id: weblogic-t3-detect

info:
  name: Weblogic T3 Protocol Detection
  author: F1tz,milo2012,wdahlenb
  severity: info
  description: |
    T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.
  impact: |
    May indicate potential exposure to Weblogic T3 Protocol vulnerabilities
  remediation: |
    Ensure proper configuration and security measures are in place for Weblogic T3 Protocol
  metadata:
    max-request: 2
  tags: network,weblogic,detect,t3,oracle,detection,tcp,discovery

tcp:
  - inputs:
      - data: "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n"
    host:
      - "{{Hostname}}"
    port: 7001
    read-size: 1024
    matchers:
      - type: word
        words:
          - "HELO"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "HELO:(.*).false"

  - inputs:
      - data: "t3s 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n"
    host:
      - "tls://{{Hostname}}"
    read-size: 1024
    port: 7002
    matchers:
      - type: word
        words:
          - "HELO"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "HELO:(.*).false"
# digest: 4b0a00483046022100f3ac61f765ce04edb88c96dff7d288dd46039ad73023b4cf79a1c41a1a9ed448022100d8d67bc7ba545e4cfaf4d2e9e81dcd045f34c8613e3059fd9781a68f7a4752cf:922c64590222798bb761d5b6d8e72950