id: ms-exchange-web-service info: name: Microsoft Exchange Web Service - Detect author: bhutch severity: info description: | Microsoft Exchange Web Services was detected. reference: - https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/start-using-web-services-in-exchange - https://pentestlab.blog/tag/ews/ metadata: max-request: 1 verified: true shodan-query: http.favicon.hash:1768726119 tags: ms,microsoft,exchange,tech http: - method: GET path: - "{{BaseURL}}/EWS/Exchange.asmx" matchers-condition: and matchers: - type: regex part: header regex: - "(?i)(X-Owa-Version:)" - type: status status: - 401 extractors: - type: kval kval: - x_owa_version # digest: 490a00463044022054a636a6be435ecb4ac3ed66b490ebc82e0e0f0897a9e11b027cc7324e2be15b022025ea15c925341179432cfbfe2398306870b85320c9da8ad83358432ede8e45fe:922c64590222798bb761d5b6d8e72950