id: weblogic-t3-detect

info:
  name: Weblogic T3 Protocol Detection
  author: F1tz,milo2012,wdahlenb
  severity: info
  description: |
    T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.
  metadata:
    max-request: 2
  tags: network,weblogic,detect
tcp:
  - inputs:
      - data: "t3 12.2.1

          AS:255

          HL:19

          MS:10000000

          PU:t3://us-l-breens:7001

          \n"
    host:
      - "{{Hostname}}"
    read-size: 1024
    matchers:
      - type: word
        words:
          - "HELO"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "HELO:(.*).false"

  - inputs:
      - data: "t3s 12.2.1

          AS:255

          HL:19

          MS:10000000

          PU:t3://us-l-breens:7001

          \n"
    host:
      - "tls://{{Hostname}}"
    read-size: 1024
    matchers:
      - type: word
        words:
          - "HELO"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "HELO:(.*).false"

# digest: 4a0a00473045022100ebbf55b455618f9581f0c6ce07904611f85cd24bfb7b8f61f221f1553df92da302203242dd9102bd984a530e54b8d8b396f5c1c82c093995af9e54f1bd7355b23c4a:922c64590222798bb761d5b6d8e72950