Skip to content

Commit f98b51e

Browse files
hollowpointerhollowpointer
committed
added more services to fingerprint
1 parent a6c5555 commit f98b51e

10 files changed

Lines changed: 126 additions & 0 deletions

File tree

‎assets/fingerprinting/dns.toml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[service]
2+
name = "dns"
3+
default_ports = [53]
4+
description = "Domain Name System"
5+
6+
# For TCP DNS, we can send a simple query or just check for the port.
7+
# DNS over TCP is often used for large responses.
8+
[[match]]
9+
name = "dns_tcp_match"
10+
pattern = "^[\\x00-\\xff][\\x00-\\xff][\\x01\\x00]" # Basic DNS header response part
11+
product = "dns"

‎assets/fingerprinting/ftp.toml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[service]
2+
name = "ftp"
3+
default_ports = [21]
4+
description = "File Transfer Protocol"
5+
6+
[[match]]
7+
name = "ftp_banner"
8+
pattern = "(?i)^220[\\s-]([\\w\\d\\s.-]+)"
9+
version_group = 1
10+
product = "ftp"

‎assets/fingerprinting/mongodb.toml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[service]
2+
name = "mongodb"
3+
default_ports = [27017]
4+
description = "MongoDB Database"
5+
6+
# MongoDB often sends something if we send a malformed/legacy request.
7+
[[match]]
8+
name = "mongodb_prequel"
9+
pattern = "MongoDB"
10+
product = "mongodb"

‎assets/fingerprinting/mysql.toml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[service]
2+
name = "mysql"
3+
default_ports = [3306]
4+
description = "MySQL Database"
5+
6+
# MySQL sends a handshake on connect.
7+
[[match]]
8+
name = "mysql_handshake"
9+
pattern = "^.[\\x00\\x00\\x00]([\\d.]+)"
10+
version_group = 1
11+
product = "mysql"

‎assets/fingerprinting/postgresql.toml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[service]
2+
name = "postgresql"
3+
default_ports = [5432]
4+
description = "PostgreSQL Database"
5+
6+
# Postgres needs a StartupMessage but often rejects with an error containing its ID.
7+
[[probe]]
8+
name = "postgres_startup"
9+
payload = "\x00\x00\x00\x08\x04\xd2\x16\x2f"
10+
protocol = "tcp"
11+
12+
[[match]]
13+
name = "postgres_error"
14+
pattern = "^E\\s*C"
15+
product = "postgresql"

‎assets/fingerprinting/rdp.toml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[service]
2+
name = "rdp"
3+
default_ports = [3389]
4+
description = "Remote Desktop Protocol"
5+
6+
# RDP waits for a connection request.
7+
[[probe]]
8+
name = "rdp_connect"
9+
payload = "\x03\x00\x00\x13\x0e\xe0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x03\x00\x00\x00"
10+
protocol = "tcp"
11+
12+
[[match]]
13+
name = "rdp_negotiate_resp"
14+
pattern = "^\\x03\\x00\\x00\\x0b\\x06\\xd0"
15+
product = "rdp"

‎assets/fingerprinting/redis.toml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[service]
2+
name = "redis"
3+
default_ports = [6379]
4+
description = "Redis Key-Value Store"
5+
6+
[[probe]]
7+
name = "redis_ping"
8+
payload = "PING\r\n"
9+
protocol = "tcp"
10+
11+
[[match]]
12+
name = "redis_pong"
13+
pattern = "^\\+PONG"
14+
product = "redis"

‎assets/fingerprinting/rpcbind.toml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[service]
2+
name = "rpcbind"
3+
default_ports = [111]
4+
description = "SUN Remote Procedure Call (Portmapper)"
5+
6+
# Rpcbind usually needs a specific RPC call to get a response.
7+
# For now, we'll rely on the default port lookup unless we add complex RPC parsing.
8+
[[match]]
9+
name = "rpc_tcp_fragment"
10+
pattern = "^[\\x80-\\xff][\\x00-\\xff]{3}"
11+
product = "rpcbind"

‎assets/fingerprinting/smb.toml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[service]
2+
name = "smb"
3+
default_ports = [445]
4+
description = "Microsoft-DS / SMB"
5+
6+
# SMB usually needs a hand-shake, but many servers send nothing until spoken to.
7+
[[probe]]
8+
name = "smb_negotiate"
9+
payload = "\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x50\x43\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31\x2e\x30\x00"
10+
protocol = "tcp"
11+
12+
[[match]]
13+
name = "smb_header_match"
14+
pattern = "^\xffSMB"
15+
product = "smb"

‎assets/fingerprinting/telnet.toml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[service]
2+
name = "telnet"
3+
default_ports = [23]
4+
description = "Telnet Protocol"
5+
6+
[[match]]
7+
name = "telnet_iac"
8+
pattern = "^[\\xff][\\xfb\\xfc\\xfd\\xfe]"
9+
product = "telnet"
10+
11+
[[match]]
12+
name = "telnet_login"
13+
pattern = "(?i)login:\\s*$"
14+
product = "telnet"

0 commit comments

Comments
 (0)