deardaniel/secdata-raw huggingface dataset:
Metasploit Module: BAVision IP Camera Web Server Login
Type: auxiliary
Path: modules/auxiliary/scanner/http/bavision_cam_login.rb

Description:
This module will attempt to authenticate to an IP camera created by BAVision via the
          web service. By default, the vendor ships a default credential admin:123456 to its
          cameras, and the web server does not enforce lockouts in case of a bruteforce attack.
Metasploit Module: Cisco IOS HTTP Unauthorized Administrative Access
Type: auxiliary
Path: modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb
Disclosure date: 2001-06-27
References: BID-2936, CVE-2001-0537, OSVDB-578

Description:
This module exploits a vulnerability in the Cisco IOS HTTP Server.
          By sending a GET request for "/level/num/exec/..", where num is between
          16 and 99, it is possible to bypass authentication and obtain full system
          control. IOS 11.3 -> 12.2 are reportedly vulnerable. This module
          tested successfully against a Cisco 1600 Router IOS v11.3(11d).
Metasploit Module: WordPress Ultimate Member SQL Injection (CVE-2024-1071)
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_ultimate_member_sorting_sqli.rb
Disclosure date: 2024-02-10
References: CVE-2024-1071, URL-https://github.com/gbrsh/CVE-2024-1071, URL-https://www.wordfence.com/blog/2024/02/2063-bounty-awarded-for-unauthenticated-sql-injection-vulnerability-patched-in-ultimate-member-wordpress-plugin/

Description:
The Ultimate Member plugin for WordPress up to version 2.8.2 is vulnerable to SQL injection via
          the 'sorting' parameter. This allows unauthenticated attackers to exploit blind SQL injections and
          extract sensitive information from the database.
Metasploit Module: HTTP Virtual Host Brute Force Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/vhost_scanner.rb

Description:
This module tries to identify unique virtual hosts
          hosted by the target web server.
Metasploit Module: HTTP Blind SQL Injection Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/blind_sql_query.rb

Description:
This module identifies the existence of Blind SQL injection issues
          in GET/POST Query parameters values.
Metasploit Module: Wordpress BulletProof Security Backup Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_bulletproofsecurity_backups.rb
Platform: php
Disclosure date: 2021-09-17
References: EDB-50382, CVE-2021-39327, URL-https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-39327/README.md

Description:
The Wordpress plugin BulletProof Security, versions <= 5.1, suffers from an information disclosure
          vulnerability, in that the db_backup_log.txt is publicly accessible.  If the backup functionality
          is being utilized, this file will disclose where the backup files can be downloaded.
          After downloading the backup file, it will be parsed to grab all user credentials.
Metasploit Module: HTTP Cross-Site Tracing Detection
Type: auxiliary
Path: modules/auxiliary/scanner/http/trace.rb
References: CVE-2005-3398, URL-https://owasp.org/www-community/attacks/Cross_Site_Tracing

Description:
Checks if the host is vulnerable to Cross-Site Tracing (XST)
Metasploit Module: Outlook Web App (OWA) Brute Force Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/owa_login.rb

Description:
This module tests credentials on OWA 2003, 2007, 2010, 2013, and 2016 servers.
Metasploit Module: HP Intelligent Management BIMS DownloadServlet Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/hp_imc_bims_downloadservlet_traversal.rb
References: CVE-2013-4823, OSVDB-98248, BID-62897, ZDI-13-239

Description:
This module exploits a lack of authentication and a directory traversal in HP
          Intelligent Management, specifically in the DownloadServlet from the BIMS component,
          in order to retrieve arbitrary files with SYSTEM privileges. This module has been
          tested successfully on HP Intelligent Management Center 5.1 E0202 with BIMS 5.1 E0201
          over Windows 2003 SP2.
Metasploit Module: WordPress Loginizer log SQLi Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_loginizer_log_sqli.rb
Disclosure date: 2020-10-21
References: URL-https://wpdeeply.com/loginizer-before-1-6-4-sqli-injection/, CVE-2020-27615, URL-https://loginizer.com/blog/loginizer-1-6-4-security-fix/, URL-https://twitter.com/mslavco/status/[PII_REDACTED]84604161

Description:
Loginizer wordpress plugin contains an unauthenticated timebased SQL injection in
          versions before 1.6.4.  The vulnerable parameter is in the log parameter.
          Wordpress has forced updates of the plugin to all servers
Metasploit Module: Radware AppDirector Bruteforce Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/radware_appdirector_enum.rb

Description:
This module scans for Radware AppDirector's web login portal, and performs login brute force
          to identify valid credentials.
Metasploit Module: WordPress ChopSlider3 id SQLi Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_chopslider_id_sqli.rb
Disclosure date: 2020-05-12
References: EDB-48457, CVE-2020-11530, URL-https://seclists.org/fulldisclosure/2020/May/26

Description:
The iDangero.us Chop Slider 3 WordPress plugin version 3.4 and prior
          contains a blind SQL injection in the id parameter of the
          get_script/index.php page.  The injection is passed through GET
          parameters, and thus must be encoded,
          and magic_quotes is applied at the server.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => target_uri.path
    })
    fail_with Failure::Unreachable, 'Connection failed' unless res
    if res && res.body =~ /idangerous.chopslider-(\d\.\d).css-css/
      v = Rex::Version.new(Regexp.last_match(1))
      print_status "Version detected: #{v}"
      if v <= Rex::Version.new('3.4')
        return Msf::Exploit::CheckCode::Appears("ChopSlider version #{v} appears to be vulnerable")
      end
    end
    Msf::Exploit::CheckCode::Unknown('ChopSlider plugin not detected')
  end
Metasploit Module: HP Intelligent Management ReportImgServlt Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/hp_imc_reportimgservlt_traversal.rb
References: CVE-2012-5203, OSVDB-91028, BID-58672, ZDI-13-052

Description:
This module exploits a lack of authentication and a directory traversal in HP
          Intelligent Management, specifically in the ReportImgServlt, in order to retrieve
          arbitrary files with SYSTEM privileges. This module has been tested successfully on
          HP Intelligent Management Center 5.1 E0202 over Windows 2003 SP2.
Metasploit Module: Titan FTP Administrative Password Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/http/titan_ftp_admin_pwd.rb
References: CVE-2013-1625

Description:
On Titan FTP servers prior to version 9.14.1628, an attacker can
      retrieve the username and password for the administrative XML-RPC
      interface, which listens on TCP Port 31001 by default, by sending an
      XML request containing bogus authentication information. After sending
      this request, the server responds with the legitimate username and
      password for the service. With this information, an attacker has
      complete control over the FTP service, which includes the ability to
      add and remove FTP users, as well as add, remove, and modify
      available directories and their permissions.
Metasploit Module: RFCode Reader Web Interface Login / Bruteforce Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/rfcode_reader_enum.rb

Description:
This module simply attempts to login to a RFCode Reader web interface.
          Please note that by default there is no authentication. In such a case, password brute force will not be performed.
          If there is authentication configured, the module will attempt to find valid login credentials and capture device information.
Metasploit Module: Dell iDRAC Default Login
Type: auxiliary
Path: modules/auxiliary/scanner/http/dell_idrac.rb
References: CVE-1999-0502

Description:
This module attempts to login to a iDRAC webserver instance using
        default username and password.  Tested against Dell Remote Access
        Controller 6 - Express version 1.50 and 1.85,
        Controller 7 - Enterprise 2.63.60.62
        Controller 8 - Enterprise 2.83.05
        Controller 9 - Enterprise 4.40.00.00
Metasploit Module: HTTP Header Detection
Type: auxiliary
Path: modules/auxiliary/scanner/http/http_header.rb
References: URL-http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html, URL-https://en.wikipedia.org/wiki/List_of_HTTP_header_fields

Description:
This module shows HTTP Headers returned by the scanned systems.
Metasploit Module: Cisco ASA Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/cisco_directory_traversal.rb
Disclosure date: 2018-06-06
References: CVE-2018-0296, EDB-44956

Description:
This module exploits a directory traversal vulnerability in Cisco's Adaptive Security Appliance (ASA) software and Firepower Threat Defense (FTD) software.
          It lists the contents of Cisco's VPN web service which includes directories, files, and currently logged in users.
Metasploit Module: Emby Version Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/emby_version_ssrf.rb
Authors: Btnz
References: CVE-2020-26948, URL-https://github.com/btnz-k/emby_ssrf

Description:
This module attempts to identify the version of an Emby Media Server running on a
                        host. If you wish to see all the information available, set VERBOSE to true. Use in
                        conjunction with emby_ssrf_scanner to locate devices vulnerable to CVE-2020-26948.
Metasploit Module: Wordpress RegistrationMagic task_ids Authenticated SQLi
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_registrationmagic_sqli.rb
Disclosure date: 2022-01-23
References: CVE-2021-24862, URL-https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24862/README.md, EDB-50686

Description:
RegistrationMagic, a WordPress plugin,
          prior to 5.0.1.5 is affected by an authenticated SQL injection via the
          task_ids parameter.
Metasploit Module: Zabbix Server Brute Force Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/zabbix_login.rb

Description:
This module attempts to login to Zabbix server instance using username and password
        combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. It
        will also test for the Zabbix default login (Admin:zabbix) and guest access.
Metasploit Module: HTTP Strict Transport Security (HSTS) Detection
Type: auxiliary
Path: modules/auxiliary/scanner/http/http_hsts.rb
Authors: Matt "hostess" Andreko <mandreko[at]accuvant.com>

Description:
Display HTTP Strict Transport Security (HSTS) information about each system.
Metasploit Module: Supermicro Onboard IPMI Static SSL Certificate Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/smt_ipmi_static_cert_scanner.rb
Disclosure date: Nov 06 2013
References: CVE-2013-3619, URL-https://www.rapid7.com/blog/post/2013/11/06/supermicro-ipmi-firmware-vulnerabilities/

Description:
This module checks for a static SSL certificate shipped with Supermicro Onboard IPMI
        controllers. An attacker with access to the publicly-available firmware can perform
        man-in-the-middle attacks and offline decryption of communication to the controller.
        This module has been on a Supermicro Onboard IPMI (X9SCL/X9SCM) with firmware
        version SMT_X9_214.
Metasploit Module: Barracuda Multiple Product "locale" Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/barracuda_directory_traversal.rb
Disclosure date: Oct 08 2010
References: CVE-2010-20109, OSVDB-68301, URL-https://web.archive.org/web/[PII_REDACTED]1244/http://secunia.com/advisories/41609/, EDB-15130

Description:
This module exploits a directory traversal vulnerability present in
        several Barracuda products, including the Barracuda Spam and Virus Firewall,
        Barracuda SSL VPN, and the Barracuda Web Application Firewall. By default,
        this module will attempt to download the Barracuda configuration file.
Metasploit Module: Apache 2.4.49/2.4.50 Traversal RCE scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/apache_normalize_path.rb
Disclosure date: 2021-05-10
References: CVE-2021-41773, CVE-2021-42013, URL-https://httpd.apache.org/security/vulnerabilities_24.html, URL-https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse, URL-https://github.com/projectdiscovery/nuclei-templates/blob/master/vulnerabilities/apache/apache-httpd-rce.yaml, URL-https://github.com/projectdiscovery/nuclei-templates/commit/9384dd235ec5107f423d930ac80055f2ce2bff74, URL-https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis

Description:
This module scans for an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773).
          If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled,
          it can be used to execute arbitrary commands (Remote Command Execution).
          This vulnerability has been reintroduced in Apache 2.4.50 fix (CVE-2021-42013).
Metasploit Module: InfluxDB Enum Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/influxdb_enum.rb
References: URL-https://docs.influxdata.com/influxdb/v2.1/, URL-https://www.shodan.io/search?query=X-Influxdb-Version

Description:
This module enumerates databases on InfluxDB using the REST API using the
          default authentication of root:root.
Metasploit Module: Joomla Version Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/joomla_version.rb

Description:
This module scans a Joomla install for information about the underlying
        operating system and Joomla version.
Metasploit Module: Nagios XI Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/nagios_xi_scanner.rb
References: CVE-2019-15949, CVE-2020-5791, CVE-2020-5792, CVE-2020-35578, CVE-2021-37343

Description:
The module detects the version of Nagios XI applications and
        suggests matching exploit modules based on the version number.
        Since Nagios XI applications only reveal the version to authenticated
        users, valid credentials for a Nagios XI account are required.
        Alternatively, it is possible to provide a specific Nagios XI version
        number via the `VERSION` option. In that case, the module simply
        suggests matching exploit modules and does not probe the target(s).
Metasploit Module: Ruby on Rails XML Processor YAML Deserialization Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/rails_xml_yaml_scanner.rb
References: CVE-2013-0156, URL-https://www.rapid7.com/blog/post/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156/

Description:
This module attempts to identify Ruby on Rails instances vulnerable to
          an arbitrary object instantiation flaw in the XML request processor.
Metasploit Module: Gitlab Version Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/gitlab_version.rb

Description:
This module scans a Gitlab install for information about its version.
Metasploit Module: Microsoft Exchange ProxyLogon Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/exchange_proxylogon.rb
Disclosure date: 2021-03-02
References: CVE-2021-26855, URL-https://proxylogon.com/, URL-https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/

Description:
This module scan for a vulnerability on Microsoft Exchange Server that
          allows an attacker bypassing the authentication and impersonating as the
          admin (CVE-2021-26855).

          By chaining this bug with another post-auth arbitrary-file-write
          vulnerability to get code execution (CVE-2021-27065).

          As a result, an unauthenticated attacker can execute arbitrary commands on
          Microsoft Exchange Server.

          This vulnerability affects (Exchange 2013 Versions < 15.00.1497.012,
          Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009,
          Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010).

          All components are vulnerable by default.
Metasploit Module: Citrix ADC (NetScaler) Directory Traversal Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/citrix_dir_traversal.rb
Disclosure date: 2019-12-17
References: CVE-2019-19781, URL-https://web.archive.org/web/[PII_REDACTED]5223/https://support.citrix.com/article/CTX267027/, URL-https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/

Description:
This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC
          (NetScaler). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request
          /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presence of
          a "[global]" directive in smb.conf, which this file should always contain.
Metasploit Module: WebPageTest Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/webpagetest_traversal.rb
Disclosure date: 2012-07-13
References: CVE-2019-17199, EDB-19790, OSVDB-83817

Description:
This module exploits a directory traversal vulnerability found in WebPageTest.
          Due to the way the gettext.php script handles the 'file' parameter, it is possible
          to read a file outside the www directory.
Metasploit Module: Apache NiFi Login Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/apache_nifi_login.rb

Description:
This module attempts to take login details for Apache NiFi websites
          and identify if they are valid or not.

          Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0
          Also works against NiFi <= 1.13.0, but the module needs to be adjusted:
          set SSL false
          set rport 8080
Metasploit Module: Riverbed SteelHead VCX File Read
Type: auxiliary
Path: modules/auxiliary/scanner/http/riverbed_steelhead_vcx_file_read.rb
Disclosure date: Jun 01 2017
References: CVE-2025-34098, EDB-42101

Description:
This module exploits an authenticated arbitrary file read in the log module's filter engine.
          SteelHead VCX (VCX255U) version 9.6.0a was confirmed as vulnerable.
Metasploit Module: HTTP Error Based SQL Injection Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/error_sql_injection.rb

Description:
This module identifies the existence of Error Based SQL injection issues. Still requires a lot of work
Metasploit Module: HP SiteScope SOAP Call getSiteScopeConfiguration Configuration Access
Type: auxiliary
Path: modules/auxiliary/scanner/http/hp_sitescope_getsitescopeconfiguration.rb
References: OSVDB-85120, BID-55269, ZDI-12-173

Description:
This module exploits an authentication bypass vulnerability in HP SiteScope
        which allows to retrieve the HP SiteScope configuration, including administrative
        credentials. It is accomplished by calling the getSiteScopeConfiguration operation
        available through the APISiteScopeImpl AXIS service. The HP SiteScope Configuration
        is retrieved as file containing Java serialization data. This module has been
        tested successfully on HP SiteScope 11.20 over Windows 2003 SP2 and Linux Centos
        6.3.
Metasploit Module: NetAlertX File Read Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/netalertx_file_read.rb
Disclosure date: 2025-01-30
References: CVE-2024-48766, URL-https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/

Description:
This module exploits improper authentication in logs.php endpoint. An unathenticated attacker can request log file and read any file due path traversal vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'maintenance.php')
    })
    return Exploit::CheckCode::Unknown('No response or unexpected status code from target') unless res&.code == 200

    html_document = res.get_html_document
    return Exploit::CheckCode::Unknown('Failed to get html document.') if html_document.blank?

    version_element = html_document.xpath('//div[text()="Installed version"]//following-sibling::*')
    return Exploit::CheckCode::Unknown('Failed to get version element.') if version_element.blank?

    version = Rex::Version.new(version_element.text&.strip&.sub(/^v/, ''))
    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('24.7.18'), Rex::Version.new('24.9.12'))

    Exploit::CheckCode::Appears("Version #{version} detected.")
  end
Metasploit Module: HTTP Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/http_login.rb
References: CVE-1999-0502

Description:
This module attempts to authenticate to HTTP services that
        require Basic, Digest, or WebDAV authentication.
        It will probe URIs to identify endpoints requiring authentication (HTTP 401)
        and then perform brute-force login attempts.
Metasploit Module: GraphQL Introspection Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/graphql_introspection_scanner.rb
References: URL-https://portswigger.net/web-security/graphql, URL-https://graphql.org/learn/introspection/

Description:
This module queries a GraphQL API Endpoint to retrieve schema data by using
          introspection, if it is enabled on the server. This module works on all GraphQL versions.

Check method (fingerprinting):
query = introspection_probe_query
    res = send_graphql_request(query)

    if res.nil?
      return Exploit::CheckCode::Unknown('The server did not send a response.')
    end

    case res.code
    when 200
      json = res.get_json_document

      # validate the JSON response has the expected structure of an introspection response, to avoid false positives.
      if valid_graphql_response?(json)
        graphql_service = report_graphql_service
        report_graphql_vuln
        report_graphql_web_vuln(graphql_service, query, res)

        return Exploit::CheckCode::Vulnerable('The server has introspection enabled.')
      else
        return Exploit::CheckCode::Safe('The server responded with a 200 status code, but the response did not have the expected structure of an introspection response.')
      end
    when 400
      json = res.get_json_document
      error_messages = process_errors(json['errors'] || Array.wrap(json['error']))

      if error_messages.nil?
        return Exploit::CheckCode::Safe('The server responded with an error status code, but did not provide any error messages in the response.')
      end

      safe_message = "The server responded with an error status code and the following error(s) to the introspection request:\n#{error_messages}"
      return Exploit::CheckCode::Safe(safe_message)
    when 403
      # Don't report the GraphQL service here, as this could be a generic 'No Access', so we are not sure if the GraphQL
      # endpoint exists or no
Metasploit Module: Joomla API Improper Access Checks
Type: auxiliary
Path: modules/auxiliary/scanner/http/joomla_api_improper_access_checks.rb
Disclosure date: 2023-02-01
References: EDB-51334, URL-https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-improper-access-check-in-webservice-endpoints.html, URL-https://nsfocusglobal.com/joomla-unauthorized-access-vulnerability-cve-2023-23752-notice/, URL-https://attackerkb.com/topics/18qrh3PXIX/cve-2023-23752, CVE-2023-23752

Description:
Joomla versions between 4.0.0 and 4.2.7, inclusive, contain an improper API access vulnerability.
          This vulnerability allows unauthenticated users access to webservice endpoints which contain
          sensitive information. Specifically for this module we exploit the users and config/application
          endpoints.

          This module was tested against Joomla 4.2.7 running on Docker.
Metasploit Module: Wordpress Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/wordpress_scanner.rb

Description:
Detects Wordpress Versions, Themes, Plugins, and Users