intrigue-ident 0.2 → 0.9.9

data/checks/http/pfsense.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Pfsense < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Firewall"],
+        :vendor => "pfSense",
+        :product =>"pfSense",
+        :match_details => "unique body content",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /Login to pfSense/,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/php.rb

@@ -0,0 +1,72 @@
+module Intrigue
+module Ident
+module Check
+class Php < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+        {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"PHP",
+        :product =>"PHP",
+        :match_details =>"x-powered-by header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /x-powered-by: PHP/i,
+        :dynamic_version => lambda { |x|
+          _first_header_capture(x,/x-powered-by: PHP\/(.*)/i)
+        },
+        :paths => ["#{url}"],
+        :inference => true
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"PHP",
+        :product =>"PHP",
+        :match_details =>"apache server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:.*PHP\/[\d\.]+.*/i,
+        :dynamic_version => lambda { |x|
+          # check for backported OS type
+          backported = false
+          backported = true if _first_header_match(x,/^server:.*\(CentOS\).*$/)
+          backported = true if _first_header_match(x,/^server:.*\(Red Hat\).*$/)
+          backported = true if _first_header_match(x,/^server:.*\(Red Hat Enterprise Linux\).*$/)
+
+          # grab the version
+          version = _first_header_capture(x,/^server:.*PHP\/([\d\.]+).*/i)
+      
+          # return a version string that indicates we can't do inference
+          return "#{version} (Backported)" if backported
+        
+          # otherwise just return the version 
+        version
+        },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"PHP",
+        :product =>"PHP",
+        :match_details =>"PHPSESSID cookie",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content =>  /PHPSESSID=.*/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/phpmyadmin.rb

@@ -0,0 +1,40 @@
+module Intrigue
+module Ident
+module Check
+class PhpMyAdmin < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Administrative","COTS"],
+        :vendor => "PhpMyAdmin",
+        :product => "PhpMyAdmin",
+        :match_details => "PhpMyAdmin",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content =>  /phpMyAdmin=/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Administrative","COTS"],
+        :vendor => "PhpMyAdmin",
+        :product => "PhpMyAdmin",
+        :match_details => "PhpMyAdmin",
+        :version => nil,
+        :match_type => :content_title,
+        :match_content =>  /^PhpMyAdmin$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/phpwind.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class PhpWind < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Phpwind",
+        :product => "Phpwind",
+        :references => ["https://www.phpwind.net/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /phpwind ([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /phpwind ([\d\.]+)/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/phusion.rb

@@ -0,0 +1,59 @@
+module Intrigue
+module Ident
+module Check
+class Phusion < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Phusion",
+        :product =>"Passenger",
+        :match_details =>"x-powered-by header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-powered-by: Phusion Passenger.*$/,
+        :dynamic_version => lambda{|x| 
+          _first_header_capture(x,/x-powered-by: Phusion Passenger (.*)/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Phusion",
+        :product =>"Passenger",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:.*Phusion Passenger.*$/,
+        :dynamic_version => lambda{|x| 
+          _first_header_capture(x,/^server:.*Phusion Passenger\ ([\d\.]*).*/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Phusion",
+        :product =>"Passenger",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:.*Phusion_Passenger.*$/,
+        :dynamic_version => lambda{|x| 
+          _first_header_capture(x,/^server:.*Phusion_Passenger\/([\w\d\.\-]*)\s.*$/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/ping_identity.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+class PingIdentiy < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["IAM"],
+        :vendor => "PingIdentity",
+        :product =>"PingFederate",
+        :references => ["https://ping.force.com/Support/PingFederate/Administration/Single-sign-on-no-target796070NEW"],
+        :match_details =>"redirect (may be interesting)",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^location:.*startSSO.ping/,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/pivotal_software.rb

@@ -0,0 +1,97 @@
+module Intrigue
+module Ident
+module Check
+class PivotalSoftware < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"Pivotal Software",
+        :product =>"Spring Framework",
+        :match_details =>"Standard Spring MVC error page",
+        :match_type => :content_body,
+        :version => nil,
+        :match_content =>  /\{\"timestamp\":\d.*,\"status\":999,\"error\":\"None\",\"message\":\"No message available\"\}/,
+        :paths => ["#{url}/error.json"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"Pivotal Software",
+        :product =>"Spring Framework",
+        :match_details =>"spring cache header",
+        :references => ["https://github.com/atramos/springy-aws"],
+        :match_type => :content_body,
+        :version => nil,
+        :match_content =>  /^x-springy-cache-disabled:.*$/i,
+        :paths => ["#{url}"],
+        :examples => ["x-springy-cache-disabled: 0"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor =>"Pivotal Software",
+        :product =>"Spring Boot",
+        :match_details =>"spring cache header",
+        :references => ["https://stackoverflow.com/questions/40379550/what-is-x-application-context-header"],
+        :match_type => :content_headers,
+        :version => nil,
+        :match_content =>  /^X-Application-Context.*$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Development", "Database"],
+        :vendor => "Pivotal Software",
+        :product => "RabbitMQ",
+        :match_details =>"RabbitMQ",
+        :match_type => :content_body,
+        :version => nil,
+        :match_content =>  /RabbitMQ Management/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Development", "Database"],
+        :vendor => "Pivotal Software",
+        :product => "RabbitMQ",
+        :match_details => "RabbitMQ API",
+        :match_type => :content_body,
+        :version => nil,
+        :match_content =>  /RabbitMQ Management HTTP API/,
+        :paths => ["#{url}/api"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["App Server"],
+        :vendor =>"Pivotal Software",
+        :product =>"tc server",
+        :match_details =>"body version string",
+        :references => ["https://www.vmware.com/products/pivotal-tcserver.html"],
+        :match_type => :content_body,
+        :version => nil,
+        :match_content =>  /Pivotal tc Server Standard Edition [\d\.]+\.RELEASE/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /Pivotal tc Server Standard Edition\ ([\d\.]+)\.RELEASE/i)},
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/pjax.rb

@@ -0,0 +1,40 @@
+module Intrigue
+module Ident
+module Check
+class Pjax < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Javascript"],
+        :vendor =>"pjax",
+        :product =>"pjax",
+        :match_details =>"header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-pjax:.*/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Javascript"],
+        :vendor =>"pjax",
+        :product =>"pjax",
+        :match_details =>"vary header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^vary:.*x-pjax.*/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/plesk.rb

@@ -0,0 +1,58 @@
+module Intrigue
+module Ident
+module Check
+class Plesk < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["COTS"],
+        :vendor => "Plesk",
+        :product =>"Plesk",
+        :references => [],
+        :match_details =>"x-powered-by-plesk... plesklin",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-powered-by: PleskLin/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["COTS"],
+        :vendor => "Plesk",
+        :product =>"Plesk",
+        :references => [],
+        :match_details =>"pleskwin in the header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^PleskWin/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["COTS"],
+        :vendor => "Plesk",
+        :product =>"Plesk",
+        :references => [],
+        :match_details =>"x-powered-by-plesk",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-powered-by-plesk:.*/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+
+
+    ]
+  end
+
+end
+end
+end
+end