Update webrunner bundled target/country profiles with CVE-targeted probes and adversarial nation list

modules/webrunner/inputs/countries.yaml

@@ -1,36 +1,51 @@
----
-# WEBRUNNER — default country target list
-# Adjust to match your engagement scope
+scan_profile:
+  name: "adversarial-nations-panos"
+  rate: 3000
+  max_hosts_per_country: null
+
 countries:
+  # Largest internet footprint first — most likely to surface exposed devices
   - code: RU
-    name: Russia
-  - code: CN
-    name: China
+    priority: high
+    exclude_cidrs: []
+    notes: "Russia"
+
   - code: IR
-    name: Iran
-  - code: KP
-    name: North Korea
+    priority: high
+    exclude_cidrs: []
+    notes: "Iran"
+
   - code: BY
-    name: Belarus
-  - code: SY
-    name: Syria
-  - code: CU
-    name: Cuba
+    priority: medium
+    exclude_cidrs: []
+    notes: "Belarus"
+
   - code: VE
-    name: Venezuela
+    priority: medium
+    exclude_cidrs: []
+    notes: "Venezuela"
+
+  - code: SY
+    priority: medium
+    exclude_cidrs: []
+    notes: "Syria"
+
+  - code: NI
+    priority: low
+    exclude_cidrs: []
+    notes: "Nicaragua"
+
+  - code: CU
+    priority: low
+    exclude_cidrs: []
+    notes: "Cuba"
+
   - code: MM
-    name: Myanmar
-  - code: SD
-    name: Sudan
-  - code: IQ
-    name: Iraq
-  - code: UA
-    name: Ukraine
-  - code: AZ
-    name: Azerbaijan
-  - code: GE
-    name: Georgia
-  - code: AM
-    name: Armenia
-  - code: MD
-    name: Moldova
+    priority: low
+    exclude_cidrs: []
+    notes: "Myanmar"
+
+  - code: KP
+    priority: low
+    exclude_cidrs: []
+    notes: "North Korea — minimal public internet, low yield expected"

modules/webrunner/inputs/targets.yaml

@@ -1,55 +1,103 @@
----
-# WEBRUNNER — default scan targets
-# Define services of interest with ports and match criteria
 targets:
-  - name: SSH
-    description: OpenSSH / SSH servers
+  - name: "Palo Alto PAN-OS < 10.2.14"
+    tags: [panos, firewall, palo-alto, cve-2024-3400, network-device]
+    ports: [443, 4443, 8443]
+    probes:
+      - type: https
+        path: "/api/?type=version"
+        method: GET
+        match_in: body
+        patterns: ["sw-version"]
+        version_extract: "<sw-version>([0-9]+\\.[0-9]+\\.[0-9]+)"
+        version_compare:
+          operator: "<"
+          value: "10.2.14"
+        confidence: high
+
+      - type: https
+        path: "/php/login.php"
+        method: GET
+        match_in: [body, headers]
+        patterns:
+          - "Palo Alto Networks"
+          - "PAN-OS"
+        confidence: low
+
+      - type: https
+        path: "/global-protect/portal/gp-portal-esp.esp"
+        method: GET
+        match_in: body
+        patterns: ["globalprotect", "PAN-OS"]
+        confidence: low
+
+  - name: "Ubuntu 24.04 SSH"
+    tags: [linux, ubuntu, ssh]
     ports: [22]
+    probes:
+      - type: tcp_banner
+        patterns:
+          - "Ubuntu-24"
+          - "OpenSSH.*Ubuntu"
+        version_extract: "SSH-2\\.0-OpenSSH_([0-9p.]+)"
+        confidence: high
 
-  - name: HTTP
-    description: Web servers (plain)
-    ports: [80, 8080, 8000, 8888]
+  - name: "D-Link DIR-823X fw 240126/240802"
+    tags: [router, d-link, cpe, iot]
+    ports: [80, 443, 8080]
+    probes:
+      - type: http
+        path: "/"
+        match_in: body
+        patterns: ["DIR-823X"]
+        confidence: medium
+      - type: http
+        path: "/"
+        match_in: body
+        all_patterns: ["DIR-823X"]
+        patterns: ["240126", "240802"]
+        confidence: high
 
-  - name: HTTPS
-    description: Web servers (TLS)
-    ports: [443, 8443, 4443]
+  - name: "Exposed IP Camera"
+    tags: [camera, iot, surveillance]
+    ports: [80, 554, 8080, 8443, 37777, 34567]
+    probes:
+      - type: http
+        path: "/"
+        match_in: [body, headers]
+        patterns:
+          - "(?i)hikvision"
+          - "(?i)dahua"
+          - "(?i)ip.?camera"
+          - "(?i)ipcam"
+          - "(?i)webcam"
+          - "(?i)reolink"
+          - "(?i)amcrest"
+          - "(?i)axis"
+        confidence: medium
+      - type: rtsp
+        patterns: ["RTSP/1.0 200"]
+        confidence: medium
 
-  - name: RDP
-    description: Remote Desktop Protocol
-    ports: [3389]
+  - name: "Cisco SD-WAN vManage <= 20.17"
+    tags: [cisco, sdwan, network]
+    ports: [443, 8443]
+    probes:
+      - type: https
+        path: "/dataservice/client/server"
+        method: GET
+        match_in: body
+        patterns: ["platformVersion"]
+        version_extract: '"platformVersion":"([0-9.]+)"'
+        version_compare:
+          operator: "<="
+          value: "20.17"
+        confidence: high
 
-  - name: SMB
-    description: Windows file sharing
-    ports: [445, 139]
-
-  - name: FTP
-    description: File Transfer Protocol
-    ports: [21]
-
-  - name: Telnet
-    description: Legacy telnet
-    ports: [23]
-
-  - name: VNC
-    description: VNC remote desktop
-    ports: [5900, 5901, 5902]
-
-  - name: Proxy
-    description: HTTP/SOCKS proxies
-    ports: [3128, 8888, 1080, 1081]
-
-  - name: Database
-    description: Common database ports
-    ports: [3306, 5432, 1433, 27017, 6379]
-
-  - name: Kubernetes
-    description: K8s API server
-    ports: [6443, 8001]
-
-  - name: Docker
-    description: Docker daemon API
-    ports: [2375, 2376]
-
-  - name: SCADA
-    description: Industrial control systems
-    ports: [102, 502, 44818, 47808]
+  - name: "Open Redis"
+    tags: [database, redis, exposed]
+    ports: [6379]
+    probes:
+      - type: tcp_banner
+        patterns: ["redis_version"]
+        version_extract: "redis_version:([0-9.]+)"
+        confidence: high