id: jfrog-login

info:
  name: JFrog Login Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: |
    JFrog login panel was detected.
  reference:
    - https://www.exploit-db.com/ghdb/6797
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cwe-id: CWE-200
    cpe: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: "http.title:\"JFrog\""
    product: artifactory
    vendor: jfrog
  tags: panel,jfrog,edb,detect,login,discovery

http:
  - method: GET
    path:
      - '{{BaseURL}}/ui/login/'
      - '{{BaseURL}}/ui/favicon.ico'

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code==200 && contains(body, "<title>JFrog")'
          - "status_code==200 && (\"-595620639\" == mmh3(base64_py(body)))"
        condition: or
# digest: 4b0a00483046022100ff8067f3497f69e4ba9c668fe810f1c5d3c4f7cb9e432bcbeae7229a6b38619f022100a7adabe599ec058f98f2ac2ffc0d351d718d5c0f910fa5f719ab1d324ab78e3d:922c64590222798bb761d5b6d8e72950