id: telerik-dialoghandler-detect

info:
  name: Detect Telerik Web UI Dialog Handler
  author: organiccrap,zhenwarx,nielsing
  severity: info
  description: This template detects the Telerik Web UI Dialog Handler.
  reference:
    - https://captmeelo.com/pentest/2018/08/03/pwning-with-telerik.html
    - https://github.com/bao7uo/dp_crypto
  metadata:
    max-request: 17
  tags: tech,telerik,asp,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    payloads:
      paths:
        - '/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/desktopmodules/telerikwebui/radeditorprovider/telerik.web.ui.dialoghandler.aspx?dp=1'
        - '/desktopmodules/dnnwerk.radeditorprovider/dialoghandler.aspx?dp=1'
        - '/DesktopModules/Admin/RadEditorProvider/DialogHandler.aspx?dp=1'
        - '/DesktopModule/UIQuestionControls/UIAskQuestion/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/Modules/CMS/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/Admin/ServerSide/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/DesktopModules/TNComments/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/Providers/HtmlEditorProviders/Telerik/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/App_Master/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/common/admin/PhotoGallery2/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/common/admin/Jobs2/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/AsiCommon/Controls/ContentManagement/ContentDesigner/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/common/admin/Calendar/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/cms/portlets/Telerik.Web.UI.DialogHandler.aspx?dp=1'
        - '/dashboard/UserControl/CMS/Page/Telerik.Web.UI.DialogHandler.aspx/Desktopmodules/Admin/dnnWerk.Users/DialogHandler.aspx?dp=1'
        - '/Telerik.Web.UI.DialogHandler.axd?dp=1'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - 'Invalid length for a Base-64 char array'
# digest: 490a0046304402207485e2d5e5b0b6c01c03c746540e96113c93e214bdb29fd4bb212bbd44f2125a02203a9b1f8cb5849f78e24073ac73702c22c56fd072f2d9f2f5c6de65cc0967014e:922c64590222798bb761d5b6d8e72950