id: honeypot-detect

info:
  name: Honeypot Detection
  author: j4vaovo
  severity: info
  description: |
    Honeypot was Detected.
  reference:
    - https://github.com/zema1/yarx
  metadata:
    max-request: 1
  tags: honeypot,tech,cti
variables:
  rand1: "{{randstr}}"
  rand2: "{{rand_int(11111, 99999)}}"
  rand3: "{{randstr}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/?{{rand1}}=../../../../../../../../etc/passwd&{{rand3}}=1%20and%20updatexml(1,concat(0x7e,(select%20md5({{rand2}}))),1)"

    matchers-condition: or
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: word
        part: body
        words:
          - '{{md5({{rand2}})}}'
# digest: 4b0a00483046022100aa9883d2e9d3256709a76ff4b1ce4da83883d74219622cc8d3bebe46ae5728ce0221009752868683c70e8c9e4566620673c456a0fbf62bde8534b0b08548b2b31b0d95:922c64590222798bb761d5b6d8e72950