Skip to content

Commit

Permalink
Added AMTHoneypot and generic confluence sigs
Browse files Browse the repository at this point in the history
  • Loading branch information
referefref authored Feb 20, 2024
1 parent 3edded2 commit 5d738dc
Showing 1 changed file with 26 additions and 0 deletions.
26 changes: 26 additions & 0 deletions signatures.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -231,3 +231,29 @@ signatures:
output: ""
invert_match: false
confidence: "High"

- name: "AMTHoneypot"
id: 19
port: 16992
proto: TCP
steps:
- input_type: string
input: "GET /invalid.htm HTTP/1.0\nHost: localhost\n\n"
output_match_type: string
output: "Content-Length: 767"
invert_match: false
confidence: "High"
comment: "Hardcoded login failure message without login failure"

- name: "Confluence Generic"
id: 20
port: "web-ports"
proto: TCP
steps:
- input_type: string
input: ""
output_match_type: string
output: "JSESSIONID=145DF9C4CDE560B2699212"
invert_match: false
confidence: "High"
comment: "Common JSESSIONID detected as per blog: https://vulncheck.com/blog/too-many-honeypots"

0 comments on commit 5d738dc

Please sign in to comment.