intrigue-ident 0.9.9 → 0.31

data/lib/checks/nagios.rb

@@ -0,0 +1,22 @@
+module Intrigue
+module Ident
+module Check
+    class Nagios < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Nagios",
+            :description => "Nagios",
+            :version => nil,
+            :type => :content_headers,
+            :content => /nagios/i,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/oracle.rb

@@ -0,0 +1,38 @@
+module Intrigue
+module Ident
+module Check
+    class Oracle < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Oracle Glassfish",
+            :description => "Oracle / Sun GlassFish Enterprise Server",
+            :url => "",
+            :version => nil,
+            :type => :content_headers,
+            :content => /Sun GlassFish Enterprise Server/,
+            :hide => true,
+            :dynamic_version => lambda { |x| x["details"]["headers"].join("\n").match(/Sun GlassFish Enterprise Server v([\d\.])/).captures[0] },
+            :examples => ["http://52.4.12.185/"],
+            :paths => ["#{uri}"]
+          },
+          {
+            :name => "Oracle Glassfish",
+            :description => "Oracle / Sun GlassFish Enterprise Server",
+            :url => "",
+            :version => nil,
+            :type => :content_headers,
+            :content => /GlassFish Server Open Source Edition/,
+            :hide => true,
+            :dynamic_version => lambda { |x| x["details"]["headers"].join("\n").match(/GlassFish Server Open Source Edition\s+([\d\.]+)$/).captures[0] },
+            :examples => ["http://52.2.97.57:80"],
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/palo_alto.rb

@@ -0,0 +1,23 @@
+module Intrigue
+module Ident
+module Check
+    class PaloAlto < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Palo Alto Networks GlobalProtect Portal",
+            :tags => ["tech:vpn"],
+            :description => "Pardot",
+            :version => nil,
+            :type => :content_body,
+            :content => /global-protect\/login.esp/i,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/pardot.rb

@@ -0,0 +1,22 @@
+module Intrigue
+module Ident
+module Check
+    class Pardot < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Pardot",
+            :description => "Pardot",
+            :version => nil,
+            :type => :content_cookies,
+            :content => /pardot/i,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/pfsense.rb

@@ -0,0 +1,25 @@
+module Intrigue
+module Ident
+module Check
+    class Pfsense < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "pfSense Firewall",
+            :description => "pfSense is an open source firewall/router " +
+              "computer software distribution based on FreeBSD. It is " +
+              "installed on a physical computer or a virtual machine to" +
+              "make a dedicated firewall/router for a network",
+            :version => nil,
+            :type => :content_body,
+            :content => /Login to pfSense/,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/phpmyadmin.rb

@@ -0,0 +1,22 @@
+module Intrigue
+module Ident
+module Check
+    class PhpMyAdmin < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "PhpMyAdmin",
+            :description => "PhpMyAdmin",
+            :version => nil,
+            :type => :content_cookies,
+            :content => /phpMyAdmin=/i,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/rabbitmq.rb

@@ -0,0 +1,29 @@
+module Intrigue
+module Ident
+module Check
+    class Rabbitmq < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+           {
+             :name => "RabbitMQ",
+             :description => "RabbitMQ",
+             :type => :content_body,
+             :version => nil,
+             :content => /RabbitMQ Management/,
+             :paths => ["#{uri}"]
+           },
+           {
+            :name => "RabbitMQ API",
+            :description => "RabbitMQ API",
+            :type => :content_body,
+            :version => nil,
+            :content => /RabbitMQ Management HTTP API/,
+            :paths => ["#{uri}/api"]
+          }
+        ]
+      end
+    end
+  end
+  end
+  end

data/lib/checks/spring.rb

@@ -0,0 +1,31 @@
+module Intrigue
+module Ident
+module Check
+    class Spring < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Spring",
+            :description => "Standard Spring Error Message",
+            :type => :content_body,
+            :version => nil,
+            :content =>  /{"timestamp":\d.*,"status":999,"error":"None","message":"No message available"}/,
+            :references => ["https://github.com/spring-projects/spring-boot"],
+            :paths => ["#{uri}/donotbealarmedthisisjusttestingagenericerrorpage"]
+          },
+          {
+            :name => "Spring",
+            :description => "Standard Spring MVC error page",
+            :type => :content_body,
+            :version => nil,
+            :content => /{"timestamp":\d.*,"status":999,"error":"None","message":"No message available"}/,
+            :paths => ["#{uri}/error.json"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/team_city.rb

@@ -0,0 +1,22 @@
+module Intrigue
+module Ident
+module Check
+    class TeamCity < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "TeamCity Continuous Integration",
+            :description => "TeamCity Continuous Integration",
+            :version => nil,
+            :type => :content_body,
+            :content => /icons\/teamcity.black.svg/i,
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/telerik.rb

@@ -0,0 +1,25 @@
+module Intrigue
+module Ident
+module Check
+    class Telerik < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Telerik Sitefinity",
+            :description => "Telerik Sitefinity is an ASP.NET 2.0-based Content Management System (CMS)",
+            :url => "https://www.sitefinity.com/",
+            :version => nil,
+            :type => :content_body,
+            :content => /Telerik.Sitefinity.Resources/,
+            :dynamic_version => lambda { |x| x.body.match(/Version=([\d\.]+),/).captures[0] },
+            :verify_sites => [],
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+  end
+  end
+  end

data/lib/checks/tomcat.rb

@@ -0,0 +1,22 @@
+module Intrigue
+module Ident
+module Check
+    class Tomcat < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Apache Tomcat",
+            :description => "Tomcat Application Server",
+            :type => :content_body,
+            :version => nil,
+            :content => /<title>Apache Tomcat/,
+            :dynamic_version => lambda{|x| x.body.scan(/<title>(.*)<\/title>/)[0].first.gsub("Apache Tomcat/","").gsub(" - Error report","").chomp },
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+    end
+end
+end
+end

data/lib/checks/varnish.rb

@@ -0,0 +1,27 @@
+module Intrigue
+module Ident
+module Check
+    class Varnish < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Varnish",
+            :description => "Varnish Proxy",
+            :version => nil,
+            :type => :content_headers,
+            :content => /via: [0-9]\.[0-9] varnish/i,
+            :dynamic_version => lambda{ |x|
+              m = nil
+              x.each_header{|h,v| m = v if (h == "via" && v =~ /varnish/) }
+              m.gsub("varnish ","") if m
+            },
+            :paths => ["#{uri}"]
+          }
+        ]
+      end
+
+    end
+end
+end
+end

data/lib/checks/wordpress.rb

@@ -0,0 +1,120 @@
+module Intrigue
+module Ident
+module Check
+    class Wordpress < Intrigue::Ident::Check::Base
+
+      def generate_checks(uri)
+        [
+          {
+            :name => "Wordpress",
+            :description => "Wordpress WP-JSON endpoint",
+            :version => nil,
+            :type => :content_body,
+            :content => /gmt_offset/,
+            :paths => ["#{uri}/wp-json"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.0",
+            :type => :checksum_body,
+            :checksum => "a306a72ce0f250e5f67132dc6bcb2ccb",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.1",
+            :type => :checksum_body,
+            :checksum => "4f04728cb4631a553c4266c14b9846aa",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.2",
+            :type => :checksum_body,
+            :checksum => "25e1e78d5b0c221e98e14c6e8c62084f",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.3",
+            :type => :checksum_body,
+            :checksum => "83c83d0f0a71bd57c320d93e59991c53",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.5",
+            :type => :checksum_body,
+            :checksum => "7293453cf0ff5a9a4cfe8cebd5b5a71a",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.6",
+            :type => :checksum_body,
+            :checksum => "61740709537bd19fb6e03b7e11eb8812",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.7",
+            :type => :checksum_body,
+            :checksum => "e6bbc53a727f3af003af272fd229b0b2",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.7.1",
+            :type =>:checksum_body,
+            :checksum => "e6bbc53a727f3af003af272fd229b0b2",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          },
+          {
+            :name => "Wordpress",
+            :description => "Wordpress TinyMCE Editor",
+            :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
+            :version => "2.9.1",
+            :type => :checksum_body,
+            :checksum => "128e75ed19d49a94a771586bf83265ec",
+            :paths => ["#{uri}/wp-includes/js/tinymce/tiny_mce.js"]
+          }
+        ]
+      end
+
+
+=begin
+all_checks = [{
+  :uri => "#{uri}",
+  :checklist => [
+  {
+    :name => "Yoast Wordpress SEO Plugin", # won't be used if we have
+    :description => "Yoast Wordpress SEO Plugin",
+    :type => "content",
+    :content => /<!-- \/ Yoast WordPress SEO plugin. -->/,
+    :test_site => "https://ip-50-62-231-56.ip.secureserver.net",
+    :dynamic_name => lambda{|x| x.scan(/the Yoast WordPress SEO plugin v.* - h/)[0].gsub("the ","").gsub(" - h","") }
+  }
+]},
+=end
+
+
+    end
+end
+end
+end