splunk-security_content/lookups/scripting_tools_user_agents.csv

1	tool	tool_user_agent
2	Python Script	*python*
3	Ruby Script	*ruby*
4	Perl Script	*perl*
5	Perl Script	*lwp::*
6	PHP Script	*php*
7	PHP Script	*guzzle*
8	PHP Script	*zend*
9	Java	*java*
10	Go Script	*golang*
11	Go Script	*go-http-*
12	NodeJS Script	*node*
13	PowerShell	*powershell*
14	Curl	*curl*
15	Curl	*libcurl*
16	Wget	*wget*
17	HTTPie	*httpie*
18	Nikto_Scanner	*mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/74.0.3729.169 safari/537.36*
19	Nmap Scanner	*nmap*
20	DirBuster	*dirbuster*
21	DirBuster	*dirb/*
22	GoBuster	*gobuster*
23	WFuzz	*wfuzz*
24	Hydra	*hydra*
25	Httrack	*httrack*
26	Medusa	*mozilla/1.22 (compatible; msie 10.0; windows 3.1)*
27	Scrapy	*scrapy*
28	Headless Browser	*headless*
29	Generic Bot	*bot*
30	Generic Bot	*crawler*
31	Generic Bot	*spider*
32	Generic Bot	*scraper*
33	Generic Scanner	*scanner*
34	Generic Scanner	*scan/*
35	Test or POC	*test*
36	Test or POC	*debug*
37	Test or POC	*poc*
38	Test or POC	*demo*
39	Test or POC	*hack*
40	Test or POC	*exploit*
41	Test or POC	*injection*
42	Empty User Agent	-
43	Arachni Scanner	* arachni/*
44	Backup File Artifacts Checker	* bfac *
45	Brutus	* brutus *
46	Cgi Scanner 3	* cgichk *
47	DataCha0s Scanner	*datacha0s*
48	DominoHunter	*domino hunter*
49	DotDotPwn Fuzzer	*dotdotpwn*
50	Gootkit Scanner	*gootkit auto-rooter scanner*
51	Grendel-Scan	*grendel-scan*
52	ZmEu	* zmeu *
53	Masscan	*masscan*
54	Morfeus	*morfeus fucking scanner*
55	N-Stalker Web Application Security Scanner	*n-stealth*
56	Nsauditor	*nsauditor*
57	Springenwerk Security Scanner	*springenwerk*
58	Vega Vulnerability Scanner	* vega/*
59	Webshag	*webshag*
60	webvulnscan	*webvulnscan*
61	Havij SQL Injection	* Havij*
62	Absinthe	*absinthe*
63	Bsqlbf-v2	*bsqlbf*
64	MySqloit	*mysqloit*
65	Pangolin SQL Injection	*pangolin*
66	SQL Power Injector	*sql power injector*
67	Sqlninja	*sqlninja*
68	SQLi Dumper	mozilla/5.0 (windows; u; windows nt 5.1; pt-pt; rv:1.9.1.2) gecko/20090729 firefox/3.5.2 (.net clr 3.5.30729)
69	Argus	*argus*
70	FeroxBuster	*feroxbuster*
71	FFUF	*fuzz faster u fool*
72	l9explore	*l9explore*
73	lkxscan	*lkxscan/*
74	Netsparker	*netsparker*
75	OpenVAS	*openvas*
76	OWASP Amass	*owasp amass*
77	Paros	*paros*
78	ShadowSpray	*shadowspray*
79	sqlmap	*sqlmap*