From d6b4f7616622657798d39123727a919d30f87926 Mon Sep 17 00:00:00 2001
From: Dominique RIGHETTO <righettod@users.noreply.github.com>
Date: Fri, 9 Aug 2024 07:24:12 +0200
Subject: [PATCH] Update axway-api-manager-panel.yaml

---
 .../axway-api-manager-panel.yaml              | 31 ++++++++++++-------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/http/exposed-panels/axway-api-manager-panel.yaml b/http/exposed-panels/axway-api-manager-panel.yaml
index dedac60d4d..ddcfb6dfa5 100644
--- a/http/exposed-panels/axway-api-manager-panel.yaml
+++ b/http/exposed-panels/axway-api-manager-panel.yaml
@@ -2,27 +2,36 @@ id: axway-api-manager-panel
 
 info:
   name: Axway API Manager Panel - Detect
-  author: johnk3r
+  author: johnk3r,righettod
   severity: info
+  description: Axway API Manager panel was detected.
+  reference:
+    - https://docs.axway.com/bundle/axway-open-docs/page/docs/index.html
+    - https://www.postman.com/api-evangelist/axway/api/06c40de2-3954-4c68-ae10-a7eded330b05
+    - https://www.postman.com/api-evangelist/axway/api/ce2ac156-4353-46b9-b148-944ab7721ed6
   metadata:
     verified: true
     max-request: 1
     shodan-query: http.title:"Axway API Manager Login"
-  tags: panel,axway,detect
+  tags: panel,axway,detect,login
 
 http:
   - method: GET
     path:
+      - "{{BaseURL}}/api/portal/v1.4/appinfo"
       - "{{BaseURL}}"
 
-    matchers-condition: and
+    stop-at-first-match: true
     matchers:
-      - type: word
-        part: body
-        words:
-          - "Axway API Manager Login</title>"
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_any(to_lower(body), "axway api manager login", "vordel/apiportal/app-login", "api manager", "api portal")'
+        condition: and
 
-      - type: status
-        status:
-          - 200
-# digest: 4b0a004830460221009806e6b46f0d419351aea507da113cdc16e7d0bb46d91d3356f8404c5aacd303022100d97a07a55afba6cc59ae9c4884f13cdff91afe76fb8f880dfe067c7e963d6920:922c64590222798bb761d5b6d8e72950
\ No newline at end of file
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - '"productVersion":\s*"([0-9.]+)"'