Update and rename adcs-detect.yaml to http/exposures/files/adcs-detect.yaml

adcs-detect.yaml

@@ -1,28 +0,0 @@
-id: adcs-detect
-
-info:
-  name: ADCS - Detect
-  author: pastaga,defte
-  severity: info
-  description: |
-    ADCS Detection checks for common redirection on potential ADCS endpoints. It should be used with the list of all domain servers like `cat servers_ips.txt | nuclei -id adcs-detect`
-  tags: ad,adcs
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/certenroll"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: header
-        words:
-          - "Location: {{BaseURL}}/certenroll/"
-
-      - type: status
-        status:
-          - 300
-          - 301
-          - 302
-        condition: or

http/exposures/files/adcs-detect.yaml

@@ -0,0 +1,27 @@
+id: adcs-detect
+
+info:
+  name: Certification Authority Web Enrollment (ADCS) - Detection
+  author: pastaga,defte
+  severity: info
+  description: |
+    Web Enrollment is a service that can be installed on an AD CS server to allow users and computers in an Active Directory domain to request a certificate through an interactive web page.
+  metadata:
+    verified: true
+    shodan-query: html:"/certenroll"
+  tags: ad,adcs,exposure
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/certenroll/"
+      - "{{BaseURL}}/CertEnroll/"
+
+    host-redirects: true
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body, ".crl") || contains(body, ".crt")
+          - contains(body, "CertEnroll") || contains(body, "certenroll")
+          - status_code == 200
+        condition: and