id: rdp-detect

info:
  name: RDP - Detection
  author: pussycat0x
  severity: info
  description: |
    Detects if a target host is running Remote Desktop Protocol (RDP) service on port 3389. This template helps identify Windows systems that have RDP enabled, which is commonly used for remote administration but can also be a security risk if not properly secured.
  metadata:
    verified: true
    max-request: 1
    shodan-query: port:"3389"
  tags: js,network,rdp,info,enum

javascript:
  - code: |
      let m = require('nuclei/rdp');
      let response = m.IsRDP(Host,Port);
      Export(response);

    args:
      Host: "{{Host}}"
      Port: "3389"

    matchers:
      - type: dsl
        dsl:
          - 'success == true'
          - 'contains(response, "\"IsRDP\": true")'
        condition: and
# digest: 490a0046304402201297e2580c84dd53bb84ad8220622e45f87e88b60c13791fc908150da4f83ba102201a343170fe7860ac27146c31375ea9a7e4c5221ad0f39946b32d5ab7c91e458c:922c64590222798bb761d5b6d8e72950