mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
bf8c6a8643
* feat(modules): tcp module executor dial+probe+banner with word/regex/size matchers, ctx-honest watcher, port required. * feat(modules): add redis unauthenticated access tcp module first shipped tcp module: sends INFO to redis (6379) and matches redis_version in the reply, which an auth-required server never returns (it answers -NOAUTH). extracts the leaked version. * docs(modules): document the tcp module type flip the http-only note and add a tcp config section (port, data, word/regex/size matchers and regex extractors against the banner), pointing at the redis demo module. * feat(modules): support matchers-condition in tcp modules tcp matchers were and-only; add the matchers-condition key (and default, or) mirroring the http executor's checkMatchers, validated at load via the shared validateMatchersCondition. documents the override in the combining matchers section. * feat(modules): decode escape sequences in tcp data payloads decode C-style escapes (\\ \a \b \f \n \r \t \v \xHH) in a tcp module's data value before it goes on the wire, so a single-quoted or plain yaml scalar reaches the service with the same control bytes a double-quoted one already would. an unrecognized escape is kept verbatim so no bytes are silently lost. * feat(modules): add tcp recon modules for common services add five built-in tcp modules alongside the redis one so the executor ships a real service set: memcached (unauth version probe), ssh and ftp (passive banner version disclosure), mysql/mariadb (handshake exposure, matched with matchers-condition: or across both auth plugin names), and vnc (rfb handshake exposure). each fingerprint tracks the documented on-wire protocol and pulls the version into an extractor. * feat(modules): add mail and rsync tcp recon modules add four more passive-banner tcp modules: smtp, pop3, and imap read the greeting each mail service sends on connect (the smtp matcher requires an esmtp/smtp marker so it does not fire on a bare 220 ftp greeting), and rsync detects an exposed daemon by its @RSYNCD handshake. each pulls the banner or protocol version into an extractor.
28 lines
692 B
YAML
28 lines
692 B
YAML
# Memcached Unauthenticated Access Detection Module
|
|
|
|
id: memcached-unauth-exposure
|
|
info:
|
|
name: Memcached Unauthenticated Access
|
|
author: sif
|
|
severity: high
|
|
description: Detects a Memcached server that answers the version command without authentication, confirming unauthenticated access to the cache (a reachable memcached is also a known UDP/TCP reflection-amplification vector)
|
|
tags: [memcached, cache, database, tcp, unauth, exposure, recon]
|
|
|
|
type: tcp
|
|
|
|
tcp:
|
|
port: 11211
|
|
data: "version\r\n"
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "VERSION "
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: memcached_version
|
|
regex:
|
|
- "VERSION ([0-9.]+)"
|
|
group: 1
|