nuclei-templates/http/technologies/confluence-detect.yaml

id: confluence-detect

info:
  name: Confluence Detection
  author: philippedelteil,AdamCrosser,6mile
  severity: info
  description: |
    This nuclei template is used to detect the presence of Confluence, a popular collaboration software.
  metadata:
    max-request: 5
    vendor: atlassian
    product: confluence_server
    shodan-query: http.component:"Atlassian Confluence"
    category: productivity
  tags: tech,confluence,atlassian,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}/dologin.action"
      - "{{BaseURL}}"
      - "{{BaseURL}}/pages"
      - "{{BaseURL}}/confluence"
      - "{{BaseURL}}/wiki"

    redirects: true
    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - contains(to_lower(header), '-confluence-')
          - contains(to_lower(body), 'confluence-base-url')

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - '<meta name="ajs-version-number" content="(.*)">'
          - 'Atlassian Confluence ([a-z0-9-._]+)'

      - type: regex
        name: hostname
        group: 1
        regex:
          - '<meta id="confluence-base-url" name="confluence-base-url" content="https://(.*)">'
          - '<meta name="ajs-base-url" content="https://(.*)">'
          - '<meta name="ajs-server-name" content="(.*)">'
# digest: 4a0a004730450220271dbbb5a7d674a45a676cf7e096ebdc39df4d0bf69c17f074b37e57ad1740bb02210090824d340b9c0f83194a42d0cf41eb23683464e53595905d46da03b2653ad7c4:922c64590222798bb761d5b6d8e72950
Update and rename confluence-detector.yaml to confluence-detect.yaml 2021-09-09 06:01:44 +00:00			`id: confluence-detect`
Create confluence-detector.yaml 2021-09-09 04:28:04 +00:00
			`info:`
New Nuclei template to pull DNS hostname from Confluence servers (#8543) * first commit of the confluence-hostname.yaml template. works great. * added to the description * added the reference to atlassian website * fixed typo in regex for new extractors * fixed the s in references typo * fixed indent spacing on lines 45-47 * improve existing template to detect hostname --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-11-05 10:14:34 +00:00			`name: Confluence Detection`
			`author: philippedelteil,AdamCrosser,6mile`
Create confluence-detector.yaml 2021-09-09 04:28:04 +00:00			`severity: info`
New Nuclei template to pull DNS hostname from Confluence servers (#8543) * first commit of the confluence-hostname.yaml template. works great. * added to the description * added the reference to atlassian website * fixed typo in regex for new extractors * fixed the s in references typo * fixed indent spacing on lines 45-47 * improve existing template to detect hostname --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-11-05 10:14:34 +00:00			`description: \|`
			`This nuclei template is used to detect the presence of Confluence, a popular collaboration software.`
Update confluence-detect.yaml 2021-10-14 10:52:58 +00:00			`metadata:`
TemplateMan Update [Wed Jun 21 21:03:53 UTC 2023] :robot: 2023-06-21 21:03:53 +00:00			`max-request: 5`
templateman update 2023-10-14 11:27:55 +00:00			`vendor: atlassian`
TemplateMan Update [Wed Jun 21 21:03:53 UTC 2023] :robot: 2023-06-21 21:03:53 +00:00			`product: confluence_server`
added confluence metadata and minor matcher updates (#3929) 2022-03-19 10:42:08 +00:00			`shodan-query: http.component:"Atlassian Confluence"`
templateman update 2023-10-14 11:27:55 +00:00			`category: productivity`
Update Confluence Detection Templates With Version Extraction Logic (#7460) * Update Confluence Version * Added Application Category * misc update * order revert --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-06-16 19:53:27 +00:00			`tags: tech,confluence,atlassian,detect`
added confluence metadata and minor matcher updates (#3929) 2022-03-19 10:42:08 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create confluence-detector.yaml 2021-09-09 04:28:04 +00:00			`- method: GET`
			`path:`
Update Confluence Detection Templates With Version Extraction Logic (#7460) * Update Confluence Version * Added Application Category * misc update * order revert --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-06-16 19:53:27 +00:00			`- "{{BaseURL}}/dologin.action"`
Create confluence-detector.yaml 2021-09-09 04:28:04 +00:00			`- "{{BaseURL}}"`
			`- "{{BaseURL}}/pages"`
			`- "{{BaseURL}}/confluence"`
			`- "{{BaseURL}}/wiki"`

New Nuclei template to pull DNS hostname from Confluence servers (#8543) * first commit of the confluence-hostname.yaml template. works great. * added to the description * added the reference to atlassian website * fixed typo in regex for new extractors * fixed the s in references typo * fixed indent spacing on lines 45-47 * improve existing template to detect hostname --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-11-05 10:14:34 +00:00			`redirects: true`
Create confluence-detector.yaml 2021-09-09 04:28:04 +00:00			`stop-at-first-match: true`
			`matchers:`
New Nuclei template to pull DNS hostname from Confluence servers (#8543) * first commit of the confluence-hostname.yaml template. works great. * added to the description * added the reference to atlassian website * fixed typo in regex for new extractors * fixed the s in references typo * fixed indent spacing on lines 45-47 * improve existing template to detect hostname --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-11-05 10:14:34 +00:00			`- type: dsl`
			`dsl:`
			`- contains(to_lower(header), '-confluence-')`
			`- contains(to_lower(body), 'confluence-base-url')`
Update and rename confluence-detector.yaml to confluence-detect.yaml 2021-09-09 06:01:44 +00:00
Create confluence-detector.yaml 2021-09-09 04:28:04 +00:00			`extractors:`
			`- type: regex`
Update Confluence Detection Templates With Version Extraction Logic (#7460) * Update Confluence Version * Added Application Category * misc update * order revert --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-06-16 19:53:27 +00:00			`name: version`
Create confluence-detector.yaml 2021-09-09 04:28:04 +00:00			`group: 1`
			`regex:`
Added additional extractor for version detection 2022-06-06 16:30:56 +00:00			`- '<meta name="ajs-version-number" content="(.*)">'`
Update Confluence Detection Templates With Version Extraction Logic (#7460) * Update Confluence Version * Added Application Category * misc update * order revert --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-06-16 19:53:27 +00:00			`- 'Atlassian Confluence ([a-z0-9-._]+)'`

New Nuclei template to pull DNS hostname from Confluence servers (#8543) * first commit of the confluence-hostname.yaml template. works great. * added to the description * added the reference to atlassian website * fixed typo in regex for new extractors * fixed the s in references typo * fixed indent spacing on lines 45-47 * improve existing template to detect hostname --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-11-05 10:14:34 +00:00			`- type: regex`
			`name: hostname`
			`group: 1`
			`regex:`
			`- '<meta id="confluence-base-url" name="confluence-base-url" content="https://(.*)">'`
			`- '<meta name="ajs-base-url" content="https://(.*)">'`
			`- '<meta name="ajs-server-name" content="(.*)">'`
Auto Template Signing [Sun Nov 5 10:17:54 UTC 2023] :robot: 2023-11-05 10:17:55 +00:00			`# digest: 4a0a004730450220271dbbb5a7d674a45a676cf7e096ebdc39df4d0bf69c17f074b37e57ad1740bb02210090824d340b9c0f83194a42d0cf41eb23683464e53595905d46da03b2653ad7c4:922c64590222798bb761d5b6d8e72950`