Files
nuclei-templates/javascript/udp/detection/zeroconf-detect.yaml

41 lines
1.3 KiB
YAML

id: zeroconf-detect
info:
name: Zeroconf - Detect
author: pussycat0x
severity: info
description: |
Queried `_services._dns-sd._udp.local` over UDP/5353 and identified Zeroconf (mDNS/DNS-SD) services that were advertised locally.
reference:
- https://en.wikipedia.org/wiki/Zero-configuration_networking
metadata:
verified: true
zoomeye-query: service="zeroconf"
tags: zeroconf,network,js,udp,discovery
javascript:
- pre-condition: |
isUDPPortOpen(Host,Port);
code: |
let packet = bytes.NewBuffer();
const c = require("nuclei/net");
const cmd = "000000000001000000000000095f7365727669636573075f646e732d7364045f756470056c6f63616c00000c0001"
packet.WriteString(cmd)
let conn = c.Open('udp', `${Host}:${Port}`);
conn.SendHex(packet);
const result = conn.RecvFullHex();
result
args:
Host: "{{Host}}"
Port: 5353
matchers:
- type: dsl
dsl:
- 'success == true'
- 'contains_all(response, "udp.local","rvices._dns-sd") || contains(response, "-servers.net")'
condition: and
# digest: 4b0a00483046022100b9a010065afdcc27130ed5274fb55b87252a649736e3648dde05a4d9fba5af99022100bba14c22d55461ea2db67f1e2fdb02a9cb370c32eaff05ed2a4f7523ea931e4b:922c64590222798bb761d5b6d8e72950