id: viper-c2

info:
  name: Viper C2 - Detect
  author: pussycat0x
  severity: info
  description: |
    Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetration.
  reference:
    - https://twitter.com/MichalKoczwara/status/1635724410274414596
  metadata:
    verified: "true"
    max-request: 1
    shodan-query: http.html_hash:1015055567
    censys-query: 057f3b5488605b4d224d038e340866e2cdfed4a3
  tags: tech,viper,c2,malware,ir,panel,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 404"
          - "(\"057f3b5488605b4d224d038e340866e2cdfed4a3\" == sha1(body))"
        condition: and
# digest: 490a004630440220228bffa204666f4dc1e9482263e52765ff9e5a47fc8d8f426bf09e7ec2bc873602205739e0e357c709e0602779c4d1b5cb73b25ffeb3a8636295c39071a4e5ed4b6f:922c64590222798bb761d5b6d8e72950