rapid7 / recog

Pattern recognition for hosts, services, and content
Other
671 stars 199 forks source link

Add recog_match support for JSON output #467

Closed mkienow-r7 closed 2 years ago

mkienow-r7 commented 2 years ago

Description

Adds recog_match support for JSON output. These changes require recog gem enhancements from rapid7/recog-ruby#7. Note, the tests on this branch will fail until the recog gem is updated.

Example output

Multiple matches disabled (default)

$ echo "Linksys\nApache\nDNE" | bundle exec ./recog_match --format json xml/http_servers.xml
{"data":"Linksys","match":{"matched":"Linksys Wireless Access Point","os.vendor":"Linksys","os.device":"WAP","hw.vendor":"Linksys","hw.device":"WAP","service.protocol":"http","fingerprint_db":"http_header.server"}}
{"data":"Apache","match":{"matched":"Apache returning no version information","service.vendor":"Apache","service.product":"HTTPD","service.family":"Apache","service.cpe23":"cpe:/a:apache:http_server:-","service.protocol":"http","fingerprint_db":"http_header.server"}}
{"data":"DNE","match_failure":true,"match":null}

Multiple matches enabled

$ echo "Linksys\nApache\nDNE" | bundle exec ./recog_match --format json --multi-match xml/http_servers.xml
{"data":"Linksys","matches":[{"matched":"Linksys Wireless Access Point","os.vendor":"Linksys","os.device":"WAP","hw.vendor":"Linksys","hw.device":"WAP","service.protocol":"http","fingerprint_db":"http_header.server"}]}
{"data":"Apache","matches":[{"matched":"Apache returning no version information","service.vendor":"Apache","service.product":"HTTPD","service.family":"Apache","service.cpe23":"cpe:/a:apache:http_server:-","service.protocol":"http","fingerprint_db":"http_header.server"},{"matched":"Apache","service.vendor":"Apache","service.product":"HTTPD","service.family":"Apache","service.version":null,"service.cpe23":"cpe:/a:apache:http_server:-","apache.info":null,"service.protocol":"http","fingerprint_db":"http_header.server"}]}
{"data":"DNE","match_failure":true,"matches":null}

Motivation and Context

Increase the usability of recog_match in command pipelines since JSON is easier to parse with other tools such as jq.

How Has This Been Tested?

-gem 'recog', '~>3.0' +gem 'recog', '~>3.0', git: 'https://github.com/mkienow-r7/recog-ruby', branch: 'feature/recog-match-json-output'

group :test do gem 'rake'


* `bundle install`
* `rake test`

## Types of changes
<!--- What types of changes does your code introduce? Remove any that do not apply: -->
- New feature (non-breaking change which adds functionality)

## Checklist:
<!--- After submitting the PR, check all of the boxes that apply. -->
- [x] I have updated the documentation accordingly (or changes are not required).
- [x] I have added tests to cover my changes (or new tests are not required).
- [x] All new and existing tests passed.