intrigue-ident 0.9.9 → 0.31

data/checks/http/pfsense.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Pfsense < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Firewall"],
-        :vendor => "pfSense",
-        :product =>"pfSense",
-        :match_details => "unique body content",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /Login to pfSense/,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/php.rb

@@ -1,72 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Php < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-        {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"PHP",
-        :product =>"PHP",
-        :match_details =>"x-powered-by header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /x-powered-by: PHP/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/x-powered-by: PHP\/(.*)/i)
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"PHP",
-        :product =>"PHP",
-        :match_details =>"apache server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:.*PHP\/[\d\.]+.*/i,
-        :dynamic_version => lambda { |x|
-          # check for backported OS type
-          backported = false
-          backported = true if _first_header_match(x,/^server:.*\(CentOS\).*$/)
-          backported = true if _first_header_match(x,/^server:.*\(Red Hat\).*$/)
-          backported = true if _first_header_match(x,/^server:.*\(Red Hat Enterprise Linux\).*$/)
-
-          # grab the version
-          version = _first_header_capture(x,/^server:.*PHP\/([\d\.]+).*/i)
-      
-          # return a version string that indicates we can't do inference
-          return "#{version} (Backported)" if backported
-        
-          # otherwise just return the version 
-        version
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"PHP",
-        :product =>"PHP",
-        :match_details =>"PHPSESSID cookie",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /PHPSESSID=.*/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/phpmyadmin.rb

@@ -1,40 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class PhpMyAdmin < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Administrative","COTS"],
-        :vendor => "PhpMyAdmin",
-        :product => "PhpMyAdmin",
-        :match_details => "PhpMyAdmin",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /phpMyAdmin=/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Administrative","COTS"],
-        :vendor => "PhpMyAdmin",
-        :product => "PhpMyAdmin",
-        :match_details => "PhpMyAdmin",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content =>  /^PhpMyAdmin$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/phpwind.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class PhpWind < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Phpwind",
-        :product => "Phpwind",
-        :references => ["https://www.phpwind.net/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /phpwind ([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /phpwind ([\d\.]+)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/phusion.rb

@@ -1,59 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Phusion < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Phusion",
-        :product =>"Passenger",
-        :match_details =>"x-powered-by header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^x-powered-by: Phusion Passenger.*$/,
-        :dynamic_version => lambda{|x| 
-          _first_header_capture(x,/x-powered-by: Phusion Passenger (.*)/i) },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Phusion",
-        :product =>"Passenger",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:.*Phusion Passenger.*$/,
-        :dynamic_version => lambda{|x| 
-          _first_header_capture(x,/^server:.*Phusion Passenger\ ([\d\.]*).*/i) },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Phusion",
-        :product =>"Passenger",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:.*Phusion_Passenger.*$/,
-        :dynamic_version => lambda{|x| 
-          _first_header_capture(x,/^server:.*Phusion_Passenger\/([\w\d\.\-]*)\s.*$/i) },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/ping_identity.rb

@@ -1,28 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class PingIdentiy < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["IAM"],
-        :vendor => "PingIdentity",
-        :product =>"PingFederate",
-        :references => ["https://ping.force.com/Support/PingFederate/Administration/Single-sign-on-no-target796070NEW"],
-        :match_details =>"redirect (may be interesting)",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^location:.*startSSO.ping/,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/pivotal_software.rb

@@ -1,97 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class PivotalSoftware < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"Pivotal Software",
-        :product =>"Spring Framework",
-        :match_details =>"Standard Spring MVC error page",
-        :match_type => :content_body,
-        :version => nil,
-        :match_content =>  /\{\"timestamp\":\d.*,\"status\":999,\"error\":\"None\",\"message\":\"No message available\"\}/,
-        :paths => ["#{url}/error.json"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"Pivotal Software",
-        :product =>"Spring Framework",
-        :match_details =>"spring cache header",
-        :references => ["https://github.com/atramos/springy-aws"],
-        :match_type => :content_body,
-        :version => nil,
-        :match_content =>  /^x-springy-cache-disabled:.*$/i,
-        :paths => ["#{url}"],
-        :examples => ["x-springy-cache-disabled: 0"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"Pivotal Software",
-        :product =>"Spring Boot",
-        :match_details =>"spring cache header",
-        :references => ["https://stackoverflow.com/questions/40379550/what-is-x-application-context-header"],
-        :match_type => :content_headers,
-        :version => nil,
-        :match_content =>  /^X-Application-Context.*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Development", "Database"],
-        :vendor => "Pivotal Software",
-        :product => "RabbitMQ",
-        :match_details =>"RabbitMQ",
-        :match_type => :content_body,
-        :version => nil,
-        :match_content =>  /RabbitMQ Management/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Development", "Database"],
-        :vendor => "Pivotal Software",
-        :product => "RabbitMQ",
-        :match_details => "RabbitMQ API",
-        :match_type => :content_body,
-        :version => nil,
-        :match_content =>  /RabbitMQ Management HTTP API/,
-        :paths => ["#{url}/api"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["App Server"],
-        :vendor =>"Pivotal Software",
-        :product =>"tc server",
-        :match_details =>"body version string",
-        :references => ["https://www.vmware.com/products/pivotal-tcserver.html"],
-        :match_type => :content_body,
-        :version => nil,
-        :match_content =>  /Pivotal tc Server Standard Edition [\d\.]+\.RELEASE/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /Pivotal tc Server Standard Edition\ ([\d\.]+)\.RELEASE/i)},
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/pjax.rb

@@ -1,40 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Pjax < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["Javascript"],
-        :vendor =>"pjax",
-        :product =>"pjax",
-        :match_details =>"header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^x-pjax:.*/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["Javascript"],
-        :vendor =>"pjax",
-        :product =>"pjax",
-        :match_details =>"vary header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^vary:.*x-pjax.*/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/plesk.rb

@@ -1,58 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Plesk < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["COTS"],
-        :vendor => "Plesk",
-        :product =>"Plesk",
-        :references => [],
-        :match_details =>"x-powered-by-plesk... plesklin",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^x-powered-by: PleskLin/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["COTS"],
-        :vendor => "Plesk",
-        :product =>"Plesk",
-        :references => [],
-        :match_details =>"pleskwin in the header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^PleskWin/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["COTS"],
-        :vendor => "Plesk",
-        :product =>"Plesk",
-        :references => [],
-        :match_details =>"x-powered-by-plesk",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^x-powered-by-plesk:.*/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-
-
-    ]
-  end
-
-end
-end
-end
-end