id: authentik-panel

info:
  name: Authentik Panel - Detect
  author: rxerium
  severity: info
  description: |
    An Authentik search engine was detected.
  reference:
    - https://github.com/searxng/searxng
  metadata:
    max-request: 1
    verified: true
    shodan-query: http.favicon.hash:-178113786
  tags: authentik,sso,mfa,panel,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/static/dist/assets/icons/icon.png"

    host-redirects: true
    max-redirects: 2
    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "<title>authentik</title>"
          - "window.authentik"
          - "authentik.css"
        condition: or
        case-insensitive: true

      - type: dsl
        dsl:
          - "(\"-178113786\" == mmh3(base64_py(body)))"
# digest: 490a00463044022038c31ff743d4cfdf6c50ec1af600e3f2dd91a108f4c2f1f27fdee3703e5defdd02205067c3bb33dab84fe219323047f9d65c3be1abe7f7b1670b3423230693cf3316:922c64590222798bb761d5b6d8e72950