intrigue-ident 0.2 → 0.9.9

data/checks/http/content/authentication.rb

@@ -0,0 +1,111 @@
+module Intrigue
+module Ident
+module Check
+class Authentication < Intrigue::Ident::Check::Base
+  
+  def generate_checks(url)
+    [
+      {
+        :type => "content",
+        :name => "Authentication - HTTP",
+        :match_type => :content_headers,
+        :dynamic_result => lambda { |d|
+          return false unless d["details"]["headers"]
+          return true if _first_header_match(d, /^www-authenticate:.*$/)
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "content",
+        :name => "Authentication - NTLM",
+        :match_type => :content_headers,
+        :dynamic_result => lambda { |d|
+          return false unless d["details"]["headers"]
+          return true if _first_header_match(d, /^www-authenticate: NTLM$/i)
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "content",
+        :name =>"Authentication - Forms",
+        :references => [
+          "https://webstersprodigy.net/2010/04/07/nmap-script-to-try-and-detect-login-pages/",
+          "https://nmap.org/nsedoc/scripts/http-auth-finder.html"
+        ],
+        :match_type => :content_body,
+        :dynamic_result => lambda { |d|
+          return true if _body(d) =~ /<input type=\"password\"/im;
+          return true if _body(d) =~ /<script>[^>]*login/im;
+          return true if _body(d) =~ /<[^>]*login/im;
+          return true if _body(d) =~ /<script>[^>]*password/im;
+          return true if _body(d) =~ /<script>[^>]*user/im;
+          return true if _body(d) =~ /<input[^>)]*user/im;
+          return true if _body(d) =~ /<input[^>)]*pass/im;
+          return true if _body(d) =~ /<input[^>)]*pwd/im;
+          return true if _body(d) =~ /log_in/im;
+          return true if _body(d) =~ /log_out/im;
+          return true if _body(d) =~ /class=\"login-btn/im;
+          return true if _body(d) =~ /<[^>]*login/im;
+          return true if _body(d) =~ />Login<\/a>/im;
+          return true if _body(d) =~ />Logout<\/a>/im;
+          return true if _body(d) =~ />Log In<\/a>/im;
+          return true if _body(d) =~ />Log Out<\/a>/im;
+          return true if _body(d) =~ />Sign In<\/a>/im;
+          return true if _body(d) =~ /sign\ in/im;
+          return true if _body(d) =~ /sign_in/im;
+          return true if _body(d) =~ /create an account/im;
+          return true if _body(d) =~ /create_account/im;
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "content",
+        :name => "Authentication - Session Identifier",
+        :references => [
+          "https://github.com/fuzzdb-project/fuzzdb/blob/ecb0850538bc9152949fa4579654d6b64e2fdb97/regex/sessionid.txt"
+        ],
+        :match_type => :content_cookies,
+        :dynamic_result => lambda { |d|
+          return false unless d["details"]["cookies"]
+          return true if _first_cookie_match d, /ASP.NET_SessionId/i
+          return true if _first_cookie_match d, /ASPSESSIONID/i
+          return true if _first_cookie_match d, /ASPXAUTH/i
+          return true if _first_cookie_match d, /barra_counter_session/i
+          return true if _first_cookie_match d, /cfid/i
+          return true if _first_cookie_match d, /cftoken/i
+          return true if _first_cookie_match d, /_enservio_session/i
+          return true if _first_cookie_match d, /grafana_sess/i
+          return true if _first_cookie_match d, /_gitlab_session/i
+          return true if _first_cookie_match d, /jive.login.ts/i
+          return true if _first_cookie_match d, /JSESSIONID/i
+          return true if _first_cookie_match d, /LiSESSIONID/i
+          return true if _first_cookie_match d, /MRHSession/i
+          return true if _first_cookie_match d, /sails.sid/i
+          return true if _first_cookie_match d, /sessid/i
+          return true if _first_cookie_match d, /session/i
+          return true if _first_cookie_match d, /sid/i
+          return true if _first_cookie_match d, /SITESERVER/i
+          return true if _first_cookie_match d, /TWIKISID/i
+          return true if _first_cookie_match d, /viewstate/i
+          return true if _first_cookie_match d, /zenid/i
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+    ]
+  end
+end
+end
+end
+end

data/checks/http/content/content.rb

@@ -0,0 +1,92 @@
+module Intrigue
+module Ident
+module Check
+class Content < Intrigue::Ident::Check::Base
+  
+  def generate_checks(url)
+    [
+      {
+        :type => "content",
+        :name =>"Location Header",
+        :match_type => :content_header,
+        :dynamic_result => lambda { |d| _first_header_capture(d,/^location:(.*)$/i) },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "content",
+        :name =>"Directory Listing Detected",
+        :match_type => :content_title,
+        :dynamic_result => lambda { |d| (  
+          _first_title_match(d,/Index of \//) ||
+          _first_body_match(d, /<h1>Index of \//) || 
+          _first_body_match(d, /\[To Parent Directory\]/) ) ? true : false },
+        :dynamic_hide => lambda { |d| false },
+        :issue => "directory_listing_detected",
+        :paths => ["#{url}"]
+      },
+      #{
+      #  :type => "content",
+      #  :name =>"Open Redirect Detected",
+      #  :match_type => :content_body,
+      #  :references => [
+      #    "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect"
+      #  ],
+      #  :dynamic_result => lambda { |d|
+      #    regex_list = [
+      #    /\?next=http/i,/\?url=http/i,/\?target=http/i,/\?rurl=http/i,
+      #    /\?dest=http/i,/\?destination=http/i,/\?redir=http/i,
+      #    /\?redirect_uri=http/i,/\?redirect_url=http/i,/\?redirect=http/i,
+      #    /\/redirect\/http/i,/\/cgi-bin\/redirect.cgi\?http/i,/\/out\/http/i,
+      #    /\/out\?http/i,/\?view=http/i,/\/login\?to=http/i,/\?image_url=http/i,
+      #    /\?go=http/i,/\?return=http/i,/\?returnTo=http/i,/\?return_to=http/i,
+      #    /\?checkout_url=http/i,/\?continue=http/i,/\?return_path=http/i
+      #    ]
+      #    out = false
+      #    regex_list.each { |regex|
+      #      _first_body_match(d,regex) ? out = true : nil 
+      #    }
+      #  out
+      #  },
+      #  :dynamic_hide => lambda { |d| false },
+      #  :dynamic_issue => lambda { |d| false   },
+      #  :paths => ["#{url}"]
+      #},
+      {
+        :type => "content",
+        :name =>"Form Detected",
+        :match_type => :content_body,
+        :dynamic_result => lambda { |d| _first_body_match(d,/\<form/) ? true : false },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "content",
+        :name =>"File Upload Form Detected",
+        :match_type => :content_body,
+        :dynamic_result => lambda { |d| _first_body_match(d,/enctype=\"multipart\/form-data/) ? true : false },
+        :paths => ["#{url}"],
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+      },
+      {
+        :type => "content",
+        :name =>"Email Addresses Detected",
+        :match_type => :content_title,
+        :dynamic_result => lambda { |d| 
+        email_address_regex = /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i
+          captures = _all_body_captures(d,email_address_regex) || []
+          captures.select{|e| !(e =~ /\.png$/) }.compact
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/content/security_headers.rb

@@ -0,0 +1,70 @@
+module Intrigue
+module Ident
+module Check
+class SecurityHeaders < Intrigue::Ident::Check::Base
+  
+  def generate_checks(url)
+    [
+      {
+        :type => "content",
+        :name => "Access-Control-Allow-Origin Header",
+        :match_type => :content_headers,
+        :dynamic_result => lambda { |d|
+          return true if _first_header_match d, /^Access-Control-Allow-Origin:.*/i;
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "content",
+        :name => "P3P Header",
+        :match_type => :content_headers,
+        :dynamic_result => lambda { |d|
+          return true if _first_header_match d, /^p3p:.*/i;
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      #{
+      #  :type => "content",
+      #  :name => "X-PJAX Header",
+      #  :match_type => :content_headers,
+      #  :dynamic_result => lambda { |d| _first_header_capture d, /^x-pjax-url:(.*)/i },
+      #  :dynamic_hide => lambda { |d| false },
+      #  :dynamic_issue => lambda { |d| false },
+      #  :paths => ["#{url}"]
+      #},
+      {
+        :type => "content",
+        :name => "X-Frame-Options Header",
+        :match_type => :content_headers,
+        :dynamic_result => lambda { |d|
+          return true if _first_header_match d, /^x-frame-options:.*/i;
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "content",
+        :name => "X-XSS-Protection Header",
+        :match_type => :content_headers,
+        :dynamic_result => lambda { |d|
+          return true if _first_header_match d, /^x-xss-protection:.*/i;
+        false
+        },
+        :dynamic_hide => lambda { |d| false },
+        :dynamic_issue => lambda { |d| false },
+        :paths => ["#{url}"]
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/cpanel.rb

@@ -0,0 +1,56 @@
+module Intrigue
+module Ident
+module Check
+class Cpanel < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS","Hosting","Administrative"],
+        :vendor => "cPanel",
+        :product =>"cPanel",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /server: cPanel/i,
+        :paths => ["#{url}"], 
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS","Hosting","Administrative"],
+        :vendor => "cPanel",
+        :product =>"cPanel Hosted - Missing Page",
+        :match_details =>"cPanel Hosted, but either misconfigured, or accessed via ip vs hostname?",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /URL=\/cgi-sys\/defaultwebpage.cgi/,
+        :hide => true,
+        :paths => ["#{url}"], 
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS","Administrative"],
+        :vendor => "cPanel",
+        :product =>"cPanel - Not configured",
+        :match_details =>"cPanel - not yet configured",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /href=\"\/cpanel\"\>log in<\/a> to launch this site/,
+        :hide => true,
+        :paths => ["#{url}"],
+        :examples => ['href="/cpanel">log in</a> to launch this site'], 
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/cradlepoint.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class Cerberus < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "Cradlepoint",
+        :product =>"HTTP Service",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:.*Cerberus.*$/,
+        :dynamic_version => lambda{ |x| 
+          _first_header_capture(x,/^server:.*Cerberus\/([\d\.]*)\s.*$/i) 
+        },
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/craft.rb

@@ -0,0 +1,42 @@
+module Intrigue
+module Ident
+module Check
+class Craft < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Craft",
+        :product =>"CMS",
+        :match_details =>"csrf protection cookie",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content =>  /CRAFT_CSRF_TOKEN/,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Craft",
+        :product =>"CMS",
+        :match_details =>"x-powered-by header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-powered-by: Craft CMS/,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/crazydomains.rb

@@ -0,0 +1,31 @@
+module Intrigue
+  module Ident
+  module Check
+  class CrazyDomains < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "CrazyDomains",
+          :product => "CrazyDomains",
+          :website => "https://www.crazydomains.com.au/",
+          :references => [],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /Domain name is registered and secured with CrazyDomains.com.au/i,
+          :match_details => "unique body string",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/crowdstrike.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Crowdstrike < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Security", "SaaS"],
+        :vendor => "Crowdstrike",
+        :product => "Falcon",
+        :references => [""],
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content => /domain\=\.falcon-sandbox\.com/i,
+        :match_details => "Falcon Sandbox cookie",
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end