Update checkmk-login.yaml

http/exposed-panels/checkmk/checkmk-login.yaml

@@ -2,35 +2,37 @@ id: checkmk-login
 
 info:
   name: Checkmk Login Panel - Detect
-  author: princechaddha
+  author: princechaddha,righettod
   severity: info
   description: Checkmk login panel was detected.
+  reference:
+    - https://checkmk.com/ 
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
     cwe-id: CWE-200
-    cpe: cpe:2.3:a:tribe29:checkmk:*:*:*:*:*:*:*:*
+    cpe: cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*
   metadata:
-    max-request: 1
-    vendor: tribe29
+    max-request: 5
+    vendor: checkmk
     product: checkmk
-  tags: login,tech,synology,rackstation,panel,tribe29
+    verified: true
+    shodan-query: http.title:"Check_MK"
+  tags: panel,checkmk,detect,login
 
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/check_mk/login.py"
+      - "{{BaseURL}}/"
 
-    matchers-condition: or
+    redirects: true
+    max-redirects: 5
+    stop-at-first-match: true
     matchers:
-      - type: word
-        part: body
-        words:
-          - '<title>Check_MK Multisite Login</title>'
-
-      - type: regex
-        part: body
-        regex:
-          - '<title>Checkmk ([A-Za-z_0-9 ]+)<\/title>'
+        - type: dsl
+          dsl:
+            - 'status_code == 200 || status_code == 401'
+            - 'contains_any(to_lower(body), "check_mk multisite login", "checkmk", "check_mk mobile")'
+          condition: and
 
     extractors:
       - type: regex
@@ -39,4 +41,3 @@ http:
         regex:
           - '<div id="version">([0-9.a-z]+)<\/div>'
           - '<div id="foot">Version: ([0-9.a-z]+)'
-# digest: 4b0a00483046022100b310dc2eb2c1633e9d63b74c63df7b1dfee65e41b00f931d7ba59a93b5655910022100dc129226cfb39444cfd03083edd885b212c317aedc94300267e185c5b25d6290:922c64590222798bb761d5b6d8e72950