Embedded Web Server Detection

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
 script_id(19689);
 script_version("1.84");
 script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/29");

 script_name(english:"Embedded Web Server Detection");
 script_summary(english:"This scripts detects whether the remote host is an embedded web server.");

 script_set_attribute(attribute:"synopsis", value:
"The remote web server is embedded.");
 script_set_attribute(attribute:"description", value:
"The remote web server cannot host user-supplied CGIs. CGI scanning
will be disabled on this server.");
 script_set_attribute(attribute:"solution", value:"n/a");
 script_set_attribute(attribute:"risk_factor", value:"None");

 script_set_attribute(attribute:"plugin_publication_date", value:"2005/09/14");

 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_set_attribute(attribute:"cpe", value:"cpe:/a:cesanta:mongoose_embedded_web_server_library");
 script_set_attribute(attribute:"asset_inventory", value:"True");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);

 script_copyright(english:"This script is Copyright (C) 2005-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

 script_family(english:"Web Servers");

 script_dependencies("cisco_ids_manager_detect.nasl", "ciscoworks_detect.nasl", "ilo_detect.nasl",
"clearswift_mimesweeper_smtp_detect.nasl", "imss_detect.nasl", "interspect_detect.nasl", "intrushield_console_detect.nasl", "ibm_rsa_www.nasl",
"veritas_cluster_mgmt_detect.nasl",	# Not an embedded web server per se
"iwss_detect.nasl", "linuxconf_detect.nasl", "securenet_provider_detect.nasl",
"tmcm_detect.nasl", "websense_detect.nasl", "xedus_detect.nasl", "xerox_document_centre_detect.nasl", "xerox_workcentre_detect.nasl", "compaq_wbem_detect.nasl", "drac_detect.nasl", "net_optics_director_web_detect.nbin");

 script_require_ports("Services/www", 80);
 exit(0);
}

include("http_func.inc");

function is_embedded_server()
{
	var banner = _FCT_ANON_ARGS[0];
  if (empty_or_null(banner))
  {
    return FALSE;
  }

  local_var pattern =
    "^(DAAP-)?([Ss]erver|SERVER): *(" +
    "3Com/|" +
    "3ware/|" +
    "4D_WebStar|" +
    "Acabit XML-RPC Server|" +
    "ADTRAN, Inc\.|" +
    "Agent-ListenServer-HttpSvr|" +
    "AKCP Embedded Web Server|" +
    "Allegro-Software-RomPager|" +
    "AnomicHTTPD|" +
    "AppleShareIP|" +
    "Asterix/[0-9]|" +
    "Axigen-Web(admin|mail)|" +
    "BarracudaHTTP|" +
    "BBC|" +
    "BOSSERV/|" +
    "CCM Desktop Agent|" +
    "Check Point SVN foundation|" +
    "CompaqHTTPServer/|" +
    "cisco-IOS|" +
    "Citrix Web PN Server|" +
    "CUPS|" +
    "DCReport/|" +
    "Desktop On-Call|" +
    "dncsatm|" +
    "DVS 304 Series/1.21|" +
    "D-Link|" +
    "eHTTP|" +
    "Embedded (HTTPD|HTTP Server.)|" +
    "Embedthis-Appweb/|" +
    "eMule|" +
    "EPSON-HTTP/|" +
    "EPSON-IPP/[0-9]|" +
    "ESWeb/|" +
    "EWS-NIC|" +
    "GE Industrial Systems UR|" +
    "glass/.+-IronPort|" +
    "GoAhead|" +
    "Gordian Embedded|" +
    "gSOAP|" +
    "HASP LM/[0-9]|" +
    "HP-ChaiServer|" +
    "HP[ -]Web[ -]Jet[aA]dmin|" +
    "httpd [0-9]|" +
    "HTTP Server$|" +
    "ida-HTTPServer|" +
    "IPC@CHIP|" +
    "Ipswitch-IMail|" +
    "IPWEBS/|" +
    "IP_SHARER|" +
    "IP-Phone Solution|" +
    "iTunes/|" +
    "JC-HTTPD/|" +
    "KDG/[0-9]|" +
    "KM-MFP-http/V|" +
    "LANDesk Management Agent/|" +
    "Linux, WEBACCESS/1.0|" +
    "LVAHTTPD/ver[0-9]|" +
    "MACOS_Personal_Websharing|" +
    "Micro-Web|" +
    "MiniServ|" +
    "Motion-httpd/[0-9]\.|" +
    "mt-daapd/|" +
    "W3MFC/[0-9]|" +
    "Muratec Server Ver.[0-9]|" +
    "Novell-Agent [0-9.]+ |DHost/[0-9.]+ HttpStk/[0-9.]+|" +
    "NetCache appliance|" +
    "NetEVI/|" +
    "NetPort Software|" +
    "OfficeScan Client|" +
    "Oracle-ILOM-Web-Server/1.0|" +
    "PanWeb Server/|" +
    "Polycom SoundPoint IP Telephone HTTPd|" +
    "portex/1\.0|" +
    "PRINT_SERVER WEB [0-9]|" +
    "PSOSHTTP/[0-9]|" +
    "PRTG/[0-9]|" +
    "R4 Embedded Server|" +
    "RAC_ONE_HTTP|" +
    "Rapid ?Logic/|" +
    "RealVNC|" +
    "RomPager|" +
    "Service admin/|" +
    "silex Web Admin|" +
    "SiteScope/[0-9]|" +
    "SMF|" +
    "(SNARE|Snare)/[0-9.]+|" +
    "Splunkd|" +
    "SonicWALL|" +
    "Squid/Alcatel|" +
    "SQ-WEBCAM|" +
    "Sun-ILOM-Web-Server/1.0|" +
    "Tandberg Television Web server|" +
    "TembriaWebServer|" +
    "TRMB/[0-9]|" +
    "TSM_HTTP/|" +
    "uc-httpd|" +
    "UPSentry|" +
    "u-Server|" +
    "Virata-EmWeb|" +
    "Vivotek Network Camera|" +
    "Vivotek Video Server|" +
    "WatchGuard Firewall|" +
    "WIBU-SYSTEMS HTTP Server|" +
    "WindWeb/|" +
    "Wing FTP Server/|" +
    "Xerox_MicroServer|" +
    "ZenAgent|" +
    "(ZyXEL-)?RomPager/|" +
    ".+UPnP/1\.[01])";

  return preg(pattern:pattern, string:banner, multiline:TRUE);
}

var port = get_service(svc:"www", default:80, exit_on_fail:TRUE);
var embedded_flag = get_kb_item("Services/www/"+port+"/embedded");
if (empty_or_null(embedded_flag) || embedded_flag == FALSE)
{
	var banner = get_http_banner(port:port);
	if (empty_or_null(banner))
	{
		audit(AUDIT_WEB_BANNER_NOT, port);
	}

	if (!(port == 901 || is_embedded_server(banner)))
	{
		audit(AUDIT_WRONG_WEB_SERVER, port, "known to be embedded");
	}

	replace_kb_item(name:"Services/www/"+port+"/embedded", value:TRUE);
}

security_report_v4(severity:SECURITY_NOTE, port:port);