Fix FN - status matcher removed

patch-11
Ritik Chaddha 2024-09-10 15:00:30 +04:00 committed by GitHub
parent a80f439959
commit 291fad7bbe
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 9 additions and 8 deletions

View File

@ -1,7 +1,7 @@
id: ibm-api-connect-developer-portal-detect
id: ibm-api-connect-detect
info:
name: IBM API Connect Developer Portal Detect
name: IBM API Connect Developer Portal - Detect
author: righettod
severity: info
description: IBM API Connect Developer Portal was detected.
@ -9,9 +9,10 @@ info:
- https://github.com/ibm-apiconnect/devportal
- https://www.ibm.com/products/api-connect/developer-portal
metadata:
max-request: 1
verified: true
max-request: 3
shodan-query: http.favicon.hash:"801517258"
tags: tech,ibm
tags: tech,ibm,detect
http:
- method: GET
@ -24,13 +25,13 @@ http:
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains_any(to_lower(body), "ibm developer portal is ready to create sites", "package: ibm api developer portal", "modules\\/ibm_apim\\/") || ("801517258" == mmh3(base64_py(body)))'
condition: and
- 'contains_any(to_lower(body), "ibm developer portal is ready", "package: ibm api developer", "modules\\/ibm_apim\\/")'
- '("801517258" == mmh3(base64_py(body)))'
condition: or
extractors:
- type: regex
part: body
group: 1
regex:
- '(?i)version:\s+([0-9a-z\-_.]+)'
- '(?i)version:\s+([0-9a-z\-_.]+)'