rapid7 / recog

Pattern recognition for hosts, services, and content
Other
671 stars 199 forks source link

Add more Metasploit JARM fingerprints #398

Closed mkienow-r7 closed 2 years ago

mkienow-r7 commented 2 years ago

Description

Adds three more Metasploit JARM fingerprints.

Motivation and Context

Updates Metasploit JARM fingerprints to reflect different SSLVersion settings.

How Has This Been Tested?

[*] Started HTTPS reverse handler on https://0.0.0.0:4443

JARM: 07b08b09b21b21b07b07b08b07b21b23aeefb38b723c523befb314af6e95ac


* Test SSLVersion TLS1.1:

msf6 exploit(multi/handler) > set SSLVersion TLS1.1 SSLVersion => TLS1.1

JARM: 07c08c09c21c21c07c07c08c07c21c23aeefb38b723c523befb314af6e95ac


* Test SSLVersion TLS1.2:

msf6 exploit(multi/handler) > set SSLVersion TLS1.2 SSLVersion => TLS1.2

JARM: 07d14d16d21d21d00007d14d07d21d0ae59125bcd90b8876b50928af8f6cd4


* Test SSLVersion SSL3:

msf6 exploit(multi/handler) > set SSLVersion SSL3 SSLVersion => SSL3

JARM: 00000000000000000000000000000000000000000000000000000000000000


* Test SSLVersion Auto, TLS, SSL23:

msf6 exploit(multi/handler) > set SSLVersion Auto SSLVersion => Auto ... msf6 exploit(multi/handler) > set SSLVersion TLS SSLVersion => TLS ... msf6 exploit(multi/handler) > set SSLVersion SSL23 SSLVersion => SSL23

Matches existing JARM fingerprint.

JARM: 07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823



## Types of changes
<!--- What types of changes does your code introduce? Remove any that do not apply: -->
- New feature (non-breaking change which adds functionality)

## Checklist:
<!--- After submitting the PR, check all of the boxes that apply. -->
- [x] I have updated the documentation accordingly (or changes are not required).
- [x] I have added tests to cover my changes (or new tests are not required).
- [x] All new and existing tests passed.