diff --git a/exposed-panels/netflix-conductor-ui.yaml b/exposed-panels/netflix-conductor-ui.yaml new file mode 100644 index 0000000000..b0fbf4c1b1 --- /dev/null +++ b/exposed-panels/netflix-conductor-ui.yaml @@ -0,0 +1,29 @@ +id: netflix-conductor-ui + +info: + name: Netflix Conductor UI Detection + author: c-sh0 + severity: info + metadata: + shodan-query: http.title:"Conductor UI", http.title:"Workflow UI" + tags: webserver,netflix,conductor,panel + +requests: + - method: GET + path: + - "{{BaseURL}}" + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - 'Conductor UI' + - 'Workflow UI' + condition: or \ No newline at end of file diff --git a/miscellaneous/netflix-conductor-version.yaml b/miscellaneous/netflix-conductor-version.yaml new file mode 100644 index 0000000000..d65a74f13b --- /dev/null +++ b/miscellaneous/netflix-conductor-version.yaml @@ -0,0 +1,44 @@ +id: netflix-conductor-version + +info: + name: Netflix Conductor Version Detection + author: c-sh0 + severity: info + description: Obtain netflix conductor version information + reference: + - https://github.com/Netflix/conductor/blob/v1.6.0-rc1/ui/src/server.js#L17 + - https://github.com/Netflix/conductor/blob/v3.1.0/rest/src/main/java/com/netflix/conductor/rest/controllers/AdminResource.java#L42 + metadata: + shodan-query: http.title:"Conductor UI", http.title:"Workflow UI" + tags: tech,netflix,conductor,api + +requests: + - method: GET + path: + - "{{BaseURL}}/api/admin/config" + - "{{BaseURL}}/api/sys" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - 'application/json' + + - type: word + part: body + words: + - 'CONDUCTOR_' + case-insensitive: true + + extractors: + - type: regex + group: 1 + regex: + - 'conductor\-server\-([0-9.]+)\-' + - '"version":"([0-9.]+)\-' \ No newline at end of file