⚠️ Overview

Riddler is an automated reconnaissance and vulnerability scanning tool first documented by security researchers in 2018, primarily used by threat actors for pre‑attack surveying of web applications. Its development is attributed to unknown actors operating through public GitHub repositories and underground forums, where it is distributed as a Python‑based modular framework. The tool’s name derives from its ability to “riddle” targets with probing requests, and it is frequently observed in attack chains targeting content management systems and enterprise portals.

🔧 Technical Capabilities

Riddler performs multi‑stage reconnaissance including subdomain enumeration, directory brute‑forcing, and version fingerprinting of web servers and applications. It is equipped with plugins for detecting common vulnerabilities such as reflected and stored cross‑site scripting (XSS), SQL injection, local file inclusion (LFI), and insecure deserialization. The tool uses a configurable User‑Agent string (default Riddler/1.0) and can randomise HTTP headers to evade signature‑based detection. It also implements a threading model to launch thousands of requests per minute, making it effective for large‑scale scans. Riddler integrates with external APIs (e.g., Shodan, Censys) to gather additional intelligence about target infrastructure before launching attacks. Its modular design allows operators to load custom exploit scripts, including those targeting recent CVEs such as CVE‑2021‑44228 (Log4j) and CVE‑2023‑46604 (Apache ActiveMQ).

📜 History & Notable Incidents

First observed in threat logs from early 2018, Riddler was initially associated with automated scans against WordPress and Joomla installations. In mid‑2020, a surge of Riddler traffic was reported by several Content Delivery Networks (CDNs) targeting enterprise VPN gateways, specifically looking for CVE‑2019‑11510 (Pulse Secure). By 2022, analysts at Sucuri and Imperva linked Riddler to a series of credential‑stuffing campaigns against e‑commerce platforms, where the tool extracted login pages and tested leaked username/password pairs. The tool’s source code remains partially public on GitHub under the repository 0xRiddler/riddler, though the original maintainer has since deleted the account, leaving only forked copies.

🔍 Detection Indicators

The primary detection indicator is the User‑Agent string Riddler/1.0 or variations like Mozilla/5.0 Riddler/1.0. Behaviourally, Riddler exhibits a rapid succession of GET requests to common paths such as /admin, /wp-admin, /.env, and /index.php?page= within seconds. It often sends non‑standard HTTP headers (e.g., X‑Riddler: scan) and omits the Accept‑Encoding header, causing responses to be uncompressed. Logs show repeated 403 and 404 responses followed by parameter‑fuzzing patterns, especially for PHP extensions. Network signatures include bursts of traffic from a single IP with low time‑to‑live values and inconsistent TLS fingerprints.

☠️ Risk & Impact

Successful exploitation by Riddler can lead to complete compromise of web applications through data exfiltration (e.g., database credentials, API keys), remote code execution, and lateral movement into internal networks. The tool’s reconnaissance phase exposes attack surfaces that enable further targeted attacks, including ransomware deployment or web shell installation. In credential‑stuffing scenarios, it can cause account takeover and financial fraud, as documented in incident reports from 2021 targeting a large US retailer.

🛡️ Mitigation

Riddler is blocked immediately on detection because its automated probing is a precursor to high‑impact attacks and its traffic patterns are not generated by legitimate search engines or users. Implementing Web Application Firewall (WAF) rules to deny requests containing the Riddler User‑Agent, coupled with rate‑limiting on directory‑brute‑force endpoints, effectively neutralises this threat without affecting normal operations.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.