intrigue-ident 0.9.9 → 0.31

data/lib/check_factory.rb

@@ -0,0 +1,22 @@
+module Intrigue
+module Ident
+class CheckFactory
+
+  #
+  # Register a new handler
+  #
+  def self.register(klass)
+    @checks = [] unless @checks
+    @checks << klass if klass
+  end
+
+  #
+  # Provide the full list of checks
+  #
+  def self.all
+    @checks
+  end
+
+end
+end
+end

data/lib/checks/akamai.rb

@@ -0,0 +1,22 @@
+module Intrigue
+module Ident
+module Check
+class Akamai < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :name => "Akamai",
+        :description => "Akamai Missing Uri",
+        :version => nil,
+        :type => :content_body,
+        :content => /The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>/,
+        :hide => true,
+        :paths => ["#{url}"]
+      }
+    ]
+  end
+end
+end
+end
+end

data/lib/checks/amazon.rb

@@ -0,0 +1,26 @@
+module Intrigue
+module Ident
+module Check
+class Amazon < Intrigue::Ident::Check::Base
+
+  def generate_checks(uri)
+    [
+      {
+        :name => "Amazon ELB",
+        :description => "Amazon Elastic Load Balancer",
+        :url => "https://aws.amazon.com/elasticloadbalancing/",
+        :version => nil,
+        :tags => ["error_page"],
+        :type => :content_headers,
+        :content => /awselb\/\d.\d/,
+        :hide => true,
+        :dynamic_version => lambda { |x| x[:headers].match(/awselb\/(\d.\d)/).captures[0] },
+        :verify_sites => ["http://52.4.103.22:80"],
+        :paths => ["#{uri}"]
+      }
+    ]
+  end
+end
+end
+end
+end

data/lib/checks/aruba.rb

@@ -0,0 +1,20 @@
+module Intrigue
+module Ident
+module Check
+class Aruba < Intrigue::Ident::Check::Base
+
+  def generate_checks(url)
+    [
+      {
+        :description => "Aruba Wireless Controller",
+        :version => nil,
+        :type => :content_body,
+        :content => /arubalp=/,
+        :paths => ["#{url}"]
+      }
+    ]
+  end
+end
+end
+end
+end

data/lib/checks/asp_net.rb

@@ -0,0 +1,70 @@
+module Intrigue
+module Ident
+module Check
+class AspNet < Intrigue::Ident::Check::Base
+
+  def generate_checks(uri)
+    [
+      {
+        :accept => "Intrigue::Entity::Uri",
+        :name => "ASP.NET",
+        :description => "ASP.Net Error Message",
+        :version => nil,
+        :tags => ["error_page"],
+        :type => :content_body,
+        :content => /^.*ASP.NET is configured.*$/i,
+        :dynamic_version => lambda{|x| x.body.scan(/ASP.NET Version:(.*)$/)[0].first.chomp },
+        :paths => ["#{uri}"]
+      },
+      {
+        :accept => "Intrigue::Entity::Uri",
+        :name => "ASP.NET",
+        :description => "X-AspNet Header",
+        :version => nil,
+        :type => :content_headers,
+        :content => /^x-aspnet-version:.*$/i,
+        :dynamic_version => lambda{|x| x.body.scan(/ASP.NET Version:(.*)$/i)[0].first.chomp if x.body.scan(/ASP.NET Version:(.*)$/i)[0] },
+        :paths => ["#{uri}"]
+      },
+      {
+        :name => "ASP.NET",
+        :description => "Asp.Net Default Cookie",
+        :version => nil,
+        :type => :content_cookies,
+        :content => /ASPSESSIONID.*$/i,
+        :paths => ["#{uri}"]
+        #:dynamic_version => lambda{|x| x.each_header{|k,v| return v if k =~ /x-aspnet-version/ } }
+      },
+      {
+        :name => "ASP.NET",
+        :description => "Asp.Net Default Cookie",
+        :version => nil,
+        :type => :content_cookies,
+        :content => /ASP.NET_SessionId.*$/i,
+        :paths => ["#{uri}"]
+        #:dynamic_version => lambda{|x| x.each_header{|k,v| return v if k =~ /x-aspnet-version/ } }
+      },
+      {
+        :name => "ASP.NET MVC",
+        :description => "Asp.Net MVC Header",
+        :version => nil,
+        :type => :content_headers,
+        :content => /x-aspnetmvc-version/i,
+        :paths => ["#{uri}"]
+        #:dynamic_version => lambda{|x| x.each_header{|k,v| return v if k =~ /x-aspnetmvc-version/ } }
+      },
+      {
+        :name => "ASP.NET",
+        :description => "WebResource.axd link in the page",
+        :version => nil,
+        :type => :content_body,
+        :content => /WebResource.axd?d=/i,
+        :paths => ["#{uri}"]
+        #:dynamic_version => lambda{|x| x.each_header{|k,v| return v if k =~ /WebResource.axd?d=/ } }
+      }
+    ]
+  end
+end
+end
+end
+end

data/lib/checks/atlassian.rb

@@ -0,0 +1,55 @@
+module Intrigue
+module Ident
+module Check
+class Atlassian < Intrigue::Ident::Check::Base
+
+  def generate_checks(uri)
+    [
+      {
+        :name => "Atlassian BitBucket",
+        :description => "Atlassian BitBucket",
+        :version => nil,
+        :type => :content_body,
+        :content => /com.atlassian.bitbucket.server/i,
+        :paths => ["#{uri}"]
+      },
+      {
+        :name => "Atlassian Confluence",
+        :description => "Atlassian Confluence",
+        :version => nil,
+        :type => :content_headers,
+        :content => /X-Confluence-Request-Time/i,
+        :paths => ["#{uri}"]
+      },
+      {
+        :name => "Atlassian Crucible",
+        :description => "Atlassian Crucible",
+        :version => nil,
+        :type => :content_body,
+        :content => /FishEye and Crucible/,
+        :dynamic_version => lambda{|x|
+          if x.body.scan(/Log in to FishEye and Crucible (.*)\</)[0]
+            x.body.scan(/Log in to FishEye and Crucible (.*)\</)[0].first
+          end
+        },
+        :paths => ["#{uri}"]
+      },
+      {
+        :name => "Atlassian Jira",
+        :description => "Atlassian Jira",
+        :version => nil,
+        :type => :content_cookies,
+        :content => /atlassian.xsrf.token/i,
+        :dynamic_version => lambda{ |x|
+          if x.body.scan(/<span id="footer-build-information">(.*)-<span/)[0]
+            x.body.scan(/<span id="footer-build-information">(.*)-<span/)[0].first.gsub("(","")
+          end
+        },
+        :paths => ["#{uri}"]
+      }
+    ]
+  end
+end
+end
+end
+end

data/lib/checks/base.rb

@@ -0,0 +1,13 @@
+module Intrigue
+module Ident
+module Check
+class Base
+
+  def self.inherited(base)
+    CheckFactory.register(base)
+  end
+
+end
+end
+end
+end

data/lib/checks/chef.rb

@@ -0,0 +1,31 @@
+module Intrigue
+module Ident
+module Check
+    class Chef < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Chef Server",
+            :description => "Chef Server",
+            :version => nil,
+            :type => :content_body,
+            :content => /<title>Chef Server<\/title>/,
+            :dynamic_version => lambda{|x| x.body.scan(/Version\ (.*)\ &mdash;/)[0].first },
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Chef Server",
+            :description => "Chef Server",
+            :version => nil,
+            :type => :content_cookies,
+            :content => /chef-manage/i,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/cisco.rb

@@ -0,0 +1,33 @@
+module Intrigue
+module Ident
+module Check
+    class Cisco < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Cisco SSL VPN",
+            :description => "Cisco SSL VPN",
+            :tags => ["tech:vpn"],
+            :version => nil,
+            :type => :content_cookies,
+            :content => /webvpn/,
+            :hide => false,
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Cisco Router",
+            :description => "Cisco Router",
+            :version => nil,
+            :type => :content_headers,
+            :content => /server: cisco-IOS/,
+            :hide => false,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/citrix.rb

@@ -0,0 +1,24 @@
+module Intrigue
+module Ident
+module Check
+    class Citrix < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Citrix Netscaler Gateway",
+            :description => "Citrix Netscaler Gateway",
+            :tags => ["tech:vpn"],
+            :version => nil,
+            :type => :content_body,
+            :content => /<title>Netscaler Gateway/,
+            :hide => false,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/cloudflare.rb

@@ -0,0 +1,59 @@
+module Intrigue
+module Ident
+module Check
+    class Cloudflare < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Cloudflare",
+            :description => "Cloudflare Accelerated Page",
+            :version => "",
+            :type => :content_cookies,
+            :content => /__cfduid/i,
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Cloudflare",
+            :description => "Cloudflare Server",
+            :version => "",
+            :type => :content_headers,
+            :content => /cloudflare-nginx/i,
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Cloudflare",
+            :description => "Cloudflare - Direct IP Access",
+            :tags => ["error_page"],
+            :version => "",
+            :type => :content_body,
+            :content => /<title>Direct IP access not allowed \| Cloudflare/,
+            :hide => true,
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Cloudflare",
+            :description => "Cloudflare Error",
+            :tags => ["error_page"],
+            :version => "",
+            :type => :content_body,
+            :content => /cferror_details/,
+            :hide => true,
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Cloudflare",
+            :description => "Cloudfront Error - Direct IP Access",
+            :version => "",
+            :type => :content_body,
+            :content => /403\ Forbidden<\/h1><\/center>\n<hr><center>cloudflare<\/center>/,
+            :hide => true,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/cloudfront.rb

@@ -0,0 +1,41 @@
+module Intrigue
+module Ident
+module Check
+    class Cloudfront < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Cloudfront - Error (Body)",
+            :description => "Cloudfront - no configured hostname",
+            :version => "",
+            :type => :content_body,
+            :content => /ERROR: The request could not be satisfied/,
+            :hide => true,
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Cloudfront - Error (Headers)",
+            :description => "Cloudfront - no configured hostname",
+            :version => "",
+            :type => :content_headers,
+            :content => /Error from cloudfront/,
+            :hide => true,
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Cloudfront - 403 (Body)",
+            :description => "Cloudfront - 403",
+            :version => "",
+            :type => :content_body,
+            :content => /<h1>403 Forbidden<\/h1><\/center>\n<hr><center>cloudflare/,
+            :hide => true,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/cpanel.rb

@@ -0,0 +1,23 @@
+module Intrigue
+module Ident
+module Check
+    class Cpanel < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "cPanel Hosted - Missing Page",
+            :description => "cPanel Hosted, but either misconfigured, or accessed via ip vs hostname?",
+            :version => nil,
+            :type => :content_body,
+            :content => /URL=\/cgi-sys\/defaultwebpage.cgi/,
+            :hide => true,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end