intrigue-ident 0.9.9 → 0.31

data/checks/http/porkbun.rb

@@ -1,31 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class Porkbun < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "Porkbun",
-          :product => "Porkbun",
-          :website => "ttps://porkbun.com/h",
-          :references => [],
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /but the owner has not put up a site yet. Visit again soon to see what amazing website they decide to build./i,
-          :match_details => "unique body string",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/progress.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class ProgressCMS < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Progress",
-        :product => "Sitefinity",
-        :references => ["https://www.progress.com/sitefinity-cms"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /sitefinity (.\d*.\d*.\d*.\d*)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /sitefinity (.\d*.\d*.\d*.\d*)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/proofpoint.rb

@@ -1,30 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class Proofpoint < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["COTS", "Security"],
-          :vendor => "Proofpoint",
-          :product => "Protection Server",
-          :references => ["https://www.proofpoint.com/us/resources/data-sheets/protection-server-technical-brief"],
-          :version => nil,
-          :match_type => :content_title,
-          :match_content => /^Proofpoint Protection Server$/i,
-          :match_details => "title",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/pulsesecure.rb

@@ -1,91 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class PulseSecure < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Networking", "VPN"],
-        :vendor =>"PulseSecure",
-        :product =>"Pulse Connect Secure",
-        :match_details => "page title",
-        :match_type => :content_title,
-        :references => [],
-        :match_content =>  /^Junos Pulse Secure Access Service$/,
-        :version => nil,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Networking", "VPN"],
-        :vendor =>"PulseSecure",
-        :product =>"Pulse Connect Secure",
-        :match_details => "page title",
-        :match_type => :content_title,
-        :references => [],
-        :match_content =>  /^Pulse&#32;Connect&#32;Secure$/,
-        :version => nil,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Networking", "VPN"],
-        :vendor =>"PulseSecure",
-        :product =>"Pulse Connect Secure",
-        :match_details => "unique image link",
-        :references => [
-          "https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40250",
-          "https://github.com/carnal0wnage/Metasploit-Code/blob/master/modules/auxiliary/scanner/juniper_scan.rb",
-          "http://carnal0wnage.attackresearch.com/2013/05/funky-juniper-urls.html" #<^ TODO ... task?
-          ],
-        :match_type => :content_body,
-        :match_content => /<td background="\/dana-na\/imgs\/footerbg.gif">/,
-        :version => nil,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Networking", "VPN"],
-        :vendor =>"PulseSecure",
-        :product =>"Pulse Connect Secure",
-        :match_details => "unique css link",
-        :references => [],
-        :match_type => :content_body,
-        :match_content => /src=\"\/dana-na\/css\/ds.js\">/,
-        :version => nil,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :depends => [{:product => "Pulse Connect Secure"}],
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Networking", "VPN"],
-        :vendor =>"PulseSecure",
-        :product =>"Pulse Connect Secure",
-        :match_details => "info disclosure in nc_gina_ver.txt",
-        :references => ["https://know.bishopfox.com/blog/breaching-the-trusted-perimeter"],
-        :match_type => :content_body,
-        :match_content => /DSSETUP_BUILD_VERSION/,
-        :version => nil,
-        :dynamic_version => lambda{|x| _first_body_capture(x,/VALUE=\"Pulse Secure Network Connect ([\d\.]+)/i) }, 
-        :paths => ["#{url}/dana-na/nc/nc_gina_ver.txt"],
-        :require_product => "Junos Pulse Secure Access Service",
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/python.rb

@@ -1,30 +0,0 @@
-
-module Intrigue
-module Ident
-module Check
-class Python < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor => "Python",
-        :product =>"Python",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^server:.*Python.*$/,
-        :dynamic_version => lambda{|x| 
-          _first_header_capture(x,/^server:.*Python\/([\d\.]*)\s.*$/i) },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/qnap.rb

@@ -1,43 +0,0 @@
-module Intrigue
-module Ident
-module Check
-  class Qnap < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "hardware",
-          :tags => ["Embedded", "IoT", "Appliance", "NAS"],
-          :vendor => "QNAP",
-          :product => "QTS",
-          :match_details => "unique string",
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /Shone added for detecting default system language when no cookie has been set/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "hardware",
-          :tags => ["Embedded", "IoT", "Appliance", "NAS"],
-          :vendor => "QNAP",
-          :product => "QTS",
-          :match_details => "firmware version on handy cgi page",
-          :version => nil,
-          :dynamic_version => lambda { |x|
-            _first_body_capture(x,%r{<version><!\[CDATA\[([\d\.]*)\]\]></version>})
-          },
-          :match_type => :content_body,
-          :match_content => /QDocRoot/,
-          :paths => ["#{url}/cgi-bin/authLogin.cgi"],
-          :require_product => "QTS",
-          :inference => true
-        }
-      ]
-    end
-  end
-end
-end
-end

data/checks/http/qualys.rb

@@ -1,69 +0,0 @@
-
-module Intrigue
-  module Ident
-  module Check
-  class Qualys < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Security"],
-          :vendor =>"Qualys",
-          :product =>"QualysGuard",
-          :match_details =>"custom server header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^server: Qualys$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Security"],
-          :vendor =>"Qualys",
-          :product =>"QualysGuard",
-          :match_details =>"custom server header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^server: qweb\/.*$/i,
-          :dynamic_version => lambda { |x| _first_header_capture(x, /^server: qweb\/(.*)$/i)},
-          :paths => ["#{url}"],
-          :inference => true
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Security"],
-          :vendor =>"Qualys",
-          :product =>"Qualys Mobility",
-          :match_details =>"custom server header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /^server: QMProprietary$/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Security"],
-          :vendor =>"Qualys",
-          :product =>"Qualys Mobility",
-          :match_details =>"custom server header",
-          :version => nil,
-          :match_type => :content_cookies,
-          :match_content =>  /QualysSession=/i,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/rapid7.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Rapid7 < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["SaaS"],
-        :vendor =>"Rapid7",
-        :product =>"Logentries",
-        :match_details =>"server header",
-        :references => [],
-        :match_type => :content_headers,
-        :match_content =>  /server: th3 c4k3 is 4 l13\.$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/rbs.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class RbsCMS < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "RBS",
-        :product => "RBS Change",
-        :references => ["https://www.rbschange.fr/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /RBS Change ([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /RBS Change ([\d\.]+)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/readmeio.rb

@@ -1,28 +0,0 @@
-
-module Intrigue
-module Ident
-module Check
-class Readmeio < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["Javascript", "SaaS", "Support"],
-        :vendor =>"Readme.io",
-        :product =>"Readme.io",
-        :match_details =>"js load string",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /cdn.readme.io\/js\/bundle-hub2.js/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/red_hat.rb

@@ -1,95 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class RedHat < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      #
-      { # server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.2.12
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["OS"],
-        :vendor =>"Red Hat",
-        :product =>"Enterprise Linux",
-        :match_details =>"nginx test page",
-        :match_type => :content_headers,
-        :match_content =>  /^Apache.* \(Red Hat Enterprise Linux\).*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["OS"],
-        :vendor =>"Red Hat",
-        :product =>"Fedora Linux",
-        :match_details =>"nginx test page",
-        :match_type => :content_title,
-        :match_content =>  /^Test Page for the Nginx HTTP Server on Fedora$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Development", "Administrative", "Hypervisor"],
-        :vendor =>"Red Hat",
-        :product =>"OpenShift Container Platform",
-        :match_details =>"error message in html",
-        :references => ["https://bugzilla.redhat.com/show_bug.cgi?id=1414657"],
-        :match_type => :content_body,
-        :match_content =>  /Route and path matches, but all pods are down./i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Development", "Administrative", "Hypervisor"],
-        :vendor =>"Red Hat",
-        :product =>"OpenShift Container Platform",
-        :match_details =>"title",
-        :references => [""],
-        :match_type => :content_title,
-        :match_content =>  /Login - OpenShift Origin/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Red Hat",
-        :product => "JBoss Core Services",
-        :references => ["https://www.redhat.com/en/resources/jboss-core-services-collection-datasheet"],
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^Server:\ JBCS\ httpd$/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/^Server:\ JBCS\ httpd$/i) },
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Red Hat",
-        :product => "JBoss Enterprise Application Platform",
-        :references => ["https://bugzilla.redhat.com/show_bug.cgi?id=1049103"],
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /X-Powered-By: JSP\/2./i,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end