Update unauth-ztp-ping.yaml

http/vulnerabilities/zyxel/unauth-ztp-ping.yaml

@@ -1,7 +1,9 @@
 id: unauth-ztp-ping
 
 info:
-  name: ZyXEL USG ZTP Lack of Authentication
+  name: Unauthenticated ZyXEL USG ZTP - Detect
+  author: dmartyn
+  severity: high
   description: |
     Make a ZyXEL USG with ZTP support, pre CVE-2023-28771 patch, do a DNS lookup by asking it to make an ICMP request.
     This template can be used to detect hosts potentially vulnerable to CVE-2023-28771, CVE-2022-30525, and other issues, without actually exploiting the vulnerability.
@@ -10,24 +12,32 @@ info:
     - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls
   metadata:
     verified: "true"
-  author: dmartyn
+    shodan-query: title:"USG FLEX"
-  severity: medium
+  tags: misconfig,unauth,zyxel,ztp,rce,oast
-  tags: misconfig,unauth,zyxel,ztp
 
-requests:
+http:
   - raw:
-      - | # try resolve
+      - |
         POST /ztp/cgi-bin/handler HTTP/1.1
         Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Content-Type: application/json
-        Connection: close
 
         {"command":"ping","dest":"{{interactsh-url}}"}
 
-
+    matchers-condition: and
     matchers:
       - type: word
-        part: interactsh_protocol # Confirms the DNS Interaction
+        part: interactsh_protocol
         words:
           - "dns"
+
+      - type: word
+        part: body
+        words:
+          - "message"
+          - "result"
+        condition: and
+
+      - type: status
+        status:
+          - 200