Create rdp-detect.yaml

javascript/detection/rdp-detect.yaml

@@ -0,0 +1,29 @@
+id: rdp-detect
+
+info:
+  name: RDP - Detection
+  author: pussycat0x
+  severity: info
+  description: Detects if a target host is running Remote Desktop Protocol (RDP) service on port 3389. This template helps identify Windows systems that have RDP enabled, which is commonly used for remote administration but can also be a security risk if not properly secured.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: port:"3389"
+  tags: js,network,rdp,info,enum
+
+javascript:
+  - code: |
+      let m = require('nuclei/rdp');
+      let response = m.IsRDP(Host,Port);
+      Export(response);
+
+    args:
+      Host: "{{Host}}"
+      Port: "3389"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'success == true'
+          - 'contains(response, "\"IsRDP\": true")'
+        condition: and