intrigue-ident 0.4 → 0.6

data/lib/checks/joomla.rb

@@ -3,16 +3,19 @@ module Ident
 module Check
     class Joomla < Intrigue::Ident::Check::Base
 
-      def generate_checks(uri)
+      def generate_checks(url)
         [
           {
-            :name => "Joomla!",
-            :description => "Known Joomla Admin Page",
-            :type => :content_body,
+            :type => "application",
+            :vendor => "Joomla!",
+            :tags => ["CMS"],
+            :product =>"Joomla!",
+            :match_details =>"Known Joomla Admin Page",
+            :match_type => :content_body,
             :version => nil,
-            :content => /files_joomla/i,
+            :match_content =>  /files_joomla/i,
             :references => ["https://twitter.com/GreyNoiseIO/status/987547246538391552"],
-            :paths => ["#{uri}/administrator/manifests/files/joomla.xml"]
+            :paths => ["#{url}/administrator/manifests/files/joomla.xml"]
           }
         ]
       end

data/lib/checks/jupyter.rb

@@ -0,0 +1,26 @@
+module Intrigue
+module Ident
+module Check
+  class Jupyter < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor => "Jupyter",
+          :tags => [],
+          :product =>"Notebook",
+          :match_details =>"matched jupyterhub header",
+          :match_type => :content_headers,
+          :version => nil,
+          :dynamic_version => lambda { |x| _first_header_capture(x,/^x-jupyterhub-version: (.*)$/) },
+          :match_content =>  /x-jupyterhub-version:/i,
+          :examples => ["https://18.18.154.11:443"],
+          :paths => ["#{url}"]
+        }
+      ]
+    end
+  end
+end
+end
+end

data/lib/checks/lighttpd.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+  class Lighttpd < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor => "Lighttpd",
+          :tags => [],
+          :product =>"Lighttpd",
+          :match_details =>"server header",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /server: lighttpd/i,
+          :dynamic_version => lambda { |x|
+            _first_header_capture(x,/server: lighttpd\/(.*)/i,)
+          },
+          :examples => ["http://98.99.246.234:80"],
+          :paths => ["#{url}"]
+        }
+      ]
+    end
+  end
+end
+end
+end

data/lib/checks/limesuvey.rb

@@ -3,15 +3,17 @@ module Ident
 module Check
     class LimeSurvey < Intrigue::Ident::Check::Base
 
-      def generate_checks(uri)
+      def generate_checks(url)
         [
           {
-            :name => "LimeSurvey",
-            :description => "LimeSurvey",
-            :type => :content_body,
+            :type => "application",
+            :vendor =>"LimeSurvey",
+            :product =>"LimeSurvey",
+            :match_details =>"LimeSurvey",
+            :match_type => :content_body,
             :version => nil,
-            :content => /Donate to LimeSurvey/,
-            :paths => ["#{uri}"]
+            :match_content =>  /Donate to LimeSurvey/,
+            :paths => ["#{url}"]
           }
         ]
       end

data/lib/checks/lithium.rb

@@ -3,23 +3,27 @@ module Ident
 module Check
     class Lithium < Intrigue::Ident::Check::Base
 
-      def generate_checks(uri)
+      def generate_checks(url)
         [
           {
-            :name => "Lithum ",
-            :description => "Lithium Community Management",
-            :type => :content_cookies,
+            :type => "application",
+            :vendor => "Lithium",
+            :product =>"Lithium",
+            :match_details =>"Lithium Community Management",
+            :match_type => :content_cookies,
             :version => nil,
-            :content => /LithiumVisitor/i,
-            :paths => ["#{uri}"]
+            :match_content =>  /LithiumVisitor/i,
+            :paths => ["#{url}"]
           },
           {
-            :name => "Lithum",
-            :description => "Lithium Community Management",
-            :type => :content_cookies,
+            :type => "application",
+            :vendor => "Lithium",
+            :product =>"Lithium",
+            :match_details =>"Lithium Community Management",
+            :match_type => :content_cookies,
             :version => nil,
-            :content => /LiSESSIONID/i,
-            :paths => ["#{uri}"]
+            :match_content =>  /LiSESSIONID/i,
+            :paths => ["#{url}"]
           }
         ]
       end

data/lib/checks/lotus.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+    class Lotus < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "application",
+            :vendor => "Lotus",
+            :product =>"Domino",
+            :match_details =>"Lotus Domino",
+            :match_type => :content_headers,
+            :version => nil,
+            :match_content =>  /server: Lotus-Domino/i,
+            :examples => [
+              "https://12.237.144.251:443"
+            ],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/magento.rb

@@ -3,15 +3,17 @@ module Ident
 module Check
     class Magento < Intrigue::Ident::Check::Base
 
-      def generate_checks(uri)
+      def generate_checks(url)
         [
           {
-            :name => "Magento",
-            :description => "Magento",
-            :type => :content_body,
+            :type => "application",
+            :vendor => "Magento",
+            :product =>"Magento",
+            :match_details =>"Magento",
+            :match_type => :content_body,
             :version => nil,
-            :content => /Mage.Cookies.path/i,
-            :paths => ["#{uri}"]
+            :match_content =>  /Mage.Cookies.path/i,
+            :paths => ["#{url}"]
           }
         ]
       end

data/lib/checks/mailchimp.rb

@@ -0,0 +1,25 @@
+module Intrigue
+module Ident
+module Check
+    class Mailchimp < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "application",
+            :vendor => "Mailchimp",
+            :product =>"Mandrill",
+            :match_details =>"login page",
+            :match_type => :content_body,
+            :version => nil,
+            :match_content =>  /<title>Log in to Mandrill/i,
+            :paths => ["#{url}"],
+            :examples => ["http://107.20.49.246:80"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/mcafee.rb

@@ -3,15 +3,17 @@ module Ident
 module Check
     class Mcafee < Intrigue::Ident::Check::Base
 
-      def generate_checks(uri)
+      def generate_checks(url)
         [
           {
-            :name => "McAfee EPolicy Orchestrator",
-            :description => "McAfee EPolicy Orchestrator",
-            :type => :content_body,
+            :type => "application",
+            :vendor => "McAfee",
+            :product =>"EPolicy Orchestrator",
+            :match_details =>"McAfee EPolicy Orchestrator",
+            :match_type => :content_body,
             :version => nil,
-            :content => /McAfee Agent Activity Log/i,
-            :paths => ["#{uri}"]
+            :match_content =>  /McAfee Agent Activity Log/i,
+            :paths => ["#{url}"]
           }
         ]
       end

data/lib/checks/mediawiki.rb

@@ -1,38 +1,37 @@
 module Intrigue
 module Ident
 module Check
-    class MediaWiki < Intrigue::Ident::Check::Base
-
-      def generate_checks(uri)
-        [
-          {
-            :name => "MediaWiki",
-            :description => "MediaWiki",
-            :type => :content_body,
-            :version => nil,
-            :content => /<a href="\/\/www.mediawiki.org\/">Powered by MediaWiki<\/a>/,
-            :paths => ["#{uri}"]
-          }
-        ]
-      end
+  class MediaWiki < Intrigue::Ident::Check::Base
 
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor =>"MediaWiki",
+          :product =>"MediaWiki",
+          :match_details =>"powered by tag",
+          :match_type => :content_body,
+          :version => nil,
+          :match_content =>  /<a href="\/\/www.mediawiki.org\/">Powered by MediaWiki<\/a>/,
+          :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor =>"MediaWiki",
+          :product =>"MediaWiki",
+          :match_details =>"generator tag",
+          :match_type => :content_body,
+          :match_content =>  /<meta name=\"generator\" content=\"MediaWiki/,
+          :version => nil,
+          :dynamic_version => lambda { |x| _first_body_capture(x,/<meta name=\"generator\" content=\"MediaWiki\ (.*?)\"\/>/) },
+          :examples => ["http://2004.appsecusa.org:80"],
+          :verify => ["b3dhc3AjSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHA6Ly8yMDA0LmFwcHNlY3VzYS5vcmc6ODA="],
+          :paths => ["#{url}"]
+        }
+      ]
     end
-  end
-  end
-  end
-
 
-=begin
-all_checks = [{
-  :uri => "#{uri}",
-  :checklist => [
-  {
-    :name => "Yoast Wordpress SEO Plugin", # won't be used if we have
-    :description => "Yoast Wordpress SEO Plugin",
-    :type => "content",
-    :content => /<!-- \/ Yoast WordPress SEO plugin. -->/,
-    :test_site => "https://ip-50-62-231-56.ip.secureserver.net",
-    :dynamic_name => lambda{|x| x.scan(/the Yoast WordPress SEO plugin v.* - h/)[0].gsub("the ","").gsub(" - h","") }
-  }
-]},
-=end
+  end
+end
+end
+end

data/lib/checks/microsoft.rb

@@ -3,63 +3,269 @@ module Ident
 module Check
     class Microsoft < Intrigue::Ident::Check::Base
 
-      def generate_checks(uri)
+      def generate_checks(url)
         [
           {
-            :name => "Microsoft Forefront TMG",
-            :description => "Microsoft Forefront Threat Management Gateway",
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET",
             :version => nil,
-            :type => :content_cookies,
-            :content => /<title>Microsoft Forefront TMG/,
-            :paths => ["#{uri}"]
+            :dynamic_version => lambda{|x| _body(x).scan(/ASP.NET Version:(.*)$/)[0].first.chomp },
+            :tags => ["error_page"],
+            :match_type => :content_body,
+            :match_content =>  /^.*ASP.NET is configured.*$/i,
+            :match_details =>"ASP.Net Error Message",
+            :paths => ["#{url}"]
           },
           {
-            :name => "Microsoft IIS 8.0",
-            :description => "Microsoft IIS 8.0",
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET",
             :version => nil,
-            :type => :content_body,
-            :content => /<img src=\"iis-8.png\"/,
-            :examples => ["http://66.162.2.18:80"],
-            :paths => ["#{uri}"]
+            :dynamic_version => lambda{|x| _body(x).scan(/ASP.NET Version:(.*)$/i)[0].first.chomp if _body(x).scan(/ASP.NET Version:(.*)$/i)[0] },
+            :match_type => :content_headers,
+            :match_content =>  /^x-aspnet-version:.*$/i,
+            :match_details =>"X-AspNet Header",
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET",
+            :match_details =>"Asp.Net Default Cookie",
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content =>  /ASPSESSIONID.*$/i,
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET",
+            :match_details =>"Asp.Net Default Cookie",
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content =>  /ASP.NET_SessionId.*$/i,
+            :paths => ["#{url}"]
           },
           {
-            :name => "Microsoft IIS 8.5",
-            :description => "Microsoft IIS 8.5",
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET",
+            :match_details =>"ASPXAUTH cookie",
             :version => nil,
-            :type => :content_body,
-            :content => /<img src=\"iis-85.png\"/,
+            :references => ["https://www.sitefinity.com/developer-network/forums/developing-with-sitefinity-/claims-auth---aspxauth-cookie-remains"],
+            :match_type => :content_cookies,
+            :match_content =>  /ASPXAUTH=/i,
+            :examples => ["https://marketplace.overdrive.com/Account/Login"],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET MVC",
+            :match_details =>"Asp.Net MVC Header",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /x-aspnetmvc-version/i,
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET",
+            :match_details =>"WebResource.axd link in the page",
+            :version => nil,
+            :match_type => :content_body,
+            :match_content =>  /WebResource.axd?d=/i,
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"ASP.NET",
+            :match_details =>"Microsoft ASP.NET",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /x-powered-by: ASP.NET/,
+            :examples => [],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"Forefront TMG",
+            :match_details =>"Microsoft Forefront Threat Management Gateway",
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content =>  /<title>Microsoft Forefront TMG/,
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"Forefront TMG",
+            :match_details =>"Microsoft Forefront Threat Management Gateway",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /via:\ 1.1\ TMGSRVR/,
+            :paths => ["#{url}"]
+          },
+
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product => "IIS",
+            :match_details =>"server header",
+            :version => nil,
+            :dynamic_version => lambda { |x|
+              _first_header_capture x, /server: Microsoft-IIS\/(.*)/
+            },
+            :match_type => :content_headers,
+            :match_content =>  /server: Microsoft-IIS\//,
+            :examples => ["http://168.75.243.138:80","http://freightmanager.nucornet.com:80"],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"IIS",
+            :match_details =>"Microsoft IIS 8.0",
+            :version => "8.0",
+            :match_type => :content_body,
+            :match_content =>  /<img src=\"iis-8.png\"/,
+            :examples => ["http://66.162.2.18:80"],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"IIS",
+            :match_details =>"Microsoft IIS 8.5",
+            :version => "8.5",
+            :match_type => :content_body,
+            :match_content =>  /<img src=\"iis-85.png\"/,
             :examples => ["http://103.1.221.151:80"],
-            :paths => ["#{uri}"]
+            :paths => ["#{url}"]
           },
           {
-            :name => "Microsoft Outlook Web Access",
-            :description => "Microsoft Outlook Web Access",
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"IIS",
+            :match_details =>"Microsoft IIS Unauthorized (403)",
+            :tags => ["error_page"],
             :version => nil,
-            :type => :content_headers,
-            :content => /x-owa-version/,
-            :dynamic_version => lambda { |x| x["x-owa-version"] },
-            :paths => ["#{uri}"]
+            :match_type => :content_body,
+            :hide => true,
+            :match_content =>  /Error Code: 403 Forbidden. The server denied the specified Uniform Resource Locator \(URL\)/,
+            :examples => ["http://199.233.74.45:80"],
+            :paths => ["#{url}"]
           },
           {
-            :name => "Microsoft Generic Error - 403",
-            :description => "Microsoft Generic Error - 403",
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"IIS",
+            :match_details =>"Microsoft IIS Missing Resource (404)",
             :tags => ["error_page"],
             :version => nil,
-            :type => :content_body,
+            :match_type => :content_body,
             :hide => true,
-            :content => /403 Forbidden. The server denied the specified Uniform Resource Locator (URL)/,
-            :paths => ["#{uri}"]
+            :match_content =>  /HTTP Error 404. The requested resource is not found./,
+            :examples => ["http://66.162.2.74:80"],
+            :paths => ["#{url}"]
           },
           {
-            :name => "Microsoft Generic Error - 503",
-            :description => "Microsoft Generic Error - 503",
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"IIS",
+            :match_details =>"Microsoft IIS Generic Error - 403",
             :tags => ["error_page"],
             :version => nil,
-            :type => :content_body,
+            :match_type => :content_body,
             :hide => true,
-            :content => /HTTP Error 503. The service is unavailable./,
-            :paths => ["#{uri}"]
-          }
+            :match_content =>  /403 Forbidden. The server denied the specified Uniform Resource Locator (URL)/,
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"IIS",
+            :match_details =>"Microsoft Generic Error - 503",
+            :tags => ["error_page"],
+            :version => nil,
+            :match_type => :content_body,
+            :hide => true,
+            :match_content =>  /HTTP Error 503. The service is unavailable./,
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor =>"Microsoft",
+            :product =>"Kestrel",
+            :references => ["https://stackify.com/what-is-kestrel-web-server/"],
+            :match_details =>"kestrel in server header",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /server: Kestrel/i,
+            :examples => ["http://partner-staging.jet.com:80"],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "service",
+            :vendor =>"Microsoft",
+            :product =>"Office 365 API",
+            :match_details =>"office 365 api auth cookie",
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content =>  /x-ms-gateway-slice/i,
+            :examples => ["http://autodiscover.jet.com:80"],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "service",
+            :vendor =>"Microsoft",
+            :product =>"Office 365",
+            :match_details =>"office 365 fronted by okta",
+            :version => nil,
+            :match_type => :content_body,
+            :match_content =>  /ok3static.oktacdn.com\/assets\/img\/logos\/office365/i,
+            :examples => ["http://outlook.newscorp.com:80"],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"Outlook Web Access",
+            :match_details =>"Microsoft Outlook Web Access",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /x-owa-version/,
+            :dynamic_version => lambda { |x| _first_header_capture(x, /x-owa-version:(.*)/) },
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"Outlook Web Access",
+            :match_details =>"Microsoft Outlook Web Access",
+            :version => nil,
+            :match_type => :content_body,
+            :match_content =>  /OwaPage\ =\ ASP.auth_logon_aspx/,
+            :dynamic_version => lambda { |x| _first_body_capture x, /href=\"\/owa\/auth\/(.*)\/themes\/resources\/favicon.ico/ },
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Microsoft",
+            :product =>"Sharepoint",
+            :match_details =>"Sharepoint cookie",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /sprequestguid/,
+            :dynamic_version => lambda { |x| _first_header_capture(x,/microsoftsharepointteamservices:(.*)/) },
+            :examples => ["http://sharepoint.edghelp.realogyfg.com:80"],
+            :paths => ["#{url}"]
+          },
         ]
       end