From 17fe702314a1768a83fc4790284238ff63a72fb1 Mon Sep 17 00:00:00 2001
From: tomsellers <tomsellers@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Wed, 4 Jul 2012 14:57:27 +0000
Subject: [PATCH] Service detection for Couchbase and Membase NoSQL server's
 web based administrative portal. By default this is on 8091 but can occur on
 any port.

---
 nmap-service-probes | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nmap-service-probes b/nmap-service-probes
index 4ad7fb326..47f716156 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -8484,6 +8484,9 @@ match upnp m|^HTTP/1\.1 501 Not Implemented\r\nContent-Type: text/html\r\nConnec
 
 match vnc-http m|^HTTP/1\.1 200\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nSet-Cookie: UBRWID=[A-F0-9]+\r\nAccess-Control-Allow-Origin: \*\r\nConnection: Keep-Alive\r\n\r\n\xef\xbb\xbf<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<title>ThinVNC</title>\r\n| p/ThinVNC/
 
+match http m|^HTTP/1\.0 405 Method Not Allowed\r\nServer: Membase Server ([\w-.]+)\r\nPragma:| p/Membase Admin httpd/ v/$1/
+match http m|^HTTP/1\.0 405 Method Not Allowed\r\nServer: Couchbase Server ([\w-.]+)\r\nPragma:| p/Couchbase Admin httpd/ v/$1/
+
 ##############################NEXT PROBE##############################
 Probe TCP RTSPRequest q|OPTIONS / RTSP/1.0\r\n\r\n|
 rarity 5