Merge pull request #9708 from kazet/more-comprehensive-rdweb-panel

more comprehensive RDWeb panel detection

http/exposed-panels/rdweb-panel.yaml

@@ -1,7 +1,7 @@
 id: rdweb-panel
 
 info:
-  name: RD Web Access - Panel Detect
+  name: RD Web Access Panel - Detect
   author: rxerium,sorrowx3
   severity: info
   description: |
@@ -11,12 +11,12 @@ info:
   classification:
     cpe: cpe:2.3:a:microsoft:remote_desktop:*:*:*:*:android:*:*:*
   metadata:
+    verified: true
     max-request: 1
     product: remote_desktop
-    shodan-query: html:"RD Web Access"
     vendor: microsoft
-    verified: true
-  tags: panel,login,rdp,web-access,microsoft
+    shodan-query: html:"RD Web Access"
+  tags: panel,login,rdp,web-access,Microsoft,detect
 
 http:
   - method: GET
@@ -24,16 +24,18 @@ http:
       - '{{BaseURL}}/RDWeb/'
 
     host-redirects: true
-    max-redirects: 1
+    max-redirects: 2
 
-    matchers-condition: and
+    matchers-condition: or
     matchers:
       - type: word
         part: header
         words:
           - "TSWAFeatureCheckCookie=true; path=/RDWeb/"
 
-      - type: status
-        status:
-          - 302
-# digest: 4b0a00483046022100b7bd22946afb7a0c73f3415567391e04361324b834a9c1f09a9c667ff9037b9d022100f0f3c01f592d151a12b1646bc53cc6476f189947426cadaeecc52cc2e1d37cd2:922c64590222798bb761d5b6d8e72950
+      - type: word
+        part: response
+        words:
+          - "<rdp-client-top-view>"
+          - "Microsoft Remote Desktop"
+        condition: and