id: sap-netweaver-detect

info:
  name: SAP NetWeaver ICM Detection
  author: randomstr1ng
  severity: info
  description: Detection of SAP NetWeaver ABAP Webserver (ICM/ICF)
  metadata:
    shodan-query: http.favicon.hash:-266008933
  tags: sap,webserver

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: regex
        part: header
        regex:
          - "sap-server:"
          - "Sap-Server:"
          - "SAP NetWeaver Application Server"
        condition: or

    extractors:
      - type: kval
        part: header
        kval:
          - "server"