id: sap-message-server-detect

info:
  name: SAP Message Server HTTP - Detect
  author: LRVT,l4rm4nd
  severity: info
  description: |
    Detected SAP Message Server by sending an HTTP request to the root path and checking for SAP Message Server header.
  metadata:
    max-request: 1
    shodan-query: http.html:SAP Message Server
  tags: sap,discovery,recon

http:
  - method: GET
    path:
      - "{{RootURL}}"

    matchers:
      - type: word
        part: header
        words:
          - "SAP Message Server"

    extractors:
      - type: regex
        part: header
        name: version
        group: 1
        regex:
          - "(?i)server:\\s*(SAP Message Server[^\\r\\n]*)"
# digest: 4a0a00473045022100faf35e2e0577af0e3f2734a7b707b7ae5d4dd381124e52bf132f47f46155c5f60220037eb1622ee99d8aa0e8073708faca80bae9850ed53222bc797764a4a98f6293:922c64590222798bb761d5b6d8e72950