Merge pull request #6228 from projectdiscovery/rpcbind-portmapper-detect

Create rpcbind-portmapper-detect.yaml
2022-12-09 14:24:37 +05:30 · 2022-12-09 14:24:37 +05:30 · f966f559ac
parent 377d9c239c cab75b415a
commit f966f559ac
1 changed files with 25 additions and 0 deletions
--- a/network/detection/rpcbind-portmapper-detect.yaml
+++ b/network/detection/rpcbind-portmapper-detect.yaml
@ -0,0 +1,25 @@
+id: rpcbind-portmapper-detect
+
+info:
+  name: RPCBind Portmapper Detection
+  author: geeknik
+  severity: info
+  reference: https://book.hacktricks.xyz/pentesting/pentesting-rpcbind
+  metadata:
+    verified: true
+    shodan-query: port:"111"
+  tags: network,rpcbind,portmap
+
+network:
+  - inputs:
+      - data: 8000002836ed646d0000000000000002000186a0000000040000000400000000000000000000000000000000
+        type: hex
+
+    host:
+      - "{{Hostname}}"
+      - "{{Host}}:111"
+
+    matchers:
+      - type: word
+        words:
+          - "/run/rpcbind.sock"