intrigue-ident 0.9.9 → 0.31

data/checks/http/axinom.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Axinom < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "axinom GmbH",
-        :product => "AxCMS",
-        :references => ["http://help.axcms.net/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Generated by AxCMS.net/i,
-        :dynamic_version => lambda { |x|  _first_body_capture(x, /Generated by AxCMS.net (\d+)/i)},
-        :match_details => "comment match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/axios.rb

@@ -1,29 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Axios < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Javascript"],
-        :vendor => "Axios",
-        :product => "Axios",
-        :references => [],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /axios\.min\.js[\"|\']\>/i,
-        :match_details => "filename",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/axis.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Axis < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Embedded", "Webcam"],
-        :vendor => "Axis",
-        :product => "Network Camera Firmware",
-        :match_details =>"default redirect uri",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0; URL=\/view\/viewer_index.shtml?id=/,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/axway.rb

@@ -1,33 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Axway < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS"],
-        :vendor => "Axway",
-        :product => "SecureTransport",
-        :website => "https://www.axway.com/en/products/secure-transport",
-        :references => [
-          "https://www-356.ibm.com/partnerworld/gsd/solutiondetails.do?&solution=47052"
-        ],
-        :version => nil,
-        :dynamic_version => lambda {|x| _first_header_capture(x,/SecureTransport (.*) build:.*/)},
-        :dynamic_update => lambda {|x| _first_header_capture(x,/SecureTransport\ .*\ build:(.*)$/)},
-        :match_type => :content_headers,
-        :match_content =>  /server: SecureTransport/i,
-        :match_details =>"server header - build is avail too",
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/backdrop.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Basekit < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Basekit",
-        :product => "Basekit",
-        :references => ["https://www.basekit.com/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /BaseKit/i,
-        :dynamic_version => nil,
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/banu.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Banu < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server","Proxy Server"],
-        :vendor => "Banu",
-        :product =>"Tinyproxy",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server: tinyproxy/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: tinyproxy\/(.*)/i,)
-        },
-        :paths => ["#{url}"],
-      :inference => true
-      }
-    ]
-  end
-end
-
-end
-end
-end

data/checks/http/barracuda.rb

@@ -1,99 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Barracuda < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["WAF"],
-        :url => "https://www.barracuda.com/products/webapplicationfirewall",
-        :references => [
-          "https://github.com/EnableSecurity/wafw00f"
-        ],
-        :vendor => "Barracuda",
-        :product =>"Application Firewall",
-        :match_details =>"cookie",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /barra_counter_session=/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["WAF"],
-        :url => "https://www.barracuda.com/products/webapplicationfirewall",
-        :references => [
-          "https://github.com/EnableSecurity/wafw00f"
-        ],
-        :vendor => "Barracuda",
-        :product =>"Application Firewall",
-        :match_details =>"cookie",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /BNI__BARRACUDA_LB_COOKIE=/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["WAF"],
-        :url => "https://www.barracuda.com/products/webapplicationfirewall",
-        :references => [
-          "https://github.com/EnableSecurity/wafw00f"
-        ],
-        :vendor => "Barracuda",
-        :product =>"Application Firewall",
-        :match_details =>"cookie",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /BNI_persistence=/i,
-        :paths => ["#{url}"],
-        :inference => false 
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["WAF"],
-        :url => "https://www.barracuda.com/products/webapplicationfirewall",
-        :references => [
-          "https://github.com/EnableSecurity/wafw00f"
-        ],
-        :vendor => "Barracuda",
-        :product =>"Application Firewall",
-        :match_details =>"cookie",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /BN[IE]S_.*?=/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["WAF"],
-        :url => "https://www.barracuda.com/products/webapplicationfirewall",
-        :vendor => "Barracuda",
-        :product =>"Email Security Gateway",
-        :match_details =>"server",
-        :version => nil,
-        :match_type => :content_headers,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: BarracudaHTTP ([\d\.]+)/i,)
-        },
-        :match_content =>  /server: BarracudaHTTP ([\d\.]+)/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/base.rb

@@ -1,139 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Base
-
-  #include Intrigue::Ident::Content::HttpHelpers
-
-  def self.inherited(base)
-    Intrigue::Ident::Http::CheckFactory.register(base)
-  end
-
-  def product_name
-
-  end
-
-  private
-
-    def _uri_match(content, regex)
-      return nil unless content["details"]["start_url"] && content["details"]["start_url"].match(regex)
-    content["details"]["start_url"].match(regex)
-    end
-
-    # matching helpers
-    def _all_body_captures(content, regex)
-      return nil unless content["details"]["hidden_response_data"] &&
-        content["details"]["hidden_response_data"].match(regex)
-
-      match = content["details"]["hidden_response_data"].match(regex)
-      return match.captures.map{|x|x.to_s.strip} if match
-    
-    nil
-    end
-
-    def _first_body_match(content, regex)
-      return nil unless content["details"]["hidden_response_data"] &&
-        content["details"]["hidden_response_data"].match(regex)
-
-    content["details"]["hidden_response_data"].match(regex)
-    end
-
-    def _first_body_capture(content, regex, filter=[])
-      return nil unless content["details"]["hidden_response_data"]
-      x = content["details"]["hidden_response_data"].match(regex)
-      if x && x.captures
-        x = x.captures.first.strip
-        filter.each{|f| x.gsub!(f,"") }
-        x = x.strip
-        return x if x && x.length > 0
-      end
-    nil
-    end
-
-    def _first_header_match(content, regex)
-      return nil unless content["details"]["headers"]
-      if content["details"]["headers"].kind_of? Array
-        headers = content["details"]["headers"].join("\n")
-      else
-        headers = content["details"]["headers"].kind_of? Array
-      end
-    headers.match(regex)
-    end
-
-    def _first_header_capture(content, regex, filter=[])
-      return nil unless content["details"]["headers"]
-      if content["details"]["headers"].kind_of? Array
-        headers = content["details"]["headers"].join("\n")
-      else
-        headers = content["details"]["headers"].kind_of? Array
-      end
-      x = headers.match(regex)
-      if x && x.captures
-        x = x.captures.first
-        filter.each{|f| x.gsub!(f,"") }
-        x = x.strip if x
-        return x if x && x.length > 0
-      end
-    nil
-    end
-
-    def _first_cookie_match(content, regex)
-      return nil unless content["details"]["cookies"] &&
-        content["details"]["cookies"].match(regex)
-    content["details"]["cookies"].match(regex)
-    end
-
-    def _first_cookie_capture(content, regex, filter=[])
-      return nil unless content["details"]["headers"]
-      x = content["details"]["cookies"].match(regex)
-      if x && x.captures
-        x = x.captures.first.strip
-        filter.each{|f| x.gsub!(f,"") }
-        x = x.strip if x
-        return x if x && x.length > 0
-      end
-    nil
-  end
-
-  def _first_title_match(content, regex)
-    return nil unless content["details"]["title"] &&
-      content["details"]["title"].match(regex)
-
-  content["details"]["title"].match(regex)
-  end
-
-  def _first_title_capture(content, regex, filter=[])
-    return nil unless content["details"]["title"]
-    x = content["details"]["title"].match(regex)
-    if x && x.captures
-      x = x.captures.first.strip
-      filter.each{|f| x.gsub!(f,"") }
-      x = x.strip if x
-      return x if x && x.length > 0
-    end
-  nil
-  end
-
-  def _first_generator_match(content, regex)
-    return nil unless content["details"]["generator"] &&
-    content["details"]["generator"].match(regex)
-
-  content["details"]["title"].match(regex)
-  end
-
-  def _first_generator_capture(content, regex, filter=[])
-    return nil unless content["details"]["generator"]
-    x = content["details"]["generator"].match(regex)
-    if x && x.captures
-      x = x.captures.first.strip
-      filter.each{|f| x.gsub!(f,"") }
-      x = x.strip if x
-      return x if x && x.length > 0
-    end
-  nil
-  end
-
-end
-end
-end
-end

data/checks/http/beehive.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Beehive < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Forum system"],
-        :vendor => "Beehive",
-        :product => "Beehive Forum",
-        :references => ["https://www.beehiveforum.co.uk/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Beehive Forum (.*\d)/i,
-        :dynamic_version => lambda { |x|  _first_body_capture(x, /Beehive Forum (.*\d)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end