Added 2 templates to detect X-AspNetMvc-Version and X-AspNet-Version headers

patch-1
Lucky-Pulse 2024-03-11 11:16:50 +13:00
parent 80844c36be
commit 5d478d5e10
2 changed files with 70 additions and 0 deletions

View File

@ -0,0 +1,35 @@
id: AspNet-Version-disclosure
info:
name: AspNet-Version-disclosure
author: lucky0x0d,PulseSecurity.co.nz
severity: info
description: |
Detects version disclosed via X-AspNet-Version: header
tags: technology, detection, tech-detect
metadata:
max-request: 1
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
http:
- method: GET
path:
- "{{BaseURL}}"
host-redirects: true
max-redirects: 3
matchers-condition: or
matchers:
- type: dsl
dsl:
- "regex('(?i)X-AspNet-Version', header)"
- "status_code != 301 && status_code != 302"
condition: and
extractors:
- type: kval
kval:
- X_AspNet_Version

View File

@ -0,0 +1,35 @@
id: AspNetMvc-Version-disclosure
info:
name: AspNetMvc-Version-disclosure
author: lucky0x0d,PulseSecurity.co.nz
severity: info
description: |
Detects version disclosed via X-AspNetMvc-Version: header
tags: technology, detection, tech-detect
metadata:
max-request: 1
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
http:
- method: GET
path:
- "{{BaseURL}}"
host-redirects: true
max-redirects: 3
matchers-condition: or
matchers:
- type: dsl
dsl:
- "regex('(?i)X-AspNetMvc-Version', header)"
- "status_code != 301 && status_code != 302"
condition: and
extractors:
- type: kval
kval:
- X_AspNetMvc_Version