moving file around + matcher update

technologies/bigip-detection.yaml

@@ -1,13 +1,13 @@
-id: unencrypted-bigip-ltm-cookie
+id: bigip-detection
 
 info:
-  name: F5 BIGIP Unencrypted Cookie
+  name: BIGIP Cookie Detection
   author: PR3R00T
   severity: info
   reference:
     - https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values
     - https://support.f5.com/csp/article/K23254150
-  tags: misc
+  tags: bigip,tech
 
 requests:
   - method: GET
@@ -16,8 +16,14 @@ requests:
 
     redirects: true
     matchers:
-      - type: regex
+      - type: word
-        regex:
-          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([0-9a-zA-Z\.]*;)'
-          - '=[0-9]*\.[0-9]{3,5}\.[0-9]{4};'
         part: header
+        words:
+          - 'BIGipServer~'
+
+    extractors:
+      - type: regex
+        part: header
+        group: 1
+        regex:
+          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([!a-z0-9A-Z/.=]+)'