2024-04-12 07:48:55 +00:00
|
|
|
id: redfish-api
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Redfish API - Detect
|
|
|
|
|
author: righettod
|
|
|
|
|
severity: info
|
|
|
|
|
description: |
|
|
|
|
|
Redfish API was detected.
|
|
|
|
|
reference:
|
|
|
|
|
- https://en.wikipedia.org/wiki/Redfish_(specification)
|
|
|
|
|
- https://www.dmtf.org/standards/redfish
|
|
|
|
|
metadata:
|
|
|
|
|
verified: true
|
|
|
|
|
max-request: 1
|
|
|
|
|
shodan-query: http.html:"/redfish/v1"
|
|
|
|
|
tags: config,exposure,redfish,api
|
|
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/redfish/v1/"
|
|
|
|
|
|
|
|
|
|
matchers:
|
2024-04-15 07:53:59 +00:00
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- 'contains_any(body, "\"@odata.type\":", "/redfish/v1/$metadata#Message")'
|
|
|
|
|
- 'contains(header, "application/json")'
|
|
|
|
|
- 'status_code == 200 || status_code == 502'
|
2024-04-12 07:48:55 +00:00
|
|
|
condition: and
|
|
|
|
|
|
|
|
|
|
extractors:
|
|
|
|
|
- type: regex
|
|
|
|
|
part: body
|
|
|
|
|
group: 1
|
|
|
|
|
regex:
|
2024-04-15 07:53:59 +00:00
|
|
|
- '[a-z]+\.v?([0-9_\.]+)\.'
|
2024-04-16 06:19:30 +00:00
|
|
|
# digest: 4b0a00483046022100ab37540993b2370275b9b4459da706a02128db660da4f16f45620081f3897b7a022100db8b89d8e912b04d1e0542260ea362dc28c9c039c265b643341b975cd18cb1d2:922c64590222798bb761d5b6d8e72950
|
