这个 Zeek 包检测 HTTP 头中的 Boa web server 字符串。所有 Boa 版本均被视为存在漏洞：
当观察到 /^Boa\/.*/ 服务器字符串时，此包会针对连接的 c$id$resp_h 发出一个通知 BoaDetector::Vulnerable_Boa_Web_Server。
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open 2022-11-28-16-56-57
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double
1669216431.624776 CHhAvVGS1DHFjwGM9 127.0.0.1 59213 127.0.0.1 80 - - - tcp BoaDetector::Vulnerable_Boa_Web_Server Vulnerable Boa web server header observed: Boa/0.94.14rc21 See https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ for more info. 127.0.0.1 127.0.0.1 80 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1669216442.169350 ClEkJM2Vm5giqnMf4h ::1 60096 ::1 80 - - - tcp BoaDetector::Vulnerable_Boa_Web_Server Vulnerable Boa web server header observed: Boa/0.94.14rc21 See https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ for more info. ::1 ::1 80 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
#close 2022-11-28-16-56-57