standardize network template tags

2023-07-24 11:27:05 -07:00 · 2023-07-24 11:27:05 -07:00 · 67a02bb507
parent b007c09328
commit 67a02bb507
62 changed files with 72 additions and 72 deletions
--- a/network/cves/2017/CVE-2017-5645.yaml
+++ b/network/cves/2017/CVE-2017-5645.yaml
@ -23,7 +23,7 @@ info:
    max-request: 2
    vendor: apache
    product: log4j
-  tags: vulhub,network,apache,log4j,rce,deserialization,oast
+  tags: vulhub,network,apache,log4j,rce,deserialization,oast,cve
 variables:
  end: "\r\n"
 tcp:
--- a/network/cves/2020/CVE-2020-11981.yaml
+++ b/network/cves/2020/CVE-2020-11981.yaml
@ -19,7 +19,7 @@ info:
    max-request: 2
    shodan-query: product:"redis"
    verified: true
-  tags: network,redis,unauth,apache,airflow,vulhub,intrusive
+  tags: network,redis,unauth,apache,airflow,vulhub,intrusive,cve

 variables:
  data: "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9a-9ec3-029f9b46e066\", \"delivery_mode\": 2, \"body_encoding\": \"base64\", \"correlation_id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"delivery_info\": {\"routing_key\": \"celery\", \"exchange\": \"\"}, \"reply_to\": \"fb996eec-3033-3c10-9ee1-418e1ca06db8\"}, \"content-type\": \"application/json\", \"headers\": {\"retries\": 0, \"lang\": \"py\", \"argsrepr\": \"(100, 200)\", \"expires\": null, \"task\": \"airflow.executors.celery_executor.execute_command\", \"kwargsrepr\": \"{}\", \"root_id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"parent_id\": null, \"id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"origin\": \"gen1@132f65270cde\", \"eta\": null, \"group\": null, \"timelimit\": [null, null]}, \"body\": \""
--- a/network/detection/activemq-openwire-transport-detect.yaml
+++ b/network/detection/activemq-openwire-transport-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"ActiveMQ OpenWire transport"'
-  tags: network,activemq
+  tags: network,activemq,detect

 tcp:
  - inputs:
--- a/network/detection/apache-activemq-detect.yaml
+++ b/network/detection/apache-activemq-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"Apache ActiveMQ"'
-  tags: network,activemq,oss
+  tags: network,activemq,oss,detect

 tcp:
  - inputs:
--- a/network/detection/axigen-mail-server-detect.yaml
+++ b/network/detection/axigen-mail-server-detect.yaml
@ -11,7 +11,7 @@ info:
    verified: true
    fofa-query: app="axigen-Mail-Server"
    shodan-query: product:"Axigen"
-  tags: network,axigen
+  tags: network,axigen,detect

 tcp:
  - inputs:
--- a/network/detection/cisco-finger-detect.yaml
+++ b/network/detection/cisco-finger-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: product:"Cisco fingerd"
-  tags: network,finger
+  tags: network,finger,detect

 tcp:
  - inputs:
--- a/network/detection/clamav-detect.yaml
+++ b/network/detection/clamav-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'port:3310 product:"ClamAV"'
-  tags: network,clamav
+  tags: network,clamav,detect

 tcp:
  - inputs:
--- a/network/detection/cql-native-transport.yaml
+++ b/network/detection/cql-native-transport.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: "cassandra"
-  tags: network,cassandra,cql
+  tags: network,cassandra,cql,detect

 tcp:
  - inputs:
--- a/network/detection/detect-addpac-voip-gateway.yaml
+++ b/network/detection/detect-addpac-voip-gateway.yaml
@ -12,7 +12,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
-  tags: network,addpac,apos,voip
+  tags: network,addpac,apos,voip,detect
  metadata:
    max-request: 2

--- a/network/detection/detect-jabber-xmpp.yaml
+++ b/network/detection/detect-jabber-xmpp.yaml
@ -11,7 +11,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
-  tags: network,jabber,xmpp,messaging
+  tags: network,jabber,xmpp,messaging,detect
  metadata:
    max-request: 2

--- a/network/detection/dropbear-cbc-ciphers.yaml
+++ b/network/detection/dropbear-cbc-ciphers.yaml
@ -14,7 +14,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"Dropbear sshd"'
-  tags: network,ssh,dropbear
+  tags: network,ssh,dropbear,detect

 tcp:
  - inputs:
--- a/network/detection/finger-detect.yaml
+++ b/network/detection/finger-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: port:"79" action
-  tags: network,finger
+  tags: network,finger,detect

 tcp:
  - inputs:
--- a/network/detection/gnu-inetutils-ftpd-detect.yaml
+++ b/network/detection/gnu-inetutils-ftpd-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"GNU Inetutils FTPd"'
-  tags: network,ftp,smartgateway,gnu,inetutils
+  tags: network,ftp,smartgateway,gnu,inetutils,detect

 tcp:
  - inputs:
--- a/network/detection/gopher-detect.yaml
+++ b/network/detection/gopher-detect.yaml
@ -10,7 +10,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
-  tags: network,gopher
+  tags: network,gopher,detect
  metadata:
    max-request: 2

--- a/network/detection/ibm-d2b-database-server.yaml
+++ b/network/detection/ibm-d2b-database-server.yaml
@ -16,7 +16,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: product:"IBM DB2 Database Server"
-  tags: network,ibm,database,db,db2
+  tags: network,ibm,database,db,db2,detect

 tcp:
  - inputs:
--- a/network/detection/iplanet-imap-detect.yaml
+++ b/network/detection/iplanet-imap-detect.yaml
@ -13,7 +13,7 @@ info:
  metadata:
    max-request: 2
    fofa-query: app="iPlanet-Messaging-Server-5.2" && protocol="imap"
-  tags: network,imap
+  tags: network,imap,detect

 tcp:
  - inputs:
--- a/network/detection/java-rmi-detect.yaml
+++ b/network/detection/java-rmi-detect.yaml
@ -4,7 +4,7 @@ info:
  name: Java Remote Method Invocation Protocol - Detect
  author: F1tz
  severity: info
-  tags: network,rmi,java
+  tags: network,rmi,java,detect
  description: |
    Java Remote Method Invocation protocol is susceptible to information disclosure. It allows for unauthenticated network attacks, which can result in unauthorized operating system takeover including arbitrary code execution.
  classification:
--- a/network/detection/microsoft-ftp-service.yaml
+++ b/network/detection/microsoft-ftp-service.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: "Microsoft FTP Service"
-  tags: network,ftp,microsoft
+  tags: network,ftp,microsoft,detect

 tcp:

--- a/network/detection/mikrotik-ftp-server-detect.yaml
+++ b/network/detection/mikrotik-ftp-server-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"MikroTik router ftpd"'
-  tags: network,ftp,mikrotik,router
+  tags: network,ftp,mikrotik,router,detect

 tcp:
  - inputs:
--- a/network/detection/mikrotik-routeros-api.yaml
+++ b/network/detection/mikrotik-routeros-api.yaml
@ -14,7 +14,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: product:"MikroTik RouterOS API Service"
-  tags: network,mikrotik
+  tags: network,mikrotik,detect

 tcp:
  - inputs:
--- a/network/detection/mongodb-detect.yaml
+++ b/network/detection/mongodb-detect.yaml
@ -12,7 +12,7 @@ info:
    cwe-id: CWE-200
  reference:
    - https://github.com/orleven/Tentacle
-  tags: network,mongodb
+  tags: network,mongodb,detect
  metadata:
    max-request: 2

--- a/network/detection/mysql-detect.yaml
+++ b/network/detection/mysql-detect.yaml
@ -14,7 +14,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: product:"MySQL"
-  tags: network,mysql,db
+  tags: network,mysql,db,detect

 tcp:
  - inputs:
--- a/network/detection/openssh-detect.yaml
+++ b/network/detection/openssh-detect.yaml
@ -16,7 +16,7 @@ info:
    - http://seclists.org/fulldisclosure/2016/Jul/51
    - https://nvd.nist.gov/vuln/detail/CVE-2016-6210
    - https://nvd.nist.gov/vuln/detail/CVE-2018-15473
-  tags: seclists,network,ssh,openssh
+  tags: seclists,network,ssh,openssh,detect
  metadata:
    max-request: 2

--- a/network/detection/pgsql-detect.yaml
+++ b/network/detection/pgsql-detect.yaml
@ -17,7 +17,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: port:5432 product:"PostgreSQL"
-  tags: network,postgresql,db
+  tags: network,postgresql,db,detect

 tcp:
  - inputs:
--- a/network/detection/proftpd-server-detect.yaml
+++ b/network/detection/proftpd-server-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"ProFTPD"'
-  tags: network,ftp,proftpd
+  tags: network,ftp,proftpd,detect

 tcp:
  - inputs:
--- a/network/detection/rabbitmq-detect.yaml
+++ b/network/detection/rabbitmq-detect.yaml
@ -12,7 +12,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: product:"RabbitMQ"
-  tags: network,rabbitmq,oss
+  tags: network,rabbitmq,oss,detect

 tcp:
  - inputs:
--- a/network/detection/rdp-detect.yaml
+++ b/network/detection/rdp-detect.yaml
@ -13,7 +13,7 @@ info:
  metadata:
    max-request: 2
    verified: true
-  tags: network,windows,rdp
+  tags: network,windows,rdp,detect

 tcp:
  - inputs:
--- a/network/detection/redis-detect.yaml
+++ b/network/detection/redis-detect.yaml
@ -12,7 +12,7 @@ info:
    max-request: 4
    shodan-query: product:"redis"
    verified: true
-  tags: network,redis
+  tags: network,redis,detect

 tcp:
  - inputs:
--- a/network/detection/riak-detect.yaml
+++ b/network/detection/riak-detect.yaml
@ -9,7 +9,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: product:"Riak"
-  tags: network,oss
+  tags: network,oss,detect

 tcp:
  - inputs:
--- a/network/detection/rpcbind-portmapper-detect.yaml
+++ b/network/detection/rpcbind-portmapper-detect.yaml
@ -14,7 +14,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: port:"111"
-  tags: network,rpcbind,portmap
+  tags: network,rpcbind,portmap,detect

 tcp:
  - inputs:
--- a/network/detection/rsyncd-service-detect.yaml
+++ b/network/detection/rsyncd-service-detect.yaml
@ -12,7 +12,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
-  tags: network,rsyncd
+  tags: network,rsyncd,detect
  metadata:
    max-request: 2

--- a/network/detection/samba-detect.yaml
+++ b/network/detection/samba-detect.yaml
@ -11,7 +11,7 @@ info:
  classification:
    cwe-id: CWE-200
  remediation: Always apply the latest security patch.
-  tags: network,smb,samba
+  tags: network,smb,samba,detect
  metadata:
    max-request: 2

--- a/network/detection/sap-router.yaml
+++ b/network/detection/sap-router.yaml
@ -4,7 +4,7 @@ info:
  name: SAPRouter Detection
  author: randomstr1ng
  severity: info
-  tags: network,sap
+  tags: network,sap,detect
  description: |
    SAProuter is a software application that provides a remote connection between our customer's network and SAP.
  metadata:
--- a/network/detection/smb-detect.yaml
+++ b/network/detection/smb-detect.yaml
@ -4,7 +4,7 @@ info:
  name: SMB Detection
  author: pussycat0x
  severity: low
-  tags: network,windows,smb,service
+  tags: network,windows,smb,service,detect
  description: |
    SMB (Server Message Block) is a network-layered protocol mainly used on Windows for sharing files, printers, and communication between network-attached computers. SMB related vulnerabilities can be levaraged to compromise large-scale systems.
  metadata:
--- a/network/detection/smtp-detect.yaml
+++ b/network/detection/smtp-detect.yaml
@ -4,7 +4,7 @@ info:
  name: SMTP Service Detection
  author: pussycat0x
  severity: info
-  tags: network,service,smtp
+  tags: network,service,smtp,detect
  description: |
    SMTP is part of the application layer of the TCP/IP protocol. Using a process called “store and forward,” SMTP moves your email on and across networks.
  metadata:
--- a/network/detection/sshd-dropbear-detect.yaml
+++ b/network/detection/sshd-dropbear-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"Dropbear sshd"'
-  tags: network,ssh,dropbear
+  tags: network,ssh,dropbear,detect

 tcp:

--- a/network/detection/starttls-mail-detect.yaml
+++ b/network/detection/starttls-mail-detect.yaml
@ -4,7 +4,7 @@ info:
  name: STARTTLS Mail Server Detection
  author: r3dg33k
  severity: info
-  tags: mail,starttls,network
+  tags: mail,starttls,network,detect
  description: |
    STARTTLS is an email protocol command that tells an email server that an email client, including an email client running in a web browser, wants to turn an existing insecure connection into a secure one.
  metadata:
--- a/network/detection/teamspeak3-detect.yaml
+++ b/network/detection/teamspeak3-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    shodan-query: product:"TeamSpeak 3 ServerQuery"
    verified: true
-  tags: network,service,teamspeak3
+  tags: network,service,teamspeak3,detect
 tcp:
  - inputs:
      - data: "\r\n"
--- a/network/detection/telnet-detect.yaml
+++ b/network/detection/telnet-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: port:23 telnet
-  tags: network,telnet
+  tags: network,telnet,detect

 tcp:
  - inputs:
--- a/network/detection/totemomail-smtp-detect.yaml
+++ b/network/detection/totemomail-smtp-detect.yaml
@ -4,7 +4,7 @@ info:
  name: Totemomail SMTP Server Detection
  author: princechaddha
  severity: info
-  tags: mail,smtp,network,totemomail
+  tags: mail,smtp,network,totemomail,detect
  description: |
    Totemomail is a comprehensive email solution designed to address all aspects of digital communication security.
  metadata:
--- a/network/detection/vmware-authentication-daemon-detect.yaml
+++ b/network/detection/vmware-authentication-daemon-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"VMware Authentication Daemon"'
-  tags: network,vmware,authenticated
+  tags: network,vmware,authenticated,detect

 tcp:

--- a/network/detection/vnc-service-detect.yaml
+++ b/network/detection/vnc-service-detect.yaml
@ -7,7 +7,7 @@ info:
  description: A Virtual Network Computing (VNC) service was detected.
  classification:
    cwe-id: CWE-200
-  tags: network,vnc,service
+  tags: network,vnc,service,detect
  metadata:
    max-request: 2

--- a/network/detection/weblogic-iiop-detect.yaml
+++ b/network/detection/weblogic-iiop-detect.yaml
@ -4,7 +4,7 @@ info:
  name: Weblogic IIOP Protocol Detection
  author: F1tz
  severity: info
-  tags: network,weblogic
+  tags: network,weblogic,detect
  description: |
    The IIOP (Internet Inter-ORB Protocol) protocol makes it possible for distributed programs written in different programming languages to communicate over the Internet.
  metadata:
--- a/network/detection/weblogic-t3-detect.yaml
+++ b/network/detection/weblogic-t3-detect.yaml
@ -4,7 +4,7 @@ info:
  name: Weblogic T3 Protocol Detection
  author: F1tz,milo2012,wdahlenb
  severity: info
-  tags: network,weblogic
+  tags: network,weblogic,detect
  description: |
    T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.
  metadata:
--- a/network/detection/xlight-ftp-service-detect.yaml
+++ b/network/detection/xlight-ftp-service-detect.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: 'product:"Xlight ftpd"'
-  tags: network,ftp,xlight
+  tags: network,ftp,xlight,detect

 tcp:

--- a/network/enumeration/niagara-fox-info-enum.yaml
+++ b/network/enumeration/niagara-fox-info-enum.yaml
@ -12,7 +12,7 @@ info:
    shodan-query: 'product:"Niagara Fox"'
  reference:
    - https://nmap.org/nsedoc/scripts/fox-info.html
-  tags: network,fox,niagara
+  tags: network,fox,niagara,enum

 tcp:
  - inputs:
--- a/network/exposures/exposed-adb.yaml
+++ b/network/exposures/exposed-adb.yaml
@ -9,7 +9,7 @@ info:
    - https://doublepulsar.com/root-bridge-how-thousands-of-internet-connected-android-devices-now-have-no-security-and-are-b46a68cb0f20
    - https://www.hackeracademy.org/how-to-hack-android-device-with-adb-android-debugging-bridge
    - https://www.securezoo.com/2018/06/thousands-of-android-devices-leave-debug-port-5555-exposed/
-  tags: network,adb,rce,android
+  tags: network,adb,rce,android,exposure
  metadata:
    max-request: 2

--- a/network/exposures/exposed-dockerd.yaml
+++ b/network/exposures/exposed-dockerd.yaml
@ -10,7 +10,7 @@ info:
    max-request: 2
    verified: true
    shodan-query: port:2375 product:"docker"
-  tags: network,docker
+  tags: network,docker,exposure

 tcp:
  - inputs:
--- a/network/exposures/exposed-redis.yaml
+++ b/network/exposures/exposed-redis.yaml
@ -9,7 +9,7 @@ info:
    - https://redis.io/topics/security
  metadata:
    max-request: 4
-  tags: network,redis,unauth
+  tags: network,redis,unauth,exposure

 tcp:
  - inputs:
--- a/network/exposures/exposed-zookeeper.yaml
+++ b/network/exposures/exposed-zookeeper.yaml
@ -7,7 +7,7 @@ info:
  description: Apache ZooKeeper was able to be accessed without any required authentication.
  reference:
    - https://zookeeper.apache.org/security.html
-  tags: network,zookeeper,unauth
+  tags: network,zookeeper,unauth,exposure
  metadata:
    max-request: 2

--- a/network/misconfig/apache-rocketmq-broker-unauth.yaml
+++ b/network/misconfig/apache-rocketmq-broker-unauth.yaml
@ -13,7 +13,7 @@ info:
    max-request: 2
    shodan-query: title:"RocketMQ"
    verified: true
-  tags: network,rocketmq,broker,apache,unauth
+  tags: network,rocketmq,broker,apache,unauth,misconfig

 tcp:
  - inputs:
--- a/network/misconfig/clamav-unauth.yaml
+++ b/network/misconfig/clamav-unauth.yaml
@ -15,7 +15,7 @@ info:
  reference:
    - https://seclists.org/nmap-dev/2016/q2/201
    - https://bugzilla.clamav.net/show_bug.cgi?id=11585
-  tags: network,clamav,unauth,seclists
+  tags: network,clamav,unauth,seclists,misconfig

 tcp:
  - inputs:
--- a/network/misconfig/clickhouse-unauth.yaml
+++ b/network/misconfig/clickhouse-unauth.yaml
@ -5,7 +5,7 @@ info:
  author: lu4nx
  severity: high
  description: ClickHouse was able to be accessed with no required authentication in place.
-  tags: network,clickhouse,unauth
+  tags: network,clickhouse,unauth,misconfig
  metadata:
    max-request: 2

--- a/network/misconfig/ganglia-xml-grid-monitor.yaml
+++ b/network/misconfig/ganglia-xml-grid-monitor.yaml
@ -7,7 +7,7 @@ info:
  description: Ganglia is a scalable distributed monitoring system for high-performance computing systems such as clusters and Grids.
  reference:
    - http://ganglia.info/
-  tags: ganglia,network
+  tags: ganglia,network,misconfig
  metadata:
    max-request: 2

--- a/network/misconfig/memcached-stats.yaml
+++ b/network/misconfig/memcached-stats.yaml
@ -4,7 +4,7 @@ info:
  name: Memcached stats disclosure
  author: pdteam
  severity: low
-  tags: network,memcached
+  tags: network,memcached,misconfig
  description: |
    Memcached stats is used to return server statistics such as PID, version, connections, etc.
  metadata:
--- a/network/misconfig/mongodb-unauth.yaml
+++ b/network/misconfig/mongodb-unauth.yaml
@ -10,7 +10,7 @@ info:
    - https://book.hacktricks.xyz/pentesting/27017-27018-mongodb
    - https://www.mongodb.com/features/mongodb-authentication
  remediation: Enable Authentication in MongoDB
-  tags: network,mongodb,unauth
+  tags: network,mongodb,unauth,misconfig
  metadata:
    max-request: 2

--- a/network/misconfig/mysql-native-password.yaml
+++ b/network/misconfig/mysql-native-password.yaml
@ -11,7 +11,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
-  tags: network,mysql,bruteforce,db
+  tags: network,mysql,bruteforce,db,misconfig
  metadata:
    max-request: 2

--- a/network/misconfig/printers-info-leak.yaml
+++ b/network/misconfig/printers-info-leak.yaml
@ -6,7 +6,7 @@ info:
  severity: info
  reference:
    - https://book.hacktricks.xyz/pentesting/9100-pjl
-  tags: network,iot,printer
+  tags: network,iot,printer,misconfig
  description: |
    Unauthorized access to printers allows attackers to print, eavesdrop sensitive documents.
  metadata:
--- a/network/misconfig/sap-router-info-leak.yaml
+++ b/network/misconfig/sap-router-info-leak.yaml
@ -8,7 +8,7 @@ info:
  reference:
    - https://securityforeveryone.com/tools/saprouter-routing-information-leakage-vulnerability-scanner
    - https://support.sap.com/en/tools/connectivity-tools/saprouter.html
-  tags: network,sap
+  tags: network,sap,misconfig
  metadata:
    max-request: 2

--- a/network/misconfig/tidb-native-password.yaml
+++ b/network/misconfig/tidb-native-password.yaml
@ -9,7 +9,7 @@ info:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
-  tags: network,tidb,bruteforce,db
+  tags: network,tidb,bruteforce,db,misconfig
  metadata:
    max-request: 2

--- a/network/misconfig/tidb-unauth.yaml
+++ b/network/misconfig/tidb-unauth.yaml
@ -8,7 +8,7 @@ info:
  metadata:
    max-request: 2
    zoomeye-query: tidb +port:"4000"
-  tags: network,tidb,unauth
+  tags: network,tidb,unauth,misconfig

 tcp:
  - inputs:
--- a/network/misconfig/unauth-psql.yaml
+++ b/network/misconfig/unauth-psql.yaml
@ -12,7 +12,7 @@ info:
    max-request: 2
    shodan-query: port:5432 product:"PostgreSQL"
    verified: "true"
-  tags: network,postgresql,db,unauth
+  tags: network,postgresql,db,unauth,misconfig

 tcp:
  - inputs: