nuclei-templates/http/technologies/bigip-detect.yaml

id: bigip-detect

info:
  name: BIGIP Cookie Detection
  author: PR3R00T
  severity: info
  reference:
    - https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values
    - https://support.f5.com/csp/article/K23254150
  metadata:
    max-request: 1
  tags: bigip,tech

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    matchers:
      - type: word
        part: header
        words:
          - 'BIGipServer~'

    extractors:
      - type: regex
        part: header
        group: 1
        regex:
          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([!a-z0-9A-Z/.=]+)'

# digest: 4a0a00473045022100fc70cd310415214c6de15905b887dc895a928506e91568d90feb6654787c944c02204503c14803d119a97e9c15c59e65b1f65038d094be0287292abc287837b374d7:922c64590222798bb761d5b6d8e72950
Update and rename bigip-detection.yaml to bigip-detect.yaml 2022-11-13 08:11:28 +00:00			`id: bigip-detect`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00
			`info:`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`name: BIGIP Cookie Detection`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`author: PR3R00T`
adding reference 2020-11-24 20:45:18 +00:00			`severity: info`
Changes fixes/around dynamic attributes ("additional-fields") Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-19 13:17:27 +00:00			`reference:`
			`- https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values`
			`- https://support.f5.com/csp/article/K23254150`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
templateman update 2023-10-14 11:27:55 +00:00			`tags: bigip,tech`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}"`
adding reference 2020-11-24 20:45:18 +00:00
Using "host-redirects" instead of "redirects" to avoid scanning 3rd party / out of scope hosts. (#5491) 2022-10-07 21:27:25 +00:00			`host-redirects: true`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`matchers:`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`- type: word`
			`part: header`
			`words:`
			`- 'BIGipServer~'`

			`extractors:`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`- type: regex`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`part: header`
			`group: 1`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`regex:`
Update and rename bigip-detection.yaml to bigip-detect.yaml 2022-11-13 08:11:28 +00:00			`- '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([!a-z0-9A-Z/.=]+)'`
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot: 2023-10-20 11:41:13 +00:00
			`# digest: 4a0a00473045022100fc70cd310415214c6de15905b887dc895a928506e91568d90feb6654787c944c02204503c14803d119a97e9c15c59e65b1f65038d094be0287292abc287837b374d7:922c64590222798bb761d5b6d8e72950`