diff --git a/http/technologies/erigon-server-detect.yaml b/http/technologies/erigon-server-detect.yaml new file mode 100644 index 0000000000..a80660cb4e --- /dev/null +++ b/http/technologies/erigon-server-detect.yaml @@ -0,0 +1,39 @@ +id: erigon-server + +info: + name: Erigon JSON-RPC HTTP Server Detect + author: Nullfuzz + severity: info + description: | + Erigon is an implementation of Ethereum (execution layer with embeddable consensus layer). By default Erigon runs a JSON-RPC HTTP server on port 8545/TCP + reference: + - https://github.com/ledgerwatch/erigon + metadata: + max-request: 1 + shodan-query: product:"Erigon" + tags: tech,erigon,ethereum,web3,blockchain + +http: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + Content-Length: 66 + + {"method":"web3_clientVersion","params":[],"id":1,"jsonrpc":"2.0"} + + matchers: + - type: dsl + dsl: + - 'status_code == 200' + - 'contains(header, "application/json")' + - 'contains(body, "erigon")' + condition: and + + extractors: + - type: regex + part: body + group: 1 + regex: + - '(erigon/[0-9_.]+)' \ No newline at end of file