intrigue-ident 0.9.9 → 0.31

data/checks/http/forgerock.rb

@@ -1,43 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class ForgeRock < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Library", "IAM"],
-        :vendor =>"ForgeRock",
-        :product =>"OpenAM",
-        :match_details =>"title",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content =>  /OpenAM \(Login\)/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Library", "IAM"],
-        :vendor =>"ForgeRock",
-        :product =>"OpenAM",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server:.*OpenAM Web Agent\/[\d\.]+$/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server:.*OpenAM Web Agent\/([\d\.]+)$/i)
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/fortinet.rb

@@ -1,29 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Fortinet < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["VPN","Networking"],
-          :vendor => "Fortinet",
-          :product =>"FortiGate",
-          :references => [
-            "https://forum.fortinet.com/tm.aspx?m=130869"
-          ],
-          :match_details =>"server header",
-          :version => nil,
-          :match_type => :content_body,
-          :match_content =>  /FortiToken clock drift detected/i,
-          :paths => ["#{url}"]
-        }
-      ]
-    end
-
-  end
-end
-end
-end

data/checks/http/fresh_service.rb

@@ -1,30 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-    class FreshService < Intrigue::Ident::Check::Base
-  
-      def generate_checks(url)
-        [
-          {
-            :type => "fingerprint",
-            :category => "service",
-            :tags => ["Support","SaaS"],
-            :vendor => "FreshService",
-            :product =>"FreshService",
-            :references => [],
-            :match_details =>"missing helpdesk (title)",
-            :version => nil,
-            :match_type => :content_title,
-            :match_content =>  /^There is no helpdesk here\!$/i,
-            :paths => ["#{url}"],
-            :issue => { name: "subdomain_takeover", details: { service: "FreshService" } }, 
-            :hide => true
-          }
-        ]
-      end
-  
-    end
-  end
-  end
-  end
-  

data/checks/http/frontify.rb

@@ -1,29 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Frontify < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "CMS"],
-        :vendor => "Frontify",
-        :product => "Frontify",
-        :references => ["https://www.frontify.com/en/"],
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:\ frontify$/i,
-        :dynamic_version => lambda { |x| 
-          _first_header_capture(x,/^server:\ frontify$/i) },
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/generic.rb

@@ -1,272 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Generic < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :product => "Error Page",
-          :match_details =>"There's a generic error message in the title.",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_title,
-          :match_content =>  /^Error$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :product => "Error Page",
-          :match_details =>"There's a generic error message in the title.",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_title,
-          :match_content =>  /^Service Unavailable$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :product => "Error Page",
-          :match_details =>"There's a generic error message in the body.",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /internal error - server connection terminated/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        #{
-        #  :type => "fingerprint",
-        #  :category => "none",
-        #  :vendor => "Generic",
-        #  :product => "Empty Response",
-        #  :match_details =>"No response received!",
-        #  :version => nil,
-        #  :hide => true,
-        #  :match_type => :content_body,
-        #  :match_content =>  /^$/i,
-        #  :paths => ["#{url}"],
-        #  :inference => false
-        #},
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked title",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_title,
-          :match_content =>  /^Domain Parked$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked title",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_title,
-          :match_content =>  /is parked/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },        
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked string",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /registered and parked/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked string",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /page is parked/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked string",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /site is parked/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked string",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /domain is parked/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked string",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /This domain is currently parked./i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked string",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /THIS DOMAIN IS REGISTERED AND PARKED/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"generic parked string",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /is a parked domain/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Generic",
-          :product => "Parked Page",
-          :match_details =>"parked for free",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /is a parked domain/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :product => "Unauthorized",
-          :match_details =>"error in body",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /<STRONG>401 Unauthorized/,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :product => "Unauthorized",
-          :match_details =>"Title",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_title,
-          :match_content =>  /^Access Denied$/,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :product => "Under Construction",
-          :match_details =>"under construction page",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_body,
-          :match_content =>  /<HEAD><TITLE>Under construction/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :product => "Load Balancer",
-          :match_details =>"There's a semi-generic xserver header being sent from this asset.",
-          :version => nil,
-          :hide => false,
-          :match_type => :content_headers,
-          :match_content =>  /^xserver:/,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "none",
-          :vendor => "Generic",
-          :tags => ["Load Balancer"],
-          :product => "Page Missing (404)",
-          :match_details =>"Could be an API, or just serving something at another location. TODO ... is this ECS-specific? (check header)",
-          :version => nil,
-          :hide => true,
-          :match_type => :content_body,
-          :match_content =>  /<title>404 - Not Found<\/title>/,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-  end
-end
-end
-end

data/checks/http/github.rb

@@ -1,40 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Github < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Development", "SaaS"],
-          :vendor => "Github",
-          :product => "Github",
-          :match_details => "github specific header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^x-github-request-id:.*$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["Development", "SaaS"],
-          :vendor => "Github",
-          :product => "Github",
-          :match_details => "github server header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^server: GitHub.com$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-  end
-end
-end
-end