deardaniel/secdata-raw huggingface dataset:
Metasploit Module: NTP "NAK to the Future"
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb
References: URL-http://talosintel.com/reports/TALOS-2015-0069/, URL-https://www.cisco.com/c/en/us/support/docs/availability/high-availability/19643-ntpm.html, URL-https://support.ntp.org/bin/view/Main/NtpBug2941, CVE-2015-7871

Description:
Crypto-NAK packets can be used to cause ntpd to accept time from
          unauthenticated ephemeral symmetric peers by bypassing the
          authentication required to mobilize peer associations.  This module
          sends these Crypto-NAK packets in order to establish an association
          between the target ntpd instance and the attacking client.  The end goal
          is to cause ntpd to declare the legitimate peers "false tickers" and
          choose the attacking clients as the preferred peers, allowing
          these peers to control time.

Check method (fingerprinting):
connect_udp

    # pick a random 64-bit timestamp
    canary_timestamp = Time.now.utc - (60 * 5)
    probe = build_crypto_nak(canary_timestamp)
    udp_sock.put(probe.to_binary_s)

    expected_length = probe.offset_of(probe.key_identifier)
    response = udp_sock.timed_read(expected_length)
    disconnect_udp
    if response.length == expected_length
      ntp_symmetric = Rex::Proto::NTP::Header::NTPHeader.read(response)
      if ntp_symmetric.mode == SYMMETRIC_PASSIVE_MODE && ntp_symmetric.origin_timestamp == nil
        vprint_good("#{rhost}:#{rport} - NTP - VULNERABLE: Accepted a NTP symmetric active association")
        report_vuln(
          host: rhost,
          port: rport.to_i,
          proto: 'udp',
          sname: 'ntp',
          name: 'NTP "NAK to the Future"',
          info: 'Accepted an NTP symmetric active association by replying with a symmetric passive request',
          refs: references
        )
        return Exploit::CheckCode::Appears('NTP service accepted a symmetric active association')
      end
    end

    Exploit::CheckCode::Unknown('NTP service did not respond to symmetric active request')
  end
Metasploit Module: NTP Mode 6 UNSETTRAP DRDoS Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb
Disclosure date: Aug 25 2014
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: CVE-2013-5211, URL-https://github.com/rapid7/metasploit-framework/pull/3696, URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/

Description:
This module identifies NTP servers which permit mode 6 UNSETTRAP requests that
        can be used to conduct DRDoS attacks.  In some configurations, NTP servers will
        respond to UNSETTRAP requests with multiple packets, allowing remote attackers
        to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic
        amplification) via spoofed requests.
Metasploit Module: Metasploit RPC Interface Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/msf/msf_rpc_login.rb

Description:
This module simply attempts to login to a
          Metasploit RPC interface using a specific
          user/pass.
Metasploit Module: EMC AlphaStor Library Manager Service
Type: auxiliary
Path: modules/auxiliary/scanner/emc/alphastor_librarymanager.rb
Authors: MC

Description:
This module queries the remote host for the EMC Alphastor Library Management Service.
Metasploit Module: EMC AlphaStor Device Manager Service
Type: auxiliary
Path: modules/auxiliary/scanner/emc/alphastor_devicemanager.rb
Authors: MC

Description:
This module queries the remote host for the EMC Alphastor Device Management Service.
Metasploit Module: Portmapper Amplification Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/portmap/portmap_amp.rb
Authors: xistence <xistence[at]0x90.nl>
References: CVE-2013-5211, URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-017A, URL-http://blog.level3.com/security/a-new-ddos-reflection-attack-portmapper-an-early-warning-to-the-industry/

Description:
This module can be used to discover Portmapper services which can be used in an
        amplification DDoS attack against a third party.
Metasploit Module: Gather Kademlia Server Information
Type: auxiliary
Path: modules/auxiliary/scanner/kademlia/server_info.rb
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: URL-https://gbmaster.wordpress.com/2013/06/16/botnets-surrounding-us-sending-kademlia2_bootstrap_req-kademlia2_hello_req-and-their-strict-cousins/#more-125

Description:
This module uses the Kademlia BOOTSTRAP and PING messages to identify
          and extract information from Kademlia speaking UDP endpoints,
          typically belonging to eMule/eDonkey/BitTorrent servers or other P2P
          applications.
Metasploit Module: WS-Discovery Information Discovery
Type: auxiliary
Path: modules/auxiliary/scanner/wsdd/wsdd_query.rb
Authors: bcoles
References: URL-https://msdn.microsoft.com/en-us/library/windows/desktop/bb513684(v=vs.85).aspx, URL-http://specs.xmlsoap.org/ws/2005/04/discovery/ws-discovery.pd, URL-https://en.wikipedia.org/wiki/Web_Services_for_Devices, URL-https://en.wikipedia.org/wiki/WS-Discovery, URL-https://en.wikipedia.org/wiki/Zero-configuration_networking#WS-Discovery

Description:
Discover information from Web Services Dynamic Discovery (WS-Discovery)
        enabled systems.
Metasploit Module: Apple Airport ACPP Authentication Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/acpp/login.rb

Description:
This module attempts to authenticate to an Apple Airport using its
        proprietary and largely undocumented protocol known only as ACPP.
Metasploit Module: URGENT/11 Scanner, Based on Detection Tool by Armis
Type: auxiliary
Path: modules/auxiliary/scanner/vxworks/urgent11_check.rb
Disclosure date: 2019-08-09
References: CVE-2019-12258, URL-https://armis.com/urgent11, URL-https://github.com/ArmisSecurity/urgent11-detector

Description:
This module detects VxWorks and the IPnet IP stack, along with devices
          vulnerable to CVE-2019-12258.
Metasploit Module: VxWorks WDB Agent Boot Parameter Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/vxworks/wdbrpc_bootline.rb
Authors: hdm
References: URL-http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html, US-CERT-VU-362332

Description:
Scan for exposed VxWorks wdbrpc daemons and dump the boot parameters from memory
Metasploit Module: SSL/TLS Version Detection
Type: auxiliary
Path: modules/auxiliary/scanner/ssl/ssl_version.rb
Disclosure date: Oct 14 2014
References: URL-https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html, CVE-2014-3566, URL-http://web.archive.org/web/[PII_REDACTED]1045/https://www.openssl.org/~bodo/ssl-poodle.pdf, URL-https://datatracker.ietf.org/doc/rfc8996/, URL-https://datatracker.ietf.org/doc/html/rfc6176, URL-https://datatracker.ietf.org/doc/html/rfc7568, URL-https://www.win.tue.nl/hashclash/rogue-ca/, URL-https://drownattack.com/, CVE-2016-0800, CVE-2011-3389

Description:
Check if a server supports a given version of SSL/TLS and cipher suites.

        The certificate is stored in loot, and any known vulnerabilities against that
        SSL version and cipher suite combination are checked. These checks include
        POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites,
        certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST.
Metasploit Module: OpenSSL Server-Side ChangeCipherSpec Injection Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ssl/openssl_ccs.rb
Disclosure date: Jun 5 2014
References: CVE-2014-0224, URL-http://ccsinjection.lepidum.co.jp/, URL-http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html, URL-http://www.tripwire.com/state-of-security/incident-detection/detection-script-for-cve-2014-0224-openssl-cipher-change-spec-injection/, URL-https://www.imperialviolet.org/2014/06/05/earlyccs.html

Description:
This module checks for the OpenSSL ChangeCipherSpec (CCS)
        Injection vulnerability. The problem exists in the handling of early
        CCS messages during session negotiation. Vulnerable installations of OpenSSL accepts
        them, while later implementations do not. If successful, an attacker can leverage this
        vulnerability to perform a man-in-the-middle (MITM) attack by downgrading the cipher spec
        between a client and server. This issue was first reported in early June, 2014.
Metasploit Module: OpenSSL Heartbeat (Heartbleed) Information Leak
Type: auxiliary
Path: modules/auxiliary/scanner/ssl/openssl_heartbleed.rb
Disclosure date: 2014-04-07
References: CVE-2014-0160, US-CERT-VU-720951, URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-098A, URL-https://heartbleed.com/, URL-https://github.com/FiloSottile/Heartbleed, URL-https://gist.github.com/takeshixx/10107280, URL-https://filippo.io/Heartbleed/

Description:
This module implements the OpenSSL Heartbleed attack. The problem
        exists in the handling of heartbeat requests, where a fake length can
        be used to leak memory data in the response. Services that support
        STARTTLS may also be vulnerable.

        The module supports several actions, allowing for scanning, dumping of
        memory contents to loot, and private key recovery.

        The LEAK_COUNT option can be used to specify leaks per SCAN or DUMP.

        The repeat command can be used to make running the SCAN or DUMP many
        times more powerful. As in:
            repeat -t 60 run; sleep 2
        To run every two seconds for one minute.
Metasploit Module: mDNS Query
Type: auxiliary
Path: modules/auxiliary/scanner/mdns/query.rb

Description:
This module sends mDNS queries, which are really just normal UDP DNS
          queries done (usually) over multicast on a different port, 5353.
Metasploit Module: Brocade Enable Login Check Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/telnet/brocade_enable_login.rb
Authors: h00die <mike[at]shorebreaksecurity.com>
References: CVE-1999-0502

Description:
This module will test a range of Brocade network devices for a
        privileged logins and report successes. The device authentication mode
        must be set as 'aaa authentication enable default local'.
        Telnet authentication, e.g. 'enable telnet authentication', should not
        be enabled in the device configuration.

        This module has been tested against the following devices:
              ICX6450-24 SWver 07.4.00bT311,
              FastIron WS 624 SWver 07.2.02fT7e1
Metasploit Module: Telnet Login Check Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/telnet/telnet_login.rb
Authors: egypt
References: CVE-1999-0502

Description:
This module will test a telnet login on a range of machines and
        report successful logins.  If you have loaded a database plugin
        and connected to a database this module will record successful
        logins and hosts so you can track your access.
Metasploit Module: Lantronix Telnet Password Recovery
Type: auxiliary
Path: modules/auxiliary/scanner/telnet/lantronix_telnet_password.rb
Authors: jgor

Description:
This module retrieves the setup record from Lantronix serial-to-ethernet
        devices via the config port (30718/udp, enabled by default) and extracts the
        telnet password. It has been tested successfully on a Lantronix Device Server
        with software version V5.8.0.1.
Metasploit Module: Telnet Service Encryption Key ID Overflow Detection
Type: auxiliary
Path: modules/auxiliary/scanner/telnet/telnet_encrypt_overflow.rb
References: BID-51182, CVE-2011-4862, EDB-18280, URL-https://www.rapid7.com/blog/post/2011/12/28/more-fun-with-bsd-derived-telnet-daemons/

Description:
Detect telnet services vulnerable to the encrypt option Key ID overflow (BSD-derived telnetd)
Metasploit Module: Satel Iberia SenNet Data Logger and Electricity Meters Command Injection Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/telnet/satel_cmd_exec.rb
Disclosure date: 2017-04-07
References: CVE-2017-6048, URL-https://ipositivesecurity.com/2017/04/07/sennet-data-logger-appliances-and-electricity-meters-multiple-vulnerabilties/, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-17-131-02

Description:
This module exploits an OS Command Injection vulnerability in Satel Iberia SenNet Data Loggers & Electricity Meters
          to perform arbitrary command execution as 'root'.
Metasploit Module: RuggedCom Telnet Password Generator
Type: auxiliary
Path: modules/auxiliary/scanner/telnet/telnet_ruggedcom.rb
References: CVE-2012-1803, EDB-18779, US-CERT-VU-889195

Description:
This module will calculate the password for the hard-coded hidden username
          "factory" in the RuggedCom Rugged Operating System (ROS). The password is
          dynamically generated based on the devices MAC address.
Metasploit Module: FTP Authentication Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ftp/ftp_login.rb
Authors: todb
References: CVE-1999-0502

Description:
This module will test FTP logins on a range of machines and
        report successful logins.  If you have loaded a database plugin
        and connected to a database this module will record successful
        logins and hosts so you can track your access.
Metasploit Module: BisonWare BisonFTP Server 3.5 Directory Traversal Information Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb
Platform: win
Disclosure date: 2015-09-28
References: EDB-38341, CVE-2015-7602

Description:
This module exploits a directory traversal vulnerability found in BisonWare BisonFTP server
          version 3.5. This vulnerability allows an attacker to download arbitrary files from the server
          by crafting a RETR command including file system traversal strings such as '..//.'
Metasploit Module: PCMan FTP Server 2.0.7 Directory Traversal Information Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb
Platform: win
Disclosure date: 2015-09-28
References: EDB-38340, CVE-2015-7601

Description:
This module exploits a directory traversal vulnerability found in PCMan FTP Server 2.0.7.
          This vulnerability allows an attacker to download arbitrary files from the server by crafting
          a RETR command that includes file system traversal strings such as '..//'
Metasploit Module: Easy File Sharing FTP Server 3.6 Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/ftp/easy_file_sharing_ftp.rb
Platform: win
Disclosure date: 2017-03-07
References: CVE-2017-6510

Description:
This module exploits a directory traversal vulnerability found in Easy File Sharing FTP Server Version 3.6 and Earlier.
          This vulnerability allows an attacker to download arbitrary files from the server by crafting
          a RETR command that includes file system traversal strings such as '../'
Metasploit Module: ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb
Platform: win
Disclosure date: 2016-08-11
References: CVE-2025-34110, EDB-40231, URL-https://bitbucket.org/nolife/coloradoftp/commits/16a60c4a74ef477cd8c16ca82442eaab2fbe8c86, URL-https://bugtraq.securityfocus.com/archive/1/539186

Description:
This module exploits a directory traversal vulnerability found in ColoradoFTP server
          version <= 1.3 Build 8. This vulnerability allows an attacker to download and upload arbitrary files
          from the server GET/PUT command including file system traversal strings starting with '\'.
          The server is written in Java and therefore platform independent, however this vulnerability is only
          exploitable on the Windows version.
Metasploit Module: Konica Minolta FTP Utility 1.00 Directory Traversal Information Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb
Platform: win
Disclosure date: 2015-09-22
References: EDB-38260, CVE-2015-7603, URL-https://shinnai.altervista.org/exploits/SH-0[PII_REDACTED]2.html

Description:
This module exploits a directory traversal vulnerability found in Konica Minolta FTP Utility 1.0.
          This vulnerability allows an attacker to download arbitrary files from the server by crafting
          a RETR command that includes file system traversal strings such as '..//'
Metasploit Module: Titan FTP XCRC Directory Traversal Information Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/ftp/titanftp_xcrc_traversal.rb
Disclosure date: Jun 15 2010
References: CVE-2010-2426, OSVDB-65533, URL-https://seclists.org/bugtraq/2010/Jun/160

Description:
This module exploits a directory traversal vulnerability in the XCRC command
        implemented in versions of Titan FTP up to and including 8.10.1125. By making
        sending multiple XCRC command, it is possible to disclose the contents of any
        file on the drive with a simple CRC "brute force" attack.

        Although the daemon runs with SYSTEM privileges, access is limited to files
        that reside on the same drive as the FTP server's root directory.
Metasploit Module: Rogue Gateway Detection: Sender
Type: auxiliary
Path: modules/auxiliary/scanner/rogue/rogue_send.rb
Authors: hdm

Description:
This module send a series of TCP SYN and ICMP ECHO requests
      to each internal target host, spoofing the source address of an external
      system running the rogue_recv module. This allows the system running
      the rogue_recv module to determine what external IP a given internal
      system is using as its default route.
Metasploit Module: Rogue Gateway Detection: Receiver
Type: auxiliary
Path: modules/auxiliary/scanner/rogue/rogue_recv.rb
Authors: hdm

Description:
This module listens for replies to the requests sent by
      the rogue_send module. The RPORT, CPORT, and ECHOID values
      must match the rogue_send parameters used exactly.
Metasploit Module: Ivanti Connect Secure HTTP Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ivanti/ivanti_login.rb
Authors: msutovsky-r7

Description:
This module will perform authentication scanning against Ivanti Connect Secure.
Metasploit Module: Gather Steam Server Information
Type: auxiliary
Path: modules/auxiliary/scanner/steam/server_info.rb
Authors: Jon Hart <jon_hart[at]rapid7.com>
References: URL-https://developer.valvesoftware.com/wiki/Server_queries#A2S_INFO

Description:
This module uses the A2S_INFO request to obtain information from a Steam server.
Metasploit Module: POP3 Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/pop3/pop3_login.rb
References: URL-https://www.ietf.org/rfc/rfc1734.txt, URL-https://www.ietf.org/rfc/rfc1939.txt

Description:
This module attempts to authenticate to an POP3 service.
Metasploit Module: Kippo SSH Honeypot Detector
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/detect_kippo.rb
Authors: Andrew Morris <andrew[at]morris.guru>
References: URL-https://www.obscurechannel.com/x42/magicknumber.html, URL-http://morris.guru/detecting-kippo-ssh-honeypots/

Description:
This module will detect if an SSH server is running a Kippo honeypot.
          This is done by issuing unexpected data to the SSH service and checking
          the response returned for two particular non-standard error messages.
Metasploit Module: SSH Login Check Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/ssh_login.rb
Authors: todb
References: CVE-1999-0502

Description:
This module will test ssh logins on a range of machines and
        report successful logins.  If you have loaded a database plugin
        and connected to a database this module will record successful
        logins and hosts so you can track your access.
Metasploit Module: Juniper SSH Backdoor Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/juniper_backdoor.rb
Disclosure date: 2015-12-20
References: CVE-2015-7755, URL-https://www.rapid7.com/blog/post/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor/, URL-https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713

Description:
This module scans for the Juniper SSH backdoor (also valid on Telnet).
          Any username is required, and the password is <<< %s(un='%s') = %u.
Metasploit Module: SSH Username Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/ssh_enumusers.rb
References: CVE-2003-0190, CVE-2006-5229, CVE-2016-6210, CVE-2018-15473, OSVDB-32721, BID-20418, URL-https://seclists.org/oss-sec/2018/q3/124, URL-https://sekurak.pl/openssh-users-enumeration-cve-2018-15473/

Description:
This module uses a malformed packet or timing attack to enumerate users on
          an OpenSSH server.

          The default action sends a malformed (corrupted) SSH_MSG_USERAUTH_REQUEST
          packet using public key authentication (must be enabled) to enumerate users.

          On some versions of OpenSSH under some configurations, OpenSSH will return a
          "permission denied" error for an invalid user faster than for a valid user,
          creating an opportunity for a timing attack to enumerate users.

          Testing note: invalid users were logged, while valid users were not. YMMV.
Metasploit Module: Test SSH Github Access
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/ssh_enum_git_keys.rb
Platform: linux
Authors: Wyatt Dahlenburg (@wdahlenb)
References: URL-https://docs.github.com/en/authentication/connecting-to-github-with-ssh/testing-your-ssh-connection

Description:
This module will attempt to test remote Git access using
          (.ssh/id_* private keys). This works against GitHub and
          GitLab by default, but can easily be extended to support
          more server types.
Metasploit Module: Apache Karaf Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/karaf_login.rb

Description:
This module attempts to log into Apache Karaf's SSH. If the TRYDEFAULTCRED option is
        set, then it will also try the default 'karaf' credential.
Metasploit Module: Apache Karaf Default Credentials Command Execution
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/apache_karaf_command_execution.rb
Platform: unix
Disclosure date: 2016-02-09

Description:
This module exploits a default misconfiguration flaw on Apache Karaf versions 2.x-4.x.
          The 'karaf' user has a known default password, which can be used to login to the
          SSH service, and execute operating system commands from remote.
Metasploit Module: Cerberus FTP Server SFTP Username Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/cerberus_sftp_enumusers.rb
Disclosure date: 2014-05-27
References: URL-http://xforce.iss.net/xforce/xfdb/93546, BID-67707

Description:
This module uses a dictionary to brute force valid usernames from
          Cerberus FTP server via SFTP.  This issue affects all versions of
          the software older than 6.0.9.0 or 7.0.0.2 and is caused by a discrepancy
          in the way the SSH service handles failed logins for valid and invalid
          users.  This issue was discovered by Steve Embling.
Metasploit Module: libssh Authentication Bypass Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/ssh/libssh_auth_bypass.rb
Disclosure date: 2018-10-16
References: CVE-2018-10933, URL-https://www.libssh.org/security/advisories/CVE-2018-10933.txt

Description:
This module exploits an authentication bypass in libssh server code
          where a USERAUTH_SUCCESS message is sent in place of the expected
          USERAUTH_REQUEST message. libssh versions 0.6.0 through 0.7.5 and
          0.8.0 through 0.8.3 are vulnerable.

          Note that this module's success depends on whether the server code
          can trigger the correct (shell/exec) callbacks despite only the state
          machine's authenticated state being set.

          Therefore, you may or may not get a shell if the server requires
          additional code paths to be followed.