From 98c3fc8d9debb58da076535cfe05cf9318c824a2 Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Thu, 30 Apr 2026 16:55:08 -0400 Subject: [PATCH] Update webrunner bundled target/country profiles with CVE-targeted probes and adversarial nation list --- modules/webrunner/inputs/countries.yaml | 75 +++++++----- modules/webrunner/inputs/targets.yaml | 146 ++++++++++++++++-------- 2 files changed, 142 insertions(+), 79 deletions(-) diff --git a/modules/webrunner/inputs/countries.yaml b/modules/webrunner/inputs/countries.yaml index efaf6bc..acecb3b 100644 --- a/modules/webrunner/inputs/countries.yaml +++ b/modules/webrunner/inputs/countries.yaml @@ -1,36 +1,51 @@ ---- -# WEBRUNNER — default country target list -# Adjust to match your engagement scope +scan_profile: + name: "adversarial-nations-panos" + rate: 3000 + max_hosts_per_country: null + countries: + # Largest internet footprint first — most likely to surface exposed devices - code: RU - name: Russia - - code: CN - name: China + priority: high + exclude_cidrs: [] + notes: "Russia" + - code: IR - name: Iran - - code: KP - name: North Korea + priority: high + exclude_cidrs: [] + notes: "Iran" + - code: BY - name: Belarus - - code: SY - name: Syria - - code: CU - name: Cuba + priority: medium + exclude_cidrs: [] + notes: "Belarus" + - code: VE - name: Venezuela + priority: medium + exclude_cidrs: [] + notes: "Venezuela" + + - code: SY + priority: medium + exclude_cidrs: [] + notes: "Syria" + + - code: NI + priority: low + exclude_cidrs: [] + notes: "Nicaragua" + + - code: CU + priority: low + exclude_cidrs: [] + notes: "Cuba" + - code: MM - name: Myanmar - - code: SD - name: Sudan - - code: IQ - name: Iraq - - code: UA - name: Ukraine - - code: AZ - name: Azerbaijan - - code: GE - name: Georgia - - code: AM - name: Armenia - - code: MD - name: Moldova + priority: low + exclude_cidrs: [] + notes: "Myanmar" + + - code: KP + priority: low + exclude_cidrs: [] + notes: "North Korea — minimal public internet, low yield expected" diff --git a/modules/webrunner/inputs/targets.yaml b/modules/webrunner/inputs/targets.yaml index 38593f3..68d5ae8 100644 --- a/modules/webrunner/inputs/targets.yaml +++ b/modules/webrunner/inputs/targets.yaml @@ -1,55 +1,103 @@ ---- -# WEBRUNNER — default scan targets -# Define services of interest with ports and match criteria targets: - - name: SSH - description: OpenSSH / SSH servers + - name: "Palo Alto PAN-OS < 10.2.14" + tags: [panos, firewall, palo-alto, cve-2024-3400, network-device] + ports: [443, 4443, 8443] + probes: + - type: https + path: "/api/?type=version" + method: GET + match_in: body + patterns: ["sw-version"] + version_extract: "([0-9]+\\.[0-9]+\\.[0-9]+)" + version_compare: + operator: "<" + value: "10.2.14" + confidence: high + + - type: https + path: "/php/login.php" + method: GET + match_in: [body, headers] + patterns: + - "Palo Alto Networks" + - "PAN-OS" + confidence: low + + - type: https + path: "/global-protect/portal/gp-portal-esp.esp" + method: GET + match_in: body + patterns: ["globalprotect", "PAN-OS"] + confidence: low + + - name: "Ubuntu 24.04 SSH" + tags: [linux, ubuntu, ssh] ports: [22] + probes: + - type: tcp_banner + patterns: + - "Ubuntu-24" + - "OpenSSH.*Ubuntu" + version_extract: "SSH-2\\.0-OpenSSH_([0-9p.]+)" + confidence: high - - name: HTTP - description: Web servers (plain) - ports: [80, 8080, 8000, 8888] + - name: "D-Link DIR-823X fw 240126/240802" + tags: [router, d-link, cpe, iot] + ports: [80, 443, 8080] + probes: + - type: http + path: "/" + match_in: body + patterns: ["DIR-823X"] + confidence: medium + - type: http + path: "/" + match_in: body + all_patterns: ["DIR-823X"] + patterns: ["240126", "240802"] + confidence: high - - name: HTTPS - description: Web servers (TLS) - ports: [443, 8443, 4443] + - name: "Exposed IP Camera" + tags: [camera, iot, surveillance] + ports: [80, 554, 8080, 8443, 37777, 34567] + probes: + - type: http + path: "/" + match_in: [body, headers] + patterns: + - "(?i)hikvision" + - "(?i)dahua" + - "(?i)ip.?camera" + - "(?i)ipcam" + - "(?i)webcam" + - "(?i)reolink" + - "(?i)amcrest" + - "(?i)axis" + confidence: medium + - type: rtsp + patterns: ["RTSP/1.0 200"] + confidence: medium - - name: RDP - description: Remote Desktop Protocol - ports: [3389] + - name: "Cisco SD-WAN vManage <= 20.17" + tags: [cisco, sdwan, network] + ports: [443, 8443] + probes: + - type: https + path: "/dataservice/client/server" + method: GET + match_in: body + patterns: ["platformVersion"] + version_extract: '"platformVersion":"([0-9.]+)"' + version_compare: + operator: "<=" + value: "20.17" + confidence: high - - name: SMB - description: Windows file sharing - ports: [445, 139] - - - name: FTP - description: File Transfer Protocol - ports: [21] - - - name: Telnet - description: Legacy telnet - ports: [23] - - - name: VNC - description: VNC remote desktop - ports: [5900, 5901, 5902] - - - name: Proxy - description: HTTP/SOCKS proxies - ports: [3128, 8888, 1080, 1081] - - - name: Database - description: Common database ports - ports: [3306, 5432, 1433, 27017, 6379] - - - name: Kubernetes - description: K8s API server - ports: [6443, 8001] - - - name: Docker - description: Docker daemon API - ports: [2375, 2376] - - - name: SCADA - description: Industrial control systems - ports: [102, 502, 44818, 47808] + - name: "Open Redis" + tags: [database, redis, exposed] + ports: [6379] + probes: + - type: tcp_banner + patterns: ["redis_version"] + version_extract: "redis_version:([0-9.]+)" + confidence: high