id: teleport-login-panel

info:
  name: Teleport Login Panel - Detect
  author: pdteam,mahmoud0x00
  severity: info
  description: |
    Detects Teleport web login interface exposed at /web/login and version information from /webapi/ping
  reference:
    - https://github.com/gravitational/teleport
  metadata:
    verified: true
    max-request: 1
    shodan-query:
      - http.favicon.hash:544208100
      - http.favicon.hash:1854879765
      - http.favicon.hash:-1275955539
      - "Set-Cookie: __Host-grv_csrf"
    fofa-query:
      - icon_hash="544208100"
      - icon_hash="1854879765"
      - icon_hash="-1275955539"
      - "Set-Cookie: __Host-grv_csrf"
  tags: panel,teleport,login,oss

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapi/ping"

    matchers:
      - type: regex
        part: body
        regex:
          - '"server_version"\s*:\s*"\d+\.\d+\.\d+"'
          - 'teleport'
        condition: and

    extractors:
      - type: json
        json:
          - '"Version: " +.server_version'
# digest: 4a0a0047304502200720916a434efc5a213b83863d5da32e6dfe15f8295cc8bf28b420cae9bb9a590221008f547722390e1b6fa3ede7b65c2e1480b021d94219e10f4ee7144ca6fad78131:922c64590222798bb761d5b6d8e72950