intrigue-ident 0.2 → 0.9.9

data/checks/http/artifactory.rb

@@ -0,0 +1,30 @@
+module Intrigue
+module Ident
+module Check
+class Artifactory < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "Development", "Security"],
+        :website => "https://jfrog.com/artifactory/",
+        :vendor => "Artifactory",
+        :product => "Artifactory",
+        :version => nil,
+        :dynamic_version => lambda { |x|
+          _first_header_capture(x,/server: Artifactory\/(.*)$/i) },
+        :match_type => :content_headers,
+        :match_content =>  /server: Artifactory/,
+        :match_details =>"server header",
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+  
+end
+end
+end
+end

data/checks/http/aruba.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Aruba < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "operating_system",
+        :tags => ["Networking", "COTS", "Wireless"],
+        :vendor => "Aruba Networks",
+        :product => "Aruba OS",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /arubalp=/,
+        :match_details =>"Matches an aruba link, generic identifier",
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+  
+end
+end
+end
+end

data/checks/http/atlassian.rb

@@ -0,0 +1,152 @@
+module Intrigue
+module Ident
+module Check
+class Atlassian < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "Development"],
+        :vendor => "Atlassian",
+        :product =>"BitBucket",
+        :match_details =>"Atlassian BitBucket",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /com.atlassian.bitbucket.server/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "Development"],
+        :vendor => "Atlassian",
+        :product =>"Confluence",
+        :match_details =>"Atlassian Confluence",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /X-Confluence-Request-Time/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "Development"],
+        :vendor => "Atlassian",
+        :product =>"Crucible",
+        :match_details =>"Atlassian Crucible",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /FishEye and Crucible/,
+        :dynamic_version => lambda{ |x|
+          _first_body_capture(x, /Log in to FishEye and Crucible (.*)\</)
+        },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "Development"],
+        :vendor => "Atlassian",
+        :product =>"Hipchat",
+        :match_details =>"Atlassian Hipchat",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /\$\(document\).trigger\('hipchat.load'\);/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "Development"],
+        :vendor => "Atlassian",
+        :product =>"Jira",
+        :match_details =>"Atlassian Jira",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /jira.webresources/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "Development"],
+        :vendor => "Atlassian",
+        :product =>"Jira",
+        :match_details =>"Atlassian Jira",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content =>  /atlassian.xsrf.token=/i,
+        :dynamic_version => lambda{ |x|
+            _first_body_capture(x,/<meta name="ajs-version-number" content="(.*)">/) },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["SaaS", "Development", "Proxy"],
+        :vendor => "Atlassian",
+        :product =>"Proxy",
+        :references => ["https://community.atlassian.com/t5/Jira-questions/REST-API-not-returning-any-data-with-API-token/qaq-p/1292806"],
+        :match_details =>"proxy server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content => /^server: AtlassianProxy\/[\d\.]+$/i,
+        :dynamic_version => lambda{ |x|
+          _first_header_capture(x,/^server: AtlassianProxy\/([\d\.]+)$/i) },
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["SaaS", "Development", "SaaS"],
+        :vendor => "Atlassian",
+        :product =>"Statuspage",
+        :match_details =>"statuspage icon",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /logos-statuspage-logo-gradient-neutral.svg/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["SaaS", "Development", "SaaS"],
+        :vendor => "Atlassian",
+        :product =>"Statuspage",
+        :match_details =>"statuspage header",
+        :version => nil,
+        :match_type => :content_heades,
+        :match_content =>  /^x-statuspage-skip-logging:.*$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["SaaS", "Development", "SaaS"],
+        :vendor => "Atlassian",
+        :product =>"Statuspage",
+        :match_details =>"statuspage header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-statuspage-version:.*$/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+  
+end
+end
+end
+end

data/checks/http/auth0.rb

@@ -0,0 +1,44 @@
+module Intrigue
+module Ident
+module Check
+class Auth0 < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["IAM", "SaaS", "Security"],
+        :vendor => "Auth0",
+        :product => "Auth0",
+        :references => [],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /window.auth0AnalyticsOptions/i,
+        :match_details => "Auth0 analytics",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["IAM", "SaaS", "Security"],
+        :vendor => "Auth0",
+        :product => "Auth0",
+        :references => [],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /\/auth0/i,
+        :match_details => "Auth0 link",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+  
+end
+end
+end
+end

data/checks/http/automattic.rb

@@ -0,0 +1,292 @@
+module Intrigue
+module Ident
+module Check
+class Automattic < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"wordpress test cookie",
+        :version => nil,
+        :match_type => :content_cookies,
+        :match_content =>  /wordpress_test_cookie=/i,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"wordpress login page",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /class=\"login login-action-login wp-core-ui/i,
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"wordpress generator tag",
+        :version => nil,
+        :match_type => :content_generator,
+        :match_content =>  /WordPress/i,
+        :dynamic_version => lambda { |x| _first_generator_capture(x, /WordPress\ ([\d\.]+)/i)},
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"wp-embed link",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /wp-includes\/js\/wp-embed.min.js\?ver=([\d\.]+)\'/i,
+        :dynamic_version => lambda { |x| _first_body_capture(x, /wp-includes\/js\/wp-embed.min.js\?ver=([\d\.]+)\'/i)},
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"version string",
+        :version => nil,
+        :references => ["https://github.com/caffeinewriter/wp-fingerprinter/blob/master/wp-fingerprint.py"],
+        :match_type => :content_cookies,
+        :match_content =>  /Version ([\d\.]+)/i,
+        :dynamic_version => lambda { |x| _first_generator_capture(x, /Version ([\d\.]+)/i) },
+        :hide => false,
+        :require_product => "Wordpress",
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"common link",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /src=\'\/wp-includes\/js\/jquery\/jquery-new\.js\'\>/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"common link",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<link rel='https:\/\/api.w.org\/'/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS", "SaaS"],
+        :vendor =>"Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"unique header for hosted service",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /x-hacker: If you're reading this, you should visit automattic.com/,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress WP-JSON endpoint",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /gmt_offset/,
+        :paths => ["#{url}/wp-json"],
+        :require_product => "Wordpress",
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.0",
+        :match_type => :checksum_body,
+        :match_content => "a306a72ce0f250e5f67132dc6bcb2ccb",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.1",
+        :match_type => :checksum_body,
+        :match_content => "4f04728cb4631a553c4266c14b9846aa",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.2",
+        :match_type => :checksum_body,
+        :match_content => "25e1e78d5b0c221e98e14c6e8c62084f",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.3",
+        :match_type => :checksum_body,
+        :match_content => "83c83d0f0a71bd57c320d93e59991c53",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.5",
+        :match_type => :checksum_body,
+        :match_content => "7293453cf0ff5a9a4cfe8cebd5b5a71a",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.6",
+        :match_type => :checksum_body,
+        :match_content => "61740709537bd19fb6e03b7e11eb8812",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.7",
+        :match_type => :checksum_body,
+        :match_content => "e6bbc53a727f3af003af272fd229b0b2",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.7.1",
+        :match_type => :checksum_body,
+        :match_content => "e6bbc53a727f3af003af272fd229b0b2",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      },
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "Wordpress",
+        :product =>"Wordpress",
+        :match_details =>"Wordpress TinyMCE Editor",
+        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+        :version => "2.9.1",
+        :match_type => :checksum_body,
+        :match_content => "128e75ed19d49a94a771586bf83265ec",
+        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
+        :require_product => "Wordpress",
+        :inference => true
+      }
+    ]
+  end
+
+=begin
+all_checks = [{
+:url => "#{url}",
+:checklist => [
+{
+  :product =>"Yoast Wordpress SEO Plugin", # won't be used if we have
+  :match_details =>"Yoast Wordpress SEO Plugin",
+  :match_type => "content",
+  :match_content =>  /<!-- \/ Yoast WordPress SEO plugin. -->/,
+  :test_site => "https://ip-50-62-231-56.ip.secureserver.net",
+  :dynamic_name => lambda{|x| x.scan(/the Yoast WordPress SEO plugin v.* - h/)[0].gsub("the ","").gsub(" - h","") }
+}
+]},
+=end
+
+end
+end
+end
+end