Fix FN - status matcher removed

patch-11
Ritik Chaddha 2024-09-10 15:00:30 +04:00 committed by GitHub
parent a80f439959
commit 291fad7bbe
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 9 additions and 8 deletions

View File

@ -1,7 +1,7 @@
id: ibm-api-connect-developer-portal-detect id: ibm-api-connect-detect
info: info:
name: IBM API Connect Developer Portal Detect name: IBM API Connect Developer Portal - Detect
author: righettod author: righettod
severity: info severity: info
description: IBM API Connect Developer Portal was detected. description: IBM API Connect Developer Portal was detected.
@ -9,9 +9,10 @@ info:
- https://github.com/ibm-apiconnect/devportal - https://github.com/ibm-apiconnect/devportal
- https://www.ibm.com/products/api-connect/developer-portal - https://www.ibm.com/products/api-connect/developer-portal
metadata: metadata:
max-request: 1 verified: true
max-request: 3
shodan-query: http.favicon.hash:"801517258" shodan-query: http.favicon.hash:"801517258"
tags: tech,ibm tags: tech,ibm,detect
http: http:
- method: GET - method: GET
@ -24,13 +25,13 @@ http:
matchers: matchers:
- type: dsl - type: dsl
dsl: dsl:
- 'status_code == 200' - 'contains_any(to_lower(body), "ibm developer portal is ready", "package: ibm api developer", "modules\\/ibm_apim\\/")'
- 'contains_any(to_lower(body), "ibm developer portal is ready to create sites", "package: ibm api developer portal", "modules\\/ibm_apim\\/") || ("801517258" == mmh3(base64_py(body)))' - '("801517258" == mmh3(base64_py(body)))'
condition: and condition: or
extractors: extractors:
- type: regex - type: regex
part: body part: body
group: 1 group: 1
regex: regex:
- '(?i)version:\s+([0-9a-z\-_.]+)' - '(?i)version:\s+([0-9a-z\-_.]+)'