From f953aca2879df362c8f0ec25b592033615d00232 Mon Sep 17 00:00:00 2001
From: johnk3r <johnatan2camargo@gmail.com>
Date: Sat, 30 Sep 2023 05:21:24 -0300
Subject: [PATCH] Create wsftp-detect.yaml (#8285)

* Create wsftp-detect.yaml

* Update and rename wsftp-detect.yaml to wsftp-ssh-detect.yaml

* Update and rename wsftp-ssh-detect.yaml to ws_ftp-ssh-detect.yaml

* Create ws_ftp-server-web-transfer.yaml

* misc update

* Update ws_ftp-server-web-transfer.yaml

* Update ws_ftp-ssh-detect.yaml

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
---
 .../ws_ftp-server-web-transfer.yaml           | 38 +++++++++++++++++++
 network/detection/ws_ftp-ssh-detect.yaml      | 34 +++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 http/exposed-panels/ws_ftp-server-web-transfer.yaml
 create mode 100644 network/detection/ws_ftp-ssh-detect.yaml

diff --git a/http/exposed-panels/ws_ftp-server-web-transfer.yaml b/http/exposed-panels/ws_ftp-server-web-transfer.yaml
new file mode 100644
index 0000000000..d4bd5e7f02
--- /dev/null
+++ b/http/exposed-panels/ws_ftp-server-web-transfer.yaml
@@ -0,0 +1,38 @@
+id: ws_ftp-server-web-transfer
+
+info:
+  name: WS_FTP Server Web Transfer - Panel Detect
+  author: johnk3r
+  severity: info
+  description: WS_FTP Server Web Transfer panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: progress
+    product: ws_ftp
+    shodan-query: http.title:"WS_FTP Server Web Transfer"
+  tags: panel,ws_ftp
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    host-redirects: true
+    max-redirects: 3
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'WS_FTP Server Web Transfer Client'
+        condition: and
+
+      - type: status
+        status:
+          - 200
diff --git a/network/detection/ws_ftp-ssh-detect.yaml b/network/detection/ws_ftp-ssh-detect.yaml
new file mode 100644
index 0000000000..91a69ce616
--- /dev/null
+++ b/network/detection/ws_ftp-ssh-detect.yaml
@@ -0,0 +1,34 @@
+id: ws_ftp-ssh-detect
+
+info:
+  name: WS_FTP-SSH Service - Detect
+  author: johnk3r
+  severity: info
+  description: |
+    WS_FTP-SSH service was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: progress
+    product: ws_ftp
+    shodan-query: "WS_FTP port:22"
+  tags: network,ssh,ws_ftp
+
+tcp:
+  - host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)WS_FTP-SSH'
+
+    extractors:
+      - type: regex
+        regex:
+          - '(?i)SSH-(.*)-WS_FTP-SSH[^\r]+'