nuclei-templates/http/exposed-panels/c2/empire-c2.yaml

id: empire-c2

info:
  name: Empire C2 - Detect
  author: pussycat0x
  severity: info
  description: |
    Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server. There is also a GUI available for remotely accessing the Empire server.
  reference: |
    - https://github.com/thehappydinoa/awesome-censys-queries#security-applications
    - https://bc-security.gitbook.io/empire-wiki/
  metadata:
    verified: "true"
    max-request: 1
    censys-query: bc517bf173440dad15b99a051389fadc366d5df2 || dcb32e6256459d3660fdc90e4c79e95a921841cc
  tags: c2,ir,osint,empire,panel

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - "(\"dcb32e6256459d3660fdc90e4c79e95a921841cc\" == sha1(body))"
# digest: 4a0a0047304502204272b0e3e53274ba1d2c28bf3b44ad0945eda9eed8289b6aa5c764a9cb9e6ca8022100964e9d3e83038cadd2a57742e65cc085a6159c9c575ce477dd57749ca658bcea:922c64590222798bb761d5b6d8e72950