nuclei-templates/technologies/nextcloud-detect.yaml

id: nextcloud-detect

info:
  name: Nextcloud Detect
  author: skeltavik
  severity: info
  description: |
    Nextcloud is a suite of client-server software for creating and using file hosting services
  reference:
    - https://nextcloud.com
  metadata:
    verified: true
    shodan-query: http.title:"Nextcloud"
  tags: tech,nextcloud,storage

requests:
  - method: GET
    path:
      - '{{BaseURL}}'
      - '{{BaseURL}}/login'
      - '{{BaseURL}}/nextcloud/login'
      - '{{BaseURL}}/nextcloud/index.php/login'

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'var nc_lastLogin'
          - 'var nc_pageLoad'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - '(?m)"version":"([0-9.]+)",'
Nextcloud templates 2021-09-05 17:22:45 +00:00			`id: nextcloud-detect`

			`info:`
			`name: Nextcloud Detect`
			`author: skeltavik`
			`severity: info`
Update nextcloud-detect.yaml 2022-10-06 05:35:52 +00:00			`description: \|`
			`Nextcloud is a suite of client-server software for creating and using file hosting services`
			`reference:`
			`- https://nextcloud.com`
feat: added metadata 2022-10-06 03:52:04 +00:00			`metadata:`
			`verified: true`
			`shodan-query: http.title:"Nextcloud"`
Nextcloud templates 2021-09-05 17:22:45 +00:00			`tags: tech,nextcloud,storage`

			`requests:`
			`- method: GET`
			`path:`
			`- '{{BaseURL}}'`
			`- '{{BaseURL}}/login'`
Update nextcloud-detect.yaml Hey 👋 I have added another path to detect URL rewrite. URL rewrite is mentioned in the official documentation : https://docs.nextcloud.com/server/latest/admin_manual/installation/source_installation.html#pretty-urls or https://help.nextcloud.com/t/removing-index-php-from-the-nextcloud-uri/13055 and so on. I just experienced the `/nextcloud/login`. Cheers 😄 2022-10-21 15:15:36 +00:00			`- '{{BaseURL}}/nextcloud/login'`
misc update Co-Authored-By: Bram Ruttens <3391681+skeltavik@users.noreply.github.com> 2021-09-05 17:26:47 +00:00			`- '{{BaseURL}}/nextcloud/index.php/login'`
Nextcloud templates 2021-09-05 17:22:45 +00:00
misc update Co-Authored-By: Bram Ruttens <3391681+skeltavik@users.noreply.github.com> 2021-09-05 17:26:47 +00:00			`stop-at-first-match: true`
Using "host-redirects" instead of "redirects" to avoid scanning 3rd party / out of scope hosts. (#5491) 2022-10-07 21:27:25 +00:00			`host-redirects: true`
Nextcloud templates 2021-09-05 17:22:45 +00:00			`max-redirects: 2`
Update nextcloud-detect.yaml Fixes an egregious false positive. [2022-10-12 19:24:22] [nextcloud-detect:status-2] [http] [info] https://raw.githubusercontent.com/Plazmaz/leaky-repo/master/.ssh/id_rsa 2022-10-12 19:26:34 +00:00			`matchers-condition: and`
Nextcloud templates 2021-09-05 17:22:45 +00:00			`matchers:`
			`- type: word`
			`part: body`
			`words:`
			`- 'var nc_lastLogin'`
feat: added version detection nextcloud 2022-10-06 03:50:59 +00:00			`- 'var nc_pageLoad'`
			`condition: and`

			`- type: status`
			`status:`
			`- 200`

			`extractors:`
			`- type: regex`
			`group: 1`
			`regex:`
			`- '(?m)"version":"([0-9.]+)",'`