rapid7 / recog

Pattern recognition for hosts, services, and content
Other
662 stars 195 forks source link

Castopod favicon fingerprint #516

Closed todb closed 1 year ago

todb commented 1 year ago

Description

Add a fingerprint for Castopod based entirely on the favicon

Notes

<link rel="icon" type="image/x-icon" href="/favicon.ico" />

This was pulled from the current-latest of Castopod, version 1.0.2.

Alas, there were no interesting cookies or <title> tags to sample -- Castopod is built using CodeIgniter and just uses a ci_session session cookie without renaming, and <title> tags are entirely custom to the content being hosted.

Motivation and Context

After Twitter changed ownership October of 2022, Fediverse services kind of exploded all over the internet. It would be nice to track them. I suspect there are a lot of new server operators who are diving into the deep end of self-hosted services.

How Has This Been Tested?

Collected the MD5 of the favicon, hoping for the best! I need to figure out how to test locally.

Types of changes

Checklist:

mkienow-r7 commented 1 year ago

@todb as for local testing at a minimum you should run 1. bundle exec ./bin/recog_verify on the modified files, and 2. rake tests