Merge pull request #6335 from arafatansari/patch-117

Create exposed-dockerd.yaml

network/exposed-dockerd.yaml

@@ -0,0 +1,25 @@
+id: exposed-dockerd
+
+info:
+  name: Docker Daemon Exposed
+  author: arafat
+  severity: critical
+  description: |
+    Docker Daemon exposed on the network map can help remote attacker to gain access to the Docker containers and potentially the host system.
+  metadata:
+    verified: true
+    shodan-query: port:2375 product:"docker"
+  tags: network,docker
+
+network:
+  - inputs:
+      - data: "Docker:\nVersion:\n"
+
+    host:
+      - "{{Hostname}}"
+      - "{{Host}}:2375"
+
+    matchers:
+      - type: word
+        words:
+          - "Server: Docker"