/auxiliary/client/telegram/send_message.rb

Description:
This module can be used to send a document and/or message to
        multiple chats on telegram. Please refer to the module
        documentation for info on how to retrieve the bot token and corresponding chat
        ID values.
Metasploit Module: Generic Emailer (SMTP)
Type: auxiliary
Path: modules/auxiliary/client/smtp/emailer.rb
References: URL-http://spl0it.org/

Description:
This module can be used to automate email delivery.
          This code is based on Joshua Abraham's email script for social
          engineering.
Metasploit Module: MMS Client
Type: auxiliary
Path: modules/auxiliary/client/mms/send_mms.rb

Description:
This module sends an MMS message to multiple phones of the same carrier.
          You can use it to send a malicious attachment to phones.
Metasploit Module: Hardware Bridge Session Connector
Type: auxiliary
Path: modules/auxiliary/client/hwbridge/connect.rb
References: URL-https://web.archive.org/web/[PII_REDACTED]5056/http://opengarages.org/hwbridge/

Description:
The Hardware Bridge (HWBridge) is a standardized method for
          Metasploit to interact with Hardware Devices.  This extends
          the normal exploit capabilities to the non-ethernet realm and
          enables direct hardware and alternative bus manipulations.  You
          must have compatible bridging hardware attached to this machine or
          reachable on your network to use any HWBridge exploits.

          Use this exploit module to connect the physical HWBridge which
          will start an interactive hwbridge session.  You can launch a hwbridge
          server locally by using compliant hardware and executing the local_hwbridge
          module.  After that module has started, pass the HWBRIDGE_BASE_URL
          options to this connector module.
Metasploit Module: SMS Client
Type: auxiliary
Path: modules/auxiliary/client/sms/send_text.rb

Description:
This module sends a text message to multiple phones of the same carrier.
          You can use it to send a malicious link to phones.

          Please note that you do not use this module to send a media file (attachment).
          In order to send a media file, please use auxiliary/client/mms/send_mms instead.
Metasploit Module: pSnuffle Packet Sniffer
Type: auxiliary
Path: modules/auxiliary/sniffer/psnuffle.rb
Authors: Max Moser <mmo[at]remote-exploit.org>

Description:
This module sniffs passwords like dsniff did in the past.
Metasploit Module: Ubiquiti Discovery Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ubiquiti/ubiquiti_discover.rb
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-017A, URL-https://community.ubnt.com/t5/airMAX-General-Discussion/airOS-airMAX-and-management-access/td-p/2654023, URL-https://www.rapid7.com/blog/post/2019/02/01/ubiquiti-discovery-service-exposures/

Description:
Detects Ubiquiti devices using a UDP discovery service
Metasploit Module: Motorola Timbuktu Service Detection
Type: auxiliary
Path: modules/auxiliary/scanner/motorola/timbuktu_udp.rb
Disclosure date: 2009-09-25
Authors: MC

Description:
This module simply sends a packet to the Motorola Timbuktu service for detection.
Metasploit Module: OpenVAS OTP Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/openvas/openvas_otp_login.rb

Description:
This module attempts to authenticate to an OpenVAS OTP service.
Metasploit Module: OpenVAS gsad Web Interface Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/openvas/openvas_gsad_login.rb

Description:
This module simply attempts to login to an OpenVAS gsad interface
        using a specific user/pass.
Metasploit Module: OpenVAS OMP Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/openvas/openvas_omp_login.rb

Description:
This module attempts to authenticate to an OpenVAS OMP service.
Metasploit Module: Endpoint Mapper Service Discovery
Type: auxiliary
Path: modules/auxiliary/scanner/dcerpc/endpoint_mapper.rb
Authors: hdm

Description:
This module can be used to obtain information from the
        Endpoint Mapper service.
Metasploit Module: DCERPC TCP Service Auditor
Type: auxiliary
Path: modules/auxiliary/scanner/dcerpc/tcp_dcerpc_auditor.rb
Authors: hdm

Description:
Determine what DCERPC services are accessible over a TCP port.
Metasploit Module: Remote Management Interface Discovery
Type: auxiliary
Path: modules/auxiliary/scanner/dcerpc/management.rb
Authors: hdm

Description:
This module can be used to obtain information from the Remote
        Management Interface DCERPC service.