deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Windows Secrets Dump
Type: auxiliary
Path: modules/auxiliary/gather/windows_secrets_dump.rb
References: URL-https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py

Description:
Dumps SAM hashes and LSA secrets (including cached creds) from the
          remote Windows target without executing any agent locally. This is
          done by remotely updating the registry key security descriptor,
          taking advantage of the WriteDACL privileges held by local
          administrators to set temporary read permissions.

          This can be disabled by setting the `INLINE` option to false and the
          module will fallback to the original implementation, which consists
          in saving the registry hives locally on the target
          (%SYSTEMROOT%\Temp\<random>.tmp), downloading the temporary hive
          files and reading the data from it. This temporary files are removed
          when it's done.

          On domain controllers, secrets from Active Directory is extracted
          using [MS-DRDS] DRSGetNCChanges(), replicating the attributes we need
          to get SIDs, NTLM hashes, groups, password history, Kerberos keys and
          other interesting data. Note that the actual `NTDS.dit` file is not
          downloaded. Instead, the Directory Replication Service directly asks
          Active Directory through RPC requests.

          This modules takes care of starting or enabling the Remote Registry
          service if needed. It will restore the service to its original state
          when it's done.

          This is a port of the great Impacket `secretsdump.py` code written by
          Alberto Solino.
Metasploit Module: DNS Record Scanner and Enumerator
Type: auxiliary
Path: modules/auxiliary/gather/enum_dns.rb
References: CVE-1999-0532, OSVDB-492

Description:
This module can be used to gather information about a domain from a
          given DNS server by performing various DNS queries such as zone
          transfers, reverse lookups, SRV record brute forcing, and other techniques.
Metasploit Module: Python Flask Cookie Signer
Type: auxiliary
Path: modules/auxiliary/gather/python_flask_cookie_signer.rb
Disclosure date: 2019-01-26
References: URL-https://github.com/Paradoxis/Flask-Unsign

Description:
This is a generic module which can manipulate Python Flask-based application cookies.
          The Retrieve action will connect to a web server, grab the cookie, and decode it.
          The Resign action will do the same as above, but after decoding it, it will replace
          the contents with that in NEWCOOKIECONTENT, then sign the cookie with SECRET. This
          cookie can then be used in a browser. This is a Ruby based implementation of some
          of the features in the Python project Flask-Unsign.
Metasploit Module: Citrix MetaFrame ICA Published Applications Bruteforcer
Type: auxiliary
Path: modules/auxiliary/gather/citrix_published_bruteforce.rb
References: OSVDB-50617, BID-5817

Description:
This module attempts to brute force program names within the Citrix
          Metaframe ICA server.
Metasploit Module: Piwigo CVE-2023-26876 Gather Credentials via SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/piwigo_cve_2023_26876.rb
Disclosure date: 2023-04-21
References: CVE-2023-26876, URL-https://nvd.nist.gov/vuln/detail/CVE-2023-26876

Description:
This module allows an authenticated user to retrieve the usernames and encrypted passwords of other users in Piwigo through SQL injection using the (filter_user_id) parameter.

Check method (fingerprinting):
login_page = target_uri.path.end_with?('index.php') ? normalize_uri(target_uri.path) : normalize_uri(target_uri.path, '/index.php')

    res = send_request_cgi(
      'method' => 'GET',
      'keep_cookies' => true,
      'uri' => login_page
    )

    if res && res.code == 200 && res.body.match(%r{themes/default/js/jquery.min.js\?v13.5.0})
      return Exploit::CheckCode::Appears('The target is running Piwigo with version 13.5.0')
    else
      return Exploit::CheckCode::Safe('The target does not appear to be running Piwigo with vulnerable version')
    end
  rescue ::Rex::ConnectionError
    return Exploit::CheckCode::Unknown("#{peer} - Connection failed")
  end
Metasploit Module: HTTP Client Information Gather
Type: auxiliary
Path: modules/auxiliary/gather/browser_info.rb
Disclosure date: 2016-03-22

Description:
This module gathers information about a browser that exploits might be interested in, such
          as OS name, browser version, plugins, etc. By default, the module will return a fake 404,
          but you can customize this output by changing the Custom404 datastore option, and
          redirect to an external web page.
Metasploit Module: Sante PACS Server Path Traversal (CVE-2025-2264)
Type: auxiliary
Path: modules/auxiliary/gather/pacsserver_traversal.rb
Disclosure date: 2025-03-13
References: CVE-2025-2264, URL-https://www.tenable.com/security/research/tra-2025-08

Description:
This module exploits a path traversal vulnerability (CVE-2025-2264) in Sante PACS Server <= v4.1.0 to retrieve arbitrary files from the system.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'index.html')
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    if res&.code == 200
      data = res.to_s
      if data.include?('Sante PACS Server PG')
        return Exploit::CheckCode::Detected('Sante PACS Server PG seems to be running on the server.')
      end

    end
    return Exploit::CheckCode::Safe('Target does not appear to be Sante PACS Server')
  end
Metasploit Module: Dolibarr Gather Credentials via SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/dolibarr_creds_sqli.rb
Disclosure date: 2018-05-30
References: CVE-2018-10094, EDB-44805

Description:
This module enables an authenticated user to collect the usernames and
          encrypted passwords of other users in the Dolibarr ERP/CRM via SQL
          injection.
Metasploit Module: WordPress All-in-One Migration Export
Type: auxiliary
Path: modules/auxiliary/gather/wp_all_in_one_migration_export.rb
Disclosure date: 2015-03-19
References: URL-https://www.pritect.net/blog/all-in-one-wp-migration-2-0-4-security-vulnerability

Description:
This module allows you to export Wordpress data (such as the database, plugins, themes,
          uploaded files, etc) via the All-in-One Migration plugin without authentication.

Check method (fingerprinting):
check_plugin_version_from_readme('all-in-one-wp-migration', '2.0.5')
  end
Metasploit Module: GitLab Tags RSS feed email disclosure
Type: auxiliary
Path: modules/auxiliary/gather/gitlab_tags_rss_feed_email_disclosure.rb
Disclosure date: 2024-01-25
References: URL-https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/, URL-https://hackerone.com/reports/2208790, CVE-2023-5612

Description:
An issue has been discovered in GitLab affecting all versions
          before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1.
          It is possible to read the user email address via tags feed
          although the visibility in the user profile has been disabled.
Metasploit Module: CorpWatch Company Name Information Search
Type: auxiliary
Path: modules/auxiliary/gather/corpwatch_lookup_name.rb
References: URL-http://api.corpwatch.org/

Description:
This module interfaces with the CorpWatch API to get publicly available
          info for a given company name.  Please note that by using CorpWatch API, you
          acknowledge the limitations of the data CorpWatch provides, and should always
          verify the information with the official SEC filings before taking any action.
Metasploit Module: Discover External IP via Ifconfig.me
Type: auxiliary
Path: modules/auxiliary/gather/external_ip.rb
Authors: RageLtMan <rageltman[at]sempervictus>
References: URL-http://ifconfig.me/ip

Description:
This module checks for the public source IP address of the current
        route to the RHOST by querying the public web application at ifconfig.me.
        It should be noted this module will register activity on ifconfig.me,
        which is not affiliated with Metasploit.
Metasploit Module: QNAP NAS/NVR Administrator Hash Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/qnap_backtrace_admin_hash.rb
Disclosure date: 2017-01-31
References: URL-https://seclists.org/fulldisclosure/2017/Feb/2, URL-https://en.wikipedia.org/wiki/Binary_search_algorithm

Description:
This module exploits combined heap and stack buffer overflows for QNAP
          NAS and NVR devices to dump the admin (root) shadow hash from memory via
          an overwrite of __libc_argv[0] in the HTTP-header-bound glibc backtrace.

          A binary search is performed to find the correct offset for the BOFs.
          Since the server forks, blind remote exploitation is possible, provided
          the heap does not have ASLR.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/cgi-bin/authLogin.cgi'
    )

    if res && res.code == 200 && (xml = res.get_xml_document)
      info = []

      %w{modelName version build patch}.each do |node|
        info << xml.at("//#{node}").text
      end

      @target = (xml.at('//platform').text == 'TS-NASX86' ? 'x86' : 'ARM')
      vprint_status("QNAP #{info[0]} #{info[1..-1].join('-')} detected")

      if Rex::Version.new(info[1]) < Rex::Version.new('4.2.3')
        Exploit::CheckCode::Appears("QNAP #{info[0]} version #{info[1]} is older than the patched version 4.2.3")
      else
        Exploit::CheckCode::Detected("QNAP #{info[0]} version #{info[1]} detected but not confirmed vulnerable")
      end
    else
      Exploit::CheckCode::Safe('Target does not appear to be a QNAP device')
    end
  end
Metasploit Module: AVideo Unauthenticated SQL Injection Credential Dump
Type: auxiliary
Path: modules/auxiliary/gather/avideo_catname_sqli.rb
Disclosure date: 2026-03-05
References: CVE-2026-28501

Description:
AVideo <= 22.0 is vulnerable to unauthenticated SQL injection via the
          catName parameter in objects/videos.json.php (CVE-2026-28501).

          The security filter in security.php sanitizes GET/POST parameters but
          does not cover JSON request bodies. Since videos.json.php parses JSON
          input and merges it into $_REQUEST after the filter runs, a catName
          value sent as JSON bypasses sanitization entirely and reaches
          getCatSQL() unsanitized.

          This module uses time-based blind injection with BENCHMARK() to dump
          usernames and password hashes. SLEEP() is blocked by the sqlDAL
          prepared statement layer, but BENCHMARK(N*(condition), SHA1(x)) works
          because the condition is evaluated as a multiplier on the iteration
          count, avoiding the subquery restrictions imposed by prepare().

          Fixed in 24.0 (no 23.0 release exists).

Check method (fingerprinting):
res = send_request_cgi('uri' => endpoint_uri, 'method' => 'GET')

    return Exploit::CheckCode::Unknown('Failed to connect to the target.') unless res
    return Exploit::CheckCode::Safe("Unexpected HTTP #{res.code}") unless res.code == 200

    json = res.get_json_document
    return Exploit::CheckCode::Safe('Response is not valid JSON') if json.empty?
    return Exploit::CheckCode::Safe('Response missing expected fields') unless json.key?('total') && json.key?('rows')

    setup_sqli

    if @setup_sqli.test_vulnerable
      return Exploit::CheckCode::Vulnerable('Time-based blind SQLi confirmed via BENCHMARK()')
    end

    Exploit::CheckCode::Safe('Endpoint accessible but injection did not trigger')
  end
Metasploit Module: Search Engine Subdomains Collector
Type: auxiliary
Path: modules/auxiliary/gather/searchengine_subdomains_collector.rb

Description:
This module can be used to gather subdomains about a domain
          from Yahoo, Bing.
Metasploit Module: Cerberus Helpdesk User Hash Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/cerberus_helpdesk_hash_disclosure.rb
Disclosure date: Mar 7 2016
References: EDB-39526

Description:
This module extracts usernames and password hashes from the Cerberus Helpdesk
        through an unauthenticated access to a workers file.
        Verified on Version 4.2.3 Stable (Build 925) and 5.4.4
Metasploit Module: IBM BigFix Relay Server Sites and Package Enum
Type: auxiliary
Path: modules/auxiliary/gather/ibm_bigfix_sites_packages_enum.rb
Disclosure date: 2019-03-18
References: CVE-2019-4061, URL-https://www.atredis.com/blog/2019/3/18/harvesting-data-from-bigfix-relay-servers

Description:
This module retrieves masthead, site, and available package information
          from IBM BigFix Relay Servers.
Metasploit Module: Joomla weblinks-categories Unauthenticated SQL Injection Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/joomla_weblinks_sqli.rb
Disclosure date: 2014-03-02
References: CVE-2014-7981, EDB-31459, URL-http://web.archive.org/web/[PII_REDACTED]2328/https://developer.joomla.org/security/[PII_REDACTED]1-core-sql-injection.html

Description:
Joomla versions 3.2.2 and below are vulnerable to an unauthenticated SQL injection
          which allows an attacker to access the database or read arbitrary files as the
          'mysql' user. This module will only work if the mysql user Joomla is using
          to access the database has the LOAD_FILE permission.

Check method (fingerprinting):
front_marker = Rex::Text.rand_text_alpha(6)
    back_marker = Rex::Text.rand_text_alpha(6)

    payload = datastore['CATEGORYID'].to_s
    payload << ") UNION ALL SELECT CONCAT(0x#{front_marker.unpack('H*')[0]},"
    payload << "IFNULL(CAST(VERSION() "
    payload << "AS CHAR),0x20),0x#{back_marker.unpack('H*')[0]})#"

    resp = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'index.php', 'weblinks-categories'),
      'vars_get' => {
        'id' => payload
      }
    })

    if !resp or !resp.body
      return Exploit::CheckCode::Unknown('No response received from the target')
    end

    if resp.body =~ /404<\/span> Category not found/
      return Exploit::CheckCode::Unknown('Joomla detected but com_weblinks component not found')
    end

    version = /#{front_marker}(.*)#{back_marker}/.match(resp.body)

    if !version
      return Exploit::CheckCode::Safe('Could not determine Joomla version')
    end

    version = version[1].gsub(front_marker, '').gsub(back_marker, '')
    print_good("Fingerprinted: #{version}")
    return Exploit::CheckCode::Vulnerable("Joomla #{version} is vulnerable to com_weblinks SQLi")
  end
Metasploit Module: Find Users Without Pre-Auth Required (ASREP-roast)
Type: auxiliary
Path: modules/auxiliary/gather/asrep.rb
References: URL-https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/as-rep-roasting-using-rubeus-and-hashcat

Description:
This module searches for AD users without pre-auth required. Two different approaches
          are provided:
          - Brute force of usernames (does not require a user account; should not lock out accounts)
          - LDAP lookup (requires an AD user account)
Metasploit Module: Flash "Rosetta" JSONP GET/POST Response Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/flash_rosetta_jsonp_url_disclosure.rb
Disclosure date: 2014-07-08
References: CVE-2014-4671, URL-http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/, URL-https://github.com/mikispag/rosettaflash, URL-https://www.quaxio.com/jsonp_handcrafted_flash_files/

Description:
A website that serves a JSONP endpoint that accepts a custom alphanumeric
          callback of 1200 chars can be abused to serve an encoded swf payload that
          steals the contents of a same-domain URL. Flash < 14.0.0.145 is required.

          This module spins up a web server that, upon navigation from a user, attempts
          to abuse the specified JSONP endpoint URLs by stealing the response from
          GET requests to STEAL_URLS.

Check method (fingerprinting):
test_string = Rex::Text.rand_text_alphanumeric(encoded_swf.length)
    io = URI.parse(exploit_url(test_string)).open
    if io.read.start_with? test_string
      Msf::Exploit::CheckCode::Vulnerable('JSONP endpoint reflects callback with sufficient length')
    else
      Msf::Exploit::CheckCode::Safe('JSONP endpoint does not reflect callback as expected')
    end
  end
Metasploit Module: McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure
Type: auxiliary
Path: modules/auxiliary/gather/mcafee_epo_xxe.rb
Disclosure date: 2015-01-06
References: CVE-2015-0921, CVE-2015-0922, URL-https://seclists.org/fulldisclosure/2015/Jan/8

Description:
This module will exploit an authenticated XXE vulnerability to read the keystore.properties
          off of the filesystem. This properties file contains an encrypted password that is set during
          installation. What is interesting about this password is that it is set as the same password
          as the database 'sa' user and of the admin user created during installation. This password
          is encrypted with a static key, and is encrypted using a weak cipher (ECB). By default,
          if installed with a local SQL Server instance, the SQL Server is listening on all interfaces.

          Recovering this password allows an attacker to potentially authenticate as the 'sa' SQL Server
          user in order to achieve remote command execution with permissions of the database process. If
          the administrator has not changed the password for the initially created account since installation,
          the attacker will have the password for this account. By default, 'admin' is recommended.

          Any user account can be used to exploit this, all that is needed is a valid credential.

          The most data that can be successfully retrieved is 255 characters due to length restrictions
          on the field used to perform the XXE attack.
Metasploit Module: Prometheus Node Exporter And Windows Exporter Information Gather
Type: auxiliary
Path: modules/auxiliary/gather/prometheus_node_exporter_gather.rb
Disclosure date: 2013-04-18
References: URL-https://github.com/prometheus/node_exporter, URL-https://sysdig.com/blog/exposed-prometheus-exploit-kubernetes-kubeconeu/, URL-https://www.aquasec.com/blog/300000-prometheus-servers-and-exporters-exposed-to-dos-attacks/

Description:
This modules connects to a Prometheus Node Exporter or Windows Exporter service
          and gathers information about the host.

          Tested against Docker image 1.6.1, Linux 1.6.1, and Windows 0.23.1
Metasploit Module: Splunk __raw Server Info Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/splunk_raw_server_info.rb
Disclosure date: 2018-06-08
References: EDB-44865, URL-https://web.archive.org/web/[PII_REDACTED]1756/https://www.splunk.com/en_us/product-security/announcements-archive/SP-CAAAP5E.html, CVE-2018-11409

Description:
Splunk 6.2.3 through 7.0.1 allows information disclosure by appending
          /__raw/services/server/info/server-info?output_mode=json to a query.
          Versisons 6.6.0 through 7.0.1 require authentication.
Metasploit Module: vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/vbulletin_getindexablecontent_sqli.rb
Disclosure date: 2020-03-12
References: CVE-2020-12720

Description:
This module exploits a SQL injection vulnerability found in vBulletin 5.x.x to dump the user
          table information or to dump all of the vBulletin tables (based on the selected options). This
          module has been tested successfully on VBulletin Version 5.6.1 on Ubuntu Linux.
Metasploit Module: Apache ZooKeeper Information Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/zookeeper_info_disclosure.rb
Disclosure date: 2020-10-14
References: URL-https://zooKeeper.apache.org/doc/current/zookeeperAdmin.html

Description:
Apache ZooKeeper server service runs on TCP 2181 and by default, it is accessible without any authentication. This module targets Apache ZooKeeper service instances to extract information about the system environment, and service statistics.
Metasploit Module: Rancher Authenticated API Credential Exposure
Type: auxiliary
Path: modules/auxiliary/gather/rancher_authenticated_api_cred_exposure.rb
Disclosure date: 2022-08-18
References: URL-https://github.com/fe-ax/tf-cve-2021-36782, URL-https://fe.ax/cve-2021-36782/, CVE-2021-36782

Description:
An issue was discovered in Rancher versions up to and including
          2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys
          and Ranchers service account token (used to provision clusters),
          were stored in plaintext directly on Kubernetes objects like Clusters,
          for example cluster.management.cattle.io. Anyone with read access to
          those objects in the Kubernetes API could retrieve the plaintext
          version of those sensitive data.

Check method (fingerprinting):
return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service, or does not seem to be a rancher website") unless rancher?

    Exploit::CheckCode::Detected('Seems to be rancher, but unable to determine version')
  end
Metasploit Module: SaltStack Salt Master Server Root Key Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/saltstack_salt_root_key.rb
Disclosure date: 2020-04-30
References: CVE-2020-11651, CVE-2020-11652, URL-https://labs.f-secure.com/advisories/saltstack-authorization-bypass, URL-https://community.saltstack.com/blog/critical-vulnerabilities-update-cve-2020-11651-and-cve-2020-11652/, URL-https://www.vmware.com/security/advisories/VMSA-2020-0009.html, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG, URL-https://github.com/saltstack/salt/blob/master/tests/integration/master/test_clear_funcs.py

Description:
This module exploits unauthenticated access to the _prep_auth_info()
          method in the SaltStack Salt master's ZeroMQ request server, for
          versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the
          root key used to authenticate administrative commands to the master.

          VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as
          well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual
          Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2,
          1.3, 1.5, and 1.6 in certain configurations, are known to be affected
          by the Salt vulnerabilities.

          Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as
          well as Vulhub's Docker image.
Metasploit Module: CorpWatch Company ID Information Search
Type: auxiliary
Path: modules/auxiliary/gather/corpwatch_lookup_id.rb
References: URL-http://api.corpwatch.org/

Description:
This module interfaces with the CorpWatch API to get publicly available
          info for a given CorpWatch ID of the company.  If you don't know the
          CorpWatch ID, please use the corpwatch_lookup_name module first.
Metasploit Module: Asterisk Gather Credentials
Type: auxiliary
Path: modules/auxiliary/gather/asterisk_creds.rb
Authors: bcoles
References: URL-http://www.asterisk.name/sip1.html, URL-http://www.asterisk.name/iax2.html, URL-https://www.voip-info.org/wiki/view/Asterisk+manager+API, URL-https://www.voip-info.org/wiki-Asterisk+CLI

Description:
This module retrieves SIP and IAX2 user extensions and credentials from
          Asterisk Call Manager service. Valid manager credentials are required.
Metasploit Module: Elasticsearch Enumeration Utility
Type: auxiliary
Path: modules/auxiliary/gather/elasticsearch_enum.rb
References: URL-https://www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html

Description:
This module enumerates Elasticsearch instances. It uses the REST API
          in order to gather information about the server, the cluster, nodes,
          in the cluster, indices, and pull data from those indices.