Merge pull request #9511 from righettod/beyondtrust_add
Add detection of BeyondTrust Privileged Remote Access login panel instances.patch-1
commit
1a9d9bc5fc
|
@ -0,0 +1,30 @@
|
||||||
|
id: beyondtrust-priv-panel
|
||||||
|
|
||||||
|
info:
|
||||||
|
name: BeyondTrust Privileged Remote Access - Panel
|
||||||
|
author: righettod
|
||||||
|
severity: info
|
||||||
|
description: |
|
||||||
|
BeyondTrust Privileged Remote Access login panel was detected.
|
||||||
|
reference:
|
||||||
|
- https://www.beyondtrust.com/products/privileged-remote-access
|
||||||
|
metadata:
|
||||||
|
max-request: 1
|
||||||
|
shodan-query: http.html:"BeyondTrust Privileged Remote Access Login"
|
||||||
|
verified: true
|
||||||
|
tags: panel,beyondtrust,login,detect
|
||||||
|
|
||||||
|
http:
|
||||||
|
- method: GET
|
||||||
|
path:
|
||||||
|
- "{{BaseURL}}/login/login"
|
||||||
|
- "{{BaseURL}}/login/pre_login_agreement"
|
||||||
|
|
||||||
|
stop-at-first-match: true
|
||||||
|
|
||||||
|
matchers:
|
||||||
|
- type: dsl
|
||||||
|
dsl:
|
||||||
|
- 'status_code == 200'
|
||||||
|
- 'contains_any(to_lower(body), "<title>beyondtrust privileged remote access login", "privileged-remote-access") && contains(to_lower(body), "login")'
|
||||||
|
condition: and
|
Loading…
Reference in New Issue