id: zk-framework-detect

info:
  name: ZK Framework - Detect
  author: ErikOwen,Cursor
  severity: info
  description: |
    Detects the presence of ZK JavaFramework and attempts to extract its version.
  reference:
    - https://www.zkoss.org/
  classification:
    cpe: cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: zkoss
    product: zk_framework
    shodan-query: http.html:"zk.wpd" OR http.html:"<!-- ZK "
    fofa-query: body="zk.wpd" || body="<!-- ZK "
  tags: zk,zkoss,framework,detect,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    max-redirects: 4
    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "ZK Framework"
          - "zk.wpd"
          - "zkau/web"
          - "zkau/zkau"
          - "zkau/web/js/zk/zk.wpd"
          - "<!-- ZK "
        condition: or

      - type: regex
        part: body
        regex:
          - 'ZK Framework v?([0-9.]+)'
          - '<!-- ZK v?([0-9.]+) [\d\s\w]+ -->'
          - 'zkau/web/js/zk/zk\.wpd\?v=([0-9.]+)'
          - 'zkau/web/js/zk/zk\.js\?v=([0-9.]+)'

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'ZK Framework v?([0-9.]+)'
          - '<!-- ZK v?([0-9.]+) [\d\s\w]+ -->'
          - 'zkau/web/js/zk/zk\.wpd\?v=([0-9.]+)'
          - 'zkau/web/js/zk/zk\.js\?v=([0-9.]+)'
# digest: 490a00463044022018def4f2e102b4d7bfccb4101f58aaf6b2df49c993227ce7898cd11341203b3e022012f3e2204e058edd424652ad08fc9d786fbc4f25a13b29578952336e950e962d:922c64590222798bb761d5b6d8e72950