intrigue-ident 0.9.9 → 0.31

data/checks/http/enservio.rb

@@ -1,29 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Enservio < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CMS"],
-        :website => "https://www.enservio.com/about-us/about-enservio",
-        :vendor => "Enservio",
-        :product => "Enservio",
-        :references => [],
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content => /_enservio_session=/i,
-        :match_details => "cookie match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/envoy.rb

@@ -1,26 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Envoy < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking", "Proxy"],
-        :vendor => "Envoy",
-        :product => "Envoy",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server: envoy$/,
-        :match_details =>"server header",
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/epiccom.rb

@@ -1,31 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class EpicCom < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "EpicCom",
-          :product => "EpicCom",
-          :website => "https://www.epik.com/",
-          :references => [],
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /Why\ purchase\ this\ domain\ with\ Epik/i,
-          :match_details => "Why\ purchase\ this\ domain\ with\ Epik",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/ergon.rb

@@ -1,31 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Ergon < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["WAF"],
-        :website => "https://www.airlock.com/en/products/airlock-waf/",
-        :vendor => "Ergon",
-        :product => "Airlock",
-        :references => [
-          "https://github.com/EnableSecurity/wafw00f"
-        ],
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content => /AL[_-]?(SESS|LB)=/i,
-        :match_details => "cookie match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/expressjs.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class ExpressJS < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Application Server"],
-          :vendor => "ExpressJS",
-          :product =>"Express",
-          :version => nil,
-          :match_details =>"x-powered-by header",
-          :match_type => :content_headers,
-          :match_content =>  /x-powered-by: Express/i,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-  end
-end
-end
-end

data/checks/http/ezproxy.rb

@@ -1,28 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class EZproxy < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-    [
-        {
-            :type => "fingerprint",
-            :category => "application",
-            :tags => ["Proxy Server"],
-            :vendor => "OCLC",
-            :product => "EZproxy",
-            :website => "https://www.oclc.org/en/ezproxy.html",
-            :match_details => "EZproxy server header",
-            :version => nil,
-            :match_type => :content_headers,
-            :match_content =>  /^server: EZproxy$/i,
-            :paths => ["#{url}"],
-            :inference => false
-        }
-    ]
-    end
-
-end
-end
-end
-end

data/checks/http/f5.rb

@@ -1,122 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class F5 < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking", "Load Balancer"],
-          :vendor => "F5",
-          :product =>"BIG-IP Access Policy Manager",
-          :match_details =>"F5 BIG-IP Access Policy Manager default cookie",
-          :version => nil,
-          :match_type => :content_cookies,
-          :match_content => /MRHSession/,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking", "Load Balancer"],
-          :vendor => "F5",
-          :product =>"BIG-IP Access Policy Manager",
-          :match_details =>"F5 BIG-IP APM default logo",
-          :version => nil,
-          :references => ["https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-customization-11-6-0/3.html"],
-          :match_type => :content_body,
-          :match_content => /<img src="\/public\/images\/my\/tr.gif\//,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking", "WAF"],
-          :vendor => "F5",
-          :product =>"BIG-IP Application Security Manager",
-          :match_details =>"TS cookie",
-          :version => "10.0.0 through 11.3.0",
-          :references => ["https://support.f5.com/csp/article/K6850",
-            "https://devcentral.f5.com/s/articles/the-big-ip-application-security-manager-part-1-what-is-the-asm"
-          ],
-          :match_type => :content_cookies,
-          :match_content => /TS[0-9a-f]{6}_[0-9a-f]=/,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking", "WAF"],
-          :vendor => "F5",
-          :product =>"BIG-IP Application Security Manager",
-          :match_details =>"TS cookie",
-          :version => "11.4.0 through 13.x",
-          :references => ["https://support.f5.com/csp/article/K6850",
-            "https://devcentral.f5.com/s/articles/the-big-ip-application-security-manager-part-1-what-is-the-asm"
-          ],
-          :match_type => :content_cookies,
-          :match_content => /TS[0-9a-f]{7}_[0-9a-f]=/,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Networking", "WAF"],
-          :vendor => "F5",
-          :product =>"BIG-IP Application Security Manager",
-          :match_details =>"TS cookie",
-          :version => "14.0.0 and later",
-          :references => ["https://support.f5.com/csp/article/K6850",
-            "https://devcentral.f5.com/s/articles/the-big-ip-application-security-manager-part-1-what-is-the-asm"
-          ],
-          :match_type => :content_cookies,
-          :match_content => /TS[0-9a-f]{7}[0-9a-f]=/,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "hardware",
-          :tags => ["Networking", "Load Balancer"],
-          :vendor => "F5",
-          :product =>"BIG-IP Local Traffic Manager",
-          :match_details =>"F5 BIG-IP Load balancer cookie",
-          :version => nil,
-          :match_type => :content_cookies,
-          :match_content =>  /BIGipServer/,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }, 
-        {
-          :type => "fingerprint",
-          :category => "hardware",
-          :tags => ["Networking", "Load Balancer"],
-          :vendor => "F5",
-          :product =>"BIG-IP Local Traffic Manager",
-          :match_details =>"F5 BIG-IP Load balancer header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^server: BigIP$/i,
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-  end
-end
-end
-end

data/checks/http/facebook.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Facebook < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Marketing", "Javascript"],
-          :vendor => "Facebook",
-          :product =>"JS SDK",
-          :version => nil,
-          :match_details =>"load string",
-          :match_type => :content_body,
-          :match_content =>  /(document, 'script', 'facebook-jssdk')/,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-  end
-end
-end
-end

data/checks/http/fastly.rb

@@ -1,67 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Fastly < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Hosting", "CDN", "WAF"],
-          :vendor =>"Fastly",
-          :product =>"Fastly",
-          :match_details =>"header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^x-fastly-backend-reqs:.*$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Hosting", "CDN", "WAF"],
-          :vendor =>"Fastly",
-          :product =>"Fastly",
-          :match_details =>"header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^x-fastly-service:.*$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Hosting", "CDN", "WAF"],
-          :vendor =>"Fastly",
-          :product =>"Fastly",
-          :match_details =>"header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^x-fastly-request-id:.*$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Hosting", "CDN", "WAF"],
-          :vendor =>"Fastly",
-          :product =>"Fastly",
-          :match_details =>"error content in page",
-          :version => nil,
-          :hide => true,
-          :match_type => :content_title,
-          :match_content =>  /Fastly error: unknown domain/i,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-  end
-end
-end
-end

data/checks/http/first_domains.rb

@@ -1,31 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class FirstDomains < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "1st Domains",
-          :product => "1st Domains",
-          :website => "https://1stdomains.nz/",
-          :references => [],
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /This domain is currently parked with 1st Domains and does not yet have a website/i,
-          :match_details => "domain is parked",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/flywheel.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Flywheel < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["CMS","SaaS"],
-          :vendor => "Flywheel",
-          :product =>"Hosted Wordpress",
-          :references => [
-            "https://getflywheel.com/wordpress-support/a-description-of-the-flywheel-technology-stack/"
-          ],
-          :match_details =>"server header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^server: Flywheel\/[\d\.]+$/i,
-          :dynamic_version => lambda {|d| _first_header_capture(d,/^server: Flywheel\/([\d\.]+)$/i)},
-          :paths => ["#{url}"]
-        }
-      ]
-    end
-
-  end
-end
-end
-end