intrigueio / intrigue-ident

Application and Service Fingerprinting
https://core.intrigue.io
Other
131 stars 40 forks source link

Multi-Matchers (and a lot of syntax cleanup) #87

Closed jcran closed 3 years ago

jcran commented 3 years ago

This PR moves all checks to modern hash style (no more hashrockets!) and enables multiple-matchers within a single check.

The key changes:

Additionally, the :match_details field is now called :description

While backward compatibility is maintained with the previous format, this matches: format is preferred for new checks.

An example is below:

      [
        {
          type: "fingerprint",
          category: "service",
          vendor: "Some",
          product: "Product",
          website: "https://www.somewhere.co.uk/",
          match_logic: :all,
          matches: [
            {
              match_type: :content_title,
              match_content: /The Title of the Page/i
            },
            {
              match_type: :content_body,
              match_content: /any body string/i
            }, 
            {
              match_type: :content_code,
              match_content: 200
            }  
          ],
          description: "just an example check",
          paths: [ { path: "#{url}", follow_redirects: true } ]
        }
      ]