49 lines
2.3 KiB
YAML
49 lines
2.3 KiB
YAML
id: telerik-dialoghandler-detect
|
|
|
|
info:
|
|
name: Detect Telerik Web UI Dialog Handler
|
|
author: organiccrap,zhenwarx,nielsing
|
|
severity: info
|
|
description: This template detects the Telerik Web UI Dialog Handler.
|
|
reference:
|
|
- https://captmeelo.com/pentest/2018/08/03/pwning-with-telerik.html
|
|
- https://github.com/bao7uo/dp_crypto
|
|
metadata:
|
|
max-request: 17
|
|
tags: tech,telerik,asp
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/desktopmodules/telerikwebui/radeditorprovider/telerik.web.ui.dialoghandler.aspx?dp=1'
|
|
- '{{BaseURL}}/desktopmodules/dnnwerk.radeditorprovider/dialoghandler.aspx?dp=1'
|
|
- '{{BaseURL}}/DesktopModules/Admin/RadEditorProvider/DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/DesktopModule/UIQuestionControls/UIAskQuestion/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/Modules/CMS/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/Admin/ServerSide/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/DesktopModules/TNComments/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/Providers/HtmlEditorProviders/Telerik/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/App_Master/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/common/admin/PhotoGallery2/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/common/admin/Jobs2/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/AsiCommon/Controls/ContentManagement/ContentDesigner/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/common/admin/Calendar/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/cms/portlets/Telerik.Web.UI.DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/dashboard/UserControl/CMS/Page/Telerik.Web.UI.DialogHandler.aspx/Desktopmodules/Admin/dnnWerk.Users/DialogHandler.aspx?dp=1'
|
|
- '{{BaseURL}}/Telerik.Web.UI.DialogHandler.axd?dp=1'
|
|
|
|
stop-at-first-match: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
words:
|
|
- 'Invalid length for a Base-64 char array'
|
|
|
|
# digest: 4a0a004730450220739858cbb93b3482549bae5f8ec48c5d01b84cefb4a1e99c724f57390609922b022100e87cbb7e2e432352c226341c97bd86d97c4e0b5f03b92a695a4742454d96c9e7:922c64590222798bb761d5b6d8e72950
|