intrigueio / intrigue-ident

Application and Service Fingerprinting
https://core.intrigue.io
Other
131 stars 40 forks source link

implement follow-on checks #17

Closed jcran closed 4 years ago

jcran commented 4 years ago

As a user looking to fingerprint things quickly, it'd be handy if ident was smart enough to do an initial check against a single (or small set) of urls, then run follow-on checks for stuff that is specific to a given product.

Note that this increases the importance and difficulty of getting the initial checks right, but extends the usefulness of ident by significantly speeding it up in the general case. Some tech may need to be revisited to see if we can address fingerprinting it with just the base url.

jcran commented 4 years ago

Example of the enhancement in action.

Previously, when testing core.intrigue.io, the following checks would be made against every URL image

With the enhancement in place, now wordpress (and other tech-specific checks are made when the technology is fingerprinted in the first round). This almost halves the requests made in the general case (and there's probably more that can be adjusted to follow-on checks:

image

jcran commented 4 years ago

To write a follow-on check, simply add the hash key :require_product => "Product Name"

jcran commented 4 years ago

Example... in this case requiring ASP.NET to be seen before we'll check for a framework (Glimpse) specific path https://github.com/intrigueio/intrigue-ident/blob/1e6c5abc93b3a0ba23d1a610356fa6cdd1920c88/checks/http/glimpse.rb#L24