id: spnego-detect

info:
  name: SPNEGO - Detect
  author: lady_bug,ruppde
  severity: info
  description: |
    SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. It is a protocol used for secure authentication and negotiation between client and server applications in a network environment. SPNEGO is based on the Generic Security Services Application Programming Interface (GSSAPI) framework.
  reference:
    - https://www.ibm.com/docs/en/was-liberty/core?topic=authentication-single-sign-http-requests-using-spnego-web
    - https://arstechnica.com/information-technology/2022/12/critical-windows-code-execution-vulnerability-went-undetected-until-now/
  metadata:
    verified: true
    max-request: 1
    shodan-query: 'www-authenticate: negotiate'
  tags: miscellaneous,misc,windows,spnego

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 5

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(header), 'www-authenticate: negotiate')"

    extractors:
      - type: kval
        kval:
          - 'www_authenticate'
# digest: 4b0a00483046022100f236927bebb32b4de51aec515f85bb81c89d1d9dae35f3fa3ec3a735d4f39fdf022100ab94f81f93fc35de1c68d785355bc288905c59a934455b8011dfe32d8d3de4c0:922c64590222798bb761d5b6d8e72950