diff --git a/finger/ehole/1caitong.yml b/finger/ehole/1caitong.yml index 963728e..3fbd8a5 100644 --- a/finger/ehole/1caitong.yml +++ b/finger/ehole/1caitong.yml @@ -14,4 +14,3 @@ rules: follow_redirects: true expression: response.body_string.contains("/custom/groupnewslist.aspx?groupid=") expression: r0() -on: r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() || r10() diff --git "a/finger/ehole/360\345\244\251\346\223\216.yml" "b/finger/ehole/360\345\244\251\346\223\216.yml" new file mode 100644 index 0000000..5b77201 --- /dev/null +++ "b/finger/ehole/360\345\244\251\346\223\216.yml" @@ -0,0 +1,23 @@ +name: fingerprint-yaml-360天擎 +manual: false +detail: + fingerprint: + name: 360天擎 + fofa: title="360天擎" || header="360天擎" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("360天擎") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("360天擎")) +expression: r0() || r1() diff --git a/finger/ehole/74CMS.yml b/finger/ehole/74CMS.yml new file mode 100644 index 0000000..f69c8b2 --- /dev/null +++ b/finger/ehole/74CMS.yml @@ -0,0 +1,79 @@ +name: fingerprint-yaml-74CMS +manual: false +detail: + fingerprint: + name: 74CMS + fofa: body="content=\"74cms.com" && body="content=\"骑士cms" && body="powered by Welcome to the Apache ActiveMQ!") && response.body_string.contains('(realm="activemqrealm') + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Apache ActiveMQ")) + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Apache ActiveMQ") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes('realm="activemqrealm')) + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Apache ActiveMQ") + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("apache activemq") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() diff --git a/finger/ehole/Apache Tika.yml b/finger/ehole/Apache Tika.yml new file mode 100644 index 0000000..801bb67 --- /dev/null +++ b/finger/ehole/Apache Tika.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Apache Tika +manual: false +detail: + fingerprint: + name: Apache Tika + fofa: header="Apache Tika" || title="Apache Tika" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Apache Tika")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Apache Tika") +expression: r0() || r1() diff --git a/finger/ehole/Apache-Flink.yml b/finger/ehole/Apache-Flink.yml new file mode 100644 index 0000000..867ab87 --- /dev/null +++ b/finger/ehole/Apache-Flink.yml @@ -0,0 +1,58 @@ +name: fingerprint-yaml-Apache-Flink +manual: false +detail: + fingerprint: + name: Apache-Flink + fofa: body="Apache Flink Web Dashboard" && body="" && body="\"apacheApache Flink Web Dashboard") && response.body_string.contains("") && response.body_string.contains('apache flink dashboardApache Flink Web Dashboard") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("") + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Apache Flink") + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("apache flink web dashboard") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() diff --git a/finger/ehole/Apache-OFBiz.yml b/finger/ehole/Apache-OFBiz.yml new file mode 100644 index 0000000..da79c3e --- /dev/null +++ b/finger/ehole/Apache-OFBiz.yml @@ -0,0 +1,44 @@ +name: fingerprint-yaml-Apache-OFBiz +manual: false +detail: + fingerprint: + name: Apache-OFBiz + fofa: 'body="Apache OFBiz" && body="apache.ofbiz" || header="Set-Cookie: OFBiz.Visitor=" || body="Apache OFBiz" || body="apache.ofbiz" || body="Powered by OFBiz"' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Apache OFBiz") && response.body_string.contains("apache.ofbiz") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("Set-Cookie: OFBiz.Visitor="))' + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Apache OFBiz") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("apache.ofbiz") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Powered by OFBiz") +expression: r0() || r1() || r2() || r3() || r4() diff --git a/finger/ehole/Apache.yml b/finger/ehole/Apache.yml new file mode 100644 index 0000000..e019c91 --- /dev/null +++ b/finger/ehole/Apache.yml @@ -0,0 +1,51 @@ +name: fingerprint-yaml-Apache +manual: false +detail: + fingerprint: + name: Apache + fofa: 'header="Server: Apache" || body="Test Page for Apache Installation" || body="Test Page for the SSL/TLS-aware Apache Installation on Web Site" || body="

It works!

" || body="Apache is functioning normally" || body="
This IP is being shared among many domains.
To view the domain you are looking for, simply enter the domain name in the location bar of your web browser.
"' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("Server: Apache"))' + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Test Page for Apache Installation") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Test Page for the SSL/TLS-aware Apache Installation on Web Site") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("

It works!

") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Apache is functioning normally") + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("
This IP is being shared among many domains.
To view the domain you are looking for, simply enter the domain name in the location bar of your web browser.
") +expression: r0() || r1() || r2() || r3() || r4() || r5() diff --git a/finger/ehole/Apollo.yml b/finger/ehole/Apollo.yml new file mode 100644 index 0000000..2a4c4d4 --- /dev/null +++ b/finger/ehole/Apollo.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Apollo +manual: false +detail: + fingerprint: + name: Apollo + fofa: header="Apollo" || title="Apollo" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Apollo")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Apollo") +expression: r0() || r1() diff --git a/finger/ehole/AppServ.yml b/finger/ehole/AppServ.yml new file mode 100644 index 0000000..a54570e --- /dev/null +++ b/finger/ehole/AppServ.yml @@ -0,0 +1,37 @@ +name: fingerprint-yaml-AppServ +manual: false +detail: + fingerprint: + name: AppServ + fofa: body="appserv/softicon.gif" && body="index.php?appservlang=th" || body="appserv/softicon.gif" || body="index.php?appservlang=th" || body="      管理apusic应用服务器") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("server: apusic application server"))' + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("欢迎使用apusic应用服务器") +expression: r0() || r1() || r2() diff --git a/finger/ehole/Arris.yml b/finger/ehole/Arris.yml new file mode 100644 index 0000000..0deb704 --- /dev/null +++ b/finger/ehole/Arris.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Arris +manual: false +detail: + fingerprint: + name: Arris + fofa: icon_hash="-1477563858" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == -1477563858 +expression: r0() diff --git a/finger/ehole/Artifactory.yml b/finger/ehole/Artifactory.yml new file mode 100644 index 0000000..8c2480d --- /dev/null +++ b/finger/ehole/Artifactory.yml @@ -0,0 +1,30 @@ +name: fingerprint-yaml-Artifactory +manual: false +detail: + fingerprint: + name: Artifactory + fofa: body="" || body="" || title="Artifactory" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Artifactory") +expression: r0() || r1() || r2() diff --git a/finger/ehole/Asustor.yml b/finger/ehole/Asustor.yml new file mode 100644 index 0000000..8ddf57a --- /dev/null +++ b/finger/ehole/Asustor.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Asustor +manual: false +detail: + fingerprint: + name: Asustor + fofa: icon_hash="1678170702" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 1678170702 +expression: r0() diff --git a/finger/ehole/Atlassian Confluence.yml b/finger/ehole/Atlassian Confluence.yml new file mode 100644 index 0000000..932a56d --- /dev/null +++ b/finger/ehole/Atlassian Confluence.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Atlassian Confluence +manual: false +detail: + fingerprint: + name: Atlassian Confluence + fofa: header="x-confluence" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("x-confluence")) +expression: r0() diff --git a/finger/ehole/Atlassian Jira.yml b/finger/ehole/Atlassian Jira.yml new file mode 100644 index 0000000..169b874 --- /dev/null +++ b/finger/ehole/Atlassian Jira.yml @@ -0,0 +1,44 @@ +name: fingerprint-yaml-Atlassian Jira +manual: false +detail: + fingerprint: + name: Atlassian Jira + fofa: 'header="Atlassian Jira" || body="" || body="Bug tracking and project tracking for software development powered by Atlassian JIRA" || body="" || title="Atlassian Jira"' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Atlassian Jira")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.body_string.contains("")' + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('Bug tracking and project tracking for software development powered by Atlassian JIRA') + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Atlassian Jira") +expression: r0() || r1() || r2() || r3() || r4() diff --git "a/finger/ehole/Atlassian \342\200\223 Confluence.yml" "b/finger/ehole/Atlassian \342\200\223 Confluence.yml" new file mode 100644 index 0000000..9713dc9 --- /dev/null +++ "b/finger/ehole/Atlassian \342\200\223 Confluence.yml" @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Atlassian – Confluence +manual: false +detail: + fingerprint: + name: Atlassian – Confluence + fofa: icon_hash="-305179312" || icon_hash="-1642532491" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == -305179312 + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == -1642532491 +expression: r0() || r1() diff --git "a/finger/ehole/Atlassian \342\200\223 JIRA.yml" "b/finger/ehole/Atlassian \342\200\223 JIRA.yml" new file mode 100644 index 0000000..4f3a313 --- /dev/null +++ "b/finger/ehole/Atlassian \342\200\223 JIRA.yml" @@ -0,0 +1,30 @@ +name: fingerprint-yaml-Atlassian – JIRA +manual: false +detail: + fingerprint: + name: Atlassian – JIRA + fofa: icon_hash="981867722" || icon_hash="552727997" || icon_hash="-1581907337" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 981867722 + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 552727997 + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == -1581907337 +expression: r0() || r1() || r2() diff --git a/finger/ehole/Atlassian.yml b/finger/ehole/Atlassian.yml new file mode 100644 index 0000000..32c50e2 --- /dev/null +++ b/finger/ehole/Atlassian.yml @@ -0,0 +1,30 @@ +name: fingerprint-yaml-Atlassian +manual: false +detail: + fingerprint: + name: Atlassian + fofa: icon_hash="743365239" || icon_hash="628535358" || icon_hash="705143395" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 743365239 + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 628535358 + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 705143395 +expression: r0() || r1() || r2() diff --git a/finger/ehole/BIG-IP.yml b/finger/ehole/BIG-IP.yml new file mode 100644 index 0000000..6c2faf1 --- /dev/null +++ b/finger/ehole/BIG-IP.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-BIG-IP +manual: false +detail: + fingerprint: + name: BIG-IP + fofa: icon_hash="878647854" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 878647854 +expression: r0() diff --git a/finger/ehole/BIGACE.yml b/finger/ehole/BIGACE.yml new file mode 100644 index 0000000..014443d --- /dev/null +++ b/finger/ehole/BIGACE.yml @@ -0,0 +1,30 @@ +name: fingerprint-yaml-BIGACE +manual: false +detail: + fingerprint: + name: BIGACE + fofa: body="content=\"BIGACE" || body="Site is running BIGACE" || body="Powered by BIGACE" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('content="BIGACE') + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Site is running BIGACE") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('Powered by BIGACE') +expression: r0() || r1() || r2() diff --git a/finger/ehole/BIGACE_CMS.yml b/finger/ehole/BIGACE_CMS.yml new file mode 100644 index 0000000..e849c11 --- /dev/null +++ b/finger/ehole/BIGACE_CMS.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-BIGACE_CMS +manual: false +detail: + fingerprint: + name: BIGACE_CMS + fofa: header="BIGACE_CMS" || title="BIGACE_CMS" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("BIGACE_CMS")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("BIGACE_CMS") +expression: r0() || r1() diff --git a/finger/ehole/Baidu.yml b/finger/ehole/Baidu.yml new file mode 100644 index 0000000..9a1acfb --- /dev/null +++ b/finger/ehole/Baidu.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Baidu +manual: false +detail: + fingerprint: + name: Baidu + fofa: icon_hash="1118684072" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 1118684072 +expression: r0() diff --git a/finger/ehole/BeeS-CMS.yml b/finger/ehole/BeeS-CMS.yml new file mode 100644 index 0000000..67f4d41 --- /dev/null +++ b/finger/ehole/BeeS-CMS.yml @@ -0,0 +1,100 @@ +name: fingerprint-yaml-BeeS-CMS +manual: false +detail: + fingerprint: + name: BeeS-CMS + fofa: body="powerd by" && body="beescms" && body="template/default/images/slides.min.jquery.js" && body="/default/images/xslider.js" && body="/default/images/search_btn.gif" && body="powerd by beescms" && body="mx_form/mx_form.php" || header="BEESCMS" || body="mx_form/mx_form.php" || body="powerd by beescms" || body="/default/images/search_btn.gif" && body="/default/images/xslider.js" || body="template/default/images/slides.min.jquery.js" || body="beescms" && body="powerd by" || body="powerd by" || body="beescms" || body="/default/images/xslider.js" || body="/default/images/search_btn.gif" || body="beescms" && body="template/default/images/slides.min.jquery.js" || title="BEESCMS" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("powerd by") && response.body_string.contains("beescms") && response.body_string.contains("template/default/images/slides.min.jquery.js") && response.body_string.contains("/default/images/xslider.js") && response.body_string.contains("/default/images/search_btn.gif") && response.body_string.contains("powerd by beescms") && response.body_string.contains("mx_form/mx_form.php") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("BEESCMS")) + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("mx_form/mx_form.php") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("powerd by beescms") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/default/images/search_btn.gif") && response.body_string.contains("/default/images/xslider.js") + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("template/default/images/slides.min.jquery.js") + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("beescms") && response.body_string.contains("powerd by") + r7: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("powerd by") + r8: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("beescms") + r9: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/default/images/xslider.js") + r10: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/default/images/search_btn.gif") + r11: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("beescms") && response.body_string.contains("template/default/images/slides.min.jquery.js") + r12: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("BEESCMS") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() || r10() || r11() || r12() diff --git a/finger/ehole/Bitbucket.yml b/finger/ehole/Bitbucket.yml new file mode 100644 index 0000000..534a63b --- /dev/null +++ b/finger/ehole/Bitbucket.yml @@ -0,0 +1,44 @@ +name: fingerprint-yaml-Bitbucket +manual: false +detail: + fingerprint: + name: Bitbucket + fofa: body="/j_atl_security_check" && body="bitbucket.page.login" || body="bitbucket.page.login" && body="/j_atl_security_check" || body="/j_atl_security_check" || body="bitbucket.page.login" || title="bitbucket" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/j_atl_security_check") && response.body_string.contains("bitbucket.page.login") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("bitbucket.page.login") && response.body_string.contains("/j_atl_security_check") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/j_atl_security_check") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("bitbucket.page.login") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("bitbucket") +expression: r0() || r1() || r2() || r3() || r4() diff --git a/finger/ehole/BloofoxCMS.yml b/finger/ehole/BloofoxCMS.yml new file mode 100644 index 0000000..8c0c328 --- /dev/null +++ b/finger/ehole/BloofoxCMS.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-BloofoxCMS +manual: false +detail: + fingerprint: + name: BloofoxCMS + fofa: body="content=\"bloofoxCMS" || body="Powered by " || header="cacti access" || header="set-cookie: cacti=" || title="login to cacti"' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/plugins/jqueryskin/include/login.css") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("set-cookie: cacti=")) && response.raw_header.bcontains(bytes("cacti access"))' + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Set-Cookie:Cacti=")) + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Login to Cacti") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("cacti access")) + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("set-cookie: cacti="))' + r7: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("login to cacti") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() diff --git a/finger/ehole/Camera.yml b/finger/ehole/Camera.yml new file mode 100644 index 0000000..bf3d31a --- /dev/null +++ b/finger/ehole/Camera.yml @@ -0,0 +1,44 @@ +name: fingerprint-yaml-Camera +manual: false +detail: + fingerprint: + name: Camera + fofa: body="href=\"/doc/css/rzslider.css\"" || body="/videostream.cgi?loginuse=" || body="北京中盾安全技术开发公司" || header="basic realm=camera name " || header="basic realm=camera name" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('href="/doc/css/rzslider.css"') + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/videostream.cgi?loginuse=") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("北京中盾安全技术开发公司") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("basic realm=camera name ")) + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("basic realm=camera name")) +expression: r0() || r1() || r2() || r3() || r4() diff --git a/finger/ehole/CentOS.yml b/finger/ehole/CentOS.yml new file mode 100644 index 0000000..03c5cc2 --- /dev/null +++ b/finger/ehole/CentOS.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-CentOS +manual: false +detail: + fingerprint: + name: CentOS + fofa: header="centos" || title="apache http server test page powered by centos" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("centos")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("apache http server test page powered by centos") +expression: r0() || r1() diff --git a/finger/ehole/Centerm.yml b/finger/ehole/Centerm.yml new file mode 100644 index 0000000..0bf1a6c --- /dev/null +++ b/finger/ehole/Centerm.yml @@ -0,0 +1,30 @@ +name: fingerprint-yaml-Centerm +manual: false +detail: + fingerprint: + name: Centerm + fofa: body="new ct.extapp.aboutsystemwindow(" || body="new ct.extapp.aboutsystemwindow" || body="new ct.extapp.aboutsystemwindow()" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("new ct.extapp.aboutsystemwindow(") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("new ct.extapp.aboutsystemwindow") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("new ct.extapp.aboutsystemwindow()") +expression: r0() || r1() || r2() diff --git a/finger/ehole/Chamilo.yml b/finger/ehole/Chamilo.yml new file mode 100644 index 0000000..7ee6a32 --- /dev/null +++ b/finger/ehole/Chamilo.yml @@ -0,0 +1,44 @@ +name: fingerprint-yaml-Chamilo +manual: false +detail: + fingerprint: + name: Chamilo + fofa: 'body="" || body=""' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.body_string.contains('''')' +expression: r0() || r1() || r2() || r3() || r4() diff --git a/finger/ehole/Chinacreator.yml b/finger/ehole/Chinacreator.yml new file mode 100644 index 0000000..ffc2720 --- /dev/null +++ b/finger/ehole/Chinacreator.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Chinacreator +manual: false +detail: + fingerprint: + name: Chinacreator + fofa: title="Chinacreator" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Chinacreator") +expression: r0() diff --git a/finger/ehole/Cisco-Adaptive-Security-Appliance.yml b/finger/ehole/Cisco-Adaptive-Security-Appliance.yml new file mode 100644 index 0000000..20794de --- /dev/null +++ b/finger/ehole/Cisco-Adaptive-Security-Appliance.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Cisco-Adaptive-Security-Appliance +manual: false +detail: + fingerprint: + name: Cisco-Adaptive-Security-Appliance + fofa: header="Adaptive Security Appliance HTTP" || body="Cisco Systems, Inc. Network Access" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Adaptive Security Appliance HTTP")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Cisco Systems, Inc. Network Access") +expression: r0() || r1() diff --git a/finger/ehole/Cisco-Prime-Infrastructure.yml b/finger/ehole/Cisco-Prime-Infrastructure.yml new file mode 100644 index 0000000..f2f03c0 --- /dev/null +++ b/finger/ehole/Cisco-Prime-Infrastructure.yml @@ -0,0 +1,58 @@ +name: fingerprint-yaml-Cisco-Prime-Infrastructure +manual: false +detail: + fingerprint: + name: Cisco-Prime-Infrastructure + fofa: 'body="
cisco prime infrastructure" && body="/webacs/internal/xwt/themes/prime/prime-xwt.css" && body="webacs/welcomeaction.do" || header="server: prime" || body="webacs/welcomeaction.do" || body="/webacs/lib/xwt/themes/prime/prime-xwt.css" || body="
cisco prime infrastructure" || body="/webacs/internal/xwt/themes/prime/prime-xwt.css" || title="cisco prime infrastructure"' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('
cisco prime infrastructure') && response.body_string.contains("/webacs/internal/xwt/themes/prime/prime-xwt.css") && response.body_string.contains("webacs/welcomeaction.do") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("server: prime"))' + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("webacs/welcomeaction.do") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/webacs/lib/xwt/themes/prime/prime-xwt.css") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('
cisco prime infrastructure') + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/webacs/internal/xwt/themes/prime/prime-xwt.css") + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("cisco prime infrastructure") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() diff --git a/finger/ehole/Cisco-VPN.yml b/finger/ehole/Cisco-VPN.yml new file mode 100644 index 0000000..5b81498 --- /dev/null +++ b/finger/ehole/Cisco-VPN.yml @@ -0,0 +1,58 @@ +name: fingerprint-yaml-Cisco-VPN +manual: false +detail: + fingerprint: + name: Cisco-VPN + fofa: header="webvpn" && header="basic realm=\"vpn8\"" || header="webvpn" || body="value=\" + svpnbtnlogin + \"" || header="basic realm=\"vpn8\"" || header="centrala_vpnrv082" || header="rv082" || title="cisco systems, inc. vpn 3000 concentrator" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("webvpn")) && response.raw_header.bcontains(bytes('basic realm="vpn8"')) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("webvpn")) + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('value=" + svpnbtnlogin + "') + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes('basic realm="vpn8"')) + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("centrala_vpnrv082")) + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("rv082")) + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("cisco systems, inc. vpn 3000 concentrator") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() diff --git a/finger/ehole/Citrix ADC.yml b/finger/ehole/Citrix ADC.yml new file mode 100644 index 0000000..1bc1722 --- /dev/null +++ b/finger/ehole/Citrix ADC.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Citrix ADC +manual: false +detail: + fingerprint: + name: Citrix ADC + fofa: header="Citrix ADC" || title="Citrix ADC" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Citrix ADC")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Citrix ADC") +expression: r0() || r1() diff --git a/finger/ehole/Citrix Gateway.yml b/finger/ehole/Citrix Gateway.yml new file mode 100644 index 0000000..fedb48a --- /dev/null +++ b/finger/ehole/Citrix Gateway.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Citrix Gateway +manual: false +detail: + fingerprint: + name: Citrix Gateway + fofa: header="Citrix Gateway" || title="Citrix Gateway" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Citrix Gateway")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Citrix Gateway") +expression: r0() || r1() diff --git a/finger/ehole/Citrix-Netscaler.yml b/finger/ehole/Citrix-Netscaler.yml new file mode 100644 index 0000000..8158818 --- /dev/null +++ b/finger/ehole/Citrix-Netscaler.yml @@ -0,0 +1,58 @@ +name: fingerprint-yaml-Citrix-Netscaler +manual: false +detail: + fingerprint: + name: Citrix-Netscaler + fofa: 'body="netscape/firefox/opera" || header="set-cookie: citrix_ns_id" || header="NS-CACHE" || header="ns_af" || header="Citrix NetScaler" || header="ns-cache" || title="Citrix NetScaler"' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("netscape/firefox/opera") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("set-cookie: citrix_ns_id"))' + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("NS-CACHE")) + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("ns_af")) + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Citrix NetScaler")) + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("ns-cache")) + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Citrix NetScaler") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() diff --git a/finger/ehole/ClusterEngine.yml b/finger/ehole/ClusterEngine.yml new file mode 100644 index 0000000..30d9ec8 --- /dev/null +++ b/finger/ehole/ClusterEngine.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-ClusterEngine +manual: false +detail: + fingerprint: + name: ClusterEngine + fofa: header="ClusterEngine" || title="ClusterEngine" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("ClusterEngine")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("ClusterEngine") +expression: r0() || r1() diff --git a/finger/ehole/Colasoft-RAS.yml b/finger/ehole/Colasoft-RAS.yml new file mode 100644 index 0000000..26b598f --- /dev/null +++ b/finger/ehole/Colasoft-RAS.yml @@ -0,0 +1,51 @@ +name: fingerprint-yaml-Colasoft-RAS +manual: false +detail: + fingerprint: + name: Colasoft-RAS + fofa: body="科来软件 版权所有" && body="i18ninit.min.js" && body="nfr=\"true\"" || body="i18ninit.min.js" && body="科来软件 版权所有" || body="科来软件 版权所有" || body="i18ninit.min.js" || body="nfr=\"true\"" || title="科来网络回溯" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("科来软件 版权所有") && response.body_string.contains("i18ninit.min.js") && response.body_string.contains('nfr="true"') + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("i18ninit.min.js") && response.body_string.contains("科来软件 版权所有") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("科来软件 版权所有") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("i18ninit.min.js") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('nfr="true"') + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("科来网络回溯") +expression: r0() || r1() || r2() || r3() || r4() || r5() diff --git a/finger/ehole/ColdFusion.yml b/finger/ehole/ColdFusion.yml new file mode 100644 index 0000000..f3524c7 --- /dev/null +++ b/finger/ehole/ColdFusion.yml @@ -0,0 +1,65 @@ +name: fingerprint-yaml-ColdFusion +manual: false +detail: + fingerprint: + name: ColdFusion + fofa: body="/cfajax/" || header="CFTOKEN" || body="ColdFusion Administrator Login" || body="{ document.write(\"\");}" || body="
" || body="" || body="Macromedia, the Macromedia logo, Macromedia ColdFusion and ColdFusion are
" || body="\"ColdFusion" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/cfajax/") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("CFTOKEN")) + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("ColdFusion Administrator Login") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('{ document.write("");}') + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Macromedia, the Macromedia logo, Macromedia ColdFusion and ColdFusion are
") + r7: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('ColdFusion MX') +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() diff --git a/finger/ehole/Consul-HashiCorp.yml b/finger/ehole/Consul-HashiCorp.yml new file mode 100644 index 0000000..ab05bbf --- /dev/null +++ b/finger/ehole/Consul-HashiCorp.yml @@ -0,0 +1,79 @@ +name: fingerprint-yaml-Consul-HashiCorp +manual: false +detail: + fingerprint: + name: Consul-HashiCorp + fofa: body="/ui/assets/consul-ui" && body="consul-ui/configs/environment" && body="consulhost" && body="consul instance" && body="www.consul.io" || body="www.consul.io" && body="consul instance" && body="consulhost" || body="consul-ui/config/environment" && body="/ui/assets/consul-ui" || body="/ui/assets/consul-ui" || body="consul-ui/configs/environment" || body="consulhost" || body="consul instance" || body="www.consul.io" || body="consul-ui/config/environment" || title="consul by hashicorp" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/ui/assets/consul-ui") && response.body_string.contains("consul-ui/configs/environment") && response.body_string.contains("consulhost") && response.body_string.contains("consul instance") && response.body_string.contains("www.consul.io") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("www.consul.io") && response.body_string.contains("consul instance") && response.body_string.contains("consulhost") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("consul-ui/config/environment") && response.body_string.contains("/ui/assets/consul-ui") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/ui/assets/consul-ui") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("consul-ui/configs/environment") + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("consulhost") + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("consul instance") + r7: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("www.consul.io") + r8: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("consul-ui/config/environment") + r9: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("consul by hashicorp") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() diff --git a/finger/ehole/Craft CMS.yml b/finger/ehole/Craft CMS.yml new file mode 100644 index 0000000..0ec9e48 --- /dev/null +++ b/finger/ehole/Craft CMS.yml @@ -0,0 +1,37 @@ +name: fingerprint-yaml-Craft CMS +manual: false +detail: + fingerprint: + name: Craft CMS + fofa: header="Craft CMS" || body="" || title="Craft CMS" || title="Craftcms" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Craft CMS")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Craft CMS") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Craftcms") +expression: r0() || r1() || r2() || r3() diff --git "a/finger/ehole/Cwindow\346\224\277\345\212\241\345\256\211\345\205\250\351\202\256\347\256\261\347\263\273\347\273\237.yml" "b/finger/ehole/Cwindow\346\224\277\345\212\241\345\256\211\345\205\250\351\202\256\347\256\261\347\263\273\347\273\237.yml" new file mode 100644 index 0000000..977fcf2 --- /dev/null +++ "b/finger/ehole/Cwindow\346\224\277\345\212\241\345\256\211\345\205\250\351\202\256\347\256\261\347\263\273\347\273\237.yml" @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Cwindow政务安全邮箱系统 +manual: false +detail: + fingerprint: + name: Cwindow政务安全邮箱系统 + fofa: header="Cwindow政务安全邮箱系统" || title="Cwindow政务安全邮箱系统" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Cwindow政务安全邮箱系统")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Cwindow政务安全邮箱系统") +expression: r0() || r1() diff --git a/finger/ehole/Cyberwisdom.yml b/finger/ehole/Cyberwisdom.yml new file mode 100644 index 0000000..cd4b7dc --- /dev/null +++ b/finger/ehole/Cyberwisdom.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Cyberwisdom +manual: false +detail: + fingerprint: + name: Cyberwisdom + fofa: header="Cyberwisdom" || title="Cyberwisdom" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Cyberwisdom")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Cyberwisdom") +expression: r0() || r1() diff --git a/finger/ehole/D-Link-DAR-8000.yml b/finger/ehole/D-Link-DAR-8000.yml new file mode 100644 index 0000000..f683f02 --- /dev/null +++ b/finger/ehole/D-Link-DAR-8000.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-D-Link-DAR-8000 +manual: false +detail: + fingerprint: + name: D-Link-DAR-8000 + fofa: body="dar-8000" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("dar-8000") +expression: r0() diff --git a/finger/ehole/DSCMS.yml b/finger/ehole/DSCMS.yml new file mode 100644 index 0000000..455b46d --- /dev/null +++ b/finger/ehole/DSCMS.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-DSCMS +manual: false +detail: + fingerprint: + name: DSCMS + fofa: header="DSCMS" || title="DSCMS" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("DSCMS")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("DSCMS") +expression: r0() || r1() diff --git a/finger/ehole/DSShop.yml b/finger/ehole/DSShop.yml new file mode 100644 index 0000000..638a1b9 --- /dev/null +++ b/finger/ehole/DSShop.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-DSShop +manual: false +detail: + fingerprint: + name: DSShop + fofa: header="DSShop" || title="DSShop" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("DSShop")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("DSShop") +expression: r0() || r1() diff --git a/finger/ehole/DVWA.yml b/finger/ehole/DVWA.yml new file mode 100644 index 0000000..5a66c36 --- /dev/null +++ b/finger/ehole/DVWA.yml @@ -0,0 +1,51 @@ +name: fingerprint-yaml-DVWA +manual: false +detail: + fingerprint: + name: DVWA + fofa: body="dvwa/css/login.css" && body="dvwa/images/login_logo.png" || body="dvwa/css/login.css" || body="dvwa/images/login_logo.png" || body="Damn Vulnerable Web App (DVWA) - Login" || body="


" || title="damn vulnerable web app (dvwa) - login" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("dvwa/css/login.css") && response.body_string.contains("dvwa/images/login_logo.png") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("dvwa/css/login.css") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("dvwa/images/login_logo.png") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Damn Vulnerable Web App (DVWA) - Login") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('


') + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("damn vulnerable web app (dvwa) - login") +expression: r0() || r1() || r2() || r3() || r4() || r5() diff --git a/finger/ehole/Dahua.yml b/finger/ehole/Dahua.yml new file mode 100644 index 0000000..315bf0d --- /dev/null +++ b/finger/ehole/Dahua.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Dahua +manual: false +detail: + fingerprint: + name: Dahua + fofa: icon_hash="-1466785234" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == -1466785234 +expression: r0() diff --git a/finger/ehole/Debian.yml b/finger/ehole/Debian.yml new file mode 100644 index 0000000..3d7f8ce --- /dev/null +++ b/finger/ehole/Debian.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Debian +manual: false +detail: + fingerprint: + name: Debian + fofa: body="

welcome to nginx on debian!

" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("

welcome to nginx on debian!

") +expression: r0() diff --git "a/finger/ehole/DedeCMS(\347\273\207\346\242\246).yml" "b/finger/ehole/DedeCMS(\347\273\207\346\242\246).yml" new file mode 100644 index 0000000..25d72dc --- /dev/null +++ "b/finger/ehole/DedeCMS(\347\273\207\346\242\246).yml" @@ -0,0 +1,23 @@ +name: fingerprint-yaml-DedeCMS(织梦) +manual: false +detail: + fingerprint: + name: DedeCMS(织梦) + fofa: body="dedecms" || title="DedeCMS(织梦)" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("dedecms") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("DedeCMS(织梦)") +expression: r0() || r1() diff --git a/finger/ehole/DedeCMS.yml b/finger/ehole/DedeCMS.yml new file mode 100644 index 0000000..cd1eb67 --- /dev/null +++ b/finger/ehole/DedeCMS.yml @@ -0,0 +1,79 @@ +name: fingerprint-yaml-DedeCMS +manual: false +detail: + fingerprint: + name: DedeCMS + fofa: body="power by dedecms" && body="http://www.dedecms.com/" && body="dedecms" && body="/templets/default/style/dedecms.css" && body="

dedecms error warning!

" || body="Power by DedeCms" || body="http://www.dedecms.com/" || body="DedeCMS" || body="/templets/default/style/dedecms.css" || body="

dedecms error warning!

" || body="dedecms" && body="http://www.dedecms.com/" && body="powered by" || body="power by dedecms" || body="Power by DedeCms" || body="/templets/default/style/dedecms.css" && body="dedecms" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("power by dedecms") && response.body_string.contains("http://www.dedecms.com/") && response.body_string.contains("dedecms") && response.body_string.contains("/templets/default/style/dedecms.css") && response.body_string.contains("

dedecms error warning!

") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Power by DedeCms") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("http://www.dedecms.com/") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("DedeCMS") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/templets/default/style/dedecms.css") + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("

dedecms error warning!

") + r6: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("dedecms") && response.body_string.contains("http://www.dedecms.com/") && response.body_string.contains("powered by") + r7: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("power by dedecms") + r8: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('Power by DedeCms') + r9: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("/templets/default/style/dedecms.css") && response.body_string.contains("dedecms") +expression: r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() diff --git a/finger/ehole/Dell-iDRAC.yml b/finger/ehole/Dell-iDRAC.yml new file mode 100644 index 0000000..34570b1 --- /dev/null +++ b/finger/ehole/Dell-iDRAC.yml @@ -0,0 +1,23 @@ +name: fingerprint-yaml-Dell-iDRAC +manual: false +detail: + fingerprint: + name: Dell-iDRAC + fofa: header="Dell-iDRAC" || title="Dell-iDRAC" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("Dell-iDRAC")) + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("Dell-iDRAC") +expression: r0() || r1() diff --git a/finger/ehole/Dell.yml b/finger/ehole/Dell.yml new file mode 100644 index 0000000..5a48044 --- /dev/null +++ b/finger/ehole/Dell.yml @@ -0,0 +1,16 @@ +name: fingerprint-yaml-Dell +manual: false +detail: + fingerprint: + name: Dell + fofa: icon_hash="-1153950306" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == -1153950306 +expression: r0() diff --git a/finger/ehole/DianCMS.yml b/finger/ehole/DianCMS.yml new file mode 100644 index 0000000..e3825cc --- /dev/null +++ b/finger/ehole/DianCMS.yml @@ -0,0 +1,44 @@ +name: fingerprint-yaml-DianCMS +manual: false +detail: + fingerprint: + name: DianCMS + fofa: body="diancms_sitename" && body="diancms_用户登陆引用" || header="DianCMS" || body="diancms_用户登陆引用" || body="diancms_sitename" || title="DianCMS" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("diancms_sitename") && response.body_string.contains("diancms_用户登陆引用") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("DianCMS")) + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("diancms_用户登陆引用") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("diancms_sitename") + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("DianCMS") +expression: r0() || r1() || r2() || r3() || r4() diff --git a/finger/ehole/Discuz! X.yml b/finger/ehole/Discuz! X.yml new file mode 100644 index 0000000..5ac6c3a --- /dev/null +++ b/finger/ehole/Discuz! X.yml @@ -0,0 +1,30 @@ +name: fingerprint-yaml-Discuz! X +manual: false +detail: + fingerprint: + name: Discuz! X + fofa: body="" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("__admin_media_prefix__") && response.body_string.contains("csrfmiddlewaretoken") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("csrfmiddlewaretoken") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("__admin_media_prefix__") + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') +expression: r0() || r1() || r2() || r3() diff --git "a/finger/ehole/DocCms(\347\250\273\345\243\263CMS).yml" "b/finger/ehole/DocCms(\347\250\273\345\243\263CMS).yml" new file mode 100644 index 0000000..c1f97e3 --- /dev/null +++ "b/finger/ehole/DocCms(\347\250\273\345\243\263CMS).yml" @@ -0,0 +1,37 @@ +name: fingerprint-yaml-DocCms(稻壳CMS) +manual: false +detail: + fingerprint: + name: DocCms(稻壳CMS) + fofa: body="DocCms" || body="Power by DocCms" || header="DocCms" || title="DocCms" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("DocCms") + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains("Power by DocCms") + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("DocCms")) + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("DocCms") +expression: r0() || r1() || r2() || r3() diff --git a/finger/ehole/DocMail-Cwindow.yml b/finger/ehole/DocMail-Cwindow.yml new file mode 100644 index 0000000..5af394f --- /dev/null +++ b/finger/ehole/DocMail-Cwindow.yml @@ -0,0 +1,44 @@ +name: fingerprint-yaml-DocMail-Cwindow +manual: false +detail: + fingerprint: + name: DocMail-Cwindow + fofa: body="href=\"http://www.docmail.cn/android/app/docmail.apk" && body="content=\"北京国信冠群技术有限公司,国信冠群,邮件" && body="" || body="" || body="content=\"北京国信冠群技术有限公司,国信冠群,邮件" || body="href=\"http://www.docmail.cn/android/app/docmail.apk" || title="cwindow云视窗安全电子邮件" +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('href="http://www.docmail.cn/android/app/docmail.apk') && response.body_string.contains('content="北京国信冠群技术有限公司,国信冠群,邮件') && response.body_string.contains('') + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('') + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('content="北京国信冠群技术有限公司,国信冠群,邮件') + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.body_string.contains('href="http://www.docmail.cn/android/app/docmail.apk') + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.title_string.contains("cwindow云视窗安全电子邮件") +expression: r0() || r1() || r2() || r3() || r4() diff --git a/finger/ehole/Docker.yml b/finger/ehole/Docker.yml new file mode 100644 index 0000000..f0df704 --- /dev/null +++ b/finger/ehole/Docker.yml @@ -0,0 +1,51 @@ +name: fingerprint-yaml-Docker +manual: false +detail: + fingerprint: + name: Docker + fofa: 'icon_hash="-1814887000" || icon_hash="1937209448" || header="x-docker-registry-version" && header="x-docker-container: nginx" || header="x-docker-container: nginx" || header="x-docker: production" || header="x-docker-registry-version"' +transport: http +rules: + r0: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == -1814887000 + r1: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: faviconHash(response.getIconContent()) == 1937209448 + r2: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("x-docker-registry-version")) && response.raw_header.bcontains(bytes("x-docker-container: nginx"))' + r3: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("x-docker-container: nginx"))' + r4: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: 'response.raw_header.bcontains(bytes("x-docker: production"))' + r5: + request: + cache: true + method: GET + path: / + follow_redirects: true + expression: response.raw_header.bcontains(bytes("x-docker-registry-version")) +expression: r0() || r1() || r2() || r3() || r4() || r5() diff --git a/finger/ehole/Dokeos.yml b/finger/ehole/Dokeos.yml new file mode 100644 index 0000000..f915eb8 --- /dev/null +++ b/finger/ehole/Dokeos.yml @@ -0,0 +1,79 @@ +name: fingerprint-yaml-Dokeos +manual: false +detail: + fingerprint: + name: Dokeos + fofa: 'body="href=\"http://www.dokeos.com\" rel=\"Copyright" || body="content=\"Dokeos" || body="name=\"Generator\" content=\"Dokeos" || body="