intrigue-ident 0.2 → 0.9.9

data/checks/http/acme.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+class Acme < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "Acme",
+        :product => "Micro Httpd",
+        :references => [ "https://acme.com/software/micro_httpd/" ],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /server: micro_httpd/i,
+        :match_details => "server header",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/acquia.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+class Acquia < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Hosting", "CDN", "PaaS"],
+        :vendor => "Acquia",
+        :product => "Acquia",
+        :references => ["https://docs.acquia.com/acquia-cloud/performance/varnish/headers/"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /X-AH-Environment:/i,
+        :match_details => "Header contains Acquia environment",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/adeptia.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class Adeptia < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS"],
+        :vendor => "Adeptia",
+        :product => "Connect",
+        :references => ["https://adeptia.com/products/Adeptia-Connect-enterprise-integration"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /server: Adeptia/i,
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false  
+      }
+    ]
+  end
+
+
+end
+end
+end
+end

data/checks/http/adobe.rb

@@ -0,0 +1,168 @@
+module Intrigue
+module Ident
+module Check
+class Adobe < Intrigue::Ident::Check::Base
+
+  ### 
+  ### Handy: Metasploit: /modules/auxiliary/scanner/http/coldfusion_version.rb
+  ###
+
+  def generate_checks(url)
+    [
+      # TODO, put more work into finding coldfusion on the front page... 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Adobe",
+        :product => "Coldfusion",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content => /CFTOKEN=/,
+        :match_details => "Adobe Coldfusion Cookie Match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      { # Coldfusion  
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Adobe",
+        :product => "Coldfusion",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /<meta name=\"Author\" content=\"Copyright \(c\) 1995\-2010 Adobe/,
+        :match_details => "body content",
+        :hide => false,
+        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
+        :require_product => "Coldfusion",
+        :inference => false
+      },
+      { # Coldfusion 6, 7  
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Adobe",
+        :references => [
+            "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/coldfusion_version.rb"
+        ],
+        :product => "Coldfusion",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content => />\s*Version:\s.*<\/strong\><br\s\//,
+        :dynamic_version => lambda {|x| 
+            version = _first_body_capture(x,/>\s*Version:\s*(.*)<\/strong\><br\s\//)
+            version =~ /^6/ ? "MX6 #{x}" : "MX7 #{x}"
+         },
+        :match_details => "Body content, version string",
+        :hide => false,
+        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
+        :require_product => "Coldfusion",
+        :inference => true
+      },
+      { # Coldfusion 10 ... this needs OR/AND ?
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Adobe",
+        :product => "Coldfusion",
+        :version => "10",
+        :match_type => :content_body,
+        :match_content => /<meta name=\"Author\" content=\"Copyright \(c\) 1995\-2010 Adobe.*1997\-2012 Adobe Systems Incorporated and its licensors/m,
+        :match_details => "body content",
+        :hide => false,
+        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
+        :require_product => "Coldfusion",
+        :inference => true
+      },
+      { # Coldfusion 11 ... this needs OR/AND ?
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Adobe",
+        :product => "Coldfusion",
+        :version => "11",
+        :match_type => :content_body,
+        :match_content => /&copy; 1997 - 2014 Adobe Systems Incorporated and its licensors/m,
+        :match_details => "body content",
+        :hide => false,
+        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
+        :require_product => "Coldfusion",
+        :inference => true
+      },
+      # 
+      { # Generic check 
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Adobe",
+        :product => "Coldfusion",
+        :version => nil,
+        :dynamic_version => lambda { |x| 
+            version = _first_body_capture(x,/<meta name=\"Keywords\" content=\"(.*)\">\s+<meta name/)
+         },
+        :match_type => :content_body,
+        :match_content => /<meta name=\"Keywords\" content=\".*\">\s+<meta name/,
+        :match_details => "body content",
+        :hide => false,
+        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
+        :require_product => "Coldfusion",
+        :inference => true
+      },
+
+=begin
+      # TODO .. implement array for match content (AND) and then grab the rest of these 
+      # 
+      # Check is disabled until we can find something better... ridiculous to make a 
+      # check against every URL just because we havent yet found something on the base page for AEM
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :vendor => "Adobe",
+        :tags => ["CMS","Marketing"],
+        :product => "Experience Manager",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /AEM/,
+        :match_details => "Adobe Experience Manager",
+        :hide => false,
+        :paths => ["#{url}/libs/granite/core/content/login.html"],
+        :inference => false
+      },
+=end    
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS", "Editor"],
+        :vendor => "Adobe",
+        :product => "Fireworks MX",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /Fireworks MX Dreamweaver MX/,
+        :match_details => "generator string in the body",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS","Marketing", "SaaS"],
+        :vendor => "Adobe",
+        :product => "Omniture DC",
+        :version => nil,
+        :dynamic_version => lambda { |x| _first_header_capture(x,/server: Omniture DC\/(.*)/) },
+        :match_type => :content_headers,
+        :match_content => /server: Omniture DC/,
+        :match_details => "Omniture server header",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/advantshop.rb

@@ -0,0 +1,33 @@
+module Intrigue
+module Ident
+module Check
+class Advantshop < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+=begin
+
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Advantshop",
+        :product => "Advantshop",
+        :references => ["https://www.advantshop.net/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /AdVantShop.NET/i,
+        :dynamic_version => lambda { |x|  _first_body_capture(x, /AdVantShop.NET (  )/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+=end
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/afrihost.rb

@@ -0,0 +1,29 @@
+  module Intrigue
+  module Ident
+  module Check
+  class AfriHost < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "AfriHost",
+          :product => "AfriHost",
+          :website => "https://www.afrihost.com/",
+          :version => nil,
+          :match_type => :content_title,
+          :match_content => /Domain Parked/i,
+          :match_details => "Domain Parked",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+
+  end
+  end
+  end
+  end

data/checks/http/aftermarketpl.rb

@@ -0,0 +1,46 @@
+module Intrigue
+  module Ident
+  module Check
+  class AfterMarketPl < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "AfterMarketPL",
+          :product => "AfterMarketPL",
+          :website => "https://www.aftermarket.pl/",
+          :references => [],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /<\/strong> has been registered on <strong>/i,
+          :match_details => "<\/strong> has been registered on <strong>",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "AfterMarketPL",
+          :product => "AfterMarketPL",
+          :website => "https://www.aftermarket.pl/",
+          :references => [],
+          :version => nil,
+          :match_type => :content_title,
+          :match_content => /AfterMarket\.pl :: domain /i,
+          :match_details => "AfterMarket\.pl :: domain ",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end

data/checks/http/agility.rb

@@ -0,0 +1,34 @@
+module Intrigue
+module Ident
+module Check
+class AgilityCMS < Intrigue::Ident::Check::Base
+
+
+  def generate_checks(url)
+    [
+=begin
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Agility",
+        :product => "AgilityCMS",
+        :references => ["https://agilitycms.com/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /Agility CMS/i,
+        :dynamic_version => lambda { |x|  _first_body_capture(x, /Agility CMS (\d+)/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+=end
+    ]
+  end
+
+
+end
+end
+end
+end

data/checks/http/akamai.rb

@@ -0,0 +1,88 @@
+module Intrigue
+module Ident
+module Check
+class Akamai < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["CDN"],
+        :vendor => "Akamai",
+        :product => "Akamai",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /server: AkamaiGHost$/i,
+        :match_details =>"ghost server header",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["CDN"],
+        :vendor => "Akamai",
+        :product => "Akamai",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>/,
+        :match_details =>"Akamai Missing Uri",
+        :hide => true,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :vendor => "Akamai",
+        :tags => ["CDN", "WAF"],
+        :product => "Akamai",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /x-akamai-transformed:.*/,
+        :match_details =>"Akamai transformed header",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :vendor => "Akamai",
+        :tags => ["CDN", "WAF"],
+        :references => [
+            "https://learn.akamai.com/en-us/webhelp/ion/web-performance-getting-started-for-http-properties/GUID-3ABC638E-14E9-4858-BD4F-BF345BC254F3.html"
+        ], 
+        :product => "Akamai (Staging Network)",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /X-Akamai-Staging: ESSL/,
+        :match_details =>"Akamai transformed header",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :vendor => "Akamai",
+        :tags => ["CDN", "WAF"],
+        :references => [
+            "https://learn.akamai.com/en-us/webhelp/ion/web-performance-getting-started-for-http-properties/GUID-3ABC638E-14E9-4858-BD4F-BF345BC254F3.html"
+        ],
+        :product => "Akamai (Staging Network)",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /X-Akamai-Staging: EdgeSuite/,
+        :match_details =>"Akamai transformed header",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end