diff --git a/exposed-panels/neos-panel.yaml b/exposed-panels/neos-panel.yaml new file mode 100644 index 0000000000..d1baa5207d --- /dev/null +++ b/exposed-panels/neos-panel.yaml @@ -0,0 +1,31 @@ +id: neos-panel + +info: + name: Neos CMS Login Panel + author: k11h-de + severity: info + description: detection of default route to admin login panel based on warranty disclainer in footer + reference: https://github.com/neos/neos/blob/master/Configuration/Routes.yaml + tags: panel,neos,cms + +requests: + - method: GET + path: + - '{{BaseURL}}/neos/login' + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + words: + - 'Neos comes with ABSOLUTELY NO WARRANTY' + + - type: status + status: + - 200 + + extractors: + - type: kval + kval: + - 'x_flow_powered' \ No newline at end of file diff --git a/technologies/neos-detect.yaml b/technologies/neos-detect.yaml new file mode 100644 index 0000000000..c1f86299dc --- /dev/null +++ b/technologies/neos-detect.yaml @@ -0,0 +1,26 @@ +id: neos-detect + +info: + name: Neos CMS detection + author: k11h-de + description: some Neos websites remove the X-Flow-Powered Header, but they usually all have a comment line at the top of the body + severity: info + reference: https://github.com/neos/ + tags: tech,neos,cms + +requests: + - method: GET + path: + - "{{BaseURL}}" + + redirects: true + max-redirects: 2 + matchers: + - type: word + words: + - "This website is powered by Neos" + + extractors: + - type: kval + kval: + - 'x_flow_powered' \ No newline at end of file