intrigue-ident 0.9.9 → 0.31

data/checks/http/wordpress/w3_total_cache.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class WordpressW3TotalCache < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Wordpress Plugin"],
-        :vendor =>"Wordpress",
-        :product =>"W3 Total Cache",
-        :match_details =>"powered by header",
-        :match_type => :content_headers,
-        :match_content =>  /x-powered-by: W3 Total Cache\/.*/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/x-powered-by: W3 Total Cache\/(.*)/i)
-        },
-        :paths => ["#{url}"],
-        :require_product => "Wordpress",
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/wordpress/wp_fastest_cache.rb

@@ -1,30 +0,0 @@
-
-module Intrigue
-module Ident
-module Check
-class WordpressWpFastestCache < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Wordpress Plugin"],
-        :vendor =>"Wordpress",
-        :product =>"WP Fastest Cache",
-        :references => ["https://seclists.org/fulldisclosure/2019/Mar/17"],
-        :match_details =>"string in body",
-        :match_type => :content_body,
-        :match_content =>  /<!-- WP Fastest Cache file was created in/i,
-        :version => nil,
-        :paths => ["#{url}"],
-        :require_product => "Wordpress",
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/wordpress/wp_super_cache.rb

@@ -1,46 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class WordpressWpSuperCache < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Wordpress Plugin"],
-        :vendor =>"Wordpress",
-        :product =>"WP-Super-Cache",
-        :references => [
-          "https://wordpress.org/plugins/wp-super-cache/",
-          "https://www.computerworld.com/article/2907533/over-1-million-wordpress-sites-may-be-affected-by-a-flaw-in-wp-super-cache-plugin.html"
-        ],
-        :match_details =>"generated by string (body)",
-        :match_type => :content_body,
-        :match_content =>  /Cached page generated by WP-Super-Cache/i,
-        :version => nil,
-        :paths => ["#{url}"],
-        :require_product => "Wordpress",
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Wordpress Plugin"],
-        :vendor =>"Wordpress",
-        :product =>"WP-Super-Cache",
-        :match_details =>"generated by string (body)",
-        :match_type => :content_body,
-        :match_content =>  /wp-super-cache/i,
-        :version => nil,
-        :paths => ["#{url}/wp-json"],
-        :require_product => "Wordpress",
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/wordpress/wpbakery.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class WordpressBakery < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Wordpress Plugin"],
-        :vendor =>"WPBakery",
-        :product =>"WPBakery",
-        :references => ["https://wpbakery.com/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Powered by WPBakery Page Builder/i ,
-        :match_details =>"header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :require_product => "Wordpress",
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/world4you.rb

@@ -1,46 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class World4You < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "World4You",
-          :product => "World4You",
-          :website => "https://www.world4you.com",
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /This is a newly created customer website\<\/h1\>/i,
-          :match_details => "unique body string",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }, 
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "World4You",
-          :product => "World4You",
-          :website => "https://www.world4you.com",
-          :version => nil,
-          :match_type => :content_title,
-          :match_content => /Hier entsteht eine neue Kunden-Website \| World4You\</i,
-          :match_details => "unique body string",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-        
-      ]
-    end
-  
-  end
-  end
-  end
-  end
-  

data/checks/http/wp_engine.rb

@@ -1,57 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class WpEngine < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CMS", "SaaS"],
-        :vendor =>"WPEngine",
-        :product =>"WPEngine",
-        :match_details =>"WPEngine - Access site by IP",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /This domain is successfully pointed at WP Engine, but is not configured for an account on our platform./,
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CMS", "SaaS"],
-        :vendor =>"WPEngine",
-        :product =>"WPEngine",
-        :match_details =>"WPEngine header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^x-powered-by: WP Engine$/,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CMS", "SaaS"],
-        :vendor =>"WPEngine",
-        :product =>"WPEngine",
-        :match_details =>"WPEngine header",
-        :version => nil,
-        :match_type => :content_headers,
-        # TODO note that this will tell us the server ala,,,   "wpe-backend: apache",
-        :match_content =>  /^wpe-backend:/, 
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/xcms.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class XCms < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "X-CMS",
-        :product => "X-CMS",
-        :references => ["https://xcmsonline.scripps.edu//"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /X-CMS-Version: ([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /X-CMS-Version: ([\d\.]+)/i) },
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/xelion.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Xelion < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS","Telephony"],
-        :vendor =>"Xelion",
-        :product =>"Phone System",
-        :references => ["https://www.xelion.com/en/"],
-        :match_details =>"title",
-        :match_type => :content_title,
-        :match_content =>  /Xelion Phone System/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/xerox.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Xerox < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Embedded","Printer"],
-        :vendor => "Xerox",
-        :product => "WorkCentre Printer",
-        :references => [],
-        :match_details =>"title",
-        :match_type => :content_title,
-        :match_content => /CentreWare Internet Services/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/xmb.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class XmbCMS < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "XMB",
-        :product => "XMB",
-        :references => ["https://forums.xmbforum2.com/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Powered by XMB (\d.*.\d)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /Powered by XMB (\d.*.\d)/i)},
-        :match_details => "Header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/xtec.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Xtec < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["IAM"],
-        :vendor => "Xtec",
-        :product =>"AuthentXware",
-        :references => ["http://www.xtec.com/products/logical-access-control/authentxware.html"],
-        :match_details =>"header",
-        :version => nil,
-        :dynamic_version => lambda {|x| 
-          _first_header_capture(x,/^x-tec-api-version: v(.*)/)},
-        :match_type => :content_headers,
-        :match_content =>  /^x-tec-api-version:.*/,
-        :paths => ["#{url}"],
-        :inference => true  # No cpes on 20190319
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/yaf.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class YafNetCMS < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "YAF.NET",
-        :product => "YAF",
-        :references => ["https://www.yetanotherforum.net/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Powered by YAF.NET ([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /Powered by YAF.NET ([\d\.]+)/i)},
-        :match_details => "Header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/yaws.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Yaws < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor =>"Yaws",
-        :product =>"Yaws",
-        :match_details =>"server header",
-        :references => ["https://en.wikipedia.org/wiki/Yaws_(web_server)"],
-        :match_type => :content_headers,
-        :match_content =>  /server: Yaws/i,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: Yaws (.*)/i)
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end