intrigue-ident 0.2 → 0.9.9

data/checks/http/porkbun.rb

@@ -0,0 +1,31 @@
+module Intrigue
+  module Ident
+  module Check
+  class Porkbun < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "Porkbun",
+          :product => "Porkbun",
+          :website => "ttps://porkbun.com/h",
+          :references => [],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /but the owner has not put up a site yet. Visit again soon to see what amazing website they decide to build./i,
+          :match_details => "unique body string",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/progress.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class ProgressCMS < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Progress",
+        :product => "Sitefinity",
+        :references => ["https://www.progress.com/sitefinity-cms"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /sitefinity (.\d*.\d*.\d*.\d*)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /sitefinity (.\d*.\d*.\d*.\d*)/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/proofpoint.rb

@@ -0,0 +1,30 @@
+module Intrigue
+  module Ident
+  module Check
+  class Proofpoint < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["COTS", "Security"],
+          :vendor => "Proofpoint",
+          :product => "Protection Server",
+          :references => ["https://www.proofpoint.com/us/resources/data-sheets/protection-server-technical-brief"],
+          :version => nil,
+          :match_type => :content_title,
+          :match_content => /^Proofpoint Protection Server$/i,
+          :match_details => "title",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/pulsesecure.rb

@@ -0,0 +1,91 @@
+module Intrigue
+module Ident
+module Check
+class PulseSecure < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Networking", "VPN"],
+        :vendor =>"PulseSecure",
+        :product =>"Pulse Connect Secure",
+        :match_details => "page title",
+        :match_type => :content_title,
+        :references => [],
+        :match_content =>  /^Junos Pulse Secure Access Service$/,
+        :version => nil,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Networking", "VPN"],
+        :vendor =>"PulseSecure",
+        :product =>"Pulse Connect Secure",
+        :match_details => "page title",
+        :match_type => :content_title,
+        :references => [],
+        :match_content =>  /^Pulse&#32;Connect&#32;Secure$/,
+        :version => nil,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Networking", "VPN"],
+        :vendor =>"PulseSecure",
+        :product =>"Pulse Connect Secure",
+        :match_details => "unique image link",
+        :references => [
+          "https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40250",
+          "https://github.com/carnal0wnage/Metasploit-Code/blob/master/modules/auxiliary/scanner/juniper_scan.rb",
+          "http://carnal0wnage.attackresearch.com/2013/05/funky-juniper-urls.html" #<^ TODO ... task?
+          ],
+        :match_type => :content_body,
+        :match_content => /<td background="\/dana-na\/imgs\/footerbg.gif">/,
+        :version => nil,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Networking", "VPN"],
+        :vendor =>"PulseSecure",
+        :product =>"Pulse Connect Secure",
+        :match_details => "unique css link",
+        :references => [],
+        :match_type => :content_body,
+        :match_content => /src=\"\/dana-na\/css\/ds.js\">/,
+        :version => nil,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :depends => [{:product => "Pulse Connect Secure"}],
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Networking", "VPN"],
+        :vendor =>"PulseSecure",
+        :product =>"Pulse Connect Secure",
+        :match_details => "info disclosure in nc_gina_ver.txt",
+        :references => ["https://know.bishopfox.com/blog/breaching-the-trusted-perimeter"],
+        :match_type => :content_body,
+        :match_content => /DSSETUP_BUILD_VERSION/,
+        :version => nil,
+        :dynamic_version => lambda{|x| _first_body_capture(x,/VALUE=\"Pulse Secure Network Connect ([\d\.]+)/i) }, 
+        :paths => ["#{url}/dana-na/nc/nc_gina_ver.txt"],
+        :require_product => "Junos Pulse Secure Access Service",
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/python.rb

@@ -0,0 +1,30 @@
+
+module Intrigue
+module Ident
+module Check
+class Python < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor => "Python",
+        :product =>"Python",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:.*Python.*$/,
+        :dynamic_version => lambda{|x| 
+          _first_header_capture(x,/^server:.*Python\/([\d\.]*)\s.*$/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/qnap.rb

@@ -0,0 +1,43 @@
+module Intrigue
+module Ident
+module Check
+  class Qnap < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "hardware",
+          :tags => ["Embedded", "IoT", "Appliance", "NAS"],
+          :vendor => "QNAP",
+          :product => "QTS",
+          :match_details => "unique string",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /Shone added for detecting default system language when no cookie has been set/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "hardware",
+          :tags => ["Embedded", "IoT", "Appliance", "NAS"],
+          :vendor => "QNAP",
+          :product => "QTS",
+          :match_details => "firmware version on handy cgi page",
+          :version => nil,
+          :dynamic_version => lambda { |x|
+            _first_body_capture(x,%r{<version><!\[CDATA\[([\d\.]*)\]\]></version>})
+          },
+          :match_type => :content_body,
+          :match_content => /QDocRoot/,
+          :paths => ["#{url}/cgi-bin/authLogin.cgi"],
+          :require_product => "QTS",
+          :inference => true
+        }
+      ]
+    end
+  end
+end
+end
+end

data/checks/http/qualys.rb

@@ -0,0 +1,69 @@
+
+module Intrigue
+  module Ident
+  module Check
+  class Qualys < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Security"],
+          :vendor =>"Qualys",
+          :product =>"QualysGuard",
+          :match_details =>"custom server header",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /^server: Qualys$/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Security"],
+          :vendor =>"Qualys",
+          :product =>"QualysGuard",
+          :match_details =>"custom server header",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /^server: qweb\/.*$/i,
+          :dynamic_version => lambda { |x| _first_header_capture(x, /^server: qweb\/(.*)$/i)},
+          :paths => ["#{url}"],
+          :inference => true
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Security"],
+          :vendor =>"Qualys",
+          :product =>"Qualys Mobility",
+          :match_details =>"custom server header",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /^server: QMProprietary$/i,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Security"],
+          :vendor =>"Qualys",
+          :product =>"Qualys Mobility",
+          :match_details =>"custom server header",
+          :version => nil,
+          :match_type => :content_cookies,
+          :match_content =>  /QualysSession=/i,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/rapid7.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Rapid7 < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["SaaS"],
+        :vendor =>"Rapid7",
+        :product =>"Logentries",
+        :match_details =>"server header",
+        :references => [],
+        :match_type => :content_headers,
+        :match_content =>  /server: th3 c4k3 is 4 l13\.$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/rbs.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class RbsCMS < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "RBS",
+        :product => "RBS Change",
+        :references => ["https://www.rbschange.fr/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /RBS Change ([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /RBS Change ([\d\.]+)/i)},
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/readmeio.rb

@@ -0,0 +1,28 @@
+
+module Intrigue
+module Ident
+module Check
+class Readmeio < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Javascript", "SaaS", "Support"],
+        :vendor =>"Readme.io",
+        :product =>"Readme.io",
+        :match_details =>"js load string",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /cdn.readme.io\/js\/bundle-hub2.js/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/red_hat.rb

@@ -0,0 +1,95 @@
+module Intrigue
+module Ident
+module Check
+class RedHat < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      #
+      { # server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.2.12
+        :type => "fingerprint",
+        :category => "operating_system",
+        :tags => ["OS"],
+        :vendor =>"Red Hat",
+        :product =>"Enterprise Linux",
+        :match_details =>"nginx test page",
+        :match_type => :content_headers,
+        :match_content =>  /^Apache.* \(Red Hat Enterprise Linux\).*$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "operating_system",
+        :tags => ["OS"],
+        :vendor =>"Red Hat",
+        :product =>"Fedora Linux",
+        :match_details =>"nginx test page",
+        :match_type => :content_title,
+        :match_content =>  /^Test Page for the Nginx HTTP Server on Fedora$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Development", "Administrative", "Hypervisor"],
+        :vendor =>"Red Hat",
+        :product =>"OpenShift Container Platform",
+        :match_details =>"error message in html",
+        :references => ["https://bugzilla.redhat.com/show_bug.cgi?id=1414657"],
+        :match_type => :content_body,
+        :match_content =>  /Route and path matches, but all pods are down./i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Development", "Administrative", "Hypervisor"],
+        :vendor =>"Red Hat",
+        :product =>"OpenShift Container Platform",
+        :match_details =>"title",
+        :references => [""],
+        :match_type => :content_title,
+        :match_content =>  /Login - OpenShift Origin/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Red Hat",
+        :product => "JBoss Core Services",
+        :references => ["https://www.redhat.com/en/resources/jboss-core-services-collection-datasheet"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^Server:\ JBCS\ httpd$/i,
+        :dynamic_version => lambda { |x|
+          _first_header_capture(x,/^Server:\ JBCS\ httpd$/i) },
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Application Server"],
+        :vendor => "Red Hat",
+        :product => "JBoss Enterprise Application Platform",
+        :references => ["https://bugzilla.redhat.com/show_bug.cgi?id=1049103"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /X-Powered-By: JSP\/2./i,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end