id: nexpose-panel

info:
  name: Rapid7 Nexpose VM Security Console - Detect
  author: johnk3r
  severity: info
  description: |
    Rapid7 Nexpose VM Security Console login panel was detected.
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-516760689
  tags: nexpose,panel,login,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.jsp"

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "Security Console")'
          - 'contains(body, "nexposeccusername")'
          - status_code == 200
        condition: and

    extractors:
      - type: kval
        part: header
        kval:
          - Server
# digest: 4a0a004730450220736560aef3bdde3c02c8ebbcbba15397b408f71e95261bd2d12bb694952f89ba022100dd85eb60d84524cfa10d0e6ee0854b9c9e41fdb9c726131d610164eb6f3a9998:922c64590222798bb761d5b6d8e72950