nuclei-templates/network/misconfig/dropbear-weakmac.yaml

id: dropbear-weakmac

info:
  name: Dropbear Weak MAC Algorithms Enabled
  author: pussycat0x
  severity: low
  description: |
    The mac-alg command specifies which MAC algorithms in the SSH client profile for SSH encryption negotiation with an SFTP server when the DataPower Gateway acts as an SFTP client.
  reference: |
    https://www.virtuesecurity.com/kb/ssh-weak-mac-algorithms-enabled
  remediation: |
    Disable MD5 and 96-bit MAC algorithms.
  metadata:
    max-request: 1
    shodan-query: product:"Dropbear sshd"
    verified: true
  tags: network,ssh,dropbear,misconfig

tcp:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
    port: 22

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "hmac-md5"
          - "hmac-sha1"
        condition: or

      - type: word
        words:
          - "SSH-"
# digest: 4a0a0047304502201e312e2112fd02be44c3d23cd1171be0f3e848d31cb26cebf4fef752f3cd645a022100ec6214b3268a8c3179da31e03e230be9b84a0750e5ce1bf134e50d2dc5e9fe2d:922c64590222798bb761d5b6d8e72950
Update and rename network/detection/dropbear-weakmac-detect.yaml to network/misconfig/dropbear-weakmac.yaml 2022-11-26 16:21:18 +00:00			`id: dropbear-weakmac`
Add files via upload 2022-11-22 18:29:56 +00:00
			`info:`
Update and rename network/detection/dropbear-weakmac-detect.yaml to network/misconfig/dropbear-weakmac.yaml 2022-11-26 16:21:18 +00:00			`name: Dropbear Weak MAC Algorithms Enabled`
Add files via upload 2022-11-22 18:29:56 +00:00			`author: pussycat0x`
Update dropbear-weakmac-detect.yaml 2022-11-22 18:33:32 +00:00			`severity: low`
Add files via upload 2022-11-22 18:29:56 +00:00			`description: \|`
			`The mac-alg command specifies which MAC algorithms in the SSH client profile for SSH encryption negotiation with an SFTP server when the DataPower Gateway acts as an SFTP client.`
Update dropbear-weakmac-detect.yaml 2022-11-23 07:04:04 +00:00			`reference: \|`
			`https://www.virtuesecurity.com/kb/ssh-weak-mac-algorithms-enabled`
TemplateMan Update [Wed Sep 27 13:29:58 UTC 2023] :robot: 2023-09-27 13:29:58 +00:00			`remediation: \|`
			`Disable MD5 and 96-bit MAC algorithms.`
Add files via upload 2022-11-22 18:29:56 +00:00			`metadata:`
TemplateMan Update [Wed Sep 27 13:29:58 UTC 2023] :robot: 2023-09-27 13:29:58 +00:00			`max-request: 1`
			`shodan-query: product:"Dropbear sshd"`
Add files via upload 2022-11-22 18:29:56 +00:00			`verified: true`
Update and rename network/detection/dropbear-weakmac-detect.yaml to network/misconfig/dropbear-weakmac.yaml 2022-11-26 16:21:18 +00:00			`tags: network,ssh,dropbear,misconfig`
Add files via upload 2022-11-22 18:29:56 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`tcp:`
Add files via upload 2022-11-22 18:29:56 +00:00			`- inputs:`
			`- data: "\n"`
Update dropbear-weakmac-detect.yaml 2022-11-24 18:16:58 +00:00
Add files via upload 2022-11-22 18:29:56 +00:00			`host:`
			`- "{{Hostname}}"`
removed duplicate network request 2023-09-16 19:35:21 +00:00			`port: 22`
Update dropbear-weakmac-detect.yaml 2022-11-24 18:16:58 +00:00
Update dropbear-weakmac.yaml 2022-12-02 11:58:09 +00:00			`matchers-condition: and`
Add files via upload 2022-11-22 18:29:56 +00:00			`matchers:`
Update dropbear-weakmac-detect.yaml 2022-11-24 18:32:02 +00:00			`- type: word`
			`words:`
			`- "hmac-md5"`
			`- "hmac-sha1"`
			`condition: or`
Update dropbear-weakmac.yaml 2022-12-02 11:58:09 +00:00
			`- type: word`
			`words:`
			`- "SSH-"`
Auto Template Signing [Thu Oct 19 13:13:50 UTC 2023] :robot: 2023-10-19 13:13:52 +00:00			`# digest: 4a0a0047304502201e312e2112fd02be44c3d23cd1171be0f3e848d31cb26cebf4fef752f3cd645a022100ec6214b3268a8c3179da31e03e230be9b84a0750e5ce1bf134e50d2dc5e9fe2d:922c64590222798bb761d5b6d8e72950`