Adding Unencrypted F5 Cookie disclosure

Locate F5 Load balancer Persistence cookies, use other tools to decode these cookies to disclose internal IP address and port number of the service.

tokens/unecrypted-bigip-ltm-cookie.yaml

@@ -0,0 +1,18 @@
+id: unecrypted-bigip-ltm-cookie
+
+info:
+  name: F5 BIGIP Unecrypted Cookie
+  author: PR3R00T
+  severity: low
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    redirects: true
+    matchers:
+      - type: regex
+        regex:
+          - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([0-9a-zA-Z\.]*;)'
+          - '=[0-9]*\.[0-9]{3,5}\.[0-9]{4};'
+        part: header