id: ocserv-panel

info:
  name: OpenConnect VPN Server (ocserv) - Detect
  author: rxerium
  severity: info
  description: |
    OpenConnect VPN Server (ocserv) is an open-source VPN server compatible with
    Cisco AnyConnect clients. It uses DTLS and TLS for secure connectivity and
    is commonly exposed on port 443 or 4443. The server header can expose
    OpenConnect or ocserv-specific markers.
  reference:
    - https://gitlab.com/openconnect/ocserv
    - https://ocserv.gitlab.io/www/
  metadata:
    max-request: 1
    shodan-query: '"Server: ocserv"'
  tags: panel,ocserv,openconnect,vpn,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - 'ocserv'
          - 'OCServer'
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e94691fe1524aec4aa112b49de9c03b3570235436498f0dc13e6848bc1336640022022e60386a69bb1fe7a0fc6a4b7101a8f272a4f18740b38b3688f28a16d4c06f0:922c64590222798bb761d5b6d8e72950