id: fortinet-fortisandbox-panel

info:
  name: Fortinet FortiSandbox Panel - Detect
  author: Umut ÖZEN,rxerium
  severity: info
  description: |
    Fortinet FortiSandbox login panel was discovered.
  reference:
    - https://www.fortinet.com/products/sandbox/fortisandbox
    - https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiSandbox.pdf
  classification:
    cpe: cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fortinet
    product: fortisandbox
    shodan-query: title:"FortiSandbox"
  tags: panel,fortinet,fortisandbox,tech,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/fsa/login"
      - "{{BaseURL}}/ng/login?returnUrl=%2F"

    stop-at-first-match: true

    host-redirects: true
    max-redirects: 2

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "<title>FortiSandbox</title>"
          - "<span>FortiSandbox"
          - "fsa_login_logo"
          - "/images/fsa_logo"
          - "FortiSandbox"
        condition: or
        case-insensitive: true

      - type: regex
        part: header
        regex:
          - 'Set-Cookie: FSA_SESSION_ID='
# digest: 490a004630440220066b3d43b321748bc99e4e1293e928673a50e971313579ce9b8b8a0a901bfe6f02207439b50574944e5b77d606a4d8340b516411283e330ccb4addbbe000c6a45c8d:922c64590222798bb761d5b6d8e72950