id: tableau-server-detect

info:
  name: Salesforce Tableau Server - Detect
  author: TechbrunchFR,aringo
  severity: info
  description: |
    Detects Salesforce Tableau Server and extracts the buildid.
  metadata:
    max-request: 1
    vendor: salesforce
    product: tableau_server
    shodan-query:
      - product:"Tableau Server"
      - "X-Tableau: Tableau Server"
      - "Server: Tableau"
      - http.favicon.hash:-1441956789
    fofa-query:
      - "X-Tableau: Tableau Server"
      - server=="Tableau"
      - icon_hash="-1441956789"
    zoomeye-query: app:"Tableau Server"
  tags: tech,detect,tableau,salesforce,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: or
    matchers:
      - type: word
        part: header
        words:
          - "X-Tableau: Tableau Server"
          - "Server: Tableau"
        condition: or

      - type: word
        part: body
        words:
          - "VizPortalRun"
          - "vizportal"
        condition: or

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'data-build[iI]d="([0-9a-z_]*)'
# digest: 490a00463044022012d7ae6ddfa17a81ab45a67057220c3496a2b982f24c2c9f5719f646454b768c022073a31f59aec0f285dac09d2e921d01578fa46c2ff05eb7a4bccb312806eba04f:922c64590222798bb761d5b6d8e72950