mirror of
https://github.com/urbanadventurer/WhatWeb
synced 2026-06-21 14:12:19 +00:00
Andrew Horton
57 lines
1.8 KiB
Ruby
57 lines
1.8 KiB
Ruby
##
|
|
# This file is part of WhatWeb and may be subject to
|
|
# redistribution and commercial restrictions. Please see the WhatWeb
|
|
# web site for more information on licensing and terms of use.
|
|
# https://morningstarsecurity.com/research/whatweb
|
|
##
|
|
Plugin.define do
|
|
name "Splunk"
|
|
authors [
|
|
"Brendan Coles <bcoles@gmail.com>", # 2012-04-17
|
|
]
|
|
version "0.1"
|
|
description "Splunk indexes and makes searchable data from any app, server or network device in real time including logs, config files, messages, alerts, scripts and metrics."
|
|
website "http://www.splunk.com"
|
|
|
|
# ShodanHQ results as at 2011-04-17 #
|
|
# 18 for session_id_8000
|
|
|
|
# Google results as at 2012-04-17 #
|
|
# 29 for intitle:"Login - Splunk" "If you've forgotten your username or password, please contact your Splunk"
|
|
|
|
# Dorks #
|
|
dorks [
|
|
'intitle:"Login - Splunk" "If you\'ve forgotten your username or password, please contact your Splunk"'
|
|
]
|
|
|
|
|
|
|
|
# Matches #
|
|
matches [
|
|
|
|
# Footer # Version Detection
|
|
{ :version=>/<p class="footer">© 2005-20[\d]{2} Splunk Inc\. Splunk ([^<]+)\.<\/p>/ },
|
|
|
|
# Forgot your password text
|
|
{ :text=>"<p><span>First time logging in?</span> Splunk's default credentials are </p><p>username: <span>admin</span><br />password: <span>changeme</span></p><p>If you've forgotten your username or password, please contact your Splunk administrator.</p>" },
|
|
|
|
# session_id_8000 Cookie
|
|
{ :search=>"headers[set-cookie]", :regexp=>/session_id_8000=[a-f\d]{32};/ },
|
|
|
|
# Meta Author
|
|
{ :certainty=>75, :text=>'<meta name="author" content="Splunk Inc." />' },
|
|
|
|
# /en-US/favicon.ico
|
|
{ :url=>"/en-US/favicon.ico", :md5=>"f7728520c81b7a303d8e54d282e13a16" },
|
|
|
|
# JavaScript # Install Type
|
|
{ :string=>/var CONFIG = \{"licenseType": "[^\"]+", "os_name": "[^"]+", "locale":[^\}]+"installType": "([^"]+)"/ },
|
|
|
|
# JavaScript # OS Detection
|
|
{ :os=>/var CONFIG = \{"licenseType": "[^\"]+", "os_name": "([^"]+)", "locale":/ },
|
|
|
|
]
|
|
|
|
end
|
|
|