Added woodwing templates

patch-1
sandeep 2023-12-13 01:50:01 +05:30
parent 94c1126326
commit bec548847e
3 changed files with 91 additions and 0 deletions

View File

@ -0,0 +1,26 @@
id: woodwing-panel
info:
name: Woodwing Studio Server - Panel
author: pdteam
severity: info
reference:
- https://twitter.com/ynsmroztas/status/1680961398011047936
metadata:
shodan-query: http.title:"WoodWing Studio Server"
fofa-query: title=="WoodWing Studio Server"
tags: woodwing,panel
http:
- method: GET
path:
- "{{BaseURL}}/StudioServer/server/apps/login.php"
- "{{BaseURL}}/server/apps/login.php"
stop-at-first-match: true
redirects: true
max-redirects: 2
matchers:
- type: dsl
dsl:
- "contains(tolower(body), 'woodwing studio server')"

View File

@ -0,0 +1,35 @@
id: woodwing-git
info:
name: Woodwing Studio Server - Git Config
author: pdteam
severity: medium
reference:
- https://twitter.com/ynsmroztas/status/1680961398011047936
metadata:
shodan-query: http.title:"WoodWing Studio Server"
fofa-query: title=="WoodWing Studio Server"
tags: woodwing,git,config
http:
- method: GET
path:
- "{{BaseURL}}/Server/.git/config"
- "{{BaseURL}}/StudioServer/.git/config"
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- "!contains_all(tolower(body), '<html', '<body')"
- "contains_all(tolower(body), '[credentials]', '[core]')"
- "status_code == 200"
condition: and
extractors:
- type: regex
group: 1
regex:
- "url ?= ?https?://(.*:.*)@"
- "AUTHORIZATION: basic (.*)"
- "pass = (.*)"

View File

@ -0,0 +1,30 @@
id: woodwing-phpinfo
info:
name: Woodwing Studio Server - Phpinfo Config
author: pdteam
severity: medium
reference:
- https://twitter.com/ynsmroztas/status/1680961398011047936
metadata:
shodan-query: http.title:"WoodWing Studio Server"
fofa-query: title=="WoodWing Studio Server"
tags: woodwing,phpinfo
http:
- method: GET
path:
- "{{BaseURL}}/StudioServer/server/wwtest/phpinfo.php"
- "{{BaseURL}}/server/wwtest/phpinfo.php"
stop-at-first-match: true
redirects: true
max-redirects: 2
matchers:
- type: dsl
dsl:
- contains(tolower(body), 'woodwing')
- contains(tolower(body), 'php extension')
- contains(tolower(body), 'php version')
- status_code == 200
condition: and