docker-api.yaml

# info to search signature
id: docker-unauth-01
info:
  name: Docker Registry Exposed
  risk: High

requests:
  - method: GET
    redirect: false
    url: >-
     {{.BaseURL}}/v2/
    detections:
      - >-
        StatusCode() == 200 && StringSearch("response", "registry/2.0") && StringSearch("response", "docker-distribution-api-version")
  
  - method: GET
    redirect: false
    url: >-
     {{.BaseURL}}/v2/_catalog
    detections:
      - >-
        StatusCode() == 200 && StringSearch("response", "repositories")

reference:
  - link: http://www.polaris-lab.com/index.php/archives/253/