id: cql-native-transport

info:
  name: CQL Native Transport Detect
  author: pussycat0x
  severity: info
  description: |
    Native transport requests (NTR) are any requests made via the CQL Native Protocol. CQL Native Protocol is the way the Cassandra driver communicates with the server.
  metadata:
    verified: true
    max-request: 1
    shodan-query: cassandra
  tags: network,cassandra,cql,detect,detection,tcp,discovery
tcp:
  - inputs:
      - data: "/n"
      - data: "/n"
      - data: "/n"
      - data: "/n"
      - data: "/n"
      - data: "/n"
      - data: "/n"
      - data: "/n"

    host:
      - "{{Hostname}}"
    port: 9042

    matchers:
      - type: word
        words:
          - "valid or unsupported protocol"

    extractors:
      - type: regex
        regex:
          - "protocol version: ([0-9]+)"
# digest: 490a00463044022073f7daf0c09d0e31a96dd627ae173e57f56e63791c1c5d53d21c92f8b1f205e602204f46bfe83fc3cef1520df153982a5cf57ebea3e75ce60909d6ba40053e46b7db:922c64590222798bb761d5b6d8e72950