---HTTP Fingerprint files, compiled by Ron Bowes with a special thanks to... -- o Kevin Johnson (@secureideas) for the fingerprints that come with Yokoso -- http://yokoso.inguardians.com -- o Jason H. (@jhaddix) for helping out with a whole pile of fingerprints he's -- collected -- o Bob Dooling -- o Robert Rowley for the awesome open source cms and README checks -- http://www.irvineunderground.org -- -- This file is released under the Nmap license; see: -- http://nmap.org/book/man-legal.html -- -- Although this format was originally modeled after the Nikto format, that ended -- up being too restrictive. The current format is a simple Lua table. There are many -- advantages to this technique; it's powerful, we don't need to write custom parsing -- code, anybody who codes in Lua can easily add checks, and we can write converters -- to read Nikto and other formats if we want to. -- -- The 'fingerprints' table is the key. It's an array of checks that will be run in the -- order they're given. Each check consists of a path, zero or more matches, output text, -- and other optional fields. Here are all the currently defined fields: -- -- fingerprint.probes -- A list of one or more probes to send to the server. Each probe is either a table containing -- the key 'path' (and potentially others), or it's a string indicating the path. -- -- fingerprint.probes[i].path -- The URI to check, optionally containing GET arguments. This should start with a '/' -- and, if it's a directory, end with a '/'. -- -- fingerprint.probes[i].method [optional; default: 'GET'}}] -- The HTTP method to use when making requests ('GET'}}, 'POST', 'HEAD', 'PUT', 'DELETE', etc -- -- fingerprint.ignore_404 [optional; default: false] -- If set, the automatic checks for 404 and custom 404 pages are disabled for that check. -- Every page will be included unless fingerprint.matches.dontmatch excludes it. -- -- fingerprint.severity [optional; default: 1] -- Give a severity rating, if it's a vulnerability. The scale is: -- 1 - Info -- 2 - Low priority -- 3 - Warning -- 4 - Critical -- -- fingerprint.matches -- An array of tables, each of which contains three fields. These will be checked, starting -- from the first, until one is matched. If there is no 'match' text, it will fire as long -- as the result isn't a 404. This match is not case sensitive. -- -- fingerprint.matches[i].match -- A string (specifically, a Lua pattern) that has to be found somewhere in the output to -- count as a match. The string can be in the status line, in a header, or in the body. -- In addition to matching, this field can contain captures that'll be included in the -- output. See: http://lua-users.org/wiki/PatternsTutorial -- -- fingerprint.matches[i].dontmatch -- A string (specifically, a lua pattern) that cannot be found somewhere in the output. -- This takes precedence over any text matched in the 'match' field -- -- fingerprint.matches[i].output -- The text to output if this match happens. If the 'match' field contains captures, these -- captures can be used with \1, \2, etc. -- -- -- If you have any questions, feel free to email nmap-dev@insecure.org or contact Ron Bowes! -- fingerprints = {} ------------------------------------------------ ---- GENERAL CHECKS ---- ------------------------------------------------ -- These are checks for generic paths, like /wiki, /images, /admin, etc table.insert(fingerprints, { category='general', probes={ {path='/', method='GET'} }, matches={ {match='Index of .*(Apache.*) Server at', output='Root directory w/ listing on \'\\1\''}, {match='<title>Index of', output='Root directory w/ directory listing'} } }) table.insert(fingerprints, { category='general', probes={ {path='/blog/', method='HEAD'}, {path='/weblog/', method='HEAD'}, {path='/weblogs/', method='HEAD'}, {path='/wordpress/', method='HEAD'} }, matches={ {output='Blog'} } }) table.insert(fingerprints, { category='general', probes={ {path='/wiki/', method='HEAD'}, {path='/mediawiki/', method='HEAD'} }, matches={ {output='Wiki'} } }) table.insert(fingerprints, { category='general', probes={ {path='/forum/', method='HEAD'}, {path='/forums/', method='HEAD'}, {path='/smf/', method='HEAD'}, {path='/phpbb/', method='HEAD'} }, matches={ {output='Forum'} } }) table.insert(fingerprints, { category='general', probes={ {path='/manager/', method='HEAD'}, {path='/manager/html/upload', method='HEAD'}, {path='/web-console/ServerInfo.jsp', method='HEAD'}, {path='/jmx-console/', method='HEAD'}, {path='/CFIDE/administrator/enter.cfm', method='HEAD'}, {path='/CFIDE/componentutils/login.cfm', method='HEAD'}, {path='/admin.php', method='HEAD'}, {path='/admin/', method='HEAD'}, {path='/administrator/', method='HEAD'}, {path='/moderator/', method='HEAD'}, {path='/webadmin/', method='HEAD'}, {path='/adminarea/', method='HEAD'}, {path='/bb-admin/', method='HEAD'}, {path='/adminLogin/', method='HEAD'}, {path='/admin_area/', method='HEAD'}, {path='/panel-administracion/', method='HEAD'}, {path='/instadmin/', method='HEAD'}, {path='/memberadmin/', method='HEAD'}, {path='/administratorlogin/', method='HEAD'}, {path='/adm/', method='HEAD'}, {path='/admin/account.php', method='HEAD'}, {path='/admin/index.php', method='HEAD'}, {path='/admin/login.php', method='HEAD'}, {path='/admin/admin.php', method='HEAD'}, {path='/admin/account.php', method='HEAD'}, {path='/joomla/administrator', method='HEAD'}, {path='/login.php', method='HEAD'}, {path='/admin_area/admin.php', method='HEAD'}, {path='/admin_area/login.php', method='HEAD'}, {path='/siteadmin/login.php', method='HEAD'}, {path='/siteadmin/index.php', method='HEAD'}, {path='/siteadmin/login.html', method='HEAD'}, {path='/admin/account.html', method='HEAD'}, {path='/admin/index.html', method='HEAD'}, {path='/admin/login.html', method='HEAD'}, {path='/admin/admin.html', method='HEAD'}, {path='/admin_area/index.php', method='HEAD'}, {path='/bb-admin/index.php', method='HEAD'}, {path='/bb-admin/login.php', method='HEAD'}, {path='/bb-admin/admin.php', method='HEAD'}, {path='/admin/home.php', method='HEAD'}, {path='/admin_area/login.html', method='HEAD'}, {path='/admin_area/index.html', method='HEAD'}, {path='/admin/controlpanel.php', method='HEAD'}, {path='/admincp/index.asp', method='HEAD'}, {path='/admincp/login.asp', method='HEAD'}, {path='/admincp/index.html', method='HEAD'}, {path='/admin/account.html', method='HEAD'}, {path='/adminpanel.html', method='HEAD'}, {path='/webadmin.html', method='HEAD'}, {path='/webadmin/index.html', method='HEAD'}, {path='/webadmin/admin.html', method='HEAD'}, {path='/webadmin/login.html', method='HEAD'}, {path='/admin/admin_login.html', method='HEAD'}, {path='/admin_login.html', method='HEAD'}, {path='/panel-administracion/login.html', method='HEAD'}, {path='/admin/cp.php', method='HEAD'}, {path='/cp.php', method='HEAD'}, {path='/administrator/index.php', method='HEAD'}, {path='/administrator/login.php', method='HEAD'}, {path='/nsw/admin/login.php', method='HEAD'}, {path='/webadmin/login.php', method='HEAD'}, {path='/admin/admin_login.php', method='HEAD'}, {path='/admin_login.php', method='HEAD'}, {path='/administrator/account.php', method='HEAD'}, {path='/administrator.php', method='HEAD'}, {path='/admin_area/admin.html', method='HEAD'}, {path='/pages/admin/admin-login.php', method='HEAD'}, {path='/admin/admin-login.php', method='HEAD'}, {path='/admin-login.php', method='HEAD'}, {path='/bb-admin/index.html', method='HEAD'}, {path='/bb-admin/login.html', method='HEAD'}, {path='/bb-admin/admin.html', method='HEAD'}, {path='/admin/home.html', method='HEAD'}, {path='/modelsearch/login.php', method='HEAD'}, {path='/moderator.php', method='HEAD'}, {path='/moderator/login.php', method='HEAD'}, {path='/moderator/admin.php', method='HEAD'}, {path='/account.php', method='HEAD'}, {path='/pages/admin/admin-login.html', method='HEAD'}, {path='/admin/admin-login.html', method='HEAD'}, {path='/admin-login.html', method='HEAD'}, {path='/controlpanel.php', method='HEAD'}, {path='/admincontrol.php', method='HEAD'}, {path='/admin/adminLogin.html', method='HEAD'}, {path='/adminLogin.html', method='HEAD'}, {path='/admin/adminLogin.html', method='HEAD'}, {path='/home.html', method='HEAD'}, {path='/rcjakar/admin/login.php', method='HEAD'}, {path='/adminarea/index.html', method='HEAD'}, {path='/adminarea/admin.html', method='HEAD'}, {path='/webadmin.php', method='HEAD'}, {path='/webadmin/index.php', method='HEAD'}, {path='/webadmin/admin.php', method='HEAD'}, {path='/admin/controlpanel.html', method='HEAD'}, {path='/admin.html', method='HEAD'}, {path='/admin/cp.html', method='HEAD'}, {path='/cp.html', method='HEAD'}, {path='/adminpanel.php', method='HEAD'}, {path='/moderator.html', method='HEAD'}, {path='/administrator/index.html', method='HEAD'}, {path='/administrator/login.html', method='HEAD'}, {path='/user.html', method='HEAD'}, {path='/administrator/account.html', method='HEAD'}, {path='/administrator.html', method='HEAD'}, {path='/login.html', method='HEAD'}, {path='/modelsearch/login.html', method='HEAD'}, {path='/moderator/login.html', method='HEAD'}, {path='/adminarea/login.html', method='HEAD'}, {path='/panel-administracion/index.html', method='HEAD'}, {path='/panel-administracion/admin.html', method='HEAD'}, {path='/modelsearch/index.html', method='HEAD'}, {path='/modelsearch/admin.html', method='HEAD'}, {path='/admincontrol/login.html', method='HEAD'}, {path='/adm/index.html', method='HEAD'}, {path='/adm.html', method='HEAD'}, {path='/moderator/admin.html', method='HEAD'}, {path='/user.php', method='HEAD'}, {path='/account.html', method='HEAD'}, {path='/controlpanel.html', method='HEAD'}, {path='/admincontrol.html', method='HEAD'}, {path='/panel-administracion/login.php', method='HEAD'}, {path='/wp-login.php', method='HEAD'}, {path='/adminLogin.php', method='HEAD'}, {path='/admin/adminLogin.php', method='HEAD'}, {path='/adminarea/index.php', method='HEAD'}, {path='/adminarea/admin.php', method='HEAD'}, {path='/adminarea/login.php', method='HEAD'}, {path='/panel-administracion/index.php', method='HEAD'}, {path='/panel-administracion/admin.php', method='HEAD'}, {path='/modelsearch/index.php', method='HEAD'}, {path='/modelsearch/admin.php', method='HEAD'}, {path='/admincontrol/login.php', method='HEAD'}, {path='/adm/admloginuser.php', method='HEAD'}, {path='/admloginuser.php', method='HEAD'}, {path='/admin2.php', method='HEAD'}, {path='/admin2/login.php', method='HEAD'}, {path='/admin2/index.php', method='HEAD'}, {path='/adm/index.php', method='HEAD'}, {path='/adm.php', method='HEAD'}, {path='/affiliate.php', method='HEAD'}, {path='/adm_auth.php', method='HEAD'}, {path='/memberadmin.php', method='HEAD'}, {path='/administratorlogin.php', method='HEAD'}, }, matches={ {match='<title>Index of', output='Possible admin folder w/ directory listing'}, {output='Possible admin folder'} } }) table.insert(fingerprints, { category='general', probes={ {path='/backup/', method='GET'}, {path='/backup', method='GET'}, {path='/backup.sql', method='GET'}, {path='/backup.sql.gz', method='GET'}, {path='/backup.sql.bz2', method='GET'}, {path='/backup.zip', method='GET'}, {path='/backups/', method='GET'}, {path='/bak/', method='GET'}, {path='/back/', method='GET'} }, matches={ {match='<title>Index of', output='Backup folder w/ directory listing'}, {match='', output='Possible backup'} } }) table.insert(fingerprints, { category='general', probes={ {path='/atom/', method='HEAD'}, {path='/atom.aspx', method='HEAD'}, {path='/atom.php', method='HEAD'}, {path='/atom.xml', method='HEAD'}, {path='/atom.jsp', method='HEAD'}, {path='/rss/', method='HEAD'}, {path='/rss.aspx', method='HEAD'}, {path='/rss.php', method='HEAD'}, {path='/rss.xml', method='HEAD'}, {path='/rss.jsp', method='HEAD'} }, matches={ {output='RSS or Atom feed'} } }) table.insert(fingerprints, { category='general', probes={ {path='/etc/passwd', method='GET'}, {path='/boot.ini', method='GET'} }, matches={ {match='root:', output='Webroot appears to be in / (Linux)'}, {match='boot loader', output='Webroot appears to be in c:\\ (Windows)'}, {match='', output='Webroot might be in root folder'} } }) table.insert(fingerprints, { category='general', probes={ {path='/example/', method='GET'}, {path='/examples/', method='GET'}, {path='/iissamples/', method='GET'}, {path='/j2eeexamples/', method='GET'}, {path='/j2eeexamplesjsp/', method='GET'}, {path='/sample/', method='GET'}, {path='/ncsample/', method='GET'}, {path='/fpsample/', method='GET'}, {path='/cmsample/', method='GET'}, {path='/samples/', method='GET'}, {path='/mono/1.1/index.aspx', method='GET'} }, matches= { {match='<title>Index of .*(Apache.*) Server at', output='Sample scripts w/ listing on \'\\1\''}, {match='<title>Index of', output='Sample scripts w/ directory listing'}, {match='', output='Sample scripts'} } }) table.insert(fingerprints, { category='general', probes={ {path='/login.asp', method='HEAD'}, {path='/login.aspx', method='HEAD'}, {path='/login/', method='HEAD'}, {path='/login.htm', method='HEAD'}, {path='/login.html', method='HEAD'}, {path='/login.php', method='HEAD'}, {path='/login.jsp', method='HEAD'} }, matches= { {match='', output='Login page'} } }) table.insert(fingerprints, { category='general', probes={ {path='/test.asp', method='HEAD'}, {path='/test.class', method='HEAD'}, {path='/test/', method='HEAD'}, {path='/test.htm', method='HEAD'}, {path='/test.html', method='HEAD'}, {path='/test.php', method='HEAD'}, {path='/test.txt', method='HEAD'} }, matches= { {match='', output='Test page'} } }) table.insert(fingerprints, { category='general', probes={ {path='/webmail/', method='HEAD'}, {path='/mail/', method='HEAD'} }, matches= { {match='', output='Mail folder'} } }) table.insert(fingerprints, { category='general', probes={ {path='/log/', method='HEAD'}, {path='/log.htm', method='HEAD'}, {path='/log.php', method='HEAD'}, {path='/log.asp', method='HEAD'}, {path='/log.aspx', method='HEAD'}, {path='/log.jsp', method='HEAD'}, {path='/logs/', method='HEAD'}, {path='/logs.htm', method='HEAD'}, {path='/logs.php', method='HEAD'}, {path='/logs.asp', method='HEAD'}, {path='/logs.aspx', method='HEAD'}, {path='/logs.jsp', method='HEAD'}, {path='/wwwlog/', method='HEAD'}, {path='/wwwlogs/', method='HEAD'}, {path='/mail_log_files/', method='HEAD'} }, matches= { {match='', output='Logs'} } }) table.insert(fingerprints, { category='general', probes={ {path='/images/rails.png', method='HEAD'}, }, matches= { {match='', output='Ruby on Rails'} } }) table.insert(fingerprints, { category='general', probes={ {path='/mono/', method='HEAD'}, }, matches= { {match='', output='Mono'} } }) table.insert(fingerprints, { category='general', probes={ {path='/robots.txt', method='HEAD'}, }, matches= { {match='', output='Robots file'} } }) ------------------------------------------------ ---- SECURITY SOFTWARE ---- ------------------------------------------------ -- These checks will find specific installed software. If possible, it will also -- find versions, etc. table.insert(fingerprints, { category='security', probes={ {path='/arcsight/', method='HEAD'}, {path='/arcsight/images/logo-login-arcsight.gif', method='HEAD'}, {path='/arcsight/images/navbar-icon-logout-on.gif', method='HEAD'}, {path='/images/logo-arcsight.gif', method='HEAD'}, {path='/logger/monitor.ftl', method='HEAD'}, }, matches={ {output='Arcsight'} } }) table.insert(fingerprints, { category='security', probes={ {path='/beef/', method='HEAD'}, {path='/BEEF/', method='HEAD'}, {path='/beef/images/beef.gif', method='HEAD'} }, matches={ {output='BeEF Browser Exploitation Framework'} } }) table.insert(fingerprints, { category='security', probes={ {path='/gfx/form_top_left_corner.gif', method='HEAD'}, {path='/gfx/logout_24.png', method='HEAD'}, {path='/gfx/new_logo.gif', method='HEAD'}, {path='/javascript/sorttable.js', method='HEAD'} }, matches= { {match='', output='Secunia NSI'} } }) table.insert(fingerprints, { category='security', probes={ {path='/images/btn_help_nml.gif', method='HEAD'}, {path='/images/hdr_icon_homeG.gif', method='HEAD'}, {path='/spControl.php', method='HEAD'}, {path='/images/isslogo.gif', method='HEAD'}, {path='/deploymentmanager/', method='HEAD'}, }, matches= { {match='', output='IBM Proventia'} } }) table.insert(fingerprints, { category='security', probes={ {path='/i18n/EN/css/foundstone.css', method='HEAD'}, {path='/i18n/EN/images/external_nav_square.gif', method='HEAD'}, }, matches= { {match='', output='Foundstone'} } }) table.insert(fingerprints, { category='security', probes={ {path='/officescan/console/html/cgi/cgiChkMasterPwd.exe', method='HEAD'}, {path='/officescan/console/html/ClientInstall/officescannt.htm', method='HEAD'}, {path='/officescan/console/html/images/icon_refresh.gif', method='HEAD'}, }, matches= { {match='', output='Trend Micro OfficeScan Server'} } }) table.insert(fingerprints, { category='security', probes={ {path='/picts/BC_bwlogorev.gif', method='HEAD'}, {path='/picts/menu_leaf.gif', method='HEAD'}, }, matches= { {match='', output='BlueCoat Reporter'} } }) table.insert(fingerprints, { category='security', probes={ {path='/theme/images/en/login1.gif', method='HEAD'}, }, matches={ {match='', output='Fortinet VPN/Firewall'} } }) table.insert(fingerprints, { category='security', probes={ {path='/', method='GET'}, }, matches={ {match='id="NessusClient"', output='Nessus'}, {match='NessusClient.swf', output='Nessus'} } }) table.insert(fingerprints, { category='security', probes={ {path='/NessusClient.swf', method='HEAD'}, }, matches={ {match='', output='Nessus'} } }) ------------------------------------------------ ---- MANAGEMENT SOFTWARE ---- ------------------------------------------------ table.insert(fingerprints, { category='management', probes={ {path='/vmware/', method='HEAD'}, {path='/vmware/imx/vmware_boxes-16x16.png', method='HEAD'}, {path='/ui/', method='HEAD'}, {path='/ui/imx/vmwareLogo-16x16.png', method='HEAD'}, {path='/ui/imx/vmwarePaperBagLogo-16x16.png', method='HEAD'}, {path='/ui/vManage.do', method='HEAD'}, {path='/client/VMware-viclient.exe', method='HEAD'}, {path='/en/welcomeRes.js', method='HEAD'} }, matches={ {output='VMWare'} } }) table.insert(fingerprints, { category='management', probes={ {path='/citrix/', method='HEAD'}, {path='/Citrix/', method='HEAD'}, {path='/Citrix/MetaFrame/auth/login.aspx', method='HEAD'}, {path='/images/ctxHeader01.jpg', method='HEAD'}, {path='/images/Safeword_Token.jpg', method='HEAD'}, {path='/sw/auth/login.aspx', method='HEAD'}, {path='/vpn/images/AccessGateway.ico', method='HEAD'}, {path='/citrix/AccessPlatform/auth/clientscripts/', method='HEAD'}, {path='/AccessPlatform/auth/clientscripts/', method='HEAD'}, {path='/Citrix//AccessPlatform/auth/clientscripts/cookies.js', method='HEAD'}, {path='/Citrix/AccessPlatform/auth/clientscripts/login.js', method='HEAD'}, {path='/Citrix/PNAgent/config.xml', method='HEAD'}, }, matches={ {output='Citrix'} } }) table.insert(fingerprints, { category='management', probes={ {path='/cgi-bin/image/shikaku2.png', method='HEAD'}, }, matches= { {match='', output='TeraStation PRO RAID 0/1/5 Network Attached Storage'} } }) table.insert(fingerprints, { category='management', probes={ {path='/config/public/usergrp.gif', method='HEAD'}, {path='/pictures/buttons/file_view_mark.gif', method='HEAD'}, }, matches= { {match='', output='AXIS StorPoint'} } }) table.insert(fingerprints, { category='management', probes={ {path='/cpqlogin.htm?RedirectUrl=/&RedirectQueryString=', method='HEAD'}, {path='/hplogo.gif', method='HEAD'}, }, matches= { {match='', output='HP System Management Homepage'} } }) table.insert(fingerprints, { category='management', probes={ {path='/ie_index.htm', method='HEAD'}, {path='/ilo.gif', method='HEAD'}, }, matches= { {match='', output='HP Integrated Lights Out'} } }) table.insert(fingerprints, { category='management', probes={ {path='/images/icon_server_connected.gif', method='HEAD'}, }, matches= { {match='', output='HP Blade Enclosure'} } }) table.insert(fingerprints, { category='management', probes={ {path='/mxhtml/images/signin_logo.gif', method='HEAD'}, {path='/mxhtml/images/status_critical_15.gif', method='HEAD'}, {path='/mxportal/home/en_US/servicetools.gif', method='HEAD'}, {path='/mxportal/home/MxPortalFrames.jsp', method='HEAD'}, }, matches= { {match='', output='HP Insight Manager'} } }) table.insert(fingerprints, { category='management', probes={ {path='/xymon/menu/menu.css', method='HEAD'}, }, matches= { {match='', output='Xymon'} } }) table.insert(fingerprints, { category='management', probes={ {path='/rrc.htm', method='HEAD'}, }, matches= { {match='', output='Raritan Remote Client'} } }) table.insert(fingerprints, { category='management', probes={ {path='/manager/', method='HEAD'}, {path='/manager/html/upload', method='HEAD'}, }, matches= { {match='', output='Tomcat manager (possibly)'} } }) table.insert(fingerprints, { category='management', probes={ {path='/web-console/ServerInfo.jsp', method='HEAD'}, {path='/jmx-console/', method='HEAD'}, }, matches= { {match='', output='JBOSS Console'} } }) table.insert(fingerprints, { category='management', probes={ {path='/CFIDE/administrator/enter.cfm', method='HEAD'}, {path='/CFIDE/componentutils/login.cfm', method='HEAD'}, {path='/CFIDE/Administrator/startstop.html', method='HEAD'}, }, matches= { {match='', output='ColdFusion Admin Console'} } }) table.insert(fingerprints, { category='management', probes={ {path='/common/help/en/go/login_ts.html', method='HEAD'}, {path='/system/login/', method='HEAD'}, {path='/system/login/reset?next=%2Fsystem%2Flogin&set-lang=en', method='HEAD'}, {path='/common/images/logos/img_logoMain.jpg', method='HEAD'}, }, matches= { {match='URL=http://www.macromedia.com/go/breeze_login_help_en', output='Adobe Acrobat Connect Pro'}, {match='<title>Connect Pro Central Login', output='Adobe Acrobat Connect Pro'}, {match='Forgot your password?', output='Adobe Acrobat Connect Pro'}, {match='Server: JRun Web Server', output='Adobe Acrobat Connect Pro'}, } }) table.insert(fingerprints, { category='management', probes={ {path='/Dashboard/Dashboard.html', method='GET'}, }, matches= { {match='Server: Kodak-RulesBasedAutomation', output='Prinergy Dashboard Client Login'}, {match='Dashboard', output='Prinergy Dashboard Client Login'} } }) ------------------------------------------------ ---- PRINTERS, WEBCAMS, PROJECTORS ---- ------------------------------------------------ table.insert(fingerprints, { category='printer', probes={ {path='/x_logo.gif', method='HEAD'} }, matches= { {match='', output='Xerox printer'} } }) table.insert(fingerprints, { category='printer', probes={ {path='/gif/hp.gif', method='HEAD'}, {path='/gif/hp_invent_logo.gif', method='HEAD'}, {path='/gif/printer.gif', method='HEAD'}, {path='/hp/device/this.LCDispatcher', method='HEAD'}, {path='/hp/device/webAccess/index.htm', method='HEAD'}, {path='/PageSelector.class', method='HEAD'} }, matches= { {match='', output='HP Printer'} } }) table.insert(fingerprints, { category='printer', probes={ {path='/images/lexbold.gif', method='HEAD'}, {path='/images/lexlogo.gif', method='HEAD'}, {path='/images/printer.gif', method='HEAD'}, {path='/printer/image', method='HEAD'} }, matches= { {match='', output='Lexmark Printer'} } }) table.insert(fingerprints, { category='printer', probes={ {path='/images/mute_alloff.gif', method='HEAD'}, {path='/images/pic_bri.gif', method='HEAD'}, }, matches= { {match='', output='NEC Projector'} } }) table.insert(fingerprints, { category='printer', probes={ {path='/scanweb/images/scanwebtm.gif', method='HEAD'}, }, matches= { {match='', output='SCAN Web (Webcam)'} } }) table.insert(fingerprints, { category='printer', probes={ {path='/view/index.shtml', method='HEAD'}, }, matches= { {match='', output='Axis 212 PTZ Network Camera'} } }) ------------------------------------------------ ---- DATABASES ---- ------------------------------------------------ table.insert(fingerprints, { category='database', probes={ {path='/phpmyadmin/', method='HEAD'}, {path='/phpMyAdmin/', method='HEAD'}, {path='/PHPMyAdmin/', method='HEAD'} }, matches={ {output='phpMyAdmin'} } }) table.insert(fingerprints, { category='database', probes={ {path='/footer1.gif', method='HEAD'}, }, matches= { {match='', output='(possible) Oracle Web server'} } }) table.insert(fingerprints, { category='database', probes={ {path='/homepage.nsf/homePage.gif?OpenImageResource', method='HEAD'}, {path='/icons/ecblank.gif', method='HEAD'}, }, matches= { {match='', output='Lotus Domino'} } }) table.insert(fingerprints, { category='database', probes={ {path='/homepage.nsf/homePage.gif?OpenImageResource', method='HEAD'}, {path='/icons/ecblank.gif', method='HEAD'}, {path='/852566C90012664F', method='HEAD'}, {path='/admin4.nsf', method='HEAD'}, {path='/admin5.nsf', method='HEAD'}, {path='/admin.nsf', method='HEAD'}, {path='/agentrunner.nsf', method='HEAD'}, {path='/alog.nsf', method='HEAD'}, {path='/a_domlog.nsf', method='HEAD'}, {path='/bookmark.nsf', method='HEAD'}, {path='/busytime.nsf', method='HEAD'}, {path='/catalog.nsf', method='HEAD'}, {path='/certa.nsf', method='HEAD'}, {path='/certlog.nsf', method='HEAD'}, {path='/certsrv.nsf', method='HEAD'}, {path='/chatlog.nsf', method='HEAD'}, {path='/clbusy.nsf', method='HEAD'}, {path='/cldbdir.nsf', method='HEAD'}, {path='/clusta4.nsf', method='HEAD'}, {path='/collect4.nsf', method='HEAD'}, {path='/da.nsf', method='HEAD'}, {path='/dba4.nsf', method='HEAD'}, {path='/dclf.nsf', method='HEAD'}, {path='/DEASAppDesign.nsf', method='HEAD'}, {path='/DEASLog01.nsf', method='HEAD'}, {path='/DEASLog02.nsf', method='HEAD'}, {path='/DEASLog03.nsf', method='HEAD'}, {path='/DEASLog04.nsf', method='HEAD'}, {path='/DEASLog05.nsf', method='HEAD'}, {path='/DEASLog.nsf', method='HEAD'}, {path='/decsadm.nsf', method='HEAD'}, {path='/decslog.nsf', method='HEAD'}, {path='/DEESAdmin.nsf', method='HEAD'}, {path='/dirassist.nsf', method='HEAD'}, {path='/doladmin.nsf', method='HEAD'}, {path='/domadmin.nsf', method='HEAD'}, {path='/domcfg.nsf', method='HEAD'}, {path='/domguide.nsf', method='HEAD'}, {path='/domlog.nsf', method='HEAD'}, {path='/dspug.nsf', method='HEAD'}, {path='/events4.nsf', method='HEAD'}, {path='/events5.nsf', method='HEAD'}, {path='/events.nsf', method='HEAD'}, {path='/event.nsf', method='HEAD'}, {path='/homepage.nsf', method='HEAD'}, {path='/iNotes/Forms5.nsf/$DefaultNav', method='HEAD'}, {path='/jotter.nsf', method='HEAD'}, {path='/leiadm.nsf', method='HEAD'}, {path='/leilog.nsf', method='HEAD'}, {path='/leivlt.nsf', method='HEAD'}, {path='/log4a.nsf', method='HEAD'}, {path='/log.nsf', method='HEAD'}, {path='/l_domlog.nsf', method='HEAD'}, {path='/mab.nsf', method='HEAD'}, {path='/mail10.box', method='HEAD'}, {path='/mail1.box', method='HEAD'}, {path='/mail2.box', method='HEAD'}, {path='/mail3.box', method='HEAD'}, {path='/mail4.box', method='HEAD'}, {path='/mail5.box', method='HEAD'}, {path='/mail6.box', method='HEAD'}, {path='/mail7.box', method='HEAD'}, {path='/mail8.box', method='HEAD'}, {path='/mail9.box', method='HEAD'}, {path='/mail.box', method='HEAD'}, {path='/msdwda.nsf', method='HEAD'}, {path='/mtatbls.nsf', method='HEAD'}, {path='/mtstore.nsf', method='HEAD'}, {path='/names.nsf', method='HEAD'}, {path='/nntppost.nsf', method='HEAD'}, {path='/nntp/nd000001.nsf', method='HEAD'}, {path='/nntp/nd000002.nsf', method='HEAD'}, {path='/nntp/nd000003.nsf', method='HEAD'}, {path='/ntsync45.nsf', method='HEAD'}, {path='/perweb.nsf', method='HEAD'}, {path='/qpadmin.nsf', method='HEAD'}, {path='/quickplace/quickplace/main.nsf', method='HEAD'}, {path='/reports.nsf', method='HEAD'}, {path='/sample/siregw46.nsf', method='HEAD'}, {path='/schema50.nsf', method='HEAD'}, {path='/setupweb.nsf', method='HEAD'}, {path='/setup.nsf', method='HEAD'}, {path='/smbcfg.nsf', method='HEAD'}, {path='/smconf.nsf', method='HEAD'}, {path='/smency.nsf', method='HEAD'}, {path='/smhelp.nsf', method='HEAD'}, {path='/smmsg.nsf', method='HEAD'}, {path='/smquar.nsf', method='HEAD'}, {path='/smsolar.nsf', method='HEAD'}, {path='/smtime.nsf', method='HEAD'}, {path='/smtpibwq.nsf', method='HEAD'}, {path='/smtpobwq.nsf', method='HEAD'}, {path='/smtp.box', method='HEAD'}, {path='/smtp.nsf', method='HEAD'}, {path='/smvlog.nsf', method='HEAD'}, {path='/srvnam.htm', method='HEAD'}, {path='/statmail.nsf', method='HEAD'}, {path='/statrep.nsf', method='HEAD'}, {path='/stauths.nsf', method='HEAD'}, {path='/stautht.nsf', method='HEAD'}, {path='/stconfig.nsf', method='HEAD'}, {path='/stconf.nsf', method='HEAD'}, {path='/stdnaset.nsf', method='HEAD'}, {path='/stdomino.nsf', method='HEAD'}, {path='/stlog.nsf', method='HEAD'}, {path='/streg.nsf', method='HEAD'}, {path='/stsrc.nsf', method='HEAD'}, {path='/userreg.nsf', method='HEAD'}, {path='/vpuserinfo.nsf', method='HEAD'}, {path='/webadmin.nsf', method='HEAD'}, {path='/web.nsf', method='HEAD'}, {path='/.nsf/../winnt/win.ini', method='HEAD'}, }, matches= { {match='', output='Lotus Domino'} } }) ------------------------------------------------ ---- MICROSOFT ---- ------------------------------------------------ table.insert(fingerprints, { category='microsoft', probes={ {path='/_layouts/images/helpicon.gif', method='HEAD'}, {path='/Pages/Default.aspx', method='HEAD'}, {path='/PublishingImages/NewsArticleImage.jpg', method='HEAD'}, {path='/_admin/operations.aspx', method='HEAD'}, {path='/_app_bin', method='HEAD'}, {path='/_controltemplates', method='HEAD'}, {path='/_layouts', method='HEAD'}, {path='/_layouts/viewlsts.aspx', method='HEAD'}, {path='/forms/allitems.aspx', method='HEAD'}, {path='/forms/webfldr.aspx', method='HEAD'}, {path='/forms/mod-view.aspx', method='HEAD'}, {path='/forms/my-sub.aspx', method='HEAD'}, {path='/pages/categoryresults.aspx', method='HEAD'}, {path='/categories/viewcategory.aspx', method='HEAD'}, {path='/sitedirectory', method='HEAD'}, {path='/editdocs.aspx', method='HEAD'}, {path='/workflowtasks/allitems.aspx', method='HEAD'}, {path='/lists/tasks/', method='HEAD'}, {path='/categories/allcategories.aspx', method='HEAD'}, {path='/categories/SOMEOTHERDIR/allcategories.aspx', method='HEAD'}, {path='/mycategories.aspx', method='HEAD'}, {path='/lists/', method='HEAD'}, {path='/lists/allitems.aspx', method='HEAD'}, {path='/lists/default.aspx', method='HEAD'}, {path='/lists/allposts.aspx', method='HEAD'}, {path='/lists/archive.aspx', method='HEAD'}, {path='/lists/byauthor.aspx', method='HEAD'}, {path='/lists/calendar.aspx', method='HEAD'}, {path='/lists/mod-view.aspx', method='HEAD'}, {path='/lists/myposts.aspx', method='HEAD'}, {path='/lists/my-sub.aspx', method='HEAD'}, {path='/lists/allcomments.aspx', method='HEAD'}, {path='/lists/mycomments.aspx', method='HEAD'}, {path='/_layouts/userdisp.aspx', method='HEAD'}, {path='/_layouts/help.aspx', method='HEAD'}, }, matches= { {match='', output='MS Sharepoint'} } }) table.insert(fingerprints, { category='microsoft', probes={ {path='/projectserver/Home/HomePage.asp', method='HEAD'}, {path='/projectserver/images/branding.gif', method='HEAD'}, {path='/projectserver/images/pgHome.gif', method='HEAD'}, {path='/projectserver/images/pgTask.gif', method='HEAD'}, {path='/projectserver/Tasks/Taskspage.asp', method='HEAD'}, }, matches= { {match='', output='MS Project Server'} } }) table.insert(fingerprints, { category='microsoft', probes={ {path='/exchweb/bin/auth/owalogon.asp', method='HEAD'}, {path='/images/outlook.jpg', method='HEAD'}, {path='/owa/8.1.375.2/themes/base/lgntopl.gif', method='HEAD'}, {path='/owa/', method='HEAD'}, }, matches= { {match='', output='Outlook Web Access'} } }) ------------------------------------------------ ---- NETWORK EQUIPMENT ---- ------------------------------------------------ -- Routers, switches, etc table.insert(fingerprints, { category='network', probes={ {path='/', method='GET'}, }, matches= { {match='realm="WRT54G"', output='Linksys WRT54g Wireless Router'} } }) ------------------------------------------------ ---- ATTACKS ---- ------------------------------------------------ -- These will search for and possibly exploit vulnerabilities. table.insert(fingerprints, { category='attacks', probes={ {path='/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml', method='GET'}, {path='/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml', method='GET'} }, matches={ {match='', output='Path traversal in VMWare (CVE-2009-3733)'}, {match='', output='Possible path traversal in VMWare (CVE-2009-3733)'} } }) table.insert(fingerprints, { category='attacks', probes={ {path='/../../../../../../../../../../etc/passwd', method='GET'}, {path='/../../../../../../../../../../boot.ini', method='GET'} }, matches={ {match='root:', output='Simple path traversal in URI (Linux)'}, {match='boot loader', output='Simple path traversal in URI (Windows)'}, {match='', output='Possible path traversal in URI'} } }) table.insert(fingerprints, { category='attacks', probes={ {path='/.htaccess', method='GET'}, {path='/.htpasswd', method='GET'} }, matches={ -- We look for a '200 OK' message on this one, because most Apache servers return an access denied {match='200 OK', output='Incorrect permissions on .htaccess or .htpasswd files'} } }) table.insert(fingerprints, { category='attacks', probes={ {path='/_vti_bin/', method='GET'}, {path='/_vti_cnf/', method='GET'}, {path='/_vti_log/', method='GET'}, {path='/_vti_pvt/', method='GET'}, {path='/_vti_txt/', method='GET'}, {path='/_vti_bin/_vti_aut/dvwssr.dll'}, {path='/_vti_bin/fpcount.exe?Page=default.asp|Image=3'}, {path='/_vti_bin/shtml.dll'}, {path='/_vti_pvt/administrator.pwd'}, {path='/_vti_pvt/administrators.pwd'}, {path='/_vti_pvt/authors.pwd'}, {path='/_vti_pvt/service.pwd'}, {path='/_vti_pvt/shtml.exe'}, {path='/_vti_pvt/users.pwd'}, }, matches= { {match='200', output='Frontpage folder'} } }) table.insert(fingerprints, { category='attacks', probes={ {path='/.svn/', method='GET'}, {path='/.svn/text-base/.htaccess.svn-base', method='GET'}, {path='/.svn/text-base/.htpasswd.svn-base', method='GET'}, {path='/.svn/text-base/Web.config.svn-base', method='GET'} }, matches= { {match='200', output='Subversion folder'} } }) ------------------------------------------------ ---- Open Source CMS checks ---- ------------------------------------------------ -- Broad wordpress version identification table.insert(fingerprints, { category='cms', probes={ {path='/wp-login.php'}, {path='/wordpress/wp-login.php'}, {path='/blog/wp-login.php'}, {path='/weblog/wp-login.php'} }, matches={ {match='ver=20080708', output='WordPress 2.6.x found'}, {match='ver=20081210', output='WordPress 2.7.x found'}, {match='ver=20090514', output='WordPress 2.8.x found'}, {match='ver=20091217', output='WordPress 2.9.x found'}, {match='ver=20100601', output='WordPress 3.0.x found'}, {output='Wordpress login page.'} } }) -- ZenCart version detection table.insert(fingerprints, { category='cms', probes={ {path='/docs/'}, {path='/store/docs/'}, {path='/zencart/docs/'}, {path='/cart/docs/'} }, matches={ {match='.*">Changelog for v(%d-%..-) %(changed files%)', output='ZenCart, version \\1'} } }) -- Broad phpBB versions table.insert(fingerprints, { category='cms', probes={ {path='/docs/CHANGELOG.html'}, {path='/forum/docs/CHANGELOG.html'}, {path='/forums/docs/CHANGELOG.html'}, {path='/board/docs/CHANGELOG.html'}, {path='/boards/docs/CHANGELOG.html'} }, matches={ {match='Changes since (%d-%..-)', output='phpBB version slightly newer than \\1'}, {match='