Fix FN - status matcher removed
parent
a80f439959
commit
291fad7bbe
|
@ -1,7 +1,7 @@
|
||||||
id: ibm-api-connect-developer-portal-detect
|
id: ibm-api-connect-detect
|
||||||
|
|
||||||
info:
|
info:
|
||||||
name: IBM API Connect Developer Portal Detect
|
name: IBM API Connect Developer Portal - Detect
|
||||||
author: righettod
|
author: righettod
|
||||||
severity: info
|
severity: info
|
||||||
description: IBM API Connect Developer Portal was detected.
|
description: IBM API Connect Developer Portal was detected.
|
||||||
|
@ -9,9 +9,10 @@ info:
|
||||||
- https://github.com/ibm-apiconnect/devportal
|
- https://github.com/ibm-apiconnect/devportal
|
||||||
- https://www.ibm.com/products/api-connect/developer-portal
|
- https://www.ibm.com/products/api-connect/developer-portal
|
||||||
metadata:
|
metadata:
|
||||||
max-request: 1
|
verified: true
|
||||||
|
max-request: 3
|
||||||
shodan-query: http.favicon.hash:"801517258"
|
shodan-query: http.favicon.hash:"801517258"
|
||||||
tags: tech,ibm
|
tags: tech,ibm,detect
|
||||||
|
|
||||||
http:
|
http:
|
||||||
- method: GET
|
- method: GET
|
||||||
|
@ -24,13 +25,13 @@ http:
|
||||||
matchers:
|
matchers:
|
||||||
- type: dsl
|
- type: dsl
|
||||||
dsl:
|
dsl:
|
||||||
- 'status_code == 200'
|
- 'contains_any(to_lower(body), "ibm developer portal is ready", "package: ibm api developer", "modules\\/ibm_apim\\/")'
|
||||||
- 'contains_any(to_lower(body), "ibm developer portal is ready to create sites", "package: ibm api developer portal", "modules\\/ibm_apim\\/") || ("801517258" == mmh3(base64_py(body)))'
|
- '("801517258" == mmh3(base64_py(body)))'
|
||||||
condition: and
|
condition: or
|
||||||
|
|
||||||
extractors:
|
extractors:
|
||||||
- type: regex
|
- type: regex
|
||||||
part: body
|
part: body
|
||||||
group: 1
|
group: 1
|
||||||
regex:
|
regex:
|
||||||
- '(?i)version:\s+([0-9a-z\-_.]+)'
|
- '(?i)version:\s+([0-9a-z\-_.]+)'
|
||||||
|
|
Loading…
Reference in New Issue