Update dionaea-http-honeypot-detect.yaml

patch-1
Dhiyaneshwaran 2023-11-09 13:21:30 +05:30 committed by GitHub
parent d5432edff1
commit 8d3a22bd1e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 32 deletions

View File

@ -1,37 +1,37 @@
id: dionaea-http-honeypot-detect
id: dionaea-http-honeypot-detect
info:
name: Dionaea HTTP Honeypot - Detect
author: UnaPibaGeek
severity: info
description: |
Dionaea HTTP honeypot has been identified.
The response to an incorrect HTTP method reveals a possible setup of the Dioanea web application honeypot.
metadata:
max-request: 1
vendor: dionaea
product: http
tags: dionaea,honeypot,ir,cti
info:
name: Dionaea HTTP Honeypot - Detect
author: UnaPibaGeek
severity: info
description: |
Dionaea HTTP honeypot has been identified.
The response to an incorrect HTTP method reveals a possible setup of the Dioanea web application honeypot.
metadata:
max-request: 1
vendor: dionaea
product: http
tags: dionaea,honeypot,ir,cti
http:
- raw:
- |
AAAA / HTTP/1.1
Host: {{Hostname}}
http:
- raw:
- |
AAAA / HTTP/1.1
Host: {{Hostname}}
unsafe: true
matchers-condition: and
matchers:
- type: status
status:
- 501
unsafe: true
matchers-condition: and
matchers:
- type: status
status:
- 501
- type: word
part: header
words:
- "nginx"
- type: word
part: header
words:
- "nginx"
- type: word
part: body
words:
- '<?xml version="1.0" encoding="ascii"?>'
- type: word
part: body
words:
- '<?xml version="1.0" encoding="ascii"?>'