rapid7 / recog

Pattern recognition for hosts, services, and content
Other
671 stars 199 forks source link

Some nextcloud cookies have a __Host- prefix #591

Closed jvoisin closed 1 year ago

jvoisin commented 1 year ago

Description

Some nextcloud cookies have a __Host- prefix

How Has This Been Tested?

On my LAN.

adfoster-r7 commented 1 year ago

Not sure if the close was accidental, the recent commit isn't quite what the same as the code suggestion - but I think it should pass if the changes are made 🤞

- <fingerprint pattern="^(__Host-)?(nc_sameSiteCookiestrict|nc_sameSiteCookielax|oc_sessionPassphrase)=">
+ <fingerprint pattern="^((?:__Host-)?(?:nc_sameSiteCookiestrict|nc_sameSiteCookielax|oc_sessionPassphrase))=">

For context I'd added few extra non-capturing groups added to get the tests passing as expected

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Non-capturing_group