Osquery and idrac updates (#4085)

* Updated CVE-2022-22963

* Updated iDRAC9 Template

* Added OSQuery Fleet Template

* misc updates

Co-authored-by: sandeep <sandeep@projectdiscovery.io>
patch-1
Adam Crosser 2022-04-09 10:19:00 -05:00 committed by GitHub
parent fa4c52b5b4
commit a10471089d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 34 additions and 4 deletions

View File

@ -3,8 +3,8 @@ id: dell-idrac9-detect
info:
name: Detect Dell iDRAC9
author: kophjager007
description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers.
severity: info
description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers.
tags: tech,dell
requests:
@ -17,19 +17,20 @@ requests:
- type: status
status:
- 200
- type: word
part: all
words:
- "14G"
- "BuildVersion"
- "SystemModelName"
extractors:
- type: regex
part: body
regex:
- '[0-9]{2}G'
- type: regex
part: body
name: fwver
group: 1
regex:
- '"FwVer" *: *"([^"]+)"'

View File

@ -0,0 +1,29 @@
id: osquery-fleet-detect
info:
name: OSQuery Fleet Detection
author: Adam Crosser
severity: info
reference: https://fleetdm.com/
metadata:
shodan-query: http.favicon.hash:-1529860313
tags: panel,fleet,osquery
requests:
- method: GET
path:
- '{{BaseURL}}/login'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Fleet"
- "osquery"
- "/assets/bundle"
condition: and
- type: status
status:
- 200