2023-07-18 09:01:33 +00:00
id : spnego-detect
2023-07-13 05:17:51 +00:00
info :
name : SPNEGO - Detect
author : lady_bug,ruppde
severity : info
description : |
SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. It is a protocol used for secure authentication and negotiation between client and server applications in a network environment. SPNEGO is based on the Generic Security Services Application Programming Interface (GSSAPI) framework.
reference :
- https://www.ibm.com/docs/en/was-liberty/core?topic=authentication-single-sign-http-requests-using-spnego-web
- https://arstechnica.com/information-technology/2022/12/critical-windows-code-execution-vulnerability-went-undetected-until-now/
metadata :
2023-10-14 11:27:55 +00:00
verified : true
2023-07-13 05:47:57 +00:00
max-request : 1
2023-07-13 05:17:51 +00:00
shodan-query: 'www-authenticate : negotiate'
2024-01-14 09:21:50 +00:00
tags : miscellaneous,misc,windows,spnego
2023-07-13 05:17:51 +00:00
http :
- method : GET
path :
- "{{BaseURL}}"
host-redirects : true
max-redirects : 5
2023-10-14 11:27:55 +00:00
2023-07-13 05:17:51 +00:00
matchers-condition : and
matchers :
- type : dsl
dsl :
2023-07-18 09:20:20 +00:00
- "contains(tolower(header), 'www-authenticate: negotiate')"
2023-07-13 05:17:51 +00:00
extractors :
- type : kval
kval :
2023-07-13 05:42:02 +00:00
- 'www_authenticate'
2024-01-26 08:31:11 +00:00
# digest: 4a0a00473045022100970ed01cba35a0bf36ab7ceb44e40d425659f959dc3a32c77e1f17437590839a02205dfd663ceb1e61851a9569c5b057040a7b4850507a44278d3f1414485a865f27:922c64590222798bb761d5b6d8e72950
