intrigue-ident 0.2 → 0.9.9

data/checks/http/bigcartel.rb

@@ -0,0 +1,33 @@
+module Intrigue
+module Ident
+module Check
+class Bigcartel < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      # Currently match_content too loose
+=begin
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "BigCartel",
+        :product => "BigCartel",
+        :references => ["https://www.bigcartel.com/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /Big Cartel/i,
+        :dynamic_version => nil,
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+=end
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/bigcommerce.rb

@@ -0,0 +1,33 @@
+module Intrigue
+module Ident
+module Check
+class BigCommerce < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+=begin
+      # Currently match_content too loose
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "bigcommerce",
+        :product => "bigcommerce",
+        :references => [],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /bigcommerce/i,
+        :dynamic_version => nil,
+        :match_details => "footer match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+=end 
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/binarysec.rb

@@ -0,0 +1,47 @@
+module Intrigue
+module Ident
+module Check
+class Binarysec < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["WAF"],
+        :url => "",
+        :references => [
+          "https://github.com/EnableSecurity/wafw00f"
+        ],
+        :vendor => "BinarySEC",
+        :product =>"Web Application Firewall",
+        :match_details =>"cookie",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /server: BinarySec/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }, 
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["WAF"],
+        :url => "",
+        :references => [
+          "https://github.com/EnableSecurity/wafw00f"
+        ],
+        :vendor => "BinarySEC",
+        :product =>"Web Application Firewall",
+        :match_details =>"cookie",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /x-binarysec/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/bitly.rb

@@ -0,0 +1,40 @@
+module Intrigue
+module Ident
+module Check
+class Bitly < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing", "Hosting"],
+        :vendor => "Bitly",
+        :product =>"Bitly",
+        :match_details =>"bitly cookie",
+        :match_type => :content_cookies,
+        :version => nil,
+        :match_content =>  /Domain=bitly.com;/i,
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Marketing", "Hosting"],
+        :vendor => "Bitly",
+        :product =>"Bitly",
+        :match_details =>"bitly title - branded short domain",
+        :match_type => :content_title,
+        :version => nil,
+        :match_content =>  /Branded Short Domain Powered by Bitly/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/blackboard.rb

@@ -0,0 +1,44 @@
+module Intrigue
+module Ident
+module Check
+class Blackboard < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "CMS"],
+        :vendor => "Blackboard",
+        :product => "Blackboard",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^x-blackboard-product: Blackboard Learn &#8482;.*$/,
+        :dynamic_version => lambda{|x| _first_header_capture(x,/^x-blackboard-product: Blackboard Learn &#8482; ([\w\d\.\-\+]*)$/i) },
+        :paths => ["#{url}"],
+        :inference => true
+      },
+      # Currently match_content too loose
+      #{
+      #  :type => "fingerprint",
+      #  :category => "application",
+      #  :tags => ["COTS", "CMS"],
+      #  :vendor => "Blackboard",
+      #  :product => "Blackboard",
+      #  :match_details =>"server header",
+      #  :version => nil,
+      #  :match_type => :content_body,
+      #  :match_content =>  /Blackboard CMS/i,
+      #  :dynamic_version => nil ,
+      #  :paths => ["#{url}"],
+      #  :inference => true
+      #}
+    ]
+  end
+
+end
+
+end
+end
+end

data/checks/http/blueimp.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Blueimp < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Javascript"],
+        :vendor => "blueimp",
+        :product =>"jQuery-File-Upload",
+        :match_details =>"match string in the page",
+        :match_type => :content_body,
+        :version => nil,
+        :match_content =>  /jquery.fileupload/i,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+  
+end
+end
+end
+end

data/checks/http/bomgar.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Bomgar < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS", "IT Support"],
+        :vendor => "Bomgar",
+        :product => "Remote Support",
+        :match_details =>"server header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server: Bomgar$/,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/bootstrap.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+class Bootstrap < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["Web Framework"],
+        :vendor => "Bootstrap",
+        :product => "Bootstrap",
+        :match_details =>"boostrap css",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /bootstrap.min.css/,
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/bower.rb

@@ -0,0 +1,28 @@
+module Intrigue
+  module Ident
+  module Check
+  class Bower < Intrigue::Ident::Check::Base
+  
+    def generate_checks(url)
+      [
+        {
+          :type => "fingerprint",
+          :category => "application",
+          :tags => ["Javascript", "Package Manager"],
+          :vendor => "Bower",
+          :product => "Bower",
+          :match_details =>"scripts loaded via bower",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content =>  /\/bower_components\//,
+          :paths => ["#{url}"],
+          :inference => false
+        }
+      ]
+    end
+  
+  end
+  end
+  end
+  end
+  

data/checks/http/broadcom.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+class Broadcom < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["COTS"],
+        :vendor => "Broadcom",
+        :product => "CA API Gateway",
+        :references => ["https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-api-management/api-gateway/9-2/learning-center/about-the-ca-api-gateway.html"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:\ CA-API-Gateway\/[\d\.]{1,}$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:\ CA-API-Gateway\/[\d\.]{1,}$/i) },
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/brocade.rb

@@ -0,0 +1,39 @@
+module Intrigue
+module Ident
+module Check
+class Brocade < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "hardware",
+        :tags => ["Appliance","Networking"],
+        :vendor => "Brocade",
+        :product => "ICX7250-24",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /Images\/uicx_7250_24_gfphdr_login1.gif/,
+        :match_details =>"specific image",
+        :paths => ["#{url}"],
+        :inference => false
+      },
+      {
+        :type => "fingerprint",
+        :category => "operating_system",
+        :tags => ["Appliance","Networking"],
+        :vendor => "Brocade",
+        :product => "Fabric OS",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /<td><img src=\"Images\/brocade_logo_no_text.gif\">/,
+        :match_details =>"specific image",
+        :paths => ["#{url}"],
+        :inference => false
+      }
+    ]
+  end
+end
+end
+end
+end

data/checks/http/browsermedia.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+class BrowserCMS < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "application",
+        :tags => ["CMS"],
+        :vendor => "BrowserMedia",
+        :product => "BrowserCMS",
+        :references => ["http://www.  .org/"],
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /BrowserCMS [\d\.]+/i,
+        :match_details => "header match",
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+
+end
+end
+end
+end

data/checks/http/bsm.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+class BSM < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "fingerprint",
+        :category => "service",
+        :tags => ["Web Server"],
+        :vendor => "MicroFocus",
+        :product => "BSM",
+        :references => ["https://docs.microfocus.com/SM/9.60/Codeless/Content/integrations/business_service_management/concepts/hp_business_service_management.htm"],
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /^server:\ DPS\/[\d\.]{1,}$/i,
+        :dynamic_version => lambda { |x| 
+          _first_header_capture(x,/^server:\ DPS\/[\d\.]{1,}$/i) },
+        :hide => false,
+        :paths => ["#{url}"],
+        :inference => true
+      }
+    ]
+  end
+end
+end
+end
+end