Riak Detection

network/detection/riak-detect.yaml

@@ -0,0 +1,30 @@
+id: riak-detect
+
+info:
+  name: Riak Detection
+  author: pussycat0x
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: title:product:"Riak"
+  description: Riak is a distributed NoSQL key-value data store that offers high availability, fault tolerance, operational simplicity, and scalability.
+  tags: network,oss
+
+network:
+  - inputs:
+      - data: 0000000107
+        type: hex
+
+    host:
+      - "{{Hostname}}"
+      - "{{Host}}:8087"
+    read-size: 2048
+
+    matchers:
+     - type: word
+       words:
+         - "riak"
+    extractors:
+      - type: regex
+        regex:
+          - "riak@([0-9.]+)..([0-9.]+([a-z]+[0-9]))"