43 lines
1.6 KiB
YAML
43 lines
1.6 KiB
YAML
id: bgp-detect
|
|
|
|
info:
|
|
name: BGP Detection
|
|
author: danfaizer
|
|
severity: info
|
|
description: |
|
|
The remote host is running BGP, a popular routing protocol. This indicates that the remote host is probably a network router.
|
|
reference:
|
|
- https://www.acunetix.com/vulnerabilities/network/vulnerability/bgp-detection/
|
|
- https://www.tenable.com/plugins/nessus/11907
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
|
|
cwe-id: CWE-200
|
|
metadata:
|
|
max-request: 1
|
|
shodan-query: product:"BGP"
|
|
tags: network,bgp,detect,detection,tcp
|
|
|
|
tcp:
|
|
- inputs:
|
|
- data: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF001D010400FFFF0000B4C0
|
|
type: hex
|
|
# Source: https://www.rfc-editor.org/rfc/rfc4271.html#section-4.2
|
|
# FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF represents the 16-byte marker field.
|
|
# 001D is the total length of the BGP message, including the 19 bytes of the header and the optional parameters.
|
|
# 01 is the BGP message type, which is OPEN (1).
|
|
# 04 represents the BGP version, which is BGP-4.
|
|
# FFFF represents the Autonomous System Number (ASN) in hexadecimal format.
|
|
# 0000 represents the Hold Time.
|
|
# B4C0 represents the BGP Identifier, usually an IP address in hexadecimal format.
|
|
|
|
host:
|
|
- "{{Hostname}}"
|
|
port: 179
|
|
|
|
read-size: 16
|
|
matchers:
|
|
- type: word
|
|
encoding: hex
|
|
words:
|
|
- "ffffffffffffffffffffffffffffffff"
|
|
# digest: 4a0a00473045022100e0c255038d1e5630b5a38022ee93cc716e6d57e8f601b02791fad2ebfd205a43022014d99b248cddeeb77cb60cd7ee0221345e0d104861ba91e9e59b3bbb1bf46b20:922c64590222798bb761d5b6d8e72950 |