nmap nse

-- The Head Section --
-- https://thesprawl.org/research/writing-nse-scripts-for-vulnerability-scanning/
description = [[Sample script to detect a fictional vulnerability
in a fictional ArcticFission 1.0 web server]]

---
-- @usage
-- nmap --script http-vuln-check <target>
-- @output
-- PORT   STATE SERVICE
-- 80/tcp open  http
-- |_http-vuln-check: Vulnerable

author = "iphelix"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"default", "safe"}

local shortport = require "shortport"
local http = require "http"
local stdnse = require "stdnse"
local string = require "string"

-- The Rule Section --
portrule = shortport.http

-- The Action Section --
action = function(host, port)

    local uri = "/"

    local options = {header={}}
    options['header']['User-Agent'] = "Mozilla/5.0 (compatible; ArcticFission)"

    local response = http.get(host, port, uri, options)

    if ( response.status == 200 ) then
        local title = string.match(response.body, "<[Tt][Ii][Tt][Ll][Ee][^>]*>ArcticFission ([^<]*)</[Tt][Ii][Tt][Ll][Ee]>")

        if ( title == "1.0" ) then
            return "Vulnerable"
        else        
            return "Not Vulnerable"
        end
    end
end