Merge pull request #10599 from righettod/vault_upd

Update detection of HashiCorp Vault login panel instances.

http/exposed-panels/vault-panel.yaml

@@ -2,16 +2,20 @@ id: vault-panel
 
 info:
   name: Vault Login Panel - Detect
-  author: DhiyaneshDK
+  author: DhiyaneshDK,righettod
   severity: info
   description: Vault login panel was detected.
+  reference:
+    - https://developer.hashicorp.com/vault
+    - https://developer.hashicorp.com/vault/api-docs
+    - https://developer.hashicorp.com/vault/api-docs#help
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
     cwe-id: CWE-200
     cpe: cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 2
+    max-request: 4
     vendor: hashicorp
     product: vault
     shodan-query: http.favicon.hash:-919788577
@@ -22,24 +26,21 @@ http:
   - method: GET
     path:
       - "{{BaseURL}}/v1/sys/health"
-      - "{{BaseURL}}/ui/vault/auth?with=oidc%2F"
+      - "{{BaseURL}}/ui/vault/auth"
+      - "{{BaseURL}}/ui/auth"
+      - "{{BaseURL}}/v1/sys/health?help=1"
 
-    matchers-condition: and
+    stop-at-first-match: true
     matchers:
-      - type: word
-        words:
-          - "<title>Vault</title>"
-          - "vault/"
+      - type: dsl
+        dsl:
+          - 'status_code == 200 || status_code == 429'
+          - 'contains_any(to_lower(body), "vault-cluster", "vault/config/environment", "<title>vault</title>", "hashicorp vault api")'
         condition: and
 
-      - type: status
-        status:
-          - 200
-
     extractors:
       - type: json
         part: body_1
         name: version
         json:
           - ".version"
-# digest: 4a0a00473045022100e4e1228ec2992872d862ee250f3634139933c4ec3e3e98a79a7280aff67d3d7e022074dcd7b9f098a4070fe881bec25860567a7144687a3cdc170b8b80e64c2840e7:922c64590222798bb761d5b6d8e72950