rapid7 / recog

Pattern recognition for hosts, services, and content
Other
662 stars 195 forks source link

VC-2316 Add fingerprinting for ivanti pulse secure #614

Closed egazizov-r7 closed 3 months ago

egazizov-r7 commented 3 months ago

Description

Added Fingerprinting for Ivanti Pulse Secure

Motivation and Context

After rebranding Pulse Secure to Ivanti, the vendor hid information about subsequent versions and their hashes, we had to come up with a new approach for retrieving information about the version of the product, this approach uses SNMP to collect version information.

How Has This Been Tested?

Ran nexpose with these arguments on vCenter:

./run.sh nexpose -Dr7.deploy.local.recog=true -Drecog.dir=~/rapid7/recog

And then scanned an existing Ivanti Connect Secure scan target.

Scan results before change: image

Scan results after change: image

Types of changes

Checklist:

adfoster-r7 commented 3 months ago

Could we rebase this PR against the latest main to verify CI is passing