id: polarion-siemens-panel

info:
  name: Polarion Siemens Login - Panel
  author: Th3l0newolf
  severity: info
  description: |
    Detects the exposed Polarion Siemens login page.
  reference:
    - https://polarion.plm.automation.siemens.com/
  metadata:
    verified: true
    shodan-query:
      - http.favicon.hash:-1135703796
      - http.favicon.hash:707299418
  tags: polarion,siemens,login,panel,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/polarion/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Polarion AG"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - "buildId=([\\d\\w\\-\\_]+)\""
# digest: 4a0a00473045022100bf34a6ebe7eed997324babf7fc510d30a9101a3f0c774140542fd6e0c2e64c3f02205d35e7e0b3455bd31521a70f5a37b6a821025c1f17de0541e4cd052f9333b770:922c64590222798bb761d5b6d8e72950