id: bigip-detection info: name: BIGIP Cookie Detection author: PR3R00T severity: info reference: - https://www.intelisecure.com/how-to-decode-big-ip-f5-persistence-cookie-values - https://support.f5.com/csp/article/K23254150 tags: bigip,tech requests: - method: GET path: - "{{BaseURL}}" host-redirects: true matchers: - type: word part: header words: - 'BIGipServer~' extractors: - type: regex part: header group: 1 regex: - '(BIGipServer[a-z\_\.\-\~0-9A-Z]*)=([!a-z0-9A-Z/.=]+)'