fingerprint-mcp 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +663 -0
- package/README.ar.md +767 -0
- package/README.bn.md +767 -0
- package/README.bs.md +767 -0
- package/README.da.md +767 -0
- package/README.de.md +770 -0
- package/README.el.md +767 -0
- package/README.es.md +769 -0
- package/README.fr.md +769 -0
- package/README.hi.md +767 -0
- package/README.it.md +767 -0
- package/README.ja.md +767 -0
- package/README.ko.md +772 -0
- package/README.md +767 -0
- package/README.no.md +767 -0
- package/README.pl.md +767 -0
- package/README.pt-BR.md +767 -0
- package/README.ru.md +767 -0
- package/README.th.md +767 -0
- package/README.tr.md +767 -0
- package/README.uk.md +767 -0
- package/README.vi.md +767 -0
- package/README.zh-TW.md +768 -0
- package/README.zh.md +768 -0
- package/dist/app/index.d.ts +3 -0
- package/dist/app/index.d.ts.map +1 -0
- package/dist/app/index.js +614 -0
- package/dist/app/index.js.map +1 -0
- package/dist/composite/analyze.d.ts +3 -0
- package/dist/composite/analyze.d.ts.map +1 -0
- package/dist/composite/analyze.js +59 -0
- package/dist/composite/analyze.js.map +1 -0
- package/dist/composite/correlate.d.ts +3 -0
- package/dist/composite/correlate.d.ts.map +1 -0
- package/dist/composite/correlate.js +184 -0
- package/dist/composite/correlate.js.map +1 -0
- package/dist/composite/enumerate.d.ts +3 -0
- package/dist/composite/enumerate.d.ts.map +1 -0
- package/dist/composite/enumerate.js +94 -0
- package/dist/composite/enumerate.js.map +1 -0
- package/dist/composite/helpers.d.ts +22 -0
- package/dist/composite/helpers.d.ts.map +1 -0
- package/dist/composite/helpers.js +111 -0
- package/dist/composite/helpers.js.map +1 -0
- package/dist/composite/index.d.ts +3 -0
- package/dist/composite/index.d.ts.map +1 -0
- package/dist/composite/index.js +29 -0
- package/dist/composite/index.js.map +1 -0
- package/dist/composite/meta.d.ts +3 -0
- package/dist/composite/meta.d.ts.map +1 -0
- package/dist/composite/meta.js +23 -0
- package/dist/composite/meta.js.map +1 -0
- package/dist/composite/osint.d.ts +3 -0
- package/dist/composite/osint.d.ts.map +1 -0
- package/dist/composite/osint.js +40 -0
- package/dist/composite/osint.js.map +1 -0
- package/dist/composite/recon.d.ts +3 -0
- package/dist/composite/recon.d.ts.map +1 -0
- package/dist/composite/recon.js +131 -0
- package/dist/composite/recon.js.map +1 -0
- package/dist/composite/scan-dns.d.ts +3 -0
- package/dist/composite/scan-dns.d.ts.map +1 -0
- package/dist/composite/scan-dns.js +44 -0
- package/dist/composite/scan-dns.js.map +1 -0
- package/dist/composite/scan-http.d.ts +3 -0
- package/dist/composite/scan-http.d.ts.map +1 -0
- package/dist/composite/scan-http.js +68 -0
- package/dist/composite/scan-http.js.map +1 -0
- package/dist/composite/scan-paths.d.ts +3 -0
- package/dist/composite/scan-paths.d.ts.map +1 -0
- package/dist/composite/scan-paths.js +32 -0
- package/dist/composite/scan-paths.js.map +1 -0
- package/dist/composite/scan-ports.d.ts +3 -0
- package/dist/composite/scan-ports.d.ts.map +1 -0
- package/dist/composite/scan-ports.js +79 -0
- package/dist/composite/scan-ports.js.map +1 -0
- package/dist/composite/scan-services.d.ts +3 -0
- package/dist/composite/scan-services.d.ts.map +1 -0
- package/dist/composite/scan-services.js +111 -0
- package/dist/composite/scan-services.js.map +1 -0
- package/dist/composite/scan-tls.d.ts +3 -0
- package/dist/composite/scan-tls.d.ts.map +1 -0
- package/dist/composite/scan-tls.js +32 -0
- package/dist/composite/scan-tls.js.map +1 -0
- package/dist/composite/scan-waf.d.ts +3 -0
- package/dist/composite/scan-waf.d.ts.map +1 -0
- package/dist/composite/scan-waf.js +35 -0
- package/dist/composite/scan-waf.js.map +1 -0
- package/dist/correlation/index.d.ts +3 -0
- package/dist/correlation/index.d.ts.map +1 -0
- package/dist/correlation/index.js +1044 -0
- package/dist/correlation/index.js.map +1 -0
- package/dist/data/analytics-patterns.d.ts +21 -0
- package/dist/data/analytics-patterns.d.ts.map +1 -0
- package/dist/data/analytics-patterns.js +449 -0
- package/dist/data/analytics-patterns.js.map +1 -0
- package/dist/data/app-signatures.d.ts +52 -0
- package/dist/data/app-signatures.d.ts.map +1 -0
- package/dist/data/app-signatures.js +1143 -0
- package/dist/data/app-signatures.js.map +1 -0
- package/dist/data/c2-signatures.d.ts +54 -0
- package/dist/data/c2-signatures.d.ts.map +1 -0
- package/dist/data/c2-signatures.js +256 -0
- package/dist/data/c2-signatures.js.map +1 -0
- package/dist/data/cloud-ranges.d.ts +34 -0
- package/dist/data/cloud-ranges.d.ts.map +1 -0
- package/dist/data/cloud-ranges.js +628 -0
- package/dist/data/cloud-ranges.js.map +1 -0
- package/dist/data/cookie-patterns.d.ts +28 -0
- package/dist/data/cookie-patterns.d.ts.map +1 -0
- package/dist/data/cookie-patterns.js +225 -0
- package/dist/data/cookie-patterns.js.map +1 -0
- package/dist/data/error-signatures.d.ts +19 -0
- package/dist/data/error-signatures.d.ts.map +1 -0
- package/dist/data/error-signatures.js +321 -0
- package/dist/data/error-signatures.js.map +1 -0
- package/dist/data/favicon-hashes.d.ts +25 -0
- package/dist/data/favicon-hashes.d.ts.map +1 -0
- package/dist/data/favicon-hashes.js +249 -0
- package/dist/data/favicon-hashes.js.map +1 -0
- package/dist/data/h2-signatures.d.ts +50 -0
- package/dist/data/h2-signatures.d.ts.map +1 -0
- package/dist/data/h2-signatures.js +211 -0
- package/dist/data/h2-signatures.js.map +1 -0
- package/dist/data/header-order.d.ts +38 -0
- package/dist/data/header-order.d.ts.map +1 -0
- package/dist/data/header-order.js +185 -0
- package/dist/data/header-order.js.map +1 -0
- package/dist/data/jarm-signatures.d.ts +25 -0
- package/dist/data/jarm-signatures.d.ts.map +1 -0
- package/dist/data/jarm-signatures.js +213 -0
- package/dist/data/jarm-signatures.js.map +1 -0
- package/dist/data/saas-patterns.d.ts +23 -0
- package/dist/data/saas-patterns.d.ts.map +1 -0
- package/dist/data/saas-patterns.js +139 -0
- package/dist/data/saas-patterns.js.map +1 -0
- package/dist/data/sensitive-paths.d.ts +12 -0
- package/dist/data/sensitive-paths.d.ts.map +1 -0
- package/dist/data/sensitive-paths.js +1539 -0
- package/dist/data/sensitive-paths.js.map +1 -0
- package/dist/data/service-banners.d.ts +59 -0
- package/dist/data/service-banners.d.ts.map +1 -0
- package/dist/data/service-banners.js +323 -0
- package/dist/data/service-banners.js.map +1 -0
- package/dist/data/smtp-signatures.d.ts +12 -0
- package/dist/data/smtp-signatures.d.ts.map +1 -0
- package/dist/data/smtp-signatures.js +350 -0
- package/dist/data/smtp-signatures.js.map +1 -0
- package/dist/data/takeover-patterns.d.ts +37 -0
- package/dist/data/takeover-patterns.d.ts.map +1 -0
- package/dist/data/takeover-patterns.js +249 -0
- package/dist/data/takeover-patterns.js.map +1 -0
- package/dist/data/tech-patterns.d.ts +44 -0
- package/dist/data/tech-patterns.d.ts.map +1 -0
- package/dist/data/tech-patterns.js +690 -0
- package/dist/data/tech-patterns.js.map +1 -0
- package/dist/data/waf-signatures.d.ts +21 -0
- package/dist/data/waf-signatures.d.ts.map +1 -0
- package/dist/data/waf-signatures.js +318 -0
- package/dist/data/waf-signatures.js.map +1 -0
- package/dist/dns/index.d.ts +3 -0
- package/dist/dns/index.d.ts.map +1 -0
- package/dist/dns/index.js +1067 -0
- package/dist/dns/index.js.map +1 -0
- package/dist/enum/index.d.ts +3 -0
- package/dist/enum/index.d.ts.map +1 -0
- package/dist/enum/index.js +818 -0
- package/dist/enum/index.js.map +1 -0
- package/dist/h2/index.d.ts +3 -0
- package/dist/h2/index.d.ts.map +1 -0
- package/dist/h2/index.js +414 -0
- package/dist/h2/index.js.map +1 -0
- package/dist/http/index.d.ts +3 -0
- package/dist/http/index.d.ts.map +1 -0
- package/dist/http/index.js +2444 -0
- package/dist/http/index.js.map +1 -0
- package/dist/identify/index.d.ts +3 -0
- package/dist/identify/index.d.ts.map +1 -0
- package/dist/identify/index.js +447 -0
- package/dist/identify/index.js.map +1 -0
- package/dist/index.d.ts +3 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +165 -0
- package/dist/index.js.map +1 -0
- package/dist/infra/index.d.ts +3 -0
- package/dist/infra/index.d.ts.map +1 -0
- package/dist/infra/index.js +989 -0
- package/dist/infra/index.js.map +1 -0
- package/dist/iot/index.d.ts +3 -0
- package/dist/iot/index.d.ts.map +1 -0
- package/dist/iot/index.js +610 -0
- package/dist/iot/index.js.map +1 -0
- package/dist/meta/index.d.ts +3 -0
- package/dist/meta/index.d.ts.map +1 -0
- package/dist/meta/index.js +442 -0
- package/dist/meta/index.js.map +1 -0
- package/dist/osint/index.d.ts +3 -0
- package/dist/osint/index.d.ts.map +1 -0
- package/dist/osint/index.js +687 -0
- package/dist/osint/index.js.map +1 -0
- package/dist/passive/index.d.ts +3 -0
- package/dist/passive/index.d.ts.map +1 -0
- package/dist/passive/index.js +944 -0
- package/dist/passive/index.js.map +1 -0
- package/dist/path/index.d.ts +3 -0
- package/dist/path/index.d.ts.map +1 -0
- package/dist/path/index.js +878 -0
- package/dist/path/index.js.map +1 -0
- package/dist/protocol/mcp-server.d.ts +4 -0
- package/dist/protocol/mcp-server.d.ts.map +1 -0
- package/dist/protocol/mcp-server.js +32 -0
- package/dist/protocol/mcp-server.js.map +1 -0
- package/dist/protocol/tools.d.ts +3 -0
- package/dist/protocol/tools.d.ts.map +1 -0
- package/dist/protocol/tools.js +5 -0
- package/dist/protocol/tools.js.map +1 -0
- package/dist/service/index.d.ts +3 -0
- package/dist/service/index.d.ts.map +1 -0
- package/dist/service/index.js +1053 -0
- package/dist/service/index.js.map +1 -0
- package/dist/smtp/index.d.ts +3 -0
- package/dist/smtp/index.d.ts.map +1 -0
- package/dist/smtp/index.js +437 -0
- package/dist/smtp/index.js.map +1 -0
- package/dist/ssh/index.d.ts +3 -0
- package/dist/ssh/index.d.ts.map +1 -0
- package/dist/ssh/index.js +676 -0
- package/dist/ssh/index.js.map +1 -0
- package/dist/tcp/index.d.ts +3 -0
- package/dist/tcp/index.d.ts.map +1 -0
- package/dist/tcp/index.js +369 -0
- package/dist/tcp/index.js.map +1 -0
- package/dist/timing/index.d.ts +3 -0
- package/dist/timing/index.d.ts.map +1 -0
- package/dist/timing/index.js +425 -0
- package/dist/timing/index.js.map +1 -0
- package/dist/tls/index.d.ts +3 -0
- package/dist/tls/index.d.ts.map +1 -0
- package/dist/tls/index.js +1332 -0
- package/dist/tls/index.js.map +1 -0
- package/dist/types/index.d.ts +26 -0
- package/dist/types/index.d.ts.map +1 -0
- package/dist/types/index.js +8 -0
- package/dist/types/index.js.map +1 -0
- package/dist/utils/cache.d.ts +11 -0
- package/dist/utils/cache.d.ts.map +1 -0
- package/dist/utils/cache.js +35 -0
- package/dist/utils/cache.js.map +1 -0
- package/dist/utils/murmurhash3.d.ts +3 -0
- package/dist/utils/murmurhash3.d.ts.map +1 -0
- package/dist/utils/murmurhash3.js +57 -0
- package/dist/utils/murmurhash3.js.map +1 -0
- package/dist/utils/rate-limiter.d.ts +10 -0
- package/dist/utils/rate-limiter.d.ts.map +1 -0
- package/dist/utils/rate-limiter.js +35 -0
- package/dist/utils/rate-limiter.js.map +1 -0
- package/dist/utils/require-key.d.ts +2 -0
- package/dist/utils/require-key.d.ts.map +1 -0
- package/dist/utils/require-key.js +8 -0
- package/dist/utils/require-key.js.map +1 -0
- package/dist/waf/index.d.ts +3 -0
- package/dist/waf/index.d.ts.map +1 -0
- package/dist/waf/index.js +767 -0
- package/dist/waf/index.js.map +1 -0
- package/dist/web/index.d.ts +3 -0
- package/dist/web/index.d.ts.map +1 -0
- package/dist/web/index.js +1366 -0
- package/dist/web/index.js.map +1 -0
- package/package.json +66 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"app-signatures.js","sourceRoot":"","sources":["../../src/data/app-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAoCH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IAErD,qDAAqD;IACrD,YAAY;IACZ,qDAAqD;IACrD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,+DAA+D;aAChE;YACD,KAAK,EAAE;gBACL,cAAc;gBACd,eAAe;gBACf,YAAY;gBACZ,eAAe;gBACf,WAAW;gBACX,aAAa;gBACb,cAAc;aACf;YACD,OAAO,EAAE;gBACP,kBAAkB;gBAClB,qBAAqB;gBACrB,sBAAsB;gBACtB,6BAA6B;aAC9B;YACD,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,CAAC;YAC3D,OAAO,EAAE,CAAC,+BAA+B,EAAE,kBAAkB,CAAC;YAC9D,OAAO,EAAE;gBACP,cAAc,EAAE,WAAW;gBAC3B,IAAI,EAAE,sCAAsC;gBAC5C,YAAY,EAAE,kBAAkB;aACjC;YACD,IAAI,EAAE;gBACJ,YAAY;gBACZ,qBAAqB;gBACrB,SAAS;aACV;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,uCAAuC;YAC/C,OAAO,EAAE,wBAAwB;SAClC;KACF;IAED,qDAAqD;IACrD,SAAS;IACT,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,4DAA4D;aAC7D;YACD,KAAK,EAAE;gBACL,uBAAuB;gBACvB,sBAAsB;gBACtB,QAAQ;gBACR,aAAa;gBACb,gBAAgB;gBAChB,eAAe;gBACf,WAAW;aACZ;YACD,OAAO,EAAE;gBACP,aAAa;gBACb,aAAa;gBACb,mBAAmB;gBACnB,qBAAqB;aACtB;YACD,OAAO,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;YACxD,OAAO,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;YACjD,OAAO,EAAE;gBACP,gBAAgB,EAAE,cAAc;gBAChC,wBAAwB,EAAE,0BAA0B;gBACpD,aAAa,EAAE,SAAS;aACzB;YACD,IAAI,EAAE;gBACJ,sBAAsB;gBACtB,aAAa;gBACb,gBAAgB;aACjB;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,qCAAqC;YAC7C,OAAO,EAAE,qBAAqB;SAC/B;KACF;IAED,qDAAqD;IACrD,SAAS;IACT,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,+CAA+C;aAChD;YACD,KAAK,EAAE;gBACL,iBAAiB;gBACjB,cAAc;gBACd,WAAW;gBACX,aAAa;gBACb,mBAAmB;gBACnB,WAAW;gBACX,oBAAoB;aACrB;YACD,OAAO,EAAE;gBACP,4BAA4B;gBAC5B,gBAAgB;gBAChB,yBAAyB;aAC1B;YACD,OAAO,EAAE,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YAC5C,OAAO,EAAE,CAAC,cAAc,CAAC;YACzB,OAAO,EAAE,EAAE;YACX,IAAI,EAAE;gBACJ,aAAa;gBACb,oBAAoB;aACrB;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,iEAAiE;YACzE,OAAO,EAAE,qCAAqC;SAC/C;KACF;IAED,qDAAqD;IACrD,YAAY;IACZ,qDAAqD;IACrD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,2DAA2D;aAC5D;YACD,KAAK,EAAE;gBACL,aAAa;gBACb,SAAS;gBACT,kBAAkB;gBAClB,gBAAgB;aACjB;YACD,OAAO,EAAE;gBACP,2BAA2B;gBAC3B,8BAA8B;aAC/B;YACD,OAAO,EAAE,CAAC,OAAO,CAAC;YAClB,OAAO,EAAE;gBACP,sBAAsB,EAAE,GAAG;aAC5B;YACD,IAAI,EAAE;gBACJ,YAAY;gBACZ,YAAY;gBACZ,YAAY;aACb;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,oBAAoB;SAC9B;KACF;IAED,qDAAqD;IACrD,QAAQ;IACR,qDAAqD;IACrD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,8CAA8C;aAC/C;YACD,KAAK,EAAE;gBACL,SAAS;gBACT,aAAa;gBACb,aAAa;gBACb,aAAa;gBACb,WAAW;aACZ;YACD,OAAO,EAAE;gBACP,iBAAiB;gBACjB,gBAAgB;aACjB;YACD,OAAO,EAAE,CAAC,OAAO,CAAC;YAClB,OAAO,EAAE,EAAE;YACX,IAAI,EAAE;gBACJ,WAAW;gBACX,WAAW;aACZ;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,wCAAwC;YAChD,OAAO,EAAE,uCAAuC;SACjD;KACF;IAED,qDAAqD;IACrD,OAAO;IACP,qDAAqD;IACrD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,0DAA0D;aAC3D;YACD,KAAK,EAAE,EAAE;YACT,IAAI,EAAE;gBACJ,kBAAkB;aACnB;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,mBAAmB;SAC7B;KACF;IAED,qDAAqD;IACrD,SAAS;IACT,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,+CAA+C;aAChD;YACD,KAAK,EAAE;gBACL,aAAa;gBACb,UAAU;aACX;YACD,OAAO,EAAE;gBACP,yBAAyB;gBACzB,qBAAqB;gBACrB,2BAA2B;aAC5B;YACD,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;YACnC,IAAI,EAAE;gBACJ,cAAc;gBACd,mBAAmB;gBACnB,kBAAkB;aACnB;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,qBAAqB;SAC/B;KACF;IAED,qDAAqD;IACrD,4BAA4B;IAC5B,qDAAqD;IACrD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,kBAAkB;gBAClB,wBAAwB;aACzB;YACD,IAAI,EAAE;gBACJ,YAAY;aACb;SACF;KACF;IAED,qDAAqD;IACrD,SAAS;IACT,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,SAAS;gBACT,OAAO;gBACP,WAAW;aACZ;YACD,OAAO,EAAE;gBACP,cAAc,EAAE,SAAS;aAC1B;SACF;KACF;IAED,qDAAqD;IACrD,SAAS;IACT,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,mBAAmB;gBACnB,eAAe;aAChB;YACD,IAAI,EAAE;gBACJ,aAAa;aACd;SACF;KACF;IAED,qDAAqD;IACrD,UAAU;IACV,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,gDAAgD;aACjD;YACD,OAAO,EAAE;gBACP,8BAA8B;gBAC9B,cAAc;aACf;YACD,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,IAAI,EAAE;gBACJ,gBAAgB;gBAChB,cAAc;gBACd,cAAc;gBACd,OAAO;aACR;SACF;KACF;IAED,qDAAqD;IACrD,cAAc;IACd,qDAAqD;IACrD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,oDAAoD;aACrD;YACD,OAAO,EAAE;gBACP,gCAAgC;gBAChC,gDAAgD;aACjD;YACD,OAAO,EAAE,CAAC,QAAQ,EAAE,qBAAqB,CAAC;YAC1C,IAAI,EAAE;gBACJ,qBAAqB;gBACrB,WAAW;aACZ;SACF;KACF;IAED,qDAAqD;IACrD,MAAM;IACN,qDAAqD;IACrD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,kDAAkD;aACnD;YACD,OAAO,EAAE;gBACP,4BAA4B;gBAC5B,0BAA0B;aAC3B;YACD,OAAO,EAAE;gBACP,kBAAkB,EAAE,GAAG;aACxB;YACD,IAAI,EAAE;gBACJ,eAAe;gBACf,mBAAmB;aACpB;SACF;KACF;IAED,qDAAqD;IACrD,uBAAuB;IACvB,qDAAqD;IAErD,qDAAqD;IACrD,UAAU;IACV,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,eAAe;gBACf,YAAY;gBACZ,OAAO;gBACP,aAAa;gBACb,SAAS;aACV;YACD,OAAO,EAAE;gBACP,qBAAqB;gBACrB,yBAAyB;gBACzB,iBAAiB;gBACjB,gBAAgB;aACjB;YACD,OAAO,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,eAAe,CAAC;YACzD,OAAO,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC;YACjD,OAAO,EAAE;gBACP,iBAAiB,EAAE,GAAG;gBACtB,UAAU,EAAE,QAAQ;gBACpB,qBAAqB,EAAE,GAAG;gBAC1B,WAAW,EAAE,GAAG;aACjB;YACD,IAAI,EAAE;gBACJ,8BAA8B;gBAC9B,iBAAiB;gBACjB,mBAAmB;aACpB;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,qCAAqC;YAC7C,OAAO,EAAE,4DAA4D;SACtE;KACF;IAED,qDAAqD;IACrD,iCAAiC;IACjC,qDAAqD;IACrD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,iEAAiE;aAClE;YACD,KAAK,EAAE;gBACL,kCAAkC;gBAClC,UAAU;gBACV,QAAQ;gBACR,oBAAoB;gBACpB,YAAY;aACb;YACD,OAAO,EAAE;gBACP,aAAa;gBACb,uBAAuB;gBACvB,0BAA0B;gBAC1B,WAAW;aACZ;YACD,OAAO,EAAE,CAAC,uBAAuB,EAAE,0BAA0B,EAAE,IAAI,CAAC;YACpE,OAAO,EAAE;gBACP,uBAAuB;gBACvB,2BAA2B;gBAC3B,kCAAkC;aACnC;YACD,IAAI,EAAE;gBACJ,aAAa;gBACb,eAAe;aAChB;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,0BAA0B;SACpC;KACF;IAED,qDAAqD;IACrD,2BAA2B;IAC3B,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,iBAAiB;gBACjB,0BAA0B;gBAC1B,mBAAmB;gBACnB,wBAAwB;gBACxB,iBAAiB;gBACjB,cAAc;aACf;YACD,OAAO,EAAE;gBACP,iBAAiB;gBACjB,wBAAwB;gBACxB,cAAc;gBACd,YAAY;aACb;YACD,OAAO,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;YACnC,OAAO,EAAE;gBACP,WAAW;gBACX,UAAU;gBACV,mBAAmB;gBACnB,oBAAoB;gBACpB,eAAe;aAChB;YACD,OAAO,EAAE;gBACP,gBAAgB,EAAE,GAAG;gBACrB,yBAAyB,EAAE,GAAG;aAC/B;YACD,IAAI,EAAE;gBACJ,gBAAgB;gBAChB,gBAAgB;gBAChB,UAAU;aACX;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,2EAA2E;YACnF,OAAO,EAAE,mBAAmB;SAC7B;KACF;IAED,qDAAqD;IACrD,cAAc;IACd,qDAAqD;IACrD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,WAAW;gBACX,WAAW;gBACX,cAAc;aACf;YACD,OAAO,EAAE;gBACP,6BAA6B;gBAC7B,gCAAgC;aACjC;YACD,OAAO,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;YACvC,OAAO,EAAE;gBACP,oBAAoB;gBACpB,eAAe;gBACf,oBAAoB;aACrB;YACD,OAAO,EAAE;gBACP,oBAAoB,EAAE,GAAG;aAC1B;YACD,IAAI,EAAE;gBACJ,mBAAmB;gBACnB,qBAAqB;aACtB;SACF;KACF;IAED,qDAAqD;IACrD,aAAa;IACb,qDAAqD;IACrD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,mDAAmD;aACpD;YACD,KAAK,EAAE;gBACL,WAAW;gBACX,UAAU;gBACV,wBAAwB;gBACxB,UAAU;aACX;YACD,OAAO,EAAE;gBACP,YAAY;gBACZ,qBAAqB;aACtB;YACD,OAAO,EAAE,CAAC,YAAY,CAAC;YACvB,OAAO,EAAE,CAAC,sBAAsB,CAAC;YACjC,IAAI,EAAE;gBACJ,YAAY;gBACZ,YAAY;aACb;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,yBAAyB;SACnC;KACF;IAED,qDAAqD;IACrD,WAAW;IACX,qDAAqD;IACrD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,8BAA8B;gBAC9B,gCAAgC;gBAChC,gCAAgC;gBAChC,sBAAsB;aACvB;YACD,OAAO,EAAE;gBACP,0BAA0B;aAC3B;YACD,OAAO,EAAE;gBACP,UAAU;gBACV,UAAU;gBACV,UAAU;aACX;YACD,IAAI,EAAE;gBACJ,uBAAuB;gBACvB,mBAAmB;aACpB;SACF;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,uBAAuB;SACjC;KACF;IAED,qDAAqD;IACrD,YAAY;IACZ,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,iBAAiB;gBACjB,cAAc;gBACd,iBAAiB;aAClB;YACD,OAAO,EAAE;gBACP,kBAAkB,EAAE,GAAG;aACxB;SACF;KACF;IAED,qDAAqD;IACrD,SAAS;IACT,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,WAAW;gBACX,aAAa;aACd;YACD,IAAI,EAAE;gBACJ,QAAQ;aACT;SACF;KACF;IAED,qDAAqD;IACrD,qBAAqB;IACrB,qDAAqD;IAErD,qDAAqD;IACrD,qBAAqB;IACrB,qDAAqD;IACrD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,WAAW;gBACX,kBAAkB;gBAClB,gBAAgB;gBAChB,eAAe;gBACf,QAAQ;gBACR,kBAAkB;gBAClB,cAAc;aACf;YACD,OAAO,EAAE;gBACP,uBAAuB,EAAE,GAAG;aAC7B;YACD,OAAO,EAAE,CAAC,YAAY,CAAC;YACvB,WAAW,EACT,wEAAwE;YAC1E,IAAI,EAAE;gBACJ,uBAAuB;gBACvB,+BAA+B;gBAC/B,mCAAmC;aACpC;SACF;KACF;IAED,qDAAqD;IACrD,kBAAkB;IAClB,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,SAAS;gBACT,eAAe;gBACf,gBAAgB;aACjB;YACD,OAAO,EAAE;gBACP,iBAAiB,EAAE,QAAQ;aAC5B;YACD,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAC;YACtD,WAAW,EAAE,+DAA+D;YAC5E,IAAI,EAAE;gBACJ,qBAAqB;gBACrB,wBAAwB;gBACxB,MAAM;gBACN,kBAAkB;aACnB;SACF;KACF;IAED,qDAAqD;IACrD,mBAAmB;IACnB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,OAAO;gBACP,QAAQ;gBACR,eAAe;aAChB;YACD,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,6DAA6D;YAC1E,IAAI,EAAE;gBACJ,SAAS;gBACT,YAAY;gBACZ,iBAAiB;aAClB;SACF;KACF;IAED,qDAAqD;IACrD,iBAAiB;IACjB,qDAAqD;IACrD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE,EAAE;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,WAAW;aACpB;YACD,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,WAAW,EAAE,uCAAuC;YACpD,IAAI,EAAE;gBACJ,mBAAmB;gBACnB,kBAAkB;aACnB;SACF;KACF;IAED,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,QAAQ;gBACR,WAAW;gBACX,iBAAiB;gBACjB,OAAO;gBACP,WAAW;gBACX,UAAU;aACX;YACD,OAAO,EAAE;gBACP,YAAY,EAAE,kBAAkB;gBAChC,cAAc,EAAE,WAAW;aAC5B;YACD,OAAO,EAAE;gBACP,iBAAiB;gBACjB,YAAY;gBACZ,eAAe;aAChB;YACD,WAAW,EAAE,yCAAyC;YACtD,IAAI,EAAE;gBACJ,QAAQ;gBACR,SAAS;gBACT,gBAAgB;aACjB;SACF;KACF;IAED,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,aAAa;gBACb,gBAAgB;aACjB;YACD,OAAO,EAAE;gBACP,cAAc,EAAE,oBAAoB;gBACpC,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,iBAAiB;aAClC;YACD,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,WAAW,EAAE,gCAAgC;YAC7C,IAAI,EAAE;gBACJ,iBAAiB;gBACjB,YAAY;gBACZ,mBAAmB;gBACnB,cAAc;aACf;SACF;KACF;IAED,qDAAqD;IACrD,uBAAuB;IACvB,qDAAqD;IACrD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,WAAW;aAC5B;YACD,WAAW,EAAE,sCAAsC;YACnD,IAAI,EAAE,EAAE;SACT;KACF;IAED,qDAAqD;IACrD,mBAAmB;IACnB,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,OAAO;aACxB;YACD,WAAW,EAAE,WAAW;SACzB;KACF;IAED,qDAAqD;IACrD,sBAAsB;IACtB,qDAAqD;IACrD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,QAAQ;aACzB;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;IAED,qDAAqD;IACrD,mBAAmB;IACnB,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,WAAW;aAC5B;YACD,WAAW,EAAE,qDAAqD;YAClE,IAAI,EAAE,EAAE;SACT;KACF;IAED,qDAAqD;IACrD,WAAW;IACX,qDAAqD;IACrD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,UAAU;aAC3B;YACD,WAAW,EAAE,oBAAoB;SAClC;KACF;IAED,qDAAqD;IACrD,aAAa;IACb,qDAAqD;IACrD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,SAAS;aAC1B;YACD,WAAW,EAAE,sCAAsC;SACpD;KACF;IAED,qDAAqD;IACrD,YAAY;IACZ,qDAAqD;IACrD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,6BAA6B;SAC3C;KACF;IAED,qDAAqD;IACrD,WAAW;IACX,qDAAqD;IACrD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,WAAW,EAAE,oBAAoB;SAClC;KACF;IAED,qDAAqD;IACrD,yBAAyB;IACzB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,aAAa;gBAC7B,kBAAkB,EAAE,cAAc;gBAClC,qBAAqB,EAAE,cAAc;aACtC;YACD,OAAO,EAAE;gBACP,qBAAqB;gBACrB,yBAAyB;gBACzB,gCAAgC;gBAChC,4BAA4B;aAC7B;YACD,IAAI,EAAE;gBACJ,aAAa;gBACb,mBAAmB;gBACnB,YAAY;aACb;SACF;KACF;IAED,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,aAAa;gBACb,QAAQ;gBACR,WAAW;aACZ;YACD,OAAO,EAAE;gBACP,eAAe,EAAE,GAAG;gBACpB,oBAAoB,EAAE,aAAa;aACpC;YACD,OAAO,EAAE,CAAC,WAAW,CAAC;YACtB,WAAW,EAAE,gDAAgD;YAC7D,IAAI,EAAE;gBACJ,YAAY;gBACZ,SAAS;gBACT,SAAS;aACV;SACF;KACF;IAED,qDAAqD;IACrD,oBAAoB;IACpB,qDAAqD;IACrD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,YAAY,EAAE,kBAAkB,CAAC;YAC3C,WAAW,EAAE,6BAA6B;YAC1C,IAAI,EAAE;gBACJ,aAAa;aACd;SACF;KACF;IAED,qDAAqD;IACrD,UAAU;IACV,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,WAAW,EAAE,6BAA6B;YAC1C,IAAI,EAAE;gBACJ,SAAS;aACV;SACF;KACF;IAED,qDAAqD;IACrD,mBAAmB;IACnB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,UAAU;gBAClB,cAAc,EAAE,kBAAkB;aACnC;YACD,OAAO,EAAE,CAAC,cAAc,CAAC;YACzB,IAAI,EAAE;gBACJ,MAAM;gBACN,kBAAkB;gBAClB,eAAe;gBACf,oBAAoB;aACrB;SACF;KACF;IAED,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,UAAU;aACnB;YACD,WAAW,EAAE,0DAA0D;SACxE;KACF;IAED,qDAAqD;IACrD,mBAAmB;IACnB,qDAAqD;IACrD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,WAAW,EAAE,IAAI;SAClB;KACF;IAED,qDAAqD;IACrD,cAAc;IACd,qDAAqD;IACrD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,WAAW,EAAE,IAAI;SAClB;KACF;IAED,qDAAqD;IACrD,qBAAqB;IACrB,qDAAqD;IACrD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;YACpD,OAAO,EAAE;gBACP,cAAc,EAAE,YAAY;aAC7B;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;IAED,qDAAqD;IACrD,oBAAoB;IACpB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,yEAAyE;SACvF;KACF;IAED,qDAAqD;IACrD,eAAe;IACf,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,WAAW;SACzB;KACF;IAED,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS;aAClB;YACD,WAAW,EAAE,yCAAyC;SACvD;KACF;IAED,qDAAqD;IACrD,8BAA8B;IAC9B,qDAAqD;IACrD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,cAAc,CAAC;YACzB,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,+BAA+B;YAC5C,IAAI,EAAE;gBACJ,OAAO;aACR;SACF;KACF;IAED,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO;aAChB;SACF;KACF;IAED,qDAAqD;IACrD,iCAAiC;IACjC,qDAAqD;IACrD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,WAAW,EAAE,0EAA0E;SACxF;KACF;IAED,qDAAqD;IACrD,iBAAiB;IACjB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,KAAK,EAAE;gBACL,WAAW;gBACX,YAAY;gBACZ,SAAS;aACV;YACD,WAAW,EAAE,mCAAmC;SACjD;KACF;IAED,qDAAqD;IACrD,oBAAoB;IACpB,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,WAAW,EAAE,kEAAkE;SAChF;KACF;IAED,qDAAqD;IACrD,qBAAqB;IACrB,qDAAqD;IACrD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,SAAS;aAC1B;YACD,OAAO,EAAE,CAAC,WAAW,CAAC;SACvB;KACF;CACF,CAAC"}
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Multi-layer C2 (Command & Control) framework detection profiles.
|
|
3
|
+
*
|
|
4
|
+
* Combines JARM TLS fingerprints, certificate anomalies, HTTP behavioral
|
|
5
|
+
* patterns, and known IOC paths to identify C2 team-servers in the wild.
|
|
6
|
+
* These profiles are used for proactive threat hunting — not exploitation.
|
|
7
|
+
*
|
|
8
|
+
* JARM hashes are sourced from public research; certificate and HTTP patterns
|
|
9
|
+
* are derived from default/untuned framework configurations.
|
|
10
|
+
*
|
|
11
|
+
* References:
|
|
12
|
+
* - https://github.com/salesforce/jarm
|
|
13
|
+
* - https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
|
|
14
|
+
* - https://blog.fox-it.com/2022/08/31/sliver-c2-hunting/
|
|
15
|
+
*/
|
|
16
|
+
/** A multi-signal C2 framework detection profile. */
|
|
17
|
+
export interface C2Signature {
|
|
18
|
+
/** Framework name */
|
|
19
|
+
name: string;
|
|
20
|
+
/** JARM TLS fingerprint hash (62 chars) — may vary with malleable profiles */
|
|
21
|
+
jarm?: string;
|
|
22
|
+
/** TLS certificate anomaly patterns for the default/out-of-box configuration */
|
|
23
|
+
certPatterns: {
|
|
24
|
+
/** Common Name regex patterns (e.g., "localhost", random hex strings) */
|
|
25
|
+
cn?: string[];
|
|
26
|
+
/** Organization field regex patterns */
|
|
27
|
+
o?: string[];
|
|
28
|
+
/** Certificate validity window anomalies */
|
|
29
|
+
validity?: {
|
|
30
|
+
minDays?: number;
|
|
31
|
+
maxDays?: number;
|
|
32
|
+
};
|
|
33
|
+
/** Whether the default cert is self-signed */
|
|
34
|
+
selfSigned?: boolean;
|
|
35
|
+
/** Serial number format regex (some frameworks use predictable serials) */
|
|
36
|
+
serialPattern?: string;
|
|
37
|
+
};
|
|
38
|
+
/** HTTP-layer behavioral indicators */
|
|
39
|
+
httpPatterns?: {
|
|
40
|
+
/** Default URI paths served by the team-server or stager */
|
|
41
|
+
defaultPaths?: string[];
|
|
42
|
+
/** Specific response body size for a given status (e.g., 404 page with fixed length) */
|
|
43
|
+
responseSize?: {
|
|
44
|
+
status: number;
|
|
45
|
+
size: number;
|
|
46
|
+
};
|
|
47
|
+
/** Characteristic HTTP headers on responses */
|
|
48
|
+
headers?: Record<string, string>;
|
|
49
|
+
};
|
|
50
|
+
/** Brief description of the framework and its primary use case */
|
|
51
|
+
description: string;
|
|
52
|
+
}
|
|
53
|
+
export declare const C2_SIGNATURES: C2Signature[];
|
|
54
|
+
//# sourceMappingURL=c2-signatures.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"c2-signatures.d.ts","sourceRoot":"","sources":["../../src/data/c2-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,YAAY,EAAE;QACZ,yEAAyE;QACzE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACd,wCAAwC;QACxC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QACb,4CAA4C;QAC5C,QAAQ,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClD,8CAA8C;QAC9C,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,2EAA2E;QAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,uCAAuC;IACvC,YAAY,CAAC,EAAE;QACb,4DAA4D;QAC5D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,wFAAwF;QACxF,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAChD,+CAA+C;QAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,aAAa,EAAE,WAAW,EAkQtC,CAAC"}
|
|
@@ -0,0 +1,256 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Multi-layer C2 (Command & Control) framework detection profiles.
|
|
3
|
+
*
|
|
4
|
+
* Combines JARM TLS fingerprints, certificate anomalies, HTTP behavioral
|
|
5
|
+
* patterns, and known IOC paths to identify C2 team-servers in the wild.
|
|
6
|
+
* These profiles are used for proactive threat hunting — not exploitation.
|
|
7
|
+
*
|
|
8
|
+
* JARM hashes are sourced from public research; certificate and HTTP patterns
|
|
9
|
+
* are derived from default/untuned framework configurations.
|
|
10
|
+
*
|
|
11
|
+
* References:
|
|
12
|
+
* - https://github.com/salesforce/jarm
|
|
13
|
+
* - https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
|
|
14
|
+
* - https://blog.fox-it.com/2022/08/31/sliver-c2-hunting/
|
|
15
|
+
*/
|
|
16
|
+
export const C2_SIGNATURES = [
|
|
17
|
+
// ──────────────────────────────────────────────────
|
|
18
|
+
// Cobalt Strike
|
|
19
|
+
// ──────────────────────────────────────────────────
|
|
20
|
+
{
|
|
21
|
+
name: "Cobalt Strike",
|
|
22
|
+
jarm: "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1",
|
|
23
|
+
certPatterns: {
|
|
24
|
+
cn: ["^localhost$", "^Major Cobalt Strike$"],
|
|
25
|
+
o: ["^cobaltstrike$", "^Strategic Cyber LLC$"],
|
|
26
|
+
validity: { minDays: 3650, maxDays: 3660 },
|
|
27
|
+
selfSigned: true,
|
|
28
|
+
serialPattern: "^146473198$",
|
|
29
|
+
},
|
|
30
|
+
httpPatterns: {
|
|
31
|
+
defaultPaths: [
|
|
32
|
+
"/visit.js",
|
|
33
|
+
"/j.ad",
|
|
34
|
+
"/ga.js",
|
|
35
|
+
"/cm",
|
|
36
|
+
"/push",
|
|
37
|
+
"/submit.php",
|
|
38
|
+
"/___utm.gif",
|
|
39
|
+
"/pixel",
|
|
40
|
+
"/updates.rss",
|
|
41
|
+
"/fwlink",
|
|
42
|
+
],
|
|
43
|
+
responseSize: { status: 404, size: 0 },
|
|
44
|
+
headers: {},
|
|
45
|
+
},
|
|
46
|
+
description: "Commercial adversary simulation framework by Fortra (formerly HelpSystems). Most widely abused C2 framework. Default config uses a self-signed cert with CN=localhost, O=cobaltstrike, and 10-year validity.",
|
|
47
|
+
},
|
|
48
|
+
// ──────────────────────────────────────────────────
|
|
49
|
+
// Metasploit Framework
|
|
50
|
+
// ──────────────────────────────────────────────────
|
|
51
|
+
{
|
|
52
|
+
name: "Metasploit Framework",
|
|
53
|
+
jarm: "07d14d16d21d21d000007d14d21d21d000000000000000000000000000000",
|
|
54
|
+
certPatterns: {
|
|
55
|
+
cn: ["^localhost$", "^MetasploitSelfSignedCA$"],
|
|
56
|
+
o: ["^Rapid7$"],
|
|
57
|
+
validity: { minDays: 365, maxDays: 1825 },
|
|
58
|
+
selfSigned: true,
|
|
59
|
+
},
|
|
60
|
+
httpPatterns: {
|
|
61
|
+
defaultPaths: [
|
|
62
|
+
"/handler",
|
|
63
|
+
"/exploit",
|
|
64
|
+
"/payload",
|
|
65
|
+
"/shell",
|
|
66
|
+
"/connect",
|
|
67
|
+
],
|
|
68
|
+
responseSize: { status: 404, size: 292 },
|
|
69
|
+
headers: {},
|
|
70
|
+
},
|
|
71
|
+
description: "Open-source penetration testing framework by Rapid7. Default HTTPS handler generates a self-signed certificate with predictable attributes. Meterpreter reverse_https uses /handler as the callback URI.",
|
|
72
|
+
},
|
|
73
|
+
// ──────────────────────────────────────────────────
|
|
74
|
+
// Sliver C2
|
|
75
|
+
// ──────────────────────────────────────────────────
|
|
76
|
+
{
|
|
77
|
+
name: "Sliver C2",
|
|
78
|
+
jarm: "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
|
|
79
|
+
certPatterns: {
|
|
80
|
+
cn: ["^[a-z]{8,16}\\.[a-z]{2,6}$"],
|
|
81
|
+
o: ["^[A-Z][a-z]+ (Inc|LLC|Ltd|Corp)$"],
|
|
82
|
+
validity: { minDays: 365, maxDays: 730 },
|
|
83
|
+
selfSigned: true,
|
|
84
|
+
serialPattern: "^[0-9a-f]{32}$",
|
|
85
|
+
},
|
|
86
|
+
httpPatterns: {
|
|
87
|
+
defaultPaths: [
|
|
88
|
+
"/info",
|
|
89
|
+
"/rpc/",
|
|
90
|
+
"/start",
|
|
91
|
+
"/session",
|
|
92
|
+
"/assets.js",
|
|
93
|
+
],
|
|
94
|
+
headers: {
|
|
95
|
+
"cache-control": "^no-store, no-cache, must-revalidate$",
|
|
96
|
+
},
|
|
97
|
+
},
|
|
98
|
+
description: "Open-source cross-platform C2 by BishopFox. Generates random-looking domain names for TLS certificates. Uses mutual TLS (mTLS), HTTP/S, DNS, and WireGuard transports. Default HTTPS listener produces JARM consistent with Go's crypto/tls.",
|
|
99
|
+
},
|
|
100
|
+
// ──────────────────────────────────────────────────
|
|
101
|
+
// Brute Ratel C4
|
|
102
|
+
// ──────────────────────────────────────────────────
|
|
103
|
+
{
|
|
104
|
+
name: "Brute Ratel C4",
|
|
105
|
+
jarm: "29d29d15d29d29d21c29d29d29d29dce7a321a0a0a0a0a0a0a0a0a0a0a0a0",
|
|
106
|
+
certPatterns: {
|
|
107
|
+
cn: ["^[a-z0-9-]+\\.[a-z]{2,}$"],
|
|
108
|
+
o: [],
|
|
109
|
+
validity: { minDays: 365, maxDays: 365 },
|
|
110
|
+
selfSigned: true,
|
|
111
|
+
},
|
|
112
|
+
httpPatterns: {
|
|
113
|
+
defaultPaths: ["/content", "/auth", "/api/", "/feed"],
|
|
114
|
+
responseSize: { status: 200, size: 0 },
|
|
115
|
+
headers: {
|
|
116
|
+
"content-type": "^text/html$",
|
|
117
|
+
},
|
|
118
|
+
},
|
|
119
|
+
description: "Commercial C2 framework by Chetan Nayak (Paranoid Ninja). Designed to evade EDR. Default HTTPS listener returns an empty 200 OK with text/html content-type. BRC4 badgers communicate over encrypted channels.",
|
|
120
|
+
},
|
|
121
|
+
// ──────────────────────────────────────────────────
|
|
122
|
+
// Havoc C2
|
|
123
|
+
// ──────────────────────────────────────────────────
|
|
124
|
+
{
|
|
125
|
+
name: "Havoc C2",
|
|
126
|
+
jarm: "00000000000000000041d41d000000041d41d41d41d41d41d41d41d41d41d",
|
|
127
|
+
certPatterns: {
|
|
128
|
+
cn: ["^localhost$", "^Havoc$"],
|
|
129
|
+
o: ["^Havoc$"],
|
|
130
|
+
validity: { minDays: 365, maxDays: 3650 },
|
|
131
|
+
selfSigned: true,
|
|
132
|
+
},
|
|
133
|
+
httpPatterns: {
|
|
134
|
+
defaultPaths: ["/", "/demon"],
|
|
135
|
+
responseSize: { status: 404, size: 0 },
|
|
136
|
+
headers: {
|
|
137
|
+
"x-powered-by": "^Havoc$",
|
|
138
|
+
},
|
|
139
|
+
},
|
|
140
|
+
description: "Open-source post-exploitation C2 framework. Teamserver (written in Go/C++) listens on HTTPS with a self-signed cert. Demon agents use HTTP/S for tasking. Known for poor OPSEC defaults.",
|
|
141
|
+
},
|
|
142
|
+
// ──────────────────────────────────────────────────
|
|
143
|
+
// Mythic C2
|
|
144
|
+
// ──────────────────────────────────────────────────
|
|
145
|
+
{
|
|
146
|
+
name: "Mythic C2",
|
|
147
|
+
jarm: "07d14d16d21d21d07c07d14d07d21d9b2f5869a6985368a9dec764186a9175",
|
|
148
|
+
certPatterns: {
|
|
149
|
+
cn: ["^Mythic$", "^mythic-ssl$"],
|
|
150
|
+
o: ["^Mythic$"],
|
|
151
|
+
validity: { minDays: 365, maxDays: 730 },
|
|
152
|
+
selfSigned: true,
|
|
153
|
+
},
|
|
154
|
+
httpPatterns: {
|
|
155
|
+
defaultPaths: [
|
|
156
|
+
"/api/v1.4/agent_message",
|
|
157
|
+
"/agent_message",
|
|
158
|
+
"/login",
|
|
159
|
+
"/new/callbacks",
|
|
160
|
+
],
|
|
161
|
+
headers: {
|
|
162
|
+
server: "^nginx$",
|
|
163
|
+
},
|
|
164
|
+
},
|
|
165
|
+
description: "Open-source collaborative C2 platform with pluggable agent architecture (Apollo, Poseidon, Medusa, etc.). Built on Docker with a React UI. Uses Nginx as a reverse proxy by default, making the JARM consistent with Nginx rather than a raw Go TLS server.",
|
|
166
|
+
},
|
|
167
|
+
// ──────────────────────────────────────────────────
|
|
168
|
+
// Covenant
|
|
169
|
+
// ──────────────────────────────────────────────────
|
|
170
|
+
{
|
|
171
|
+
name: "Covenant",
|
|
172
|
+
jarm: "07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823",
|
|
173
|
+
certPatterns: {
|
|
174
|
+
cn: ["^Covenant$", "^localhost$"],
|
|
175
|
+
o: ["^Covenant$"],
|
|
176
|
+
validity: { minDays: 365, maxDays: 365 },
|
|
177
|
+
selfSigned: true,
|
|
178
|
+
},
|
|
179
|
+
httpPatterns: {
|
|
180
|
+
defaultPaths: [
|
|
181
|
+
"/en-us/test.html",
|
|
182
|
+
"/en-us/docs.html",
|
|
183
|
+
"/covenantuser/login",
|
|
184
|
+
"/api/grunts",
|
|
185
|
+
],
|
|
186
|
+
headers: {
|
|
187
|
+
server: "^Microsoft-HTTPAPI/2\\.0$",
|
|
188
|
+
},
|
|
189
|
+
},
|
|
190
|
+
description: "Open-source .NET C2 framework. Runs on ASP.NET Core (Kestrel). Default grunt stager uses /en-us/test.html and /en-us/docs.html as callback URIs. Teamserver exposes a Blazor UI on the same port.",
|
|
191
|
+
},
|
|
192
|
+
// ──────────────────────────────────────────────────
|
|
193
|
+
// PoshC2
|
|
194
|
+
// ──────────────────────────────────────────────────
|
|
195
|
+
{
|
|
196
|
+
name: "PoshC2",
|
|
197
|
+
jarm: "2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261",
|
|
198
|
+
certPatterns: {
|
|
199
|
+
cn: ["^P18055077$", "^PoshC2$"],
|
|
200
|
+
o: ["^PoshC2$"],
|
|
201
|
+
validity: { minDays: 365, maxDays: 730 },
|
|
202
|
+
selfSigned: true,
|
|
203
|
+
serialPattern: "^[0-9]{8,12}$",
|
|
204
|
+
},
|
|
205
|
+
httpPatterns: {
|
|
206
|
+
defaultPaths: [
|
|
207
|
+
"/images/static/content/",
|
|
208
|
+
"/news/",
|
|
209
|
+
"/webapp/static/",
|
|
210
|
+
"/homepage/",
|
|
211
|
+
"/get",
|
|
212
|
+
],
|
|
213
|
+
responseSize: { status: 200, size: 1 },
|
|
214
|
+
headers: {
|
|
215
|
+
server: "^Apache$",
|
|
216
|
+
},
|
|
217
|
+
},
|
|
218
|
+
description: "Open-source proxy-aware C2 framework. Written in Python with PowerShell/C#/Python implants. Default server spoofs Apache Server header. Uses predictable URI prefixes and returns 200 with a 1-byte body as a heartbeat.",
|
|
219
|
+
},
|
|
220
|
+
// ──────────────────────────────────────────────────
|
|
221
|
+
// Nighthawk (commercial, less documented)
|
|
222
|
+
// ──────────────────────────────────────────────────
|
|
223
|
+
{
|
|
224
|
+
name: "Nighthawk",
|
|
225
|
+
certPatterns: {
|
|
226
|
+
cn: ["^[a-z0-9]{6,12}$"],
|
|
227
|
+
o: [],
|
|
228
|
+
validity: { minDays: 30, maxDays: 365 },
|
|
229
|
+
selfSigned: true,
|
|
230
|
+
},
|
|
231
|
+
httpPatterns: {
|
|
232
|
+
defaultPaths: ["/index.html", "/static/"],
|
|
233
|
+
headers: {},
|
|
234
|
+
},
|
|
235
|
+
description: "Commercial C2 framework by MDSec. Designed as a Cobalt Strike alternative with advanced evasion. Limited public JARM/IOC data due to its commercial, licensed nature.",
|
|
236
|
+
},
|
|
237
|
+
// ──────────────────────────────────────────────────
|
|
238
|
+
// Villain
|
|
239
|
+
// ──────────────────────────────────────────────────
|
|
240
|
+
{
|
|
241
|
+
name: "Villain",
|
|
242
|
+
certPatterns: {
|
|
243
|
+
cn: ["^villain$", "^localhost$"],
|
|
244
|
+
o: [],
|
|
245
|
+
validity: { minDays: 365, maxDays: 365 },
|
|
246
|
+
selfSigned: true,
|
|
247
|
+
},
|
|
248
|
+
httpPatterns: {
|
|
249
|
+
defaultPaths: ["/", "/shell"],
|
|
250
|
+
responseSize: { status: 200, size: 0 },
|
|
251
|
+
headers: {},
|
|
252
|
+
},
|
|
253
|
+
description: "Open-source Python C2 framework generating Windows/Linux reverse shells. Supports HoaxShell-based PowerShell payloads. Minimal OPSEC; self-signed cert with CN=villain.",
|
|
254
|
+
},
|
|
255
|
+
];
|
|
256
|
+
//# sourceMappingURL=c2-signatures.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"c2-signatures.js","sourceRoot":"","sources":["../../src/data/c2-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAkCH,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,gEAAgE;QACtE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,aAAa,EAAE,uBAAuB,CAAC;YAC5C,CAAC,EAAE,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;YAC9C,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1C,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,aAAa;SAC7B;QACD,YAAY,EAAE;YACZ,YAAY,EAAE;gBACZ,WAAW;gBACX,OAAO;gBACP,QAAQ;gBACR,KAAK;gBACL,OAAO;gBACP,aAAa;gBACb,aAAa;gBACb,QAAQ;gBACR,cAAc;gBACd,SAAS;aACV;YACD,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;YACtC,OAAO,EAAE,EAAE;SACZ;QACD,WAAW,EACT,8MAA8M;KACjN;IAED,qDAAqD;IACrD,uBAAuB;IACvB,qDAAqD;IACrD;QACE,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,+DAA+D;QACrE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,aAAa,EAAE,0BAA0B,CAAC;YAC/C,CAAC,EAAE,CAAC,UAAU,CAAC;YACf,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACzC,UAAU,EAAE,IAAI;SACjB;QACD,YAAY,EAAE;YACZ,YAAY,EAAE;gBACZ,UAAU;gBACV,UAAU;gBACV,UAAU;gBACV,QAAQ;gBACR,UAAU;aACX;YACD,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;YACxC,OAAO,EAAE,EAAE;SACZ;QACD,WAAW,EACT,0MAA0M;KAC7M;IAED,qDAAqD;IACrD,YAAY;IACZ,qDAAqD;IACrD;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,gEAAgE;QACtE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,4BAA4B,CAAC;YAClC,CAAC,EAAE,CAAC,kCAAkC,CAAC;YACvC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACxC,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,gBAAgB;SAChC;QACD,YAAY,EAAE;YACZ,YAAY,EAAE;gBACZ,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,UAAU;gBACV,YAAY;aACb;YACD,OAAO,EAAE;gBACP,eAAe,EAAE,uCAAuC;aACzD;SACF;QACD,WAAW,EACT,8OAA8O;KACjP;IAED,qDAAqD;IACrD,iBAAiB;IACjB,qDAAqD;IACrD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,+DAA+D;QACrE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,0BAA0B,CAAC;YAChC,CAAC,EAAE,EAAE;YACL,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACxC,UAAU,EAAE,IAAI;SACjB;QACD,YAAY,EAAE;YACZ,YAAY,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACrD,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;YACtC,OAAO,EAAE;gBACP,cAAc,EAAE,aAAa;aAC9B;SACF;QACD,WAAW,EACT,gNAAgN;KACnN;IAED,qDAAqD;IACrD,WAAW;IACX,qDAAqD;IACrD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,+DAA+D;QACrE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC;YAC9B,CAAC,EAAE,CAAC,SAAS,CAAC;YACd,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACzC,UAAU,EAAE,IAAI;SACjB;QACD,YAAY,EAAE;YACZ,YAAY,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;YAC7B,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;YACtC,OAAO,EAAE;gBACP,cAAc,EAAE,SAAS;aAC1B;SACF;QACD,WAAW,EACT,0LAA0L;KAC7L;IAED,qDAAqD;IACrD,YAAY;IACZ,qDAAqD;IACrD;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,gEAAgE;QACtE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;YAChC,CAAC,EAAE,CAAC,UAAU,CAAC;YACf,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACxC,UAAU,EAAE,IAAI;SACjB;QACD,YAAY,EAAE;YACZ,YAAY,EAAE;gBACZ,yBAAyB;gBACzB,gBAAgB;gBAChB,QAAQ;gBACR,gBAAgB;aACjB;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS;aAClB;SACF;QACD,WAAW,EACT,6PAA6P;KAChQ;IAED,qDAAqD;IACrD,WAAW;IACX,qDAAqD;IACrD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,gEAAgE;QACtE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;YACjC,CAAC,EAAE,CAAC,YAAY,CAAC;YACjB,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACxC,UAAU,EAAE,IAAI;SACjB;QACD,YAAY,EAAE;YACZ,YAAY,EAAE;gBACZ,kBAAkB;gBAClB,kBAAkB;gBAClB,qBAAqB;gBACrB,aAAa;aACd;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,2BAA2B;aACpC;SACF;QACD,WAAW,EACT,mMAAmM;KACtM;IAED,qDAAqD;IACrD,SAAS;IACT,qDAAqD;IACrD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,gEAAgE;QACtE,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;YAC/B,CAAC,EAAE,CAAC,UAAU,CAAC;YACf,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACxC,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,eAAe;SAC/B;QACD,YAAY,EAAE;YACZ,YAAY,EAAE;gBACZ,yBAAyB;gBACzB,QAAQ;gBACR,iBAAiB;gBACjB,YAAY;gBACZ,MAAM;aACP;YACD,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;YACtC,OAAO,EAAE;gBACP,MAAM,EAAE,UAAU;aACnB;SACF;QACD,WAAW,EACT,0NAA0N;KAC7N;IAED,qDAAqD;IACrD,0CAA0C;IAC1C,qDAAqD;IACrD;QACE,IAAI,EAAE,WAAW;QACjB,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACxB,CAAC,EAAE,EAAE;YACL,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE;YACvC,UAAU,EAAE,IAAI;SACjB;QACD,YAAY,EAAE;YACZ,YAAY,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;YACzC,OAAO,EAAE,EAAE;SACZ;QACD,WAAW,EACT,uKAAuK;KAC1K;IAED,qDAAqD;IACrD,UAAU;IACV,qDAAqD;IACrD;QACE,IAAI,EAAE,SAAS;QACf,YAAY,EAAE;YACZ,EAAE,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;YAChC,CAAC,EAAE,EAAE;YACL,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACxC,UAAU,EAAE,IAAI;SACjB;QACD,YAAY,EAAE;YACZ,YAAY,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;YAC7B,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;YACtC,OAAO,EAAE,EAAE;SACZ;QACD,WAAW,EACT,yKAAyK;KAC5K;CACF,CAAC"}
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Cloud provider identification patterns.
|
|
3
|
+
*
|
|
4
|
+
* Maps ASN numbers, reverse-DNS naming conventions, HTTP response headers,
|
|
5
|
+
* and error page content to specific cloud providers and their services.
|
|
6
|
+
* Used for infrastructure attribution — determining which cloud platform
|
|
7
|
+
* hosts a given IP or service without relying on IP range databases.
|
|
8
|
+
*
|
|
9
|
+
* References:
|
|
10
|
+
* - https://bgp.he.net/
|
|
11
|
+
* - https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
|
|
12
|
+
* - https://www.microsoft.com/en-us/download/details.aspx?id=56519
|
|
13
|
+
* - https://cloud.google.com/compute/docs/faq#find_ip_range
|
|
14
|
+
*/
|
|
15
|
+
/** A cloud provider identification profile. */
|
|
16
|
+
export interface CloudPattern {
|
|
17
|
+
/** Cloud provider name */
|
|
18
|
+
provider: string;
|
|
19
|
+
/** Autonomous System Numbers associated with this provider */
|
|
20
|
+
asn: string[];
|
|
21
|
+
/** Regex patterns for reverse DNS (PTR record) hostnames */
|
|
22
|
+
rdnsPatterns: string[];
|
|
23
|
+
/** HTTP header patterns (header name in lowercase → regex for value) */
|
|
24
|
+
headerPatterns: Record<string, string>;
|
|
25
|
+
/** Error page body content patterns (regex) unique to this provider */
|
|
26
|
+
errorPatterns?: string[];
|
|
27
|
+
/** Sub-service identifiers within the provider */
|
|
28
|
+
serviceIdentifiers?: {
|
|
29
|
+
service: string;
|
|
30
|
+
pattern: string;
|
|
31
|
+
}[];
|
|
32
|
+
}
|
|
33
|
+
export declare const CLOUD_PATTERNS: CloudPattern[];
|
|
34
|
+
//# sourceMappingURL=cloud-ranges.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cloud-ranges.d.ts","sourceRoot":"","sources":["../../src/data/cloud-ranges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,4DAA4D;IAC5D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kDAAkD;IAClD,kBAAkB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7D;AAED,eAAO,MAAM,cAAc,EAAE,YAAY,EA6nBxC,CAAC"}
|