id: web-server

info:
  name: Detect web server daemon
  author: fabaff
  severity: informative

requests:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: or
    matchers:
      - type: word
        name: apache
        words:
          - "Apache"
        part: header
      - type: word
        name: lighttpd
        words:
          - "lighttpd"
        part: header
      - type: word
        name: lighttpd
        words:
          - "lighttpd"
        part: header
      - type: word
        name: wsgiserver
        words:
          - "WSGIServer"
        part: header
      - type: word
        name: simplehttp
        words:
          - "SimpleHTTP"
        part: header
      - type: word
        name: twistedweb
        words:
          - "TwistedWeb"
        part: header
      - type: word
        name: tsm
        words:
          - "TSM_HTTP"
        part: header
      - type: word
        name: ms-iis
        words:
          - "Microsoft-IIS"
        part: header
      - type: word
        name: ms-httpapi
        words:
          - "Microsoft-HTTPAPI"
        part: header
      - type: word
        name: tomcat
        words:
          - "Tomcat"
        part: header
      - type: word
        name: darkhttpd
        words:
          - "darkhttpd"
        part: header
      - type: word
        name: cherrypy
        words:
          - "CherryPy"
        part: header
      - type: word
        name: cherokee
        words:
          - "Cherokee"
        part: header
      - type: word
        name: caddy
        words:
          - "Caddy"
        part: header
      - type: word
        name: jetty
        words:
          - "Jetty"
        part: header