metadata update

http/misconfiguration/microsoft-exchange-user-enumeration.yaml

@@ -1,22 +1,24 @@
-id: microsoft-exchange-user-enumeration
+id: ms-exchange-enum
 
 info:
   name: Microsoft Exchange Autodiscover - User Enumeration
   author: righettod
   severity: info
-  description: Microsoft Exchange (on premise) is prone to a user enumeration via the ActiveSync protocol using the AutodiscoverV2 endpoint.
+  description: |
+    Microsoft Exchange (on premise) is prone to a user enumeration via the ActiveSync protocol using the AutodiscoverV2 endpoint.
   reference:
     - https://www.msxfaq.de/exchange/autodiscover/autodiscover_v2.htm
-  classification:
-    cwe-id: CWE-204
+    - https://github.com/righettod/toolbox-pentest-web/blob/master/docs/4-HINTS_ARCHIVED.md#user-enumeration-techniques-for-microsoft-exchange
   metadata:
     max-request: 1
-  tags: exchange,microsoft,misconfig,intrusive
+    verified: true
+    shodan-query: http.title:outlook exchange
+  tags: ms-exchange,microsoft,misconfig,enum
 
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/autodiscover/autodiscover.json?Protocol=ActiveSync&Email={{rand_text_alpha(6)}}%40domain.com&RedirectCount=1"
+      - "{{BaseURL}}/autodiscover/autodiscover.json?Protocol=ActiveSync&Email={{rand_text_alpha(6)}}%40oast.pro&RedirectCount=1"
 
     matchers-condition: and
     matchers: