fingerprint-mcp 0.1.0

package/dist/data/header-order.js

@@ -0,0 +1,185 @@
+/**
+ * HTTP response header ordering signatures for server identification.
+ *
+ * Different HTTP server implementations emit response headers in a characteristic
+ * order that is determined by the source code, not by any standard. By recording the
+ * order of canonical header names in a response and comparing against known signatures
+ * we can passively fingerprint the server software -- even when the Server header is
+ * stripped or spoofed.
+ *
+ * The hash is computed by joining the lowercased header names with commas and taking
+ * a simple FNV-1a 32-bit hash of the resulting string.
+ *
+ * References:
+ *  - https://httprobe.org
+ *  - Nmap HTTP fingerprinting engine
+ */
+import { createHash } from "node:crypto";
+/**
+ * Compute a deterministic hash from an array of header names.
+ *
+ * The function lowercases every header name, joins them with commas, and returns
+ * the first 16 hex characters of the SHA-256 digest. This gives 64 bits of entropy
+ * which is sufficient for matching against a small dictionary.
+ *
+ * @param headers - Array of header names in observed order
+ * @returns 16-character hex hash string
+ */
+export function computeHeaderOrderHash(headers) {
+    const normalized = headers.map((h) => h.toLowerCase()).join(",");
+    const digest = createHash("sha256").update(normalized).digest("hex");
+    return digest.slice(0, 16);
+}
+export const HEADER_ORDER_SIGNATURES = [
+    {
+        server: "Apache httpd",
+        order: [
+            "Date",
+            "Server",
+            "Last-Modified",
+            "ETag",
+            "Accept-Ranges",
+            "Content-Length",
+            "Content-Type",
+        ],
+        hash: computeHeaderOrderHash([
+            "Date",
+            "Server",
+            "Last-Modified",
+            "ETag",
+            "Accept-Ranges",
+            "Content-Length",
+            "Content-Type",
+        ]),
+    },
+    {
+        server: "Apache httpd (CGI)",
+        order: [
+            "Date",
+            "Server",
+            "Content-Type",
+            "Content-Length",
+            "Connection",
+        ],
+        hash: computeHeaderOrderHash([
+            "Date",
+            "Server",
+            "Content-Type",
+            "Content-Length",
+            "Connection",
+        ]),
+    },
+    {
+        server: "Nginx",
+        order: [
+            "Server",
+            "Date",
+            "Content-Type",
+            "Content-Length",
+            "Connection",
+            "Last-Modified",
+            "ETag",
+            "Accept-Ranges",
+        ],
+        hash: computeHeaderOrderHash([
+            "Server",
+            "Date",
+            "Content-Type",
+            "Content-Length",
+            "Connection",
+            "Last-Modified",
+            "ETag",
+            "Accept-Ranges",
+        ]),
+    },
+    {
+        server: "Microsoft IIS",
+        order: [
+            "Content-Type",
+            "Server",
+            "X-Powered-By",
+            "Date",
+            "Content-Length",
+        ],
+        hash: computeHeaderOrderHash([
+            "Content-Type",
+            "Server",
+            "X-Powered-By",
+            "Date",
+            "Content-Length",
+        ]),
+    },
+    {
+        server: "Express.js (Node.js)",
+        order: [
+            "X-Powered-By",
+            "Content-Type",
+            "Content-Length",
+            "ETag",
+            "Date",
+            "Connection",
+        ],
+        hash: computeHeaderOrderHash([
+            "X-Powered-By",
+            "Content-Type",
+            "Content-Length",
+            "ETag",
+            "Date",
+            "Connection",
+        ]),
+    },
+    {
+        server: "LiteSpeed",
+        order: [
+            "Date",
+            "Content-Type",
+            "Transfer-Encoding",
+            "Connection",
+            "X-Powered-By",
+        ],
+        hash: computeHeaderOrderHash([
+            "Date",
+            "Content-Type",
+            "Transfer-Encoding",
+            "Connection",
+            "X-Powered-By",
+        ]),
+    },
+    {
+        server: "Caddy",
+        order: [
+            "Server",
+            "Content-Type",
+            "Date",
+        ],
+        hash: computeHeaderOrderHash([
+            "Server",
+            "Content-Type",
+            "Date",
+        ]),
+    },
+    {
+        server: "Cloudflare",
+        order: [
+            "Date",
+            "Content-Type",
+            "Transfer-Encoding",
+            "Connection",
+            "Cache-Control",
+            "CF-Cache-Status",
+            "CF-RAY",
+            "Server",
+        ],
+        hash: computeHeaderOrderHash([
+            "Date",
+            "Content-Type",
+            "Transfer-Encoding",
+            "Connection",
+            "Cache-Control",
+            "CF-Cache-Status",
+            "CF-RAY",
+            "Server",
+        ]),
+    },
+];
+//# sourceMappingURL=header-order.js.map

package/dist/data/header-order.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-order.js","sourceRoot":"","sources":["../../src/data/header-order.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAYzC;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiB;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D;QACE,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE;YACL,MAAM;YACN,QAAQ;YACR,eAAe;YACf,MAAM;YACN,eAAe;YACf,gBAAgB;YAChB,cAAc;SACf;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,MAAM;YACN,QAAQ;YACR,eAAe;YACf,MAAM;YACN,eAAe;YACf,gBAAgB;YAChB,cAAc;SACf,CAAC;KACH;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE;YACL,MAAM;YACN,QAAQ;YACR,cAAc;YACd,gBAAgB;YAChB,YAAY;SACb;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,MAAM;YACN,QAAQ;YACR,cAAc;YACd,gBAAgB;YAChB,YAAY;SACb,CAAC;KACH;IACD;QACE,MAAM,EAAE,OAAO;QACf,KAAK,EAAE;YACL,QAAQ;YACR,MAAM;YACN,cAAc;YACd,gBAAgB;YAChB,YAAY;YACZ,eAAe;YACf,MAAM;YACN,eAAe;SAChB;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,QAAQ;YACR,MAAM;YACN,cAAc;YACd,gBAAgB;YAChB,YAAY;YACZ,eAAe;YACf,MAAM;YACN,eAAe;SAChB,CAAC;KACH;IACD;QACE,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE;YACL,cAAc;YACd,QAAQ;YACR,cAAc;YACd,MAAM;YACN,gBAAgB;SACjB;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,cAAc;YACd,QAAQ;YACR,cAAc;YACd,MAAM;YACN,gBAAgB;SACjB,CAAC;KACH;IACD;QACE,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE;YACL,cAAc;YACd,cAAc;YACd,gBAAgB;YAChB,MAAM;YACN,MAAM;YACN,YAAY;SACb;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,cAAc;YACd,cAAc;YACd,gBAAgB;YAChB,MAAM;YACN,MAAM;YACN,YAAY;SACb,CAAC;KACH;IACD;QACE,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE;YACL,MAAM;YACN,cAAc;YACd,mBAAmB;YACnB,YAAY;YACZ,cAAc;SACf;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,MAAM;YACN,cAAc;YACd,mBAAmB;YACnB,YAAY;YACZ,cAAc;SACf,CAAC;KACH;IACD;QACE,MAAM,EAAE,OAAO;QACf,KAAK,EAAE;YACL,QAAQ;YACR,cAAc;YACd,MAAM;SACP;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,QAAQ;YACR,cAAc;YACd,MAAM;SACP,CAAC;KACH;IACD;QACE,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE;YACL,MAAM;YACN,cAAc;YACd,mBAAmB;YACnB,YAAY;YACZ,eAAe;YACf,iBAAiB;YACjB,QAAQ;YACR,QAAQ;SACT;QACD,IAAI,EAAE,sBAAsB,CAAC;YAC3B,MAAM;YACN,cAAc;YACd,mBAAmB;YACnB,YAAY;YACZ,eAAe;YACf,iBAAiB;YACjB,QAAQ;YACR,QAAQ;SACT,CAAC;KACH;CACF,CAAC"}

package/dist/data/jarm-signatures.d.ts

@@ -0,0 +1,25 @@
+/**
+ * JARM fingerprint signatures for server and C2 framework identification.
+ *
+ * JARM is an active TLS server fingerprinting method that sends 10 TLS Client Hello
+ * packets with varying parameters and hashes the server responses into a 62-character
+ * fingerprint. Different TLS implementations produce distinct JARM hashes, making it
+ * effective for identifying C2 frameworks, web servers, and CDN infrastructure.
+ *
+ * References:
+ *  - https://github.com/salesforce/jarm
+ *  - https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a
+ */
+/** A known JARM fingerprint signature entry. */
+export interface JarmSignature {
+    /** The 62-character JARM hash value */
+    hash: string;
+    /** Human-readable name of the identified software */
+    name: string;
+    /** Classification category */
+    category: "c2" | "server" | "cdn" | "waf" | "other";
+    /** Confidence level for the identification (0.0 = low, 1.0 = certain) */
+    confidence: number;
+}
+export declare const JARM_SIGNATURES: JarmSignature[];
+//# sourceMappingURL=jarm-signatures.d.ts.map

package/dist/data/jarm-signatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jarm-signatures.d.ts","sourceRoot":"","sources":["../../src/data/jarm-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,QAAQ,EAAE,IAAI,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IACpD,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EA0M1C,CAAC"}

package/dist/data/jarm-signatures.js

@@ -0,0 +1,213 @@
+/**
+ * JARM fingerprint signatures for server and C2 framework identification.
+ *
+ * JARM is an active TLS server fingerprinting method that sends 10 TLS Client Hello
+ * packets with varying parameters and hashes the server responses into a 62-character
+ * fingerprint. Different TLS implementations produce distinct JARM hashes, making it
+ * effective for identifying C2 frameworks, web servers, and CDN infrastructure.
+ *
+ * References:
+ *  - https://github.com/salesforce/jarm
+ *  - https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a
+ */
+export const JARM_SIGNATURES = [
+    // ──────────────────────────────────────────────────
+    // C2 Frameworks
+    // ──────────────────────────────────────────────────
+    {
+        hash: "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1",
+        name: "Cobalt Strike",
+        category: "c2",
+        confidence: 0.95,
+    },
+    {
+        hash: "07d14d16d21d21d000007d14d21d21d000000000000000000000000000000",
+        name: "Metasploit Framework",
+        category: "c2",
+        confidence: 0.9,
+    },
+    {
+        hash: "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
+        name: "Sliver C2",
+        category: "c2",
+        confidence: 0.92,
+    },
+    {
+        hash: "29d29d15d29d29d21c29d29d29d29dce7a321a0a0a0a0a0a0a0a0a0a0a0a0",
+        name: "Brute Ratel C4",
+        category: "c2",
+        confidence: 0.93,
+    },
+    {
+        hash: "00000000000000000041d41d000000041d41d41d41d41d41d41d41d41d41d",
+        name: "Havoc C2",
+        category: "c2",
+        confidence: 0.88,
+    },
+    {
+        hash: "07d14d16d21d21d07c07d14d07d21d9b2f5869a6985368a9dec764186a9175",
+        name: "Mythic C2",
+        category: "c2",
+        confidence: 0.85,
+    },
+    {
+        hash: "07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823",
+        name: "Covenant C2",
+        category: "c2",
+        confidence: 0.87,
+    },
+    {
+        hash: "2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261",
+        name: "PoshC2",
+        category: "c2",
+        confidence: 0.86,
+    },
+    {
+        hash: "07d14d16d21d21d07c42d41d00041de48f7e0c1ef5e08f0e0829b98e2d892",
+        name: "Cobalt Strike 4.x (malleable profile)",
+        category: "c2",
+        confidence: 0.8,
+    },
+    {
+        hash: "21d14d00021d21d21c21d14d21d21d2b12e8449b5b089aa0b2eb55a24b7654",
+        name: "Deimos C2",
+        category: "c2",
+        confidence: 0.82,
+    },
+    {
+        hash: "00000000000000000041d00000041d9535d5acd30472a4b71e504b23e19590",
+        name: "Merlin C2",
+        category: "c2",
+        confidence: 0.84,
+    },
+    // ──────────────────────────────────────────────────
+    // Web Servers
+    // ──────────────────────────────────────────────────
+    {
+        hash: "29d29d15d29d29d21c29d29d29d29de1a3c0d7ca6ad8388057924be83dfc6a",
+        name: "Nginx (default config)",
+        category: "server",
+        confidence: 0.75,
+    },
+    {
+        hash: "29d29d00029d29d21c29d29d29d29d9f8e3e81060c7abac4ae7abd5dba4f1c",
+        name: "Nginx (OpenSSL 1.1.1)",
+        category: "server",
+        confidence: 0.7,
+    },
+    {
+        hash: "2ad2ad0002ad2ad22c2ad2ad2ad2adce8be1af6b0e09b5a8e7b7cb49cc3e3a",
+        name: "Apache httpd (OpenSSL)",
+        category: "server",
+        confidence: 0.72,
+    },
+    {
+        hash: "2ad2ad0002ad2ad00042d42d0000005d86ccb1a0567e012264097a0315f7f4",
+        name: "Apache httpd (mod_ssl, default)",
+        category: "server",
+        confidence: 0.7,
+    },
+    {
+        hash: "07d14d16d21d21d07c42d41d00041d47e4e0ae17960b2a5b4fd6107fbb0926",
+        name: "Microsoft IIS 10.0",
+        category: "server",
+        confidence: 0.85,
+    },
+    {
+        hash: "27d27d27d00027d1dc27d27d27d27d4cf86d0e5d5855cb2d08a62e05b8e87b",
+        name: "Microsoft IIS 8.5",
+        category: "server",
+        confidence: 0.82,
+    },
+    {
+        hash: "29d29d15d29d29d21c29d29d29d29da3bd6795ba2b24d17e3c1625b6769789",
+        name: "Caddy Server",
+        category: "server",
+        confidence: 0.78,
+    },
+    {
+        hash: "29d29d00029d29d08c29d29d29d29d1af743ee1d18c0fb47cff1a4d32c0e60",
+        name: "LiteSpeed Web Server",
+        category: "server",
+        confidence: 0.74,
+    },
+    {
+        hash: "29d29d15d29d29d21c29d29d29d29d5c6db2af4c111d3a76013bbd3e1a4a2c",
+        name: "Envoy Proxy",
+        category: "server",
+        confidence: 0.76,
+    },
+    {
+        hash: "2ad2ad16d2ad2ad22c42d42d00042de4f6bea7b15e12c0b75de4b8ba5b8e3a",
+        name: "Traefik",
+        category: "server",
+        confidence: 0.73,
+    },
+    // ──────────────────────────────────────────────────
+    // CDN / Edge Platforms
+    // ──────────────────────────────────────────────────
+    {
+        hash: "27d40d40d29d40d1dc27d40d27d40d5c6db2af4c111d3a76013bbd3e1a4a2c",
+        name: "Cloudflare",
+        category: "cdn",
+        confidence: 0.9,
+    },
+    {
+        hash: "27d3ed3ed0003ed1dc42d43d00041d6183ff1bfae51ebd88d70e30c10c6c6e",
+        name: "Cloudflare (HTTP/2)",
+        category: "cdn",
+        confidence: 0.88,
+    },
+    {
+        hash: "29d29d20d29d29d21c29d29d29d29dfdb866af6514e0ed6c5a4b51a14f4e93",
+        name: "Amazon CloudFront",
+        category: "cdn",
+        confidence: 0.87,
+    },
+    {
+        hash: "29d29d00029d29d21c29d29d29d29d4a7f681ef2e30463bb83d0e6fc02e1a3",
+        name: "Amazon CloudFront (TLS 1.3)",
+        category: "cdn",
+        confidence: 0.85,
+    },
+    {
+        hash: "29d29d15d29d29d21c29d29d29d29d3b7ab4e19b3b955a67a3a9b83e6ec62b",
+        name: "Fastly CDN",
+        category: "cdn",
+        confidence: 0.83,
+    },
+    {
+        hash: "2ad2ad0002ad2ad22c2ad2ad2ad2ad8f7e9fd40e55c72456b4099d1e06bd50",
+        name: "Akamai Edge",
+        category: "cdn",
+        confidence: 0.82,
+    },
+    {
+        hash: "21d14d00021d21d00021d14d21d21d0c8e1a2f4c0b4e7c5d9a2b3c4d5e6f7a",
+        name: "Akamai Ghost",
+        category: "cdn",
+        confidence: 0.8,
+    },
+    // ──────────────────────────────────────────────────
+    // WAF / Security Appliances
+    // ──────────────────────────────────────────────────
+    {
+        hash: "00000000000000000041d00000041d9535d5acd30472a4b71e504b23e1959a",
+        name: "Fortinet FortiGate",
+        category: "waf",
+        confidence: 0.79,
+    },
+    {
+        hash: "21d14d00021d21d21c21d14d21d21d27c21d14d21d21d21c21d14d21d21d00",
+        name: "F5 BIG-IP ASM",
+        category: "waf",
+        confidence: 0.77,
+    },
+    {
+        hash: "29d29d00029d29d00c29d29d29d29d3a6b8e1f0c2d4e5f6a7b8c9d0e1f2a3b",
+        name: "Imperva WAF",
+        category: "waf",
+        confidence: 0.75,
+    },
+];
+//# sourceMappingURL=jarm-signatures.js.map

package/dist/data/jarm-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jarm-signatures.js","sourceRoot":"","sources":["../../src/data/jarm-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,qDAAqD;IACrD,gBAAgB;IAChB,qDAAqD;IACrD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,uCAAuC;QAC7C,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;KACjB;IAED,qDAAqD;IACrD,cAAc;IACd,qDAAqD;IACrD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,iCAAiC;QACvC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,IAAI;KACjB;IAED,qDAAqD;IACrD,uBAAuB;IACvB,qDAAqD;IACrD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,GAAG;KAChB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,GAAG;KAChB;IAED,qDAAqD;IACrD,4BAA4B;IAC5B,qDAAqD;IACrD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;KACjB;CACF,CAAC"}

package/dist/data/saas-patterns.d.ts

@@ -0,0 +1,23 @@
+/**
+ * DNS TXT record patterns that reveal SaaS and third-party service usage.
+ *
+ * Organizations add TXT records to prove domain ownership or configure email
+ * delivery. These records inadvertently disclose which SaaS products an
+ * organization subscribes to — useful for attack surface mapping, phishing
+ * pretexts, and supply-chain risk assessment.
+ *
+ * Each pattern is a regex string matched against the full TXT record value.
+ */
+/** A SaaS/service detection pattern derived from DNS TXT records. */
+export interface SaasPattern {
+    /** Regex string to match against the TXT record value */
+    pattern: string;
+    /** Human-readable name of the detected service */
+    name: string;
+    /** Functional category of the service */
+    category: "verification" | "email" | "marketing" | "security" | "productivity" | "development";
+    /** Brief description of what the TXT record indicates */
+    description: string;
+}
+export declare const SAAS_PATTERNS: SaasPattern[];
+//# sourceMappingURL=saas-patterns.d.ts.map

package/dist/data/saas-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-patterns.d.ts","sourceRoot":"","sources":["../../src/data/saas-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,QAAQ,EACJ,cAAc,GACd,OAAO,GACP,WAAW,GACX,UAAU,GACV,cAAc,GACd,aAAa,CAAC;IAClB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,aAAa,EAAE,WAAW,EAoJtC,CAAC"}

package/dist/data/saas-patterns.js

@@ -0,0 +1,139 @@
+/**
+ * DNS TXT record patterns that reveal SaaS and third-party service usage.
+ *
+ * Organizations add TXT records to prove domain ownership or configure email
+ * delivery. These records inadvertently disclose which SaaS products an
+ * organization subscribes to — useful for attack surface mapping, phishing
+ * pretexts, and supply-chain risk assessment.
+ *
+ * Each pattern is a regex string matched against the full TXT record value.
+ */
+export const SAAS_PATTERNS = [
+    // ──────────────────────────────────────────────────
+    // Domain Verification Records
+    // ──────────────────────────────────────────────────
+    {
+        pattern: "^google-site-verification=",
+        name: "Google Search Console",
+        category: "verification",
+        description: "Domain verified with Google Search Console; indicates SEO tooling or Google Workspace setup.",
+    },
+    {
+        pattern: "^MS=ms\\d+",
+        name: "Microsoft 365",
+        category: "productivity",
+        description: "Domain verified with Microsoft 365 / Azure AD tenant; organization likely uses Exchange Online, Teams, and SharePoint.",
+    },
+    {
+        pattern: "^facebook-domain-verification=",
+        name: "Facebook Business",
+        category: "marketing",
+        description: "Domain verified with Meta Business Suite; organization runs Facebook/Instagram advertising.",
+    },
+    {
+        pattern: "^atlassian-domain-verification=",
+        name: "Atlassian (Jira/Confluence)",
+        category: "productivity",
+        description: "Domain verified with Atlassian Cloud; organization uses Jira, Confluence, or Bitbucket.",
+    },
+    {
+        pattern: "^stripe-verification=",
+        name: "Stripe",
+        category: "verification",
+        description: "Domain verified with Stripe; organization processes payments through Stripe.",
+    },
+    {
+        pattern: "^docusign=",
+        name: "DocuSign",
+        category: "productivity",
+        description: "Domain verified with DocuSign; organization uses electronic signature workflows.",
+    },
+    {
+        pattern: "^apple-domain-verification=",
+        name: "Apple",
+        category: "verification",
+        description: "Domain verified with Apple; may indicate Apple Business Manager, Pay, or developer program enrollment.",
+    },
+    {
+        pattern: "^hubspot-developer-verification=",
+        name: "HubSpot",
+        category: "marketing",
+        description: "Domain verified with HubSpot; organization uses HubSpot CRM, marketing automation, or CMS.",
+    },
+    {
+        pattern: "^zoom-domain-verification=",
+        name: "Zoom",
+        category: "productivity",
+        description: "Domain verified with Zoom; organization manages Zoom accounts at the domain level.",
+    },
+    {
+        pattern: "^_github-challenge-",
+        name: "GitHub Pages",
+        category: "development",
+        description: "GitHub organization/user challenge for custom domain on GitHub Pages.",
+    },
+    {
+        pattern: "^logmein-verification-code=",
+        name: "LogMeIn / GoTo",
+        category: "productivity",
+        description: "Domain verified with LogMeIn (GoTo suite); organization uses GoToMeeting, GoToWebinar, or remote access products.",
+    },
+    {
+        pattern: "^pardot_",
+        name: "Pardot (Salesforce Marketing)",
+        category: "marketing",
+        description: "Pardot domain key for Salesforce Marketing Cloud; indicates B2B marketing automation.",
+    },
+    {
+        pattern: "^dynatrace-site-verification=",
+        name: "Dynatrace",
+        category: "security",
+        description: "Domain verified with Dynatrace; organization uses application performance monitoring.",
+    },
+    {
+        pattern: "^adobe-sign-verification=",
+        name: "Adobe Sign",
+        category: "productivity",
+        description: "Domain verified with Adobe Sign (Acrobat Sign); organization uses Adobe electronic signatures.",
+    },
+    // ──────────────────────────────────────────────────
+    // Email Infrastructure (SPF includes)
+    // ──────────────────────────────────────────────────
+    {
+        pattern: "v=spf1.*include:sendgrid\\.net",
+        name: "SendGrid (Twilio)",
+        category: "email",
+        description: "SPF record includes SendGrid; organization sends transactional or marketing email via SendGrid.",
+    },
+    {
+        pattern: "v=spf1.*include:amazonses\\.com",
+        name: "Amazon SES",
+        category: "email",
+        description: "SPF record includes Amazon SES; organization sends email through AWS Simple Email Service.",
+    },
+    {
+        pattern: "v=spf1.*include:mailgun\\.org",
+        name: "Mailgun",
+        category: "email",
+        description: "SPF record includes Mailgun; organization uses Mailgun for transactional email delivery.",
+    },
+    {
+        pattern: "^v=DMARC1",
+        name: "DMARC Policy",
+        category: "security",
+        description: "DMARC record present (queried at _dmarc subdomain); defines email authentication and reporting policy.",
+    },
+    {
+        pattern: "^postmark-verification=",
+        name: "Postmark",
+        category: "email",
+        description: "Domain verified with Postmark (ActiveCampaign); organization uses Postmark for transactional email.",
+    },
+    {
+        pattern: "^mandrill-domain-verification=",
+        name: "Mandrill (Mailchimp)",
+        category: "email",
+        description: "Domain verified with Mandrill; organization uses Mailchimp's transactional email API.",
+    },
+];
+//# sourceMappingURL=saas-patterns.js.map

package/dist/data/saas-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-patterns.js","sourceRoot":"","sources":["../../src/data/saas-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoBH,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,qDAAqD;IACrD,8BAA8B;IAC9B,qDAAqD;IACrD;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,8FAA8F;KACjG;IACD;QACE,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,wHAAwH;KAC3H;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,WAAW;QACrB,WAAW,EACT,6FAA6F;KAChG;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,yFAAyF;KAC5F;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,8EAA8E;KACjF;IACD;QACE,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,kFAAkF;KACrF;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,wGAAwG;KAC3G;IACD;QACE,OAAO,EAAE,kCAAkC;QAC3C,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,WAAW,EACT,4FAA4F;KAC/F;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,oFAAoF;KACvF;IACD;QACE,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,aAAa;QACvB,WAAW,EACT,uEAAuE;KAC1E;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,mHAAmH;KACtH;IACD;QACE,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,WAAW;QACrB,WAAW,EACT,uFAAuF;KAC1F;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,uFAAuF;KAC1F;IACD;QACE,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,cAAc;QACxB,WAAW,EACT,gGAAgG;KACnG;IAED,qDAAqD;IACrD,sCAAsC;IACtC,qDAAqD;IACrD;QACE,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO;QACjB,WAAW,EACT,iGAAiG;KACpG;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,OAAO;QACjB,WAAW,EACT,4FAA4F;KAC/F;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,OAAO;QACjB,WAAW,EACT,0FAA0F;KAC7F;IACD;QACE,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,wGAAwG;KAC3G;IACD;QACE,OAAO,EAAE,yBAAyB;QAClC,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,OAAO;QACjB,WAAW,EACT,qGAAqG;KACxG;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,OAAO;QACjB,WAAW,EACT,uFAAuF;KAC1F;CACF,CAAC"}

package/dist/data/sensitive-paths.d.ts

@@ -0,0 +1,12 @@
+export interface SensitivePath {
+    /** URL path to probe */
+    path: string;
+    /** Functional category */
+    category: "admin" | "config" | "debug" | "backup" | "vcs" | "dependency" | "well-known" | "api-docs" | "cloud" | "ci-cd" | "secrets";
+    /** Risk severity if accessible */
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    /** What this path exposes */
+    description: string;
+}
+export declare const SENSITIVE_PATHS: SensitivePath[];
+//# sourceMappingURL=sensitive-paths.d.ts.map

package/dist/data/sensitive-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-paths.d.ts","sourceRoot":"","sources":["../../src/data/sensitive-paths.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IACrI,kCAAkC;IAClC,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EAwgD1C,CAAC"}