deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Android Open Source Platform (AOSP) Browser UXSS
Type: auxiliary
Path: modules/auxiliary/gather/android_object_tag_webview_uxss.rb
Disclosure date: 2014-10-04
References: CVE-2014-6041, URL-http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.html, URL-https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117ef, URL-http://trac.webkit.org/changeset/96826/webkit

Description:
This module exploits a Universal Cross-Site Scripting (UXSS) vulnerability present in
          all versions of Android's open source stock browser before 4.4, and Android apps running
          on < 4.4 that embed the WebView component. If successful, an attacker can leverage this bug
          to scrape both cookie data and page contents from a vulnerable browser window.

          Target URLs that use X-Frame-Options can not be exploited with this vulnerability.

          Some sample UXSS scripts are provided in data/exploits/uxss.
Metasploit Module: Check Point Security Gateway Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919.rb
References: CVE-2024-24919, URL-https://support.checkpoint.com/results/sk/sk182336, URL-https://www.rapid7.com/blog/post/2024/05/30/etr-cve-2024-24919-check-point-security-gateway-information-disclosure/, URL-https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/

Description:
This module leverages an unauthenticated arbitrary root file read vulnerability for
          Check Point Security Gateway appliances. When the IPSec VPN or Mobile Access blades
          are enabled on affected devices, traversal payloads can be used to read any files on
          the local file system. Password hashes read from disk may be cracked, potentially
          resulting in administrator-level access to the target device. This vulnerability is
          tracked as CVE-2024-24919.

Check method (fingerprinting):
# Attempt to read the /etc/group file (used in check due to lower likelihood of being flagged vs something like /etc/shadow)
    res_file = read_file('/etc/group')

    # Check for connection failure
    return Msf::Exploit::CheckCode::Unknown('Connection failed - unable to complete web request') unless res_file

    # If the response body includes the string "root", we can assume the target is vulnerable
    unless res_file.body.include?('root')
      return Msf::Exploit::CheckCode::Safe('Arbitrary file read failed - the target did not respond with the requested file')
    end

    Msf::Exploit::CheckCode::Vulnerable('Arbitrary file read successful!')
  end
Metasploit Module: CrushFTP Unauthenticated Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/crushftp_fileread_cve_2024_4040.rb
References: CVE-2024-4040, URL-https://attackerkb.com/topics/20oYjlmfXa/cve-2024-4040/rapid7-analysis

Description:
This module leverages an unauthenticated server-side template injection vulnerability in CrushFTP < 10.7.1 and
          < 11.1.0 (as well as legacy 9.x versions). Attackers can submit template injection payloads to the web API without
          authentication. When attacker payloads are reflected in the server's responses, the payloads are evaluated. The
          primary impact of the injection is arbitrary file read as root, which can result in authentication bypass, remote
          code execution, and NetNTLMv2 theft (when the host OS is Windows and SMB egress traffic is permitted).

Check method (fingerprinting):
# Unauthenticated requests to WebInterface endpoints should receive a response containing an 'anonymous' user session cookie
    res_anonymous_check = get_anon_session

    return Msf::Exploit::CheckCode::Unknown('Connection failed - unable to get 404 page response (confirm target and SSL settings)') unless res_anonymous_check

    # Confirm that the response returned a CrushAuth cookie and the status code was 404. If this is not the case, the target is probably not CrushFTP
    if (res_anonymous_check.code != 404) || !res_anonymous_check.get_cookies.include?('CrushAuth')
      return Msf::Exploit::CheckCode::Unknown('The application did not return a 404 response that provided an anonymous session cookie')
    end

    # Extract the CrushAuth anonymous session cookie value using regex
    crushauth_cookie = res_anonymous_check&.get_cookies&.match(/\d{13}_[A-Za-z0-9]{30}/)

    # The string "password" is included to invoke CrushFTP's sensitive parameter redaction in logs. The injection will be logged as "********"
    # NOTE: Due to an apparent bug in the way CrushFTP redacts data, if file paths contain ":", some of the injection will be leaked in logs
    res_template_inject = perform_template_injection(datastore['INJECTINTO'], '{user_name}password', crushauth_cookie)

    return Msf::Exploit::CheckCode::Unknown('Connection failed - unable to get template injection page response') unless res_template_inject

    # Confirm that the "{user_name}" template injection evaluates to
Metasploit Module: n8n arbitrary file read
Type: auxiliary
Path: modules/auxiliary/gather/ni8mare_cve_2026_21858.rb

Description:
This module exploits CVE-2026-21858, a critical unauthenticated remote code execution vulnerability in n8n workflow automation platform versions 1.65.0 through 1.120.x. The vulnerability, dubbed "Ni8mare", is a content-type confusion flaw in webhook request handling that allows attackers to achieve arbitrary file read.
Metasploit Module: Jetty WEB-INF File Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/jetty_web_inf_disclosure.rb
Disclosure date: 2021-07-15
References: EDB-50438, EDB-50478, URL-https://github.com/ColdFusionX/CVE-2021-34429, CVE-2021-34429, CVE-2021-28164

Description:
Jetty suffers from a vulnerability where certain encoded URIs and ambiguous paths can access
          protected files in the WEB-INF folder. Versions effected are:
          9.4.37.v20210219, 9.4.38.v20210224 and 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5.
          Exploitation can obtain any file in the WEB-INF folder, but web.xml is most likely
          to have information of value.

Check method (fingerprinting):
res = send_request_cgi('uri' => '/')
    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200
    return Exploit::CheckCode::Safe("#{peer} - No Server header found") unless res.headers['Server']
    unless /Jetty\((?<version>[^)]+)\)/ =~ res.headers['Server']
      return Exploit::CheckCode::Safe("#{peer} - Unable to detect Jetty version from server header: #{res.headers['Server']}")
    end

    vprint_status("Found version: #{version}")
    version = Rex::Version.new(version)

    if version == Rex::Version.new('9.4.37.v20210219') || version == Rex::Version.new('9.4.38.v20210224')
      print_good("#{version} vulnerable to CVE-2021-28164")
      return Exploit::CheckCode::Detected("Jetty #{version} vulnerable to CVE-2021-28164")
    elsif version.between?(Rex::Version.new('9.4.37'), Rex::Version.new('9.4.43')) ||
          version.between?(Rex::Version.new('10.0.1'), Rex::Version.new('10.0.6')) ||
          version.between?(Rex::Version.new('11.0.1'), Rex::Version.new('11.0.6'))
      print_good("#{version} vulnerable to CVE-2021-34429")
      return Exploit::CheckCode::Appears("Jetty #{version} vulnerable to CVE-2021-34429")
    end

    Exploit::CheckCode::Safe("Jetty #{version} is not vulnerable")
  end
Metasploit Module: Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump
Type: auxiliary
Path: modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb
Disclosure date: 2020-03-30
References: CVE-2020-5724, CVE-2020-5723, URL-http://web.archive.org/web/[PII_REDACTED]2924/http://firmware.grandstream.com/Release_Note_UCM6xxx_1.0.20.22.pdf, URL-https://raw.githubusercontent.com/tenable/poc/master/grandstream/ucm62xx/dump_http_user_creds.py

Description:
This module uses a blind SQL injection (CVE-2020-5724) affecting the Grandstream UCM62xx
          IP PBX to dump the users table. The injection occurs over a websocket at the websockify
          endpoint, and specifically occurs when the user requests the challenge (as part of a
          challenge and response authentication scheme). The injection is blind, but the server
          response contains a different status code if the query was successful. As such, the
          attacker can guess the contents of the user database. Most helpfully, the passwords are
          stored in cleartext within the user table (CVE-2020-5723).

          This issue was patched in Grandstream UCM62xx IP PBX firmware version 1.20.22.

Check method (fingerprinting):
normalized_uri = normalize_uri(target_uri.path, '/cgi')
    print_status("Requesting version information from #{normalized_uri}")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalized_uri,
      'vars_post' => { 'action' => 'getInfo' }
    })

    return Exploit::CheckCode::Unknown('No response from target!') unless res && (res.code == 200)

    body_json = res.get_json_document
    return Exploit::CheckCode::Unknown("Got response from target but it didn't contain a JSON body!") if body_json.empty?

    prog_version = body_json.dig('response', 'prog_version')
    return Exploit::CheckCode::Unknown('JSON response obtained from target, but no prog_version field could be found!') if prog_version.nil?

    if Rex::Version.new(prog_version) < Rex::Version.new('1.0.20.22')
      return Exploit::CheckCode::Appears("The self-reported version is: #{prog_version}")
    end

    Exploit::CheckCode::Safe("The self-reported version is: #{prog_version}")
  end
Metasploit Module: Xerox Workcentre 5735 LDAP Service Redential Extractor
Type: auxiliary
Path: modules/auxiliary/gather/xerox_workcentre_5xxx_ldap.rb

Description:
This module extract the printer's LDAP username and password from Xerox Workcentre 5735.
Metasploit Module: Java RMI Registry Interfaces Enumeration
Type: auxiliary
Path: modules/auxiliary/gather/java_rmi_registry.rb
Authors: juan vazquez
References: URL-https://docs.oracle.com/javase/8/docs/platform/rmi/spec/rmiTOC.html

Description:
This module gathers information from an RMI endpoint running an RMI registry
        interface. It enumerates the names bound in a registry and looks up each
        remote reference.
Metasploit Module: Redis Extractor
Type: auxiliary
Path: modules/auxiliary/gather/redis_extractor.rb
Authors: Geoff Rainville noncenz[at]ultibits.com
References: URL-https://redis.io/topics/protocol

Description:
This module connects to a Redis instance and retrieves keys and data stored.
Metasploit Module: Progress MOVEit SFTP Authentication Bypass for Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806.rb
Disclosure date: 2024-06-25
References: CVE-2024-5806, URL-https://attackerkb.com/topics/44EZLG2xgL/cve-2024-5806/rapid7-analysis

Description:
This module exploits CVE-2024-5806, an authentication bypass vulnerability in the MOVEit Transfer SFTP service. The
          following version are affected:

          * MOVEit Transfer 2023.0.x (Fixed in 2023.0.11)
          * MOVEit Transfer 2023.1.x (Fixed in 2023.1.6)
          * MOVEit Transfer 2024.0.x (Fixed in 2024.0.2)

          The module can establish an authenticated SFTP session for a MOVEit Transfer user. The module allows for both listing
          the contents of a directory, and the reading of an arbitrary file.

Check method (fingerprinting):
# Our check method will establish an unauthenticated connection to the remote SFTP (which is an extension of SSH)
    # service and we pull out the servers version string.
    transport = ::Net::SSH::Transport::Session.new(
      datastore['RHOST'],
      {
        port: datastore['RPORT'],
        # Use self as a proxy for the net/ssh library, to allow us to use Metasploit's Rex sockets, which will honor pivots.
        proxy: self
      }
    )

    ident = transport.server_version.version

    # We test the SSH version string for a known value of MOVEit SFTP.
    return Msf::Exploit::CheckCode::Safe(ident) unless ident == 'SSH-2.0-MOVEit Transfer SFTP'

    # We cannot get a product version number, so the best we can do is return Detected.
    Msf::Exploit::CheckCode::Detected(ident)
  rescue ::Rex::ConnectionRefused
    Msf::Exploit::CheckCode::Unknown('Connection Refused')
  rescue ::Rex::HostUnreachable
    Msf::Exploit::CheckCode::Unknown('Host Unreachable')
  rescue ::Rex::ConnectionTimeout, ::Net::SSH::ConnectionTimeout
    Msf::Exploit::CheckCode::Unknown('Connection Timeout')
  end
Metasploit Module: Listmonk Insecure Sprig Template Functions Environment Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/listmonk_env_disclosure.rb
Disclosure date: 2025-06-08
Authors: Tarek Nakkouch
References: CVE-2025-49136

Description:
This module exploits insecure Sprig template functions in Listmonk
          versions prior to v5.0.2. The env and expandenv functions are enabled
          by default, allowing authenticated users with campaign permissions to
          extract sensitive environment variables via campaign preview.

Check method (fingerprinting):
begin
      login
    rescue Msf::Exploit::Failed
      return Msf::Exploit::CheckCode::Unknown('Authentication failed')
    end

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'about')
    })

    return Msf::Exploit::CheckCode::Unknown('Connection failed') unless res

    if res.code == 200
      json = res.get_json_document
      return Msf::Exploit::CheckCode::Unknown('Failed to parse version information') unless json

      if json['version']
        version_string = json['version'].gsub(/^v/, '')
        version = Rex::Version.new(version_string)
        if version >= Rex::Version.new('4.0.0') && version < Rex::Version.new('5.0.2')
          return Msf::Exploit::CheckCode::Appears("Listmonk version #{version_string} is vulnerable")
        else
          return Msf::Exploit::CheckCode::Safe("Listmonk version #{version_string} is patched")
        end
      end
    end

    Msf::Exploit::CheckCode::Unknown('Could not determine if target is running Listmonk')
  end
Metasploit Module: QNAP QTS and Photo Station Local File Inclusion
Type: auxiliary
Path: modules/auxiliary/gather/qnap_lfi.rb
Disclosure date: 2019-11-25
References: CVE-2019-7192, CVE-2019-7194, CVE-2019-7195, EDB-48531, URL-https://infosecwriteups.com/qnap-pre-auth-root-rce-affecting-450k-devices-on-the-internet-d55488d28a05, URL-https://www.qnap.com/en-us/security-advisory/nas-201911-25, URL-https://github.com/Imanfeng/QNAP-NAS-RCE

Description:
This module exploits a local file inclusion in QNAP QTS and Photo
          Station that allows an unauthenticated attacker to download files from
          the QNAP filesystem.

          Because the HTTP server runs as root, it is possible to access
          sensitive files, such as SSH private keys and password hashes.

          This module has been tested on QTS 4.3.3 (unknown Photo Station
          version) and QTS 4.3.6 with Photo Station 5.7.9.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'authLogin.cgi')
    )

    unless res && res.code == 200 && (xml = res.get_xml_document)
      return Exploit::CheckCode::Safe('Target does not appear to be a QNAP device')
    end

    info = %w[modelName version build patch].map do |node|
      xml.at("//#{node}").text
    end

    vprint_status("QNAP #{info[0]} #{info[1..].join('-')} detected")

    return Exploit::CheckCode::Appears("QNAP #{info[0]} build #{info[2]} is older than the patched build 20191206") if info[2].to_i < 20191206

    Exploit::CheckCode::Detected("QNAP #{info[0]} #{info[1..].join('-')} detected, but build is not confirmed vulnerable")
  end
Metasploit Module: LDAP Password Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/ldap_passwords.rb
Disclosure date: 2020-07-23
References: URL-https://blog.xpnsec.com/lapsv2-internals/, URL-https://github.com/fortra/impacket/blob/master/examples/GetLAPSPassword.py

Description:
This module will gather passwords and password hashes from a target LDAP server via multiple techniques
          including Windows LAPS. For best results, run with SSL because some attributes are only readable over
          encrypted connections.
Metasploit Module: BillQuick Web Suite txtID SQLi
Type: auxiliary
Path: modules/auxiliary/gather/billquick_txtid_sqli.rb
Disclosure date: 2021-10-22
References: URL-https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware, URL-http://billquick.net/download/Support_Download/BQWS2021Upgrade/WebSuite2021LogFile_9_1.pdf, CVE-2021-42258

Description:
This module exploits a SQL injection vulnerability in BillQUick Web Suite prior to version 22.0.9.1.
          The application is .net based, and the database is required to be MSSQL.  Luckily the website gives
          error based SQLi messages, so it is trivial to pull data from the database.  However the webapp
          uses an unknown password security algorithm.  This vulnerability does not seem to support stacked
          queries.
          This module pulls the database name, banner, user, hostname, and the SecurityTable (user table).

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'default.aspx'),
        'method' => 'GET'
      }, datastore['HttpClientTimeout'])
      return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
      return Exploit::CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if res.code != 200

      %r{Version: (?<version>\d{1,2}\.\d{1,2}\.\d{1,2})\.\d{1,2}</span>} =~ res.body

      if version && Rex::Version.new(version) <= Rex::Version.new('22.0.9.1')
        return Exploit::CheckCode::Appears("Version Detected: #{version}")
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown("#{peer} - Could not connect to the web service")
    end
    Exploit::CheckCode::Safe("Unexploitable Version: #{version}")
  end
Metasploit Module: Microsoft Exchange ProxyLogon Collector
Type: auxiliary
Path: modules/auxiliary/gather/exchange_proxylogon_collector.rb
Disclosure date: 2021-03-02
References: CVE-2021-26855, URL-https://proxylogon.com/, URL-https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/, URL-https://docs.microsoft.com/en-us/exchange/client-developer/web-service-reference/distinguishedfolderid, URL-https://github.com/3gstudent/Homework-of-Python/blob/master/ewsManage.py

Description:
This module exploit a vulnerability on Microsoft Exchange Server that
          allows an attacker bypassing the authentication and impersonating as the
          admin (CVE-2021-26855).

          By taking advantage of this vulnerability, it is possible to dump all
          mailboxes (emails, attachments, contacts, ...).

          This vulnerability affects (Exchange 2013 Versions < 15.00.1497.012,
          Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009,
          Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010).

          All components are vulnerable by default.
Metasploit Module: Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability
Type: auxiliary
Path: modules/auxiliary/gather/ie_sandbox_findfiles.rb
Platform: win
Disclosure date: 2016-08-09
Authors: Yorick Koster
References: CVE-2016-3321, MSB-MS16-095, URL-https://securify.nl/advisory/SFY20160301/internet_explorer_iframe_sandbox_local_file_name_disclosure_vulnerability.html

Description:
It was found that Internet Explorer allows the disclosure of local file names.
          This issue exists due to the fact that Internet Explorer behaves different for
          file:// URLs pointing to existing and non-existent files. When used in
          combination with HTML5 sandbox iframes it is possible to use this behavior to
          find out if a local file exists. This technique only works on Internet Explorer
          10 & 11 since these support the HTML5 sandbox. Also it is not possible to do
          this from a regular website as file:// URLs are blocked all together. The attack
          must be performed locally (works with Internet zone Mark of the Web) or from a
          share.
Metasploit Module: Magento XXE Unserialize Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
Disclosure date: 2024-06-11
References: CVE-2024-34102, URL-https://github.com/spacewasp/public_docs/blob/main/CVE-2024-34102.md

Description:
This module exploits a XXE vulnerability in Magento 2.4.7-p1 and below which allows an attacker to read any file on the system.

Check method (fingerprinting):
vprint_status('Trying to get the Magento version')

    # request to check if the target is vulnerable /magento_version
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/magento_version')
    })

    return Exploit::CheckCode::Unknown('Could not detect the version.') unless res&.code == 200

    # Magento/2.4 (Community)
    version, edition = res.body.scan(%r{Magento/([\d.]+) \(([^)]+)\)}).first

    version = Rex::Version.new(version)

    return Exploit::CheckCode::Safe("Detected Magento #{edition} edition version #{version} which is not vulnerable") unless
      version <= (Rex::Version.new('2.4.7')) ||
      version <= (Rex::Version.new('2.4.6-p5')) ||
      version <= (Rex::Version.new('2.4.5-p7')) ||
      version <= (Rex::Version.new('2.4.4-p8')) ||
      (
        edition == 'Enterprise' && (
          version <= (Rex::Version.new('2.4.3-ext-7')) ||
          version <= (Rex::Version.new('2.4.2-ext-7'))
        )
      )

    Exploit::CheckCode::Appears("Detected Magento #{edition} edition version #{version} which is vulnerable")
  end
Metasploit Module: Censys Search
Type: auxiliary
Path: modules/auxiliary/gather/censys_search.rb
References: URL-https://search.censys.io

Description:
The module uses the Censys REST API to access the same data accessible
          through the web interface. The search endpoint allows queries using
          the Censys Search Language against the Hosts dataset. Setting the
          CERTIFICATES option will also retrieve the certificate details for each
          relevant service by querying the Certificates dataset.
Metasploit Module: CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/coldfusion_pms_servlet_file_read.rb
Disclosure date: 2024-03-12
References: CVE-2024-20767, URL-https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html, URL-https://jeva.cc/2973.html

Description:
This module exploits an Improper Access Vulnerability in Adobe Coldfusion versions prior to version
          '2023 Update 6' and '2021 Update 12'. The vulnerability allows unauthenticated attackers to request authentication
          token in the form of a UUID from the /CFIDE/adminapi/_servermanager/servermanager.cfc endpoint. Using that
          UUID attackers can hit the /pms endpoint in order to exploit the Arbitrary File Read Vulnerability.
Metasploit Module: Mac OS X Safari .webarchive File Format UXSS
Type: auxiliary
Path: modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
Disclosure date: 2013-02-22
Authors: joev
References: URL-https://www.rapid7.com/blog/post/2013/04/25/abusing-safaris-webarchive-file-format/

Description:
Generates a .webarchive file for Mac OS X Safari that will attempt to
          inject cross-domain Javascript (UXSS), silently install a browser
          extension, collect user information, steal the cookie database,
          and steal arbitrary local files.

          When opened on the target machine the webarchive file must not have the
          quarantine attribute set, as this forces the webarchive to execute in a
          sandbox.