Merge pull request #10283 from righettod/falco_add
Add detection of Falcosidekick UI login panel instances.patch-5
commit
9cb1221d52
|
@ -0,0 +1,26 @@
|
||||||
|
id: falcosidekick-panel
|
||||||
|
|
||||||
|
info:
|
||||||
|
name: Falcosidekick UI Login Panel - Detect
|
||||||
|
author: righettod
|
||||||
|
severity: info
|
||||||
|
description: Falcosidekick UI login panel was detected.
|
||||||
|
reference:
|
||||||
|
- https://github.com/falcosecurity/falcosidekick-ui
|
||||||
|
metadata:
|
||||||
|
max-request: 1
|
||||||
|
verified: true
|
||||||
|
shodan-query: http.title:"Falcosidekick"
|
||||||
|
tags: panel,falco,detect,login
|
||||||
|
|
||||||
|
http:
|
||||||
|
- method: GET
|
||||||
|
path:
|
||||||
|
- '{{BaseURL}}/login/'
|
||||||
|
|
||||||
|
matchers:
|
||||||
|
- type: dsl
|
||||||
|
dsl:
|
||||||
|
- 'status_code == 200'
|
||||||
|
- 'contains_any(to_lower(body), "falcosidekick ui", "falcosidekick-ui")'
|
||||||
|
condition: and
|
Loading…
Reference in New Issue