intrigue-ident 0.9.9 → 0.31

data/checks/http/redmine.rb

@@ -1,38 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Redmine < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      { 
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["OS"],
-        :vendor =>"Redmine",
-        :product =>"Redmine",
-        :match_details =>"redmine cookie",
-        :match_type => :content_cookies,
-        :match_content =>  /_redmine_session=/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      { 
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["OS"],
-        :vendor =>"Redmine",
-        :product =>"Redmine",
-        :match_details =>"redmine title",
-        :match_type => :content_title,
-        :match_content =>  /^Redmine$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/restlet.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Restlet < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"Restlet",
-        :product =>"Restlet",
-        :match_details =>"server header for Restlet",
-        :references => ["http://restlet.com/company/blog/2016/02/03/api-testing-testing-web-apis-using-dhc-by-restlet/"],
-        :match_type => :content_headers,
-        :match_content =>  /server: Restlet-Framework/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: Restlet-Framework\/(.*)/i)
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/ritecms.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class RiteCMS < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "RiteCMS",
-        :product => "RiteCMS",
-        :references => ["http://ritecms.com/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /ritecms ([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /ritecms ([\d\.]+)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/roadiz.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class RoadizCMS < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Roadiz",
-        :product => "Roadiz",
-        :references => ["https://www.roadiz.io/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /roadiz ([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /roadiz ([\d\.]+)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/rock.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Rock < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Rock",
-        :product => "RockCMS",
-        :references => ["https://www.roadiz.io/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /rock v([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /rock v([\d\.]+)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/rollbar.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Rollbar < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Javascript"],
-        :vendor => "Rollbar",
-        :product => "Rollbarjs",
-        :match_details => "unique javascript string ",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /_rollbarConfig/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/roundcube.rb

@@ -1,42 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Roundcube < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-    [
-        {
-            :type => "fingerprint",
-            :category => "application",
-            :tags => ["Email" "COTS"],
-            :vendor => "Roundcube",
-            :product => "Roundcube",
-            :website => "https://roundcube.net/",
-            :match_details => "Roundcube title",
-            :version => nil,
-            :match_type => :content_title,
-            :match_content =>  /:: Welcome to Roundcube Webmail$/i,
-            :paths => ["#{url}"],
-            :inference => false
-        },
-        {
-            :type => "fingerprint",
-            :category => "application",
-            :tags => ["Email"],
-            :vendor => "Roundcube",
-            :product => "Roundcube",
-            :website => "https://roundcube.net/",
-            :match_details => "Roundcube session cookie",
-            :version => nil,
-            :match_type => :content_cookies,
-            :match_content => /roundcube_sessid=/i,
-            :paths => ["#{url}"], 
-            :inference => false
-        }
-    ]
-    end
-
-end
-end
-end
-end

data/checks/http/ruby.rb

@@ -1,92 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Ruby < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server"],
-        :vendor =>"Ruby",
-        :product =>"Rack",
-        :match_details =>"x-rack-cache header",
-        :match_type => :content_headers,
-        :match_content =>  /^x-rack-cache:.*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server"],
-        :vendor =>"Ruby",
-        :product =>"Rack",
-        :match_details =>"x-cascade header",
-        :match_type => :content_headers,
-        :match_content =>  /^x-cascade:.*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server"],
-        :vendor =>"Ruby",
-        :references => [
-          "https://stackoverflow.com/questions/984633/how-to-remove-x-runtime-header-from-nginx-passenger",
-          "https://hackernoon.com/the-giving-ruby-the-strange-case-of-user-enumeration-on-heroku-not-fixed-1a8296067318"
-        ],
-        :product =>"Rack",
-        :match_details =>"x-runtime header",
-        :match_type => :content_headers,
-        :match_content =>  /^x-runtime:.*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["library"],
-        :vendor =>"Ruby",
-        :product =>"Ruby",
-        :match_details =>"x-rack-cache header",
-        :match_type => :content_headers,
-        :match_content =>  /^x-rack-cache:.*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["library"],
-        :vendor =>"Ruby",
-        :product =>"Ruby",
-        :match_details =>"server header",
-        :match_type => :content_headers,
-        :dynamic_version => lambda {|d| _first_header_capture(d,/\(Ruby\/([\d\.]+)\/[\d\-]+\)/) },
-        :match_content =>  /server:.*\(Ruby\/[\d\.]+\/[\d\-]+\)/i,
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["library"],
-        :vendor =>"Ruby",
-        :product =>"Webrick",
-        :match_details =>"server header",
-        :match_type => :content_headers,
-        :dynamic_version => lambda {|d| _first_header_capture(d,/WEBrick\/([\d\.]+)/) },
-        :match_content =>  /server:.*WEBrick\/[\d\.]+/i,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/ruckus_wireless.rb

@@ -1,26 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class RuckusWireless < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Networking", "COTS", "Administrative"],
-        :vendor =>"Ruckus Wireless",
-        :product =>"Admin",
-        :match_details =>"login page for ruckus wireless device",
-        :match_type => :content_title,
-        :match_content =>  /Ruckus Wireless Admin/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/sailpoint.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Sailpoint < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["IAM"],
-        :vendor => "Sailpoint",
-        :product => "IdentityQ",
-        :references => [
-          "https://www.sailpoint.com/identity-management-software-identityiq/"
-        ],
-        :match_details => "Main page of a sailpoint identityq instance",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content =>  /SailPoint IdentityIQ/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/salesforce.rb

@@ -1,28 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class SalesForce < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-    [
-        {
-            :type => "fingerprint",
-            :category => "application",
-            :tags => ["Cloud", "CRM", "SaaS", "PaaS"],
-            :vendor => "Salesforce",
-            :product => "Salesforce ApexPages",
-            :website => "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_methods_system_apexpages.htm",
-            :match_details => "Salesforce Apex Pages header",
-            :version => nil,
-            :match_type => :content_headers,
-            :match_content =>  /^X-Powered-By: Salesforce\.com ApexPages$/i,
-            :paths => ["#{url}"],
-            :inference => false
-        }
-    ]
-    end
-
-end
-end
-end
-end

data/checks/http/sap.rb

@@ -1,149 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Sap < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"SAP",
-        :product =>"Advanced Business Application Programming",
-        :match_details =>"server header",
-        :references => [
-          "https://en.wikipedia.org/wiki/ABAP"
-        ],
-        :match_type => :content_headers,
-        :match_content =>  /server: SAP NetWeaver Application Server [\d\.\s]*\/ ABAP [\d]+/i,
-        :dynamic_version => lambda { |x| _first_header_capture(x, /server: SAP NetWeaver Application Server [\d\.\s]*\/ ABAP ([\d]+)/i,) },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Framework"],
-        :vendor =>"SAP",
-        :product =>"Internet Communication Manager",
-        :match_details =>"server header",
-        :references => [
-          "https://help.sap.com/doc/saphelp_nw73ehp1/7.31.19/en-US/48/039d48c0070c84e10000000a42189c/frameset.htm"
-        ],
-        :match_type => :content_headers,
-        :match_content =>  /server: SAP NetWeaver Application Server [\d\.\s]*\/ ICM [\d\.]+/i,
-        :dynamic_version => lambda { |x| _first_header_capture(x, /server: SAP NetWeaver Application Server [\d\.\s]*\/ ICM ([\d\.]+)/i,) },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"SAP",
-        :product =>"NetWeaver",
-        :match_details =>"cookie",
-        :version => nil,
-        :references => [
-          "https://apps.support.sap.com/sap/support/knowledge/preview/en/2082323",
-          "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence.rb"
-        ],
-        :match_type => :content_cookies,
-        :match_content =>  /sap-usercontext=sap-language=/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"SAP",
-        :product =>"NetWeaver",
-        :match_details =>"cookie",
-        :version => nil,
-        :references => [],
-        :match_type => :content_cookies,
-        :match_content =>  /com.sap.engine.security.authentication.original_application_url/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"SAP",
-        :product =>"NetWeaver",
-        :match_details =>"title",
-        :version => nil,
-        :references => [],
-        :match_type => :content_title,
-        :match_content =>  /SAP NetWeaver Application Server Java/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"SAP",
-        :product =>"NetWeaver",
-        :match_details =>"title",
-        :version => nil,
-        :references => [],
-        :match_type => :content_title,
-        :match_content =>  /SAP&#x20;NetWeaver&#x20;Portal/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"SAP",
-        :product =>"NetWeaver",
-        :version => nil,
-        :match_details =>"server header",
-        :references => [],
-        :match_type => :content_headers,
-        :match_content =>  /server: SAP NetWeaver Application Server [\d\.]*.*/i,
-        :dynamic_version => lambda { |x| _first_header_capture(x, /server: SAP NetWeaver Application Server ([\d\.]+)/i) },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"SAP",
-        :product =>"NetWeaver",
-        :version => nil,
-        :match_details =>"location header",
-        :references => [
-          "https://blogs.sap.com/2016/05/19/hp-loadrunner-scripts-for-webui/"
-        ],
-        :match_type => :content_headers,
-        :match_content =>  /bD1lbiZjPTEwMCZkPW1pbg==/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"SAP",
-        :product =>"XSEngine",
-        :version => nil,
-        :match_details =>"title",
-        :match_type => :content_title,
-        :match_content =>  /SAP XSEngine/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end