intrigue-ident 0.2 → 0.9.9

data/checks/http/gitlab.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+  class Gitlab < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["COTS", "Development"],
+          :vendor => "Gitlab",
+          :product => "Gitlab",
+          :match_details => "Gitlab",
+          :version => nil,
+          :match_type => :content_cookies,
+          :match_content =>  /_gitlab_session/i,
+          :dynamic_version => lambda{ |x|
+              _first_body_capture(x,/window.gon={};gon.api_version=\"v([0-9\.])\"/i)
+          },
+          :paths => ["#{url}"],
+          :inference => true
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/checks/http/glimpse.rb

@@ -0,0 +1,32 @@
+module Intrigue
+module Ident
+module Check
+class Glimpse < Intrigue::Ident::Check::Base
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor => "Glimpse",
+        :product => "Glimpse",
+        :match_details => "glimpse.axd version",
+        :version => nil,
+        :references => [
+          "https://docs.microsoft.com/en-us/aspnet/mvc/overview/performance/profile-and-debug-your-aspnet-mvc-app-with-glimpse"
+        ],
+        :dynamic_version => lambda { |x| 
+          _first_body_capture(x,/name="glimpseRuntimeVersion" value="([\d\.]*)"/) 
+        },
+        :match_type => :content_body,
+        :match_content => /Glimpse - Configuration Page/,
+        :paths => ["#{url}/glimpse.axd"],
+        :require_product => "ASP.NET",
+        :inference => true
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/globalscape.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+  class Globalscape < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["COTS"],
+          :vendor => "Globalscape",
+          :product => "Secure FTP Server",
+          :match_details => "lost password link",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content =>  /\/EFTClient\/Account\/LostPassword.htm/i,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/checks/http/goahead.rb

@@ -0,0 +1,31 @@
+module Intrigue
+module Ident
+module Check
+  class Goahead < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        # Server: Goahead/2.5.0 PeerSec-MatrixSSL/3.2.1-OPEN
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["IoT"],
+          :vendor => "EmbedThis",
+          :product => "GoAhead",
+          :match_details => "GoAhead",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /^Server: Goahead.*$/i,
+          :dynamic_version => lambda{ |x|
+              _first_body_capture(x,/^Server: Goahead\/(\d.\d.\d).*$/i)
+          },
+          :paths => ["#{url}"],
+          :inference => true
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/checks/http/godaddy.rb

@@ -0,0 +1,31 @@
+module Intrigue
+  module Ident
+  module Check
+  class Godaddy < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "Godaddy",
+          :product => "Godaddy",
+          :website => "https://www.godaddy.com",
+          :references => [],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /This Web page is parked for FREE, courtesy of.*GoDaddy.com/im,
+          :match_details => "parking string in body",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/google.rb

@@ -0,0 +1,164 @@
+module Intrigue
+module Ident
+module Check
+  class Google < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Marketing","Javascript"],
+          :vendor => "Google",
+          :product =>"Analytics",
+          :match_details =>"UA string",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content =>  /getTracker\([\"|\']UA-/im,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Marketing","Javascript"],
+          :vendor => "Google",
+          :product =>"Analytics",
+          :match_details =>"load string",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content =>  /www.google-analytics.com\/analytics.js','ga'/im,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["IaaS", "SaaS"],
+          :vendor => "Google",
+          :product => "Google",
+          :references => ["https://cloud.google.com/storage/docs/xml-api/reference-headers"],
+          :match_details => "unique header",
+          :match_type => :content_headers,
+          :version => nil,
+          :match_content =>  /^x-goog-stored-content-encoding:.*$/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["IaaS"],
+          :vendor => "Gooogle",
+          :product => "Google",
+          :references => ["https://cloud.google.com/storage/docs/xml-api/reference-headers"],
+          :match_details => "unique header",
+          :match_type => :content_headers,
+          :version => nil,
+          :match_content =>  /^x-goog-generation:.*$/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["SaaS"],
+          :vendor => "Google",
+          :product => "Google",
+          :match_details => "server header",
+          :match_type => :content_headers,
+          :version => nil,
+          :match_content =>  /^server: ghs$/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["SaaS"],
+          :vendor => "Google",
+          :product => "Google",
+          :match_details => "server header",
+          :match_type => :content_headers,
+          :version => nil,
+          :match_content =>  /^server: GSE$/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["SaaS"],
+          :vendor => "Google",
+          :product => "Google",
+          :match_details => "Google Missing Page",
+          :match_type => :content_body,
+          :version => nil,
+          :match_content =>  /The requested URL <code>\/<\/code> was not found on this server\./,
+          :hide => true,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["Embedded", "Appliance","COTS"],
+          :vendor => "Google",
+          :product =>"Search Appliance",
+          :match_details =>"server header reports google search appliance",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /server: Google Search Appliance/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["Marketing","Javascript"],
+          :vendor => "Google",
+          :product =>"Tag Manager",
+          :match_details =>"js load string",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content =>  /<!-- End Google Tag Manager -->/im,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["Web Server", "Hosting", "SaaS"],
+          :vendor => "Google",
+          :product =>"Google Web Server",
+          :match_details =>"Google web server header",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /^server: gws$/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        # Currently match_content too loose, also no point in inference if we dont' have a versions
+        #{
+        #  :type => "fingerprint",
+        #  :category => "application",
+        #  :tags => ["CMS"],
+        #  :vendor => "Google",
+        #  :product => "blogger",
+        #  :references => ["https://www.blogger.com/"],
+        #  :version => nil,
+        #  :match_type => :content_body,
+        #  :match_content => /blogger/i,
+        #  :dynamic_version => nil,
+        #  :match_details => "header match",
+        #  :hide => false,
+        #  :paths => ["#{url}"],
+        #  :inference => true
+        #}
+      ]
+    end
+
+  end
+end
+end
+end

data/checks/http/google_cloud.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+  class GoogleCloud < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Networking", "Load Balancer"],
+          :vendor => "Google Cloud",
+          :product =>"Load Balancewr",
+          :match_details =>"cookie",
+          :version => nil,
+          :match_type => :content_cookies,
+          :match_content => /GCLB=/i,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/checks/http/grafana.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+  class Grafana < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["COTS","Development"],
+          :vendor => "Grafana",
+          :product =>"Grafana",
+          :match_details =>"Grafana",
+          :version => nil,
+          :match_type => :content_cookies,
+          :match_content =>  /grafana_sess/i,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/checks/http/gunicorn.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+  class Gunicorn < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["COTS","Development"],
+          :vendor => "Gunicorn",
+          :product =>"Gunicorn",
+          :match_details =>"server",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /server: gunicorn/i,
+          :dynamic_version => lambda{ |x|
+            _first_header_capture(x,/server: gunicorn\/(.*)/)
+          },
+          :paths => ["#{url}"],
+          :inference => true
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/checks/http/haskell.rb

@@ -0,0 +1,31 @@
+module Intrigue
+  module Ident
+  module Check
+    class Haskell < Intrigue::Ident::Check::Base
+  
+      def generate_checks(url)
+        [
+          {
+            :type => "fingerprint",
+            :category => "application",
+            :tags => ["Web Framework"],
+            :vendor =>"Haskell",
+            :product =>"Snap",
+            :match_details =>"server header",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /server: Snap\/[\d\.]+$/i,
+            :dynamic_version => lambda { |x|
+              _first_header_capture(x,/server: Snap\/([\d\.]+)$/i)
+            },
+            :paths => ["#{url}"],
+            :inference => false
+          }
+        ]
+      end
+  
+    end
+  end
+  end
+  end
+  

data/checks/http/heroku.rb

@@ -0,0 +1,77 @@
+module Intrigue
+module Ident
+module Check
+class Heroku < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["PaaS"],
+        :vendor => "Heroku",
+        :product =>"Heroku",
+        :match_details =>"Heroku (error page)",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /src=\"\/\/www.herokucdn.com\/error-pages\/no-such-app.html/,
+        :dynamic_hide => lambda{ |x| 
+          return true if _uri_match(x,/heroku.com/)       || 
+                         _uri_match(x,/herokussl.com/)    || 
+                         _uri_match(x,/herokudns.com/)    ||
+                         _uri_match(x,/herokuapp.com/)    || 
+                         _uri_match(x,/amazonaws.com/)    || 
+                         _uri_match(x,/\d+.\d+.\d+.\d+:/) 
+        },
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["PaaS"],
+        :vendor => "Heroku",
+        :product =>"Heroku",
+        :match_details =>"Heroku vegur server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /^via: [\d\.]+ vegur/i,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["PaaS"],
+        :vendor => "Heroku",
+        :product =>"Heroku",
+        :match_details =>"Heroku header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server: Cowboy$/i,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["PaaS"],
+        :vendor => "Heroku",
+        :product =>"Heroku",
+        :match_details =>"heroku offline iframe",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /www\.herokucdn\.com\/error-pages\/maintenance-mode\.html\"\>\<\/iframe\>/i,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end