Merge pull request #10340 from righettod/tomcat_upd

Refactor the Tomcat template

http/exposed-panels/tomcat/tomcat-exposed-docs.yaml

@@ -1,46 +0,0 @@
-id: tomcat-exposed-docs
-
-info:
-  name: Tomcat exposed docs
-  author: Podalirius
-  severity: info
-  classification:
-    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
-  metadata:
-    max-request: 1
-    vendor: apache
-    product: tomcat
-    shodan-query:
-      - title:"Apache Tomcat"
-      - http.title:"apache tomcat"
-      - http.html:"apache tomcat"
-      - cpe:"cpe:2.3:a:apache:tomcat"
-    fofa-query:
-      - body="apache tomcat"
-      - title="apache tomcat"
-    google-query: intitle:"apache tomcat"
-  tags: version,tomcat,docs,panel,apache
-
-http:
-  - method: GET
-    path:
-      - '{{BaseURL}}/docs/'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'Apache Tomcat'
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - '<div class="versionInfo">[ \n\t]*(Version[ \n\t]*[^\n\t<]+)[ \n\t]*<time'
-# digest: 4b0a00483046022100e6dc2d9d6fa2e1dea5c5f126e696b23d549ce3c851378fe5c818f46a7856e4120221008dd4bfa8d0eb137626e86bddb522da573c9a58b84a6c7e5530193f79a55627a9:922c64590222798bb761d5b6d8e72950

http/exposed-panels/tomcat/tomcat-exposed.yaml

@@ -0,0 +1,50 @@
+id: tomcat-exposed
+
+info:
+  name: Tomcat Exposed - Detect
+  author: Podalirius,righettod
+  severity: info
+  description: An Apache Tomcat instance was detected.
+  classification:
+    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: apache
+    product: tomcat
+    shodan-query:
+      - title:"Apache Tomcat"
+      - http.title:"apache tomcat"
+      - http.html:"apache tomcat"
+      - cpe:"cpe:2.3:a:apache:tomcat"
+    fofa-query:
+      - body="apache tomcat"
+      - title="apache tomcat"
+    google-query: intitle:"apache tomcat"
+  tags: tomcat,panel,apache,detect
+
+http:
+  - method: GET
+    path:
+      - '{{BaseURL}}/host-manager/html'
+      - '{{BaseURL}}/manager/status'
+      - '{{BaseURL}}/manager/html'
+      - '{{BaseURL}}/docs/'
+      - '{{BaseURL}}/examples/'
+
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200 || status_code == 401'
+          - 'contains_any(to_lower(body), "apache tomcat", "tomcat-users.xml")'
+        condition: and
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - 'Version\s+([0-9.]+),'
+          - '(?i)/lib/([a-z0-9.]+)/webapps'
+          - '(?i)<h3>Apache\s+Tomcat/([0-9.]+)'