intrigue-ident 0.9.9 → 0.31

data/checks/http/software_ag.rb

@@ -1,47 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class SoftwareAg < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["COTS"],
-          :vendor => "Software AG",
-          :product => "webMethods Nirvana Messaging",
-          :references => ["http://www.universalmessaging.org/"],
-          :match_details => "server header",
-          :version => nil,
-          :match_type => :content_headers,
-          :match_content =>  /server: my-Channels/i,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "application",
-          :tags => ["COTS"],
-          :vendor => "Software AG",
-          :product => "webMethods Nirvana Messaging",
-          :references => ["http://www.universalmessaging.org/"],
-          :match_details => "documentation index version",
-          :version => nil,
-          :match_type => :content_body,
-          :match_content =>  /<h1>Nirvana [\d\.]+ Documentation Index/i,
-          :dynamic_version => lambda{|x| _first_body_capture(x,/<h1>Nirvana ([\d\.]+) Documentation Index/i)},
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-
-    
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/soha.rb

@@ -1,66 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Soha < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [          
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["VPN"],
-        :vendor =>"Soha",
-        :product =>"Soha",
-        :match_details =>"x-spx-status header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^x-spx-status: \d+$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["VPN"],
-        :vendor =>"Soha",
-        :product =>"Soha",
-        :match_details =>"x-spx-login-server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^x-spx-login-server: .*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["VPN"],
-        :vendor =>"Soha",
-        :product =>"Soha",
-        :match_details =>"x-spx-auth-supported header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^x-spx-auth-supported: .*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["VPN"],
-        :vendor =>"Soha",
-        :product =>"Soha",
-        :match_details =>"x-spx-auth-token-hdr header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^x-spx-auth-token-hdr: .*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/solarwinds.rb

@@ -1,41 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Solarwinds < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS"],
-        :vendor => "Solarwinds",
-        :product =>"Serv-U",
-        :match_details =>"",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server: Serv-U/,
-        :dynamic_version => lambda {|x| _first_header_capture(x, /server: Serv-U\/([\d\.]+)/)},
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server"],
-        :vendor => "Solarwinds",
-        :product =>"Nginx",
-        :match_details =>"",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server: solarwinds-nginx/,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/sonatype.rb

@@ -1,43 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Sonatype < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Security"],
-        :vendor =>"Sonatype",
-        :product =>"Nexus Repository Manager",
-        :match_details =>"product name in body",
-        :references => [],
-        :match_type => :content_title,
-        :match_content => /Nexus Repository Manager/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Security"],
-        :vendor =>"Sonatype",
-        :product =>"Nexus Repository Manager",
-        :match_details =>"version in body - specific to oss?",
-        :references => [],
-        :match_type => :content_body,
-        :match_content => /app\.js\?_v\=[\d\.\-]+\&_e\=/i,
-        :dynamic_version => lambda { |x|
-          _first_body_capture(x,/app\.js\?_v\=([\d\.\-]+)\&_e\=/i)
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/sonicwall.rb

@@ -1,63 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Sonicwall < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Networking","VPN","Security"],
-        :vendor =>"Sonicwall",
-        :product =>"SonicOS",
-        :match_details =>"server header",
-        :references => [
-          "https://www.sonicwall.com/en-us/support/technical-documentation/secure-mobile-access-12-0-workplace-user-guide/using-sma-workplace"],
-        :match_type => :content_headers,
-        :match_content =>  /server: SMA\/.*/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: SMA\/([\d\.]+)/i)
-        },
-        :paths => ["#{url}"],
-        :examples => ["server: SMA/12.2"],
-        :inference => true
-      },
-      { # duplicate of SMA fingerprint, want to flag SonicOS as well
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Networking","VPN","Security"],
-        :vendor =>"Sonicwall",
-        :product =>"Secure Mobile Access",
-        :match_details =>"server header",
-        :references => [
-          "https://www.sonicwall.com/en-us/support/technical-documentation/secure-mobile-access-12-0-workplace-user-guide/using-sma-workplace"],
-        :match_type => :content_headers,
-        :match_content =>  /server: SMA\/.*/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: SMA\/([\d\.]+)/i)
-        },
-        :paths => ["#{url}"],
-        :examples => ["server: SMA/12.2"],
-        :inference => true
-      }, 
-      { # Sonicwall
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Networking","Security"],
-        :vendor =>"Sonicwall",
-        :product =>"Network Security Appliance",
-        :match_details =>"server header",
-        :match_type => :content_headers,
-        :match_content =>  /server: SonicWALL$/i,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/sophos.rb

@@ -1,40 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Sophos < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [          
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Security"],
-        :vendor =>"Sophos",
-        :product =>"Sophos",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^server: xxxx$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Security"],
-        :vendor =>"Sophos",
-        :product =>"Sophos",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^server: xxxxxxxx-xxxxx$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/southriver.rb

@@ -1,43 +0,0 @@
-
-module Intrigue
-module Ident
-module Check
-class SouthRiver < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      { # check may be too broad, there is a string in the body that
-        # is more specific to MFT
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS"],
-        :vendor =>"SouthRiver",
-        :product =>"Cornerstone MFT",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server: SouthRiver\/1.0/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      { # check may be too broad, there is a string in the body that
-        # is more specific to MFT
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS"],
-        :vendor =>"SouthRiver",
-        :product =>"Cornerstone MFT",
-        :match_details =>"unique body string",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /title="Cornerstone MFT" target="_blank"/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/splash.rb

@@ -1,29 +0,0 @@
-
-module Intrigue
-  module Ident
-  module Check
-  class Splash < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Marketing", "Javascript", "SaaS"],
-          :vendor =>"Splash",
-          :product =>"Splash",
-          :match_details =>"title for default landing page",
-          :version => nil,
-          :match_type => :content_title,
-          :match_content =>  /Event Marketing Software - Splash/i,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/splunk.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Splunk < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Security"],
-        :vendor =>"Splunk",
-        :product =>"Splunk",
-        :match_details =>"server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^server: Splunkd$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/springfox.rb

@@ -1,43 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Springfox < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["API"],
-        :vendor =>"Springfox",
-        :product =>"Swagger UI",
-        :references => ["https://reflectoring.io/documenting-spring-data-rest-api-with-springfox/"],
-        :match_details =>"content",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /src=\'webjars\/springfox-swagger-ui\/springfox.js\'/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["API"],
-        :vendor =>"Springfox",
-        :product =>"Swagger UI",
-        :references => ["https://reflectoring.io/documenting-spring-data-rest-api-with-springfox/"],
-        :match_details =>"title",
-        :version => nil,
-        :match_type => :content_title,
-        :match_content =>  /Swagger UI/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-
-    ]
-  end
-
-end
-end
-end
-end