nuclei-templates/network/weblogic-t3-detect.yaml

43 lines
954 B
YAML

id: weblogic-t3-detect
info:
name: Detect Weblogic T3 Protocol
author: F1tz,milo2012,wdahlenb
severity: info
tags: network,weblogic
description: |
T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.
network:
- inputs:
- data: "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n"
host:
- "{{Hostname}}"
read-size: 1024
matchers:
- type: word
words:
- "HELO"
extractors:
- type: regex
part: body
group: 1
regex:
- "HELO:(.*).false"
- inputs:
- data: "t3s 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n"
host:
- "tls://{{Hostname}}"
read-size: 1024
matchers:
- type: word
words:
- "HELO"
extractors:
- type: regex
part: body
group: 1
regex:
- "HELO:(.*).false"