deardaniel/secdata-raw huggingface dataset:
Metasploit Module: IPID Sequence Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ip/ipidseq.rb
Authors: kris katterjohn

Description:
This module will probe hosts' IPID sequences and classify
        them using the same method Nmap uses when it's performing
        its IPID Idle Scan (-sI) and OS Detection (-O).

        Nmap's probes are SYN/ACKs while this module's are SYNs.
        While this does not change the underlying functionality,
        it does change the chance of whether or not the probe
        will be stopped by a firewall.

        Nmap's Idle Scan can use hosts whose IPID sequences are
        classified as "Incremental" or "Broken little-endian incremental".
Metasploit Module: WinRM Command Runner
Type: auxiliary
Path: modules/auxiliary/scanner/winrm/winrm_cmd.rb

Description:
This module runs arbitrary Windows commands using the WinRM Service
Metasploit Module: WinRM Authentication Method Detection
Type: auxiliary
Path: modules/auxiliary/scanner/winrm/winrm_auth_methods.rb

Description:
This module sends a request to an HTTP/HTTPS service to see if it is a WinRM service.
        If it is a WinRM service, it also gathers the Authentication Methods supported.
Metasploit Module: WinRM Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/winrm/winrm_login.rb
References: CVE-1999-0502

Description:
This module attempts to authenticate to a WinRM service. It currently
        works only if the remote end allows Negotiate(NTLM) authentication.
        Kerberos is not currently supported.  Please note: in order to use this
        module without SSL, the 'AllowUnencrypted' winrm option must be set.
        Otherwise adjust the port and set the SSL options in the module as appropriate.
Metasploit Module: WinRM WQL Query Runner
Type: auxiliary
Path: modules/auxiliary/scanner/winrm/winrm_wql.rb

Description:
This module runs WQL queries against remote WinRM Services.
        Authentication is required. Currently only works with NTLM auth.
        Please note in order to use this module, the 'AllowUnencrypted'
        winrm option must be set.
Metasploit Module: SMB Domain User Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_enumusers_domain.rb
References: URL-https://docs.microsoft.com/en-us/windows/win32/api/lmwksta/nf-lmwksta-netwkstauserenum

Description:
Determine what domain users are logged into a remote system via a DCERPC to NetWkstaUserEnum.
Metasploit Module: SMB Version Detection
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_version.rb
Authors: hdm
References: URL-https://support.microsoft.com/en-us/help/161372/how-to-enable-smb-signing-in-windows-nt, URL-https://support.microsoft.com/en-us/help/887429/overview-of-server-message-block-signing

Description:
Fingerprint and display version information about SMB servers. Protocol
        information and host operating system (if available) will be reported.
        Host operating system detection requires the remote server to support
        version 1 of the SMB protocol. Compression and encryption capability
        negotiation is only present in version 3.1.1.
Metasploit Module: SMB Session Pipe Auditor
Type: auxiliary
Path: modules/auxiliary/scanner/smb/pipe_auditor.rb
Authors: hdm

Description:
Determine what named pipes are accessible over SMB
Metasploit Module: MS17-010 SMB RCE Detection
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_ms17_010.rb
References: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148, MSB-MS17-010, URL-https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html, URL-https://github.com/countercept/doublepulsar-detection-script, URL-https://web.archive.org/web/[PII_REDACTED]0203/https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Description:
Uses information disclosure to determine if MS17-010 has been patched or not.
          Specifically, it connects to the IPC$ tree and attempts a transaction on FID 0.
          If the status returned is "STATUS_INSUFF_SERVER_RESOURCES", the machine does
          not have the MS17-010 patch.

          If the machine is missing the MS17-010 patch, the module will check for an
          existing DoublePulsar (ring 0 shellcode/malware) infection.

          This module does not require valid SMB credentials in default server
          configurations. It can log on as the user "\" and connect to IPC$.
Metasploit Module: SMB User Enumeration (SAM EnumUsers)
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_enumusers.rb
Authors: hdm

Description:
Determine what users exist via the SAM RPC service
Metasploit Module: SMB Login Check Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_login.rb
References: CVE-1999-0506

Description:
This module will test a SMB login on a range of machines and
        report successful logins.  If you have loaded a database plugin
        and connected to a database this module will record successful
        logins and hosts so you can track your access.
Metasploit Module: SMB Share Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_enumshares.rb

Description:
This module determines what shares are provided by the SMB service and which ones
          are readable/writable. It also collects additional information such as share types,
          directories, files, time stamps, etc.

          By default, a RubySMB net_share_enum_all request is done in order to retrieve share information,
          which uses SRVSVC.
Metasploit Module: Samba _netr_ServerPasswordSet Uninitialized Credential State
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_uninit_cred.rb
References: CVE-2015-0240, OSVDB-118637, URL-https://www.redhat.com/en/blog/samba-vulnerability-cve-2015-0240, URL-https://gist.github.com/worawit/33cc5534cb555a0b710b, URL-https://www.nccgroup.com/en/blog/2015/03/samba-_netr_serverpasswordset-expoitability-analysis/

Description:
This module checks if a Samba target is vulnerable to an uninitialized variable creds vulnerability.
Metasploit Module: SMB Session Pipe DCERPC Auditor
Type: auxiliary
Path: modules/auxiliary/scanner/smb/pipe_dcerpc_auditor.rb
Authors: hdm

Description:
Determine what DCERPC services are accessible over a SMB pipe
Metasploit Module: SMB SID User Enumeration (LookupSid)
Type: auxiliary
Path: modules/auxiliary/scanner/smb/smb_lookupsid.rb
Authors: hdm

Description:
Determine what users exist via brute force SID lookups.
        This module can enumerate both local and domain accounts by setting
        ACTION to either LOCAL or DOMAIN
Metasploit Module: 
Type: auxiliary
Path: modules/auxiliary/scanner/sonicwall/sonicwall_login.rb
Authors: msutovsky-r7

Description:
This module adds HTTP Login scanning for SonicWall NSv. It allows scanning both admin and user accounts.
Metasploit Module: DNS Amplification Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/dns/dns_amp.rb
References: CVE-2006-0987, CVE-2006-0988

Description:
This module can be used to discover DNS servers which expose recursive
          name lookups which can be used in an amplification attack against a
          third party.
Metasploit Module: FreeSWITCH Event Socket Login
Type: auxiliary
Path: modules/auxiliary/scanner/misc/freeswitch_event_socket_login.rb
References: URL-https://freeswitch.org/confluence/display/FREESWITCH/mod_event_socket

Description:
This module tests FreeSWITCH Event Socket logins on a range of
          machines and report successful attempts.
Metasploit Module: IBM WebSphere MQ Login Check
Type: auxiliary
Path: modules/auxiliary/scanner/misc/ibm_mq_login.rb
Authors: Petros Koutroumpis

Description:
This module can be used to bruteforce usernames that can be used to connect to a queue manager. The name of a valid server-connection channel without SSL configured is required, as well as a list of usernames to try.
Metasploit Module: OKI Printer Default Login Credential Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/misc/oki_scanner.rb
Authors: antr6X <anthr6x[at]gmail.com>

Description:
This module scans for OKI printers via SNMP, then tries to connect to found devices
          with vendor default administrator credentials via HTTP authentication. By default, OKI
          network printers use the last six digits of the MAC as admin password.
Metasploit Module: Poison Ivy Command and Control Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb
Authors: SeawolfRN

Description:
Enumerate Poison Ivy Command and Control (C&C) on ports 3460, 80, 8080 and 443. Adaptation of iTrust Python script.
Metasploit Module: Ray Sharp DVR Password Retriever
Type: auxiliary
Path: modules/auxiliary/scanner/misc/raysharp_dvr_passwords.rb
References: URL-http://console-cowboys.blogspot.com/2013/01/swann-song-dvr-insecurity.html

Description:
This module takes advantage of a protocol design issue with the
        Ray Sharp based DVR systems. It is possible to retrieve the username and
        password through the TCP service running on port 9000. Other brands using
        this platform and exposing the same issue may include Swann, Lorex,
        Night Owl, Zmodo, URMET, and KGuard Security.
Metasploit Module: ClamAV Remote Command Transmitter
Type: auxiliary
Path: modules/auxiliary/scanner/misc/clamav_control.rb
Disclosure date: 2016-06-08
References: URL-https://twitter.com/nitr0usmx/status/[PII_REDACTED]84679680/photo/1, URL-https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf

Description:
In certain configurations, ClamAV will bind to all addresses and listen for commands.
          This module sends properly-formatted commands to the ClamAV daemon if it is in such a
          configuration.
Metasploit Module: IBM WebSphere MQ Channel Name Bruteforce
Type: auxiliary
Path: modules/auxiliary/scanner/misc/ibm_mq_channel_brute.rb
Authors: Petros Koutroumpis

Description:
This module uses a dictionary to bruteforce MQ channel names. For all identified channels it also returns if SSL is used and whether it is a server-connection channel.
Metasploit Module: SerComm Network Device Backdoor Detection
Type: auxiliary
Path: modules/auxiliary/scanner/misc/sercomm_backdoor_scanner.rb
Disclosure date: 2013-12-31
References: CVE-2014-0659, OSVDB-101653, URL-https://github.com/elvanderb/TCP-32764

Description:
This module can identify SerComm manufactured network devices which
          contain a backdoor, allowing command injection or account disclosure.
Metasploit Module: cups-browsed Information Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb
References: CVE-2024-47176, URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

Description:
Retrieve CUPS version and kernel version information from cups-browsed services.
Metasploit Module: 
Type: auxiliary
Path: modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb
References: CVE-2013-6117, URL-https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117

Description:
Obtain the channel/camera information from the DVR
Metasploit Module: SunRPC Portmap Program Enumerator
Type: auxiliary
Path: modules/auxiliary/scanner/misc/sunrpc_portmapper.rb
Authors: <tebo[at]attackresearch.com>
References: URL-https://www.ietf.org/rfc/rfc1057.txt

Description:
This module calls the target portmap service and enumerates all program
        entries and their running port numbers.
Metasploit Module: Novell ZENworks Configuration Management Preboot Service Remote File Access
Type: auxiliary
Path: modules/auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb
References: CVE-2012-2215, OSVDB-80230, URL-https://web.archive.org/web/[PII_REDACTED]2235/http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=975

Description:
This module exploits a directory traversal in the ZENworks Configuration Management.
          The vulnerability exists in the Preboot service and can be triggered by sending a specially
          crafted PROXY_CMD_FTP_FILE (opcode 0x21) packet to the 998/TCP port. This module has been
          successfully tested on Novell ZENworks Configuration Management 10 SP2 and SP3 over Windows.
Metasploit Module: Borland InterBase Services Manager Information
Type: auxiliary
Path: modules/auxiliary/scanner/misc/ib_service_mgr_info.rb

Description:
This module retrieves version of the services manager, version
        and implementation of the InterBase server from InterBase
        Services Manager.
Metasploit Module: Rosewill RXS-3211 IP Camera Password Retriever
Type: auxiliary
Path: modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb
Authors: Ben Schmidt

Description:
This module takes advantage of a protocol design issue with the Rosewill admin
        executable in order to retrieve passwords, allowing remote attackers to take
        administrative control over the device.  Other similar IP Cameras such as Edimax,
        Hawking, Zonet, etc, are also believed to have the same flaw, but not fully tested.
        The protocol design issue also allows attackers to reset passwords on the device.
Metasploit Module: CCTV DVR Login Scanning Utility
Type: auxiliary
Path: modules/auxiliary/scanner/misc/cctv_dvr_login.rb
Authors: Justin Cacak

Description:
This module tests for standalone CCTV DVR video surveillance
        deployments specifically by MicroDigital, HIVISION, CTRing, and
        numerous other rebranded devices that are utilizing default vendor
        passwords. Additionally, this module has the ability to brute
        force user accounts.

        Such CCTV DVR video surveillance deployments support remote
        viewing through Central Management Software (CMS) via the
        CMS Web Client, an IE ActiveX control hosted over HTTP, or
        through Win32 or mobile CMS client software. By default,
        remote authentication is handled over port 5920/TCP with video
        streaming over 5921/TCP.

        After successful authentication over 5920/TCP this module
        will then attempt to determine if the IE ActiveX control
        is listening on the default HTTP port (80/TCP).
Metasploit Module: Identify Cisco Smart Install endpoints
Type: auxiliary
Path: modules/auxiliary/scanner/misc/cisco_smart_install.rb
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: URL-http://web.archive.org/web/[PII_REDACTED]4218/http://blog.talosintelligence.com/2017/02/cisco-coverage-for-smart-install-client.html, URL-https://blogs.cisco.com/security/cisco-psirt-mitigating-and-detecting-potential-abuse-of-cisco-smart-install-feature, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi, URL-https://github.com/Cisco-Talos/smi_check, URL-https://github.com/frostbits-security/SIET

Description:
This module attempts to connect to the specified Cisco Smart Install port
          and determines if it speaks the Smart Install Protocol.  Exposure of SMI
          to untrusted networks can allow complete compromise of the switch.
Metasploit Module: EasyCafe Server Remote File Access
Type: auxiliary
Path: modules/auxiliary/scanner/misc/easycafe_server_fileaccess.rb
References: CVE-2025-34119, EDB-39102

Description:
This module exploits a file retrieval vulnerability in
          EasyCafe Server. The vulnerability can be triggered by
          sending a specially crafted packet (opcode 0x43) to the
          831/TCP port.
          This module has been successfully tested on EasyCafe Server
          version 2.2.14 (Trial mode and Demo mode) on Windows XP SP3
          and Windows 7 SP1.
          Note that the server will throw a popup messagebox if the
          specified file does not exist.
Metasploit Module: Multiple DVR Manufacturers Configuration Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/misc/dvr_config_disclosure.rb
References: CVE-2013-1391, URL-http://www.securitybydefault.com/2013/01/12000-grabadores-de-video-expuestos-en.html

Description:
This module takes advantage of an authentication bypass vulnerability at the
        web interface of multiple manufacturers DVR systems, which allows to retrieve the
        device configuration.
Metasploit Module: Identify Queue Manager Name and MQ Version
Type: auxiliary
Path: modules/auxiliary/scanner/misc/ibm_mq_enum.rb

Description:
Run this auxiliary against the listening port of an IBM MQ Queue Manager to identify its name and version. Any channel type can be used to get this information as long as the name of the channel is valid.
Metasploit Module: Chargen Probe Utility
Type: auxiliary
Path: modules/auxiliary/scanner/chargen/chargen_probe.rb
Disclosure date: Feb 08 1996
Authors: Matteo Cantoni <goony[at]nothink.org>
References: CVE-1999-0103, URL-http://tools.ietf.org/html/rfc864

Description:
Chargen is a debugging and measurement tool and a character
        generator service. A character generator service simply sends
        data without regard to the input.
        Chargen is susceptible to spoofing the source of transmissions
        as well as use in a reflection attack vector. The misuse of the
        testing features of the Chargen service may allow attackers to
        craft malicious network payloads and reflect them by spoofing
        the transmission source to effectively direct it to a target.
        This can result in traffic loops and service degradation with
        large amounts of network traffic.
Metasploit Module: LDAP Login Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ldap/ldap_login.rb

Description:
This module attempts to login to the LDAP service.
Metasploit Module: IPMI Information Discovery
Type: auxiliary
Path: modules/auxiliary/scanner/ipmi/ipmi_version.rb
References: URL-http://fish2.com/ipmi/

Description:
Discover host information through IPMI Channel Auth probes
Metasploit Module: LLMNR Query
Type: auxiliary
Path: modules/auxiliary/scanner/llmnr/query.rb

Description:
This module sends LLMNR queries, which are really just normal UDP DNS
          queries done (usually) over multicast on a different port, 5355.
          Targets other than the default RHOSTS' 224.0.0.252 should not respond
          but may anyway.
Metasploit Module: NTP Mode 7 PEER_LIST_SUM DoS Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb
Disclosure date: Aug 25 2014
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: CVE-2013-5211, URL-https://github.com/rapid7/metasploit-framework/pull/3696, URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/

Description:
This module identifies NTP servers which permit "PEER_LIST_SUM" queries and
        return responses that are larger in size or greater in quantity than
        the request, allowing remote attackers to cause a distributed, reflected
        denial of service (aka, "DRDoS" or traffic amplification) via spoofed
        requests.
Metasploit Module: NTP Timeroast
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/timeroast.rb
References: URL-https://github.com/SecuraBV/Timeroast/, URL-https://www.secura.com/uploads/whitepapers/Secura-WP-Timeroasting-v3.pdf

Description:
Windows authenticates NTP requests by calculating the message digest using the NT hash followed by the first
          48 bytes of the NTP message (all fields preceding the key ID). An attacker can abuse this to recover hashes
          that can be cracked offline for machine and trust accounts. The attacker must know the accounts RID, but
          because RIDs are sequential, they can easily be enumerated.
Metasploit Module: NTP Mode 7 PEER_LIST DoS Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb
Disclosure date: Aug 25 2014
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: CVE-2013-5211, URL-https://github.com/rapid7/metasploit-framework/pull/3696, URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/

Description:
This module identifies NTP servers which permit "PEER_LIST" queries and
        return responses that are larger in size or greater in quantity than
        the request, allowing remote attackers to cause a distributed, reflected
        denial of service (aka, "DRDoS" or traffic amplification) via spoofed
        requests.
Metasploit Module: NTP Mode 7 GET_RESTRICT DRDoS Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb
Disclosure date: Aug 25 2014
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: CVE-2013-5211, URL-https://github.com/rapid7/metasploit-framework/pull/3696, URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/

Description:
This module identifies NTP servers which permit "reslist" queries and
        obtains the list of restrictions placed on various network interfaces,
        networks or hosts. The reslist feature allows remote
        attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or
        traffic amplification) via spoofed requests. The more interfaces, networks
        or hosts with specific restrictions, the greater the amplification.
        requests.
Metasploit Module: NTP Mode 6 REQ_NONCE DRDoS Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb
Disclosure date: Aug 25 2014
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: CVE-2013-5211, URL-https://github.com/rapid7/metasploit-framework/pull/3696, URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/

Description:
This module identifies NTP servers which permit mode 6 REQ_NONCE requests that
        can be used to conduct DRDoS attacks. In some configurations, NTP servers will
        respond to REQ_NONCE requests with a response larger than the request,
        allowing remote attackers to cause a distributed, reflected
        denial of service (aka, "DRDoS" or traffic amplification) via spoofed
        requests.
Metasploit Module: NTP Monitor List Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_monlist.rb
Authors: hdm
References: CVE-2013-5211, URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-013A, URL-https://support.ntp.org/bin/view/Main/SecurityNotice, URL-https://nmap.org/nsedoc/scripts/ntp-monlist.html

Description:
This module identifies NTP servers which permit "monlist" queries and
        obtains the recent clients list. The monlist feature allows remote
        attackers to cause a denial of service (traffic amplification)
        via spoofed requests. The more clients there are in the list, the
        greater the amplification.
Metasploit Module: NTP Clock Variables Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_readvar.rb
References: CVE-2013-5211, URL-https://www.rapid7.com/db/vulnerabilities/ntp-clock-variables-disclosure/

Description:
This module reads the system internal NTP variables. These variables contain
          potentially sensitive information, such as the NTP software version, operating
          system version, peers, and more.