[update] 整理部分指纹

chaitin · Jul 5, 2024 · 4ca4d59 · 4ca4d59
1 parent 1dc2a9d
commit 4ca4d59
Show file tree

Hide file tree

Showing 4 changed files with 48 additions and 26 deletions.
diff --git a/finger/ehole/DzzOffice.yml b/finger/ehole/DzzOffice.yml
diff --git a/finger/manual/web/DzzOffice.yml b/finger/manual/web/DzzOffice.yml
@@ -0,0 +1,37 @@
+name: fingerprint-yaml-DzzOffice
+manual: false
+detail:
+    fingerprint:
+        name: DzzOffice
+    fofa: product="DzzOffice-产品"
+    cpe: dzzoffice:dzzoffice
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.raw_header.bcontains(bytes("DzzOffice"))
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("DzzOffice")
+    r2:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("/static/dzzicon/icon.css")
+    favicon_hash:
+        request:
+            method: GET
+            path: /
+            follow_redirects: false
+        expression: faviconHash(response.getIconContent()) == -1961736892
+expression: r0() || r1() || r2() || favicon_hash()
diff --git a/finger/ehole/Leadsec-Firewall.yml → finger/manual/web/Leadsec-Firewall.yml b/finger/ehole/Leadsec-Firewall.yml → finger/manual/web/Leadsec-Firewall.yml
@@ -4,6 +4,7 @@ detail:
     fingerprint:
         name: Leadsec-Firewall
     fofa: title="网御 防火墙"
+    cpe: leadsec:firewall
 transport: http
 rules:
     r0:
@@ -13,4 +14,4 @@ rules:
             path: /
             follow_redirects: true
         expression: response.title_string.contains("网御 防火墙")
-expression: r0()
+expression: r0()
diff --git a/finger/ehole/Mattermost.yml → finger/manual/web/Mattermost.yml b/finger/ehole/Mattermost.yml → finger/manual/web/Mattermost.yml
@@ -3,7 +3,8 @@ manual: false
 detail:
     fingerprint:
         name: Mattermost
-    fofa: header="Mattermost" || title="Mattermost"
+    fofa: product="Mattermost"
+    cpe: mattermost:mattermost
 transport: http
 rules:
     r0:
@@ -20,4 +21,10 @@ rules:
             path: /
             follow_redirects: true
         expression: response.title_string.contains("Mattermost")
-expression: r0() || r1()
+    favicon_hash:
+        request:
+            method: GET
+            path: /
+            follow_redirects: false
+        expression: faviconHash(response.getIconContent()) in [2091779061,-77128220,-940958811,1875634354,1158942057,180508508,-405956582]
+expression: r0() || r1() || favicon_hash()