mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-12 21:53:39 +08:00
moved misconfig templates
This commit is contained in:
Prince Chaddha
@@ -1,46 +0,0 @@
|
||||
id: ssh-cbc-mode-ciphers
|
||||
|
||||
info:
|
||||
name: SSH Server CBC Mode Ciphers Enabled
|
||||
author: pussycat0x
|
||||
severity: low
|
||||
description: |
|
||||
"SSH Server CBC Mode Ciphers Enabled" signifies that the SSH server supports Cipher Block Chaining (CBC) mode ciphers, which are known for potential vulnerabilities. This configuration poses a security risk, and it's recommended to disable CBC ciphers in favor of more secure alternatives for enhanced protection during data transmission.
|
||||
reference:
|
||||
- https://www.tenable.com/plugins/nessus/70658
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
shodan-query: product:"OpenSSH"
|
||||
tags: js,enum,ssh,misconfig,network
|
||||
|
||||
javascript:
|
||||
- pre-condition: |
|
||||
isPortOpen(Host,Port)
|
||||
code: |
|
||||
let m = require("nuclei/ssh");
|
||||
let c = m.SSHClient();
|
||||
let response = c.ConnectSSHInfoMode(Host, Port);
|
||||
to_json(response);
|
||||
args:
|
||||
Host: "{{Host}}"
|
||||
Port: "22"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "client_to_server_ciphers"
|
||||
- "server_to_client_ciphers"
|
||||
condition: and
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "aes128-cbc"
|
||||
- "aes192-cbc:"
|
||||
- "aes256-cbc"
|
||||
- "3des-cbc"
|
||||
- "blowfish-cbc"
|
||||
- "cast128-cbc"
|
||||
condition: or
|
||||
# digest: 4b0a0048304602210082687c326b5c8ec0803ad1e07fd7d94f166ac53dad501f5ad325daf42d789045022100e7525130e591163bc997cca9eac1c1b757c6099e892becc2e9b546f12298d13d:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,43 +0,0 @@
|
||||
id: ssh-weak-algo-supported
|
||||
|
||||
info:
|
||||
name: SSH Weak Algorithms Supported
|
||||
author: pussycat0x
|
||||
severity: medium
|
||||
description: |
|
||||
SSH weak algorithms are outdated cryptographic methods that pose security risks. Identifying and disabling these vulnerable algorithms is crucial for enhancing the overall security of SSH connections.
|
||||
reference:
|
||||
- https://www.tenable.com/plugins/nessus/90317
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
shodan-query: product:"OpenSSH"
|
||||
tags: js,enum,ssh,misconfig,network
|
||||
|
||||
javascript:
|
||||
- pre-condition: |
|
||||
isPortOpen(Host,Port);
|
||||
code: |
|
||||
let m = require("nuclei/ssh");
|
||||
let c = m.SSHClient();
|
||||
let response = c.ConnectSSHInfoMode(Host, Port);
|
||||
to_json(response);
|
||||
args:
|
||||
Host: "{{Host}}"
|
||||
Port: "22"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "client_to_server_ciphers"
|
||||
- "server_to_client_ciphers"
|
||||
condition: and
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "arcfour"
|
||||
- "arcfour128"
|
||||
- "arcfour256"
|
||||
condition: or
|
||||
# digest: 4b0a00483046022100d5c038917f6f85efc71fd0c4703c4d90406e6b2f94a7b3a21abaf30494d74369022100cf9e9e33471dab9e101674d98ef884133d7bc1f89306f560f010d6ffb42d359a:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,46 +0,0 @@
|
||||
id: ssh-weak-mac-algo
|
||||
|
||||
info:
|
||||
name: SSH Weak MAC Algorithms Enabled
|
||||
author: pussycat0x
|
||||
severity: low
|
||||
description: |
|
||||
The system's SSH configuration poses a security risk by allowing weak Message Authentication Code (MAC) algorithms, potentially exposing it to vulnerabilities and unauthorized access. It is crucial to update and strengthen the MAC algorithms for enhanced security.
|
||||
reference:
|
||||
- https://www.tenable.com/plugins/nessus/71049
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
shodan-query: product:"OpenSSH"
|
||||
tags: js,enum,ssh,misconfig,network
|
||||
|
||||
javascript:
|
||||
- pre-condition: |
|
||||
isPortOpen(Host,Port);
|
||||
code: |
|
||||
let m = require("nuclei/ssh");
|
||||
let c = m.SSHClient();
|
||||
let response = c.ConnectSSHInfoMode(Host, Port);
|
||||
to_json(response);
|
||||
args:
|
||||
Host: "{{Host}}"
|
||||
Port: "22"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "server_to_client_macs"
|
||||
- "client_to_server_macs"
|
||||
condition: and
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "hmac-md5"
|
||||
- "hmac-md5-96"
|
||||
- "hmac-sha1-96"
|
||||
- "hmac-md5"
|
||||
- "hmac-md5-96"
|
||||
- "hmac-sha1-96"
|
||||
condition: or
|
||||
# digest: 490a0046304402200808b310f424b589a3a2f8857b11481b27e3141e21dd9ae12991cc026d7a1dff022059ffe406c18c198b90735f0a78b24d49fbb04a6152186b7d83ae9e775b0e2072:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,56 +0,0 @@
|
||||
id: ssh-weak-public-key
|
||||
|
||||
info:
|
||||
name: SSH Host Keys < 2048 Bits Considered Weak
|
||||
author: pussycat0x
|
||||
severity: low
|
||||
description: |
|
||||
SSH host keys with a bit length below 2048 are deemed weak, posing an increased vulnerability to security threats. Employing robust key lengths is crucial for fortifying the integrity of encrypted communication and thwarting potential exploits.
|
||||
reference:
|
||||
- https://www.tenable.com/plugins/nessus/153954
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
shodan-query: product:"OpenSSH"
|
||||
tags: enum,js,ssh,misconfig,network
|
||||
|
||||
variables:
|
||||
ecdsa_bit: '256' # 256 bytes = 2048 bits
|
||||
rsa_bit: '2048' # 2048 bits
|
||||
|
||||
javascript:
|
||||
- pre-condition: |
|
||||
isPortOpen(Host,Port);
|
||||
code: |
|
||||
let m = require("nuclei/ssh");
|
||||
let c = m.SSHClient();
|
||||
let response = c.ConnectSSHInfoMode(Host, Port);
|
||||
to_json(response);
|
||||
args:
|
||||
Host: "{{Host}}"
|
||||
Port: "22"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "server_host_key"
|
||||
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'len(ecdsa_keylen) != 0 && ecdsa_keylen < ecdsa_bit'
|
||||
- 'len(rsa_keylen) !=0 && rsa_keylen < rsa_bit'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
internal: true
|
||||
name: ecdsa_keylen
|
||||
json:
|
||||
- '.DHKeyExchange.server_host_key.ecdsa_public_key.length'
|
||||
|
||||
- type: json
|
||||
internal: true
|
||||
name: rsa_keylen
|
||||
json:
|
||||
- '.DHKeyExchange.server_host_key.rsa_public_key.length'
|
||||
# digest: 4a0a0047304502204b98e1786f6494bcf96bf3b39d57952295c377938b7b72a812cb6d3a2ba43d85022100f73954e4a88a8b86052942f190163c039261f30781ab20b2d91102da65b2f7ab:922c64590222798bb761d5b6d8e72950
|
||||
@@ -1,44 +0,0 @@
|
||||
id: ssh-weakkey-exchange-algo
|
||||
|
||||
info:
|
||||
name: SSH Weak Key Exchange Algorithms Enabled
|
||||
author: pussycat0x
|
||||
severity: low
|
||||
description: |
|
||||
SSH Weak Key Exchange Algorithms Enabled indicates that the SSH server or client is configured to allow the use of less secure key exchange methods, posing a potential security risk during the establishment of secure connections. It's crucial to update configurations to prioritize stronger key exchange algorithms.
|
||||
reference:
|
||||
- https://www.tenable.com/plugins/nessus/153953
|
||||
metadata:
|
||||
verified: true
|
||||
max-request: 2
|
||||
shodan-query: product:"OpenSSH"
|
||||
tags: js,enum,ssh,misconfig,network
|
||||
|
||||
javascript:
|
||||
- pre-condition: |
|
||||
isPortOpen(Host,Port);
|
||||
code: |
|
||||
let m = require("nuclei/ssh");
|
||||
let c = m.SSHClient();
|
||||
let response = c.ConnectSSHInfoMode(Host, Port);
|
||||
to_json(response);
|
||||
args:
|
||||
Host: "{{Host}}"
|
||||
Port: "22"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "ServerKex"
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "diffie-hellman-group-exchange-sha1"
|
||||
- "diffie-hellman-group1-sha1"
|
||||
- "gss-gex-sha1"
|
||||
- "gss-group1-sha1"
|
||||
- "gss-group14-sha1"
|
||||
- "rsa1024-sha1"
|
||||
condition: or
|
||||
# digest: 4b0a0048304602210097cf374f08b29512614a9e69ea8605018abddda61f043cb46358703a2d3fe34b0221008df104926f407aab1bd0020c6fd5e768b2581e19d355fefac6c73d62e5fa994c:922c64590222798bb761d5b6d8e72950
|
||||
Reference in New Issue
Block a user