fingerprint-mcp 0.1.0

package/dist/data/cookie-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-patterns.d.ts","sourceRoot":"","sources":["../../src/data/cookie-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,QAAQ,EAAE,SAAS,GAAG,gBAAgB,GAAG,UAAU,GAAG,WAAW,CAAC;IAClE,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EAyN1C,CAAC"}

package/dist/data/cookie-patterns.js

@@ -0,0 +1,225 @@
+/**
+ * HTTP cookie patterns for technology and infrastructure identification.
+ *
+ * Web servers, frameworks, load balancers, CDNs, and WAFs set distinctive cookies
+ * that reveal the underlying technology stack. Some infrastructure cookies (F5 BIG-IP,
+ * Citrix NetScaler) encode backend server addresses that can be decoded to discover
+ * internal network topology.
+ *
+ * References:
+ *  - https://github.com/AliasIO/wappalyzer
+ *  - https://support.f5.com/csp/article/K6917 (BIG-IP cookie persistence)
+ *  - https://support.citrix.com/article/CTX206793 (NetScaler persistence)
+ */
+export const COOKIE_PATTERNS = [
+    // ──────────────────────────────────────────────────
+    // Session / Framework Identification
+    // ──────────────────────────────────────────────────
+    {
+        pattern: "^PHPSESSID$",
+        name: "PHP Session",
+        category: "session",
+        technology: "PHP",
+    },
+    {
+        pattern: "^JSESSIONID$",
+        name: "Java Servlet Session",
+        category: "session",
+        technology: "Java (Servlet/JSP)",
+    },
+    {
+        pattern: "^ASP\\.NET_SessionId$",
+        name: "ASP.NET Session",
+        category: "session",
+        technology: "ASP.NET",
+    },
+    {
+        pattern: "^connect\\.sid$",
+        name: "Express.js Session",
+        category: "session",
+        technology: "Express.js (Node.js)",
+    },
+    {
+        pattern: "^laravel_session$",
+        name: "Laravel Session",
+        category: "session",
+        technology: "Laravel (PHP)",
+    },
+    {
+        pattern: "^rack\\.session$",
+        name: "Rack Session (Ruby)",
+        category: "session",
+        technology: "Ruby on Rails / Sinatra",
+    },
+    {
+        pattern: "^_session_id$",
+        name: "Rails Session",
+        category: "session",
+        technology: "Ruby on Rails",
+    },
+    {
+        pattern: "^wordpress_test_cookie$",
+        name: "WordPress Test Cookie",
+        category: "session",
+        technology: "WordPress",
+    },
+    {
+        pattern: "^wordpress_logged_in_",
+        name: "WordPress Auth Cookie",
+        category: "session",
+        technology: "WordPress",
+    },
+    {
+        pattern: "^wp-settings-",
+        name: "WordPress Settings Cookie",
+        category: "session",
+        technology: "WordPress",
+    },
+    {
+        pattern: "^SESS[0-9a-f]{32}$",
+        name: "Drupal Session",
+        category: "session",
+        technology: "Drupal",
+    },
+    {
+        pattern: "^SSESS[0-9a-f]{32}$",
+        name: "Drupal Secure Session",
+        category: "session",
+        technology: "Drupal (HTTPS)",
+    },
+    {
+        pattern: "^ci_session$",
+        name: "CodeIgniter Session",
+        category: "session",
+        technology: "CodeIgniter (PHP)",
+    },
+    {
+        pattern: "^csrftoken$",
+        name: "Django CSRF Token",
+        category: "session",
+        technology: "Django (Python)",
+    },
+    {
+        pattern: "^sessionid$",
+        name: "Django Session",
+        category: "session",
+        technology: "Django (Python)",
+    },
+    {
+        pattern: "^_gorilla_csrf$",
+        name: "Gorilla CSRF Token",
+        category: "session",
+        technology: "Go (Gorilla toolkit)",
+    },
+    // ──────────────────────────────────────────────────
+    // Infrastructure / Load Balancer
+    // ──────────────────────────────────────────────────
+    {
+        pattern: "^BIGipServer",
+        name: "F5 BIG-IP Persistence Cookie",
+        category: "infrastructure",
+        technology: "F5 BIG-IP",
+        decode: "Decimal cookie value encodes backend IP:port. Split value by '.': " +
+            "first part is encoded IP (convert to hex, reverse byte pairs, convert each pair to decimal octets), " +
+            "second part is encoded port (convert to hex, reverse byte pair, convert to decimal). " +
+            "Example: 1677787402.36895.0000 -> IP 10.1.1.100, port 8080.",
+    },
+    {
+        pattern: "^NSC_",
+        name: "Citrix NetScaler Persistence Cookie",
+        category: "infrastructure",
+        technology: "Citrix NetScaler / ADC",
+        decode: "Cookie name suffix after 'NSC_' is the vserver name with character substitution " +
+            "(a-z mapped by XOR/Caesar). Cookie value is hex-encoded: first 8 hex chars = " +
+            "XOR-decoded VIP address, next 4 hex chars = XOR-decoded port. XOR key is 0x03.",
+    },
+    {
+        pattern: "^ROUTEID$",
+        name: "HAProxy Route Persistence",
+        category: "infrastructure",
+        technology: "HAProxy",
+        decode: "Value is the backend server identifier from HAProxy configuration (server directive name). " +
+            "Reveals internal node naming conventions.",
+    },
+    {
+        pattern: "^SERVERID$",
+        name: "HAProxy Server ID",
+        category: "infrastructure",
+        technology: "HAProxy",
+        decode: "Value is the backend server name or address assigned in HAProxy config.",
+    },
+    {
+        pattern: "^AWSALB$",
+        name: "AWS Application Load Balancer",
+        category: "infrastructure",
+        technology: "AWS ALB",
+        decode: "Base64-encoded value contains ALB identifier and target group routing info. " +
+            "Decoding reveals the ALB internal name and availability zone.",
+    },
+    {
+        pattern: "^AWSALBCORS$",
+        name: "AWS ALB CORS Cookie",
+        category: "infrastructure",
+        technology: "AWS ALB",
+    },
+    {
+        pattern: "^GCLB$",
+        name: "Google Cloud Load Balancer",
+        category: "infrastructure",
+        technology: "Google Cloud Platform",
+        decode: "Base64-encoded value identifies the backend service instance.",
+    },
+    // ──────────────────────────────────────────────────
+    // Security / CDN / WAF
+    // ──────────────────────────────────────────────────
+    {
+        pattern: "^__cfduid$",
+        name: "Cloudflare Device ID (deprecated)",
+        category: "security",
+        technology: "Cloudflare",
+    },
+    {
+        pattern: "^__cf_bm$",
+        name: "Cloudflare Bot Management",
+        category: "security",
+        technology: "Cloudflare",
+    },
+    {
+        pattern: "^_cfuvid$",
+        name: "Cloudflare Unique Visitor ID",
+        category: "security",
+        technology: "Cloudflare",
+    },
+    {
+        pattern: "^cf_clearance$",
+        name: "Cloudflare Challenge Clearance",
+        category: "security",
+        technology: "Cloudflare",
+    },
+    {
+        pattern: "^incap_ses_",
+        name: "Imperva Incapsula Session",
+        category: "security",
+        technology: "Imperva / Incapsula WAF",
+        decode: "Cookie name suffix contains session and site identifiers. Value is an encrypted session token.",
+    },
+    {
+        pattern: "^visid_incap_",
+        name: "Imperva Incapsula Visitor ID",
+        category: "security",
+        technology: "Imperva / Incapsula WAF",
+    },
+    {
+        pattern: "^__hssc$",
+        name: "HubSpot Session Cookie",
+        category: "analytics",
+        technology: "HubSpot",
+    },
+    {
+        pattern: "^__hstc$",
+        name: "HubSpot Tracking Cookie",
+        category: "analytics",
+        technology: "HubSpot",
+    },
+];
+//# sourceMappingURL=cookie-patterns.js.map

package/dist/data/cookie-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-patterns.js","sourceRoot":"","sources":["../../src/data/cookie-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgBH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,qDAAqD;IACrD,qCAAqC;IACrC,qDAAqD;IACrD;QACE,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,KAAK;KAClB;IACD;QACE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,oBAAoB;KACjC;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;KACtB;IACD;QACE,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,sBAAsB;KACnC;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,eAAe;KAC5B;IACD;QACE,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,yBAAyB;KACtC;IACD;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,eAAe;KAC5B;IACD;QACE,OAAO,EAAE,yBAAyB;QAClC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,WAAW;KACxB;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,WAAW;KACxB;IACD;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,WAAW;KACxB;IACD;QACE,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,QAAQ;KACrB;IACD;QACE,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,gBAAgB;KAC7B;IACD;QACE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,mBAAmB;KAChC;IACD;QACE,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,iBAAiB;KAC9B;IACD;QACE,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,iBAAiB;KAC9B;IACD;QACE,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,sBAAsB;KACnC;IAED,qDAAqD;IACrD,iCAAiC;IACjC,qDAAqD;IACrD;QACE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,WAAW;QACvB,MAAM,EACJ,oEAAoE;YACpE,sGAAsG;YACtG,uFAAuF;YACvF,6DAA6D;KAChE;IACD;QACE,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,qCAAqC;QAC3C,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,wBAAwB;QACpC,MAAM,EACJ,kFAAkF;YAClF,+EAA+E;YAC/E,gFAAgF;KACnF;IACD;QACE,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,SAAS;QACrB,MAAM,EACJ,6FAA6F;YAC7F,2CAA2C;KAC9C;IACD;QACE,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,yEAAyE;KAClF;IACD;QACE,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,SAAS;QACrB,MAAM,EACJ,8EAA8E;YAC9E,+DAA+D;KAClE;IACD;QACE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,SAAS;KACtB;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,uBAAuB;QACnC,MAAM,EAAE,+DAA+D;KACxE;IAED,qDAAqD;IACrD,uBAAuB;IACvB,qDAAqD;IACrD;QACE,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,YAAY;KACzB;IACD;QACE,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,YAAY;KACzB;IACD;QACE,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,YAAY;KACzB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,YAAY;KACzB;IACD;QACE,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,yBAAyB;QACrC,MAAM,EACJ,gGAAgG;KACnG;IACD;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,yBAAyB;KACtC;IACD;QACE,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,WAAW;QACrB,UAAU,EAAE,SAAS;KACtB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,WAAW;QACrB,UAAU,EAAE,SAAS;KACtB;CACF,CAAC"}

package/dist/data/error-signatures.d.ts

@@ -0,0 +1,19 @@
+export interface ErrorSignature {
+    /** Server or framework name */
+    server: string;
+    /** Patterns to match against the HTTP response */
+    patterns: {
+        /** Regex strings to match in the response body */
+        body?: string[];
+        /** Expected HTTP status code */
+        status?: number;
+        /** Regex patterns to match against response header values (header name -> regex) */
+        headers?: Record<string, string>;
+    };
+    /** URL paths that are likely to trigger this error page */
+    triggerPaths: string[];
+    /** Confidence score from 0.0 to 1.0 */
+    confidence: number;
+}
+export declare const ERROR_SIGNATURES: ErrorSignature[];
+//# sourceMappingURL=error-signatures.d.ts.map

package/dist/data/error-signatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-signatures.d.ts","sourceRoot":"","sources":["../../src/data/error-signatures.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,EAAE;QACR,kDAAkD;QAClD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,gCAAgC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oFAAoF;QACpF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,2DAA2D;IAC3D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,gBAAgB,EAAE,cAAc,EA2U5C,CAAC"}

package/dist/data/error-signatures.js

@@ -0,0 +1,321 @@
+// error-signatures.ts — Error page patterns for server/framework fingerprinting
+// Each signature maps a server or framework to the error response patterns it produces.
+export const ERROR_SIGNATURES = [
+    // ── Apache HTTPD ───────────────────────────────────────────────────────
+    {
+        server: "Apache",
+        patterns: {
+            body: [
+                "<address>Apache\\/([\\d.]+)\\s*(?:\\(.*?\\))?\\s*Server at",
+                "Not Found.*The requested URL was not found on this server",
+            ],
+            status: 404,
+            headers: {
+                server: "^Apache\\/[\\d.]+",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent-path-abc123",
+            "/this-does-not-exist.html",
+        ],
+        confidence: 0.9,
+    },
+    // ── Nginx ──────────────────────────────────────────────────────────────
+    {
+        server: "Nginx",
+        patterns: {
+            body: [
+                "<title>\\d{3}\\s+.*<\\/title>\\s*<\\/head>\\s*<body>\\s*<center><h1>\\d{3}",
+                "<hr><center>nginx\\/([\\d.]+)<\\/center>",
+                "<center>nginx<\\/center>",
+            ],
+            status: 404,
+            headers: {
+                server: "^nginx",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent-path-abc123",
+            "/this-does-not-exist.html",
+        ],
+        confidence: 0.9,
+    },
+    // ── Microsoft IIS ──────────────────────────────────────────────────────
+    {
+        server: "IIS",
+        patterns: {
+            body: [
+                "Microsoft-IIS\\/([\\d.]+)",
+                '<span><H1>Server Error in \'.*?\' Application\\.<\\/H1>',
+                "HTTP Error \\d{3}\\.\\d+ - .*",
+                "Detailed Error Information:",
+            ],
+            status: 404,
+            headers: {
+                server: "^Microsoft-IIS\\/[\\d.]+",
+                "x-powered-by": "^ASP\\.NET",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent.aspx",
+            "/nonexistent.asp",
+            "/trace.axd",
+        ],
+        confidence: 0.85,
+    },
+    // ── Apache Tomcat ──────────────────────────────────────────────────────
+    {
+        server: "Tomcat",
+        patterns: {
+            body: [
+                "<title>Apache Tomcat\\/([\\d.]+) - Error report<\\/title>",
+                "<h1>HTTP Status \\d{3} &ndash;",
+                "java\\.lang\\.\\w+Exception",
+                "org\\.apache\\.catalina\\.",
+            ],
+            status: 404,
+            headers: {
+                server: "^Apache-Coyote\\/[\\d.]+",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+            "/WEB-INF/",
+            "/META-INF/",
+        ],
+        confidence: 0.9,
+    },
+    // ── Express.js ─────────────────────────────────────────────────────────
+    {
+        server: "Express",
+        patterns: {
+            body: [
+                "Cannot GET \\/.*",
+                "Cannot POST \\/.*",
+                "ReferenceError:.*<br>\\s+at\\s+",
+                "<!DOCTYPE html>\\s*<html.*?>\\s*<head>\\s*<title>Error<\\/title>",
+            ],
+            status: 404,
+            headers: {
+                "x-powered-by": "^Express$",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent-path",
+            "/%00",
+        ],
+        confidence: 0.85,
+    },
+    // ── Django ─────────────────────────────────────────────────────────────
+    {
+        server: "Django",
+        patterns: {
+            body: [
+                "Page not found \\(404\\)",
+                "You're seeing this error because you have <code>DEBUG = True<\\/code>",
+                "Using the URLconf defined in <code>.*?\\.urls<\\/code>",
+                "DisallowedHost at \\/",
+                "django\\.core\\.exceptions\\.DisallowedHost",
+            ],
+            status: 404,
+            headers: {
+                "x-frame-options": "^DENY$",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+            "/admin/nonexistent",
+        ],
+        confidence: 0.9,
+    },
+    // ── Laravel (Ignition) ────────────────────────────────────────────────
+    {
+        server: "Laravel",
+        patterns: {
+            body: [
+                "Whoops!\\s*<\\/h1>",
+                "Illuminate\\\\.*?Exception",
+                "ignition-ui",
+                "laravel_session",
+                "Symfony\\\\Component\\\\HttpKernel\\\\Exception\\\\NotFoundHttpException",
+            ],
+            status: 500,
+            headers: {
+                "set-cookie": "laravel_session=",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+            "/_ignition/health-check",
+            "/_ignition/execute-solution",
+        ],
+        confidence: 0.85,
+    },
+    // ── Spring Boot ────────────────────────────────────────────────────────
+    {
+        server: "Spring Boot",
+        patterns: {
+            body: [
+                "Whitelabel Error Page",
+                '"timestamp"\\s*:\\s*".*?"\\s*,\\s*"status"\\s*:\\s*\\d+\\s*,\\s*"error"\\s*:',
+                "This application has no explicit mapping for \\/error",
+                '"path"\\s*:\\s*"\\/.*?"',
+            ],
+            status: 404,
+            headers: {
+                "x-application-context": ".*",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+            "/error",
+            "/actuator",
+        ],
+        confidence: 0.9,
+    },
+    // ── Flask / Werkzeug ───────────────────────────────────────────────────
+    {
+        server: "Flask",
+        patterns: {
+            body: [
+                "werkzeug\\.exceptions\\.NotFound",
+                "The requested URL was not found on the server",
+                "<!DOCTYPE HTML PUBLIC.*?werkzeug",
+                "Traceback \\(most recent call last\\)",
+                "\\/console.*?__debugger__",
+            ],
+            status: 404,
+            headers: {
+                server: "^Werkzeug\\/[\\d.]+",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+            "/console",
+        ],
+        confidence: 0.85,
+    },
+    // ── Ruby on Rails ──────────────────────────────────────────────────────
+    {
+        server: "Rails",
+        patterns: {
+            body: [
+                "ActionController::RoutingError",
+                "No route matches \\[GET\\]",
+                "Rails\\.root:",
+                "<title>Action Controller: Exception caught<\\/title>",
+                "_rucksack_session",
+            ],
+            status: 404,
+            headers: {
+                "x-request-id": "^[0-9a-f-]{36}$",
+                "x-runtime": "^[\\d.]+$",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+            "/rails/info/properties",
+        ],
+        confidence: 0.85,
+    },
+    // ── FastAPI ────────────────────────────────────────────────────────────
+    {
+        server: "FastAPI",
+        patterns: {
+            body: [
+                '\\{"detail"\\s*:\\s*"Not Found"\\}',
+                '\\{"detail"\\s*:\\s*\\[\\{.*?"type"\\s*:',
+            ],
+            status: 404,
+            headers: {
+                "content-type": "^application\\/json",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+            "/docs",
+            "/openapi.json",
+        ],
+        confidence: 0.8,
+    },
+    // ── Gin (Go) ───────────────────────────────────────────────────────────
+    {
+        server: "Gin",
+        patterns: {
+            body: [
+                "^404 page not found$",
+            ],
+            status: 404,
+            headers: {
+                "content-type": "^text\\/plain",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+        ],
+        confidence: 0.7,
+    },
+    // ── ASP.NET ────────────────────────────────────────────────────────────
+    {
+        server: "ASP.NET",
+        patterns: {
+            body: [
+                "Server Error in '\\/.*?' Application",
+                "Runtime Error",
+                "\\[HttpException.*?\\]",
+                "Version Information:.*?Microsoft \\.NET Framework Version:",
+                "ASP\\.NET is configured to show.*?error messages",
+            ],
+            status: 500,
+            headers: {
+                "x-powered-by": "^ASP\\.NET",
+                "x-aspnet-version": "^[\\d.]+$",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent.aspx",
+            "/elmah.axd",
+            "/Trace.axd",
+        ],
+        confidence: 0.9,
+    },
+    // ── Koa.js ─────────────────────────────────────────────────────────────
+    {
+        server: "Koa",
+        patterns: {
+            body: [
+                "^Not Found$",
+                "InternalServerError:.*at.*",
+            ],
+            status: 404,
+            headers: {
+                "x-koa-redis": ".*",
+                "content-type": "^text\\/plain",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+        ],
+        confidence: 0.6,
+    },
+    // ── Fiber (Go) ─────────────────────────────────────────────────────────
+    {
+        server: "Fiber",
+        patterns: {
+            body: [
+                "Cannot GET \\/.*",
+                "Cannot POST \\/.*",
+            ],
+            status: 404,
+            headers: {
+                "x-request-id": "^[0-9a-f-]{36}$",
+                "content-type": "^text\\/plain",
+            },
+        },
+        triggerPaths: [
+            "/nonexistent",
+        ],
+        confidence: 0.6,
+    },
+];
+//# sourceMappingURL=error-signatures.js.map

package/dist/data/error-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-signatures.js","sourceRoot":"","sources":["../../src/data/error-signatures.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wFAAwF;AAoBxF,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,0EAA0E;IAC1E;QACE,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,4DAA4D;gBAC5D,2DAA2D;aAC5D;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,MAAM,EAAE,mBAAmB;aAC5B;SACF;QACD,YAAY,EAAE;YACZ,0BAA0B;YAC1B,2BAA2B;SAC5B;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,4EAA4E;gBAC5E,0CAA0C;gBAC1C,0BAA0B;aAC3B;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;aACjB;SACF;QACD,YAAY,EAAE;YACZ,0BAA0B;YAC1B,2BAA2B;SAC5B;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,2BAA2B;gBAC3B,yDAAyD;gBACzD,+BAA+B;gBAC/B,6BAA6B;aAC9B;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,MAAM,EAAE,0BAA0B;gBAClC,cAAc,EAAE,YAAY;aAC7B;SACF;QACD,YAAY,EAAE;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,YAAY;SACb;QACD,UAAU,EAAE,IAAI;KACjB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,2DAA2D;gBAC3D,gCAAgC;gBAChC,6BAA6B;gBAC7B,4BAA4B;aAC7B;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,MAAM,EAAE,0BAA0B;aACnC;SACF;QACD,YAAY,EAAE;YACZ,cAAc;YACd,WAAW;YACX,YAAY;SACb;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,kBAAkB;gBAClB,mBAAmB;gBACnB,iCAAiC;gBACjC,kEAAkE;aACnE;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,WAAW;aAC5B;SACF;QACD,YAAY,EAAE;YACZ,mBAAmB;YACnB,MAAM;SACP;QACD,UAAU,EAAE,IAAI;KACjB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,0BAA0B;gBAC1B,uEAAuE;gBACvE,wDAAwD;gBACxD,uBAAuB;gBACvB,6CAA6C;aAC9C;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,iBAAiB,EAAE,QAAQ;aAC5B;SACF;QACD,YAAY,EAAE;YACZ,cAAc;YACd,oBAAoB;SACrB;QACD,UAAU,EAAE,GAAG;KAChB;IAED,yEAAyE;IACzE;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,oBAAoB;gBACpB,4BAA4B;gBAC5B,aAAa;gBACb,iBAAiB;gBACjB,0EAA0E;aAC3E;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,YAAY,EAAE,kBAAkB;aACjC;SACF;QACD,YAAY,EAAE;YACZ,cAAc;YACd,yBAAyB;YACzB,6BAA6B;SAC9B;QACD,UAAU,EAAE,IAAI;KACjB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,uBAAuB;gBACvB,8EAA8E;gBAC9E,uDAAuD;gBACvD,yBAAyB;aAC1B;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,uBAAuB,EAAE,IAAI;aAC9B;SACF;QACD,YAAY,EAAE;YACZ,cAAc;YACd,QAAQ;YACR,WAAW;SACZ;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,kCAAkC;gBAClC,+CAA+C;gBAC/C,kCAAkC;gBAClC,uCAAuC;gBACvC,2BAA2B;aAC5B;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,MAAM,EAAE,qBAAqB;aAC9B;SACF;QACD,YAAY,EAAE;YACZ,cAAc;YACd,UAAU;SACX;QACD,UAAU,EAAE,IAAI;KACjB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,gCAAgC;gBAChC,4BAA4B;gBAC5B,eAAe;gBACf,sDAAsD;gBACtD,mBAAmB;aACpB;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,iBAAiB;gBACjC,WAAW,EAAE,WAAW;aACzB;SACF;QACD,YAAY,EAAE;YACZ,cAAc;YACd,wBAAwB;SACzB;QACD,UAAU,EAAE,IAAI;KACjB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,oCAAoC;gBACpC,0CAA0C;aAC3C;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,qBAAqB;aACtC;SACF;QACD,YAAY,EAAE;YACZ,cAAc;YACd,OAAO;YACP,eAAe;SAChB;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,sBAAsB;aACvB;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,eAAe;aAChC;SACF;QACD,YAAY,EAAE;YACZ,cAAc;SACf;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,sCAAsC;gBACtC,eAAe;gBACf,wBAAwB;gBACxB,4DAA4D;gBAC5D,kDAAkD;aACnD;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,YAAY;gBAC5B,kBAAkB,EAAE,WAAW;aAChC;SACF;QACD,YAAY,EAAE;YACZ,mBAAmB;YACnB,YAAY;YACZ,YAAY;SACb;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,aAAa;gBACb,4BAA4B;aAC7B;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,eAAe;aAChC;SACF;QACD,YAAY,EAAE;YACZ,cAAc;SACf;QACD,UAAU,EAAE,GAAG;KAChB;IAED,0EAA0E;IAC1E;QACE,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,kBAAkB;gBAClB,mBAAmB;aACpB;YACD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,iBAAiB;gBACjC,cAAc,EAAE,eAAe;aAChC;SACF;QACD,YAAY,EAAE;YACZ,cAAc;SACf;QACD,UAAU,EAAE,GAAG;KAChB;CACF,CAAC"}

package/dist/data/favicon-hashes.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Favicon MurmurHash3 database for application fingerprinting.
+ *
+ * Shodan computes a signed 32-bit MurmurHash3 of the raw favicon bytes (after
+ * base64-encoding and joining lines with \n). The resulting hash is deterministic
+ * for a given favicon file. Many applications ship a default favicon that never
+ * changes across installations, making the hash a reliable fingerprint.
+ *
+ * Usage in Shodan: http.favicon.hash:<hash>
+ *
+ * References:
+ *  - https://www.shodan.io/search/facet?query=http.favicon.hash
+ *  - https://github.com/Viralmaniar/Favicon-Hash-For-Shodan
+ */
+/** A known favicon hash entry. */
+export interface FaviconHash {
+    /** Signed 32-bit MurmurHash3 of the favicon */
+    hash: number;
+    /** Human-readable application name */
+    name: string;
+    /** Classification category */
+    category: "ci-cd" | "monitoring" | "firewall" | "network" | "cms" | "database" | "security" | "storage" | "management" | "other";
+}
+export declare const FAVICON_HASHES: FaviconHash[];
+//# sourceMappingURL=favicon-hashes.d.ts.map

package/dist/data/favicon-hashes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"favicon-hashes.d.ts","sourceRoot":"","sources":["../../src/data/favicon-hashes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,QAAQ,EACJ,OAAO,GACP,YAAY,GACZ,UAAU,GACV,SAAS,GACT,KAAK,GACL,UAAU,GACV,UAAU,GACV,SAAS,GACT,YAAY,GACZ,OAAO,CAAC;CACb;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EAiPvC,CAAC"}