Create apache-jspwiki-IP-userenum.yaml

Enumerates the IP Address and users that is currently accessing an Apache JSPWiki web application, leading open source WikiWiki engine, feature-rich and built around standard JEE components (Java, servlets, JSP).

http/exposures/configs/apache-jspwiki-IP-userenum.yaml

@@ -0,0 +1,37 @@
+id: apache-jspwiki-IP-userenum
+
+info:
+  name: Apache JSPWiki - Active User IP Enumeration
+  author: icarot
+  severity: low 
+  description: |
+    Enumerates the IP Address and users that is currently accessing an Apache JSPWiki web application, leading open source WikiWiki engine, feature-rich and built around standard JEE components (Java, servlets, JSP).
+  classification:
+    cpe: cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: apache
+    product: jspwiki
+  tags: tech,jspwiki,apache,enumeration
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/Wiki.jsp?page=SystemInfo"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<b>Active Wiki Users</b>'
+        condition: and
+      - type: status
+        status:
+          - 200
+    extractors:
+      - type: regex
+        name: user and IP address enumeration
+        group: 1
+        part: body
+        regex:
+          - "(?i)\\<\\/td\\>\\<td\\> ([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.+)\\<\\/td><\\/tr\\>"