simple_whatweb 0.1.0

data/lib/whatweb/plugins/osticket.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+WhatWeb::Plugin.define "osTicket" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2011-08-24
+  @version = "0.1"
+  @description = "osTicket is a widely-used open source support ticket system - Requires: PHP and MySQL"
+  @website = "http://www.osticket.com/"
+
+  # Google results as at 2011-08-24 #
+  # 511 for "SUPPORT TICKET SYSTEM" +Home "Ticket Status" "New Ticket" "Welcome to the support center"
+  #  33 for intitle:"osTicket Installer" "osTicket version" "osTicket web path and title"
+
+  # Dorks #
+  @dorks = [
+    '"SUPPORT TICKET SYSTEM" "Home" "Ticket Status" "New Ticket" "Welcome to the support center"'
+  ]
+
+  # Matches #
+  @matches = [
+
+    # Version Detection # Install Page # ./setup/install.php
+    { version: /<div id="nav">[\s]+<ul id="sub_nav">[\s]+<li>osTicket version ([^\-^<]+) - Basic installation<\/li>[\s]+<\/ul>[\s]+<\/div>/ },
+
+    # Install Page # Title # ./setup/install.php
+    { regexp: /<title>osTicket Installer<\/title>[\s]+<link rel="stylesheet" href="style\.css" media="screen">/ },
+
+    # Powered by image HTML
+    { regexp: /<a id="powered_by" href="http:\/\/osticket\.com"><img src="\.\/images\/poweredby\.jpg" width="126" height="23" alt="Powered by osTicket"><\/a><\/div>/ },
+
+  ]
+end

data/lib/whatweb/plugins/otrs.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+# Version 0.2 #
+# Updated matches and version detection
+##
+WhatWeb::Plugin.define "Open-Source-Ticket-Request-System" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2010-06-06
+  @version = "0.2"
+  @description = "OTRS is an Open source Ticket Request System (also well known as trouble ticket system) with many features to manage customer telephone calls and e-mails."
+  @website = "http://otrs.org/"
+
+  # About 529 results for "Powered by OTRS" inurl:customer.pl @ 2010-60-06
+
+  # Dorks #
+  @dorks = [
+    '"Powered by OTRS" inurl:customer.pl'
+  ]
+
+  @matches = [
+
+    # GHDB Match
+    { ghdb: '"Powered by OTRS" inurl:customer.pl', certainty: 75 },
+
+    # Default title
+    { text: '<title>OTRS  :: Login</title>' },
+
+    # Version detection # Powered by text
+    { version: /Powered by <a href="http:\/\/otrs.org[\/]*" class="small">OTRS ([^<]+)<\/a>/ },
+
+  ]
+end

data/lib/whatweb/plugins/ourdisclaimer.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+WhatWeb::Plugin.define "OurDisclaimer" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2010-10-14
+  @version = "0.1"
+  @description = "OurDisclaimer.com - Third party disclaimer service."
+  @website = "http://ourdisclaimer.com/"
+
+  # 59 results for inurl:"ourdisclaimer.com/?i=" @ 2010-10-14
+
+  @matches = [
+
+    # Get URL # Link & Image method
+    { version: /<a[^>]+href[\s]*=[\s]*"http:\/\/ourdisclaimer.com\/\?i=([^\"]+)/i },
+
+    # Get URL # Iframe method
+    { version: /<iframe[^>]+src[\s]*=[\s]*"http:\/\/ourdisclaimer.com\/\?i=([^\"]+)/i },
+
+  ]
+end

data/lib/whatweb/plugins/outlook-web-app.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+# Version 0.2 # 2011-08-08 # Brendan Coles <bcoles@gmail.com> #
+# Updated matches and version detection
+##
+WhatWeb::Plugin.define "Outlook-Web-App" do
+  @author = "Aung Khant <http://yehg.net/>" # 2011-02-03
+  @version = "0.2"
+  @description = "Outlook Web App (OWA), originally called Outlook Web Access and before that Exchange Web Connect (EWC), is a webmail service of Microsoft Exchange Server 5.0 and later. OWA is used to access e-mail (including support for S/MIME), calendars, contacts, tasks, and other mailbox content when access to the Microsoft Outlook desktop application is unavailable. In the Exchange 2007 release, OWA also offers read-only access to documents stored in Microsoft SharePoint sites and network (UNC) shares. Microsoft provides Outlook Web App as part of Exchange Server to allow users to connect remotely via a web browser."
+  @website = "http://help.outlook.com/"
+  # More info: http://en.wikipedia.org/wiki/Outlook_Web_App
+
+  # Google results as at 2011-06-06 #
+  # 125 for "To protect your account from unauthorized access, Outlook Web Access" intitle:"Microsoft Outlook Web Access"
+  #  76 for inurl:"/owa/auth/logon.aspx?url="
+
+  # Dorks #
+  @dorks = [
+    '"To protect your account from unauthorized access, Outlook Web Access" intitle:"Microsoft Outlook Web Access"',
+    'inurl:"/owa/auth/logon.aspx?url="'
+  ]
+
+  # Matches #
+  @matches = [
+
+    # body class="owaLgnBdy"
+    { text: '<body class="owaLgnBdy">' },
+
+    # Version Detection # logon.css path
+    { version: /<link type="text\/css" rel="stylesheet" href="\/owa\/([^\s^\/]+)\/themes\/base\/logon\.css">/ },
+
+    # Version Detection # warn.png path
+    { version: /<td><img src="\/owa\/([^\s^\/]+)\/themes\/base\/warn\.png"><\/td>/ },
+
+    # Version Detection # shortcut icon path
+    { version: /<link rel="shortcut icon" href="\/owa\/([^\s^\/]+)\/themes\/base\/favicon\.ico" type="image\/x-icon">/ },
+
+    # HTML Comment
+    { text: '<!-- OwaPage = ASP.auth_logon_aspx -->' },
+
+    # Form
+    { regexp: /<FORM action="(\/CookieAuth\.dll\?Logon|\/exchweb\/bin\/auth\/owaauth\.dll)" method="POST" name="logonForm"/i },
+
+    # URL Pattern # /exchweb/bin/auth/owalogon.asp
+    { ghdb: 'inurl:/exchweb/bin/auth/owalogon.asp' },
+
+    # /exchweb/bin/auth/owalogon.asp?url=https://1&reason=2 # You could not be logged on to
+    { name: 'html body', url: '/exchweb/bin/auth/owalogon.asp?url=https://1&reason=2', text: '<TR><TD><P style="color:red">You could not be logged on to' },
+
+    # /CookieAuth.dll?GetLogon?url=/&reason=2 # You could not be logged on to
+    { name: 'html body', url: '/CookieAuth.dll?GetLogon?url=/&reason=2', text: '<TR><TD><P style="color:red">You could not be logged on to' },
+
+    # Title
+    { name: 'html title', text: '<TITLE>Microsoft Outlook Web Access</TITLE>' },
+
+    # Edition Year Detection
+    { string: /<IMG title="Microsoft Office Outlook Web Access provided by Microsoft Exchange Server ([\d]{4})" alt="Microsoft Office Outlook Web Access provided by Microsoft Exchange Server ([\d]{4})" height=62 src="\/exchweb\/img\/logon_logo\.gif" width=331 border=0 hspace=0>/ },
+
+    # browser settings must allow scripts to run message HTML
+    { text: '<td style="width:100%">To use Outlook Web App, browser settings must allow scripts to run. For information about how to allow scripts, consult the Help for your browser. If your browser doesn\'t support scripts, you can download <a href="http://www.microsoft.com/windows/ie/downloads/default.mspx">Windows Internet Explorer</a> for access to Outlook Web App.</td>' },
+
+  ]
+
+  # Passive #
+  def passive(target)
+    m = []
+
+    # Version Detection # x-owa-version HTTP Header
+    m << { version: target.headers["x-owa-version"].to_s } unless target.headers["x-owa-version"].nil?
+
+    # Active Directory Domain Detection
+    if /<!--Copyright \(c\) 2000-20[\d]{2} Microsoft Corporation\.  All rights reserved\.-->/.match?(target.body)
+      if target.body =~ /logonForm\.username\.value[\s]*=[\s]*"([^"^\\]+)\\\\"/i
+        m << { string: "AD Domain: #{$1}" }
+      elsif target.body =~ /document\.getElementById\("username"\)\.value = '([^']+)'/i
+        m << { string: "AD Domain: #{$1}" }
+      end
+    end
+
+    # Return passive matches
+    m
+  end
+end

data/lib/whatweb/plugins/ovbb.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+WhatWeb::Plugin.define "OvBB" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2010-09-26
+  @version = "0.2"
+  @description = "Written in PHP and powered by MySQL, OvBB is a light-weight and fast discussion board system that mimics vBulletin 2 in both look and behavior while incorporating new features and functionality."
+  @website = "http://sourceforge.net/projects/ovbb/"
+
+  # Google results for 2010-09-26 #
+  # 34 for "powered by OvBB"
+
+  # Dorks #
+  @dorks = [
+    '"powered by OvBB"'
+  ]
+
+  # Matches #
+  @matches = [
+
+    # Default title
+    { regexp: /<title>[^:]+:: Powered by OvBB<\/title>/ },
+
+    # Default logo HTML
+    { regexp: /<img src="images\/ovbb.png" align="middle" border="0" alt="[^:]+:: Powered by OvBB" \/><\/a>/ },
+
+    # Default favicon
+    { md5: "8dd1c74458a43d658a9136333893a999", url: "/favicon.ico" },
+
+    # Database error page
+    { text: '<p>Please try again by pressing the <a href="javascript:window.location=window.location;">refresh</a> button in your browser. An e-mail message has been dispatched to the <a href="mailto:' },
+
+    # Version Detection
+    { version: /<a style="color: #EEEEFF;" href="http:\/\/www.ovbb.org">Powered by OvBB V([\d\.a-z]+)<\/a><br \/><br \/>/ },
+
+  ]
+end

data/lib/whatweb/plugins/owl-intranet-engine.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+WhatWeb::Plugin.define "Owl-Intranet-Engine" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2012-08-30
+  @version = "0.1"
+  @description = "Owl is a multi user document repository (knowledge base) system written in PHP for publishing files/documents onto the web."
+  @website = "http://owl.anytimecomm.com"
+
+  # ShodanHQ results as at 2012-08-30 #
+  # 87 for owl_sessid
+
+  # Google results as at 2012-08-30 #
+  # 143 for "Owl Intranet Engine, Version Owl" "Username" "Password"
+
+  # Dorks #
+  @dorks = [
+    '"Owl Intranet Engine, Version Owl" "Username" "Password"'
+  ]
+
+  # Matches #
+  @matches = [
+
+    # Cookie # owl_sessid
+    { search: "headers[set-cookie]", regexp: /owl_sessid=/ },
+
+    # Footer # Version Detection
+    { version: /<a class="version2" href="http:\/\/owl\.sourceforge\.net\/" target="_blank">Owl Intranet Engine, Version Owl ([^<]+)<\/a>/ },
+
+    # Title # # Version Detection
+    { version: /<title>[^<]+ Owl ([\d\.]+ [\d]{8})<\/title>/ },
+
+  ]
+end

data/lib/whatweb/plugins/ownserver.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+# Version 0.2 # 2016-04-23 # Andrew Horton
+# Moved patterns from passive function to matches[]
+##
+WhatWeb::Plugin.define "OwnServer" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2011-05-16
+  @version = "0.2"
+  @description = "OwnServer is a web server used as a webserver for watching security cameras remotly. It allows broadcasting live streaming video on the web through the built-in webserver."
+  @website = "http://www.anteco.co.il/"
+
+  # ShodanHQ results as at 2011-05-16 #
+  # 26,527 for OwnServer
+
+  @matches = [
+    # HTTP Server Header
+    { regexp: /^OwnServer/, search: "headers[server]" },
+
+    # Version Detection
+    { version: /^OwnServer([\d\.]+)$/, search: "headers[server]" },
+
+  ]
+end

data/lib/whatweb/plugins/packetshaper.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+WhatWeb::Plugin.define "PacketShaper" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2011-04-19
+  @version = "0.1"
+  @description = "The Blue Coat PacketShaper provides application performance monitoring for an accurate picture of network traffic and ensures business-critical applications have the resources they need to operate effectively"
+  @website = "http://www.bluecoat.com/products/packetshaper"
+  # Datasheet: http://www.bluecoat.com/doc/7941
+
+  # ShodanHQ results as at 2011-04-19 #
+  # 47 for PSlcV310
+
+  # Google results as at 2011-04-19 #
+  # 29 for (intitle:"PacketShaper Login")|(intitle:"PacketShaper Customer Login") -intitle
+
+  # Dorks #
+  @dorks = [
+    '(intitle:"PacketShaper Login")|(intitle:"PacketShaper Customer Login") -intitle'
+  ]
+
+  # Matches #
+  @matches = [
+
+    # Default title
+    { text: '<title>PacketShaper Customer Login</title>' },
+
+    # JavaScript
+    { text: '<SCRIPT LANGUAGE=JavaScript SRC="/libmd5.js"></SCRIPT>' },
+
+  ]
+
+  # Passive #
+  def passive(target)
+    m = []
+
+    # PScfgstr cookie
+    if /^PScfgstr=/.match?(target.headers['set-cookie'])
+
+      m << { name: "PScfgstr cookie" }
+
+      # Model Detection
+      m << { model: target.body.scan(/desc \+= '<FONT SIZE=\+2><I>PacketShaper ([\d\.]+)<\/I><\/FONT>';/) } if target.body =~ /desc \+= '<FONT SIZE=\+2><I>PacketShaper ([\d\.]+)<\/I><\/FONT>';/
+
+    end
+
+    # Return passive matches
+    m
+  end
+end

data/lib/whatweb/plugins/packetwave.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+WhatWeb::Plugin.define "PacketWave" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2012-05-11
+  @version = "0.1"
+  @description = "Some sort of wireless broadband contraption from Aperto Networks"
+  @website = "http://www.apertonet.com/products/pmax_productline.html"
+
+  # ShodanHQ results as at 2011-05-11 #
+  # 73 for PacketWave
+
+  # Matches #
+  @matches = [
+
+    # input button # goto
+    { text: '<td bgcolor="#cccccc" colspan=2 align="center"><input type="button" name="goto" value="Log On" onClick="encode_submit(this.form)">' },
+
+  ]
+end

data/lib/whatweb/plugins/pagecookery-microblog.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+WhatWeb::Plugin.define "PageCookery-Microblog" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2011-03-06
+  @version = "0.1"
+  @description = "Blog [Chinese]"
+  @website = "http://www.pagecookery.com/"
+
+  # Google results as at 2011-03-06 #
+  # 384 for "Powered by PageCookery Microblog"
+
+  # Dorks #
+  @dorks = [
+    '"Powered by PageCookery Microblog"'
+  ]
+
+  # Matches #
+  @matches = [
+
+    # Version detection # Powered by footer
+    { version: /Powered by <a href="http:\/\/pagecookery.com\/" target="_blank">PageCookery<\/a> Microblog ([\d\.]{1,5})/ },
+
+  ]
+end

data/lib/whatweb/plugins/pageup-people.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+##
+# This file is part of WhatWeb and may be subject to
+# redistribution and commercial restrictions. Please see the WhatWeb
+# web site for more information on licensing and terms of use.
+# http://www.morningstarsecurity.com/research/whatweb
+##
+# Version 0.2 # 2016-04-17 # Andrew Horton
+# Added website parameter and description
+##
+WhatWeb::Plugin.define "PageUp-People" do
+  @author = "Brendan Coles <bcoles@gmail.com>" # 2010-07-03
+  @version = "0.2"
+  @description = "PageUpPeople is a commercial SaaS platform to recruit, onboard, train, develop, manage and retain employees."
+  @website = "http://www.pageuppeople.com/"
+
+  # Google results as at 2010-07-02 #
+  # 216 for "Powered by PageUp People"
+
+  # Dorks #
+  @dorks = [
+    '"Powered by PageUp People"'
+  ]
+
+  # Matches #
+  @matches = [
+
+    # GHDB
+    { ghdb: '"Powered by PageUp People"', certainty: 75 },
+
+    # Powered by text
+    { text: '<a class="pageupLink" href="http://www.pageuppeople.com" target="self">Powered by PageUp People</a>' },
+
+  ]
+
+  # Passive #
+  def passive(target)
+    m = []
+
+    # sPULastSelectedLanguage Cookie
+    m << { name: "sPULastSelectedLanguage Cookie" } if target.headers["set-cookie"] =~ /sPULastSelectedLanguage=/
+
+    # Return passive matches
+    m
+  end
+end