diff --git a/network/detection/activemq-openwire-transport-detect.yaml b/network/detection/activemq-openwire-transport-detect.yaml new file mode 100644 index 0000000000..38b0ca2a83 --- /dev/null +++ b/network/detection/activemq-openwire-transport-detect.yaml @@ -0,0 +1,31 @@ +id: activemq-openwire-transport-detect + +info: + name: ActiveMQ OpenWire Transport Detection + author: pussycat0x + severity: info + description: | + OpenWire is the native protocol that Apache ActiveMQ uses. It is designed for performance and size on the wire - sacrificing some ease of implementation with higher performance and reduced network bandwidth as a priority. + metadata: + verified: true + shodan-query: 'product:"ActiveMQ OpenWire transport"' + tags: network,activemq + +network: + - inputs: + - data: "VERSION" + + host: + - "{{Hostname}}" + - "{{Host}}:61616" + + matchers-condition: and + matchers: + - type: word + words: + - "ActiveMQ" + + extractors: + - type: regex + regex: + - "ProviderVersion...([0-9.]+)"