Merge pull request #10089 from Mys7ic/add_domain_extraction

add domain extraction
2024-06-24 12:59:11 +05:30 · 2024-06-24 12:59:11 +05:30 · 146fb2f6e3
parent a3f74d3d4c 98562ac5c1
commit 146fb2f6e3
1 changed files with 9 additions and 1 deletions
--- a/http/technologies/adfs-detect.yaml
+++ b/http/technologies/adfs-detect.yaml
@ -2,7 +2,7 @@ id: adfs-detect

 info:
  name: ADFS Detect
-  author: Adam Crosser
+  author: Adam Crosser,Mys7ic
  severity: info
  description: Detects ADFS with forms-based authentication enabled.
  metadata:
@ -21,4 +21,12 @@ http:
        words:
          - '/adfs/portal/css/style.css'

+    extractors:
+      - type: regex
+        part: body
+        name: domain
+        group: 1
+        regex:
+          - 'var\s+userNameValue\s*=\s*''([^\\]*)\\'
+
 # digest: 4a0a0047304502200fd3109b341765721cc300a6fc04830ccc8d78a68883b3b08ed48841c3ba1ad3022100a01920ae98b24f8b98962e684308e29f8f3f285540b18504211ad783d94990e4:922c64590222798bb761d5b6d8e72950