id: teleport-login-panel

info:
  name: Teleport Login Panel - Detect
  author: pdteam,mahmoud0x00
  severity: info
  description: |
    Detects Teleport web login interface exposed at /web/login and version information from /webapi/ping
  reference:
    - https://github.com/gravitational/teleport
  metadata:
    verified: true
    max-request: 1
    shodan-query:
      - http.favicon.hash:544208100
      - http.favicon.hash:1854879765
      - http.favicon.hash:-1275955539
      - "Set-Cookie: __Host-grv_csrf"
    fofa-query:
      - icon_hash="544208100"
      - icon_hash="1854879765"
      - icon_hash="-1275955539"
      - "Set-Cookie: __Host-grv_csrf"
  tags: panel,teleport,login,oss,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapi/ping"

    matchers:
      - type: regex
        part: body
        regex:
          - '"server_version"\s*:\s*"\d+\.\d+\.\d+"'
          - 'teleport'
        condition: and

    extractors:
      - type: json
        json:
          - '"Version: " +.server_version'
# digest: 4b0a00483046022100e7d38f4ce643eaa775f9b0f5f9e815b35d253b8a92f977c3e89571556f31d6c9022100cf4964ef2f66eca38ec844286a2fab80307e055666fbd8c4038843767bf01ac3:922c64590222798bb761d5b6d8e72950