intrigue-ident 0.9.9 → 0.31

data/checks/http/content/authentication.rb

@@ -1,111 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Authentication < Intrigue::Ident::Check::Base
-  
-  def generate_checks(url)
-    [
-      {
-        :type => "content",
-        :name => "Authentication - HTTP",
-        :match_type => :content_headers,
-        :dynamic_result => lambda { |d|
-          return false unless d["details"]["headers"]
-          return true if _first_header_match(d, /^www-authenticate:.*$/)
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      {
-        :type => "content",
-        :name => "Authentication - NTLM",
-        :match_type => :content_headers,
-        :dynamic_result => lambda { |d|
-          return false unless d["details"]["headers"]
-          return true if _first_header_match(d, /^www-authenticate: NTLM$/i)
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      {
-        :type => "content",
-        :name =>"Authentication - Forms",
-        :references => [
-          "https://webstersprodigy.net/2010/04/07/nmap-script-to-try-and-detect-login-pages/",
-          "https://nmap.org/nsedoc/scripts/http-auth-finder.html"
-        ],
-        :match_type => :content_body,
-        :dynamic_result => lambda { |d|
-          return true if _body(d) =~ /<input type=\"password\"/im;
-          return true if _body(d) =~ /<script>[^>]*login/im;
-          return true if _body(d) =~ /<[^>]*login/im;
-          return true if _body(d) =~ /<script>[^>]*password/im;
-          return true if _body(d) =~ /<script>[^>]*user/im;
-          return true if _body(d) =~ /<input[^>)]*user/im;
-          return true if _body(d) =~ /<input[^>)]*pass/im;
-          return true if _body(d) =~ /<input[^>)]*pwd/im;
-          return true if _body(d) =~ /log_in/im;
-          return true if _body(d) =~ /log_out/im;
-          return true if _body(d) =~ /class=\"login-btn/im;
-          return true if _body(d) =~ /<[^>]*login/im;
-          return true if _body(d) =~ />Login<\/a>/im;
-          return true if _body(d) =~ />Logout<\/a>/im;
-          return true if _body(d) =~ />Log In<\/a>/im;
-          return true if _body(d) =~ />Log Out<\/a>/im;
-          return true if _body(d) =~ />Sign In<\/a>/im;
-          return true if _body(d) =~ /sign\ in/im;
-          return true if _body(d) =~ /sign_in/im;
-          return true if _body(d) =~ /create an account/im;
-          return true if _body(d) =~ /create_account/im;
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      {
-        :type => "content",
-        :name => "Authentication - Session Identifier",
-        :references => [
-          "https://github.com/fuzzdb-project/fuzzdb/blob/ecb0850538bc9152949fa4579654d6b64e2fdb97/regex/sessionid.txt"
-        ],
-        :match_type => :content_cookies,
-        :dynamic_result => lambda { |d|
-          return false unless d["details"]["cookies"]
-          return true if _first_cookie_match d, /ASP.NET_SessionId/i
-          return true if _first_cookie_match d, /ASPSESSIONID/i
-          return true if _first_cookie_match d, /ASPXAUTH/i
-          return true if _first_cookie_match d, /barra_counter_session/i
-          return true if _first_cookie_match d, /cfid/i
-          return true if _first_cookie_match d, /cftoken/i
-          return true if _first_cookie_match d, /_enservio_session/i
-          return true if _first_cookie_match d, /grafana_sess/i
-          return true if _first_cookie_match d, /_gitlab_session/i
-          return true if _first_cookie_match d, /jive.login.ts/i
-          return true if _first_cookie_match d, /JSESSIONID/i
-          return true if _first_cookie_match d, /LiSESSIONID/i
-          return true if _first_cookie_match d, /MRHSession/i
-          return true if _first_cookie_match d, /sails.sid/i
-          return true if _first_cookie_match d, /sessid/i
-          return true if _first_cookie_match d, /session/i
-          return true if _first_cookie_match d, /sid/i
-          return true if _first_cookie_match d, /SITESERVER/i
-          return true if _first_cookie_match d, /TWIKISID/i
-          return true if _first_cookie_match d, /viewstate/i
-          return true if _first_cookie_match d, /zenid/i
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-    ]
-  end
-end
-end
-end
-end

data/checks/http/content/content.rb

@@ -1,92 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Content < Intrigue::Ident::Check::Base
-  
-  def generate_checks(url)
-    [
-      {
-        :type => "content",
-        :name =>"Location Header",
-        :match_type => :content_header,
-        :dynamic_result => lambda { |d| _first_header_capture(d,/^location:(.*)$/i) },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      {
-        :type => "content",
-        :name =>"Directory Listing Detected",
-        :match_type => :content_title,
-        :dynamic_result => lambda { |d| (  
-          _first_title_match(d,/Index of \//) ||
-          _first_body_match(d, /<h1>Index of \//) || 
-          _first_body_match(d, /\[To Parent Directory\]/) ) ? true : false },
-        :dynamic_hide => lambda { |d| false },
-        :issue => "directory_listing_detected",
-        :paths => ["#{url}"]
-      },
-      #{
-      #  :type => "content",
-      #  :name =>"Open Redirect Detected",
-      #  :match_type => :content_body,
-      #  :references => [
-      #    "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect"
-      #  ],
-      #  :dynamic_result => lambda { |d|
-      #    regex_list = [
-      #    /\?next=http/i,/\?url=http/i,/\?target=http/i,/\?rurl=http/i,
-      #    /\?dest=http/i,/\?destination=http/i,/\?redir=http/i,
-      #    /\?redirect_uri=http/i,/\?redirect_url=http/i,/\?redirect=http/i,
-      #    /\/redirect\/http/i,/\/cgi-bin\/redirect.cgi\?http/i,/\/out\/http/i,
-      #    /\/out\?http/i,/\?view=http/i,/\/login\?to=http/i,/\?image_url=http/i,
-      #    /\?go=http/i,/\?return=http/i,/\?returnTo=http/i,/\?return_to=http/i,
-      #    /\?checkout_url=http/i,/\?continue=http/i,/\?return_path=http/i
-      #    ]
-      #    out = false
-      #    regex_list.each { |regex|
-      #      _first_body_match(d,regex) ? out = true : nil 
-      #    }
-      #  out
-      #  },
-      #  :dynamic_hide => lambda { |d| false },
-      #  :dynamic_issue => lambda { |d| false   },
-      #  :paths => ["#{url}"]
-      #},
-      {
-        :type => "content",
-        :name =>"Form Detected",
-        :match_type => :content_body,
-        :dynamic_result => lambda { |d| _first_body_match(d,/\<form/) ? true : false },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      {
-        :type => "content",
-        :name =>"File Upload Form Detected",
-        :match_type => :content_body,
-        :dynamic_result => lambda { |d| _first_body_match(d,/enctype=\"multipart\/form-data/) ? true : false },
-        :paths => ["#{url}"],
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-      },
-      {
-        :type => "content",
-        :name =>"Email Addresses Detected",
-        :match_type => :content_title,
-        :dynamic_result => lambda { |d| 
-        email_address_regex = /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i
-          captures = _all_body_captures(d,email_address_regex) || []
-          captures.select{|e| !(e =~ /\.png$/) }.compact
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/content/security_headers.rb

@@ -1,70 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class SecurityHeaders < Intrigue::Ident::Check::Base
-  
-  def generate_checks(url)
-    [
-      {
-        :type => "content",
-        :name => "Access-Control-Allow-Origin Header",
-        :match_type => :content_headers,
-        :dynamic_result => lambda { |d|
-          return true if _first_header_match d, /^Access-Control-Allow-Origin:.*/i;
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      {
-        :type => "content",
-        :name => "P3P Header",
-        :match_type => :content_headers,
-        :dynamic_result => lambda { |d|
-          return true if _first_header_match d, /^p3p:.*/i;
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      #{
-      #  :type => "content",
-      #  :name => "X-PJAX Header",
-      #  :match_type => :content_headers,
-      #  :dynamic_result => lambda { |d| _first_header_capture d, /^x-pjax-url:(.*)/i },
-      #  :dynamic_hide => lambda { |d| false },
-      #  :dynamic_issue => lambda { |d| false },
-      #  :paths => ["#{url}"]
-      #},
-      {
-        :type => "content",
-        :name => "X-Frame-Options Header",
-        :match_type => :content_headers,
-        :dynamic_result => lambda { |d|
-          return true if _first_header_match d, /^x-frame-options:.*/i;
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      },
-      {
-        :type => "content",
-        :name => "X-XSS-Protection Header",
-        :match_type => :content_headers,
-        :dynamic_result => lambda { |d|
-          return true if _first_header_match d, /^x-xss-protection:.*/i;
-        false
-        },
-        :dynamic_hide => lambda { |d| false },
-        :dynamic_issue => lambda { |d| false },
-        :paths => ["#{url}"]
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/cpanel.rb

@@ -1,56 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Cpanel < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Hosting","Administrative"],
-        :vendor => "cPanel",
-        :product =>"cPanel",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /server: cPanel/i,
-        :paths => ["#{url}"], 
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Hosting","Administrative"],
-        :vendor => "cPanel",
-        :product =>"cPanel Hosted - Missing Page",
-        :match_details =>"cPanel Hosted, but either misconfigured, or accessed via ip vs hostname?",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /URL=\/cgi-sys\/defaultwebpage.cgi/,
-        :hide => true,
-        :paths => ["#{url}"], 
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Administrative"],
-        :vendor => "cPanel",
-        :product =>"cPanel - Not configured",
-        :match_details =>"cPanel - not yet configured",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /href=\"\/cpanel\"\>log in<\/a> to launch this site/,
-        :hide => true,
-        :paths => ["#{url}"],
-        :examples => ['href="/cpanel">log in</a> to launch this site'], 
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/cradlepoint.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Cerberus < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server"],
-        :vendor => "Cradlepoint",
-        :product =>"HTTP Service",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:.*Cerberus.*$/,
-        :dynamic_version => lambda{ |x| 
-          _first_header_capture(x,/^server:.*Cerberus\/([\d\.]*)\s.*$/i) 
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/craft.rb

@@ -1,42 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Craft < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Craft",
-        :product =>"CMS",
-        :match_details =>"csrf protection cookie",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /CRAFT_CSRF_TOKEN/,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Craft",
-        :product =>"CMS",
-        :match_details =>"x-powered-by header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^x-powered-by: Craft CMS/,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/crazydomains.rb

@@ -1,31 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class CrazyDomains < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "CrazyDomains",
-          :product => "CrazyDomains",
-          :website => "https://www.crazydomains.com.au/",
-          :references => [],
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /Domain name is registered and secured with CrazyDomains.com.au/i,
-          :match_details => "unique body string",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/crowdstrike.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Crowdstrike < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["Security", "SaaS"],
-        :vendor => "Crowdstrike",
-        :product => "Falcon",
-        :references => [""],
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content => /domain\=\.falcon-sandbox\.com/i,
-        :match_details => "Falcon Sandbox cookie",
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end