Update webrunner bundled target/country profiles with CVE-targeted probes and adversarial nation list

2026-04-30 16:55:08 -04:00
parent 507b376e13
commit 180e9c3aa0
2 changed files with 142 additions and 79 deletions
@@ -1,55 +1,103 @@
---
-# WEBRUNNER — default scan targets
-# Define services of interest with ports and match criteria
 targets:
-  - name: SSH
-    description: OpenSSH / SSH servers
+  - name: "Palo Alto PAN-OS < 10.2.14"
+    tags: [panos, firewall, palo-alto, cve-2024-3400, network-device]
+    ports: [443, 4443, 8443]
+    probes:
+      - type: https
+        path: "/api/?type=version"
+        method: GET
+        match_in: body
+        patterns: ["sw-version"]
+        version_extract: "<sw-version>([0-9]+\\.[0-9]+\\.[0-9]+)"
+        version_compare:
+          operator: "<"
+          value: "10.2.14"
+        confidence: high
+
+      - type: https
+        path: "/php/login.php"
+        method: GET
+        match_in: [body, headers]
+        patterns:
+          - "Palo Alto Networks"
+          - "PAN-OS"
+        confidence: low
+
+      - type: https
+        path: "/global-protect/portal/gp-portal-esp.esp"
+        method: GET
+        match_in: body
+        patterns: ["globalprotect", "PAN-OS"]
+        confidence: low
+
+  - name: "Ubuntu 24.04 SSH"
+    tags: [linux, ubuntu, ssh]
    ports: [22]
+    probes:
+      - type: tcp_banner
+        patterns:
+          - "Ubuntu-24"
+          - "OpenSSH.*Ubuntu"
+        version_extract: "SSH-2\\.0-OpenSSH_([0-9p.]+)"
+        confidence: high

-  - name: HTTP
-    description: Web servers (plain)
-    ports: [80, 8080, 8000, 8888]
+  - name: "D-Link DIR-823X fw 240126/240802"
+    tags: [router, d-link, cpe, iot]
+    ports: [80, 443, 8080]
+    probes:
+      - type: http
+        path: "/"
+        match_in: body
+        patterns: ["DIR-823X"]
+        confidence: medium
+      - type: http
+        path: "/"
+        match_in: body
+        all_patterns: ["DIR-823X"]
+        patterns: ["240126", "240802"]
+        confidence: high

-  - name: HTTPS
-    description: Web servers (TLS)
-    ports: [443, 8443, 4443]
+  - name: "Exposed IP Camera"
+    tags: [camera, iot, surveillance]
+    ports: [80, 554, 8080, 8443, 37777, 34567]
+    probes:
+      - type: http
+        path: "/"
+        match_in: [body, headers]
+        patterns:
+          - "(?i)hikvision"
+          - "(?i)dahua"
+          - "(?i)ip.?camera"
+          - "(?i)ipcam"
+          - "(?i)webcam"
+          - "(?i)reolink"
+          - "(?i)amcrest"
+          - "(?i)axis"
+        confidence: medium
+      - type: rtsp
+        patterns: ["RTSP/1.0 200"]
+        confidence: medium

-  - name: RDP
-    description: Remote Desktop Protocol
-    ports: [3389]
+  - name: "Cisco SD-WAN vManage <= 20.17"
+    tags: [cisco, sdwan, network]
+    ports: [443, 8443]
+    probes:
+      - type: https
+        path: "/dataservice/client/server"
+        method: GET
+        match_in: body
+        patterns: ["platformVersion"]
+        version_extract: '"platformVersion":"([0-9.]+)"'
+        version_compare:
+          operator: "<="
+          value: "20.17"
+        confidence: high

-  - name: SMB
-    description: Windows file sharing
-    ports: [445, 139]
-
-  - name: FTP
-    description: File Transfer Protocol
-    ports: [21]
-
-  - name: Telnet
-    description: Legacy telnet
-    ports: [23]
-
-  - name: VNC
-    description: VNC remote desktop
-    ports: [5900, 5901, 5902]
-
-  - name: Proxy
-    description: HTTP/SOCKS proxies
-    ports: [3128, 8888, 1080, 1081]
-
-  - name: Database
-    description: Common database ports
-    ports: [3306, 5432, 1433, 27017, 6379]
-
-  - name: Kubernetes
-    description: K8s API server
-    ports: [6443, 8001]
-
-  - name: Docker
-    description: Docker daemon API
-    ports: [2375, 2376]
-
-  - name: SCADA
-    description: Industrial control systems
-    ports: [102, 502, 44818, 47808]
+  - name: "Open Redis"
+    tags: [database, redis, exposed]
+    ports: [6379]
+    probes:
+      - type: tcp_banner
+        patterns: ["redis_version"]
+        version_extract: "redis_version:([0-9.]+)"
+        confidence: high