id: nginx-eol

info:
  name: Nginx End-of-Life - Detect
  author: Shivam Kamboj
  severity: info
  description: |
    Detected Nginx versions that have reached End-of-Life (EOL) and no longer receive security updates.
  reference:
    - https://endoflife.date/nginx
    - https://nginx.org/en/download.html
  metadata:
    verified: true
    max-request: 1
    shodan-query: "Server: nginx/"
    product: nginx
    vendor: nginx
  tags: tech,nginx,eol

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 3

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - compare_versions(version, '<1.28.0')
          - contains(server, 'nginx')
        condition: and

    extractors:
      - type: regex
        part: header
        name: version
        group: 1
        regex:
          - 'Server: nginx/([0-9.]+)'
# digest: 490a00463044022078a2e43b32daf5a1e7dfa9b6e75e4860534ea033ae7d753559000325f602153702200315e77e40a82c8133d4de77c8c3f841dfaa1b5ecb7b8561070291af575b4ad9:922c64590222798bb761d5b6d8e72950