id: vllm-api-detect

info:
  name: vLLM OpenAI-Compatible Server - Detect
  author: ChrisJr404
  severity: info
  description: |
   Detected vLLM was a high-throughput LLM serving engine that exposed an OpenAI-compatible HTTP API on TCP 8000 with no authentication by default.
  reference:
    - https://github.com/vllm-project/vllm
    - https://docs.vllm.ai/en/latest/serving/openai_compatible_server.html
  metadata:
    verified: true
    max-request: 1
    vendor: vllm-project
    product: vllm
    shodan-query: '"served-model-name"'
    fofa-query: body="vllm" && body="/v1/models"
  tags: tech,vllm,llm,ai,ml,openai,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "vLLM", "/v1/models", "/v1/chat/completions")'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"version"\s*:\s*"([^"]+)"'
# digest: 490a0046304402205f5eb6ac0382ca18b723d41db618838e80bbc660dd1c02a0922f25582fc93fe70220062dcaddd0b24b3b8b34a2e2106151ff42201f314e9213aa7cb499e5b806bbd0:922c64590222798bb761d5b6d8e72950