Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add fast reverse proxy (frp) fingerprints #573

Merged
merged 1 commit into from
May 10, 2023

Conversation

mkienow-r7
Copy link
Contributor

@mkienow-r7 mkienow-r7 commented May 2, 2023

Description

Adds 3 fast reverse proxy (frp) fingerprints.

Notes

Fingerprinted frp version 0.48.0.

  • favicon.ico
$ file favicon.ico
favicon.ico: MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
$ md5 favicon.ico
MD5 (favicon.ico) = 57801ef5135f6a6e8ea69baef85f8607

Motivation and Context

Improved coverage

How Has This Been Tested?

  • bundle exec ./bin/recog_verify xml/favicons.xml xml/html_title.xml
  • rake tests

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist:

  • I have updated the documentation accordingly (or changes are not required).
  • I have added tests to cover my changes (or new tests are not required).
  • All new and existing tests passed.

@@ -4939,6 +4939,14 @@
<param pos="0" name="hw.vendor" value="Server Technology"/>
</fingerprint>

<fingerprint pattern="^frp/(\d+(?:\.\d+)*)$">
<description>frp - fast reverse proxy, not found response</description>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's interesting that the server header is only present on a 404 page 👀

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That was interesting (see pkg/util/vhost/resource.go#L72)

<description>frp - fast reverse proxy</description>
<!-- favicon.ico from frp version 0.48.0 -->

<example>57801ef5135f6a6e8ea69baef85f8607</example>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me; I double checked historical assets too, but it looks like it's been this md5sum for ~5 years

@mkienow-r7 mkienow-r7 merged commit e52e9f0 into rapid7:main May 10, 2023
@mkienow-r7 mkienow-r7 deleted the feature/frp branch May 10, 2023 21:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants