intrigue-ident 0.49 → 0.51

data/lib/checks/openresty.rb

@@ -0,0 +1,25 @@
+module Intrigue
+module Ident
+module Check
+    class OpenResty < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "service",
+            :vendor =>"OpenResty",
+            :product =>"OpenResty",
+            :match_details =>"server header for OpenResty",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /server: openresty/i,
+            :examples => ["http://54.164.224.102:80"],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/oracle.rb

@@ -5,7 +5,7 @@ module Check
 
       def generate_checks(url)
         [
-          {
+          { # TODO are HTTP-server and application-server the same thing?  
             :type => "application",
             :vendor => "Oracle",
             :product =>"Application Server",
@@ -15,8 +15,10 @@ module Check
             :match_type => :content_headers,
             :match_content =>  /server: Oracle-Application-Server/,
             :hide => false,
-            :dynamic_version => lambda { |x| _first_header_capture(x,/server:.*\/(.*) Oracle-HTTP-Server,/) },
-            :examples => ["https://63.85.74.53:443"],
+            :dynamic_version => lambda { |x|
+                _first_header_capture(x,/server:.*\/(.*) Oracle-HTTP-Server,/) || _first_header_capture(x,/server: Oracle-Application-Server-(.*)/) },
+            :examples => ["https://63.85.74.53:443","https://rss.tomthumb.com:443"],
+            :verify => ["YWxiZXJ0c29ucyNJbnRyaWd1ZTo6RW50aXR5OjpVcmkjaHR0cHM6Ly9yc3MudG9tdGh1bWIuY29tOjQ0Mw=="],
             :paths => ["#{url}"]
           },
           {
@@ -47,6 +49,47 @@ module Check
             :examples => ["http://52.2.97.57:80"],
             :paths => ["#{url}"]
           },
+          {
+            :type => "application",
+            :vendor => "Oracle",
+            :product =>"Java",
+            :match_details =>"JSESSIONID cookie",
+            :references => ["https://javarevisited.blogspot.com/2012/08/what-is-jsessionid-in-j2ee-web.html"],
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content =>  /JSESSIONID=/,
+            :hide => false,
+            :examples => ["https://birdcam.xcelenergy.com:443"],
+            :paths => ["#{url}"]
+          },
+          { # TODO - this will tell us J2EE versions, see references!!!
+            :type => "application",
+            :vendor => "Oracle",
+            :product =>"Java Application Server",
+            :match_details =>"x-header",
+            :references => ["http://www.ntu.edu.sg/home/ehchua/programming/java/javaservlets.html"],
+            :version => nil,
+            :dynamic_version => lambda { |x| _first_header_capture(x,/^x-powered-by: Servlet\/(.*)JSP.*$/) },
+            :match_type => :content_headers,
+            :match_content =>  /x-powered-by: Servlet/,
+            :hide => false,
+            :paths => ["#{url}"],
+            :examples => ["http://165.160.15.20/"]
+          },
+          { # TODO - this will tell us J2EE versions, see references!!!
+            :type => "application",
+            :vendor => "Oracle",
+            :product =>"Java Server Pages",
+            :match_details =>"x-header",
+            :references => ["http://www.ntu.edu.sg/home/ehchua/programming/java/javaservlets.html"],
+            :version => nil,
+            :dynamic_version => lambda { |x| _first_header_capture(x,/^x-powered-by: Servlet\/.*JSP\/(.*)$/) },
+            :match_type => :content_headers,
+            :match_content =>  /x-powered-by: Servlet\/.*JSP.*/,
+            :hide => false,
+            :paths => ["#{url}"],
+            :examples => ["http://165.160.15.20/"]
+          },
           {
             :type => "application",
             :vendor => "Oracle",
@@ -64,6 +107,19 @@ module Check
             :hide => false,
             :examples => ["https://reset.oxy.com:443"],
             :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor => "Oracle",
+            :product =>"Weblogic",
+            :match_details =>"weblogic fault / fail",
+            :references => ["https://coderanch.com/t/603067/application-servers/Calling-weblogic-webservice-error"],
+            :version => nil,
+            :match_type => :content_body,
+            :match_content =>  /<faultcode>env:WebServiceFault/,
+            :hide => false,
+            :examples => ["https://css-ewebsvcs.freddiemac.com:443"],
+            :paths => ["#{url}"]
           }
         ]
       end

data/lib/checks/pantheon.rb

@@ -0,0 +1,26 @@
+module Intrigue
+module Ident
+module Check
+    class Pantheon < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "service",
+            :vendor => "Pantheon",
+            :product => "Pantheon",
+            :tags => ["CMS"],
+            :match_details => "x-pantheon-site header",
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /x-pantheon-site/,
+            :paths => ["#{url}"]
+          }
+
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/php.rb

@@ -9,7 +9,7 @@ module Check
             :type => "application",
             :vendor =>"PHP",
             :product =>"PHP",
-            :match_details =>"",
+            :match_details =>"x-powered-by header",
             :version => nil,
             :match_type => :content_headers,
             :match_content =>  /x-powered-by: PHP/i,
@@ -18,6 +18,17 @@ module Check
             },
             :examples => ["http://78.40.183.96:8081"],
             :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor =>"PHP",
+            :product =>"PHP",
+            :match_details =>"cookie",
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content =>  /PHPSESSID=/i,
+            :examples => ["http://107.20.49.246:80"],
+            :paths => ["#{url}"]
           }
         ]
       end

data/lib/checks/ruckus_wireless.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Check
+    class RuckusWireless < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "application",
+            :vendor =>"Ruckus Wireless",
+            :product =>"Admin",
+            :match_details =>"login page for ruckus wireless device",
+            :match_type => :content_body,
+            :match_content =>  /<title>Ruckus Wireless Admin/i,
+            :examples => [],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/tableau.rb

@@ -0,0 +1,26 @@
+module Intrigue
+module Ident
+module Check
+    class Tableau < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "application",
+            :vendor => "Tableau",
+            :product => "Tableau",
+            :match_details => "Tableau Server",
+            :version => nil,
+            :references => ["https://community.tableau.com/thread/165653"],
+            :match_type => :content_body,
+            :match_content =>  /<meta name="vizportal-config" data-buildId=/i,
+            :examples => ["http://137.154.26.56:80"],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/zeit.rb

@@ -0,0 +1,28 @@
+module Intrigue
+module Ident
+module Check
+    class Zeit < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "application",
+            :vendor =>"Zeit",
+            :product =>"Next.js",
+            :match_details =>"x-powered-by header",
+            :references => ["https://zeit.co/blog/next"],
+            :match_type => :content_headers,
+            :match_content =>  /x-powered-by: Next.js/i,
+            :dynamic_version => lambda { |x|
+              _first_header_capture(x,/sx-powered-by: Next.js\ (.*)/i)
+            },
+            :examples => ["http://static.invisionapp.com:80"],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/zimbra.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Check
+    class Zimbra < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "service",
+            :vendor =>"Zimbra",
+            :product =>"Server",
+            :match_details =>"login page for zimbra",
+            :match_type => :content_body,
+            :match_content =>  /<title>Zimbra Web Client Sign In/i,
+            :examples => ["https://219.84.198.177:443"],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/zscaler.rb

@@ -1,7 +1,7 @@
 module Intrigue
 module Ident
 module Check
-    class Restlet < Intrigue::Ident::Check::Base
+    class Zscaler < Intrigue::Ident::Check::Base
 
       def generate_checks(url)
         [

data/lib/intrigue-ident.rb

@@ -11,7 +11,7 @@ Dir["#{check_folder}/*.rb"].each { |file| require_relative file }
 module Intrigue
   module Ident
 
-    VERSION=0.49
+    VERSION=0.51
 
     def generate_requests_and_check(url)
 
@@ -51,7 +51,7 @@ module Intrigue
     results.compact
     end
 
-    def check_intrigue_uri(intrigue_uri_data)
+    def check_intrigue_uri_hash(intrigue_uri_data)
 
       results = []
 
@@ -70,7 +70,7 @@ module Intrigue
 
         # call each check, collecting the product if it's a match
         ggc.last.each do |check|
-          results << _match_uri(check, intrigue_uri_data)
+          results << _match_uri_hash(check, intrigue_uri_data)
         end
       end
 
@@ -106,7 +106,7 @@ module Intrigue
     }
     end
 
-    def _match_uri(check,data)
+    def _match_uri_hash(check,data)
       return nil unless check && data
 
       #puts "Trying to match #{check[:vendor]} #{check[:product]}: #{data["details"]["cookies"][0..10]}"
@@ -199,7 +199,7 @@ module Intrigue
       data["details"]["response_data_hash"] = Digest::SHA256.base64digest("#{response.body}")
 
       # call the actual matcher & return
-      _match_uri check, data
+      _match_uri_hash check, data
     end
 
     def _http_request(method, uri_string, credentials=nil, headers={}, data=nil, limit = 10, open_timeout=15, read_timeout=15)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: intrigue-ident
 version: !ruby/object:Gem::Version
-  version: '0.49'
+  version: '0.51'
 platform: ruby
 authors:
 - jcran
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-07-09 00:00:00.000000000 Z
+date: 2018-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -71,13 +71,16 @@ files:
 - lib/checks/aruba.rb
 - lib/checks/atlassian.rb
 - lib/checks/automattic.rb
+- lib/checks/banu.rb
 - lib/checks/base.rb
 - lib/checks/chef.rb
 - lib/checks/cisco.rb
 - lib/checks/citrix.rb
 - lib/checks/cloudflare.rb
 - lib/checks/cpanel.rb
+- lib/checks/craft.rb
 - lib/checks/django.rb
+- lib/checks/docuwiki.rb
 - lib/checks/drupal.rb
 - lib/checks/f5.rb
 - lib/checks/fastly.rb
@@ -88,13 +91,21 @@ files:
 - lib/checks/groovy.rb
 - lib/checks/heroku.rb
 - lib/checks/hp.rb
+- lib/checks/ibm.rb
+- lib/checks/ivanti.rb
+- lib/checks/jamf.rb
+- lib/checks/jekyll.rb
 - lib/checks/jenkins.rb
+- lib/checks/jive.rb
 - lib/checks/jobvite.rb
 - lib/checks/joomla.rb
+- lib/checks/jupyter.rb
+- lib/checks/lighttpd.rb
 - lib/checks/limesuvey.rb
 - lib/checks/lithium.rb
 - lib/checks/lotus.rb
 - lib/checks/magento.rb
+- lib/checks/mailchimp.rb
 - lib/checks/mcafee.rb
 - lib/checks/mediawiki.rb
 - lib/checks/microsoft.rb
@@ -102,8 +113,10 @@ files:
 - lib/checks/new_relic.rb
 - lib/checks/nginx.rb
 - lib/checks/okta.rb
+- lib/checks/openresty.rb
 - lib/checks/oracle.rb
 - lib/checks/palo_alto.rb
+- lib/checks/pantheon.rb
 - lib/checks/pardot.rb
 - lib/checks/pfsense.rb
 - lib/checks/php.rb
@@ -111,12 +124,16 @@ files:
 - lib/checks/pivotal.rb
 - lib/checks/rabbitmq.rb
 - lib/checks/restlet.rb
+- lib/checks/ruckus_wireless.rb
 - lib/checks/sailpoint.rb
+- lib/checks/tableau.rb
 - lib/checks/team_city.rb
 - lib/checks/telerik.rb
 - lib/checks/varnish.rb
 - lib/checks/vmware.rb
 - lib/checks/wp_engine.rb
+- lib/checks/zeit.rb
+- lib/checks/zimbra.rb
 - lib/checks/zscaler.rb
 - lib/intrigue-ident.rb
 - util/check.rb