id: iplanet-imap-detect
info:
name: iplanet messaging imap protocol
author: pussycat0x
severity: info
metadata:
fofa-query: app="iPlanet-Messaging-Server-5.2" && protocol="imap"
tags: network,imap
network:
- inputs:
- data: "\n"
host:
- "{{Hostname}}"
- "{{Host}}:110"
matchers:
- type: word
words:
- "iPlanet Messaging Server"
extractors:
- type: regex
part: body
regex:
- "iPlanet Messaging Server ([0-9.]+)"
