id: spnego-detect

info:
  name: SPNEGO - Detect
  author: lady_bug,ruppde
  severity: info
  description: |
    SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. It is a protocol used for secure authentication and negotiation between client and server applications in a network environment. SPNEGO is based on the Generic Security Services Application Programming Interface (GSSAPI) framework.
  reference:
    - https://www.ibm.com/docs/en/was-liberty/core?topic=authentication-single-sign-http-requests-using-spnego-web
    - https://arstechnica.com/information-technology/2022/12/critical-windows-code-execution-vulnerability-went-undetected-until-now/
  metadata:
    verified: true
    max-request: 1
    shodan-query: 'www-authenticate: negotiate'
  tags: miscellaneous,misc,windows,spnego,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 5

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(header), 'www-authenticate: negotiate')"

    extractors:
      - type: kval
        kval:
          - 'www_authenticate'
# digest: 490a0046304402206d9d0dbda65563af5c334b6cc847b63d7f367877f60419a29da66b5c7cadf26d02204ed69816b0dbc9308b996c114c861ccef0af496aeedf8d35aae020ca84379b94:922c64590222798bb761d5b6d8e72950