id: mikrotik-routeros-api

info:
  name: MikroTik RouterOS API Detection
  author: pussycat0x
  severity: info
  description: |
    Application Programmable Interface (API) allows users to create custom software solutions to communicate with RouterOS to gather information, adjust the configuration, and manage the router. API closely follows syntax from the command-line interface (CLI). It can be used to create translated or custom configuration tools to aid ease of use running and managing routers with RouterOS.
  metadata:
    verified: true
    shodan-query: product:"MikroTik RouterOS API Service"
  tags: network,mikrotik

network:
  - inputs:
      - data: "3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000"
        type: hex

    host:
      - "{{Hostname}}"
      - "{{Host}}:8728"

    matchers:
      - type: word
        encoding: hex
        words:
          - "0621666174616c0d6e6f74206c6f6767656420696e00"