nuclei-templates/network/detection/weblogic-t3-detect.yaml

id: weblogic-t3-detect

info:
  name: Weblogic T3 Protocol Detection
  author: F1tz,milo2012,wdahlenb
  severity: info
  description: |
    T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.
  metadata:
    max-request: 2
  tags: network,weblogic,detect
tcp:
  - inputs:
      - data: "t3 12.2.1

          AS:255

          HL:19

          MS:10000000

          PU:t3://us-l-breens:7001

          \n"
    host:
      - "{{Hostname}}"
    read-size: 1024
    matchers:
      - type: word
        words:
          - "HELO"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "HELO:(.*).false"

  - inputs:
      - data: "t3s 12.2.1

          AS:255

          HL:19

          MS:10000000

          PU:t3://us-l-breens:7001

          \n"
    host:
      - "tls://{{Hostname}}"
    read-size: 1024
    matchers:
      - type: word
        words:
          - "HELO"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "HELO:(.*).false"
more network templates 2021-04-30 15:54:53 +00:00			`id: weblogic-t3-detect`

			`info:`
Update weblogic-t3-detect.yaml 2022-09-20 07:43:50 +00:00			`name: Weblogic T3 Protocol Detection`
Detect T3s protocol for Weblogic 2021-07-06 18:02:14 +00:00			`author: F1tz,milo2012,wdahlenb`
more network templates 2021-04-30 15:54:53 +00:00			`severity: info`
Update weblogic-t3-detect.yaml 2022-08-16 16:23:54 +00:00			`description: \|`
			`T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 2`
templateman update 2023-10-14 11:27:55 +00:00			`tags: network,weblogic,detect`
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`tcp:`
more network templates 2021-04-30 15:54:53 +00:00			`- inputs:`
templateman update 2023-10-14 11:27:55 +00:00			`- data: "t3 12.2.1`

			`AS:255`

			`HL:19`

			`MS:10000000`

			`PU:t3://us-l-breens:7001`

			`\n"`
more network templates 2021-04-30 15:54:53 +00:00			`host:`
			`- "{{Hostname}}"`
misc changes 2021-04-30 16:04:18 +00:00			`read-size: 1024`
more network templates 2021-04-30 15:54:53 +00:00			`matchers:`
			`- type: word`
			`words:`
Added version extractors 2021-06-24 16:43:10 +00:00			`- "HELO"`
templateman update 2023-10-14 11:27:55 +00:00
Detect T3s protocol for Weblogic 2021-07-06 18:02:14 +00:00			`extractors:`
			`- type: regex`
			`part: body`
			`group: 1`
			`regex:`
			`- "HELO:(.*).false"`
Added version extractors 2021-06-24 16:43:10 +00:00
Detect T3s protocol for Weblogic 2021-07-06 18:02:14 +00:00			`- inputs:`
templateman update 2023-10-14 11:27:55 +00:00			`- data: "t3s 12.2.1`

			`AS:255`

			`HL:19`

			`MS:10000000`

			`PU:t3://us-l-breens:7001`

			`\n"`
Detect T3s protocol for Weblogic 2021-07-06 18:02:14 +00:00			`host:`
			`- "tls://{{Hostname}}"`
			`read-size: 1024`
			`matchers:`
			`- type: word`
			`words:`
			`- "HELO"`
templateman update 2023-10-14 11:27:55 +00:00
Added version extractors 2021-06-24 16:43:10 +00:00			`extractors:`
			`- type: regex`
			`part: body`
			`group: 1`
			`regex:`
Detect T3s protocol for Weblogic 2021-07-06 18:02:14 +00:00			`- "HELO:(.*).false"`