Merge pull request #9511 from righettod/beyondtrust_add

Add detection of BeyondTrust Privileged Remote Access login panel instances.
patch-1
pussycat0x 2024-04-10 16:57:55 +05:30 committed by GitHub
commit 1a9d9bc5fc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 30 additions and 0 deletions

View File

@ -0,0 +1,30 @@
id: beyondtrust-priv-panel
info:
name: BeyondTrust Privileged Remote Access - Panel
author: righettod
severity: info
description: |
BeyondTrust Privileged Remote Access login panel was detected.
reference:
- https://www.beyondtrust.com/products/privileged-remote-access
metadata:
max-request: 1
shodan-query: http.html:"BeyondTrust Privileged Remote Access Login"
verified: true
tags: panel,beyondtrust,login,detect
http:
- method: GET
path:
- "{{BaseURL}}/login/login"
- "{{BaseURL}}/login/pre_login_agreement"
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains_any(to_lower(body), "<title>beyondtrust privileged remote access login", "privileged-remote-access") && contains(to_lower(body), "login")'
condition: and