id: jfrog-login

info:
  name: JFrog Login Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: |
    JFrog login panel was detected.
  reference:
    - https://www.exploit-db.com/ghdb/6797
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cwe-id: CWE-200
    cpe: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: "http.title:\"JFrog\""
    product: artifactory
    vendor: jfrog
  tags: panel,jfrog,edb,detect,login

http:
  - method: GET
    path:
      - '{{BaseURL}}/ui/login/'
      - '{{BaseURL}}/ui/favicon.ico'

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code==200 && contains(body, "<title>JFrog")'
          - "status_code==200 && (\"-595620639\" == mmh3(base64_py(body)))"
        condition: or
# digest: 490a0046304402207c323aa3932b6fd0d9368278a868b7b319c7ab7620c4bc753c84d63cbbfd6a3e022079df7848a2e617491649de4fd5a5a7938e02f3ac3216acc7b24a04407af8a8bc:922c64590222798bb761d5b6d8e72950