intrigue-ident 0.55 → 0.56

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c5a196eeaef456f3e87603aa30e79660de9ea33399fcf07848a3a274574a612
-  data.tar.gz: 2f14d719d150986307142c501e58fe3d71f95d057b5cf8ddd68c13e8846c49d7
+  metadata.gz: e1c9207e2e33297b590d8750d681ca4d4596ce08da81742425b41c070fd32f98
+  data.tar.gz: 4f47cfd03bee058851314b1b8b2a5540dd9d0860fe81d8e6aa67633c308b1681
 SHA512:
-  metadata.gz: b0394663390d12ddb496f347dd0ee87e1afda4dd928b336951ce8aaf5ba3c4ea1cfce2d915222cc84bc611fa70b84aede5a11b7878862f9ce1dd770ca30f2360
-  data.tar.gz: 95cbfa13c55eec6da6ebd7bee2902e7d38c6bf9a17da36815af305a5c2fbb28d6aad694aa036974dd0206a412ceba500e9bcaec2aa8986b9e35b7f0db68d4d75
+  metadata.gz: 33bffe27cd64e8569dc535b88edec091726d88d6c61d69cea59967a617d58304ad64a887a003c7eb065adc2df96b0865665fc1eb5332be90118c361c2b0d2d7b
+  data.tar.gz: 7eeb8a06a4eef2e9be0337977ced244690996e1ec3f35a8241a5630775efd0c918fcbb12323a19d9490e337240bf198d3f6e9456418addf758b32d8450cfd6d0

data/lib/checks/apache.rb

@@ -5,6 +5,18 @@ class Apache < Intrigue::Ident::Check::Base
 
   def generate_checks(url)
     [
+      {
+        :type => "application",
+        :vendor => "Apache",
+        :product =>"Ambari",
+        :match_details =>"page title",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<title>Ambari<\/title>/i,
+        :examples => ["http://12.42.205.114:8080"],
+        :verify => "aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMTIuNDIuMjA1LjExNDo4MDgw",
+        :paths => ["#{url}"]
+      },
       {
         :type => "application",
         :vendor => "Apache",

data/lib/checks/axis.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Check
+class Axis < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :type => "application",
+        :vendor => "Axis",
+        :tags => ["tech:webcam"],
+        :product => "Webcam",
+        :match_details =>"default redirect uri",
+        :version => nil,
+        :match_type => :content_body,
+        :match_content =>  /<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0; URL=\/view\/viewer_index.shtml?id=/,
+        :paths => ["#{url}"]
+      }
+    ]
+  end
+end
+end
+end
+end

data/lib/checks/checkpoint.rb

@@ -8,7 +8,7 @@ module Check
         {
           :type => "application",
           :vendor => "Checkpoint",
-          :tags => [],
+          :tags => ["tech:vpn"],
           :product =>"GO",
           :match_details =>"page title",
           :references => ["https://en.wikipedia.org/wiki/Check_Point_GO"],
@@ -18,6 +18,34 @@ module Check
           :examples => ["http://192.234.138.61:80"],
           :verify => ["eGNlbGVuZXJneSNJbnRyaWd1ZTo6RW50aXR5OjpVcmkjaHR0cDovLzE5Mi4yMzQuMTM4LjYxOjgw"],
           :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor => "Checkpoint",
+          :tags => ["tech:vpn"],
+          :product =>"GO",
+          :match_details =>"server header",
+          :references => ["https://en.wikipedia.org/wiki/Check_Point_GO"],
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /server: CPWS/i,
+          :examples => ["http://200.142.200.1:80"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMjAwLjE0Mi4yMDAuMTo4MA=="],
+          :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor => "Checkpoint",
+          :tags => ["tech:vpn"],
+          :product =>"SSL Network Extender",
+          :match_details =>"server header",
+          :references => [],
+          :version => nil,
+          :match_type => :content_headers,
+          :match_content =>  /server: Check Point SVN foundation/i,
+          :examples => ["https://www.cora.ro:8443"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovL3d3dy5jb3JhLnJvOjg0NDM="],
+          :paths => ["#{url}"]
         }
       ]
     end

data/lib/checks/cisco.rb

@@ -5,6 +5,34 @@ module Check
 
       def generate_checks(url)
         [
+          {
+            :type => "application",
+            :vendor => "Cisco",
+            :product => "Adaptive Security Device Manager",
+            :match_details => "page title",
+            :version => nil,
+            :dynamic_version => lambda {|x| _first_body_capture(x,/<title>Cisco ASDM (.*?)<\/title>/)},
+            :match_type => :content_body,
+            :match_content =>  /<title>Cisco ASDM/,
+            :hide => false,
+            :examples => ["https://194.107.112.4:443"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovLzE5NC4xMDcuMTEyLjQ6NDQz"],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "hardware",
+            :vendor => "Cisco",
+            :product => "Email Security Appliance",
+            :match_details => "page title",
+            :version => nil,
+            :dynamic_version => lambda {|x| _first_body_capture(x,/Email Security Appliance   (.*?) \(/)},
+            :match_type => :content_body,
+            :match_content =>  /<title>        Cisco         Email Security Appliance/,
+            :hide => false,
+            :examples => ["https://200.142.198.180:443"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovLzIwMC4xNDIuMTk4LjE4MDo0NDM="],
+            :paths => ["#{url}"]
+          },
           {
             :type => "hardware",
             :vendor => "Cisco",
@@ -54,7 +82,21 @@ module Check
             :match_content =>  /server: cisco-IOS/,
             :hide => false,
             :paths => ["#{url}"]
-          }
+          },
+          {
+            :type => "application",
+            :vendor => "Cisco",
+            :product =>"vManage",
+            :match_details => "page title",
+            :tags => [],
+            :version => nil,
+            :match_type => :content_body,
+            :match_content => /<title>Cisco vManage/,
+            :examples => ["http://129.41.171.244:80"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMTI5LjQxLjE3MS4yNDQ6ODA="],
+            :hide => false,
+            :paths => ["#{url}"]
+          },
         ]
       end
 

data/lib/checks/citrix.rb

@@ -42,8 +42,54 @@ module Check
             :hide => false,
             :paths => ["#{url}"],
             :examples => ["http://204.29.196.116:80"]
+          },
+          {
+            :type => "application",
+            :vendor => "Citrix",
+            :product => "Netscaler Gateway",
+            :match_details => "cookie",
+            :tags => ["tech:vpn"],
+            :references => ["https://support.citrix.com/article/CTX131488"],
+            :version => nil,
+            :match_type => :content_cookies,
+            :match_content => /citrix_ns_id=/,
+            :hide => false,
+            :paths => ["#{url}"],
+            :verify => ["dW5kZXJhcm1vdXIjSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHA6Ly8yMDQuMjkuMTk2LjEwMjo4MA=="],
+            :examples => ["http://204.29.196.102:80"]
+          },
+          {
+            :type => "application",
+            :vendor => "Citrix",
+            :product => "XenServer",
+            :match_details => "page title",
+            :tags => ["tech:hypervisor"],
+            :references => [""],
+            :version => nil,
+            :dynamic_version => lambda { |x| _first_body_capture(x,/<title>XenServer (.*?)<\/title>/) },
+            :match_type => :content_body,
+            :match_content => /<title>XenServer/,
+            :hide => false,
+            :paths => ["#{url}"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMTU4Ljg1LjE3My4zNzo4MA=="],
+            :examples => ["http://158.85.173.37:80"]
+          },
+          {
+            :type => "application",
+            :vendor => "Citrix",
+            :product => "XenServer",
+            :match_details => "page title",
+            :tags => ["tech:hypervisor"],
+            :references => [""],
+            :version => nil,
+            :dynamic_version => lambda { |x| _first_body_capture(x,/<title>Welcome to Citrix XenServer (.*?)<\/title>/) },
+            :match_type => :content_body,
+            :match_content => /<title>Welcome to Citrix XenServer/,
+            :hide => false,
+            :paths => ["#{url}"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovLzIzLmRjLjU1OWUuaXA0LnN0YXRpYy5zbC1yZXZlcnNlLmNvbTo0NDM="],
+            :examples => ["https://23.dc.559e.ip4.static.sl-reverse.com:443"]
           }
-
         ]
       end
 

data/lib/checks/ibm.rb

@@ -5,6 +5,20 @@ module Check
 
     def generate_checks(url)
       [
+        {
+          :type => "application",
+          :vendor => "IBM",
+          :product =>"Axway SecureTranspor",
+          :references => ["https://www-356.ibm.com/partnerworld/gsd/solutiondetails.do?&solution=47052"],
+          :version => nil,
+          :dynamic_version => lambda {|x| _first_header_capture(x,/SecureTransport (.*) (build:.*)/)},
+          :match_type => :content_headers,
+          :match_content =>  /server: SecureTransport/i,
+          :match_details =>"server header - build is avail too",
+          :examples => ["https://dhebpcb01.boulder.ibm.com:443"],
+          :verify => ["xaWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovL2RoZWJwY2IwMS5ib3VsZGVyLmlibS5jb206NDQz"],
+          :paths => ["#{url}"]
+        },
         {
           :type => "application",
           :vendor => "IBM",

data/lib/checks/lithium.rb

@@ -8,7 +8,7 @@ module Check
           {
             :type => "application",
             :vendor => "Lithium",
-            :product =>"Lithum",
+            :product =>"Lithium",
             :match_details =>"Lithium Community Management",
             :match_type => :content_cookies,
             :version => nil,
@@ -18,7 +18,7 @@ module Check
           {
             :type => "application",
             :vendor => "Lithium",
-            :product =>"Lithum",
+            :product =>"Lithium",
             :match_details =>"Lithium Community Management",
             :match_type => :content_cookies,
             :version => nil,

data/lib/checks/mediawiki.rb

@@ -9,15 +9,28 @@ module Check
           :type => "application",
           :vendor =>"MediaWiki",
           :product =>"MediaWiki",
-          :match_details =>"MediaWiki",
+          :match_details =>"powered by tag",
           :match_type => :content_body,
           :version => nil,
           :match_content =>  /<a href="\/\/www.mediawiki.org\/">Powered by MediaWiki<\/a>/,
           :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor =>"MediaWiki",
+          :product =>"MediaWiki",
+          :match_details =>"generator tag",
+          :match_type => :content_body,
+          :match_content =>  /<meta name=\"generator\" content=\"MediaWiki/,
+          :version => nil,
+          :dynamic_version => lambda { |x| _first_body_capture(x,/<meta name=\"generator\" content=\"MediaWiki\ (.*?)\"\/>/) },
+          :examples => ["http://2004.appsecusa.org:80"],
+          :verify => ["b3dhc3AjSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHA6Ly8yMDA0LmFwcHNlY3VzYS5vcmc6ODA="],
+          :paths => ["#{url}"]
         }
       ]
     end
-    
+
   end
 end
 end

data/lib/checks/microtik.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+  class Microtik < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor =>"Microtik",
+          :product =>"RouterOS",
+          :match_details => "page title",
+          :match_type => :content_body,
+          :match_content =>  /<title>RouterOS router configuration page/,
+          :version => nil,
+          :dynamic_version => lambda { |x| _first_body_capture(x,/<h1>RouterOS v(.*?)<\/h1>/) },
+          :examples => ["http://91.211.58.34:80"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vOTEuMjExLjU4LjM0Ojgw"],
+          :paths => ["#{url}"]
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/lib/checks/ookla.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+  class Ookla < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor =>"Ookla",
+          :product =>"Speedtest Server",
+          :match_details => "page title",
+          :match_type => :content_body,
+          :references => ["https://support.ookla.com/hc/en-us/articles/234578568-How-To-Install-Submit-Server"],
+          :match_content => /<title>OoklaServer/,
+          :version => nil,
+          :examples => ["http://91.211.56.179:8081"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vOTEuMjExLjU2LjE3OTo4MDgx"],
+          :paths => ["#{url}"]
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/lib/checks/oracle.rb

@@ -28,38 +28,42 @@ module Check
           {
             :type => "application",
             :vendor => "Oracle",
-            :product =>"HTTP Server",
-            :match_details =>"server header",
-            :references => [],
+            :product =>"Fusion Middleware",
+            :match_details =>"page title & docs link... should give us a version",
             :version => nil,
-            :match_type => :content_headers,
-            :match_content =>  /Oracle-HTTP-Server/,
-            :hide => false,
             :dynamic_version => lambda { |x|
-                _first_header_capture(x,/Oracle-HTTP-Server\/(.*?)\ /)
+              doc_version = _first_body_capture(x,/download.oracle.com\/docs\/cd\/(.*?)\/index.htm/)
+              case doc_version
+                when "E15217_01"
+                  fmw_version = "10.1.4.3"
+                when "E15051_01"
+                  fmw_version = "11.1.1.0"
+                when "E12839_01"
+                  fmw_version = "11.1.1.1"
+                when "E15523_01"
+                  fmw_version = "11.1.1.2"
+                when "E14571_01"
+                  fmw_version = "11.1.1.3"
+                when "E17904_01"
+                  fmw_version = "11.1.1.4"
+                when "E21764_01"
+                  fmw_version = "11.1.1.5"
+                else
+                  fmw_version = nil
+              end
+            fmw_version
             },
-            :examples => [
-              "https://qas.huntsmanservice.com:443"
+            :match_type => :content_body,
+            :references => [
+              "https://en.wikipedia.org/wiki/Oracle_Fusion_Middleware",
+              "https://docs.oracle.com/cd/E21764_01/index.htm"
             ],
-            :verify => ["aHVudHNtYW4jSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHBzOi8vcWFzLmh1bnRzbWFuc2VydmljZS5jb206NDQz"],
-            :paths => ["#{url}"]
-          },
-          {
-            :type => "application",
-            :vendor => "Oracle",
-            :product =>"Web Cache Server",
-            :match_details =>"server header",
-            :references => [],
-            :version => nil,
-            :match_type => :content_headers,
-            :match_content =>  /Oracle-Web-Cache/,
+            :match_content =>  /<title>Welcome to Oracle Fusion Middleware/,
             :hide => false,
-            :dynamic_version => lambda { |x|
-                _first_header_capture(x,/Oracle-Web-Cache-[0-9]+[a-z]?\/(.*?)\ /) },
             :examples => [
-              "https://qas.huntsmanservice.com:443"
+              "http://200.142.198.113:80"
             ],
-            :verify => ["aHVudHNtYW4jSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHBzOi8vcWFzLmh1bnRzbWFuc2VydmljZS5jb206NDQz"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMjAwLjE0Mi4xOTguMTEzOjgw"],
             :paths => ["#{url}"]
           },
           {
@@ -90,6 +94,25 @@ module Check
             :examples => ["http://52.2.97.57:80"],
             :paths => ["#{url}"]
           },
+          {
+            :type => "application",
+            :vendor => "Oracle",
+            :product =>"HTTP Server",
+            :match_details =>"server header",
+            :references => [],
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /Oracle-HTTP-Server/,
+            :hide => false,
+            :dynamic_version => lambda { |x|
+                _first_header_capture(x,/Oracle-HTTP-Server\/(.*?)\ /)
+            },
+            :examples => [
+              "https://qas.huntsmanservice.com:443"
+            ],
+            :verify => ["aHVudHNtYW4jSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHBzOi8vcWFzLmh1bnRzbWFuc2VydmljZS5jb206NDQz"],
+            :paths => ["#{url}"]
+          },
           {
             :type => "application",
             :vendor => "Oracle",
@@ -149,6 +172,24 @@ module Check
             :examples => ["https://reset.oxy.com:443"],
             :paths => ["#{url}"]
           },
+          {
+            :type => "application",
+            :vendor => "Oracle",
+            :product =>"Web Cache Server",
+            :match_details =>"server header",
+            :references => [],
+            :version => nil,
+            :match_type => :content_headers,
+            :match_content =>  /Oracle-Web-Cache/,
+            :hide => false,
+            :dynamic_version => lambda { |x|
+                _first_header_capture(x,/Oracle-Web-Cache-[0-9]+[a-z]?\/(.*?)\ /) },
+            :examples => [
+              "https://qas.huntsmanservice.com:443"
+            ],
+            :verify => ["aHVudHNtYW4jSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHBzOi8vcWFzLmh1bnRzbWFuc2VydmljZS5jb206NDQz"],
+            :paths => ["#{url}"]
+          },
           {
             :type => "application",
             :vendor => "Oracle",
@@ -167,7 +208,10 @@ module Check
             :vendor => "Oracle",
             :product =>"Weblogic",
             :match_details =>"weblogic header",
-            :references => ["https://support.oracle.com/knowledge/Middleware/2100514_1.html"],
+            :references => [
+              "https://support.oracle.com/knowledge/Middleware/2100514_1.html",
+              "https://www.qualogy.com/techblog/oracle/how-to-harden-weblogic-and-fusion-middleware-against-worm-attacks"
+            ],
             :version => nil,
             :match_type => :content_headers,
             :match_content =>  /^x-oracle-dms-ecid:/,

data/lib/checks/plesk.rb

@@ -0,0 +1,41 @@
+module Intrigue
+module Ident
+module Check
+  class Plesk < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor =>"Plesk",
+          :product =>"Plesk",
+          :match_details => "page title",
+          :match_type => :content_body,
+          :references => ["https://en.wikipedia.org/wiki/Plesk"],
+          :match_content =>  /<title>Plesk (.*?)<\/title>/,
+          :version => nil,
+          :dynamic_version => lambda { |x| _first_body_capture(x,/<title>Plesk (.*?)<\/title>/) },
+          :examples => ["https://158.85.134.112:8443"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovLzE1OC44NS4xMzQuMTEyOjg0NDM="],
+          :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor =>"Plesk",
+          :product =>"Plesk",
+          :match_details => "server header",
+          :match_type => :content_headers,
+          :references => ["https://en.wikipedia.org/wiki/Plesk"],
+          :match_content => /server: sw-cp-server/,
+          :version => nil,
+          :examples => ["https://158.85.134.112:8443"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovLzE1OC44NS4xMzQuMTEyOjg0NDM="],
+          :paths => ["#{url}"]
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/lib/checks/pulse_secure.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+  class PulseSecure < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor =>"Pulse Secure",
+          :product =>"Junos VPN",
+          :match_details => "page title",
+          :match_type => :content_body,
+          :references => [],
+          :match_content =>  /<title>Junos Pulse Secure Access Service/,
+          :version => nil,
+          :examples => ["https://193.240.34.79:443"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovLzE5My4yNDAuMzQuNzk6NDQz"],
+          :paths => ["#{url}"]
+        },
+      ]
+    end
+
+  end
+end
+end
+end

data/lib/checks/restlet.rb

@@ -1,7 +1,7 @@
 module Intrigue
 module Ident
 module Check
-    class Zscaler < Intrigue::Ident::Check::Base
+    class Restlet < Intrigue::Ident::Check::Base
 
       def generate_checks(url)
         [

data/lib/checks/sap.rb

@@ -0,0 +1,43 @@
+module Intrigue
+module Ident
+module Check
+    class Sap < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "application",
+            :vendor =>"SAP",
+            :product =>"NetWeaver",
+            :match_details =>"cookie",
+            :references => [
+              "https://apps.support.sap.com/sap/support/knowledge/preview/en/2082323",
+              "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence.rb"
+            ],
+            :match_type => :content_cookies,
+            :match_content =>  /sap-usercontext=sap-language=/i,
+            :examples => ["http://204.29.196.102:80"],
+            :verify => ["dW5kZXJhcm1vdXIjSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHA6Ly8yMDQuMjkuMTk2LjEwMjo4MA=="],
+            :paths => ["#{url}"]
+          },
+          {
+            :type => "application",
+            :vendor =>"SAP",
+            :product =>"NetWeaver",
+            :match_details =>"location header",
+            :references => [
+              "https://blogs.sap.com/2016/05/19/hp-loadrunner-scripts-for-webui/"
+            ],
+            :match_type => :content_headers,
+            :match_content =>  /bD1lbiZjPTEwMCZkPW1pbg==/i,
+            :examples => ["http://onlinepaymentstest.underarmour.com:80"],
+            :verify => ["dW5kZXJhcm1vdXIjSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHA6Ly9vbmxpbmVwYXltZW50c3Rlc3QudW5kZXJhcm1vdXIuY29tOjgw"],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/vmware.rb

@@ -8,8 +8,22 @@ module Check
           {
             :type => "application",
             :vendor => "VMWare",
+            :tags => ["tech:hypervisor"],
+            :product =>"ESXi",
+            :match_details =>"unique page string",
+            :version => nil,
+            :match_type => :content_body,
+            :match_content => /document.write\(\"<title>\"\ \+\ ID_EESX_Welcome/,
+            :paths => ["#{url}"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMTIuNDIuMjA1LjEyNzo4MA=="],
+            :examples => ["http://12.42.205.127:80"]
+          },
+          {
+            :type => "application",
+            :vendor => "VMWare",
+            :tags => ["tech:hypervisor"],
             :product =>"Horizon",
-            :match_details =>"VMWare Horizon",
+            :match_details =>"page title",
             :version => nil,
             :match_type => :content_body,
             :match_content =>  /<title>VMware Horizon/,

data/lib/checks/webmin.rb

@@ -0,0 +1,41 @@
+module Intrigue
+module Ident
+module Check
+  class Webmin < Intrigue::Ident::Check::Base
+
+    def generate_checks(url)
+      [
+        {
+          :type => "application",
+          :vendor =>"Webmin",
+          :product =>"MiniServ",
+          :match_details => "server header",
+          :match_type => :content_headers,
+          :references => [],
+          :match_content => /server: MiniServ/,
+          :version => nil,
+          :dynamic_version => lambda {|x| _first_header_capture(x,/server: MiniServ\/(.*)/)},
+          :examples => ["http://158.85.208.126:8080"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMTU4Ljg1LjIwOC4xMjY6ODA4MA=="],
+          :paths => ["#{url}"]
+        },
+        {
+          :type => "application",
+          :vendor =>"Webmin",
+          :product =>"Webmin",
+          :match_details => "page title",
+          :match_type => :content_body,
+          :references => [],
+          :match_content => /<title>Login to Webmin/,
+          :version => nil,
+          :examples => ["http://158.85.208.126:8080"],
+          :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwOi8vMTU4Ljg1LjIwOC4xMjY6ODA4MA=="],
+          :paths => ["#{url}"]
+        }
+      ]
+    end
+
+  end
+end
+end
+end

data/lib/checks/yaws.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+    class Yaws < Intrigue::Ident::Check::Base
+
+      def generate_checks(url)
+        [
+          {
+            :type => "application",
+            :vendor =>"Yaws",
+            :product =>"Yaws",
+            :match_details =>"server header",
+            :references => ["https://en.wikipedia.org/wiki/Yaws_(web_server)"],
+            :match_type => :content_headers,
+            :match_content =>  /server: Yaws/i,
+            :dynamic_version => lambda { |x|
+              _first_header_capture(x,/server: Yaws (.*)/i)
+            },
+            :examples => ["https://158.85.224.176:443"],
+            :verify => ["aWJtI0ludHJpZ3VlOjpFbnRpdHk6OlVyaSNodHRwczovLzE1OC44NS4yMjQuMTc2OjQ0Mw=="],
+            :paths => ["#{url}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/zendesk.rb

@@ -16,6 +16,19 @@ module Check
             :examples => ["http://help.etsy.com:80"],
             :verify => ["ZXRzeSNJbnRyaWd1ZTo6RW50aXR5OjpVcmkjaHR0cDovL2hlbHAuZXRzeS5jb206ODA="],
             :paths => ["#{url}"]
+          },
+          { # TODO - this might catch valid (closed) helpdesk uris too.
+            :type => "service",
+            :vendor =>"Zendesk",
+            :product =>"Zendesk",
+            :match_details =>"zendesk access by IP / invalid hostname",
+            :references => [],
+            :hide => true,
+            :match_type => :content_body,
+            :match_content =>  /<title>Help Center Closed \| Zendesk/i,
+            :examples => ["http://192.161.147.1:80"],
+            :verify => ["a2VubmFzZWN1cml0eSNJbnRyaWd1ZTo6RW50aXR5OjpVcmkjaHR0cDovLzE5Mi4xNjEuMTQ3LjE6ODA="],
+            :paths => ["#{url}"]
           }
         ]
       end

data/lib/intrigue-ident.rb

@@ -11,7 +11,7 @@ Dir["#{check_folder}/*.rb"].each { |file| require_relative file }
 module Intrigue
   module Ident
 
-    VERSION=0.55
+    VERSION=0.56
 
     def generate_requests_and_check(url)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: intrigue-ident
 version: !ruby/object:Gem::Version
-  version: '0.55'
+  version: '0.56'
 platform: ruby
 authors:
 - jcran
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-07-29 00:00:00.000000000 Z
+date: 2018-07-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -71,6 +71,7 @@ files:
 - lib/checks/aruba.rb
 - lib/checks/atlassian.rb
 - lib/checks/automattic.rb
+- lib/checks/axis.rb
 - lib/checks/banu.rb
 - lib/checks/base.rb
 - lib/checks/checkpoint.rb
@@ -110,10 +111,12 @@ files:
 - lib/checks/mcafee.rb
 - lib/checks/mediawiki.rb
 - lib/checks/microsoft.rb
+- lib/checks/microtik.rb
 - lib/checks/nagios.rb
 - lib/checks/new_relic.rb
 - lib/checks/nginx.rb
 - lib/checks/okta.rb
+- lib/checks/ookla.rb
 - lib/checks/openresty.rb
 - lib/checks/oracle.rb
 - lib/checks/palo_alto.rb
@@ -125,16 +128,21 @@ files:
 - lib/checks/phpmyadmin.rb
 - lib/checks/ping_identity.rb
 - lib/checks/pivotal.rb
+- lib/checks/plesk.rb
+- lib/checks/pulse_secure.rb
 - lib/checks/rabbitmq.rb
 - lib/checks/restlet.rb
 - lib/checks/ruckus_wireless.rb
 - lib/checks/sailpoint.rb
+- lib/checks/sap.rb
 - lib/checks/tableau.rb
 - lib/checks/team_city.rb
 - lib/checks/telerik.rb
 - lib/checks/varnish.rb
 - lib/checks/vmware.rb
+- lib/checks/webmin.rb
 - lib/checks/wp_engine.rb
+- lib/checks/yaws.rb
 - lib/checks/zeit.rb
 - lib/checks/zendesk.rb
 - lib/checks/zimbra.rb