intrigue-ident 0.9.9 → 0.31

data/checks/http/adobe.rb

@@ -1,168 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Adobe < Intrigue::Ident::Check::Base
-
-  ### 
-  ### Handy: Metasploit: /modules/auxiliary/scanner/http/coldfusion_version.rb
-  ###
-
-  def generate_checks(url)
-    [
-      # TODO, put more work into finding coldfusion on the front page... 
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Adobe",
-        :product => "Coldfusion",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content => /CFTOKEN=/,
-        :match_details => "Adobe Coldfusion Cookie Match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      { # Coldfusion  
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Adobe",
-        :product => "Coldfusion",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /<meta name=\"Author\" content=\"Copyright \(c\) 1995\-2010 Adobe/,
-        :match_details => "body content",
-        :hide => false,
-        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
-        :require_product => "Coldfusion",
-        :inference => false
-      },
-      { # Coldfusion 6, 7  
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Adobe",
-        :references => [
-            "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/coldfusion_version.rb"
-        ],
-        :product => "Coldfusion",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content => />\s*Version:\s.*<\/strong\><br\s\//,
-        :dynamic_version => lambda {|x| 
-            version = _first_body_capture(x,/>\s*Version:\s*(.*)<\/strong\><br\s\//)
-            version =~ /^6/ ? "MX6 #{x}" : "MX7 #{x}"
-         },
-        :match_details => "Body content, version string",
-        :hide => false,
-        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
-        :require_product => "Coldfusion",
-        :inference => true
-      },
-      { # Coldfusion 10 ... this needs OR/AND ?
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Adobe",
-        :product => "Coldfusion",
-        :version => "10",
-        :match_type => :content_body,
-        :match_content => /<meta name=\"Author\" content=\"Copyright \(c\) 1995\-2010 Adobe.*1997\-2012 Adobe Systems Incorporated and its licensors/m,
-        :match_details => "body content",
-        :hide => false,
-        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
-        :require_product => "Coldfusion",
-        :inference => true
-      },
-      { # Coldfusion 11 ... this needs OR/AND ?
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Adobe",
-        :product => "Coldfusion",
-        :version => "11",
-        :match_type => :content_body,
-        :match_content => /&copy; 1997 - 2014 Adobe Systems Incorporated and its licensors/m,
-        :match_details => "body content",
-        :hide => false,
-        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
-        :require_product => "Coldfusion",
-        :inference => true
-      },
-      # 
-      { # Generic check 
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Application Server"],
-        :vendor => "Adobe",
-        :product => "Coldfusion",
-        :version => nil,
-        :dynamic_version => lambda { |x| 
-            version = _first_body_capture(x,/<meta name=\"Keywords\" content=\"(.*)\">\s+<meta name/)
-         },
-        :match_type => :content_body,
-        :match_content => /<meta name=\"Keywords\" content=\".*\">\s+<meta name/,
-        :match_details => "body content",
-        :hide => false,
-        :paths => ["#{url}/CFIDE/administrator/index.cfm"],
-        :require_product => "Coldfusion",
-        :inference => true
-      },
-
-=begin
-      # TODO .. implement array for match content (AND) and then grab the rest of these 
-      # 
-      # Check is disabled until we can find something better... ridiculous to make a 
-      # check against every URL just because we havent yet found something on the base page for AEM
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :vendor => "Adobe",
-        :tags => ["CMS","Marketing"],
-        :product => "Experience Manager",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /AEM/,
-        :match_details => "Adobe Experience Manager",
-        :hide => false,
-        :paths => ["#{url}/libs/granite/core/content/login.html"],
-        :inference => false
-      },
-=end    
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS", "Editor"],
-        :vendor => "Adobe",
-        :product => "Fireworks MX",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Fireworks MX Dreamweaver MX/,
-        :match_details => "generator string in the body",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS","Marketing", "SaaS"],
-        :vendor => "Adobe",
-        :product => "Omniture DC",
-        :version => nil,
-        :dynamic_version => lambda { |x| _first_header_capture(x,/server: Omniture DC\/(.*)/) },
-        :match_type => :content_headers,
-        :match_content => /server: Omniture DC/,
-        :match_details => "Omniture server header",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/advantshop.rb

@@ -1,33 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Advantshop < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-=begin
-
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Advantshop",
-        :product => "Advantshop",
-        :references => ["https://www.advantshop.net/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /AdVantShop.NET/i,
-        :dynamic_version => lambda { |x|  _first_body_capture(x, /AdVantShop.NET (  )/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-=end
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/afrihost.rb

@@ -1,29 +0,0 @@
-  module Intrigue
-  module Ident
-  module Check
-  class AfriHost < Intrigue::Ident::Check::Base
-
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "AfriHost",
-          :product => "AfriHost",
-          :website => "https://www.afrihost.com/",
-          :version => nil,
-          :match_type => :content_title,
-          :match_content => /Domain Parked/i,
-          :match_details => "Domain Parked",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-
-  end
-  end
-  end
-  end

data/checks/http/aftermarketpl.rb

@@ -1,46 +0,0 @@
-module Intrigue
-  module Ident
-  module Check
-  class AfterMarketPl < Intrigue::Ident::Check::Base
-  
-    def generate_checks(url)
-      [
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "AfterMarketPL",
-          :product => "AfterMarketPL",
-          :website => "https://www.aftermarket.pl/",
-          :references => [],
-          :version => nil,
-          :match_type => :content_body,
-          :match_content => /<\/strong> has been registered on <strong>/i,
-          :match_details => "<\/strong> has been registered on <strong>",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        },
-        {
-          :type => "fingerprint",
-          :category => "service",
-          :tags => ["Parked"],
-          :vendor => "AfterMarketPL",
-          :product => "AfterMarketPL",
-          :website => "https://www.aftermarket.pl/",
-          :references => [],
-          :version => nil,
-          :match_type => :content_title,
-          :match_content => /AfterMarket\.pl :: domain /i,
-          :match_details => "AfterMarket\.pl :: domain ",
-          :hide => false,
-          :paths => ["#{url}"],
-          :inference => false
-        }
-      ]
-    end
-  
-  end
-  end
-  end
-  end

data/checks/http/agility.rb

@@ -1,34 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class AgilityCMS < Intrigue::Ident::Check::Base
-
-
-  def generate_checks(url)
-    [
-=begin
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Agility",
-        :product => "AgilityCMS",
-        :references => ["https://agilitycms.com/"],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Agility CMS/i,
-        :dynamic_version => lambda { |x|  _first_body_capture(x, /Agility CMS (\d+)/i)},
-        :match_details => "header match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-=end
-    ]
-  end
-
-
-end
-end
-end
-end

data/checks/http/akamai.rb

@@ -1,88 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Akamai < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN"],
-        :vendor => "Akamai",
-        :product => "Akamai",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /server: AkamaiGHost$/i,
-        :match_details =>"ghost server header",
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["CDN"],
-        :vendor => "Akamai",
-        :product => "Akamai",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>/,
-        :match_details =>"Akamai Missing Uri",
-        :hide => true,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :vendor => "Akamai",
-        :tags => ["CDN", "WAF"],
-        :product => "Akamai",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /x-akamai-transformed:.*/,
-        :match_details =>"Akamai transformed header",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :vendor => "Akamai",
-        :tags => ["CDN", "WAF"],
-        :references => [
-            "https://learn.akamai.com/en-us/webhelp/ion/web-performance-getting-started-for-http-properties/GUID-3ABC638E-14E9-4858-BD4F-BF345BC254F3.html"
-        ], 
-        :product => "Akamai (Staging Network)",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /X-Akamai-Staging: ESSL/,
-        :match_details =>"Akamai transformed header",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }, 
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :vendor => "Akamai",
-        :tags => ["CDN", "WAF"],
-        :references => [
-            "https://learn.akamai.com/en-us/webhelp/ion/web-performance-getting-started-for-http-properties/GUID-3ABC638E-14E9-4858-BD4F-BF345BC254F3.html"
-        ],
-        :product => "Akamai (Staging Network)",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /X-Akamai-Staging: EdgeSuite/,
-        :match_details =>"Akamai transformed header",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/alkacon.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Alkacon < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Alkacon",
-        :product => "OpenCMS",
-        :references => [],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /Powered by Al Mubda version (\d.*?)<\/a>/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /Powered by Al Mubda version (\d.*?)<\/a>/i)},
-        :match_details => "footer match",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-
-end
-end
-end
-end

data/checks/http/allegro.rb

@@ -1,28 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Allegro < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Web Server","Embedded"],
-        :vendor => "Allegro",
-        :product => "RomPager",
-        :version => nil,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/Allegro-Software-RomPager\/(.*)$/i) },
-        :match_type => :content_headers,
-        :match_content =>  /server:\ Allegro-Software-RomPager/,
-        :match_details =>"server header",
-        :paths => ["#{url}"],
-        :inference => true
-      }
-    ]
-  end
-end
-end
-end
-end