Ident is an application and service fingerprinting library used within Intrigue Core.

The Ident project has a few stated goals:

To deeply identify network service and app software while remaining extremely fast - limiting unnecessary requests
To have the most complete set of identification checks for modern application and server software
To integrate well as a library, for easy use in other projects such as Intrigue Core
To maintain a robust command line interface for use as a standalone tool
To be commercially viable through use of the BSD license

Ident is written in Ruby and uses the lightning fast libcurl-backed Typhoeus and the powerful Socketry libraries to make requests.

Below, find instruction on how to get stated:

Using ident via Docker image:

Pull and run the docker image! It'll download directly from DockerHub if the image doesnt exist locally docker run -t intrigueio/intrigue-ident -u https://intrigue.io

Usage:

$ bundle exec ruby ./util/ident.rb -c -v -u https://xyz.com:443
Checking... https://xyz.com:443
Fingerprint:
 - PHP PHP 5.4.16  - x-powered-by header (CPE: cpe:2.3:a:php:php:5.4.16:) (Tags: ["Web Framework"])
   - Vuln: CVE-2016-5768 (CVSSv3: 9.8)
   - Vuln: CVE-2016-4538 (CVSSv3: 9.8)
 - PHP PHP   - PHPSESSID cookie (CPE: cpe:2.3:a:php:php::) (Tags: ["Web Framework"])
 - Apache HTTP Server 2.4.6  - Apache web server - server header - with versions (CPE: cpe:2.3:a:apache:http_server:2.4.6:) (Tags: ["Web Server"])
   - Vuln: CVE-2018-1312 (CVSSv3: 9.8)
   - Vuln: CVE-2017-15715 (CVSSv3: 8.1)
 - Wordpress Wordpress   - common link (CPE: cpe:2.3:a:wordpress:wordpress::) (Tags: ["CMS"])
 - Yoast Wordpress SEO   - unique string (CPE: cpe:2.3:a:yoast:wordpress_seo::) (Tags: ["Marketing", "Wordpress Plugin"])
 - Bootstrap Bootstrap   - boostrap css (CPE: cpe:2.3:a:bootstrap:bootstrap::) (Tags: ["Web Framework"])
 - OpenSSL OpenSSL 1.0.2k-fips  - server header (CPE: cpe:2.3:a:openssl:openssl:1.0.2k-fips:) (Tags: ["Library"])
   - Vuln: CVE-2018-0732 (CVSSv3: 7.5)
Content Checks:
 - Authentication - HTTP: false
 - Authentication - Session Identifier: true
 - Google Analytics Account Detected: false
 - Location Header:
 - Directory Listing Detected: false
 - Form Detected: false
 - File Upload Form Detected: false
 - Email Addresses Detected: []
 - Access-Control-Allow-Origin Header: false
 - P3P Header: false
 - X-Frame-Options Header: true
 - X-XSS-Protection Header: false

For Check Writers:

Check types can be written against supported protocols:

AMQP
Apache Zookeeper Atomic Broadcast (Raw)
Cisco Smart Install
DNS
Elasticsearch
FTP
Ganglia (Raw)
HTTP / HTTPS
Memcached (Raw)
Mongodb
Mysql
Oracle IIOP (Raw)
Oracle T3 (Raw)
Pop3
RDP (Raw)
Redis
SAP NI (Raw)
SMB
SMTP
SNMP
SSH
Telnet

Generally speaking, checks have the following structure. This is a check for HTTP and HTTPS:

 [
        {
          type: "fingerprint",
          category: "service",
          vendor: "Some",
          product: "Product",
          website: "https://www.somewhere.co.uk/",
          match_logic: :all,
          matches: [
            {
              match_type: :content_title,
              match_content: /The Title of the Page/i
            },
            {
              match_type: :content_body,
              match_content: /any body string/i
            },
            {
              match_type: :content_code,
              match_content: 200
            }
          ],
          description: "just an example check",
          paths: [ { path: "#{url}", follow_redirects: true } ]
        }
      ]

There are many types of matchers, which tell the check what part of the target's response to check.

 - content_body: checks should be run against body
 - content_code: checks should be run against code returned in the response as an integer (note that this is generally only useful for follow-on checks)
 - content_cookies: checks should be run against the set-cookie: header (do not include the header name, just the content when writing checks)
 - content_generator:  checks should be run against text inside the <meta generator> tag (do not include the tag when writing checks)
 - content_headers: checks should be run against response headers (assumes one string of text, each header '\n' delimited)
 - content_title: checks should be run against text inside the <title> tag (do not include the tag when writing checks)

Multiple matches per check are supported, see: intrigueio#87

For more details, have a look at the checks in the 'checks' directory, or jump into our slack channel for help.

Contributors:

A special thanks to the following contributors who help make ident awesome!

@adambakalar: Protocol support and Fingerprints
@duartemateus: Bugfixes, Architecture, Protocol support and Fingerprints
@chowdud: Fingerprints++ **
@jen140: Fingerprints
@shpendk: Fingerprints, Architecture
@m-q-t: Fingerprints, Architecture
@bensalah_anas: Fingerprints
@bcoles: Fingerprints, Bugfixes, JSON output
@bmcdevitt: Fingerprints
@retornam: Dockerization

chowdud / intrigue-ident Goto Github PK

intrigue-ident's Introduction

Using ident via Docker image:

Usage:

For Check Writers:

Contributors:

intrigue-ident's People

Contributors

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent