2023-07-18 09:01:33 +00:00
id : spnego-detect
2023-07-13 05:17:51 +00:00
info :
name : SPNEGO - Detect
author : lady_bug,ruppde
severity : info
description : |
SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. It is a protocol used for secure authentication and negotiation between client and server applications in a network environment. SPNEGO is based on the Generic Security Services Application Programming Interface (GSSAPI) framework.
reference :
- https://www.ibm.com/docs/en/was-liberty/core?topic=authentication-single-sign-http-requests-using-spnego-web
- https://arstechnica.com/information-technology/2022/12/critical-windows-code-execution-vulnerability-went-undetected-until-now/
metadata :
2023-10-14 11:27:55 +00:00
verified : true
2023-07-13 05:47:57 +00:00
max-request : 1
2023-07-13 05:17:51 +00:00
shodan-query: 'www-authenticate : negotiate'
tags : misc,windows,spnego
http :
- method : GET
path :
- "{{BaseURL}}"
host-redirects : true
max-redirects : 5
2023-10-14 11:27:55 +00:00
2023-07-13 05:17:51 +00:00
matchers-condition : and
matchers :
- type : dsl
dsl :
2023-07-18 09:20:20 +00:00
- "contains(tolower(header), 'www-authenticate: negotiate')"
2023-07-13 05:17:51 +00:00
extractors :
- type : kval
kval :
2023-07-13 05:42:02 +00:00
- 'www_authenticate'
2023-10-20 11:41:13 +00:00
# digest: 4a0a00473045022100b7c13e68fa1e466cd979e720d51e7a5a0fdbc0a1db4a335b2e5f11046cc107e002207381d614ec3e8a201b0f353fade2c89f4511f9b7e0d2a98f2eb7f10eb66cdbad:922c64590222798bb761d5b6d8e72950
