id: viper-c2

info:
  name: Viper C2 - Detect
  author: pussycat0x
  severity: info
  description: |
    Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetration.
  reference:
    - https://twitter.com/MichalKoczwara/status/1635724410274414596
  metadata:
    censys-query: 057f3b5488605b4d224d038e340866e2cdfed4a3
    max-request: 1
    shodan-query: http.html_hash:1015055567
    verified: "true"
  tags: tech,viper,c2,malware,ir,panel

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 404"
          - "(\"057f3b5488605b4d224d038e340866e2cdfed4a3\" == sha1(body))"
        condition: and
# digest: 4a0a00473045022100d611d7a526bfb1c041ade83ada99949e2306854350ec715f40beba72ec98b6b10220406bc07f5bb48c3398fe534d989b2ab250b58eddc9592bb4933702801b491073:922c64590222798bb761d5b6d8e72950