intrigue-ident 0.49 → 0.51

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d58d63bdc512c08643f0f899a2fb93c8c7c31fd878c58e0b4109017f0273114
-  data.tar.gz: 2fdf907897a3984d45c4409b154d0ad17dcfd6dfa82e626bfcb2f1953b96fe18
+  metadata.gz: f91b614544db4600d47b6c438d375db720472ba450931c6fe672291a42b01b5f
+  data.tar.gz: 762f2ff05f40d7aef97379be04a5341aca83312d8ff1f859f26336f9e2da7b8f
 SHA512:
-  metadata.gz: 9bba27d33b8e9ac30a10da3b76b35290951d099bc3812360fdeb6f357eb2634cf5888356b7e6bf5ea12b93fa1685d830c6d52e37a5e896e5d525b1385bda9dd9
-  data.tar.gz: c7492be298f8481bb2991a8b8d5b454e561aa24dfc6e59c5636fa7be0fa3ce409b15504e74510bd484e34994103ce67ca1d142f5f1999885cea719e17e332d91
+  metadata.gz: 6e839dc08186fbfe8261848d939e187efffa985fd0b2af8d99455dccf147b84c2e31df84cfb0a3e180051079a2f06406a1873059d7f6c42b79524dd4b0fa2e8e
+  data.tar.gz: bfe37dc2199e514692f14838097f37d58bb87260d6671bebe873faccbe10233e53c81d47adcfd12690d14378ef54733c8aaced3c3c1d8046f6c197ec889d1a7c

data/Gemfile

@@ -2,3 +2,4 @@ source 'https://rubygems.org'
 ruby '2.5.1'
 
 gem "rspec"
+gem "dynamoid"

data/lib/checks/adobe.rb

@@ -16,7 +16,20 @@ class Adobe < Intrigue::Ident::Check::Base
         :hide => false,
         :examples => ["https://209.235.70.106:443"],
         :paths => ["#{url}"]
+      },
+      {
+        :type => "application",
+        :vendor => "Adobe",
+        :product => "Experience MAnager",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content => /AEM/,
+        :match_details => "Adobe Experience Manager",
+        :hide => false,
+        :examples => ["https://www.ford.com/content/dam/login/core/content/login"],
+        :paths => ["#{url}/libs/granite/core/content/login.html"]
       }
+
     ]
   end
 end

data/lib/checks/amazon.rb

@@ -8,9 +8,20 @@ class Amazon < Intrigue::Ident::Check::Base
       {
         :type => "service",
         :vendor => "Amazon",
-        :product =>"Cloudfront - Error (Body)",
-        :match_details =>"Cloudfront - no configured hostname",
-        :version => "",
+        :product =>"Cloudfront",
+        :match_details =>"cloudfront cache header",
+        :version => nil,
+        :match_type => :content_headers,
+        :match_content =>  /via:.*.cloudfront.net \(CloudFront\)/,
+        :hide => false,
+        :paths => ["#{url}"]
+      },
+      {
+        :type => "service",
+        :vendor => "Amazon",
+        :product =>"Cloudfront",
+        :match_details =>"Cloudfront - no configured hostname error condition",
+        :version => nil,
         :match_type => :content_body,
         :match_content =>  /ERROR: The request could not be satisfied/,
         :hide => true,
@@ -19,9 +30,9 @@ class Amazon < Intrigue::Ident::Check::Base
       {
         :type => "service",
         :vendor => "Amazon",
-        :product =>"Cloudfront - Error (Headers)",
-        :match_details =>"Cloudfront - no configured hostname",
-        :version => "",
+        :product =>"Cloudfront",
+        :match_details =>"Cloudfront - no configured hostname error condition",
+        :version => nil,
         :match_type => :content_headers,
         :match_content =>  /Error from cloudfront/,
         :hide => true,
@@ -30,9 +41,9 @@ class Amazon < Intrigue::Ident::Check::Base
       {
         :type => "service",
         :vendor => "Amazon",
-        :product =>"Cloudfront - 403 (Body)",
-        :match_details =>"Cloudfront - 403",
-        :version => "",
+        :product =>"Cloudfront",
+        :match_details =>"Cloudfront - 403 error condition",
+        :version => nil,
         :match_type => :content_body,
         :match_content =>  /<h1>403 Forbidden<\/h1><\/center>\n<hr><center>cloudflare/,
         :hide => true,

data/lib/checks/apache.rb

@@ -48,6 +48,20 @@ class Apache < Intrigue::Ident::Check::Base
         :examples => [ "http://15.224.214.203:80" ],
         :paths => ["#{url}"]
       },
+      {
+        :type => "application",
+        :vendor => "Apache",
+        :product =>"Sling",
+        :references => ["https://sling.apache.org/"],
+        :match_details =>"Apache Sling™ is a framework for RESTful web-applications based on an extensible content tree. also note that this may be related to apache experience manager",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<address>Apache Sling<\/address>/i,
+        :examples => [
+          "https://assets.microncpg.com/"
+        ],
+        :paths => ["#{url}"]
+      },
       {
         :type => "application",
         :vendor => "Apache",

data/lib/checks/atlassian.rb

@@ -56,10 +56,13 @@ class Atlassian < Intrigue::Ident::Check::Base
         :match_details =>"Atlassian Jira",
         :version => nil,
         :match_type => :content_cookies,
-        :match_content =>  /atlassian.xsrf.token/i,
+        :match_content =>  /atlassian.xsrf.token=/i,
         :dynamic_version => lambda{ |x|
-            _first_body_capture(x,/<span id="footer-build-information">(.*)-<span/,["("])
+            _first_body_capture(x,/<meta name="ajs-version-number" content="(.*)">/)
         },
+        :examples => [
+          "http://jira.understood.org/",
+          "http://jira.londonandpartners.com:80"],
         :paths => ["#{url}"]
       }
     ]

data/lib/checks/automattic.rb

@@ -5,9 +5,51 @@ module Check
 
     def generate_checks(url)
       [
+        {
+          :type => "application",
+          :vendor =>"Automattic",
+          :tags => ["CMS"],
+          :product =>"Wordpress",
+          :match_details =>"wordpress generator tag in content",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content =>  /<meta name="generator" content="WordPress/i,
+          :dynamic_version => lambda { |x|  _first_body_capture x, /<meta name=\"generator\" content=\"WordPress\ (.*)\" \/>/i },
+          :hide => false,
+          :examples => [
+            "http://www.jewelosco.com:80",
+            "http://blog.nolimitvpn.com:80"
+          ],
+          :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor =>"Automattic",
+          :tags => ["CMS"],
+          :product =>"Wordpress",
+          :match_details =>"common link",
+          :version => nil,
+          :match_type => :content_body,
+          :match_content =>  /<link rel='https:\/\/api.w.org\/'/,
+          :examples => ["https://staging.blogs.nordstrom.com:443"],
+          :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor =>"Automattic",
+          :tags => ["CMS"],
+          :product =>"Wordpress (Hosted)",
+          :match_details =>"unique header",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /x-hacker: If you're reading this, you should visit automattic.com/,
+          :examples => ["http://192.0.78.12:80"],
+          :paths => ["#{url}"]
+        },
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress WP-JSON endpoint",
           :version => nil,
@@ -18,6 +60,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -29,6 +72,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -40,6 +84,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -51,6 +96,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -62,6 +108,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -73,6 +120,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -84,6 +132,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -95,6 +144,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
@@ -106,6 +156,7 @@ module Check
         {
           :type => "application",
           :vendor => "Automattic",
+          :tags => ["CMS"],
           :product =>"Wordpress",
           :match_details =>"Wordpress TinyMCE Editor",
           :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],

data/lib/checks/banu.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+  class Banu < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor => "Banu",
+          :tags => [],
+          :product =>"Tinyproxy",
+          :match_details =>"server header",
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /server: tinyproxy/i,
+          :dynamic_version => lambda { |x|
+            _first_header_capture(x,/server: tinyproxy\/(.*)/i,)
+          },
+          :examples => ["http://208.46.69.59:8080"],
+          :paths => ["#{url}"]
+        }
+      ]
+    end
+  end
+end
+end
+end

data/lib/checks/base.rb

@@ -9,12 +9,19 @@ class Base
 
   private
 
+    def _body(content)
+      return nil unless content["details"]["hidden_response_data"]
+      content["details"]["hidden_response_data"]
+    end
+
     # matching helpers
     def _first_body_match(content, regex)
+      return nil unless content["details"]["hidden_response_data"]
       content["details"]["hidden_response_data"].match(regex)
     end
 
     def _first_body_capture(content, regex, filter=[])
+      return nil unless content["details"]["hidden_response_data"]
       x = content["details"]["hidden_response_data"].match(regex)
       if x
         x = x.captures.first.strip
@@ -26,10 +33,12 @@ class Base
     end
 
     def _first_header_match(content, regex)
+      return nil unless content["details"]["headers"]
       content["details"]["headers"].match(regex).first
     end
 
     def _first_header_capture(content,regex, filter=[])
+      return nil unless content["details"]["headers"]
       x = content["details"]["headers"].join("\n").match(regex)
       if x
         x = x.captures.first
@@ -41,10 +50,12 @@ class Base
     end
 
     def _first_cookie_match(content, regex)
+      return nil unless content["details"]["cookies"]
       content["details"]["cookies"].match(regex).first
     end
 
     def _first_cookie_capture(content, regex, filter=[])
+      return nil unless content["details"]["headers"]
       x = content["details"]["cookies"].match(regex)
       if x
         x = x.captures.first.strip

data/lib/checks/cisco.rb

@@ -5,6 +5,18 @@ module Check
 
       def generate_checks(url)
         [
+          {
+            :type => "hardware",
+            :vendor => "Cisco",
+            :product => "Meraki",
+            :match_details => "Meraki logo on an on-prem box",
+            :version => nil,
+            :match_type => :content_body,
+            :match_content =>  /<img id="header_logo" src="images\/meraki-logo.png"/,
+            :hide => false,
+            :examples => [],
+            :paths => ["#{url}"]
+          },
           {
             :type => "application",
             :vendor => "Cisco",

data/lib/checks/citrix.rb

@@ -28,6 +28,20 @@ module Check
             :match_content => /CTXMSAM_LogonFont/,
             :hide => false,
             :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Citrix",
+            :product => "Netscaler Gateway",
+            :match_details => "misspelled content-length header",
+            :tags => ["tech:vpn"],
+            :references => ["https://support.citrix.com/article/CTX211605"],
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content => /^cteonnt-length:.*$/,
+            :hide => false,
+            :paths => ["#{url}"],
+            :examples => ["http://204.29.196.116:80"]
           }
 
         ]

data/lib/checks/cloudflare.rb

@@ -8,7 +8,7 @@ module Check
           {
             :type => "service",
             :vendor => "Cloudflare",
-            :product =>"CDN",
+            :product => "CDN",
             :version => nil,
             :match_type => :content_cookies,
             :match_content =>  /__cfduid/i,
@@ -18,7 +18,7 @@ module Check
           {
             :type => "service",
             :vendor => "Cloudflare",
-            :product =>"CDN",
+            :product => "CDN",
             :version => nil,
             :match_type => :content_headers,
             :match_content =>  /cloudflare-nginx/i,
@@ -28,11 +28,11 @@ module Check
           {
             :type => "service",
             :vendor => "Cloudflare",
-            :product =>"CDN",
+            :product => "CDN",
             :tags => ["error_page"],
             :version => nil,
             :match_type => :content_body,
-            :match_content =>  /<title>Direct IP access not allowed \| Cloudflare/,
+            :match_content => /<title>Direct IP access not allowed \| Cloudflare/,
             :match_details =>"Cloudflare - Direct IP Access",
             :hide => true,
             :paths => ["#{url}"]
@@ -40,7 +40,7 @@ module Check
           {
             :type => "service",
             :vendor => "Cloudflare",
-            :product =>"CDN",
+            :product => "CDN",
             :match_details =>"Cloudflare Error",
             :tags => ["error_page"],
             :version => "",
@@ -52,11 +52,11 @@ module Check
           {
             :type => "service",
             :vendor => "Cloudflare",
-            :product =>"CDN",
+            :product => "CDN",
             :match_details =>"Cloudfront Error - Direct IP Access",
-            :version => "",
+            :version => nil,
             :match_type => :content_body,
-            :match_content =>  /403\ Forbidden<\/h1><\/center>\n<hr><center>cloudflare<\/center>/,
+            :match_content =>  /403\ Forbidden<\/h1><\/center>\n<hr><center>cloudflare<\/center>/im,
             :hide => true,
             :paths => ["#{url}"]
           }

data/lib/checks/craft.rb

@@ -0,0 +1,25 @@
+module Intrigue
+module Ident
+module Check
+    class Craft < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :vendor => "Craft",
+            :type => "application",
+            :product =>"CMS",
+            :match_details =>"csrf protection cookie",
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content =>  /CRAFT_CSRF_TOKEN/,
+            :hide => true,
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end