id: tasmota-config-webui

info:
  name: Tasmota Configuration Exposure
  author: ritikchaddha
  severity: medium
  reference:
    - https://github.com/arendst/Tasmota
  metadata:
    verified: true
    shodan-query: title:"Tasmota"
  tags: misconfig,tasmota,exposure,config

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "Firmware"
          - "Tasmota"
        condition: and
        case-insensitive: true

      - type: word
        part: body
        words:
          - "Theo Arends"
          - "<h2>Tasmota</h2>"
        condition: and
        case-insensitive: true

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "Tasmota ([0-9.]+) "