intrigue-ident 0.2 → 0.9.9

data/checks/http/seamless_cms.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class SeamlessCMS < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "SeamlessCMS",
+        :product => "SeamlessCMS",
+        :references => ["https://www.seamlesscms.com/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /Published by Seamless.CMS.WebUI, ([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /Published by Seamless.CMS.WebUI, ([\d\.]+)/i)},
+        :match_details => "Header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/securi.rb

@@ -0,0 +1,54 @@
+module Intrigue
+module Ident
+module Check
+class Sucuri < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["SaaS", "WAF", "Security"],
+        :vendor => "Sucuri",
+        :product =>"Cloudproxy",
+        :match_details =>"",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /Server: Sucuri\/Cloudproxy/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["SaaS", "WAF", "Security"],
+        :vendor => "Sucuri",
+        :product =>"Cloudproxy",
+        :match_details =>"",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^X-Sucuri-ID:.*/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["SaaS", "WAF", "Security"],
+        :vendor => "Sucuri",
+        :product =>"Cloudproxy",
+        :match_details =>"",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^X-Sucuri-Cache:.*/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+
+end
+end
+end

data/checks/http/sedo.rb

@@ -0,0 +1,63 @@
+module Intrigue
+  module Ident
+  module Check
+  class Sedo < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "Sedo",
+          :product => "Sedo",
+          :website => "https://sedo.com/us/park-domains/",
+          :references => [],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /sedoParkingUrl:dto.sedoParkingUrl/i,
+          :match_details => "parking string in body",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "Sedo",
+          :product => "Sedo",
+          :website => "https://sedo.com/us/park-domains/",
+          :references => [],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /because\ this\ domain\ has\ been\ parked\ at\ your\ registrar/i,
+          :match_details => "because this domain has been parked at your registrar",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        },
+        {
+          :type => "fingerprint",
+          :category => "service",
+          :tags => ["Parked"],
+          :vendor => "Sedo",
+          :product => "Sedo",
+          :website => "https://sedo.com/us/park-domains/",
+          :references => [],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /FOOTER_DOMAIN_PARKING/,
+          :match_details => "FOOTER_DOMAIN_PARKING",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/segment.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Segment < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Javascript", "SaaS", "APM"],
+        :vendor =>"Segment",
+        :product =>"Segment",
+        :match_details =>"segment js",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /cdn.segment.com\/analytics.js/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/sencha.rb

@@ -0,0 +1,31 @@
+module Intrigue
+  module Ident
+  module Check
+  class Sencha < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["CMS"],
+          :vendor => "Sencha",
+          :product => "Cmd",
+          :references => ["https://www.sencha.com/products/sencha-cmd/"],
+          :version => nil,
+          :match_type => :content_body,
+          :match_content => /<!-- The line below must be kept intact for Sencha Cmd to build your application -->/i,
+          :match_details => "unique comment",
+          :hide => false,
+          :paths => ["#{url}"],
+          :inference => false  
+        }
+      ]
+    end
+  
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/sentry.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Sentry < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Javascript", "SaaS", "APM"],
+        :vendor =>"Sentry",
+        :product =>"Sentry",
+        :match_details =>"sentry init js",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /Sentry.init\({dsn:/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/serendipity.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class Serendipity < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Serendipity",
+        :product => "Serendipity",
+        :references => ["https://docs.s9y.org/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /Serendipity v.([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /Serendipity v.([\d\.]+)/i)},
+        :match_details => "Header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/shopfactory.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class ShopFactory< Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "ShopFactory",
+        :product => "ShopFactoryCMS",
+        :references => [],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /ShopFA([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /V([\.\d]+)/)},
+        :match_details => "Header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/sip.rb

@@ -0,0 +1,29 @@
+module Intrigue
+  module Ident
+  module Check
+  class Sip < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "none",
+          :vendor => "SIP",
+          :product => "SIP",
+          :match_details =>"RTC server header, generic fp (skype, lync, etc)",
+          :version => nil,
+          :hide => false,
+          :match_type => :content_headers,
+          :match_content =>  /^server: RTC\/[\d\.]+/,
+          :dynamic_version => lambda { |x| _first_header_capture(x,/^server: RTC\/([\d\.]+)/)},
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/sitecore.rb

@@ -0,0 +1,39 @@
+module Intrigue
+module Ident
+module Check
+class Sitecore < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor => "Sitecore",
+        :product => "Sitecore CMS",
+        :match_details => "Sitecore Analytics Cookie",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content => /SC_ANALYTICS_GLOBAL_COOKIE=/i,
+        :paths => ["#{url}"], 
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor => "Sitecore",
+        :product => "Sitecore CMS",
+        :match_details =>"powered by header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /x-powered-by:.*Sitecore CMS/,
+        :paths => ["#{url}"],
+        :inference => false
+        }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/smartling.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Smartling < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      { # Magnolia CMS?
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "CMS"],
+        :vendor =>"Smartling",
+        :product =>"Smartling",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /^x-server: Smartling$/i, 
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/smf.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class SimpleMachineForum < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Forum builder"],
+        :vendor => "Simple Machine Forum",
+        :product => "SMF",
+        :references => ["https://www.simplemachines.org/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /SMF ([\d\.]+s)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /SMF ([\d\.]+)/i)},
+        :match_details => "body match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/snews.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class SNews < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Snews",
+        :product => "Snews",
+        :references => ["https://snewscms.com/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /snews ([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /snews ([\d\.]+)/i)},
+        :match_details => "Header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end