Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a WebSocket++ fingerprint #414

Merged
merged 2 commits into from
Feb 12, 2022
Merged

Conversation

dabdine
Copy link
Contributor

@dabdine dabdine commented Feb 9, 2022

Description

Adds a fingerprint for WebSocket++. There are over 72K of these on the internet, according to Censys.

The server git repository is on GH:
https://github.com/zaphoyd/websocketpp

Motivation and Context

Adds a fingerprint

How Has This Been Tested?

bundle exec rake tests

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist:

  • I have updated the documentation accordingly (or changes are not required).
  • I have added tests to cover my changes (or new tests are not required).
  • All new and existing tests passed.

@dabdine
Copy link
Contributor Author

dabdine commented Feb 9, 2022

Output from recog_match (with a little transform to make it easier to read):

echo -n "WebSocket++/0.8.1" | bin/recog_match xml/http_servers.xml | cut -c 8- | sed 's/=>/:/g' | jq .
{
  "matched": "WebSocket++ web server - https://github.com/zaphoyd/websocketpp",
  "service.vendor": "Zaphoyd Studios",
  "service.product": "WebSocket++",
  "service.family": "WebSocket++",
  "service.version": "0.8.1",
  "service.cpe23": "cpe:/a:zaphoyd:websocketpp:0.8.1",
  "service.protocol": "http",
  "fingerprint_db": "http_header.server",
  "data": "WebSocket++/0.8.1"
}

xml/http_servers.xml Outdated Show resolved Hide resolved
@mkienow-r7
Copy link
Contributor

mkienow-r7 commented Feb 10, 2022

Would you please rebase with master to resolve the merge conflict? I can take care of that if you don't want to deal with it.

Copy link
Contributor

@mkienow-r7 mkienow-r7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I overlooked that the service.vendor and service.product values do not map back to the CPE values. When we run update_cpes.py it will end up removing the service.cpe23 param. I will merge this as-is and open a small PR to change those values.

Thank you for the contribution @dabdine!

@mkienow-r7 mkienow-r7 merged commit dfc7220 into rapid7:master Feb 12, 2022
@dabdine
Copy link
Contributor Author

dabdine commented Feb 12, 2022

@mkienow-r7 thanks for the reviews and shepherding the merge!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants