id: exposed-dockerd

info:
  name: Docker Daemon Exposed
  author: arafatansari
  severity: critical
  description: |
    Docker Daemon exposed on the network map can help remote attacker to gain access to the Docker containers and potentially the host system.
  metadata:
    verified: true
    max-request: 1
    shodan-query: port:2375 product:"docker"
  tags: network,docker,exposure,tcp,discovery
tcp:
  - inputs:
      - data: "GET /_ping HTTP/1.0\r\n\r\n"

    host:
      - "{{Hostname}}"
    port: 2375

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Server: Docker"
      - type: word
        words:
          - "Api-Version:"
# digest: 4b0a00483046022100ba8f242ac74299752ff3a724b2e1c393449caa8da2f50a046014d61e1b9bddb7022100c398d40b0b7fde1649a42d1e0f405e0a2fb7855e538502b452eeb3c555e6329f:922c64590222798bb761d5b6d8e72950