moriarty-project 0.1.6__py3-none-any.whl

moriarty/assets/modules/streaming/dlive.yaml

@@ -0,0 +1,27 @@
+site: dlive
+name: DLive
+category:
+  - streaming
+  - crypto
+tags:
+  - streaming
+  - blockchain
+url_template: "https://dlive.tv/{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: css
+    query: ".profile"
+
+not_found_selectors:
+  - type: regex
+    query: "not found"
+
+extractors: []
+
+require_headless: false
+rate_limit_per_second: 1.5
+enabled: true
+nsfw: false

moriarty/assets/modules/streaming/trovo.yaml

@@ -0,0 +1,25 @@
+site: trovo
+name: Trovo
+category:
+  - streaming
+tags:
+  - streaming
+url_template: "https://trovo.live/{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: css
+    query: ".profile"
+
+not_found_selectors:
+  - type: regex
+    query: "not found"
+
+extractors: []
+
+require_headless: false
+rate_limit_per_second: 1.5
+enabled: true
+nsfw: false

moriarty/assets/modules/travel/airbnb.yaml

@@ -0,0 +1,26 @@
+site: airbnb
+name: Airbnb
+category:
+  - travel
+tags:
+  - travel
+  - hosting
+url_template: "https://www.airbnb.com/users/show/{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: css
+    query: ".profile-header"
+
+not_found_selectors:
+  - type: regex
+    query: "not found"
+
+extractors: []
+
+require_headless: false
+rate_limit_per_second: 1.0
+enabled: true
+nsfw: false

moriarty/assets/modules/travel/booking.yaml

@@ -0,0 +1,26 @@
+site: booking
+name: Booking.com
+category:
+  - travel
+tags:
+  - travel
+  - hotels
+url_template: "https://www.booking.com/myprofile/{username}.html"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: css
+    query: ".profile"
+
+not_found_selectors:
+  - type: regex
+    query: "not found"
+
+extractors: []
+
+require_headless: false
+rate_limit_per_second: 1.0
+enabled: true
+nsfw: false

moriarty/assets/modules/travel/couchsurfing.yaml

@@ -0,0 +1,27 @@
+site: couchsurfing
+name: Couchsurfing
+category:
+  - travel
+  - social
+tags:
+  - travel
+  - hosting
+url_template: "https://www.couchsurfing.com/people/{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: css
+    query: ".profile-header"
+
+not_found_selectors:
+  - type: regex
+    query: "not found"
+
+extractors: []
+
+require_headless: false
+rate_limit_per_second: 1.5
+enabled: true
+nsfw: false

moriarty/assets/modules/travel/tripadvisor.yaml

@@ -0,0 +1,32 @@
+site: tripadvisor
+name: TripAdvisor
+category:
+  - travel
+  - reviews
+tags:
+  - travel
+  - reviews
+url_template: "https://www.tripadvisor.com/members/{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: css
+    query: ".memberProfile"
+
+not_found_selectors:
+  - type: regex
+    query: "not found"
+
+extractors:
+  - name: reviews
+    selector:
+      type: css
+      query: ".review-count"
+    required: false
+
+require_headless: false
+rate_limit_per_second: 1.0
+enabled: true
+nsfw: false

moriarty/assets/modules/tumblr.yaml

@@ -0,0 +1,40 @@
+site: tumblr
+name: Tumblr
+category:
+  - social
+  - blog
+tags:
+  - top20
+url_template: "https://{username}.tumblr.com"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: css
+    query: ".blog-title"
+  - type: css
+    query: "[data-blog-name]"
+
+not_found_selectors:
+  - type: regex
+    query: "There's nothing here"
+  - type: regex
+    query: "Whatever you were looking for doesn't currently exist"
+
+extractors:
+  - name: title
+    selector:
+      type: css
+      query: ".blog-title"
+    required: false
+  
+  - name: description
+    selector:
+      type: css
+      query: ".blog-description"
+    required: false
+
+require_headless: false
+rate_limit_per_second: 2.0
+enabled: true

moriarty/assets/modules/twitch.yaml

@@ -0,0 +1,48 @@
+site: twitch
+name: Twitch
+category:
+  - social
+  - gaming
+  - video
+tags:
+  - top20
+url_template: "https://www.twitch.tv/{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: regex
+    query: '"login":"[^"]+"'
+
+not_found_selectors:
+  - type: regex
+    query: "Sorry. Unless you've got a time machine"
+  - type: regex
+    query: "404"
+
+extractors:
+  - name: username
+    selector:
+      type: regex
+      query: '"login":"([^"]+)"'
+      group: 1
+    required: false
+  
+  - name: display_name
+    selector:
+      type: regex
+      query: '"displayName":"([^"]+)"'
+      group: 1
+    required: false
+  
+  - name: description
+    selector:
+      type: regex
+      query: '"description":"([^"]+)"'
+      group: 1
+    required: false
+
+require_headless: false
+rate_limit_per_second: 1.5
+enabled: true

moriarty/assets/modules/twitter.yaml

@@ -0,0 +1,39 @@
+site: twitter
+name: Twitter/X
+category:
+  - social
+tags:
+  - top20
+url_template: "https://twitter.com/{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: regex
+    query: '"screen_name":"[^"]+"'
+
+not_found_selectors:
+  - type: regex
+    query: "This account doesn't exist"
+  - type: regex
+    query: "Account suspended"
+
+extractors:
+  - name: screen_name
+    selector:
+      type: regex
+      query: '"screen_name":"([^"]+)"'
+      group: 1
+    required: false
+  
+  - name: name
+    selector:
+      type: regex
+      query: '"name":"([^"]+)"'
+      group: 1
+    required: false
+
+require_headless: true
+rate_limit_per_second: 1.0
+enabled: false

moriarty/assets/modules/youtube.yaml

@@ -0,0 +1,42 @@
+site: youtube
+name: YouTube
+category:
+  - social
+  - video
+tags:
+  - top20
+url_template: "https://www.youtube.com/@{username}"
+method: GET
+headers:
+  Accept: text/html
+
+exists_selectors:
+  - type: regex
+    query: '"channelId":"[^"]+"'
+  - type: regex
+    query: '"title":"[^"]+"'
+
+not_found_selectors:
+  - type: regex
+    query: "This page isn't available"
+  - type: regex
+    query: "404 Not Found"
+
+extractors:
+  - name: channel_id
+    selector:
+      type: regex
+      query: '"channelId":"([^"]+)"'
+      group: 1
+    required: false
+  
+  - name: title
+    selector:
+      type: regex
+      query: '"title":"([^"]+)"'
+      group: 1
+    required: false
+
+require_headless: false
+rate_limit_per_second: 2.0
+enabled: true

moriarty/assets/templates/cves/CVE-2017-5638.yaml

@@ -0,0 +1,27 @@
+id: cve-2017-5638
+
+info:
+  name: Apache Struts 2 Remote Code Execution (CVE-2017-5638)
+  author: moriarty
+  severity: critical
+  description: Detects Apache Struts installations exposing the S2-045 OGNL parser error pattern
+  tags: cve,struts,rce
+
+requests:
+  - method: GET
+    path:
+      - "/struts2-showcase/index.action"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "Struts Problem Report"
+          - "Struts2"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'ognl.OgnlException') or contains(body, 'No result defined for action')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2018-7600.yaml

@@ -0,0 +1,30 @@
+id: cve-2018-7600
+
+info:
+  name: Drupalgeddon2 Remote Code Execution (CVE-2018-7600)
+  author: moriarty
+  severity: critical
+  description: Detects Drupal instances vulnerable to Drupalgeddon2 via ajax request leakage
+  tags: cve,drupal,rce
+
+requests:
+  - method: POST
+    path:
+      - "/user/register?element_parents=account/mail/%23value&ajax_form=1"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "form_id=user_register_form&_drupal_ajax=1"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "form_build_id"
+          - "ajax_html"
+        condition: and
+      - type: dsl
+        dsl:
+          - "contains(body, 'drupal_settings')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2019-11510.yaml

@@ -0,0 +1,27 @@
+id: cve-2019-11510
+
+info:
+  name: Pulse Secure Arbitrary File Read (CVE-2019-11510)
+  author: moriarty
+  severity: critical
+  description: Detects Pulse Secure VPN appliances exposing the HTML5 gateway directory traversal flaw
+  tags: cve,pulse,vpn
+
+requests:
+  - method: GET
+    path:
+      - "/dana-na/../dana/html5acc/guacamole/"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Guacamole"
+          - "HTML5"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'Pulse Secure') or contains(header('Set-Cookie') or '', 'DSID')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2019-19781.yaml

@@ -0,0 +1,28 @@
+id: cve-2019-19781
+
+info:
+  name: Citrix ADC Directory Traversal (CVE-2019-19781)
+  author: moriarty
+  severity: critical
+  description: Detects Citrix ADC / Gateway vulnerable path traversal endpoint
+  tags: cve,citrix,traversal
+
+requests:
+  - method: GET
+    path:
+      - "/vpn/../vpns/portal/scripts/newbm.pl"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 403
+      - type: word
+        words:
+          - "ctx_id"
+          - "newbm.pl"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'Citrix') or contains(header('Set-Cookie') or '', 'NSC_')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2020-14882.yaml

@@ -0,0 +1,28 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Console Path Traversal (CVE-2020-14882)
+  author: moriarty
+  severity: critical
+  description: Detects Oracle WebLogic vulnerable console portal traversal chain
+  tags: cve,weblogic,traversal
+
+requests:
+  - method: GET
+    path:
+      - "/console/css/%252e%252e%252fconsole.portal"
+      - "/console/images/%252e%252e%252fconsole.portal"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Oracle WebLogic"
+          - "Console Portal"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'bea.portal.servlet.PortalServlet')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2020-14883.yaml

@@ -0,0 +1,29 @@
+id: cve-2020-14883
+
+info:
+  name: Oracle WebLogic Remote Command Execution (CVE-2020-14883)
+  author: moriarty
+  severity: critical
+  description: Detects Oracle WebLogic installations leaking diagnostic JSP portal via traversal
+  tags: cve,weblogic,rce
+
+requests:
+  - method: GET
+    path:
+      - "/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=HomePage1"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WebLogic Server"
+          - "PortalFramework"
+        condition: or
+      - type: word
+        part: body
+        words:
+          - 'class="loginMessage"'
+        condition: or
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2020-3452.yaml

@@ -0,0 +1,28 @@
+id: cve-2020-3452
+
+info:
+  name: Cisco ASA / FTD Web Services Read (CVE-2020-3452)
+  author: moriarty
+  severity: high
+  description: Detects vulnerable Cisco ASA/FTD devices exposing the translation-table path traversal
+  tags: cve,cisco,traversal
+
+requests:
+  - method: GET
+    path:
+      - "/+CSCOT+/translation-table?type=mst&textdomain=/%25../"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 404
+      - type: word
+        words:
+          - "<!DOCTYPE html>"
+          - "CSCOE"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'Cisco') or contains(header('Server') or '', 'CSA')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2020-5902.yaml

@@ -0,0 +1,28 @@
+id: cve-2020-5902
+
+info:
+  name: F5 BIG-IP TMUI RCE (CVE-2020-5902)
+  author: moriarty
+  severity: critical
+  description: Detects vulnerable F5 BIG-IP appliances exposing tmshCmd workspace endpoint
+  tags: cve,f5,rce
+
+requests:
+  - method: GET
+    path:
+      - "/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 401
+      - type: word
+        words:
+          - "tmshCmd.jsp"
+          - "F5 Networks"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'workspace/tmsh') or contains(body, 'REST API Error')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2021-21972.yaml

@@ -0,0 +1,31 @@
+id: cve-2021-21972
+
+info:
+  name: VMware vCenter UploadOVA RCE (CVE-2021-21972)
+  author: moriarty
+  severity: critical
+  description: Detects VMware vCenter vROPS plugin upload endpoint exposure
+  tags: cve,vmware,rce
+
+requests:
+  - method: POST
+    path:
+      - "/ui/vropspluginui/rest/services/uploadova"
+    headers:
+      Content-Type: "application/json"
+    body: "{}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 405
+          - 500
+      - type: word
+        part: header
+        words:
+          - "ALLOW"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'UploadFileServlet') or contains(body, 'java.lang.IllegalStateException')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2021-21985.yaml

@@ -0,0 +1,28 @@
+id: cve-2021-21985
+
+info:
+  name: VMware vCenter vSAN Plugin RCE (CVE-2021-21985)
+  author: moriarty
+  severity: critical
+  description: Detects VMware vCenter vSAN plugin unauthenticated proxy endpoint
+  tags: cve,vmware,rce
+
+requests:
+  - method: GET
+    path:
+      - "/ui/h5-vsan/rest/proxy/service/vmodlContext"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 500
+      - type: word
+        words:
+          - "vmodlContext"
+          - "vmware.vsan.client.services"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'Exception') or contains(body, 'java.lang')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2021-26084.yaml

@@ -0,0 +1,30 @@
+id: cve-2021-26084
+
+info:
+  name: Atlassian Confluence OGNL Injection (CVE-2021-26084)
+  author: moriarty
+  severity: critical
+  description: Detects Confluence endpoints susceptible to OGNL injection via template preview
+  tags: cve,confluence,rce
+
+requests:
+  - method: POST
+    path:
+      - "/pages/createpage-entervariables.action"
+    headers:
+      Content-Type: "application/x-www-form-urlencoded"
+    body: "queryString=bannerMessage\u003d%27%3Cscript%3E1%3C/script%3E&types=page"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "atlassian-editor"
+          - "ajs-message"
+        condition: or
+      - type: dsl
+        dsl:
+          - "contains(body, 'Confluence')"
+    stop-at-first-match: true

moriarty/assets/templates/cves/CVE-2021-41773.yaml

@@ -0,0 +1,25 @@
+id: cve-2021-41773
+
+info:
+  name: Apache HTTP Server Path Traversal (CVE-2021-41773)
+  author: moriarty
+  severity: high
+  description: Detects Apache HTTP Server 2.4.49 path traversal vulnerability
+  tags: cve,apache,traversal
+
+requests:
+  - method: GET
+    path:
+      - "/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:.*:0:0:"
+      - type: dsl
+        dsl:
+          - "not contains(body, '<html')"
+    stop-at-first-match: true