id: pingaccess-detect

info:
  name: PingAccess - Detect
  author: rxerium
  severity: info
  description: |
    PingAccess is an identity-aware access management proxy. A PingAccess response page was detected.
  reference:
    - https://www.pingidentity.com/en/resources/downloads/pingaccess.html
  metadata:
    verified: true
    max-request: 1
    vendor: pingidentity
    product: pingaccess
    shodan-query: http.html:"/pingaccess/assets/css/main.css"
  tags: tech,pingaccess,identity

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '/pingaccess/assets/css/main.css'
          - '/pingaccess/assets/images/favicon.ico'
        condition: and

      - type: status
        status:
          - 403
# digest: 4a0a00473045022100f7786e62e91bc8c29cb82ff189783426b1ec9701b1a912378dabd1be6c007adb02205e59d7ad205a4c131de75e3761b113f14bd6b3b75867dbfae15b0673049484c6:922c64590222798bb761d5b6d8e72950