id: tableau-server-detect

info:
  name: Salesforce Tableau Server - Detect
  author: TechbrunchFR,aringo
  severity: info
  description: |
    Detects Salesforce Tableau Server and extracts the buildid.
  metadata:
    max-request: 1
    vendor: salesforce
    product: tableau_server
    shodan-query:
      - product:"Tableau Server"
      - "X-Tableau: Tableau Server"
      - "Server: Tableau"
      - http.favicon.hash:-1441956789
    fofa-query:
      - "X-Tableau: Tableau Server"
      - server=="Tableau"
      - icon_hash="-1441956789"
    zoomeye-query: app:"Tableau Server"
  tags: tech,detect,tableau,salesforce

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: or
    matchers:
      - type: word
        part: header
        words:
          - "X-Tableau: Tableau Server"
          - "Server: Tableau"
        condition: or

      - type: word
        part: body
        words:
          - "VizPortalRun"
          - "vizportal"
        condition: or

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'data-build[iI]d="([0-9a-z_]*)'
# digest: 4a0a00473045022100ab8a111582077e2fb8150aeb9b970c3227c6a3475391e2b447d54dbe1e853c8502205dfb75c1a964dfd606de88e6f069b5481f7eefb19c8d50bcc3dbd0b3ba394c67:922c64590222798bb761d5b6d8e72950