id: nexpose-panel

info:
  name: Rapid7 Nexpose VM Security Console - Detect
  author: johnk3r
  severity: info
  description: |
    Rapid7 Nexpose VM Security Console login panel was detected.
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-516760689
  tags: nexpose,panel,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.jsp"

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "Security Console")'
          - 'contains(body, "nexposeccusername")'
          - status_code == 200
        condition: and

    extractors:
      - type: kval
        part: header
        kval:
          - Server
# digest: 4b0a004830460221008291b1a0e1dd6a5184eef02d05168118493e23a3b4f3725c93d6982679fac05e02210097b10675fd9ec1f539f880a00717bbb29ebe638cad9637d17623beeba312ef0d:922c64590222798bb761d5b6d8e72950