id: hedgedoc-detect

info:
  name: HedgeDoc Collaborative Editor - Detect
  author: Rupendra0
  severity: info
  description: |
    HedgeDoc is an open-source, collaborative markdown editor for teams to share and co-edit notes in real time. This template detects publicly reachable HedgeDoc instances by fingerprinting unique branding markers and the dedicated Hedgedoc-Version response header.
  reference:
    - https://hedgedoc.org
    - https://github.com/hedgedoc/hedgedoc
  metadata:
    verified: true
    max-request: 2
    vendor: hedgedoc
    product: hedgedoc
    shodan-query: 'http.title:"HedgeDoc - Ideas grow better together"'
    fofa-query: 'body="Powered by <a href=\"https://hedgedoc.org\">HedgeDoc"'
  tags: tech,detect,hedgedoc

http:
  - method: GET
    path:
      - '{{BaseURL}}/'

    host-redirects: true
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(header), "hedgedoc-version:")'
          - 'contains_any(body, "HedgeDoc - Ideas", "Powered by <a href=\"https://hedgedoc.org\">HedgeDoc")'
        condition: or

    extractors:
      - type: regex
        name: version
        part: header
        group: 1
        regex:
          - '(?i)hedgedoc-version:\s*([0-9.]+)'
# digest: 4a0a004730450221008e735d42775f6d3f3bb72d68af529f4c64c297113abe425a08f1b13dfe2db8ed022020e80e636e2dc793430dc102ebdb463e5472d829911f7f444c49ebf33bff8f8e:922c64590222798bb761d5b6d8e72950