id: ibm-api-connect-detect

info:
  name: IBM API Connect Developer Portal - Detect
  author: righettod
  severity: info
  description: IBM API Connect Developer Portal was detected.
  reference:
    - https://github.com/ibm-apiconnect/devportal
    - https://www.ibm.com/products/api-connect/developer-portal
  metadata:
    verified: true
    max-request: 3
    shodan-query: http.favicon.hash:"801517258"
  tags: tech,ibm,detect,discovery

http:
  - method: GET
    path:
      - '{{BaseURL}}'
      - '{{BaseURL}}/favicon.ico'
      - '{{BaseURL}}/modules/ibm_apim/ibm_apim.info.yml'

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(to_lower(body), "ibm developer portal is ready", "package: ibm api developer")'
          - '("801517258" == mmh3(base64_py(body)))'
        condition: or

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '(?i)version:\s+([0-9a-z\-_.]+)'
# digest: 4b0a0048304602210085df78f0db113b32422c2af3c17d22dd9b2dc667e5cdd321358522d22c610278022100a91a39e037ff28dafc6b4014974f1ee848bded97bf09933b278fc725198f1856:922c64590222798bb761d5b6d8e72950