sap-router: SAPRouter Detection

id: sap-router

info:
  name: SAPRouter Detection
  author: randomstr1ng
  severity: info
  tags: network,sap
  description: |
    SAProuter is a software application that provides a remote connection between our customer's network and SAP.
    fofa: protocol="sap-router"

set:
  hostname: request.url.host
  host: request.url.domain
rules:
  r0:
    request:
      type: tcp
      host: "{{hostname}}"
      data: "57484f415245594f553f0a"
      data-type: hex
      read-size: 1024
    expression: response.raw.bcontains(b'SAProuter')
  r1:
    request:
      type: tcp
      host: "{{host}}:3299"
      data: "57484f415245594f553f0a"
      data-type: hex
      read-size: 1024
    expression: response.raw.bcontains(b'SAProuter')
expression: r0() || r1()