nuclei-templates/http/exposed-panels/phpmyadmin-panel.yaml

id: phpmyadmin-panel

info:
  name: phpMyAdmin Panel - Detect
  author: pdteam
  severity: info
  description: phpMyAdmin panel was detected.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
  metadata:
    max-request: 12
    shodan-query: http.title:phpMyAdmin
  tags: panel,phpmyadmin

http:
  - method: GET
    path:
      - "{{BaseURL}}/phpmyadmin/"
      - "{{BaseURL}}/admin/phpmyadmin/"
      - "{{BaseURL}}/_phpmyadmin/"
      - "{{BaseURL}}/administrator/components/com_joommyadmin/phpmyadmin/"
      - "{{BaseURL}}/apache-default/phpmyadmin/"
      - "{{BaseURL}}/blog/phpmyadmin/"
      - "{{BaseURL}}/forum/phpmyadmin/"
      - "{{BaseURL}}/php/phpmyadmin/"
      - "{{BaseURL}}/typo3/phpmyadmin/"
      - "{{BaseURL}}/web/phpmyadmin/"
      - "{{BaseURL}}/xampp/phpmyadmin/"
      - "{{BaseURL}}/phpMyAdmin/"

    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "<title>phpMyAdmin"
          - "pmahomme"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'v=([a-z0-9-._]+)'

# Enhanced by md on 2022/12/06
Added templates 2020-04-04 18:19:48 +00:00			`id: phpmyadmin-panel`

			`info:`
Dashboard Content Enhancements (#6289) Dashboard Content Enhancements 2022-12-08 13:42:03 +00:00			`name: phpMyAdmin Panel - Detect`
misc tag updates 2021-04-06 06:46:11 +00:00			`author: pdteam`
uniform severity update 2020-08-03 21:52:00 +00:00			`severity: info`
Dashboard Content Enhancements (#6289) Dashboard Content Enhancements 2022-12-08 13:42:03 +00:00			`description: phpMyAdmin panel was detected.`
			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N`
			`cvss-score: 0.0`
			`cwe-id: CWE-200`
Update phpmyadmin-panel.yaml 2022-04-28 19:22:07 +00:00			`metadata:`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`max-request: 12`
Update phpmyadmin-panel.yaml 2022-04-28 19:22:07 +00:00			`shodan-query: http.title:phpMyAdmin`
Added technology tags (#3470) 2022-01-03 16:06:23 +00:00			`tags: panel,phpmyadmin`
Added templates 2020-04-04 18:19:48 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Added templates 2020-04-04 18:19:48 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/phpmyadmin/"`
Update phpmyadmin-panel.yaml (#4981) 2022-08-02 13:38:01 +00:00			`- "{{BaseURL}}/admin/phpmyadmin/"`
Update phpmyadmin-panel.yaml 2020-04-10 17:13:45 +00:00			`- "{{BaseURL}}/_phpmyadmin/"`
Added aditional phpmyadmin locations 2020-04-07 14:22:47 +00:00			`- "{{BaseURL}}/administrator/components/com_joommyadmin/phpmyadmin/"`
			`- "{{BaseURL}}/apache-default/phpmyadmin/"`
			`- "{{BaseURL}}/blog/phpmyadmin/"`
			`- "{{BaseURL}}/forum/phpmyadmin/"`
			`- "{{BaseURL}}/php/phpmyadmin/"`
			`- "{{BaseURL}}/typo3/phpmyadmin/"`
			`- "{{BaseURL}}/web/phpmyadmin/"`
			`- "{{BaseURL}}/xampp/phpmyadmin/"`
Update phpmyadmin-panel.yaml 2021-08-23 08:54:04 +00:00			`- "{{BaseURL}}/phpMyAdmin/"`
Update phpmyadmin-panel.yaml 2021-09-01 18:51:43 +00:00
Update phpmyadmin-panel.yaml Stopping at first match (stop-at-first-match: true) With the id (html) "pmahomme" you will find hidden phpmyadmin instances (status 301) those instances do not show the title. The title can be easily change but id are not that simple to get rid of. 2021-09-01 16:25:12 +00:00			`stop-at-first-match: true`
Added templates 2020-04-04 18:19:48 +00:00			`matchers:`
			`- type: word`
			`words:`
Update phpmyadmin-panel.yaml 2021-08-23 08:54:04 +00:00			`- "<title>phpMyAdmin"`
Update phpmyadmin-panel.yaml Stopping at first match (stop-at-first-match: true) With the id (html) "pmahomme" you will find hidden phpmyadmin instances (status 301) those instances do not show the title. The title can be easily change but id are not that simple to get rid of. 2021-09-01 16:25:12 +00:00			`- "pmahomme"`
Update phpmyadmin-panel.yaml 2021-09-01 18:51:43 +00:00
Update phpmyadmin-panel.yaml Extractor added to retrieve version. Test nuclei -t nuclei-templates/exposed-panels/phpmyadmin-panel.yaml -u https://mojavedata.gov 2021-06-06 02:22:14 +00:00			`extractors:`
			`- type: regex`
			`part: body`
			`group: 1`
			`regex:`
updates to the phpmyadmin panel detection script Added another possible path URL for detection phpmyadmin panel and matching condition along with possile title to be detected for confirmation of the exposed phpmyadmin panel. 2021-08-23 07:22:33 +00:00			`- 'v=([a-z0-9-._]+)'`
Dashboard Content Enhancements (#6289) Dashboard Content Enhancements 2022-12-08 13:42:03 +00:00
			`# Enhanced by md on 2022/12/06`