mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
bf8c6a8643
* feat(modules): tcp module executor dial+probe+banner with word/regex/size matchers, ctx-honest watcher, port required. * feat(modules): add redis unauthenticated access tcp module first shipped tcp module: sends INFO to redis (6379) and matches redis_version in the reply, which an auth-required server never returns (it answers -NOAUTH). extracts the leaked version. * docs(modules): document the tcp module type flip the http-only note and add a tcp config section (port, data, word/regex/size matchers and regex extractors against the banner), pointing at the redis demo module. * feat(modules): support matchers-condition in tcp modules tcp matchers were and-only; add the matchers-condition key (and default, or) mirroring the http executor's checkMatchers, validated at load via the shared validateMatchersCondition. documents the override in the combining matchers section. * feat(modules): decode escape sequences in tcp data payloads decode C-style escapes (\\ \a \b \f \n \r \t \v \xHH) in a tcp module's data value before it goes on the wire, so a single-quoted or plain yaml scalar reaches the service with the same control bytes a double-quoted one already would. an unrecognized escape is kept verbatim so no bytes are silently lost. * feat(modules): add tcp recon modules for common services add five built-in tcp modules alongside the redis one so the executor ships a real service set: memcached (unauth version probe), ssh and ftp (passive banner version disclosure), mysql/mariadb (handshake exposure, matched with matchers-condition: or across both auth plugin names), and vnc (rfb handshake exposure). each fingerprint tracks the documented on-wire protocol and pulls the version into an extractor. * feat(modules): add mail and rsync tcp recon modules add four more passive-banner tcp modules: smtp, pop3, and imap read the greeting each mail service sends on connect (the smtp matcher requires an esmtp/smtp marker so it does not fire on a bare 220 ftp greeting), and rsync detects an exposed daemon by its @RSYNCD handshake. each pulls the banner or protocol version into an extractor.
31 lines
823 B
YAML
31 lines
823 B
YAML
# MySQL/MariaDB Network Exposure Detection Module
|
|
|
|
id: mysql-exposure
|
|
info:
|
|
name: MySQL/MariaDB Network Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects a network-reachable MySQL or MariaDB server by its initial handshake packet, which advertises an authentication plugin and the server version in cleartext before any login (a database port open to the network is an attack surface regardless of credentials)
|
|
tags: [mysql, mariadb, database, tcp, exposure, recon]
|
|
|
|
type: tcp
|
|
|
|
tcp:
|
|
port: 3306
|
|
|
|
matchers-condition: or
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "mysql_native_password"
|
|
- type: word
|
|
words:
|
|
- "caching_sha2_password"
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: mysql_version
|
|
regex:
|
|
- "([0-9]+\\.[0-9]+\\.[0-9]+[0-9A-Za-z.\\-]*)"
|
|
group: 1
|