From 767492ff0918f8068e1c0920977eed8319eabcfe Mon Sep 17 00:00:00 2001
From: PR3R00T <50199640+PR3R00T@users.noreply.github.com>
Date: Mon, 2 Nov 2020 21:07:47 +0000
Subject: [PATCH] Adding Unencrypted F5 Cookie disclosure

Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service.
---
 tokens/unecrypted-bigip-ltm-cookie.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 tokens/unecrypted-bigip-ltm-cookie.yaml

diff --git a/tokens/unecrypted-bigip-ltm-cookie.yaml b/tokens/unecrypted-bigip-ltm-cookie.yaml
new file mode 100644
index 0000000000..dcf00fb655
--- /dev/null
+++ b/tokens/unecrypted-bigip-ltm-cookie.yaml
@@ -0,0 +1,18 @@
+id: unecrypted-bigip-ltm-cookie
+
+info:
+  name: F5 BIGIP Unecrypted Cookie
+  author: PR3R00T
+  severity: low
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    redirects: true
+    matchers:
+      - type: regex
+        regex:
+          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([0-9a-zA-Z\.]*;)'
+          - '=[0-9]*\.[0-9]{3,5}\.[0-9]{4};'
+        part: header