Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add phpMyAdmin fingerprints #409

Merged
merged 2 commits into from
Feb 16, 2022

Conversation

mkienow-r7
Copy link
Contributor

@mkienow-r7 mkienow-r7 commented Feb 7, 2022

Description

Adds 3 phpMyAdmin fingerprints.

Motivation and Context

Fingerprint more services.

How Has This Been Tested?

  • rake tests

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist:

  • I have updated the documentation accordingly (or changes are not required).
  • I have added tests to cover my changes (or new tests are not required).
  • All new and existing tests passed.

<example>phpMyAdmin</example>
<example service.version="2.10.0.2">phpMyAdmin 2.10.0.2</example>
<example service.version="5.0.0-rc1">phpMyAdmin 5.0.0-rc1</example>
<example service.version="5.0.4">10.10.10.10:8080 / db.foo.bar | phpMyAdmin 5.0.4</example>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we extract 10.10.10.10 into a host.ip field like we do elsewhere? Same thing can be said for the host name below, though that's arguably less useful since it can be localhost or something internal (and it would also likely require splitting the regex which i'm not a fan of).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I was thinking about doing that. The regex might be a little tricky in that it needs to capture both IPv4, IPv6 and hostnames dropping the :port portion.
The title is loaded with information '@HTTP_HOST@ / @VSERVER@ | @PHPMYADMIN@' and also contains the MySQL server name.

From What format strings can I use?

@HTTP_HOST@
HTTP host that runs phpMyAdmin

@VSERVER@
Verbose MySQL server name if set, otherwise normal

@mkienow-r7 mkienow-r7 force-pushed the feature/phpmyadmin-fingerprints branch 6 times, most recently from affad5b to 2afea1a Compare February 12, 2022 04:26
xml/favicons.xml Outdated
<fingerprint pattern="^531b63a51234bb06c9d77f219eb25553$">
<description>phpMyAdmin web interface for MySQL and MariaDB</description>
<example>531b63a51234bb06c9d77f219eb25553</example>
<param pos="0" name="service.vendor" value="phpmyadmin"/>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here and elsewhere for .vendor and .product: This should be phpMyAdmin

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch!

@mkienow-r7 mkienow-r7 force-pushed the feature/phpmyadmin-fingerprints branch from 2afea1a to b4e455c Compare February 15, 2022 20:47
@mkienow-r7 mkienow-r7 merged commit cca1210 into rapid7:master Feb 16, 2022
@mkienow-r7 mkienow-r7 deleted the feature/phpmyadmin-fingerprints branch February 16, 2022 05:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants