favicon-detect and waf-detect

[sec13b]

how i use to get this from a ip list , what nuclei command to run .
[favicon-detect:fortinet-forticlient] [http] [info] https://ip2/favicon.ico [1234556]

[waf-detect:fortigate] [http] [info] https://ip1/
[waf-detect:fortigate] [http] [info] https://ip2/

thank you a lot

[rxerium]

Just so I understand correctly, you'd like to find instances running forticlient software from favicon hashes?

[sec13b]

yes.

[rxerium]

Fantastic! So what you'd like to do is create a new template with the below:

id: favicon-detect

info:
  name: favicon-detection
  author: un-fmunozs,DhiyaneshDk
  severity: info
  reference:
    - https://twitter.com/brsn76945860/status/1171233054951501824
    - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
    - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
    - https://github.com/devanshbatham/FavFreak
    - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
  metadata:
    max-request: 2
  tags: tech,favicon

http:
  - method: GET
    path:
      - "{{BaseURL}}/favicon.ico"
      - "{{BaseURL}}/images/favicon.ico"

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        name: "fortinet-forticlient"
        dsl:
          - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))"

Once you have this run the following command:

nuclei -t templateYouJustCreated.yaml -l IPs.txt -o output.txt

The output will be sent to the output.txt file.

Do let me know if this works :)

[sec13b]

i thnk need sign the template

[sec13b]

test.txt list ip :
https://ip:port

nuclei -t templateYouJustCreated.yaml -l test.txt  -o output.txt -stats
[INF] Supplied input was automatically deduplicated (118 removed).
[INF] Current nuclei version: v3.1.10 (outdated)
[INF] Current nuclei-templates version: v9.8.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] Targets loaded for current scan: 9
[INF] No results found. Better luck next time!
[FTL] Could not run nuclei: no templates provided for scan

nuclei -t templateYouJustCreated.yaml -sign
[INF] Generating new key-pair for signing templates
[*] Enter User/Organization Name (exit to abort) : test
[*] Enter passphrase (exit to abort):
[*] Enter same passphrase again:
[INF] Successfully generated new key-pair for signing templates

nuclei -t templateYouJustCreated.yaml -code  -l test.txt  -o output.txt -stats
[INF] Supplied input was automatically deduplicated (118 removed).
[INF] Current nuclei version: v3.1.10 (outdated)
[INF] Current nuclei-templates version: v9.8.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] Targets loaded for current scan: 9
[INF] No results found. Better luck next time!
[FTL] Could not run nuclei: no templates provided for scan

[rxerium]

Can I suggest updating Nuclei to the latest version? nuclei --update

Also, presuming the contents of the file templateYouJustCreated.yaml contains this code?

[sec13b]

is your code

[rxerium]

Yes, you will need to create a new file with this code and reference it in the command :)

[sec13b]

work, after i sign .
thank you a lot

[rxerium]

fantastic, glad to hear! Feel free to mark as resolved 😊

[sec13b]

can i know from where you get : 945408572

• "status_code==200 && ("945408572" == mmh3(base64_py(body)))"

[rxerium]

From the original template here. The hashes itself can be fetched using httpX or a python script.

[sec13b]

now i understand . i will use your model for future template.

thank you again.