Merge pull request #10340 from righettod/tomcat_upd

Refactor the Tomcat template

http/exposed-panels/tomcat/tomcat-exposed.yaml

@@ -0,0 +1,50 @@
+id: tomcat-exposed
+
+info:
+  name: Tomcat Exposed - Detect
+  author: Podalirius,righettod
+  severity: info
+  description: An Apache Tomcat instance was detected.
+  classification:
+    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: apache
+    product: tomcat
+    shodan-query:
+      - title:"Apache Tomcat"
+      - http.title:"apache tomcat"
+      - http.html:"apache tomcat"
+      - cpe:"cpe:2.3:a:apache:tomcat"
+    fofa-query:
+      - body="apache tomcat"
+      - title="apache tomcat"
+    google-query: intitle:"apache tomcat"
+  tags: tomcat,panel,apache,detect
+
+http:
+  - method: GET
+    path:
+      - '{{BaseURL}}/host-manager/html'
+      - '{{BaseURL}}/manager/status'
+      - '{{BaseURL}}/manager/html'
+      - '{{BaseURL}}/docs/'
+      - '{{BaseURL}}/examples/'
+
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200 || status_code == 401'
+          - 'contains_any(to_lower(body), "apache tomcat", "tomcat-users.xml")'
+        condition: and
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - 'Version\s+([0-9.]+),'
+          - '(?i)/lib/([a-z0-9.]+)/webapps'
+          - '(?i)<h3>Apache\s+Tomcat/([0-9.]+)'