diff --git a/http/exposed-panels/moodle-workplace-panel.yaml b/http/exposed-panels/moodle-workplace-panel.yaml new file mode 100644 index 0000000000..8c9662836d --- /dev/null +++ b/http/exposed-panels/moodle-workplace-panel.yaml @@ -0,0 +1,27 @@ +id: moodle-workplace-panel + +info: + name: Moodle Workplace Login Panel - Detect + author: righettod + severity: info + description: | + Moodle workplace login panel was detected. + reference: + - https://moodle.com/solutions/workplace/ + metadata: + max-request: 1 + verified: true + shodan-query: http.html:"moodle," + tags: panel,moodle,login,detect + +http: + - method: GET + path: + - "{{BaseURL}}/login/index.php" + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains_any(body, "content=\"moodle", "\"name\":\"moodle\"") && contains(body, "workplace")' + condition: and \ No newline at end of file