From d3a02e2bde780f127fa80831c3990b959bc4a2b1 Mon Sep 17 00:00:00 2001 From: Dominique RIGHETTO Date: Fri, 5 Apr 2024 11:32:18 +0200 Subject: [PATCH 1/3] Add files via upload --- ...dtrust-privileged-remote-access-panel.yaml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml diff --git a/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml b/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml new file mode 100644 index 0000000000..e59b59dd7b --- /dev/null +++ b/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml @@ -0,0 +1,30 @@ +id: beyondtrust-privileged-remote-access-panel + +info: + name: BeyondTrust Privileged Remote Access Login Panel - Detect + author: righettod + severity: info + description: | + BeyondTrust Privileged Remote Access login panel was detected. + reference: + - https://www.beyondtrust.com/products/privileged-remote-access + metadata: + max-request: 1 + shodan-query: http.html:"BeyondTrust Privileged Remote Access Login" + verified: true + tags: panel,beyondtrust,login,detect + +http: + - method: GET + path: + - "{{BaseURL}}/login/login" + - "{{BaseURL}}/login/pre_login_agreement" + + stop-at-first-match: true + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains_any(to_lower(body), "beyondtrust privileged remote access login", "privileged-remote-access") && contains(to_lower(body), "login")' + condition: and \ No newline at end of file From 2b67c2668e82b47bcfc638999fa104c206774179 Mon Sep 17 00:00:00 2001 From: Dominique RIGHETTO <righettod@users.noreply.github.com> Date: Fri, 5 Apr 2024 11:37:28 +0200 Subject: [PATCH 2/3] Fix linter error --- .../beyondtrust-privileged-remote-access-panel.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml b/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml index e59b59dd7b..b6c287256b 100644 --- a/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml +++ b/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml @@ -19,7 +19,7 @@ http: path: - "{{BaseURL}}/login/login" - "{{BaseURL}}/login/pre_login_agreement" - + stop-at-first-match: true matchers: @@ -27,4 +27,4 @@ http: dsl: - 'status_code == 200' - 'contains_any(to_lower(body), "<title>beyondtrust privileged remote access login", "privileged-remote-access") && contains(to_lower(body), "login")' - condition: and \ No newline at end of file + condition: and From e65efb427ccac055dfd98957081c76948a54b9f8 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran <leedhiyanesh@gmail.com> Date: Wed, 10 Apr 2024 12:50:49 +0530 Subject: [PATCH 3/3] Update and rename beyondtrust-privileged-remote-access-panel.yaml to beyondtrust-priv-panel.yaml --- ...d-remote-access-panel.yaml => beyondtrust-priv-panel.yaml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename http/exposed-panels/{beyondtrust-privileged-remote-access-panel.yaml => beyondtrust-priv-panel.yaml} (87%) diff --git a/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml b/http/exposed-panels/beyondtrust-priv-panel.yaml similarity index 87% rename from http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml rename to http/exposed-panels/beyondtrust-priv-panel.yaml index b6c287256b..35e72031e0 100644 --- a/http/exposed-panels/beyondtrust-privileged-remote-access-panel.yaml +++ b/http/exposed-panels/beyondtrust-priv-panel.yaml @@ -1,7 +1,7 @@ -id: beyondtrust-privileged-remote-access-panel +id: beyondtrust-priv-panel info: - name: BeyondTrust Privileged Remote Access Login Panel - Detect + name: BeyondTrust Privileged Remote Access - Panel author: righettod severity: info description: |