intrigue-ident 0.2 → 0.9.9

data/checks/http/nexicom.rb

@@ -0,0 +1,44 @@
+  module Intrigue
+  module Ident
+  module Check
+  class Nexicom < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "Nexicom",
+          :product => "Nexicom",
+          :website => "https://nexicom.net/",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /\<STRONG\>What\ is\ Domain\ Parking\?\<\/STRONG\>/i,
+          :match_details => "<STRONG>What is Domain Parking?</STRONG>",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "Nexicom",
+          :product => "Nexicom",
+          :website => "https://nexicom.net/",
+          :version => nil,
+          :match_type => :content_title,
+          :match_content => /Park\ your\ Domain\ \@\ Nexicom/i,
+          :match_details => "Park\ your\ Domain\ \@\ Nexicom",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+
+  end
+  end
+  end
+  end

data/checks/http/nginx.rb

@@ -0,0 +1,82 @@
+module Intrigue
+module Ident
+module Check
+class Nginx < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "Nginx",
+        :product =>"Nginx",
+        :match_details =>"Nginx default page",
+        :version => nil,
+        :match_type => :content_title,
+        :match_content =>  /^Welcome to nginx\!?$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "Nginx",
+        :product =>"Nginx",
+        :match_details =>"Nginx test page",
+        :version => nil,
+        :match_type => :content_title,
+        :match_content =>  /^Test Page for the Nginx HTTP Server/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "Nginx",
+        :product =>"Nginx",
+        :match_details =>"Nginx (no version)",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server: nginx$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "Nginx",
+        :product =>"Nginx",
+        :match_details =>"Nginx (with version)",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:.*nginx\/([\d\.]*).*/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:.*nginx\/([\d\.]*).*/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "Nginx",
+        :product =>"Nginx",
+        :match_details =>"nginx default 404 page - TODO needs multiline",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /<hr><center>nginx<\/center>/i,
+        :hide => true,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/nisource.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+class NiSource < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor => "NiSource",
+        :product => "NiSource",
+        :references => ["https://www.nisource.com/"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:\ NiSource$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:\ NiSource$/i) },
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/nodejs.rb

@@ -0,0 +1,79 @@
+module Intrigue
+module Ident
+module Check
+class Nodejs < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor =>"Node.js",
+        :product =>"Node.js",
+        :match_details =>"unique error page",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /^<pre>Cannot GET \/doesntexist-123<\/pre>$/i,
+        :paths => ["#{url}/doesntexist-123"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor =>"Node.js",
+        :product =>"Node.js",
+        :match_details =>"unique error page",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content =>  /sails.sid=/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor =>"Node.js",
+        :product =>"Node.js",
+        :match_details =>"x-powered-by (sails.js)",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-powered-by: Sails$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"Sails.js",
+        :product =>"Sails",
+        :match_details =>"unique error page",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content =>  /sails.sid=/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"Sails.js",
+        :product =>"Sails",
+        :match_details =>"x-powered-by header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-powered-by: Sails$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/okta.rb

@@ -0,0 +1,53 @@
+module Intrigue
+module Ident
+module Check
+class Okta < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["IAM", "SaaS", "Security"],
+        :vendor =>"Okta",
+        :product =>"Okta",
+        :match_details =>"okta header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /x-okta-backend/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["IAM", "SaaS", "Security"],
+        :vendor =>"Okta",
+        :product =>"Okta",
+        :match_details =>"okta header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /x-okta-request-id/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["IAM", "SaaS", "Security"],
+        :vendor =>"Okta",
+        :product =>"Okta",
+        :match_details =>"okta container div",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /class="auth okta-container">/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/ookla.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+class Ookla < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS"],
+        :vendor =>"Ookla",
+        :product =>"Speedtest Server",
+        :match_details => "page title",
+        :match_type => :content_body,
+        :references => ["https://support.ookla.com/hc/en-us/articles/234578568-How-To-Install-Submit-Server"],
+        :match_content => /<title>OoklaServer/,
+        :version => nil,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/openbsd.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class Openbsd < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Library"],
+        :vendor =>"OpenBSD",
+        :product =>"LibreSSL",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^.*LibreSSL\/.*$/i,
+        :dynamic_version => lambda { |x|
+          _first_header_capture(x,/^.*LibreSSL\/([\w\d\.\-]*)\s.*$/i)
+        },
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/openresty.rb

@@ -0,0 +1,41 @@
+module Intrigue
+module Ident
+module Check
+class OpenResty < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor =>"OpenResty",
+        :product =>"OpenResty",
+        :match_details =>"server header for OpenResty",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /server: openresty/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Server"],
+        :vendor =>"OpenResty",
+        :product =>"OpenResty",
+        :match_details =>"server header for OpenResty with version",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /server: openresty\/[\d\.]+/i,
+        :dynamic_version => lambda {|x| _first_header_capture(x, /server: openresty\/([\d\.]+)/i)},
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/openscholar.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class OpenScholar < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"OpenScholar",
+        :product =>"OpenScholar",
+        :match_details =>"x-powered-by header",
+        :version => nil,
+        :match_type => :content_header,
+        :match_content =>  /x-powered-by: OpenScholar/i,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/opensolution.rb

@@ -0,0 +1,46 @@
+module Intrigue
+module Ident
+module Check
+class OpenSolutionCMS < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "OpenSolution",
+        :product => "Quick.Cart",
+        :references => ["https://opensolution.org/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /Quick.Cart(.*?)v([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /ext v([\d\.]+)/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "OpenSolution",
+        :product => "Quick.Cms",
+        :references => ["https://opensolution.org/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /quick.cms v([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /quick.cms v([\d\.]+)/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end