id: ghe-encrypt-saml

info:
  name: GitHub Enterprise - Encrypted SAML
  author: rootxharsh,iamnoooob,pdresearch
  severity: info
  description: |
    This template checks if Encrypted SAML (Security Assertion Markup Language) is enabled on a GitHub Enterprise instance.
  reference:
    - https://docs.github.com/en/enterprise-server@3.10/admin/managing-iam/using-saml-for-enterprise-iam/enabling-encrypted-assertions
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"GitHub Enterprise"
  tags: github,ghe,saml,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/saml/metadata"

    redirects: true
    max-redirects: 2

    matchers:
      - type: word
        part: body
        words:
          - EntityDescriptor
          - KeyDescriptor
          - use="encryption"
        condition: and
# digest: 490a0046304402206417dd7f6e51699453529b9fc5aed80ff1b159342cd4874fc00ea40f1c4e52aa0220381dde6e6c14bcaf0db0f7098646315212cd26cc3a97aff47b9d1fe5e7b9ba21:922c64590222798bb761d5b6d8e72950