nuclei-templates/technologies/bigip-detection.yaml

id: bigip-detection

info:
  name: BIGIP Cookie Detection
  author: PR3R00T
  severity: info
  reference:
    - https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values
    - https://support.f5.com/csp/article/K23254150
  tags: bigip,tech

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    matchers:
      - type: word
        part: header
        words:
          - 'BIGipServer~'

    extractors:
      - type: regex
        part: header
        group: 1
        regex:
          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([!a-z0-9A-Z/.=]+)'
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`id: bigip-detection`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00
			`info:`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`name: BIGIP Cookie Detection`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`author: PR3R00T`
adding reference 2020-11-24 20:45:18 +00:00			`severity: info`
Changes fixes/around dynamic attributes ("additional-fields") Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-19 13:17:27 +00:00			`reference:`
			`- https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values`
			`- https://support.f5.com/csp/article/K23254150`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`tags: bigip,tech`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}"`
adding reference 2020-11-24 20:45:18 +00:00
Using "host-redirects" instead of "redirects" to avoid scanning 3rd party / out of scope hosts. (#5491) 2022-10-07 21:27:25 +00:00			`host-redirects: true`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`matchers:`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`- type: word`
			`part: header`
			`words:`
			`- 'BIGipServer~'`

			`extractors:`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`- type: regex`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`part: header`
			`group: 1`
Adding Unencrypted F5 Cookie disclosure Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service. 2020-11-02 21:07:47 +00:00			`regex:`
moving file around + matcher update 2021-10-31 15:40:48 +00:00			`- '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([!a-z0-9A-Z/.=]+)'`