id: microstrategy-detect

info:
  name: MicroStrategy Instances Detection Template
  author: philippedelteil,Retr02332
  severity: info
  description: Detect if MicroStrategy instances exist in your URLS
  metadata:
    max-request: 16
  tags: microstrategy,panel,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}"

    payloads:
      path:
        - MicroStrategy/servlet/mstrWebAdmin/
        - MicroStrategy/servlet/mstrWebAdmin
        - MicroStrategy/servlet/taskProc/
        - MicroStrategy/servlet/taskProc
        - MicroStrategy/servlet/mstrWeb/
        - MicroStrategy/servlet/mstrWeb
        - MicroStrategy/
        - MicroStrategy
        - servlet/mstrWebAdmin/
        - servlet/mstrWebAdmin
        - servlet/taskProc/
        - servlet/taskProc
        - servlet/mstrWeb/
        - servlet/mstrWeb
        - asp/Main.aspx
        - MicroStrategy/asp

    stop-at-first-match: true
    matchers:
      - type: dsl
        condition: or
        dsl:
          - 'contains(body, "MicroStrategy, Incorporated.")'
          - 'contains(body, "microstrategy.servletName")'
          - 'contains(body, "mstrHiddenInput")'

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'ProductHelp/([0-9.A-Z]+)'

      - type: regex
        part: body
        group: 1
        regex:
          - 'WELCOME. MicroStrategy ([0-9]+)'
# digest: 490a0046304402205f3ea2e2167bf1889e539e2e5002abd6ac0208a82bb62df1446cdd23ccee645d02203879f9c35daff0f8f10c0e33631d00e8ff40c1f24a7ea1ece7e7118fe4d5f814:922c64590222798bb761d5b6d8e72950