Merge pull request #6127 from projectdiscovery/Dropbear-sshd-CBC-Mode-Ciphers-Detection

Dropbear sshd CBC Mode Ciphers Detection

network/detection/dropbear-cbc-ciphers.yaml

@@ -0,0 +1,31 @@
+id: dropbear-cbc-ciphers
+
+info:
+  name: Dropbear sshd CBC Mode Ciphers Detection
+  author: pussycat0x
+  severity: low
+  description: |
+    The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.
+  remediation: |
+    Disable CBC Ciphers.
+  reference: |
+    https://www.tenable.com/plugins/nessus/70658
+  metadata:
+    verified: true
+    shodan-query: 'product:"Dropbear sshd"'
+  tags: network,ssh,dropbear
+
+network:
+  - inputs:
+      - data: "\n"
+
+    host:
+      - "{{Hostname}}"
+      - "{{Host}}:22"
+
+    matchers:
+      - type: word
+        words:
+          - "cbc"
+          - "SSH-"
+        condition: and