id: fortisiem-panel

info:
  name: FortiSIEM Login Panel - Detect
  author: pussycat0x
  severity: info
  description: FortiSIEM login panel was detected.
  classification:
    cpe: cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: "http.favicon.hash:-1341442175"
    product: fortisiem
    vendor: fortinet
  tags: panel,fortisiem
flow: http(1) && http(2)
http:
  - method: GET
    path:
      - "{{BaseURL}}/phoenix/login.html"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "(\"426d365a42bbc67c092b9c2e49b336420f0559d1\" == sha1(body))"
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/phoenix/js/login.min.js"

    matchers:
      - type: word
        words:
          - "fortiSIEM_current_login_salt"
# digest: 490a0046304402203d644778258aac373cae19503ef869c01107957203ea85904fe4b929e8b0377902207ff03722daa69de262bd68e3886773f7dfaabf6bb1683903dd87c2862fdc85f9:922c64590222798bb761d5b6d8e72950