intrigue-ident 0.9.9 → 0.31

data/checks/http/bynder.rb

@@ -1,31 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class Bynder < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["CMS"],
-          :vendor => "Bynder",
-          :product => "Bynder",
-          :website => "https://www.bynder.com/en/",
-          :references => [],
-          :version => nil,
-          :match_type => :content_cookies,
-          :match_content => /bynder=/i,
-          :match_details => "unique cookie",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/calibre.rb

@@ -1,33 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Calibre < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["EBook Server","COTS"],
-        :vendor =>"Calibre-Ebook",
-        :product =>"Calibre",
-        :match_details =>"server header",
-        :references => [
-          "https://github.com/kovidgoyal/calibre",
-          "https://en.wikipedia.org/wiki/Calibre_(software)"
-        ],
-        :match_type => :content_headers,
-        :match_content =>  /^server: calibre.*$/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/^server: calibre (.*)$/i)
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/centos.rb

@@ -1,28 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Centos < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      { ## Infer from apache title...
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server"],
-        :vendor => "Centos",
-        :product => "Centos",
-        :references => [],
-        :version => nil,
-        :match_type => :content_title,
-        :match_content => /^Apache HTTP Server Test Page powered by CentOS$/i,
-        :match_details => "apache server default page",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/cerberus.rb

@@ -1,28 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Cerberus < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS"],
-        :vendor => "Cerberus",
-        :product =>"Ftp Server",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:.*Cerberus.*$/,
-        :dynamic_version => lambda{|x| _first_header_capture(x,/^server:.*Cerberus\/([\d\.]*)\s.*$/i) },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/charity_engine.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class CharityEngine < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CRM"],
-        :vendor => "CharityEngine",
-        :product => "CharityEngine",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /title=\"Powered By CharityEngine\">/i,
-        :match_details =>"unique body string",
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/checkpoint.rb

@@ -1,56 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Checkpoint < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :vendor => "Checkpoint",
-        :tags => ["VPN"],
-        :product =>"GO",
-        :match_details =>"page title",
-        :references => ["https://en.wikipedia.org/wiki/Check_Point_GO"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /<title>Check Point Mobile GO/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :vendor => "Checkpoint",
-        :tags => ["VPN"],
-        :product =>"GO",
-        :match_details =>"server header",
-        :references => ["https://en.wikipedia.org/wiki/Check_Point_GO"],
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server: CPWS/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :vendor => "Checkpoint",
-        :tags => ["VPN"],
-        :product =>"SSL Network Extender",
-        :match_details =>"server header",
-        :references => [],
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server: Check Point SVN foundation/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/cherokee.rb

@@ -1,29 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Cherokee < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server"],
-        :vendor => "Cherokee",
-        :product => "Cherokee",
-        :references => ["https://cherokee-project.com/"],
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:\ Cherokee[\/]{0,1}(\d+\.\d+\.\d+\ \([a-zA-Z]{1,10}\)){0,1}$/i,
-        :dynamic_version => lambda { |x| 
-          _first_header_capture(x,/^server:\ Cherokee[\/]{0,1}(\d+\.\d+\.\d+\ \([a-zA-Z]{1,10}\)){0,1}$/i) },
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/cisco.rb

@@ -1,134 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Cisco < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking","COTS","VPN","Firewall"],
-          :vendor => "Cisco",
-          :product => "Adaptive Security Appliance Device Manager",
-          :match_details => "page title",
-          :version => nil,
-          :dynamic_version => lambda {|x| _first_body_capture(x,/<title>Cisco ASDM (.*?)<\/title>/)},
-          :match_type => :content_body,
-          :match_content =>  /<title>Cisco ASDM/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => true
-        },
-        {
-          :type => "fingerprint",
-          :category => "hardware",
-          :tags => ["Networking","COTS"],
-          :vendor => "Cisco",
-          :product => "Email Security Appliance",
-          :match_details => "page title",
-          :version => nil,
-          :dynamic_version => lambda {|x| 
-            _first_body_capture(x,/Email Security Appliance   (.*?) \(/i)
-          },
-          :match_type => :content_body,
-          :match_content =>  /<title>[\s\t]+Cisco[\s\t]+Email Security Appliance/,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "hardware",
-          :tags => ["Networking","COTS"],
-          :vendor => "Cisco",
-          :product => "Expressway",
-          :references => [
-              "https://www.cisco.com/c/en/us/products/unified-communications/expressway-series/index.html",
-              "https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/admin_guide/Cisco-Expressway-Administrator-Guide-X8-10.pdf"
-          ],
-          :match_details => "server header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^server: CE_E$/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => true
-        },
-        {
-          :type => "fingerprint",
-          :category => "hardware",
-          :tags => ["Networking","COTS","Firewall","Wireless"],
-          :vendor => "Cisco",
-          :product => "Meraki",
-          :match_details => "Meraki logo on an on-prem box",
-          :version => nil,
-          :match_type => :content_body,
-          :match_content =>  /<img id="header_logo" src="images\/meraki-logo.png"/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking","COTS", "VPN"],
-          :vendor => "Cisco",
-          :product =>"Adaptive Security Appliance Software",
-          :match_details =>"Cisco SSL VPN",
-          :version => nil,
-          :match_type => :content_cookies,
-          :match_content =>  /webvpn/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking","COTS", "VPN"],
-          :vendor => "Cisco",
-          :product =>"Adaptive Security Appliance Software",
-          :match_details =>"Cisco SSL VPN",
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /document.location.replace\(\"\/\+CSCOE\+\/logon.html\"\)/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking","COTS", "VPN"],
-          :vendor => "Cisco",
-          :product => "IOS",
-          :match_details => "Cisco Router",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /server: cisco-IOS/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking","COTS", "Hypervisor"],
-          :vendor => "Cisco",
-          :product =>"vManage",
-          :match_details => "page title",
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /<title>Cisco vManage/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-      ]
-    end
-
-  end
-end
-end
-end

data/checks/http/citrix.rb

@@ -1,137 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Citrix < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking","COTS", "VPN"],
-        :vendor => "Citrix",
-        :product => "NetScaler Gateway",
-        :match_details => "title",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content => /NetScaler Gateway/i,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking","COTS", "VPN"],
-        :vendor => "Citrix",
-        :product => "NetScaler Gateway",
-        :match_details => "(often) customized logon page - netscaler gateway",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /CTXMSAM_LogonFont/i,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking","COTS", "VPN"],
-        :vendor => "Citrix",
-        :product => "NetScaler Gateway",
-        :match_details => "misspelled content-length header",
-        :references => ["https://support.citrix.com/article/CTX211605"],
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^cteonnt-length:.*$/i,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking","COTS", "VPN"],
-        :vendor => "Citrix",
-        :product => "NetScaler Gateway",
-        :match_details => "cookie",
-        :references => ["https://support.citrix.com/article/CTX131488"],
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content => /citrix_ns_id=/i,
-        :hide => false,
-        :paths => ["#{url}"],
-        :verify => ["dW5kZXJhcm1vdXIjSW50cmlndWU6OkVudGl0eTo6VXJpI2h0dHA6Ly8yMDQuMjkuMTk2LjEwMjo4MA=="],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking", "COTS", "VPN"],
-        :vendor => "Citrix",
-        :product => "NetScaler Gateway",
-        :match_details => "redirect",
-        :references => ["https://support.citrix.com/article/CTX131488"],
-        :match_type => :content_headers,
-        :match_content => /^location: \/vpn\/index\.html$/i ,
-        :hide => false,
-        :paths => ["#{url}/doesntexist-123"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking", "COTS", "VPN"],
-        :vendor => "Citrix",
-        :product => "NetScaler Gateway",
-        :match_details => "cookie",
-        :references => [],
-        :match_type => :content_cookies,
-        :match_content => /NSC_TASS=\/doesntexist-123\/vpn\/index\.html/i ,
-        :hide => false,
-        :paths => ["#{url}/doesntexist-123"],
-        :inference => false
-      },  
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Networking","COTS", "Hypervisor"],
-        :vendor => "Citrix",
-        :product => "XenServer",
-        :match_details => "page title",
-        :references => [],
-        :version => nil,
-        :dynamic_version => lambda { |x| 
-          _first_body_capture(x,/<title>XenServer (.*?)<\/title>/) 
-        },
-        :match_type => :content_body,
-        :match_content => /<title>XenServer/,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :vendor => "Citrix",
-        :tags => ["Networking","COTS", "Hypervisor"],
-        :product => "XenServer",
-        :match_details => "page title",
-        :references => [],
-        :version => nil,
-        :dynamic_version => lambda { |x|
-          _first_body_capture(x,/<title>Welcome to Citrix XenServer (.*?)<\/title>/)
-        },
-        :match_type => :content_body,
-        :match_content => /<title>Welcome to Citrix XenServer/,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end