deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Cambium ePMP 1000 Dump Device Config
Type: auxiliary
Path: modules/auxiliary/scanner/http/epmp1000_dump_config.rb
References: URL-http://ipositivesecurity.com/2015/11/28/cambium-epmp-1000-multiple-vulnerabilities/

Description:
This module dumps Cambium ePMP 1000 device configuration file. An
          ePMP 1000 box has four (4) login accounts - admin/admin, installer/installer,
          home/home, and readonly/readonly. This module requires any one of the following
          login credentials - admin / installer / home - to dump device configuration
          file.
Metasploit Module: HTTP Blind XPATH 1.0 Injector
Type: auxiliary
Path: modules/auxiliary/scanner/http/xpath.rb

Description:
This module exploits blind XPATH 1.0 injections over HTTP GET requests.
Metasploit Module: Syncovery For Linux Web-GUI Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/syncovery_linux_login.rb
Platform: linux

Description:
This module will attempt to authenticate to Syncovery File Sync & Backup Software For Linux Web-GUI.
Metasploit Module: WordPress Total Upkeep Unauthenticated Backup Downloader
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_total_upkeep_downloader.rb
Disclosure date: 2020-12-12
References: CVE-2020-36848, EDB-49252, URL-https://plugins.trac.wordpress.org/changeset/2439376/boldgrid-backup

Description:
This module exploits an unauthenticated database backup vulnerability in WordPress plugin
          'Boldgrid-Backup' also known as 'Total Upkeep' version < 1.14.10.
          First, `env-info.php` is read to get server information.  Next, `restore-info.json` is
          read to retrieve the last backup file.  That backup is then downloaded, and any sql
          files will be parsed looking for the wp_users INSERT statement to grab user creds.
Metasploit Module: D-Link DIR-300B / DIR-600B / DIR-815 / DIR-645 HTTP Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb
References: CVE-1999-0502

Description:
This module attempts to authenticate to different D-Link HTTP management
        services. It has been tested successfully on D-Link DIR-300 Hardware revision B,
        D-Link DIR-600 Hardware revision B, D-Link DIR-815 Hardware revision A and DIR-645
        Hardware revision A devices. It is possible that this module also works with other
        models.
Metasploit Module: Host Information Enumeration via NTLM Authentication
Type: auxiliary
Path: modules/auxiliary/scanner/http/ntlm_info_enumeration.rb
Authors: Brandon Knight

Description:
This module makes requests to resources on the target server in
        an attempt to find resources which permit NTLM authentication. For
        resources which permit NTLM authentication, a blank NTLM type 1 message
        is sent to enumerate a type 2 message from the target server. The type
        2 message is then parsed for information such as the Active Directory
        domain and NetBIOS name.  A single URI can be specified with TARGET_URI
        and/or a file of URIs can be specified with TARGET_URIS_FILE (default).
Metasploit Module: Meteocontrol WEBlog Password Extractor
Type: auxiliary
Path: modules/auxiliary/scanner/http/meteocontrol_weblog_extractadmin.rb
References: URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-16-133-01, CVE-2016-2296, CVE-2016-2298

Description:
This module exploits an authentication bypass vulnerability in Meteocontrol WEBLog appliances (software version < May 2016 release) to extract Administrator password for the device management portal.
Metasploit Module: LiteSpeed Source Code Disclosure/Download
Type: auxiliary
Path: modules/auxiliary/scanner/http/litespeed_source_disclosure.rb
References: CVE-2010-2333, OSVDB-65476, BID-40815, EDB-13850

Description:
This module exploits a source code disclosure/download vulnerability in
        versions 4.0.14 and prior of LiteSpeed.
Metasploit Module: Zen Load Balancer Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/zenload_balancer_traversal.rb
Disclosure date: 2020-04-10
References: CVE-2020-11491, EDB-48308

Description:
This module exploits a authenticated directory traversal vulnerability in Zen Load
          Balancer `v3.10.1`. The flaw exists in 'index.cgi' not properly handling 'filelog='
          parameter which allows a malicious actor to load arbitrary file path.
Metasploit Module: Pretalx Arbitrary File Read/Limited File Write
Type: auxiliary
Path: modules/auxiliary/scanner/http/pretalx_file_read_cve_2023_28459.rb

Description:
This module exploits functionality in Pretalx that export conference schedule as zipped file. The Pretalx will iteratively include any file referenced by any HTML tag and does not properly check the path of the file, which can lead to arbitrary file read. The module requires credentials that allow schedule export, schedule release and approval of proposals. Additionally, module requires conference name and URL for media files.
Metasploit Module: Xorcom CompletePBX Authenticated File Disclosure via Backup Download
Type: auxiliary
Path: modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb
Platform: %w[linux unix
Disclosure date: 2025-03-02
References: CVE-2025-2292, URL-https://xorcom.com/new-completepbx-release-5-2-36-1/, URL-https://chocapikk.com/posts/2025/completepbx/

Description:
This module exploits an authenticated file disclosure vulnerability in CompletePBX <= 5.2.35.
          The issue resides in the backup download function, where user input is not properly validated,
          allowing an attacker to access arbitrary files on the system as root.

          The vulnerability is triggered by setting the `backup` parameter to a Base64-encoded
          absolute file path, prefixed by a comma `,`. This results in the server exposing the
          file contents directly.

Check method (fingerprinting):
completepbx?
  end
Metasploit Module: Cambium ePMP 1000 'ping' Password Hash Extractor (up to v2.5)
Type: auxiliary
Path: modules/auxiliary/scanner/http/epmp1000_dump_hashes.rb
References: URL-http://ipositivesecurity.com/2015/11/28/cambium-epmp-1000-multiple-vulnerabilities/, URL-https://support.cambiumnetworks.com/file/476262a0256fdd8be0e595e51f5112e0f9700f83

Description:
This module exploits an OS Command Injection vulnerability in Cambium
          ePMP 1000 (<v2.5) device management portal. It requires any one of the
          following login credentials - admin/admin, installer/installer, home/home - to
          dump system hashes.
Metasploit Module: DnaLIMS Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/dnalims_file_retrieve.rb
Disclosure date: 2017-03-08
References: CVE-2017-6527, US-CERT-VU-929263, URL-https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/

Description:
This module exploits a directory traversal vulnerability found in dnaLIMS.
          Due to the way the viewAppletFsa.cgi script handles the 'secID' parameter, it is possible
          to read a file outside the www directory.
Metasploit Module: HTTP Open Proxy Detection
Type: auxiliary
Path: modules/auxiliary/scanner/http/open_proxy.rb
Authors: Matteo Cantoni <goony[at]nothink.org>
References: URL-https://en.wikipedia.org/wiki/Open_proxy, URL-https://svn.nmap.org/nmap/scripts/http-open-proxy.nse

Description:
Checks if an HTTP proxy is open. False positive are avoided
          verifying the HTTP return code and matching a pattern.
          The CONNECT method is verified only the return code.
          HTTP headers are shown regarding the use of proxy or load balancer.
Metasploit Module: OWA Exchange Web Services (EWS) Login Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/owa_ews_login.rb
Authors: Rich Whitcroft

Description:
This module attempts to log in to the Exchange Web Services, often
        exposed at https://example.com/ews/, using NTLM authentication. This
        method is faster and simpler than traditional form-based logins.

        In most cases, all you need to set is RHOSTS and some combination of
        user/pass files; the autodiscovery should find the location of the NTLM
        authentication point as well as the AD domain, and use them accordingly.
Metasploit Module: Cambium ePMP 1000 'get_chart' Command Injection (v3.1-3.5-RC7)
Type: auxiliary
Path: modules/auxiliary/scanner/http/epmp1000_get_chart_cmd_exec.rb
References: CVE-2017-5255, URL-https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/

Description:
This module exploits an OS Command Injection vulnerability in Cambium
          ePMP 1000 (v3.1-3.5-RC7) device management portal. It requires any one of the
          following login credentials - admin/admin, installer/installer, home/home - to
          execute arbitrary system commands.
Metasploit Module: Chromecast Web Server Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/chromecast_webserver.rb
Authors: wvu
References: URL-https://store.google.com/product/chromecast?utm_source=chromecast.com&hl=en-US

Description:
This module scans for the Chromecast web server on port 8008/TCP, and
          can be used to discover devices which can be targeted by other Chromecast
          modules, such as chromecast_youtube.
Metasploit Module: BMC TrackIt! Unauthenticated Arbitrary User Password Change
Type: auxiliary
Path: modules/auxiliary/scanner/http/bmc_trackit_passwd_reset.rb
Disclosure date: 2014-12-09
References: URL-https://www.zerodayinitiative.com/advisories/ZDI-14-419/, CVE-2014-8270

Description:
This module exploits a flaw in the password reset mechanism in BMC TrackIt! 11.3
          and possibly prior versions. If the password reset service is configured to use
          a domain administrator (which is the recommended configuration), then domain
          credentials can be reset (such as domain Administrator).
Metasploit Module: Dicoogle PACS Web Server Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/dicoogle_traversal.rb
Disclosure date: 2018-07-11
References: CVE-2018-25113, EDB-45007

Description:
This module exploits an unauthenticated directory traversal vulnerability
          in the Dicoogle PACS Web Server v2.5.0 and possibly earlier, allowing an
          attacker to read arbitrary files with the web server privileges.
          While the application is java based, the directory traversal was only
          successful against Windows targets.
Metasploit Module: Sentry Switched CDU Bruteforce Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/sentry_cdu_enum.rb

Description:
This module scans for ServerTech's Sentry Switched CDU (Cabinet Power
          Distribution Unit) web login portals, and performs login brute force
          to identify valid credentials.
Metasploit Module: Cisco Device HTTP Device Manager Access
Type: auxiliary
Path: modules/auxiliary/scanner/http/cisco_device_manager.rb
Disclosure date: 2000-10-26
References: BID-1846, CVE-2000-0945, OSVDB-444

Description:
This module gathers data from a Cisco device (router or switch) with the device manager
          web interface exposed. The HttpUsername and HttpPassword options can be used to specify
          authentication.
Metasploit Module: Strapi CMS Unauthenticated Password Reset
Type: auxiliary
Path: modules/auxiliary/scanner/http/strapi_3_password_reset.rb
Disclosure date: 2022-02-09
References: URL-https://vulners.com/cve/CVE-2019-18818, URL-https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.4, URL-https://github.com/strapi/strapi/pull/4443, CVE-2019-18818, EDB-50716

Description:
This module abuses the mishandling of a password reset request for
          Strapi CMS version 3.0.0-beta.17.4 to change the password of the admin user.

          Successfully tested against Strapi CMS version 3.0.0-beta.17.4.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'admin', 'init')
    })
    return Exploit::CheckCode::Unknown('Unable to determine due to a HTTP connection timeout') if res.nil?

    begin
      version = JSON.parse(res.body)
    rescue JSON::ParserError
      return Exploit::CheckCode::Safe("Unable to parse json data: #{res.body}")
    end

    # Untested if it works with versions lower than 3.0.0-beta.17.4.
    # builds of 3.0.0-beta.17.3 and lower fail:
    # npm ERR! gyp: Undefined variable standalone_static_library in binding.gyp while trying to load binding.gyp
    # however vulners shows 3.0.0 and up to 3.0.0-beta.17.4 are vulnerable
    version = Rex::Version.new(version.dig('data', 'strapiVersion'))
    if version.start_with?('3.0.0-beta') && (Rex::Version.new(version.split('-beta.')[1]) <= Rex::Version.new('17.4'))
      return Exploit::CheckCode::Vulnerable("Vulnerable version detected: #{version.dig('data', 'strapiVersion')}")
    end

    Exploit::CheckCode::Safe('Strapi version is not vulnerable to password reset')
  end
Metasploit Module: Apache Axis2 Brute Force Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/axis_login.rb
References: CVE-2010-0219, OSVDB-68662

Description:
This module attempts to login to an Apache Axis2 instance using
        username and password combinations indicated by the USER_FILE,
        PASS_FILE, and USERPASS_FILE options. It has been verified to
        work on at least versions 1.4.1 and 1.6.2.
Metasploit Module: HP SiteScope SOAP Call getFileInternal Remote File Access
Type: auxiliary
Path: modules/auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess.rb
References: OSVDB-85119, BID-55269, ZDI-12-176

Description:
This module exploits an authentication bypass vulnerability in HP SiteScope to
        retrieve an arbitrary file from the remote server. It is accomplished by calling
        the getFileInternal operation available through the APISiteScopeImpl AXIS service.
        This module has been successfully tested on HP SiteScope 11.20 over Windows 2003
        SP2 and Linux Centos 6.3.
Metasploit Module: Cisco ASA SSL VPN Privilege Escalation Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb
Disclosure date: 2014-04-09
References: CVE-2014-2127, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa, URL-https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18908

Description:
This module exploits a privilege escalation vulnerability for Cisco
          ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
          level 15.
Metasploit Module: Web-Dorado ECommerce WD for Joomla! search_category_id SQL Injection Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/joomla_ecommercewd_sqli_scanner.rb
Disclosure date: 2015-03-20
References: CVE-2015-2562

Description:
This module will scan for hosts vulnerable to an unauthenticated SQL injection within the
          advanced search feature of the Web-Dorado ECommerce WD 1.2.5 and likely prior.
Metasploit Module: Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb
Disclosure date: 2014-09-24
References: CVE-2014-6271, CVE-2014-6278, OSVDB-112004, EDB-34765, URL-https://access.redhat.com/articles/1200223, URL-https://seclists.org/oss-sec/2014/q3/649

Description:
This module scans for the Shellshock vulnerability, a flaw in how the Bash shell
          handles external environment variables. This module targets CGI scripts in the
          Apache web server by setting the HTTP_USER_AGENT environment variable to a
          malicious function definition.

          PROTIP: Use exploit/multi/handler with a PAYLOAD appropriate to your
          CMD, set ExitOnSession false, run -j, and then run this module to create
          sessions on vulnerable hosts.

          Note that this is not the recommended method for obtaining shells.
          If you require sessions, please use the apache_mod_cgi_bash_env_exec
          exploit module instead.
Metasploit Module: Symantec Web Gateway Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/symantec_web_gateway_login.rb

Description:
This module will attempt to authenticate to a Symantec Web Gateway.
Metasploit Module: HTTP SickRage Password Leak
Type: auxiliary
Path: modules/auxiliary/scanner/http/http_sickrage_password_leak.rb
Disclosure date: 2018-03-08
References: CVE-2018-9160, EDB-44545

Description:
SickRage < v2018-09-03 allows an attacker to view a user's saved Github credentials in HTTP
          responses unless the user has set login information for SickRage.

          By default, SickRage does not require login information for the installation.
Metasploit Module: D-Link DIR-615H HTTP Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb
References: CVE-1999-0502

Description:
This module attempts to authenticate to different D-Link HTTP management
        services. It has been tested successfully on D-Link DIR-615 Hardware revision H
        devices. It is possible that this module also works with other models.
Metasploit Module: Apache Axis2 v1.4.1 Local File Inclusion
Type: auxiliary
Path: modules/auxiliary/scanner/http/axis_local_file_include.rb
References: EDB-12721, OSVDB-59001

Description:
This module exploits an Apache Axis2 v1.4.1 local file inclusion (LFI) vulnerability.
        By loading a local XML file which contains a cleartext username and password, attackers can trivially
        recover authentication credentials to Axis services.
Metasploit Module: Softing Secure Integration Server Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/softing_sis_login.rb

Description:
This module will attempt to authenticate to a Softing Secure Integration Server.
Metasploit Module: Synology Forget Password User Enumeration Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/synology_forget_passwd_user_enum.rb
Disclosure date: 2011-01-05
References: EDB-43455, CVE-2017-9554, URL-https://www.synology.com/en-global/security/advisory/Synology_SA_17_29_DSM

Description:
This module attempts to enumerate users on the Synology NAS
          by sending GET requests for the forgot password URL.
          The Synology NAS will respond differently if a user is present or not.
          These count as login attempts, and the default is 10 logins in 5min to
          get a permanent block.  Set delay accordingly to avoid this, as default
          is permanent.
          Vulnerable DSMs are:
          DSM 6.1 < 6.1.3-15152
          DSM 6.0 < 6.0.3-8754-4
          DSM 5.2 < 5.2-5967-04
Metasploit Module: Microsoft IIS shortname vulnerability scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/iis_shortname_scanner.rb
References: URL-https://soroush.secproject.com/blog/tag/iis-tilde-vulnerability/, URL-http://web.archive.org/web/[PII_REDACTED]4258/http://support.detectify.com/customer/portal/articles/1711520-microsoft-iis-tilde-vulnerability

Description:
The vulnerability is caused by a tilde character "~" in a GET or OPTIONS request, which
          could allow remote attackers to disclose 8.3 filenames (short names). In 2010, Soroush Dalili
          and Ali Abbasnejad discovered the original bug (GET request). This was publicly disclosed in
          2012. In 2014, Soroush Dalili discovered that newer IIS installations are vulnerable with OPTIONS.

Check method (fingerprinting):
is_vul ? Exploit::CheckCode::Vulnerable('Target is vulnerable to IIS shortname scanning') : Exploit::CheckCode::Safe('Target is not vulnerable to IIS shortname scanning')
  rescue Rex::ConnectionError
    print_bad("Failed to connect to target")
    Exploit::CheckCode::Unknown('Failed to connect to target')
  end
Metasploit Module: Nginx Source Code Disclosure/Download
Type: auxiliary
Path: modules/auxiliary/scanner/http/nginx_source_disclosure.rb
References: CVE-2010-2263, OSVDB-65531, BID-40760, EDB-13818, EDB-13822

Description:
This module exploits a source code disclosure/download vulnerability in
        versions 0.7 and 0.8 of the nginx web server. Versions 0.7.66 and 0.8.40
        correct this vulnerability.
Metasploit Module: WordPress Subscribe Comments File Read Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb
References: CVE-2015-10133, URL-https://advisories.dxw.com/advisories/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2/

Description:
This module exploits an authenticated directory traversal vulnerability
          in WordPress Plugin "Subscribe to Comments" version 2.1.2, allowing
          to read arbitrary files with the web server privileges.

Check method (fingerprinting):
check_plugin_version_from_readme('subscribe-to-comments', '2.3')
  end
Metasploit Module: SAP BusinessObjects Web User Bruteforcer
Type: auxiliary
Path: modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb
References: URL-http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf

Description:
This module simply attempts to bruteforce SAP BusinessObjects users by using CmcApp.
Metasploit Module: NetDecision NOCVision Server Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/netdecision_traversal.rb
Disclosure date: 2012-03-07
References: CVE-2012-1465, OSVDB-79863, URL-http://aluigi.altervista.org/adv/netdecision_1-adv.txt

Description:
This module exploits a directory traversal bug in NetDecision's
          TrafficGrapherServer.exe service.  This is done by using "...\" in
          the path to retrieve a file on a vulnerable machine.
Metasploit Module: HTTP Backup File Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/backup_file.rb

Description:
This module identifies the existence of possible copies
          of a specific file in a given path.
Metasploit Module: WordPress CP Multi-View Calendar Unauthenticated SQL Injection Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb
Disclosure date: 2015-03-03
References: CVE-2014-8586, EDB-36243

Description:
This module will scan given instances for an unauthenticated SQL injection
          within the CP Multi-View Calendar plugin v1.1.4 for Wordpress.
Metasploit Module: Apache Reverse Proxy Bypass Vulnerability Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/rewrite_proxy_bypass.rb
Authors: chao-mu
References: URL-http://www.contextis.com/research/blog/reverseproxybypass/, CVE-2011-3368

Description:
Scan for poorly configured reverse proxy servers.
        By default, this module attempts to force the server to make
        a request with an invalid domain name. Then, if the bypass
        is successful, the server will look it up and of course fail,
        then responding with a status code 502. A baseline status code
        is always established and if that baseline matches your test
        status code, the injection attempt does not occur.
        "set VERBOSE true" if you are paranoid and want to catch potential
        false negatives. Works best against Apache and mod_rewrite
Metasploit Module: Ektron CMS400.NET Default Password Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/ektron_cms400net.rb
Authors: Justin Cacak

Description:
Ektron CMS400.NET is a web content management system based on .NET.
          This module tests for installations that are utilizing default
          passwords set by the vendor. Additionally, it has the ability
          to brute force user accounts. Note that Ektron CMS400.NET, by
          default, enforces account lockouts for regular user account
          after a number of failed attempts.