id: ibm-api-connect-detect

info:
  name: IBM API Connect Developer Portal - Detect
  author: righettod
  severity: info
  description: IBM API Connect Developer Portal was detected.
  reference:
    - https://github.com/ibm-apiconnect/devportal
    - https://www.ibm.com/products/api-connect/developer-portal
  metadata:
    verified: true
    max-request: 3
    shodan-query: http.favicon.hash:"801517258"
  tags: tech,ibm,detect

http:
  - method: GET
    path:
      - '{{BaseURL}}'
      - '{{BaseURL}}/favicon.ico'
      - '{{BaseURL}}/modules/ibm_apim/ibm_apim.info.yml'

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(to_lower(body), "ibm developer portal is ready", "package: ibm api developer")'
          - '("801517258" == mmh3(base64_py(body)))'
        condition: or

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '(?i)version:\s+([0-9a-z\-_.]+)'
# digest: 490a004630440220559f6c37268b2fe435d4755401347da616ee781aa816798c464218c219260ac5022023a483066f4c41790fbf60efd8931cc68c73fe4f611e179b2be040570cfdddac:922c64590222798bb761d5b6d8e72950