id: nexpose-panel

info:
  name: Rapid7 Nexpose VM Security Console - Detect
  author: johnk3r
  severity: info
  description: |
    Rapid7 Nexpose VM Security Console login panel was detected.
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-516760689
  tags: nexpose,panel,login,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.jsp"

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "Security Console")'
          - 'contains(body, "nexposeccusername")'
          - status_code == 200
        condition: and

    extractors:
      - type: kval
        part: header
        kval:
          - Server
# digest: 4b0a00483046022100d41151f3f096285c71bcba180046df27ef07888268df181bc3c0e92266f1167f022100d7189b05e8cd18b206def07ffce1f78591a500f5d27e4078793a45250eaa786f:922c64590222798bb761d5b6d8e72950