id: sap-router-detect

info:
  name: SAProuter - Detect
  author: pussycat0x
  severity: info
  description: |
    The SAProuter is a proxy program that controls and secures communication between SAP systems and external networks.
  metadata:
    verified: true
    shodan-query: product:"SAProuter"
  tags: network,tcp,sap,tech,discovery

tcp:
  - inputs:
      - data: "00000000"
        type: hex

    host:
      - "{{Hostname}}"
    port: 3200

    read-size: 1024

    matchers:
      - type: word
        part: raw
        words:
          - "SAProuter"
          - "network interface"
        condition: and

    extractors:
      - type: regex
        regex:
          - "SAProuter ([0-9.]+)"
# digest: 4a0a0047304502204ee92b7e0b901ce3a8f6b7d79e1c38970cdca7e587c2e4f1df9f5a745a22236c022100def425430e4f16827dc806adb7a61bcf385d2128831546c21a7fc8626a24a459:922c64590222798bb761d5b6d8e72950