id: forticlientems-panel

info:
  name: FortiClient Endpoint Management Server Panel - Detect
  author: h4sh5
  severity: info
  classification:
    cpe: cpe:2.3:a:fortinet:forticlient_endpoint_management_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fortinet
    product: forticlient_endpoint_management_server
    shodan-query: http.favicon.hash:-800551065
  tags: panel,fortinet,forticlient,ems,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/signin"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "FortiClient Endpoint Management Server"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'VERSION_FULL\\u0022: \\u0022(.*?)\\u0022'
# digest: 4b0a0048304602210089a7fae8a34590225c3ec41efaf4dc2f7ae8f23db042d4ddffcdc8e80615e6f1022100997e0976d73a28e414ac8f5a0a125caddcc142a50b8cafd8b13ac053add33eb8:922c64590222798bb761d5b6d8e72950