id: cyber-stealer-panel

info:
  name: Cyber Stealer C2 Panel - Detect
  author: pussycat0x
  severity: info
  description: |
    Cyber Stealer C2 Login Panel was discovered.
  reference:
    - https://x.com/solostalking/status/1947143367336534254
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Cyber Stealer - Secure Access"
    fofa-query: title="Cyber Stealer - Secure Access"
  tags: c2,cyber-stealer,stealer,panel,login,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/webpanel/panel/login.php"

    host-redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>Cyber Stealer - Secure Access"

      - type: status
        status:
          - 200
# digest: 490a0046304402203fdf7b1ac858dfa280a6df0b6ee525786b27452ab35b77c07f94d425680ea5dd022001e26a41666a4e2f6b54ba4f13e16265cba134eeb546fa5ac723602bc81d878c:922c64590222798bb761d5b6d8e72950