id: llamacpp-detect

info:
  name: llama.cpp - Detect
  author: rxerium
  severity: info
  description: |
   Detected llama.cpp, a lightweight C/C++ inference engine for running GGUF-format large language models locally. Exposed instances serve an OpenAI-compatible REST API and a built-in web chat interface with no authentication by default.
  reference:
    - https://github.com/ggerganov/llama.cpp
  metadata:
    verified: true
    max-request: 1
    vendor: ggerganov
    product: llama.cpp
    shodan-query: 'http.headers.server:"llama.cpp"'
    fofa-query: 'server="llama.cpp"'
  tags: tech,llamacpp,llm,ai,detect,discovery

http:
  - raw:
      - |
        GET /health HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status":"ok"'

      - type: dsl
        dsl:
          - contains(header, "llama.cpp")
          - status_code == 200
        condition: and
# digest: 4b0a00483046022100d251dc3ced29f03682258ba8083d111a0d5e886ac162f83854fe69d64befe28c022100f5140cddf8faab2f109a45eb486780680cc4d55b1f8e8543af1fcfc978e1195b:922c64590222798bb761d5b6d8e72950