id: labview-service-locator-enum

info:
  name: LabVIEW/NI Service Locator
  author: matejsmycka
  severity: info
  reference:
    - https://forums.ni.com/t5/LabVIEW/Get-list-of-services-from-NI-service-locator/td-p/3850515
    - https://www.ni.com/en/support/security/configuring-software-and-hardware-firewalls-to-support-national-.html
  description: |
    National Instruments (LabVIEW) Service Locator detected and enumerated. This services leaks a list of all services provided by the device, hardware capabilities and possibly versions. These hardware devices should not be exposed to the internet.
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:1192389544 port:3580
  tags: detect,labview,panel,enumeration,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/dumpinfo"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Service Locator URL Mappings"
          - "National Instruments"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a0048304602210090547852e6fb0fbe578fe1aa6dcc54c1846de3b7f68d08ba262c02c93cef2617022100917343015281843125f7400c7c6ee866e01d0cad34267a47acbacf85b56291a6:922c64590222798bb761d5b6d8e72950