intrigue-ident 0.2 → 0.9.9

data/checks/http/hikvision.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+class HikVision < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["IoT"],
+        :vendor => "HikVision",
+        :product => "DNVRS",
+        :references => ["https://www.hikvision.com/en/products/Turbo-HD-Products/Turbo-HD-Cameras/IOT-Series/"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:\ DNVRS-Webs$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:\ DNVRS-Webs$/i) },
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/hp.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Hp < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Embedded", "Printer"],
+        :vendor => "HP",
+        :product =>"HP-ChaiSOE",
+        :version => "1.0",
+        :match_type => :content_headers,
+        :match_content =>  /server: HP-ChaiSOE\/1.0/i,
+        :match_details =>"Generic HP Printer match",
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+  
+end
+end
+end
+end

data/checks/http/hubspot.rb

@@ -0,0 +1,104 @@
+module Intrigue
+module Ident
+module Check
+class Hubspot < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing", "Javascript"],
+        :vendor => "Hubspot",
+        :product =>"Analytics",
+        :match_details =>"unique string",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<!-- End of HubSpot Analytics Code -->/,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing", "SaaS"],
+        :vendor => "Hubspot",
+        :product =>"Hubspot",
+        :match_details =>"x-powered-by header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /x-powered-by: HubSpot/,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing", "SaaS"],
+        :vendor => "Hubspot",
+        :product =>"Hubspot",
+        :match_details =>"x-hs-content-group-id header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-hs-content-group-id:.*$/,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing", "SaaS"],
+        :vendor => "Hubspot",
+        :product =>"Hubspot",
+        :match_details =>"x-hs-content-group-id header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-hs-cache-config:.*$/,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing", "Javascript"],
+        :vendor => "Hubspot",
+        :product =>"Template Builder",
+        :references => [
+          "https://www.betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html"
+        ],
+        :match_details =>"unique string",
+        :version => nil,
+        :match_type => :content_body,
+        :dynamic_version => lambda {|x|
+          _first_body_capture(x,/<!-- Generated by the HubSpot Template Builder - template version ([\d\.]*)  \ -->/i,)
+        },
+        :match_content =>  /<!-- Generated by the HubSpot Template Builder - template version [\d\.]*\ -->/,
+        :hide => true,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing"],
+        :vendor => "Hubspot",
+        :product =>"Hubspot",
+        :match_details =>"generator string",
+        :version => nil,
+        :match_type => :content_generator,
+        :match_content => /HubSpot/,
+        :hide => true,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/ibm.rb

@@ -0,0 +1,182 @@
+module Intrigue
+module Ident
+module Check
+class Ibm < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Embedded", "Appliance","COTS", "Web Server"],
+        :vendor => "IBM",
+        :product =>"Datapower",
+        :references => ["https://www.ibm.com/developerworks/community/blogs/HermannSW/entry/datapower_x_backside_transport_transfer_encoding_and_connection_header_fields9?lang=en"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /X-Backside-Transport:/i,
+        :match_details =>"header thrown by ibm datapower (on error)",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "IBM",
+        :product =>"HTTP Server",
+        :references => [],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<address>IBM_HTTP_Server Server/i,
+        :match_details =>"error thrown by ibm http server",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "IBM",
+        :product =>"HTTP Server",
+        :references => [],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server: IBM_HTTP_Server/i,
+        :match_details =>"server header",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Administrative","COTS"],
+        :vendor => "IBM",
+        :product =>"IBM Security Access Manager for Web",
+        :references => ["https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.2.1/com.ibm.isam.doc/wrp_config/concept/con_sam_intro.html"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /www-authenticate: Basic realm=\"IBM Security Access Manager for Web\"/i,
+        :match_details =>"IBM security access manager login prompt",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Administrative","COTS"],
+        :vendor => "IBM",
+        :product =>"Tivoli Access Manager for e-business",
+        :references => ["https://www.ibm.com/support/knowledgecenter/en/SSPREK_6.1.0/com.ibm.itame.doc_6.1/am61_qsg_en.htm"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<title>Access Manager for e-Business Login/i,
+        :match_details =>"Generic Ibm tivoli copyright",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server","COTS"],
+        :vendor => "IBM",
+        :product =>"WebSEAL",
+        :references => ["https://www.ibm.com/support/knowledgecenter/en/SSPREK_8.0.1.2/com.ibm.isamw.doc_8.0.1.2/wrp_config/task/tsk_submt_form_data_ws.html"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<form method=\"POST\" action=\"\/pkmslogin.form\">/i,
+        :match_details =>"form action to submit to webseal (on ourselves)",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server","COTS"],
+        :vendor => "IBM",
+        :product =>"WebSEAL",
+        :references => ["https://www.ibm.com/support/knowledgecenter/en/SSPREK_8.0.1.2/com.ibm.isamw.doc_8.0.1.2/wrp_config/task/tsk_submt_form_data_ws.html"],
+        :match_type => :content_headers,
+        :match_content =>  /^server:\ WebSEAL\/[\d\.]{1,}(\ \(Build \d{6}\)){0,1}$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:\ WebSEAL\/[\d\.]{1,}(\ \(Build \d{6}\)){0,1}$/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "IBM",
+        :product =>"WebSphere",
+        :references => ["https://github.com/wireghoul/lbmap/commit/2d15ace54266ecf146fdf8a06f4d226398ddd19c"],
+        :match_type => :content_headers,
+        :match_content =>  /^\$WSEP:.*$/i,
+        :match_details => "header",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "IBM",
+        :product =>"WebSphere",
+        :references => [],
+        :match_type => :content_headers,
+        :match_content =>  /^server: WebSphere Application Server\/[\d\.]+$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server: WebSphere Application Server\/([\d\.]+)/i) },
+        :match_details => "webphere header",
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "IBM",
+        :product =>"WebSphere",
+        :references => ["https://github.com/danamodio/webintel"],
+        :version => "6.1",
+        :match_type => :content_body,
+        :match_content =>  /infocenter\/wasinfo\/v6r1/i,
+        :match_details => "header",
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "IBM",
+        :product =>"WebSphere",
+        :references => ["https://github.com/wireghoul/lbmap/commit/2d15ace54266ecf146fdf8a06f4d226398ddd19c"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /SRVE0190E: File not found/i,
+        :match_details => "header",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "IBM",
+        :product =>"WebSphere",
+        :references => ["https://github.com/wireghoul/lbmap/commit/2d15ace54266ecf146fdf8a06f4d226398ddd19c"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /SRVE0190E: File not found/i,
+        :match_details => "header",
+        :paths => ["#{url}/doesntexist-123"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/icewarp.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+class IceWarp < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Productivity", "COTS", "Email"],
+        :vendor => "IceWarp",
+        :product => "IceWarp",
+        :references => ["https://www.icewarp.com/"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:\ IceWarp\/(\d{1,}\.\d{1,}\.\d{1,})$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:\ IceWarp\/(\d{1,}\.\d{1,}\.\d{1,})$/i) },
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/impresspages.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class ImpressPages < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "ImpressPages",
+        :product => "ImpressPages",
+        :references => ["https://www.impresspages.org/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /impresspages/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /impresspages (.*\d)/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+  
+end
+end
+end
+end

data/checks/http/imunify360.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+class Imunify360 < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Web Server","Proxy Server"],
+        :vendor => "CloudLinux",
+        :product => "Imunify360",
+        :references => ["https://www.imunify360.com/blog/webshield-introduction-for-server-administrators"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:\ imunify360-webshield\/[\d\.]{1,}$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:\ imunify360-webshield\/[\d\.]{1,}$/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/incapsula.rb

@@ -0,0 +1,54 @@
+module Intrigue
+module Ident
+module Check
+class Incapsula < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["CDN","WAF"],
+        :vendor =>"Incapsula",
+        :product =>"CDN",
+        :match_details =>"incapsula header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-iinfo:\ .*$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["CDN","WAF"],
+        :vendor =>"Incapsula",
+        :product =>"CDN",
+        :match_details =>"incapsula header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-cdn: Incapsula$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["CDN","WAF"],
+        :vendor =>"Incapsula",
+        :product =>"CDN",
+        :match_details =>"incapsula header (miss)",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /Request unsuccessful. Incapsula incident ID/i,
+        :paths => ["#{url}"],
+        :inference => false,
+        :hide => true 
+      } 
+    ]
+  end
+
+end
+end
+end
+end