deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Eaton Xpert Meter SSH Private Key Exposure Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/eaton_xpert_backdoor.rb
Disclosure date: 2018-07-18
References: CVE-2018-16158, EDB-45283, URL-https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf, URL-https://www.ctrlu.net/vuln/0006.html

Description:
Eaton Power Xpert Meters running firmware below version 12.x.x.x or
          below version 13.3.x.x ship with a public/private key pair that
          facilitate remote administrative access to the devices.
          Tested on: Firmware 12.1.9.1 and 13.3.2.10.
Metasploit Module: SSH Public Key Acceptance Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb

Description:
This module can determine what public keys are configured for
        key-based authentication across a range of machines, users, and
        sets of known keys. The SSH protocol indicates whether a particular
        key is accepted prior to the client performing the actual signed
        authentication request. To use this module, a text file containing
        one or more SSH keys should be provided. These can be private or
        public, so long as no passphrase is set on the private keys.

        If you have loaded a database plugin and connected to a database
        this module will record authorized public keys and hosts so you can
        track your process.

        Key files may be a single public (unencrypted) key, or several public
        keys concatenated together as an ASCII text file. Non-key data should be
        silently ignored. Private keys will only utilize the public key component
        stored within the key file.
Metasploit Module: Jenkins Server Broadcast Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/jenkins/jenkins_udp_broadcast_enum.rb
References: URL-https://wiki.jenkins-ci.org/display/JENKINS/Auto-discovering+Jenkins+on+the+network

Description:
This module sends out a udp broadcast packet querying for
          any Jenkins servers on the local network.
          Be advised that while this module does not identify the
          port on which Jenkins is running, the default port for
          Jenkins is 8080.
Metasploit Module: NNTP Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/nntp/nntp_login.rb
Authors: bcoles
References: CVE-1999-0502, URL-https://datatracker.ietf.org/doc/html/rfc3977, URL-https://datatracker.ietf.org/doc/html/rfc4642, URL-https://datatracker.ietf.org/doc/html/rfc4643

Description:
This module attempts to authenticate to NNTP services
          which support the AUTHINFO authentication extension.

          This module supports AUTHINFO USER/PASS authentication,
          but does not support AUTHINFO GENERIC or AUTHINFO SASL
          authentication methods.
Metasploit Module: GitLab User Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/http/gitlab_user_enum.rb
Disclosure date: 2014-11-21
Authors: Ben Campbell
References: URL-https://labs.f-secure.com/archive/gitlab-user-enumeration/

Description:
The GitLab 'internal' API is exposed unauthenticated on GitLab. This
          allows the username for each SSH Key ID number to be retrieved. Users
          who do not have an SSH Key cannot be enumerated in this fashion. LDAP
          users, e.g. Active Directory users will also be returned. This issue
          was fixed in GitLab v7.5.0 and is present from GitLab v5.0.0.
Metasploit Module: Concrete5 Member List Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/http/concrete5_member_list.rb
References: URL-https://blog.c22.cc/, URL-https://www.concretecms.com/, URL-https://web.archive.org/web/[PII_REDACTED]5851/http://www.concrete5.org/documentation/using-concrete5/dashboard/users-and-groups/

Description:
This module extracts username information from the Concrete5 member page
Metasploit Module: Wordpress Plugin WooCommerce Payments Unauthenticated Admin Creation
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_woocommerce_payments_add_user.rb
Disclosure date: 2023-03-22
References: URL-https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/, URL-https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/, CVE-2023-28121

Description:
WooCommerce-Payments plugin for Wordpress versions 4.8', '4.8.2, 4.9', '4.9.1,
          5.0', '5.0.4, 5.1', '5.1.3, 5.2', '5.2.2, 5.3', '5.3.1, 5.4', '5.4.1,
          5.5', '5.5.2, and 5.6', '5.6.2 contain an authentication bypass by specifying a valid user ID number
          within the X-WCPAY-PLATFORM-CHECKOUT-USER header. With this authentication bypass, a user can then use the API
          to create a new user with administrative privileges on the target WordPress site IF the user ID
          selected corresponds to an administrator account.

Check method (fingerprinting):
unless wordpress_and_online?
      return Msf::Exploit::CheckCode::Safe('Server not online or not detected as wordpress')
    end

    vuln_versions = [
      ['4.8', '4.8.2'],
      ['4.9', '4.9.1'],
      ['5.0', '5.0.4'],
      ['5.1', '5.1.3'],
      ['5.2', '5.2.2'],
      ['5.3', '5.3.1'],
      ['5.4', '5.4.1'],
      ['5.5', '5.5.2'],
      ['5.6', '5.6.2']
    ]

    vuln_versions.each do |versions|
      introduced = versions[0]
      fixed = versions[1]
      checkcode = check_plugin_version_from_readme('woocommerce-payments', fixed, introduced)
      if checkcode == Exploit::CheckCode::Appears
        return Msf::Exploit::CheckCode::Appears('WooCommerce-Payments version is exploitable')
      end
    end

    Msf::Exploit::CheckCode::Safe('WooCommerce-Payments version not vulnerable or plugin not installed')
  end
Metasploit Module: HTTP Copy File Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/copy_of_file.rb

Description:
This module identifies the existence of possible copies
          of a specific file in a given path.
Metasploit Module: Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/allegro_rompager_misfortune_cookie.rb
Disclosure date: 2014-12-17
References: CVE-2014-9222, URL-http://mis.fortunecook.ie, URL-http://mis.fortunecook.ie/misfortune-cookie-suspected-vulnerable.pdf, URL-http://mis.fortunecook.ie/too-many-cooks-exploiting-tr069_tal-oppenheim_31c3.pdf

Description:
This module scans for HTTP servers that appear to be vulnerable to the
          'Misfortune Cookie' vulnerability which affects Allegro Software
          Rompager versions before 4.34 and can allow attackers to authenticate
          to the HTTP service as an administrator without providing valid
          credentials.
Metasploit Module: WordPress Duplicator File Read Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_duplicator_file_read.rb
Disclosure date: 2020-02-19
References: CVE-2020-11738, URL-https://snapcreek.com/duplicator/docs/changelog

Description:
This module exploits an unauthenticated directory traversal vulnerability in WordPress plugin
          'Duplicator' version 1.3.24-1.3.26, allowing arbitrary file read with the web server privileges.
          This vulnerability was being actively exploited when it was discovered.

Check method (fingerprinting):
check_plugin_version_from_readme('duplicator_download', '1.3.27', '1.3.24')
  end
Metasploit Module: Cambium cnPilot r200/r201 Login Scanner and Config Dump
Type: auxiliary
Path: modules/auxiliary/scanner/http/cnpilot_r_web_login_loot.rb
References: CVE-2017-5260, URL-https://www.rapid7.com/blog/post/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/

Description:
This module scans for Cambium cnPilot r200/r201 management login
          portal(s), attempts to identify valid credentials, and dump device
          configuration.

          The device has at least two (2) users - admin and user. Due to an
          access control vulnerability, it is possible for 'user' account to access full
          device config. All information, including passwords, and keys, is stored
          insecurely, in clear-text form, thus allowing unauthorized admin access to any
          user.
Metasploit Module: Bitweaver overlay_type Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb
Disclosure date: 2012-10-23
References: CVE-2012-5192, OSVDB-86599, EDB-22216, URL-http://web.archive.org/web/[PII_REDACTED]1908/https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt

Description:
This module exploits a directory traversal vulnerability found in Bitweaver.
          When handling the 'overlay_type' parameter, view_overlay.php fails to do any
          path checking/filtering, which can be abused to read any file outside the
          virtual directory.
Metasploit Module: SevOne Network Performance Management Application Brute Force Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/sevone_enum.rb
Disclosure date: 2013-06-07

Description:
This module scans for SevOne Network Performance Management System Application,
          finds its version, and performs login brute force to identify valid credentials.
Metasploit Module: IP Board Login Auxiliary Module
Type: auxiliary
Path: modules/auxiliary/scanner/http/ipboard_login.rb
Authors: Christopher Truncer chris@christophertruncer.com

Description:
This module attempts to validate user provided credentials against
        an IP Board web application.
Metasploit Module: JBoss Status Servlet Information Gathering
Type: auxiliary
Path: modules/auxiliary/scanner/http/jboss_status.rb
Authors: Matteo Cantoni <goony[at]nothink.org>
References: CVE-2008-3273, CVE-2010-1429, URL-https://seclists.org/fulldisclosure/2011/Sep/139, URL-https://owasp.org/www-pdf-archive/OWASP3011_Luca.pdf, URL-https://www.slideshare.net/chrisgates/lares-fromlowtopwned

Description:
This module queries the JBoss status servlet to collect sensitive
        information, including URL paths, GET parameters and client IP addresses.
        This module has been tested against JBoss 4.0, 4.2.2 and 4.2.3.
Metasploit Module: ElasticSearch Snapshot API Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/elasticsearch_traversal.rb
References: CVE-2015-5531

Description:
'This module exploits a directory traversal vulnerability in
          ElasticSearch, allowing an attacker to read arbitrary files
          with JVM process privileges, through the Snapshot API.'
Metasploit Module: Squid Proxy Port Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/squid_pivot_scanning.rb
References: URL-http://wiki.squid-cache.org/SquidFaq/SecurityPitfalls

Description:
A exposed Squid proxy will usually allow an attacker to make requests on
        their behalf. If misconfigured, this may give the attacker information
        about devices that they cannot normally reach. For example, an attacker
        may be able to make requests for internal IP addresses against an open
        Squid proxy exposed to the Internet, therefore performing a port scan
        against the internal network.

        The `auxiliary/scanner/http/open_proxy` module can be used to test for
        open proxies, though a Squid proxy does not have to be on the open
        Internet in order to allow for pivoting (e.g. an Intranet Squid proxy
        which allows the attack to pivot to another part of the internal
        network).

        This module will not be able to scan network ranges or ports denied by
        Squid ACLs. Fortunately it is possible to detect whether a host was up
        and the port was closed, or if the request was blocked by an ACL, based
        on the response Squid gives. This feedback is provided to the user in
        meterpreter `VERBOSE` output, otherwise only open and permitted ports
        are printed.
Metasploit Module: Apache ActiveMQ Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/apache_activemq_traversal.rb
References: CVE-2010-1587, OSVDB-86401, URL-http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=895, URL-https://issues.apache.org/jira/browse/amq-2788

Description:
This module exploits a directory traversal vulnerability in Apache ActiveMQ
          5.3.1 and 5.3.2 on Windows systems. The vulnerability exists in the Jetty's
          ResourceHandler installed with the affected versions. This module has been tested
          successfully on ActiveMQ 5.3.1 and 5.3.2 over Windows 2003 SP2.
Metasploit Module: Kodi 17.0 Local File Inclusion Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/kodi_traversal.rb
Disclosure date: 2017-02-12
References: CVE-2017-5982

Description:
This module exploits a directory traversal flaw found in Kodi before 17.1.
Metasploit Module: HTTP Microsoft SQL Injection Table XSS Infection
Type: auxiliary
Path: modules/auxiliary/scanner/http/lucky_punch.rb

Description:
This module implements the mass SQL injection attack in
          use lately by concatenation of HTML string that forces a persistent
          XSS attack to redirect user browser to an attacker controller website.
Metasploit Module: WordPress NextGEN Gallery Directory Read Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb
References: CVE-2015-9538, URL-http://permalink.gmane.org/gmane.comp.security.oss.general/17650

Description:
This module exploits an authenticated directory traversal vulnerability
          in WordPress Plugin "NextGEN Gallery" version 2.1.7, allowing
          to read arbitrary directories with the web server privileges.

Check method (fingerprinting):
check_plugin_version_from_readme('nextgen-gallery', '2.1.9')
  end
Metasploit Module: Joomla Plugins Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/joomla_plugins.rb

Description:
This module scans a Joomla install for plugins and potential
        vulnerabilities.
Metasploit Module: Novell ZENworks Asset Management 7.5 Remote File Access
Type: auxiliary
Path: modules/auxiliary/scanner/http/zenworks_assetmanagement_fileaccess.rb
References: CVE-2012-4933, URL-https://www.rapid7.com/blog/post/2012/10/11/cve-2012-4933-novell-zenworks/

Description:
This module exploits a hardcoded user and password for the GetFile maintenance
          task in Novell ZENworks Asset Management 7.5. The vulnerability exists in the Web
          Console and can be triggered by sending a specially crafted request to the rtrlet component,
          allowing a remote unauthenticated user to retrieve a maximum of 100_000_000 KB of
          remote files. This module has been successfully tested on Novell ZENworks Asset
          Management 7.5.
Metasploit Module: Path Traversal in Oracle GlassFish Server Open Source Edition
Type: auxiliary
Path: modules/auxiliary/scanner/http/glassfish_traversal.rb
Disclosure date: 2015-08-08
References: CVE-2[PII_REDACTED], URL-https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18822, EDB-39441

Description:
This module exploits an unauthenticated directory traversal vulnerability
          which exists in administration console of Oracle GlassFish Server 4.1, which is
          listening by default on port 4848/TCP.
Metasploit Module: HTTP Subversion Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/svn_scanner.rb
Authors: et

Description:
Detect subversion directories and files and analyze its content. Only SVN Version > 7 supported
Metasploit Module: FortiMail Unauthenticated Login Bypass Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/fortimail_login_bypass_detection.rb
References: CVE-2020-9294, URL-https://www.fortiguard.com/psirt/FG-IR-20-045, URL-https://www.redguard.ch/blog/2020/07/02/fortimail-unauthenticated-login-bypass/

Description:
This module attempts to detect instances of FortiMail vulnerable
        against an unauthenticated login bypass (CVE-2020-9294).
Metasploit Module: Cisco ASA Clientless SSL VPN (WebVPN) Brute-force Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/cisco_asa_clientless_vpn.rb
References: URL-https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html

Description:
This module scans for Cisco ASA Clientless SSL VPN (WebVPN) web login portals and
          performs login brute-force to identify valid credentials.
Metasploit Module: Emby SSRF HTTP Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/emby_ssrf_scanner.rb
Authors: Btnz
References: CVE-2020-26948, URL-https://github.com/btnz-k/emby_ssrf

Description:
Generates a `GET` request to the provided web servers and executes an SSRF against
                        the targeted EMBY server. Returns the server header, HTML title attribute and
                        location header (if set). This is useful for rapidly identifying web applications
                        on the internal network using the Emby SSRF vulnerability (CVE-2020-26948).
Metasploit Module: TP-Link Wireless Lite N Access Point Directory Traversal Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/tplink_traversal_noauth.rb
References: CVE-2012-5687, OSVDB-86881, BID-57969, EDB-24504, URL-http://www.s3cur1ty.de/m1adv2013-011

Description:
This module tests whether a directory traversal vulnerability is present in
        versions of TP-Link Access Point 3.12.16 Build 120228 Rel.37317n.
Metasploit Module: Inedo BuildMaster Login Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/buildmaster_login.rb

Description:
This module will attempt to authenticate to BuildMaster. There is a default user 'Admin'
          which has the default password 'Admin'.
Metasploit Module: Accellion FTA 'statecode' Cookie Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/scanner/http/accellion_fta_statecode_file_read.rb
Disclosure date: 2015-07-10
References: URL-https://www.rapid7.com/blog/post/2015/07/10/r7-2015-08-accellion-file-transfer-appliance-vulnerabilities-cve-2015-2856-cve-2015-2857/, CVE-2015-2856

Description:
This module exploits a file disclosure vulnerability in the Accellion
          File Transfer appliance. This vulnerability is triggered when a user-provided
          'statecode' cookie parameter is appended to a file path that is processed as
          a HTML template. By prepending this cookie with directory traversal sequence
          and appending a NULL byte, any file readable by the web user can be exposed.
          The web user has read access to a number of sensitive files, including the
          system configuration and files uploaded to the appliance by users.
          This issue was confirmed on version FTA_9_11_200, but may apply to previous
          versions as well. This issue was fixed in software update FTA_9_11_210.
Metasploit Module: Apache Tomcat User Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/http/tomcat_enum.rb
References: BID-35196, CVE-2009-0580, OSVDB-55055

Description:
This module enumerates Apache Tomcat's usernames via malformed requests to
        j_security_check, which can be found in the web administration package. It should
        work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18.
        Newer versions no longer have the "admin" package by default. The 'admin' package
        is no longer provided for Tomcat 6 and later versions.
Metasploit Module: WordPress XMLRPC GHOST Vulnerability Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb
References: CVE-2015-0235, URL-https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ghost-gethostbyname-heap-overflow-in-glibc-cve-2015-0235/, URL-http://web.archive.org/web/[PII_REDACTED]0537/https://blog.sucuri.net/2015/01/critical-ghost-vulnerability-released.html

Description:
This module can be used to determine hosts vulnerable to the GHOST vulnerability via
          a call to the WordPress XMLRPC interface. If the target is vulnerable, the system
          will segfault and return a server error. On patched systems, a normal XMLRPC error
          is returned.
Metasploit Module: HTTP WebDAV Website Content Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/webdav_website_content.rb
Authors: et

Description:
Detect webservers disclosing its content though WebDAV
Metasploit Module: MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb
References: MSB-MS09-020, CVE-2009-1535, CVE-2009-1122, OSVDB-54555, BID-34993

Description:
This module is based on et's HTTP Directory Scanner module,
          with one exception. Where authentication is required, it attempts
          to bypass authentication using the WebDAV IIS6 Unicode vulnerability
          discovered by Kingcope. The vulnerability appears to be exploitable
          where WebDAV is enabled on the IIS6 server, and any protected folder
          requires either Basic, Digest or NTLM authentication.
Metasploit Module: Canon Printer Wireless Configuration Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/http/canon_wireless.rb
Disclosure date: 2013-06-18
References: CVE-2013-4614, OSVDB-94417, URL-https://www.mattandreko.com/2013/06/canon-y-u-no-security.html

Description:
This module enumerates wireless credentials from Canon printers with a web interface.
          It has been tested on Canon models: MG3100, MG5300, MG6100, MP495, MX340, MX870,
          MX890, MX920.
Metasploit Module: Log4Shell HTTP Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/log4shell_scanner.rb
Disclosure date: 2021-12-09
References: CVE-2021-44228, CVE-2021-45046, URL-https://attackerkb.com/topics/in9sPR2Bzt/cve-2021-44228-log4shell/rapid7-analysis, URL-https://logging.apache.org/log4j/2.x/security.html

Description:
Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration,
        log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints.

        This module will scan an HTTP end point for the Log4Shell vulnerability by injecting a format message that will
        trigger an LDAP connection to Metasploit. This module is a generic scanner and is only capable of identifying
        instances that are vulnerable via one of the pre-determined HTTP request injection points. These points include
        HTTP headers and the HTTP request path.

        Known impacted software includes Apache Struts 2, VMWare VCenter, Apache James, Apache Solr, Apache Druid,
        Apache JSPWiki, Apache OFBiz.
Metasploit Module: Icingaweb Directory Traversal in Static Library File Requests
Type: auxiliary
Path: modules/auxiliary/scanner/http/icinga_static_library_file_directory_traversal.rb
Disclosure date: 2022-05-09
References: EDB-51329, URL-https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/, URL-https://github.com/Icinga/icingaweb2/commit/9931ed799650f5b8d5e1dc58ea3415a4cdc5773d, CVE-2022-24716

Description:
Icingaweb versions from 2.9.0 to 2.9.5 inclusive, and 2.8.0 to 2.8.5 inclusive suffer from an
          unauthenticated directory traversal vulnerability. The vulnerability is triggered
          through the icinga-php-thirdparty library, which allows unauthenticated users
          to retrieve arbitrary files from the targets filesystem via a GET request to
          /lib/icinga/icinga-php-thirdparty/<absolute path to target file on disk> as the user
          running the Icingaweb server, which will typically be the www-data user.

          This can then be used to retrieve sensitive configuration information from the target
          such as the configuration of various services, which may reveal sensitive login
          or configuration information, the /etc/passwd file to get a list of valid usernames
          for password guessing attacks, or other sensitive files which may exist as part of
          additional functionality available on the target server.

          This module was tested against Icingaweb 2.9.5 running on Docker.