id: sap-web-dispatcher-admin-portal

info:
  name: SAP Web Dispatcher admin portal detection
  author: randomstr1ng
  severity: info
  description: Detection of SAP Web Dispatcher Admin Portal
  metadata:
    max-request: 1
    shodan-query: http.favicon.hash:-266008933
    product: content_server
    vendor: sap
    fofa-query: icon_hash=-266008933
  tags: sap,webserver,proxy,tech

http:
  - method: GET
    host-redirects: true
    max-redirects: 2
    path:
      - "{{BaseURL}}/sap/wdisp/admin/public/default.html"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        condition: or
        words:
          - "Basic realm=\"WEB ADMIN\""
          - "SAP NetWeaver Application Server"

      - type: status
        condition: or
        status:
          - 401
          - 200

      - type: word
        part: body
        condition: or
        words:
          - "SAP Web Dispatcher"
          - "<title>Administration</title>"
# digest: 4a0a00473045022100a26ebad42d2fb7deabb0c798855aa17cf31b1b1aa31fb5a1d856676fe944899f0220606009f92e1384f7ce31c7df0c2d015c67a00a790f6d519e66e9d9594735ae0b:922c64590222798bb761d5b6d8e72950