2021-05-06 19:44:19 +00:00
|
|
|
id: darkstat-detect
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Detect Darkstat Reports
|
|
|
|
|
author: geeknik
|
|
|
|
|
description: Darkstat captures network traffic, calculates statistics about usage, and serves reports over HTTP
|
|
|
|
|
reference: https://unix4lyfe.org/darkstat/
|
|
|
|
|
severity: high
|
2021-05-07 20:11:36 +00:00
|
|
|
tags: darkstat,logs,exposure
|
2021-05-06 19:44:19 +00:00
|
|
|
|
|
|
|
|
requests:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}"
|
|
|
|
|
- "{{BaseURL}}/darkstat/"
|
|
|
|
|
# FYI, the default port for darkstat is 666
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: regex
|
|
|
|
|
part: header
|
|
|
|
|
regex:
|
|
|
|
|
- "[Ss]erver: darkstat.*"
|
|
|
|
|
- type: word
|
|
|
|
|
part: body
|
|
|
|
|
words:
|
|
|
|
|
- "darkstat"
|
|
|
|
|
- "<title>Graphs"
|
|
|
|
|
- "Measuring for"
|
|
|
|
|
- "hosts</a>"
|
|
|
|
|
condition: and
|
2021-05-07 10:21:06 +00:00
|
|
|
|
2021-05-06 19:44:19 +00:00
|
|
|
extractors:
|
|
|
|
|
- type: kval
|
|
|
|
|
part: header
|
|
|
|
|
kval:
|
|
|
|
|
- server
|
