smtp-credentials-exposure: SMTP Credentials Exposure - Detection

id: smtp-credentials-exposure

info:
  name: SMTP Credentials Exposure - Detection
  author: pussycat0x
  severity: high
  description: |
    Detects exposed SMTP credentials (username and password) in a webpage's HTML or JavaScript source code.
  metadata:
    verified: true
    shodan-query: html:"smtp_password"
    max-request: 1
  tags: exposure,smtp,config,credentials,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, "smtp_username","smtp_password")
          - status_code == 200
        condition: and

    extractors:
      - type: regex
        part: body
        name: username
        group: 1
        regex:
          - smtp_username":"(.*?)"
          - <smtp_username>(.*)</smtp_username>
        internal: true

      - type: regex
        part: body
        name: password
        group: 1
        regex:
          - smtp_password":"(.*?)"
          - <smtp_password>(.*)</smtp_password>
        internal: true

      - type: dsl
        dsl:
          - '"Username: "+ username'
          - '"PASSWORD: "+ password'
# digest: 4a0a00473045022008a9cbbfba1896423a064de23c8b0e385c2d8dabd4c11bee662fe0ac33b5f072022100f09a197bab75ed3dd4f0f0ca80af0da422ddc9883f47d25efb83bcd23ff2619b:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.