diff --git a/exposed-panels/cisco/cisco-webvpn-detect.yaml b/exposed-panels/cisco/cisco-webvpn-detect.yaml new file mode 100644 index 0000000000..fa0d6dfd70 --- /dev/null +++ b/exposed-panels/cisco/cisco-webvpn-detect.yaml @@ -0,0 +1,40 @@ +id: cisco-webvpn-detect +info: + name: CISCO WebVPN detect + author: ricardomaia + severity: info + reference: + - https://askanydifference.com/difference-between-cisco-clientless-ssl-vpn-and-anyconnect-with-table/ + tags: panel,cisco,vpn + metadata: + fofa-query: fid="U1TP/SJklrT9VLIEpZkQNg==" + google-query: intitle:"SSLVPN Service" + +requests: + - method: GET + redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and + path: + - "{{BaseURL}}/webvpn.html" + - "{{BaseURL}}" + matchers: + - type: word + case-insensitive: true + condition: or + part: header + words: + - "webvpncontext" + - "CISCO" + - "AnyConnect" + - "SSL_Context" + - "WEBVPN" + - type: word + case-insensitive: true + condition: or + part: body + words: + - "CISCO" + - "AnyConnect" + - "SSLVPN Service"