id: cisco-ise-admin-panel

info:
  name: Cisco ISE Admin Login Panel - Detect
  author: bhutch
  severity: info
  description: |
    Cisco Identity Services Engine (ISE) admin login panel was discovered.
  metadata:
    verified: true
    max-request: 1
    shodan-query:
      - html:"Identity Services Engine"
      - '"Set-Cookie: APPSESSIONID=" "Path=/admin"'
      - http.favicon.hash:-945076912
      - http.favicon.hash:-12304266
    fofa-query:
      - body="Identity Services Engine"
      - '"Set-Cookie: APPSESSIONID=" && "Path=/admin"'
      - icon_hash="-945076912"
      - icon_hash="-12304266"
  tags: cisco,ise,admin,login,panel,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/login.jsp"

    matchers:
      - type: dsl
        dsl:
          - status_code == 200 && contains(body, "document.title =\'Identity Services Engine\';")
          - status_code == 403 && contains(body, "<title>Identity Services Engine</title>")

    extractors:
      - type: regex
        name: extracted_unix_timestamp
        part: body
        regex:
          - "\\?_isever=(\\d{10})"
        group: 1
        internal: true

      - type: dsl
        name: extracted_date
        dsl:
          - "date_time('%Y-%M-%D', extracted_unix_timestamp)"
# digest: 490a004630440220065a9785dca6cb4adda4149dc9f329e668fbd80165954721c1e7e51e086a5f47022040c515ceb3d658be3c0c7561b5fab70812b224747cc36d79eed12e6524fd75fb:922c64590222798bb761d5b6d8e72950