search

intrigueio / intrigue-ident

Application and Service Fingerprinting
https://core.intrigue.io
Other
131 stars 40 forks source link

Check and version extraction for docker #57

Closed shpendk closed 3 years ago

shpendk commented 4 years ago

Check and version extraction for docker, tested on multiple targets:

shpend@ubuntu:$ bundle exec ./util/ident.rb -u http://[redacted]:2375/version
Fingerprint: 
 - Docker Docker 18.06.1-ce  - body content (CPE: cpe:2.3:a:docker:docker:18.06.1-ce:) (Tags: ["Virtualization"]) (Hide: false) (Issues: ) (Tasks: )
 - Docker Docker 18.06.1-ce  - header match (CPE: cpe:2.3:a:docker:docker:18.06.1-ce:) (Tags: ["Virtualization"]) (Hide: false) (Issues: ) (Tasks: )
shpend@ubuntu:$ bundle exec ./util/ident.rb -u http://[redacted]:2375/version
Fingerprint: 
 - Docker Docker 17.06.2-ee-5  - body content (CPE: cpe:2.3:a:docker:docker:17.06.2-ee-5:) (Tags: ["Virtualization"]) (Hide: false) (Issues: ) (Tasks: )
 - Docker Docker 17.06.2-ee-5  - header match (CPE: cpe:2.3:a:docker:docker:17.06.2-ee-5:) (Tags: ["Virtualization"]) (Hide: false) (Issues: ) (Tasks: )
shpend@ubuntu:$ bundle exec ./util/ident.rb -u http://[redacted]:2375/version
Fingerprint: 
 - Docker Docker 17.05.0-ce  - body content (CPE: cpe:2.3:a:docker:docker:17.05.0-ce:) (Tags: ["Virtualization"]) (Hide: false) (Issues: ) (Tasks: )
 - Docker Docker 17.05.0-ce  - header match (CPE: cpe:2.3:a:docker:docker:17.05.0-ce:) (Tags: ["Virtualization"]) (Hide: false) (Issues: ) (Tasks: )
shpend@ubuntu:$

Unfortunately there are zero indicators for docker on the root url, making it hard to detect without appending /version. A good approach would be to test /version whenever we see port 2375/2376, but I dunno how to do that.

jcran commented 4 years ago

Holding on this until we have a :require_ports => [] directive... this should only be run when we're checking the standard docker ports

shpendk commented 4 years ago

Sounds good.

jcran commented 3 years ago

Per our discussion this week, this is good to merge, :require_ports directive is not required. Note that this adds a new path to check by default, but we're still well under the target of 10, and this seems like a good one to add into our stable.