Merge pull request #9511 from righettod/beyondtrust_add
Add detection of BeyondTrust Privileged Remote Access login panel instances.patch-1
commit
1a9d9bc5fc
|
@ -0,0 +1,30 @@
|
|||
id: beyondtrust-priv-panel
|
||||
|
||||
info:
|
||||
name: BeyondTrust Privileged Remote Access - Panel
|
||||
author: righettod
|
||||
severity: info
|
||||
description: |
|
||||
BeyondTrust Privileged Remote Access login panel was detected.
|
||||
reference:
|
||||
- https://www.beyondtrust.com/products/privileged-remote-access
|
||||
metadata:
|
||||
max-request: 1
|
||||
shodan-query: http.html:"BeyondTrust Privileged Remote Access Login"
|
||||
verified: true
|
||||
tags: panel,beyondtrust,login,detect
|
||||
|
||||
http:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}/login/login"
|
||||
- "{{BaseURL}}/login/pre_login_agreement"
|
||||
|
||||
stop-at-first-match: true
|
||||
|
||||
matchers:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'status_code == 200'
|
||||
- 'contains_any(to_lower(body), "<title>beyondtrust privileged remote access login", "privileged-remote-access") && contains(to_lower(body), "login")'
|
||||
condition: and
|
Loading…
Reference in New Issue