# attack_profiles.conf:
# ---------------------
# [<profile-name>]
# description = short text describing the profile (mandatory)
# <service_name> = <ordered list of checks to run>


#########################################################################################
# Fast-scan
#########################################################################################
[fast-scan]
description = Perform only fast checks

ajp = 
    #nmap-recon, 
    tomcat-version, 
    cvedetails-lookup, 
    default-creds-tomcat, 
    deploy-webshell-tomcat

ftp = 
    #nmap-recon, 
    #ftpmap-scan, 
    cvedetails-lookup, 
    default-creds, 
    ftp-dirlisting

http = 
    #nmap-recon, 
    waf-detection, 
    fingerprinting-multi-whatweb, 
    fingerprinting-appserver, 
    webdav-detection-msf,
    fingerprinting-cms-cmseek,
    fingerprinting-drupal,
    fingerprinting-domino,
    crawling-fast,
    crawling-fast2,
    cvedetails-lookup,
    #ssl-check,
    #vulnscan-multi-nikto,
    default-creds-web-multi,
    default-creds-appserver,
    webdav-scan-davscan,
    webdav-internal-ip-disclosure,
    webdav-website-content,
    http-put-check,
    shellshock-scan,
    iis-shortname-scan,
    iis-internal-ip-disclosure,
    tomcat-user-enum,
    jboss-vulnscan-multi,
    jboss-status-infoleak,
    jenkins-infoleak,
    wordpress-vulnscan,
    #wordpress-vulnscan2,
    joomla-vulnscan,
    drupal-vulnscan,
    magento-vulnscan,
    silverstripe-vulnscan,
    vbulletin-vulnscan,
    liferay-vulnscan,
    angularjs-csti-scan,
    jquery-fileupload-rce-cve2018-9206,
    struts2-rce-cve2017-5638,
    struts2-rce-cve2017-9791,
    struts2-rce-cve2017-9805,
    struts2-rce-cve2018-11776,
    rails-rce-cve2019-5420,
    appserver-auth-bypass,
    tomcat-rce-cve2017-12617,
    jboss-misconfig-exploit,
    jboss-path-traversal-cve2014-7816,
    jboss-deserialize-cve2015-7501,
    jboss-jbossmq-deserialize-cve2017-7504,
    jboss-deserialize-cve2017-12149,
    glassfish-path-traversal-cve2017-1000028,
    jenkins-unauthenticated-console,
    jenkins-cli-deserialize-cve2015-8103,
    jenkins-groovy-xml-rce-cve2016-0792,
    jenkins-deserialize-cve2017-1000353,
    jenkins-rce-cve2018-1000861,
    weblogic-t3-open-jdbc-datasource,
    weblogic-t3-deserialize-cve2015-4852,
    weblogic-t3-deserialize-cve2016-3510,
    weblogic-t3-deserialize-cve2017-3248,
    weblogic-wls-wsat-cve2017-10271,
    weblogic-t3-deserialize-cve2018-2628,
    weblogic-t3-deserialize-cve2018-2893,
    weblogic-rce-cve2018-2894,
    weblogic-wls-wsat-cve2019-2725,
    weblogic-wls-wsat-cve2019-2729,
    websphere-deserialize-cve2015-7450,
    coldfusion-xxe-cve2009-3960,
    coldfusion-path-traversal-cve2010-2861,
    coldfusion-path-traversal-cve2013-3336,
    coldfusion-deserialize-cve2017-3066,
    iis-webdav-win2003-bof,
    drupal-sqli-drupalgeddon,
    drupal-rce-drupalgeddon2,
    drupal-rce-rest-cve2019-6340,
    joomla-comfields-sqli-rce,
    magento-22-sqli,
    cms-multi-exploits,
    appserver-postauth-deploy,
    wordpress-shell-upload

java-rmi = 
    nmap-recon,
    rmi-enum,
    jmx-info,
    jmx-auth-disabled,
    jmx-default-creds,
    exploit-rmi-default-config,
    exploit-jmx-insecure-config,
    exploit-jmx-auth-disabled,
    tomcat-jmxrmi-deserialize,
    rmi-deserialize-all-payloads,
    tomcat-jmxrmi-manager-creds

jdwp =
    #nmap-recon,
    jdwp-rce

mssql =
    #nmap-recon,
    mssqlinfo,
    cvedetails-lookup,
    default-creds,
    postauth-audit,
    postauth-rce-xpcmdshell

mysql =
    #nmap-recon,
    cvedetails-lookup,
    mysql-auth-bypass-cve2012-2122,
    default-creds,
    mysql-hashdump,
    mysql-interesting-tables-columns

oracle =
    tnscmd,
    sid-guessing,
    cvedetails-lookup,
    tnspoisoning,
    default-creds,
    postauth-audit,
    search-columns-passwords

postgresql =
    cvedetails-lookup,
    dbname-flag-injection-cve2013-1899,
    default-creds,
    postauth-rce-cve2019-9193

rdp =
    ms12-020-check,
    bluekeep-cve2019-0708-check

smb =
    #nmap-recon,
    anonymous-enum-smb,
    detect-ms17-010,
    samba-rce-cve2015-0240,
    exploit-rce-ms08-067,
    exploit-rce-ms17-010-eternalblue,
    exploit-sambacry-rce-cve2017-7494,
    auth-enum-smb,
    auth-shares-perm,
    smb-exec

smtp =
    smtp-cve,
    smtp-user-enum
    
snmp =
    default-community-strings,
    enumerate-info

ssh = 
    cvedetails-lookup,
    user-enum-timing-attack,
    user-enum-cve2018-15473,
    auth-bypass-libssh-cve2018-10933,
    default-ssh-key,
    default-creds

telnet = 
    #nmap-recon,
    default-creds

vnc = 
    #nmap-recon,
    default-creds


#########################################################################################
# Red-team
#########################################################################################
[red-team]
description = For red teaming when the goal is to detect "easy wins" on infrastructure

ajp = 
    #nmap-recon, 
    # tomcat-version, 
    # cvedetails-lookup, 
    default-creds-tomcat, 
    deploy-webshell-tomcat

ftp = 
    #nmap-recon, 
    # ftpmap-scan, 
    # cvedetails-lookup, 
    default-creds, 
    ftp-dirlisting

http = 
    #nmap-recon, 
    #waf-detection, 
    # fingerprinting-multi-whatweb, 
    fingerprinting-appserver, 
    # webdav-detection-msf,
    # fingerprinting-cms-cmseek,
    # fingerprinting-drupal,
    # fingerprinting-domino,
    # crawling-fast,
    # crawling-fast2,
    # cvedetails-lookup,
    #ssl-check,
    #vulnscan-multi-nikto,
    default-creds-web-multi,
    default-creds-appserver,
    # webdav-scan-davscan,
    # webdav-internal-ip-disclosure,
    # webdav-website-content,
    http-put-check,
    shellshock-scan,
    # iis-shortname-scan,
    # iis-internal-ip-disclosure,
    tomcat-user-enum,
    jboss-vulnscan-multi,
    # jboss-status-infoleak,
    # jenkins-infoleak,
    # wordpress-vulnscan,
    #wordpress-vulnscan2,
    # joomla-vulnscan,
    # drupal-vulnscan,
    # magento-vulnscan,
    # silverstripe-vulnscan,
    # vbulletin-vulnscan,
    # liferay-vulnscan,
    # angularjs-csti-scan,
    jquery-fileupload-rce-cve2018-9206,
    struts2-rce-cve2017-5638,
    struts2-rce-cve2017-9791,
    struts2-rce-cve2017-9805,
    struts2-rce-cve2018-11776,
    rails-rce-cve2019-5420,
    appserver-auth-bypass,
    tomcat-rce-cve2017-12617,
    jboss-misconfig-exploit,
    jboss-path-traversal-cve2014-7816,
    jboss-deserialize-cve2015-7501,
    jboss-jbossmq-deserialize-cve2017-7504,
    jboss-deserialize-cve2017-12149,
    glassfish-path-traversal-cve2017-1000028,
    jenkins-unauthenticated-console,
    jenkins-cli-deserialize-cve2015-8103,
    jenkins-groovy-xml-rce-cve2016-0792,
    jenkins-deserialize-cve2017-1000353,
    jenkins-rce-cve2018-1000861,
    weblogic-t3-open-jdbc-datasource,
    weblogic-t3-deserialize-cve2015-4852,
    weblogic-t3-deserialize-cve2016-3510,
    weblogic-t3-deserialize-cve2017-3248,
    weblogic-wls-wsat-cve2017-10271,
    weblogic-t3-deserialize-cve2018-2628,
    weblogic-t3-deserialize-cve2018-2893,
    weblogic-rce-cve2018-2894,
    weblogic-wls-wsat-cve2019-2725,
    weblogic-wls-wsat-cve2019-2729,
    websphere-deserialize-cve2015-7450,
    coldfusion-xxe-cve2009-3960,
    coldfusion-path-traversal-cve2010-2861,
    coldfusion-path-traversal-cve2013-3336,
    coldfusion-deserialize-cve2017-3066,
    iis-webdav-win2003-bof,
    drupal-sqli-drupalgeddon,
    drupal-rce-drupalgeddon2,
    drupal-rce-rest-cve2019-6340,
    joomla-comfields-sqli-rce,
    magento-22-sqli,
    cms-multi-exploits,
    bruteforce-appserver,
#     drupal-sqli-drupalgeddon,
#     drupal-rce-drupalgeddon2,
#     drupal-rce-rest-cve2019-6340,
#     joomla-comfields-sqli-rce,
    appserver-postauth-deploy
#     wordpress-shell-upload

java-rmi = 
    nmap-recon,
    rmi-enum,
    jmx-info,
    jmx-auth-disabled,
    jmx-default-creds,
    exploit-rmi-default-config,
    exploit-jmx-insecure-config,
    exploit-jmx-auth-disabled,
    tomcat-jmxrmi-deserialize,
    rmi-deserialize-all-payloads,
    tomcat-jmxrmi-manager-creds

jdwp =
    #nmap-recon,
    jdwp-rce

mssql =
    #nmap-recon,
    #mssqlinfo,
    #cvedetails-lookup,
    default-creds,
    postauth-audit,
    postauth-rce-xpcmdshell

mysql =
    #nmap-recon,
    #cvedetails-lookup,
    mysql-auth-bypass-cve2012-2122,
    default-creds,
    mysql-hashdump,
    mysql-interesting-tables-columns

oracle =
    tnscmd,
    sid-guessing,
    #cvedetails-lookup,
    #tnspoisoning,
    default-creds,
    postauth-audit,
    search-columns-passwords

postgresql =
    #cvedetails-lookup,
    default-creds

rdp =
    ms12-020-check,
    bluekeep-cve2019-0708-check

smb =
    #nmap-recon,
    #anonymous-enum-smb,
    detect-ms17-010,
    samba-rce-cve2015-0240,
    exploit-rce-ms08-067,
    exploit-rce-ms17-010-eternalblue,
    exploit-sambacry-rce-cve2017-7494,
    auth-enum-smb,
    auth-shares-perm,
    smb-exec

smtp =
    smtp-cve,
    smtp-user-enum
    
snmp =
    default-community-strings,
    enumerate-info

ssh = 
    #cvedetails-lookup,
    user-enum-timing-attack,
    user-enum-cve2018-15473,
    auth-bypass-libssh-cve2018-10933,
    default-ssh-key,
    default-creds

telnet = 
    #nmap-recon,
    default-creds

vnc = 
    #nmap-recon,
    default-creds


#########################################################################################
# Web Server Scan
#########################################################################################
[web-server-scan]
description = Perform checks on web/app servers only

http = 
    fingerprinting-appserver,
    default-creds-web-multi,
    default-creds-appserver,
    webdav-scan-davscan,
    webdav-internal-ip-disclosure,
    webdav-website-content,
    iis-shortname-scan,
    tomcat-user-enum,
    jboss-vulnscan-multi,
    jboss-status-infoleak,
    jenkins-infoleak,
    rails-rce-cve2019-5420,
    appserver-auth-bypass,
    tomcat-rce-cve2017-12617,
    jboss-misconfig-exploit,
    jboss-path-traversal-cve2014-7816,
    jboss-deserialize-cve2015-7501,
    jboss-jbossmq-deserialize-cve2017-7504,
    jboss-deserialize-cve2017-12149,
    glassfish-path-traversal-cve2017-1000028,
    jenkins-unauthenticated-console,
    jenkins-cli-deserialize-cve2015-8103,
    jenkins-cli-deserialize2-cve2015-8103,
    jenkins-groovy-xml-rce-cve2016-0792,
    jenkins-deserialize-cve2017-1000353,
    jenkins-rce-cve2018-1000861,
    weblogic-t3-open-jdbc-datasource,
    weblogic-t3-deserialize-cve2015-4852,
    weblogic-t3-deserialize-cve2016-3510,
    weblogic-t3-deserialize-cve2017-3248,
    weblogic-wls-wsat-cve2017-10271,
    weblogic-t3-deserialize-cve2018-2628,
    weblogic-t3-deserialize-cve2018-2893,
    weblogic-rce-cve2018-2894,
    weblogic-wls-wsat-cve2019-2725,
    weblogic-wls-wsat-cve2019-2729,
    websphere-deserialize-cve2015-7450,
    coldfusion-xxe-cve2009-3960,
    coldfusion-path-traversal-cve2010-2861,
    coldfusion-path-traversal-cve2013-3336,
    coldfusion-deserialize-cve2017-3066,
    iis-webdav-win2003-bof,
    bruteforce-appserver,
    bruteforce-domino,
    appserver-postauth-deploy

#########################################################################################
# Web CMS Scan
#########################################################################################
[web-cms-scan]
description = Perform checks on web CMS only

http =
    fingerprinting-multi-wig,
    fingerprinting-cms-cmseek,
    fingerprinting-cms-fingerprinter,
    fingerprinting-drupal,
    fingerprinting-domino,
    cms-multi-vulnscan-cmsmap,
    wordpress-vulnscan,
    wordpress-vulnscan2,
    joomla-vulnscan,
    joomla-vulnscan2,
    joomla-vulnscan3,
    drupal-vulnscan,
    magento-vulnscan,
    silverstripe-vulnscan,
    vbulletin-vulnscan,
    liferay-vulnscan,
    drupal-sqli-drupalgeddon,
    drupal-rce-drupalgeddon2,
    drupal-rce-rest-cve2019-6340,
    joomla-comfields-sqli-rce,
    magento-22-sqli,
    cms-multi-exploits,
    bruteforce-wordpress,
    bruteforce-joomla,
    bruteforce-drupal,
    bruteforce-opencart,
    bruteforce-magento,
    wordpress-shell-upload



