klyrek-tech 0.1.0__py3-none-any.whl

klyrek_tech/__init__.py

@@ -0,0 +1,8 @@
+"""klyrek-tech: signature-based technology fingerprinting."""
+
+from klyrek_tech.fingerprint import fingerprint
+from klyrek_tech.signatures import SIGNATURES, Signature
+
+__version__ = "0.1.0"
+
+__all__ = ["SIGNATURES", "Signature", "__version__", "fingerprint"]

klyrek_tech/fingerprint.py

@@ -0,0 +1,93 @@
+"""Match an HTTP response against known technology signatures."""
+
+from __future__ import annotations
+
+import re
+from http.cookies import SimpleCookie
+
+import httpx
+
+from klyrek_core.models import Technology
+from klyrek_tech.signatures import SIGNATURES
+
+_META_GENERATOR_RE = re.compile(
+    r'<meta[^>]+name=["\']generator["\'][^>]+content=["\']([^"\']+)["\']', re.IGNORECASE
+)
+
+
+def _extract_version(match: re.Match[str] | None) -> str | None:
+    if match is None:
+        return None
+    try:
+        return match.group("version")
+    except IndexError:
+        return None
+
+
+def _cookie_names(response: httpx.Response) -> list[str]:
+    names: list[str] = []
+    for raw in response.headers.get_list("set-cookie"):
+        jar: SimpleCookie = SimpleCookie()
+        jar.load(raw)
+        names.extend(jar.keys())
+    return names
+
+
+def _looks_like_text(response: httpx.Response) -> bool:
+    content_type = response.headers.get("content-type", "")
+    return "text" in content_type or "json" in content_type or content_type == ""
+
+
+def fingerprint(response: httpx.Response) -> list[Technology]:
+    """Match a response against every known signature and return the technologies found."""
+    body = response.text if _looks_like_text(response) and response.content else ""
+    meta_generator_match = _META_GENERATOR_RE.search(body) if body else None
+    cookie_names = _cookie_names(response)
+
+    technologies: list[Technology] = []
+
+    for sig in SIGNATURES:
+        evidence: list[str] = []
+        version: str | None = None
+
+        for header_name, pattern in sig.headers.items():
+            value = response.headers.get(header_name)
+            if value is None:
+                continue
+            match = pattern.search(value)
+            if match:
+                evidence.append(f"{header_name}: {value}")
+                version = version or _extract_version(match)
+
+        for cookie_pattern in sig.cookies:
+            for name in cookie_names:
+                if cookie_pattern.search(name):
+                    evidence.append(f"cookie: {name}")
+
+        if sig.meta_generator and meta_generator_match:
+            content = meta_generator_match.group(1)
+            match = sig.meta_generator.search(content)
+            if match:
+                evidence.append(f"meta generator: {content}")
+                version = version or _extract_version(match)
+
+        for body_pattern in sig.body:
+            if not body:
+                continue
+            match = body_pattern.search(body)
+            if match:
+                evidence.append(f"body pattern: {body_pattern.pattern}")
+                version = version or _extract_version(match)
+
+        if evidence:
+            technologies.append(
+                Technology(
+                    name=sig.name,
+                    category=sig.category,
+                    version=version,
+                    evidence=evidence,
+                    discovered_by="klyrek-tech",
+                )
+            )
+
+    return technologies

klyrek_tech/signatures.py

@@ -0,0 +1,111 @@
+"""Declarative technology signatures.
+
+Kept data-driven (a list of ``Signature`` records) rather than one class per
+technology, since the matching logic (header/cookie/body regex) is identical
+across every signature — only the patterns differ. Adding a new technology is a
+new list entry, not new code.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+
+@dataclass(slots=True)
+class Signature:
+    name: str
+    category: str
+    headers: dict[str, re.Pattern[str]] = field(default_factory=dict)
+    cookies: list[re.Pattern[str]] = field(default_factory=list)
+    body: list[re.Pattern[str]] = field(default_factory=list)
+    meta_generator: re.Pattern[str] | None = None
+
+
+def _re(pattern: str) -> re.Pattern[str]:
+    return re.compile(pattern, re.IGNORECASE)
+
+
+#: A pattern with a named ``(?P<version>...)`` group lets fingerprint() report a version;
+#: patterns without one still match, just without a version string attached.
+SIGNATURES: list[Signature] = [
+    Signature(
+        "nginx", "web-server", headers={"server": _re(r"nginx(?:/(?P<version>[\d.]+))?")}
+    ),
+    Signature(
+        "Apache", "web-server", headers={"server": _re(r"apache(?:/(?P<version>[\d.]+))?")}
+    ),
+    Signature(
+        "Microsoft IIS",
+        "web-server",
+        headers={"server": _re(r"microsoft-iis(?:/(?P<version>[\d.]+))?")},
+    ),
+    Signature("PHP", "language", headers={"x-powered-by": _re(r"php(?:/(?P<version>[\d.]+))?")}),
+    Signature(
+        "ASP.NET",
+        "framework",
+        headers={
+            "x-powered-by": _re(r"asp\.net"),
+            "x-aspnet-version": _re(r"(?P<version>[\d.]+)"),
+        },
+    ),
+    Signature("Express", "framework", headers={"x-powered-by": _re(r"express")}),
+    Signature(
+        "Cloudflare", "cdn", headers={"server": _re(r"cloudflare"), "cf-ray": _re(r".+")}
+    ),
+    Signature(
+        "Vercel", "hosting", headers={"server": _re(r"vercel"), "x-vercel-id": _re(r".+")}
+    ),
+    Signature("Netlify", "hosting", headers={"server": _re(r"netlify")}),
+    Signature(
+        "WordPress",
+        "cms",
+        body=[_re(r"wp-content"), _re(r"wp-includes")],
+        meta_generator=_re(r"wordpress(?:\s+(?P<version>[\d.]+))?"),
+    ),
+    Signature(
+        "Drupal",
+        "cms",
+        body=[_re(r"drupal\.settings"), _re(r"/sites/default/files")],
+        meta_generator=_re(r"drupal(?:\s+(?P<version>[\d.]+))?"),
+    ),
+    Signature(
+        "Joomla",
+        "cms",
+        body=[_re(r"/media/jui/")],
+        meta_generator=_re(r"joomla!?\s*-?\s*(?P<version>[\d.]+)?"),
+    ),
+    Signature("Laravel", "framework", cookies=[_re(r"^laravel_session$")]),
+    Signature(
+        "Django",
+        "framework",
+        body=[_re(r"csrfmiddlewaretoken")],
+        cookies=[_re(r"^csrftoken$")],
+    ),
+    Signature(
+        "Ruby on Rails",
+        "framework",
+        cookies=[_re(r"^_\w+_session$")],
+        headers={"x-powered-by": _re(r"phusion passenger")},
+    ),
+    Signature(
+        "Next.js", "framework", body=[_re(r"__next_data__"), _re(r"/_next/static/")]
+    ),
+    Signature("React", "frontend-library", body=[_re(r"data-reactroot"), _re(r"react-dom")]),
+    Signature("Vue.js", "frontend-library", body=[_re(r"data-v-[0-9a-f]{6,}")]),
+    Signature(
+        "Angular",
+        "frontend-framework",
+        body=[_re(r'ng-version="(?P<version>[\d.]+)"')],
+    ),
+    Signature(
+        "jQuery",
+        "js-library",
+        body=[_re(r"jquery(?:[.-](?P<version>[\d.]+))?\.(?:min\.)?js")],
+    ),
+    Signature(
+        "Bootstrap",
+        "css-framework",
+        body=[_re(r"bootstrap(?:[.-](?P<version>[\d.]+))?\.(?:min\.)?css")],
+    ),
+]

klyrek_tech-0.1.0.dist-info/METADATA

@@ -0,0 +1,39 @@
+Metadata-Version: 2.4
+Name: klyrek-tech
+Version: 0.1.0
+Summary: Technology fingerprinting for the Klyrek ecosystem
+Author: Klyrek Contributors
+License: MIT
+Keywords: appsec,fingerprinting,pentesting,reconnaissance,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
+Requires-Dist: klyrek-core
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# klyrek-tech
+
+Technology fingerprinting. Matches an `httpx.Response` against a curated set of declarative
+`Signature`s (header patterns, cookie names, response-body patterns, and `<meta name="generator">`
+tags) and produces `klyrek_core.models.Technology` records — the same approach tools like
+Wappalyzer and WhatWeb use, kept intentionally data-driven rather than one class per technology
+so new signatures are a one-line addition, not a new module.
+
+```python
+from klyrek_tech.fingerprint import fingerprint
+
+response = client.get("https://target.com/")
+for tech in fingerprint(response):
+    print(tech.category, tech.name, tech.version, tech.evidence)
+```
+
+Signatures live in `klyrek_tech.signatures.SIGNATURES` — add an entry there to recognize a new
+server, framework, CMS, or JS library rather than writing new matching code.

klyrek_tech-0.1.0.dist-info/RECORD

@@ -0,0 +1,7 @@
+klyrek_tech/__init__.py,sha256=RmS_dX5nuyMHL0QRstcXKwlStGMxDsDS6HQfXlc1Ijw,260
+klyrek_tech/fingerprint.py,sha256=7YrJDPQF07q4V98oUbAwmAiLm_iRM2u4TdgmQjErLzk,3012
+klyrek_tech/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+klyrek_tech/signatures.py,sha256=P4YiXeCVddoaU96dyYbOk6HY1hX1SvedzBDm5g8sf4M,3675
+klyrek_tech-0.1.0.dist-info/METADATA,sha256=Ig3MzTkxvAugFKwAqNz8LuPjXJAze-AP2i_tTrsoU1c,1556
+klyrek_tech-0.1.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+klyrek_tech-0.1.0.dist-info/RECORD,,

klyrek_tech-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any