{"vulnerability": "CVE-2013-5211", "sightings": [{"uuid": "b2fc6783-04f1-457f-82de-ec6f049ae649", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "MISP/5b06d57d-f2b8-4357-9038-45d39f590eb0", "content": "", "creation_timestamp": "2018-05-24T15:44:33.000000Z"}, {"uuid": "4d5ab8a4-1a40-4877-b24b-f2ea32a6f333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-02", "content": "", "creation_timestamp": "2024-12-17T11:00:00.000000Z"}, {"uuid": "ce688f1b-3e3a-4db1-81fc-1d6b237443ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:41.000000Z"}, {"uuid": "dd8a68a7-a2e9-4423-a398-5b9359e1da5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:22.000000Z"}, {"uuid": "32a05151-1373-4322-897b-d25786dce2dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "a49269a8-82bd-484c-9879-4f20565c28fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "5fcaf253-66d9-4906-a2fd-5d1ac9a8eb06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_monlist.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "039136ab-2482-434f-89ad-e0d83d18c615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/upnp/ssdp_amp.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "d047bb4f-c18b-417d-8c24-06a622c82674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "179c35af-e85d-4331-9684-503fa71bdc61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "28ae5f47-b132-4b4e-a6c4-38a6293087f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/portmap/portmap_amp.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "d23f7d17-38e7-4453-9298-b430bf13ffe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/udp/udp_amplification.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "324d1b52-f10f-415b-b997-30b03ca15c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_readvar.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "e037a377-02d1-400c-bfed-61c5569d06af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "05b6c4da-606e-44e2-9c09-0e3dc8afbd32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://t.me/eXCe_Fixxed/109130", "content": "# DD0S CVE List by Layer 3/4/7\n\n##  Layer 3 (Network) - ICMP, IP, NDP\n\n# 2020\n- CVE-2020-16898  > Windows TCP/IP \"Bad Neighbor\" - ICMPv6 ping of death (DoS via BSOD)\n\n##  Layer 4 (Transport) - TCP, UDP\n\n# 2013\n- CVE-2013-5211  > NTP Amplification Attack via 'monlist' (UDP-based)\n\n# 2016\n- CVE-2016-9244  > Cisco VPN IKEv1 flood (UDP port 500 DoS)\n\n# 2018\n- CVE-2018-1000115  > Memcached UDP Amplification (reflection attack)\n\n# 2018\n- CVE-2018-0171  > Cisco Smart Install DoS (TCP port 4786)\n\n##  Layer 7 (Application) - HTTP, NTP, Memcached, API\n\n# 2021\n- CVE-2021-22986  > F5 BIG-IP iControl REST unauth DoS/RCE (API abuse)\n\n# 2023\n- CVE-2023-44487  > HTTP/2 Rapid Reset Attack - stream reset flooding\n\n# 2024\n- CVE-2024-29269  > Telesquare LTE Router Cmd Injection (dapat digunakan untuk DoS chaining) {New Cve Bug}", "creation_timestamp": "2025-08-03T06:11:01.000000Z"}, {"uuid": "b346bf71-49fd-46be-b20e-80f9bd8bc6ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://t.me/eXCe_Fixxed/502", "content": "# DD0S CVE List by Layer 3/4/7\n\n##  Layer 3 (Network) - ICMP, IP, NDP\n\n# 2020\n- CVE-2020-16898  > Windows TCP/IP \"Bad Neighbor\" - ICMPv6 ping of death (DoS via BSOD)\n\n##  Layer 4 (Transport) - TCP, UDP\n\n# 2013\n- CVE-2013-5211  > NTP Amplification Attack via 'monlist' (UDP-based)\n\n# 2016\n- CVE-2016-9244  > Cisco VPN IKEv1 flood (UDP port 500 DoS)\n\n# 2018\n- CVE-2018-1000115  > Memcached UDP Amplification (reflection attack)\n\n# 2018\n- CVE-2018-0171  > Cisco Smart Install DoS (TCP port 4786)\n\n##  Layer 7 (Application) - HTTP, NTP, Memcached, API\n\n# 2021\n- CVE-2021-22986  > F5 BIG-IP iControl REST unauth DoS/RCE (API abuse)\n\n# 2023\n- CVE-2023-44487  > HTTP/2 Rapid Reset Attack - stream reset flooding\n\n# 2024\n- CVE-2024-29269  > Telesquare LTE Router Cmd Injection (dapat digunakan untuk DoS chaining) {New Cve Bug}", "creation_timestamp": "2025-08-03T06:11:01.000000Z"}, {"uuid": "6c6344ef-401f-48fd-9790-5f4423a6b214", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c71f80be-c80f-4630-8434-fd78080d6131", "content": "", "creation_timestamp": "2026-06-19T16:45:35.828917Z"}, {"uuid": "f5b36837-da73-40d5-a688-a486c913e169", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/71d4d962-6395-4387-9de4-55f7607ed449", "content": "", "creation_timestamp": "2026-06-23T14:04:08.092624Z"}, {"uuid": "16735d9a-d38c-4bec-9fab-5299d11c0680", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3muwlohukka2v", "content": "\ud83d\udd17 CVE : CVE-2013-5211, CVE-2016-9042, CVE-2016-9310, CVE-2017-6451, CVE-2017-6452, CVE-2017-6455, CVE-2017-6458, CVE-2017-6459, CVE-2017-6460, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464", "creation_timestamp": "2026-09-07T13:15:19.518698Z"}, {"uuid": "8c304d9b-2bdd-4373-a75f-92c9039a1a16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_monlist.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"hdm \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module identifies NTP servers which permit \\\"monlist\\\" queries and\\n        obtains the recent clients list. The monlist feature allows remote\\n        attackers to cause a denial of service (traffic amplification)\\n        via spoofed requests. The more clients there are in the list, the\\n        greater the amplification.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/ntp/ntp_monlist\", \"is_install_path\": true, \"mod_time\": \"2025-06-20 13:20:44 +0000\", \"name\": \"NTP Monitor List Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ntp/ntp_monlist.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ntp/ntp_monlist\", \"references\": [\"CVE-2013-5211\", \"URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-013A\", \"URL-https://support.ntp.org/bin/view/Main/SecurityNotice\", \"URL-https://nmap.org/nsedoc/scripts/ntp-monlist.html\"], \"rport\": 123, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:02.227299Z"}, {"uuid": "bfb66ab6-40a3-4a69-83a2-f2941e192ae0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module identifies NTP servers which permit \\\"PEER_LIST\\\" queries and\\n        return responses that are larger in size or greater in quantity than\\n        the request, allowing remote attackers to cause a distributed, reflected\\n        denial of service (aka, \\\"DRDoS\\\" or traffic amplification) via spoofed\\n        requests.\", \"disclosure_date\": \"2014-08-25\", \"fullname\": \"auxiliary/scanner/ntp/ntp_peer_list_dos\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"NTP Mode 7 PEER_LIST DoS Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ntp/ntp_peer_list_dos\", \"references\": [\"CVE-2013-5211\", \"URL-https://github.com/rapid7/metasploit-framework/pull/3696\", \"URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/\"], \"rport\": 123, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:02.447530Z"}, {"uuid": "780b5055-457a-43f1-a077-2e51389d9df0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_readvar.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Ewerson Guimaraes(Crash) \", \"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module reads the system internal NTP variables. These variables contain\\n          potentially sensitive information, such as the NTP software version, operating\\n          system version, peers, and more.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/ntp/ntp_readvar\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"NTP Clock Variables Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/scanner/ntp/ntp_readvar.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ntp/ntp_readvar\", \"references\": [\"CVE-2013-5211\", \"URL-https://www.rapid7.com/db/vulnerabilities/ntp-clock-variables-disclosure/\"], \"rport\": 123, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:02.639189Z"}, {"uuid": "7d7a92b3-c56b-4ae7-9254-30be81ff4b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module identifies NTP servers which permit mode 6 UNSETTRAP requests that\\n        can be used to conduct DRDoS attacks.  In some configurations, NTP servers will\\n        respond to UNSETTRAP requests with multiple packets, allowing remote attackers\\n        to cause a distributed, reflected denial of service (aka, \\\"DRDoS\\\" or traffic\\n        amplification) via spoofed requests.\", \"disclosure_date\": \"2014-08-25\", \"fullname\": \"auxiliary/scanner/ntp/ntp_unsettrap_dos\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"NTP Mode 6 UNSETTRAP DRDoS Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ntp/ntp_unsettrap_dos\", \"references\": [\"CVE-2013-5211\", \"URL-https://github.com/rapid7/metasploit-framework/pull/3696\", \"URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/\"], \"rport\": 123, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:02.915139Z"}, {"uuid": "6ab24b0a-89b6-4b2c-9b2d-945c5c1e180e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module identifies NTP servers which permit \\\"PEER_LIST_SUM\\\" queries and\\n        return responses that are larger in size or greater in quantity than\\n        the request, allowing remote attackers to cause a distributed, reflected\\n        denial of service (aka, \\\"DRDoS\\\" or traffic amplification) via spoofed\\n        requests.\", \"disclosure_date\": \"2014-08-25\", \"fullname\": \"auxiliary/scanner/ntp/ntp_peer_list_sum_dos\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"NTP Mode 7 PEER_LIST_SUM DoS Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ntp/ntp_peer_list_sum_dos\", \"references\": [\"CVE-2013-5211\", \"URL-https://github.com/rapid7/metasploit-framework/pull/3696\", \"URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/\"], \"rport\": 123, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:02.542889Z"}, {"uuid": "860b5b6b-d9fe-4da5-ac43-87d383327652", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module identifies NTP servers which permit mode 6 REQ_NONCE requests that\\n        can be used to conduct DRDoS attacks. In some configurations, NTP servers will\\n        respond to REQ_NONCE requests with a response larger than the request,\\n        allowing remote attackers to cause a distributed, reflected\\n        denial of service (aka, \\\"DRDoS\\\" or traffic amplification) via spoofed\\n        requests.\", \"disclosure_date\": \"2014-08-25\", \"fullname\": \"auxiliary/scanner/ntp/ntp_req_nonce_dos\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"NTP Mode 6 REQ_NONCE DRDoS Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ntp/ntp_req_nonce_dos\", \"references\": [\"CVE-2013-5211\", \"URL-https://github.com/rapid7/metasploit-framework/pull/3696\", \"URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/\"], \"rport\": 123, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:02.731785Z"}, {"uuid": "577acd86-fce2-4a7f-a941-bbcfaa2bc3a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module identifies NTP servers which permit \\\"reslist\\\" queries and\\n        obtains the list of restrictions placed on various network interfaces,\\n        networks or hosts. The reslist feature allows remote\\n        attackers to cause a distributed, reflected denial of service (aka, \\\"DRDoS\\\" or\\n        traffic amplification) via spoofed requests. The more interfaces, networks\\n        or hosts with specific restrictions, the greater the amplification.\\n        requests.\", \"disclosure_date\": \"2014-08-25\", \"fullname\": \"auxiliary/scanner/ntp/ntp_reslist_dos\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"NTP Mode 7 GET_RESTRICT DRDoS Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ntp/ntp_reslist_dos\", \"references\": [\"CVE-2013-5211\", \"URL-https://github.com/rapid7/metasploit-framework/pull/3696\", \"URL-https://www.rapid7.com/blog/post/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks/\"], \"rport\": 123, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:02.818197Z"}, {"uuid": "d05f2409-b774-47ea-bf87-f897fbdb13ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/portmap/portmap_amp.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"xistence \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module can be used to discover Portmapper services which can be used in an\\n        amplification DDoS attack against a third party.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/portmap/portmap_amp\", \"is_install_path\": true, \"mod_time\": \"2025-06-20 13:20:44 +0000\", \"name\": \"Portmapper Amplification Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/portmap/portmap_amp.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/portmap/portmap_amp\", \"references\": [\"CVE-2013-5211\", \"URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-017A\", \"URL-http://blog.level3.com/security/a-new-ddos-reflection-attack-portmapper-an-early-warning-to-the-industry/\"], \"rport\": 111, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:03.304932Z"}, {"uuid": "432b4db7-01fc-4a7b-9663-8b79c225a0c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/udp/udp_amplification.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Detect UDP endpoints with UDP amplification vulnerabilities\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/udp/udp_amplification\", \"is_install_path\": true, \"mod_time\": \"2025-06-20 13:20:44 +0000\", \"name\": \"UDP Amplification Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/udp/udp_amplification.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/udp/udp_amplification\", \"references\": [\"CVE-2013-5211\", \"URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-017A\"], \"rport\": null, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:11.082837Z"}, {"uuid": "d3936d9e-46ea-4d61-ad0a-d1048aae228d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-5211", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/upnp/ssdp_amp.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"xistence \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Discover SSDP amplification possibilities\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/upnp/ssdp_amp\", \"is_install_path\": true, \"mod_time\": \"2025-06-20 13:20:44 +0000\", \"name\": \"SSDP ssdp:all M-SEARCH Amplification Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/upnp/ssdp_amp.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/upnp/ssdp_amp\", \"references\": [\"CVE-2013-5211\", \"URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-017A\"], \"rport\": 1900, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:11.181964Z"}]}