id: weblogic-iiop-detect

info:
  name: Weblogic IIOP Protocol Detection
  author: F1tz
  severity: info
  description: |
    The IIOP (Internet Inter-ORB Protocol) protocol makes it possible for distributed programs written in different programming languages to communicate over the Internet.
  metadata:
    max-request: 1
  tags: network,weblogic,detect,oracle,iiop,detection,tcp,discovery
tcp:
  - inputs:
      - data: "{{hex_decode('47494f50010200030000001700000002000000000000000b4e616d6553657276696365')}}"
    host:
      - "{{Hostname}}"
    read-size: 1024

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "GIOP"
          - "weblogic"
        condition: and
# digest: 4a0a004730450220033098dc3746ae59ece7e250776c6264b998311336e5eef0e368ad00a9721a86022100cf3295d9441dc62fc98bfb0465655ad36ceecccaebf76b7090317fb945607e0c:922c64590222798bb761d5b6d8e72950