klyrek-tech 0.1.0__tar.gz

klyrek_tech-0.1.0/.gitignore

@@ -0,0 +1,20 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+.qodo/
+build/
+dist/
+.venv/
+venv/
+.env
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+*.log
+.idea/
+.vscode/
+!.vscode/extensions.json
+klyrek_output/

klyrek_tech-0.1.0/PKG-INFO

@@ -0,0 +1,39 @@
+Metadata-Version: 2.4
+Name: klyrek-tech
+Version: 0.1.0
+Summary: Technology fingerprinting for the Klyrek ecosystem
+Author: Klyrek Contributors
+License: MIT
+Keywords: appsec,fingerprinting,pentesting,reconnaissance,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
+Requires-Dist: klyrek-core
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# klyrek-tech
+
+Technology fingerprinting. Matches an `httpx.Response` against a curated set of declarative
+`Signature`s (header patterns, cookie names, response-body patterns, and `<meta name="generator">`
+tags) and produces `klyrek_core.models.Technology` records — the same approach tools like
+Wappalyzer and WhatWeb use, kept intentionally data-driven rather than one class per technology
+so new signatures are a one-line addition, not a new module.
+
+```python
+from klyrek_tech.fingerprint import fingerprint
+
+response = client.get("https://target.com/")
+for tech in fingerprint(response):
+    print(tech.category, tech.name, tech.version, tech.evidence)
+```
+
+Signatures live in `klyrek_tech.signatures.SIGNATURES` — add an entry there to recognize a new
+server, framework, CMS, or JS library rather than writing new matching code.

klyrek_tech-0.1.0/README.md

@@ -0,0 +1,18 @@
+# klyrek-tech
+
+Technology fingerprinting. Matches an `httpx.Response` against a curated set of declarative
+`Signature`s (header patterns, cookie names, response-body patterns, and `<meta name="generator">`
+tags) and produces `klyrek_core.models.Technology` records — the same approach tools like
+Wappalyzer and WhatWeb use, kept intentionally data-driven rather than one class per technology
+so new signatures are a one-line addition, not a new module.
+
+```python
+from klyrek_tech.fingerprint import fingerprint
+
+response = client.get("https://target.com/")
+for tech in fingerprint(response):
+    print(tech.category, tech.name, tech.version, tech.evidence)
+```
+
+Signatures live in `klyrek_tech.signatures.SIGNATURES` — add an entry there to recognize a new
+server, framework, CMS, or JS library rather than writing new matching code.

klyrek_tech-0.1.0/pyproject.toml

@@ -0,0 +1,30 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "klyrek-tech"
+version = "0.1.0"
+description = "Technology fingerprinting for the Klyrek ecosystem"
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.10"
+authors = [{ name = "Klyrek Contributors" }]
+keywords = ["security", "reconnaissance", "appsec", "pentesting", "fingerprinting"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Information Technology",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+]
+dependencies = [
+    "klyrek-core",
+    "httpx>=0.27",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0", "ruff>=0.6", "mypy>=1.10"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/klyrek_tech"]

klyrek_tech-0.1.0/src/klyrek_tech/__init__.py

@@ -0,0 +1,8 @@
+"""klyrek-tech: signature-based technology fingerprinting."""
+
+from klyrek_tech.fingerprint import fingerprint
+from klyrek_tech.signatures import SIGNATURES, Signature
+
+__version__ = "0.1.0"
+
+__all__ = ["SIGNATURES", "Signature", "__version__", "fingerprint"]

klyrek_tech-0.1.0/src/klyrek_tech/fingerprint.py

@@ -0,0 +1,93 @@
+"""Match an HTTP response against known technology signatures."""
+
+from __future__ import annotations
+
+import re
+from http.cookies import SimpleCookie
+
+import httpx
+
+from klyrek_core.models import Technology
+from klyrek_tech.signatures import SIGNATURES
+
+_META_GENERATOR_RE = re.compile(
+    r'<meta[^>]+name=["\']generator["\'][^>]+content=["\']([^"\']+)["\']', re.IGNORECASE
+)
+
+
+def _extract_version(match: re.Match[str] | None) -> str | None:
+    if match is None:
+        return None
+    try:
+        return match.group("version")
+    except IndexError:
+        return None
+
+
+def _cookie_names(response: httpx.Response) -> list[str]:
+    names: list[str] = []
+    for raw in response.headers.get_list("set-cookie"):
+        jar: SimpleCookie = SimpleCookie()
+        jar.load(raw)
+        names.extend(jar.keys())
+    return names
+
+
+def _looks_like_text(response: httpx.Response) -> bool:
+    content_type = response.headers.get("content-type", "")
+    return "text" in content_type or "json" in content_type or content_type == ""
+
+
+def fingerprint(response: httpx.Response) -> list[Technology]:
+    """Match a response against every known signature and return the technologies found."""
+    body = response.text if _looks_like_text(response) and response.content else ""
+    meta_generator_match = _META_GENERATOR_RE.search(body) if body else None
+    cookie_names = _cookie_names(response)
+
+    technologies: list[Technology] = []
+
+    for sig in SIGNATURES:
+        evidence: list[str] = []
+        version: str | None = None
+
+        for header_name, pattern in sig.headers.items():
+            value = response.headers.get(header_name)
+            if value is None:
+                continue
+            match = pattern.search(value)
+            if match:
+                evidence.append(f"{header_name}: {value}")
+                version = version or _extract_version(match)
+
+        for cookie_pattern in sig.cookies:
+            for name in cookie_names:
+                if cookie_pattern.search(name):
+                    evidence.append(f"cookie: {name}")
+
+        if sig.meta_generator and meta_generator_match:
+            content = meta_generator_match.group(1)
+            match = sig.meta_generator.search(content)
+            if match:
+                evidence.append(f"meta generator: {content}")
+                version = version or _extract_version(match)
+
+        for body_pattern in sig.body:
+            if not body:
+                continue
+            match = body_pattern.search(body)
+            if match:
+                evidence.append(f"body pattern: {body_pattern.pattern}")
+                version = version or _extract_version(match)
+
+        if evidence:
+            technologies.append(
+                Technology(
+                    name=sig.name,
+                    category=sig.category,
+                    version=version,
+                    evidence=evidence,
+                    discovered_by="klyrek-tech",
+                )
+            )
+
+    return technologies

klyrek_tech-0.1.0/src/klyrek_tech/signatures.py

@@ -0,0 +1,111 @@
+"""Declarative technology signatures.
+
+Kept data-driven (a list of ``Signature`` records) rather than one class per
+technology, since the matching logic (header/cookie/body regex) is identical
+across every signature — only the patterns differ. Adding a new technology is a
+new list entry, not new code.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+
+@dataclass(slots=True)
+class Signature:
+    name: str
+    category: str
+    headers: dict[str, re.Pattern[str]] = field(default_factory=dict)
+    cookies: list[re.Pattern[str]] = field(default_factory=list)
+    body: list[re.Pattern[str]] = field(default_factory=list)
+    meta_generator: re.Pattern[str] | None = None
+
+
+def _re(pattern: str) -> re.Pattern[str]:
+    return re.compile(pattern, re.IGNORECASE)
+
+
+#: A pattern with a named ``(?P<version>...)`` group lets fingerprint() report a version;
+#: patterns without one still match, just without a version string attached.
+SIGNATURES: list[Signature] = [
+    Signature(
+        "nginx", "web-server", headers={"server": _re(r"nginx(?:/(?P<version>[\d.]+))?")}
+    ),
+    Signature(
+        "Apache", "web-server", headers={"server": _re(r"apache(?:/(?P<version>[\d.]+))?")}
+    ),
+    Signature(
+        "Microsoft IIS",
+        "web-server",
+        headers={"server": _re(r"microsoft-iis(?:/(?P<version>[\d.]+))?")},
+    ),
+    Signature("PHP", "language", headers={"x-powered-by": _re(r"php(?:/(?P<version>[\d.]+))?")}),
+    Signature(
+        "ASP.NET",
+        "framework",
+        headers={
+            "x-powered-by": _re(r"asp\.net"),
+            "x-aspnet-version": _re(r"(?P<version>[\d.]+)"),
+        },
+    ),
+    Signature("Express", "framework", headers={"x-powered-by": _re(r"express")}),
+    Signature(
+        "Cloudflare", "cdn", headers={"server": _re(r"cloudflare"), "cf-ray": _re(r".+")}
+    ),
+    Signature(
+        "Vercel", "hosting", headers={"server": _re(r"vercel"), "x-vercel-id": _re(r".+")}
+    ),
+    Signature("Netlify", "hosting", headers={"server": _re(r"netlify")}),
+    Signature(
+        "WordPress",
+        "cms",
+        body=[_re(r"wp-content"), _re(r"wp-includes")],
+        meta_generator=_re(r"wordpress(?:\s+(?P<version>[\d.]+))?"),
+    ),
+    Signature(
+        "Drupal",
+        "cms",
+        body=[_re(r"drupal\.settings"), _re(r"/sites/default/files")],
+        meta_generator=_re(r"drupal(?:\s+(?P<version>[\d.]+))?"),
+    ),
+    Signature(
+        "Joomla",
+        "cms",
+        body=[_re(r"/media/jui/")],
+        meta_generator=_re(r"joomla!?\s*-?\s*(?P<version>[\d.]+)?"),
+    ),
+    Signature("Laravel", "framework", cookies=[_re(r"^laravel_session$")]),
+    Signature(
+        "Django",
+        "framework",
+        body=[_re(r"csrfmiddlewaretoken")],
+        cookies=[_re(r"^csrftoken$")],
+    ),
+    Signature(
+        "Ruby on Rails",
+        "framework",
+        cookies=[_re(r"^_\w+_session$")],
+        headers={"x-powered-by": _re(r"phusion passenger")},
+    ),
+    Signature(
+        "Next.js", "framework", body=[_re(r"__next_data__"), _re(r"/_next/static/")]
+    ),
+    Signature("React", "frontend-library", body=[_re(r"data-reactroot"), _re(r"react-dom")]),
+    Signature("Vue.js", "frontend-library", body=[_re(r"data-v-[0-9a-f]{6,}")]),
+    Signature(
+        "Angular",
+        "frontend-framework",
+        body=[_re(r'ng-version="(?P<version>[\d.]+)"')],
+    ),
+    Signature(
+        "jQuery",
+        "js-library",
+        body=[_re(r"jquery(?:[.-](?P<version>[\d.]+))?\.(?:min\.)?js")],
+    ),
+    Signature(
+        "Bootstrap",
+        "css-framework",
+        body=[_re(r"bootstrap(?:[.-](?P<version>[\d.]+))?\.(?:min\.)?css")],
+    ),
+]

klyrek_tech-0.1.0/tests/test_fingerprint.py

@@ -0,0 +1,109 @@
+import httpx
+
+from klyrek_tech.fingerprint import fingerprint
+
+
+def _response(
+    headers: dict[str, str] | list[tuple[str, str]] | None = None,
+    body: str = "",
+    content_type: str = "text/html",
+) -> httpx.Response:
+    hdrs: dict[str, str] | list[tuple[str, str]] = headers or {}
+    if isinstance(hdrs, dict):
+        hdrs = {**hdrs, "content-type": content_type}
+    else:
+        hdrs = [*hdrs, ("content-type", content_type)]
+    return httpx.Response(
+        200, headers=hdrs, content=body.encode(), request=httpx.Request("GET", "https://target.com/")
+    )
+
+
+def _names(techs: list) -> set[str]:
+    return {t.name for t in techs}
+
+
+def test_nginx_server_header_with_version():
+    response = _response(headers={"Server": "nginx/1.18.0"})
+    techs = fingerprint(response)
+    nginx = next(t for t in techs if t.name == "nginx")
+    assert nginx.category == "web-server"
+    assert nginx.version == "1.18.0"
+
+
+def test_php_via_x_powered_by():
+    response = _response(headers={"X-Powered-By": "PHP/8.1.2"})
+    techs = fingerprint(response)
+    php = next(t for t in techs if t.name == "PHP")
+    assert php.version == "8.1.2"
+
+
+def test_wordpress_via_body_markers():
+    response = _response(body='<link rel="stylesheet" href="/wp-content/themes/x/style.css">')
+    assert "WordPress" in _names(fingerprint(response))
+
+
+def test_wordpress_via_meta_generator_with_version():
+    response = _response(
+        body='<meta name="generator" content="WordPress 6.4.2">'
+    )
+    techs = fingerprint(response)
+    wp = next(t for t in techs if t.name == "WordPress")
+    assert wp.version == "6.4.2"
+
+
+def test_django_via_csrf_marker_and_cookie():
+    response = _response(
+        headers=[("Set-Cookie", "csrftoken=abc123; Path=/")],
+        body='<input type="hidden" name="csrfmiddlewaretoken" value="xyz">',
+    )
+    assert "Django" in _names(fingerprint(response))
+
+
+def test_laravel_via_session_cookie():
+    response = _response(headers=[("Set-Cookie", "laravel_session=abc123; Path=/; HttpOnly")])
+    assert "Laravel" in _names(fingerprint(response))
+
+
+def test_cloudflare_via_headers():
+    response = _response(headers={"Server": "cloudflare", "CF-RAY": "abc123-DFW"})
+    assert "Cloudflare" in _names(fingerprint(response))
+
+
+def test_react_via_body_marker():
+    response = _response(body='<div id="root" data-reactroot=""></div>')
+    assert "React" in _names(fingerprint(response))
+
+
+def test_angular_version_extracted():
+    response = _response(body='<html ng-version="17.0.1"><body></body></html>')
+    techs = fingerprint(response)
+    angular = next(t for t in techs if t.name == "Angular")
+    assert angular.version == "17.0.1"
+
+
+def test_no_signatures_match_generic_response():
+    response = _response(headers={}, body="<html><body>hello</body></html>")
+    assert fingerprint(response) == []
+
+
+def test_binary_response_is_not_scanned_as_body():
+    response = _response(
+        headers={}, body="wp-content should not match", content_type="image/png"
+    )
+    assert fingerprint(response) == []
+
+
+def test_evidence_is_populated():
+    response = _response(headers={"Server": "nginx/1.24.0"})
+    techs = fingerprint(response)
+    nginx = next(t for t in techs if t.name == "nginx")
+    assert any("nginx/1.24.0" in e for e in nginx.evidence)
+
+
+def test_multiple_technologies_detected_independently():
+    response = _response(
+        headers={"Server": "nginx/1.18.0", "X-Powered-By": "PHP/8.1.2"},
+        body='<meta name="generator" content="WordPress 6.4">',
+    )
+    names = _names(fingerprint(response))
+    assert {"nginx", "PHP", "WordPress"}.issubset(names)