docker-version

NSE detection rule by Claudio Criscione · Same as Nmap--See https://nmap.org/book/man-legal.html

Detects the Docker service version.

local shortport =  require "shortport"
local json = require "json"
local http = require "http"
local nmap = require "nmap"

description = [[Detects the Docker service version.]]

---
-- @output
-- PORT     STATE SERVICE VERSION
-- 2375/tcp open  docker  Docker 1.11.2
-- |   Version: 1.11.2
-- |   BuildTime: 2016-06-01T21:47:50.269346868+00:00
-- |   Arch: amd64
-- |   KernelVersion: 3.13.0-91-generic
-- |   Os: linux
-- |   ApiVersion: 1.23
-- |   GitCommit: b9f10c9
-- |_  GoVersion: go1.5.4


author = "Claudio Criscione"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"version"}

portrule = shortport.version_port_or_service({2375, 2376}, {"docker", "docker-s"}, "tcp")

action = function(host, port)

  local http_response = http.get(host, port, "/version")
  if not http_response or not http_response.status or
    http_response.status ~= 200 or not http_response.body then
    return
  end

  local ok_json, response = json.parse(http_response.body)
  if ok_json and response["Version"] and response["GitCommit"] then
    ---Detected
    port.version.name = 'docker'
    port.version.version = response["Version"]
    port.version.product = "Docker"
    nmap.set_port_version(host, port)
    return response
  end
  return
end

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

de56b911-d068-46a7-b274-11c17cff1c91

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion