id: airflow-detect

info:
  name: Apache Airflow
  author: pdteam,righettod
  severity: info
  description: |
     Apache Airflow was detected - A platform to programmatically author, schedule and monitor workflows.
  reference:
    - https://airflow.apache.org/
  classification:
    cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: airflow
    shodan-query: http.html:"Apache Airflow"
  tags: tech,apache,airflow,intrusive,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{randstr}}"
      - "{{BaseURL}}/openapi.json"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404 && contains(to_lower(body), "airflow 404")'
          - 'status_code == 200 && contains(to_lower(body), "airflow api")'
        condition: or
# digest: 4b0a00483046022100e684ad48c34e3b3ae4e9b9e3b850d8a3b1153b18de19979e2a03b74b61a9c21a022100beee63ade1b4e23280a80a74b29c0b1a76a36725af751c99f768fa1e64eb1244:922c64590222798bb761d5b6d8e72950