intrigue-ident 0.9.9 → 0.31

data/checks/http/appdynamics.rb

@@ -1,43 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Appdynamics < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["APM", "Javascript"],
-        :website => "https://www.appdynamics.com/",
-        :vendor => "AppDynamics",
-        :product => "AppDynamics",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_details =>"",
-        :match_content =>  /ADRUM_BTa=/,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["APM", "Javascript"],
-        :website => "https://www.appdynamics.com/",
-        :vendor => "AppDynamics",
-        :product => "AppDynamics",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_details =>"",
-        :match_content =>  /ADRUM_BT1=/,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-end
-end
-end
-end

data/checks/http/arris.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Arris < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["Embedded","Networking"],
-        :website => "http://www.arrisi.com/",
-        :vendor => "Arris",
-        :product => "2307 Modem",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /<meta name="description" content="ARRIS 2307">/,
-        :match_details =>"unique string, admin page?",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false,
-        :examples => ["<meta name=\"description\" content=\"ARRIS 2307\">"]
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/artifactory.rb

@@ -1,30 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Artifactory < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Development", "Security"],
-        :website => "https://jfrog.com/artifactory/",
-        :vendor => "Artifactory",
-        :product => "Artifactory",
-        :version => nil,
-        :dynamic_version => lambda { |x|
-          _first_header_capture(x,/server: Artifactory\/(.*)$/i) },
-        :match_type => :content_headers,
-        :match_content =>  /server: Artifactory/,
-        :match_details =>"server header",
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/aruba.rb

@@ -1,27 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Aruba < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "operating_system",
-        :tags => ["Networking", "COTS", "Wireless"],
-        :vendor => "Aruba Networks",
-        :product => "Aruba OS",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /arubalp=/,
-        :match_details =>"Matches an aruba link, generic identifier",
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/atlassian.rb

@@ -1,152 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Atlassian < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Development"],
-        :vendor => "Atlassian",
-        :product =>"BitBucket",
-        :match_details =>"Atlassian BitBucket",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /com.atlassian.bitbucket.server/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Development"],
-        :vendor => "Atlassian",
-        :product =>"Confluence",
-        :match_details =>"Atlassian Confluence",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /X-Confluence-Request-Time/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Development"],
-        :vendor => "Atlassian",
-        :product =>"Crucible",
-        :match_details =>"Atlassian Crucible",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /FishEye and Crucible/,
-        :dynamic_version => lambda{ |x|
-          _first_body_capture(x, /Log in to FishEye and Crucible (.*)\</)
-        },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Development"],
-        :vendor => "Atlassian",
-        :product =>"Hipchat",
-        :match_details =>"Atlassian Hipchat",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /\$\(document\).trigger\('hipchat.load'\);/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Development"],
-        :vendor => "Atlassian",
-        :product =>"Jira",
-        :match_details =>"Atlassian Jira",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /jira.webresources/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["COTS", "Development"],
-        :vendor => "Atlassian",
-        :product =>"Jira",
-        :match_details =>"Atlassian Jira",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /atlassian.xsrf.token=/i,
-        :dynamic_version => lambda{ |x|
-            _first_body_capture(x,/<meta name="ajs-version-number" content="(.*)">/) },
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["SaaS", "Development", "Proxy"],
-        :vendor => "Atlassian",
-        :product =>"Proxy",
-        :references => ["https://community.atlassian.com/t5/Jira-questions/REST-API-not-returning-any-data-with-API-token/qaq-p/1292806"],
-        :match_details =>"proxy server header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content => /^server: AtlassianProxy\/[\d\.]+$/i,
-        :dynamic_version => lambda{ |x|
-          _first_header_capture(x,/^server: AtlassianProxy\/([\d\.]+)$/i) },
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["SaaS", "Development", "SaaS"],
-        :vendor => "Atlassian",
-        :product =>"Statuspage",
-        :match_details =>"statuspage icon",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /logos-statuspage-logo-gradient-neutral.svg/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["SaaS", "Development", "SaaS"],
-        :vendor => "Atlassian",
-        :product =>"Statuspage",
-        :match_details =>"statuspage header",
-        :version => nil,
-        :match_type => :content_heades,
-        :match_content =>  /^x-statuspage-skip-logging:.*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["SaaS", "Development", "SaaS"],
-        :vendor => "Atlassian",
-        :product =>"Statuspage",
-        :match_details =>"statuspage header",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /^x-statuspage-version:.*$/i,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/auth0.rb

@@ -1,44 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Auth0 < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["IAM", "SaaS", "Security"],
-        :vendor => "Auth0",
-        :product => "Auth0",
-        :references => [],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /window.auth0AnalyticsOptions/i,
-        :match_details => "Auth0 analytics",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "service",
-        :tags => ["IAM", "SaaS", "Security"],
-        :vendor => "Auth0",
-        :product => "Auth0",
-        :references => [],
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /\/auth0/i,
-        :match_details => "Auth0 link",
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      }
-    ]
-  end
-  
-end
-end
-end
-end

data/checks/http/automattic.rb

@@ -1,292 +0,0 @@
-module Intrigue
-module Ident
-module Check
-class Automattic < Intrigue::Ident::Check::Base
-
-  def generate_checks(url)
-    [
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"wordpress test cookie",
-        :version => nil,
-        :match_type => :content_cookies,
-        :match_content =>  /wordpress_test_cookie=/i,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"wordpress login page",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /class=\"login login-action-login wp-core-ui/i,
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"wordpress generator tag",
-        :version => nil,
-        :match_type => :content_generator,
-        :match_content =>  /WordPress/i,
-        :dynamic_version => lambda { |x| _first_generator_capture(x, /WordPress\ ([\d\.]+)/i)},
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"wp-embed link",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /wp-includes\/js\/wp-embed.min.js\?ver=([\d\.]+)\'/i,
-        :dynamic_version => lambda { |x| _first_body_capture(x, /wp-includes\/js\/wp-embed.min.js\?ver=([\d\.]+)\'/i)},
-        :hide => false,
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"version string",
-        :version => nil,
-        :references => ["https://github.com/caffeinewriter/wp-fingerprinter/blob/master/wp-fingerprint.py"],
-        :match_type => :content_cookies,
-        :match_content =>  /Version ([\d\.]+)/i,
-        :dynamic_version => lambda { |x| _first_generator_capture(x, /Version ([\d\.]+)/i) },
-        :hide => false,
-        :require_product => "Wordpress",
-        :paths => ["#{url}"],
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"common link",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content => /src=\'\/wp-includes\/js\/jquery\/jquery-new\.js\'\>/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"common link",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /<link rel='https:\/\/api.w.org\/'/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS", "SaaS"],
-        :vendor =>"Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"unique header for hosted service",
-        :version => nil,
-        :match_type => :content_headers,
-        :match_content =>  /x-hacker: If you're reading this, you should visit automattic.com/,
-        :paths => ["#{url}"],
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress WP-JSON endpoint",
-        :version => nil,
-        :match_type => :content_body,
-        :match_content =>  /gmt_offset/,
-        :paths => ["#{url}/wp-json"],
-        :require_product => "Wordpress",
-        :inference => false
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.0",
-        :match_type => :checksum_body,
-        :match_content => "a306a72ce0f250e5f67132dc6bcb2ccb",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.1",
-        :match_type => :checksum_body,
-        :match_content => "4f04728cb4631a553c4266c14b9846aa",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.2",
-        :match_type => :checksum_body,
-        :match_content => "25e1e78d5b0c221e98e14c6e8c62084f",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.3",
-        :match_type => :checksum_body,
-        :match_content => "83c83d0f0a71bd57c320d93e59991c53",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.5",
-        :match_type => :checksum_body,
-        :match_content => "7293453cf0ff5a9a4cfe8cebd5b5a71a",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.6",
-        :match_type => :checksum_body,
-        :match_content => "61740709537bd19fb6e03b7e11eb8812",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.7",
-        :match_type => :checksum_body,
-        :match_content => "e6bbc53a727f3af003af272fd229b0b2",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.7.1",
-        :match_type => :checksum_body,
-        :match_content => "e6bbc53a727f3af003af272fd229b0b2",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      },
-      {
-        :type => "fingerprint",
-        :category => "application",
-        :tags => ["CMS"],
-        :vendor => "Wordpress",
-        :product =>"Wordpress",
-        :match_details =>"Wordpress TinyMCE Editor",
-        :references => ["https://dcid.me/texts/fingerprinting-web-apps.html"],
-        :version => "2.9.1",
-        :match_type => :checksum_body,
-        :match_content => "128e75ed19d49a94a771586bf83265ec",
-        :paths => ["#{url}/wp-includes/js/tinymce/tiny_mce.js"],
-        :require_product => "Wordpress",
-        :inference => true
-      }
-    ]
-  end
-
-=begin
-all_checks = [{
-:url => "#{url}",
-:checklist => [
-{
-  :product =>"Yoast Wordpress SEO Plugin", # won't be used if we have
-  :match_details =>"Yoast Wordpress SEO Plugin",
-  :match_type => "content",
-  :match_content =>  /<!-- \/ Yoast WordPress SEO plugin. -->/,
-  :test_site => "https://ip-50-62-231-56.ip.secureserver.net",
-  :dynamic_name => lambda{|x| x.scan(/the Yoast WordPress SEO plugin v.* - h/)[0].gsub("the ","").gsub(" - h","") }
-}
-]},
-=end
-
-end
-end
-end
-end