nuclei-templates/misconfiguration/iis-internal-ip-disclosure....

id: iis-internal-ip-disclosure

info:
  name: IIS Internal IP Disclosure Template
  author: WillD96
  severity: info
  reference:
    - https://support.kemptechnologies.com/hc/en-us/articles/203522429-How-to-Mitigate-Against-Internal-IP-Address-Domain-Name-Disclosure-In-Real-Server-Redirect
  tags: iis,misconfig,disclosure

requests:
  - raw:
      - |+
        GET / HTTP/1.0
        Accept: */*

      - |+
        GET / HTTP/1.0
        Host:
        Accept: */*

    stop-at-first-match: true
    unsafe: true # Use Unsafe HTTP library for malformed HTTP requests.
    matchers-condition: and
    matchers:
      - type: regex
        part: location
        regex:
          - '([0-9]{1,3}[\.]){3}[0-9]{1,3}'

      - type: status
        status:
          - 301
          - 302

    extractors:
      - type: regex
        part: location
        regex:
          - '([0-9]{1,3}[\.]){3}[0-9]{1,3}'
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`id: iis-internal-ip-disclosure`

			`info:`
			`name: IIS Internal IP Disclosure Template`
			`author: WillD96`
misc updates 2021-06-09 16:45:55 +00:00			`severity: info`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://support.kemptechnologies.com/hc/en-us/articles/203522429-How-to-Mitigate-Against-Internal-IP-Address-Domain-Name-Disclosure-In-Real-Server-Redirect`
misc updates 2021-06-09 16:45:55 +00:00			`tags: iis,misconfig,disclosure`
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00
			`requests:`
			`- raw:`
Fix IIS Internal IP Disclosure (#4479) * Update iis-internal-ip-disclosure.yaml Fix IIS Internal IP Disclosure for OWA case * Auto Generated CVE annotations [Wed May 25 14:01:45 UTC 2022] :robot: * Additional request + improved matcher part Co-authored-by: GitHub Action <action@github.com> Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-05-25 19:20:38 +00:00			`- \|+`
			`GET / HTTP/1.0`
			`Accept: /`

Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`- \|+`
			`GET / HTTP/1.0`
misc updates 2021-06-09 16:45:55 +00:00			`Host:`
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`Accept: /`

Fix IIS Internal IP Disclosure (#4479) * Update iis-internal-ip-disclosure.yaml Fix IIS Internal IP Disclosure for OWA case * Auto Generated CVE annotations [Wed May 25 14:01:45 UTC 2022] :robot: * Additional request + improved matcher part Co-authored-by: GitHub Action <action@github.com> Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-05-25 19:20:38 +00:00			`stop-at-first-match: true`
misc updates 2021-06-09 16:45:55 +00:00			`unsafe: true # Use Unsafe HTTP library for malformed HTTP requests.`
			`matchers-condition: and`
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`matchers:`
			`- type: regex`
Fix IIS Internal IP Disclosure (#4479) * Update iis-internal-ip-disclosure.yaml Fix IIS Internal IP Disclosure for OWA case * Auto Generated CVE annotations [Wed May 25 14:01:45 UTC 2022] :robot: * Additional request + improved matcher part Co-authored-by: GitHub Action <action@github.com> Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-05-25 19:20:38 +00:00			`part: location`
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`regex:`
			`- '([0-9]{1,3}[\.]){3}[0-9]{1,3}'`
misc updates 2021-06-09 16:45:55 +00:00
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`- type: status`
			`status:`
Fix IIS Internal IP Disclosure (#4479) * Update iis-internal-ip-disclosure.yaml Fix IIS Internal IP Disclosure for OWA case * Auto Generated CVE annotations [Wed May 25 14:01:45 UTC 2022] :robot: * Additional request + improved matcher part Co-authored-by: GitHub Action <action@github.com> Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-05-25 19:20:38 +00:00			`- 301`
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`- 302`
misc updates 2021-06-09 16:45:55 +00:00
Added template for IIS Internal IP Disclosure By sending a HTTP 1.0 request to the root of the webserver, sometimes an internal IP address is disclosed in the Location header of the 302 response. 2021-06-09 14:30:59 +00:00			`extractors:`
Fixed trailing spaces 2021-06-09 15:04:53 +00:00			`- type: regex`
Fix IIS Internal IP Disclosure (#4479) * Update iis-internal-ip-disclosure.yaml Fix IIS Internal IP Disclosure for OWA case * Auto Generated CVE annotations [Wed May 25 14:01:45 UTC 2022] :robot: * Additional request + improved matcher part Co-authored-by: GitHub Action <action@github.com> Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-05-25 19:20:38 +00:00			`part: location`
Fixed trailing spaces 2021-06-09 15:04:53 +00:00			`regex:`
misc updates 2021-06-09 16:45:55 +00:00			`- '([0-9]{1,3}[\.]){3}[0-9]{1,3}'`