intrigue-ident 0.2 → 0.9.9

data/util/list_paths.rb

@@ -0,0 +1,12 @@
+#!/usr/bin/env ruby
+require_relative "../lib/ident"
+include Intrigue::Ident
+
+def list_checks
+  Intrigue::Ident::Http::CheckFactory.checks.map{|x| x.new.generate_checks("[uri]") }.flatten
+  #Intrigue::Ident::Ftp::CheckFactory.checks.map{|x| x.new.generate_checks.flatten
+  #Intrigue::Ident::Smtp::CheckFactory.checks.map{|x| x.new.generate_checks.flatten
+  #Intrigue::Ident::Snmp::CheckFactory.checks.map{|x| x.new.generate_checks.flatten
+end
+
+puts list_checks.map{|c| c[:paths] }.flatten.sort.uniq

data/util/tags.rb

@@ -0,0 +1,36 @@
+#!/usr/bin/env ruby
+require_relative "../lib/ident"
+include Intrigue::Ident
+
+def list_checks
+  Intrigue::Ident::Http::CheckFactory.checks.map{|x| x.new.generate_checks("[uri]") }.flatten
+  #Intrigue::Ident::Ftp::CheckFactory.checks.map{|x| x.new.generate_checks.flatten
+  #Intrigue::Ident::Smtp::CheckFactory.checks.map{|x| x.new.generate_checks.flatten
+  #Intrigue::Ident::Snmp::CheckFactory.checks.map{|x| x.new.generate_checks.flatten
+end
+
+def tag_description(tag_name)
+
+  descriptions = {
+    "Application Server" => "Identified as application server software (ex: Tomcat - note that this is different than \"Web Server\").",
+    "COTS" => "Identified as Commercial Off the Shelf Software installed by the user.",
+    "CDN" => "Identified a Content Delivery Network (ex: Cloudflare, Akamai, LimeLight Networks)",
+    "CMS" => "Identified as Content Mangement System Software (ex: Wordpress)",
+    "IaaS" => "Identified as Infrastructure as a Service. Used when the entity is identified as a IaaS platform (ex: AWS, GCP, Azure, etc).",
+    "Networking" => "Identified as hardware or software relevant to the network infrastructure.",
+    "PaaS" => "Identified as Platform as a Service. Used when a Platform that hosts user code is identified (ex: Heroku, Joyent, etc).",
+    "SaaS" => "Identified as Software as a Service. Used when the entity is hosted as SaaS. (ex: StatusPage, Wix, etc)",
+    "WAF" => "Identified as Web Application Firewall (ex: Cloudflare, Incapsula, etc).",
+    "Web Server" => "Identified as web server software. (ex: Apache, Nginx, IIS)",
+  }
+
+descriptions[tag_name]
+end
+
+tags = list_checks.map{ |x| x[:tags] }.flatten.compact
+tag_counts = Hash.new(0).tap { |h| tags.each { |t| h[t] += 1 } }
+
+tag_counts.sort_by{|t,c| c }.reverse.each  do |t,c|
+  puts "#{c} #{t}: #{tag_description(t.strip)}"
+end
+

data/utils.rb

@@ -0,0 +1,19 @@
+module Intrigue
+module Ident
+module Utils
+
+    ## Helpers 
+    def encode_string(string)
+      return string unless string.kind_of? String
+    string.encode("UTF-8", :undef => :replace, :invalid => :replace, :replace => "?")
+    end
+
+    def encode_hash(hash)
+      return hash unless hash.kind_of? Hash
+      hash.each {|k,v| hash[k] = encode_string(v) if v.kind_of? String }
+    hash
+    end
+
+end
+end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: intrigue-ident
 version: !ruby/object:Gem::Version
-  version: '0.2'
+  version: 0.9.9
 platform: ruby
 authors:
 - jcran
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-07-06 00:00:00.000000000 Z
+date: 2020-06-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -28,16 +28,16 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -52,63 +52,496 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
-description: Fingerprinter for Intrigue Data
+- !ruby/object:Gem::Dependency
+  name: socketry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: snmp
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: recog-intrigue
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Intrigue Asset Fingerprinting Library
 email:
 - jcran@intrigue.io
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".circleci/config.yml"
+- ".gitignore"
+- ".ruby-version"
+- Dockerfile
 - Gemfile
 - Gemfile.lock
-- ident.rb
+- LICENSE.md
+- README.md
+- checks/ftp/base.rb
+- checks/ftp/filezilla.rb
+- checks/ftp/microsoft.rb
+- checks/ftp/proftp.rb
+- checks/ftp/pureftpd.rb
+- checks/ftp/vsftp.rb
+- checks/http/123reg.rb
+- checks/http/acme.rb
+- checks/http/acquia.rb
+- checks/http/adeptia.rb
+- checks/http/adobe.rb
+- checks/http/advantshop.rb
+- checks/http/afrihost.rb
+- checks/http/aftermarketpl.rb
+- checks/http/agility.rb
+- checks/http/akamai.rb
+- checks/http/alkacon.rb
+- checks/http/allegro.rb
+- checks/http/almuba.rb
+- checks/http/amazon.rb
+- checks/http/amirocms.rb
+- checks/http/anelectron.rb
+- checks/http/anquanbao.rb
+- checks/http/aol.rb
+- checks/http/apache.rb
+- checks/http/appdynamics.rb
+- checks/http/arris.rb
+- checks/http/artifactory.rb
+- checks/http/aruba.rb
+- checks/http/atlassian.rb
+- checks/http/auth0.rb
+- checks/http/automattic.rb
+- checks/http/axinom.rb
+- checks/http/axios.rb
+- checks/http/axis.rb
+- checks/http/axway.rb
+- checks/http/backdrop.rb
+- checks/http/banu.rb
+- checks/http/barracuda.rb
+- checks/http/base.rb
+- checks/http/beehive.rb
+- checks/http/bigcartel.rb
+- checks/http/bigcommerce.rb
+- checks/http/binarysec.rb
+- checks/http/bitly.rb
+- checks/http/blackboard.rb
+- checks/http/blueimp.rb
+- checks/http/bomgar.rb
+- checks/http/bootstrap.rb
+- checks/http/bower.rb
+- checks/http/broadcom.rb
+- checks/http/brocade.rb
+- checks/http/browsermedia.rb
+- checks/http/bsm.rb
+- checks/http/bynder.rb
+- checks/http/calibre.rb
+- checks/http/centos.rb
+- checks/http/cerberus.rb
+- checks/http/charity_engine.rb
+- checks/http/checkpoint.rb
+- checks/http/cherokee.rb
+- checks/http/cisco.rb
+- checks/http/citrix.rb
+- checks/http/cloud_city.rb
+- checks/http/cloudflare.rb
+- checks/http/cmsimple.rb
+- checks/http/codeigniter.rb
+- checks/http/communigate.rb
+- checks/http/concrete5.rb
+- checks/http/contenido.rb
+- checks/http/content/analytics.rb
+- checks/http/content/authentication.rb
+- checks/http/content/content.rb
+- checks/http/content/security_headers.rb
+- checks/http/cpanel.rb
+- checks/http/cradlepoint.rb
+- checks/http/craft.rb
+- checks/http/crazydomains.rb
+- checks/http/crowdstrike.rb
+- checks/http/dan.rb
+- checks/http/danneo.rb
+- checks/http/day.rb
+- checks/http/debian.rb
+- checks/http/dell.rb
+- checks/http/dev_php.rb
+- checks/http/discourse.rb
+- checks/http/discuz!.rb
+- checks/http/distil.rb
+- checks/http/django.rb
+- checks/http/dmanager.rb
+- checks/http/dns_made_easy.rb
+- checks/http/docuwiki.rb
+- checks/http/docverify.rb
+- checks/http/domain_parking_ru.rb
+- checks/http/domainname_shop.rb
+- checks/http/dosarrest.rb
+- checks/http/dreamhost.rb
+- checks/http/drupal.rb
+- checks/http/duo.rb
+- checks/http/dyn.rb
+- checks/http/dynamicweb.rb
+- checks/http/dynatrace.rb
+- checks/http/easyname.rb
+- checks/http/eclipse.rb
+- checks/http/enservio.rb
+- checks/http/envoy.rb
+- checks/http/epiccom.rb
+- checks/http/ergon.rb
+- checks/http/expressjs.rb
+- checks/http/ezproxy.rb
+- checks/http/f5.rb
+- checks/http/facebook.rb
+- checks/http/fastly.rb
+- checks/http/first_domains.rb
+- checks/http/flywheel.rb
+- checks/http/forgerock.rb
+- checks/http/fortinet.rb
+- checks/http/fresh_service.rb
+- checks/http/frontify.rb
+- checks/http/generic.rb
+- checks/http/github.rb
+- checks/http/gitlab.rb
+- checks/http/glimpse.rb
+- checks/http/globalscape.rb
+- checks/http/goahead.rb
+- checks/http/godaddy.rb
+- checks/http/google.rb
+- checks/http/google_cloud.rb
+- checks/http/grafana.rb
+- checks/http/gunicorn.rb
+- checks/http/haskell.rb
+- checks/http/heroku.rb
+- checks/http/hikvision.rb
+- checks/http/hp.rb
+- checks/http/hubspot.rb
+- checks/http/ibm.rb
+- checks/http/icewarp.rb
+- checks/http/impresspages.rb
+- checks/http/imunify360.rb
+- checks/http/incapsula.rb
+- checks/http/ingram_micro.rb
+- checks/http/innovative_interfaces_inc.rb
+- checks/http/inside_sales.rb
+- checks/http/instra.rb
+- checks/http/intercom.rb
+- checks/http/ivanti.rb
+- checks/http/jamf.rb
+- checks/http/jekyll.rb
+- checks/http/jenkins.rb
+- checks/http/jetbrains.rb
+- checks/http/jetty.rb
+- checks/http/jforum.rb
+- checks/http/jitbit.rb
+- checks/http/jive.rb
+- checks/http/joomla.rb
+- checks/http/jquery.rb
+- checks/http/jupyter.rb
+- checks/http/kentico.rb
+- checks/http/kerio.rb
+- checks/http/kibana.rb
+- checks/http/kong.rb
+- checks/http/kubernetes.rb
+- checks/http/laravel.rb
+- checks/http/lastpass.rb
+- checks/http/lcn.rb
+- checks/http/leadpages.rb
+- checks/http/lighttpd.rb
+- checks/http/limelight_networks.rb
+- checks/http/limesuvey.rb
+- checks/http/link1.rb
+- checks/http/linksys.rb
+- checks/http/litespeed.rb
+- checks/http/lithium.rb
+- checks/http/lotus.rb
+- checks/http/magento.rb
+- checks/http/magnolia.rb
+- checks/http/mailchimp.rb
+- checks/http/manage_engine.rb
+- checks/http/markmonitor.rb
+- checks/http/mbf_bioscience.rb
+- checks/http/mcafee.rb
+- checks/http/media_temple.rb
+- checks/http/mediawiki.rb
+- checks/http/mhcsoftwareinc.rb
+- checks/http/microsoft.rb
+- checks/http/mikrotik.rb
+- checks/http/modwsgi.rb
+- checks/http/mojolicious.rb
+- checks/http/moodle.rb
+- checks/http/mura.rb
+- checks/http/nagios.rb
+- checks/http/namesilo.rb
+- checks/http/nationbuilder.rb
+- checks/http/nec.rb
+- checks/http/netlify.rb
+- checks/http/netobjects_inc.rb
+- checks/http/netscape.rb
+- checks/http/neustar.rb
+- checks/http/new_relic.rb
+- checks/http/nexicom.rb
+- checks/http/nginx.rb
+- checks/http/nisource.rb
+- checks/http/nodejs.rb
+- checks/http/okta.rb
+- checks/http/ookla.rb
+- checks/http/openbsd.rb
+- checks/http/openresty.rb
+- checks/http/openscholar.rb
+- checks/http/opensolution.rb
+- checks/http/openssl.rb
+- checks/http/opentext.rb
+- checks/http/openvpn.rb
+- checks/http/opscode.rb
+- checks/http/oracle.rb
+- checks/http/orion_technology.rb
+- checks/http/ovh.rb
+- checks/http/palo_alto.rb
+- checks/http/pantheon.rb
+- checks/http/papercut.rb
+- checks/http/parallels.rb
+- checks/http/pardot.rb
+- checks/http/parkingcrew.rb
+- checks/http/pbworks.rb
+- checks/http/perfectsense.rb
+- checks/http/perl.rb
+- checks/http/pfsense.rb
+- checks/http/php.rb
+- checks/http/phpmyadmin.rb
+- checks/http/phpwind.rb
+- checks/http/phusion.rb
+- checks/http/ping_identity.rb
+- checks/http/pivotal_software.rb
+- checks/http/pjax.rb
+- checks/http/plesk.rb
+- checks/http/porkbun.rb
+- checks/http/progress.rb
+- checks/http/proofpoint.rb
+- checks/http/pulsesecure.rb
+- checks/http/python.rb
+- checks/http/qnap.rb
+- checks/http/qualys.rb
+- checks/http/rapid7.rb
+- checks/http/rbs.rb
+- checks/http/readmeio.rb
+- checks/http/red_hat.rb
+- checks/http/redmine.rb
+- checks/http/restlet.rb
+- checks/http/ritecms.rb
+- checks/http/roadiz.rb
+- checks/http/rock.rb
+- checks/http/rollbar.rb
+- checks/http/roundcube.rb
+- checks/http/ruby.rb
+- checks/http/ruckus_wireless.rb
+- checks/http/sailpoint.rb
+- checks/http/salesforce.rb
+- checks/http/sap.rb
+- checks/http/seamless_cms.rb
+- checks/http/securi.rb
+- checks/http/sedo.rb
+- checks/http/segment.rb
+- checks/http/sencha.rb
+- checks/http/sentry.rb
+- checks/http/serendipity.rb
+- checks/http/shopfactory.rb
+- checks/http/sip.rb
+- checks/http/sitecore.rb
+- checks/http/smartling.rb
+- checks/http/smf.rb
+- checks/http/snews.rb
+- checks/http/software_ag.rb
+- checks/http/soha.rb
+- checks/http/solarwinds.rb
+- checks/http/sonatype.rb
+- checks/http/sonicwall.rb
+- checks/http/sophos.rb
+- checks/http/southriver.rb
+- checks/http/splash.rb
+- checks/http/splunk.rb
+- checks/http/springfox.rb
+- checks/http/squarespace.rb
+- checks/http/stackpath.rb
+- checks/http/stibo_systems.rb
+- checks/http/subrion.rb
+- checks/http/symantec.rb
+- checks/http/synacor.rb
+- checks/http/tableau_software.rb
+- checks/http/telerik.rb
+- checks/http/tengine.rb
+- checks/http/tibco.rb
+- checks/http/townnews.rb
+- checks/http/tridium.rb
+- checks/http/twiki.rb
+- checks/http/typo3.rb
+- checks/http/uberflip.rb
+- checks/http/ucoz.rb
+- checks/http/umbraco.rb
+- checks/http/unbounce.rb
+- checks/http/united_domains.rb
+- checks/http/vanilla_forums.rb
+- checks/http/varnish.rb
+- checks/http/vbulletin.rb
+- checks/http/verizon.rb
+- checks/http/vmware.rb
+- checks/http/vue_js.rb
+- checks/http/webflow.rb
+- checks/http/webgui.rb
+- checks/http/webmin.rb
+- checks/http/webpagetest_project.rb
+- checks/http/wftpserver.rb
+- checks/http/wildfly.rb
+- checks/http/wix.rb
+- checks/http/woltlab_gmbh.rb
+- checks/http/wordpress/ithemes.rb
+- checks/http/wordpress/john_godley.rb
+- checks/http/wordpress/pixelcraft.rb
+- checks/http/wordpress/rocklobster.rb
+- checks/http/wordpress/team_heateor.rb
+- checks/http/wordpress/w3_total_cache.rb
+- checks/http/wordpress/wp_fastest_cache.rb
+- checks/http/wordpress/wp_super_cache.rb
+- checks/http/wordpress/wpbakery.rb
+- checks/http/world4you.rb
+- checks/http/wp_engine.rb
+- checks/http/xcms.rb
+- checks/http/xelion.rb
+- checks/http/xerox.rb
+- checks/http/xmb.rb
+- checks/http/xtec.rb
+- checks/http/yaf.rb
+- checks/http/yaws.rb
+- checks/http/yoast.rb
+- checks/http/zeit.rb
+- checks/http/zendesk.rb
+- checks/http/zengenti.rb
+- checks/http/zoho.rb
+- checks/http/zscaler.rb
+- checks/smtp/base.rb
+- checks/smtp/exim.rb
+- checks/snmp/base.rb
+- checks/snmp/cisco.rb
+- checks/ssh/array_networks.rb
+- checks/ssh/base.rb
+- checks/ssh/openssh.rb
+- checks/telnet/base.rb
+- checks/telnet/huawei.rb
+- data/logos/acquia.png
+- data/logos/amazon_cloudfront.png
+- data/logos/apache_coyote.png
+- data/logos/apache_tomcat.png
+- data/logos/atlassian_bamboo.png
+- data/logos/atlassian_bitbucket.png
+- data/logos/atlassian_confluence.png
+- data/logos/atlassian_crowd.png
+- data/logos/atlassian_crucible.png
+- data/logos/atlassian_fisheye.png
+- data/logos/atlassian_jira.png
+- data/logos/atlassian_sourcetree.png
+- data/logos/automattic_wordpress.png
+- data/logos/calibre.png
+- data/logos/cisco_ssl_vpn.png
+- data/logos/citrix_netscaler_gateway.png
+- data/logos/cloudflare_cdn.png
+- data/logos/drupal.png
+- data/logos/f5_big-ip.png
+- data/logos/f5_big-ip_apm.png
+- data/logos/fastly.png
+- data/logos/generic.png
+- data/logos/gitlab.png
+- data/logos/ibm_axway_securetransport.png
+- data/logos/lithium.png
+- data/logos/microsoft_asp.net.png
+- data/logos/microsoft_iis.png
+- data/logos/microsoft_outlook_web_access.png
+- data/logos/microsoft_sharepoint.png
+- data/logos/microtik_routeros.png
+- data/logos/mikrotik_routeros.png
+- data/logos/newrelic.png
+- data/logos/nginx.png
+- data/logos/okta.png
+- data/logos/oracle_glassfish.png
+- data/logos/oracle_java_application_server.png
+- data/logos/oracle_java_server_pages.png
+- data/logos/oracle_weblogic.png
+- data/logos/phpmyadmin.png
+- data/logos/tableau.png
+- data/logos/vmware_esxi.png
+- data/logos/vmware_horizon.png
+- data/logos/zendesk.png
+- data/logos/zimbra_server.png
+- data/microsoft_sharepoint_versions.csv
 - intrigue-ident.gemspec
-- lib/check_factory.rb
-- lib/checks/akamai.rb
-- lib/checks/amazon.rb
-- lib/checks/aruba.rb
-- lib/checks/asp_net.rb
-- lib/checks/atlassian.rb
-- lib/checks/base.rb
-- lib/checks/chef.rb
-- lib/checks/cisco.rb
-- lib/checks/citrix.rb
-- lib/checks/cloudflare.rb
-- lib/checks/cloudfront.rb
-- lib/checks/cpanel.rb
-- lib/checks/django.rb
-- lib/checks/drupal.rb
-- lib/checks/f5.rb
-- lib/checks/fastly.rb
-- lib/checks/generic.rb
-- lib/checks/gitlab.rb
-- lib/checks/google.rb
-- lib/checks/grafana.rb
-- lib/checks/jenkins.rb
-- lib/checks/joomla.rb
-- lib/checks/limesuvey.rb
-- lib/checks/lithium.rb
-- lib/checks/magento.rb
-- lib/checks/mcafee.rb
-- lib/checks/mediawiki.rb
-- lib/checks/microsoft.rb
-- lib/checks/nagios.rb
-- lib/checks/oracle.rb
-- lib/checks/palo_alto.rb
-- lib/checks/pardot.rb
-- lib/checks/pfsense.rb
-- lib/checks/phpmyadmin.rb
-- lib/checks/rabbitmq.rb
-- lib/checks/spring.rb
-- lib/checks/team_city.rb
-- lib/checks/telerik.rb
-- lib/checks/tomcat.rb
-- lib/checks/varnish.rb
-- lib/checks/wordpress.rb
-- lib/checks/wp_engine.rb
+- lib/banner_helpers.rb
+- lib/ftp/check_factory.rb
+- lib/ftp/content.rb
+- lib/ftp/ftp.rb
+- lib/ftp/matchers.rb
+- lib/http/browser.rb
+- lib/http/check_factory.rb
+- lib/http/content.rb
+- lib/http/http.rb
+- lib/http/matchers.rb
+- lib/ident.rb
+- lib/recog_wrapper.rb
+- lib/simple_socket.rb
+- lib/smtp/check_factory.rb
+- lib/smtp/content.rb
+- lib/smtp/matchers.rb
+- lib/smtp/smtp.rb
+- lib/snmp/check_factory.rb
+- lib/snmp/content.rb
+- lib/snmp/matchers.rb
+- lib/snmp/snmp.rb
+- lib/ssh/check_factory.rb
+- lib/ssh/content.rb
+- lib/ssh/matchers.rb
+- lib/ssh/ssh.rb
+- lib/telnet/check_factory.rb
+- lib/telnet/content.rb
+- lib/telnet/matchers.rb
+- lib/telnet/telnet.rb
+- lib/utils.rb
+- lib/version.rb
+- lib/vulndb_client.rb
+- util/console.rb
+- util/docker.sh
+- util/ident.rb
+- util/list_paths.rb
+- util/tags.rb
+- utils.rb
 homepage: https://intrigue.io
 licenses:
-- BSD
+- BSD-3-Clause
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -125,9 +558,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
-summary: Fingerprinter for Intrigue Data
+summary: Intrigue Asset Fingerprinting Library
 test_files: []