id: sharepoint-web-services-discovery

info:
  name: Microsoft SharePoint - Web Services Discovery
  author: 0x_Akoko
  severity: info
  description: |
    Detected exposed SharePoint web services via /_vti_bin/spdisco.aspx endpoint
  metadata:
    max-request: 1
  tags: sharepoint,iis,microsoft,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/_vti_bin/spdisco.aspx"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<discovery"
          - "<contractRef"
        condition: and
        case-insensitive: true

      - type: word
        part: content_type
        words:
          - text/xml

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009256ec619cfe0061170b4656742dc0bf09f3e050e8543322a92122895a5b4eb602202cc796b48f6f382f23aab561aea5ae0c6a7e5941a22d188f77381c3c8c89c262:922c64590222798bb761d5b6d8e72950