From 5fc755c56141e35a453967bb51e9bf06962e3f4e Mon Sep 17 00:00:00 2001 From: GwanYeong Kim Date: Tue, 25 Jan 2022 11:23:11 +0900 Subject: [PATCH 1/2] Create gnuboard-cms-detect.yaml Signed-off-by: GwanYeong Kim --- technologies/gnuboard-cms-detect.yaml | 32 +++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 technologies/gnuboard-cms-detect.yaml diff --git a/technologies/gnuboard-cms-detect.yaml b/technologies/gnuboard-cms-detect.yaml new file mode 100644 index 00000000000..696eef83a69 --- /dev/null +++ b/technologies/gnuboard-cms-detect.yaml @@ -0,0 +1,32 @@ +id: gnuboard-cms-detect + +info: + name: Gnuboard CMS Detect + author: gy741 + severity: info + description: Detects Gnuboard CMS + tags: tech,gnuboard + reference: https://sir.kr/ + +requests: + - method: GET + path: + - "{{BaseURL}}/LICENSE.txt" + - "{{BaseURL}}/perms.sh" + - "{{BaseURL}}/bbs/ajax.filter.php" + + matchers-condition: or + matchers: + - type: word + part: body + words: + - 'GNU Board' + - 'Complete change permissions' + condition: or + + - type: word + part: body + words: + - 'subject' + - 'content' + condition: and From 810330917a508d07b7061b85fcd89bdff46b2a9a Mon Sep 17 00:00:00 2001 From: Prince Chaddha Date: Tue, 25 Jan 2022 12:44:35 +0530 Subject: [PATCH 2/2] Update and rename gnuboard-cms-detect.yaml to gnuboard-detect.yaml --- ...d-cms-detect.yaml => gnuboard-detect.yaml} | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) rename technologies/{gnuboard-cms-detect.yaml => gnuboard-detect.yaml} (62%) diff --git a/technologies/gnuboard-cms-detect.yaml b/technologies/gnuboard-detect.yaml similarity index 62% rename from technologies/gnuboard-cms-detect.yaml rename to technologies/gnuboard-detect.yaml index 696eef83a69..d52656d7bd7 100644 --- a/technologies/gnuboard-cms-detect.yaml +++ b/technologies/gnuboard-detect.yaml @@ -1,32 +1,35 @@ -id: gnuboard-cms-detect +id: gnuboard-detect info: name: Gnuboard CMS Detect author: gy741 severity: info description: Detects Gnuboard CMS - tags: tech,gnuboard reference: https://sir.kr/ + tags: tech,gnuboard requests: - method: GET path: - "{{BaseURL}}/LICENSE.txt" - - "{{BaseURL}}/perms.sh" - - "{{BaseURL}}/bbs/ajax.filter.php" - matchers-condition: or + matchers-condition: and matchers: - type: word part: body words: - 'GNU Board' - - 'Complete change permissions' - condition: or + - 'http://sir.kr' + condition: and - type: word - part: body + part: header words: - - 'subject' - - 'content' - condition: and + - 'text/plain' + + extractors: + - type: regex + part: body + group: 1 + regex: + - '\( GNU Board (.*) \)'