Exposed Internal PKI Infrastructure Detection nuclei template

exposed-pki-infrastructure.yaml

id: exposed-pki-infrastructure
info:
  name: Exposed Internal PKI Infrastructure Detection
  author: nullenc0de
  severity: critical
  description: Detects exposed internal PKI infrastructure including CRL distribution points and OCSP responders
  tags: pki,exposure,misconfig

requests:
  - method: GET
    path:
      - "{{BaseURL}}/certsrv/"
      - "{{BaseURL}}/pki/"
      - "{{BaseURL}}/crl/"
      - "{{BaseURL}}/.well-known/pki-validation/"
      - "{{BaseURL}}/ocsp/"
      - "{{BaseURL}}/CertEnroll/"
      - "{{BaseURL}}/CertSrv/"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "Microsoft-IIS/10.0"
          - "certsrv"
          - "Certificate Services"
          - "Microsoft CA"
          - "Certificate Authority"
          - "CRL Distribution Point"
          - "OCSP Responder"
        condition: or

      - type: status
        status:
          - 200
          - 401
          - 403

      - type: regex
        regex:
          - "CN=[A-Za-z0-9-]+-CA"
          - "\.crl$"
          - "\.cer$"
          - "\.p7b$"

    extractors:
      - type: regex
        name: certificate_details
        regex:
          - "CN=[A-Za-z0-9-]+-CA"
          - "O=[A-Za-z0-9 ]+"
          - "OU=[A-Za-z0-9 ]+"

    Stop-If-Match: true

http:
  - max-redirects: 2
  - follow-redirects: true
  - tls-verification: false