Symantec Encryption Server Login Panel - Detect

What is the "Symantec Encryption Server Login Panel - Detect?" module?

The "Symantec Encryption Server Login Panel - Detect" module is designed to detect the presence of the Symantec Encryption Server login panel. This module focuses on identifying potential misconfigurations or vulnerabilities related to the login panel of the Symantec Encryption Server software.

This module has an informative severity level, meaning it provides valuable information without indicating an immediate threat or vulnerability.

This module was authored by johnk3r.

Impact

The impact of detecting the Symantec Encryption Server login panel is dependent on the specific context and configuration of the server. However, it can potentially reveal the presence of the login panel, which may indicate the use of Symantec Encryption Server and provide insights for further analysis or security assessments.

How does the module work?

The module utilizes HTTP request templates and matching conditions to identify the Symantec Encryption Server login panel. It sends a GET request to the path "/b/l.e" and applies two matching conditions:

- The response body must contain the HTML title tag "<TITLE>Symantec Encryption Server: Web Email Protection - Login</TITLE>". - The response status code must be 200 (OK).

If both conditions are met, the module considers the Symantec Encryption Server login panel to be detected.

Example HTTP request:

GET /b/l.e

The module's matching conditions ensure that the response body contains the specific HTML title tag and the response status code is 200.