CISCO WebVPN detect

exposed-panels/cisco/cisco-webvpn-detect.yaml

@@ -0,0 +1,40 @@
+id: cisco-webvpn-detect
+info:
+  name: CISCO WebVPN detect
+  author: ricardomaia
+  severity: info
+  reference:
+    - https://askanydifference.com/difference-between-cisco-clientless-ssl-vpn-and-anyconnect-with-table/
+  tags: panel,cisco,vpn
+  metadata:
+    fofa-query: fid="U1TP/SJklrT9VLIEpZkQNg=="
+    google-query: intitle:"SSLVPN Service"
+
+requests:
+  - method: GET
+    redirects: true
+    max-redirects: 2
+    stop-at-first-match: true
+    matchers-condition: and
+    path:
+      - "{{BaseURL}}/webvpn.html"
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        case-insensitive: true
+        condition: or
+        part: header
+        words:
+          - "webvpncontext"
+          - "CISCO"
+          - "AnyConnect"
+          - "SSL_Context"
+          - "WEBVPN"
+      - type: word
+        case-insensitive: true
+        condition: or
+        part: body
+        words:
+          - "CISCO"
+          - "AnyConnect"
+          - "SSLVPN Service"