Add adversarial-nations sweep: PAN-OS < 10.2.14 fingerprint, US-adversarial country list

2026-04-30 14:30:03 -04:00
parent 3cbecd16b1
commit 61a6285c36
2 changed files with 76 additions and 9 deletions
@@ -1,4 +1,35 @@
 targets:
+  - name: "Palo Alto PAN-OS < 10.2.14"
+    tags: [panos, firewall, palo-alto, cve-2024-3400, network-device]
+    ports: [443, 4443, 8443]
+    probes:
+      - type: https
+        path: "/api/?type=version"
+        method: GET
+        match_in: body
+        patterns: ["sw-version"]
+        version_extract: "<sw-version>([0-9]+\\.[0-9]+\\.[0-9]+)"
+        version_compare:
+          operator: "<"
+          value: "10.2.14"
+        confidence: high
+
+      - type: https
+        path: "/php/login.php"
+        method: GET
+        match_in: [body, headers]
+        patterns:
+          - "Palo Alto Networks"
+          - "PAN-OS"
+        confidence: low
+
+      - type: https
+        path: "/global-protect/portal/gp-portal-esp.esp"
+        method: GET
+        match_in: body
+        patterns: ["globalprotect", "PAN-OS"]
+        confidence: low
+
  - name: "Ubuntu 24.04 SSH"
    tags: [linux, ubuntu, ssh]
    ports: [22]