intrigue-ident 0.9.9 → 0.31

data/checks/http/cloud_city.rb

@@ -1,30 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class CloudCity < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Cloud City",
-          :product => "Cloud City",
-          :references => [],
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /This domain name is registered and parked<br>with Cloud City/i,
-          :match_details => "unique body string",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/cloudflare.rb

@@ -1,219 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Cloudflare < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :match_type => :content_title,
-        :match_content => /1.1.1.1 â\u0080\u0094 The free app that makes your Internet faster./i,
-        :match_details =>"cloudflare known error",
-        :dynamic_hide => lambda{ |x| 
-          return true if _uri_match(x,/1\.1\.1\.1:/) || _uri_match(x,/1\.0\.0\.1:/)
-        },        
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /<title>403 Forbidden<\/title>.*<center>cloudflare<\/center>/mi,
-        :match_details =>"cloudflare known error",
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content => /cf_ob_info=/i,
-        :match_details =>"offline browsing cookie",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },       
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => / network. A valid Host header must be supplied to reach the desired website./mi,
-        :match_details =>"cloudflare missing page error",
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content => /\| 525: SSL handshake failed/mi,
-        :match_details =>"cloudflare missing handshake error",
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare Error",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content => /DNS resolution error \| [\d\w\.]+ \| Cloudflare/i,
-        :match_details =>"cloudflare known error",
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content => /Direct IP access not allowed \| Cloudflare/,
-        :match_details =>"cloudflare access-by-ip message",
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :match_details =>"Cloudflare error",
-        :version => "",
-        :match_type => :content_body,
-        :match_content =>  /cferror_details/,
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :match_details =>"Error - Direct IP Access",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /403\ Forbidden<\/h1><\/center>\n<hr><center>cloudflare<\/center>/im,
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /__cfduid/i,
-        :match_details =>"cloudflare cookie",
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^cfray:/i,
-        :match_details =>"header",
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^cf-ray:/i,
-        :match_details =>"header",
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /cloudflare-nginx/i,
-        :match_details =>"cloudflare nginx header",
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server: cloudflare$/i,
-        :match_details =>"server header",
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN","WAF"],
-        :vendor => "Cloudflare",
-        :product => "Cloudflare",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^expect-ct:.*cloudflare.com.*$/i,
-        :match_details =>"ct header pointed to cloudflare",
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/cmsimple.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class CMSimple < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "CMSimple",
-        :product => "CMSimple",
-        :references => ["https://www.cmsimple.fr/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /CMSimple [\d\.]+/i,
-        :dynamic_version => lambda { |x|  _first_body_capture(x, /CMSimple ([\d\.]+)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/codeigniter.rb

@@ -1,26 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class CodeIgniter < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server","Embedded"],
-        :vendor => "CodeIgniter",
-        :product => "CodeIgniter",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content =>  /Welcome to CodeIgniter/,
-        :match_details =>"page title",
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/communigate.rb

@@ -1,32 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Communigate < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :vendor => "Stalker", # recently renamed to communigate systems inc
-        :category => "application",
-        :tags => ["COTS","Marketing"],
-        :product =>"CommuniGate",
-        :website => "http://www.stalker.com/CommuniGatepro/",
-        :match_details =>"server header",
-        :version => nil,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: CommuniGatePro\/(.*)/i,)
-        },
-        :match_type => :content_headers,
-        :match_content => /server: CommuniGatePro/,
-        :hide => false,
-        :paths => ["#{url}"], 
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/concrete5.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Concrete5CMS < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Concrete5",
-        :product => "Concrete5",
-        :references => ["https://www.concrete5.org/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /concrete5 - (.*\d)/,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /concrete5 - (.*\d)/)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/contenido.rb

@@ -1,33 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Contenido < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-=begin 
-      # Currently match_content too loose
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Contenido",
-        :product => "Contenido CMS",
-        :references => ["https://www.contenido.org/"],
-        :version => nil,
-        :match_type => :content_generator,
-        :match_content => /CMS Contenido/i,
-        :dynamic_version => lambda { |x| _first_generator_capture(x, /CMS Contenido ([\d\.]+)/i)},
-        :match_details => "generator tag",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-=end
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/content/analytics.rb

@@ -1,40 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class Analytics < Intrigue::Ident::Check::Base
-    
-    def generate_checks(url)
-      [
-        {
-          :type => "content",
-          :name =>"Google Analytics",
-          :match_type => :content_body,
-          :dynamic_result => lambda { |d|
-            _first_body_capture(d, /gtag\(\'config\', \'(UA-\d+-\d+)/)
-          },
-          :paths => ["#{url}"]
-        },
-        {
-          :type => "content",
-          :name =>"Google Site Verification",
-          :match_type => :content_body,
-          :dynamic_result => lambda { |d|
-            _first_body_capture(d, /<meta name=\"google-site-verification\" content=\"([\d\w\-]+)\" \/>/)
-          },
-          :paths => ["#{url}"]
-        },
-        {
-          :type => "content",
-          :name =>"MyWebStats",
-          :match_type => :content_body,
-          :dynamic_result => lambda { |d|
-            _first_body_capture(d,/mywebstats_site_ids\.push\(([\d]+)\);/)
-          },
-          :paths => ["#{url}"]
-        }
-      ]
-    end
-  end
-end
-end
-end