id: cisco-webvpn-detect
info:
  name: CISCO WebVPN detect
  author: ricardomaia
  severity: info
  reference:
    - https://askanydifference.com/difference-between-cisco-clientless-ssl-vpn-and-anyconnect-with-table/
  tags: panel,cisco,vpn
  metadata:
    fofa-query: fid="U1TP/SJklrT9VLIEpZkQNg=="
    google-query: intitle:"SSLVPN Service"

requests:
  - method: GET
    redirects: true
    max-redirects: 2
    stop-at-first-match: true
    matchers-condition: and
    path:
      - "{{BaseURL}}/webvpn.html"
      - "{{BaseURL}}"
    matchers:
      - type: word
        case-insensitive: true
        condition: or
        part: body
        words:
          - "CISCO"
          - "AnyConnect"
          - "SSLVPN Service"
      - type: regex
        part: header
        condition: or
        regex:
          - "webvpncontext=00@.+"
          - "webvpn="