Skip to content

Commit 408c8c2

Browse files
ChrisTruncerChrisTruncer
authored
Merge pull request #591 from Relkci/categoryupdates11042022
Category additions + array index fixes in categories and signatures
2 parents 4574110 + cf5b0d5 commit 408c8c2

File tree

3 files changed

+129
-15
lines changed

3 files changed

+129
-15
lines changed

‎Python/categories.txt

Lines changed: 111 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ Cisco Systems, Inc. IP Phone CP-7960G;<title>Cisco Systems, Inc.</title>;<img a=
9595
<strong>Cisco IP Conference Station CP-7937G</strong>;<img border="0" align="bottom" hspace="0" alt="Cisco Systems, Inc." src="/Logo" />;<a href="localmenus.cgi?func=604">|voip
9696
<p align="center"><b><font color="#FFFFFF" size="4">Cisco Unified IP Phone CP-7962G;<a href="/CGI/Java/Serviceability?|voip
9797
<p align="center"><b><font size="4" color="#FFFFFF">Cisco Unified IP Phone CP-7975G;/CGI/Java/Serviceability?adapter|voip
98-
<div id="product"><span>Xirrus XN8 WiFi Array;<div onclick="window.open('http://www.xirrus.com/feedback')";if ( key_code &lt; 0x20 | key_code &gt|highval
98+
<div id="product"><span>Xirrus XN8 WiFi Array;<div onclick="window.open('http://www.xirrus.com/feedback')";if ( key_code &lt; 0x20; key_code &gt|highval
9999
<p>If you've forgotten your username or password, please contact your Splunk administrator.<br /><br />username <span>admin</span><br />password <span>changeme</span></p><p></p>;MRSPARKLE;<meta content="Splunk Inc." name="author" />|highval
100100
dummyActiveXObject = new ActiveXObject('Msxml2.XMLHTTP');<td class="mastheadTitle">HP Designjet T1200</td>|printer
101101
<strong class="product">HP LaserJet 600 M602</strong>;<link href="/hp/device/theme/onevoice/;action="/hp/device/DeviceStatus/Save">|printer
@@ -135,7 +135,7 @@ div.hpGasGaugeBlock;div.hpPageText;HP LaserJet;MFP Series</title>|printer
135135
Polycom '+GetCurrentPageName ()+'</title>');document.title = sysName+' - Polycom '+model|voip
136136
<a href="http://solutions.brother.com/cgi-bin/solutions.cgi?;alt="Brother"|printer
137137
<img src="iis-85.png";go.microsoft.com/fwlink;IIS Windows|crap
138-
jenkins;yuiResizeMonitor;projectstatus|highval
138+
jenkins;yuiResizeMonitor;projectstatus|devops
139139
<frame src="/index_top.htm" name="Banner" leftmargin="5" noresize="";<frame src="/index_top_2.htm" name="Tabs" leftmargin="25" noresize="";<frame src="/index_down.htm" name="Main";|printer
140140
Apache2 Ubuntu Default Page;This is the default welcome page|crap
141141
Dell;status/status.htm;frametop.htm|printer
@@ -250,7 +250,7 @@ a class="login-page-logo" title="Go to;CA Performance Center;form id="frmSignIn"
250250
<title>AppInternals Xpert;Transaction Trace Warehouse;<div id="login-nav-menu"><div><div class="productSuiteName">APM Xpert|infrastructure
251251
<title>Avocent DSView 4</title>;Avocent DSView 4 Software End User License Agreement;Point and Click Access and Control|infrastructure
252252
<title>Axeda Policy Server</title>;Please log in.</td>;EMC Corporation|infrastructure
253-
<title>Cisco Secure ACS Login</title>;function checkBroserCompatability();Cisco Secure ACS||netdev
253+
<title>Cisco Secure ACS Login</title>;function checkBroserCompatability();Cisco Secure ACS|netdev
254254
<title>Cisco Systems Login</title>;<input type="button" onclick="loginAction()" name="bSubmit " value="Login" style="cursor:pointer;<meta name="GENERATOR" content=|netdev
255255
<title>Dell OpenManage </title>;<frame src="/servlet/Login?omacmd=getlogin&amp;page=Login"|highval
256256
EMC SourceOne Search Logon;<div class="aspNetHidden">;function __doPostBack(eventTarget, eventArgument)|infrastructure
@@ -324,7 +324,7 @@ Management Studio - Redirection;Refresh;ManagementStudio|redirector
324324
<title>Log In</title>;title="Go to CA Network Flow Analysis" class="login-page-logo";Network Flow Analysis</span>|infrastructure
325325
<p id="powered">Powered by <a href="http://www.ruckuswireless.com">Ruckus Wireless</a></p>;<tr><th>Admin Name</th><td><input class="login_input";<tr><th>Password</th><td><input class="login_input";<title>Log In</title>|infrastructure
326326
<link rel="stylesheet" href="resources/webLogin-all.css">;<title>Polycom Login</title>;<meta http-equiv="X-UA-Compatible" content="IE=edge">;Password:</label></div></div></div>;type="text" role="textbox" size="1" name="userName" class="x-form-field x-form-text|infrastructure
327-
<title>WebTools | Home</title>;<td align="left" valign="middle" class="name">XeroxC70;set_status_refresh_interval|printer
327+
<title>WebTools;Home</title>;<td align="left" valign="middle" class="name">XeroxC70;set_status_refresh_interval|printer
328328
<title>S2 Netbox Login</title>;<!--License IFRAME HERE GOES HERE-->;div id="headerframe"|infrastructure
329329
<title>Remote Support Portal;Powered by BOMGAR</title>;exitSurveyBox;Show Representatives Help Window;/content/access_key_input.js|infrastructure
330330
<title>Pritunl</title>;<link rel="icon" type="image/x-icon" href;onSubmit();login-form;var duoUserInput = document.getElementById('duo-username')|infrastructure
@@ -431,7 +431,7 @@ Internet Services;window.document.body.scrollTop;href="JavaScript:parent.fflip;p
431431
<title>Altova LicenseServer</title>;<span>Please wait...</span>;<div id="statusErrorMessage";<p class="legalese">|infrastructure
432432
Nimble Storage;/assets/vendor;/oem/settings.js;<!-- Username field -->;data-ember-modal-dialog-overlay|netdev
433433
<title>Welcome to JBoss™</title>;JBoss Online Resources;<h3>JBoss Management</h3>;href="/status">Tomcat status</a>|highval
434-
<title>APC | Log On</title>;function isValidBrowser();class="applyCancel"|infrastructure
434+
<title>APC;Log On</title>;function isValidBrowser();class="applyCancel"|infrastructure
435435
<head><title>U</title></head>;client-side JavaScript client sniff;client-side JavaScript client sniff|voip
436436
<title>Liebert IntelliSlot Web Card</title>;var appObj = new Object();document.appObj= appObj|infrastructure
437437
<title>Lexmark CS725</title>;<img src="/images/printer_logo.png";role="heading">Embedded Web Server</div>|printer
@@ -452,7 +452,7 @@ var jumpProt = jumpURL.substr(0,6).toLowerCase();var argc = setCookie.arguments.
452452
<title>Netman 204 login</title>;<form id="login" action="cgi-bin/login.cgi";onsubmit="this.submit.disabled='disabled';action="cgi-bin/view.cgi"|infrastructure
453453
<title>DS-510</title>;<frameset rows="90,*" frameborder="0" framespacing="0" border="0">;<frameset rows="90,*" frameborder="0" framespacing="0" border="0">;<frame src="/en/top.htm" name="top" noresize="" scrolling="no">|printer
454454
<title>AlienVault OSSIM;<title>AlienVault OSSIM;form name="f_login" id="f_login" method="POST"|infrastructure
455-
<base href="/sysmgr/">;nwf-loading-indicator class="nwf-loading";upport-href="{{ 'supportHref' | Vendorizer }}|infrastructure
455+
<base href="/sysmgr/">;nwf-loading-indicator class="nwf-loading";upport-href="{{ 'supportHref'|infrastructure
456456
<h1>Welcome to nginx!</h1>;<title>Welcome to nginx!</title>;<p>For online documentation and support please refer|crap
457457
<title>IBM TS7700</title>;<div class="deviceImage"></div>;"productnameLabelSpan">Storage Management|nas
458458
<title>Login</title>;function initDHTMLAPI() {;var cacUserName = "";hideElement("trInitName", "trInitPwd");name="login_saml" id="login_saml_form"|netdev
@@ -528,4 +528,108 @@ g_strLanguage;g_bHasNote;g_strFirmware;<title>Yealink;loginbox|voip
528528
IBM FlashSystem 5200;lib-prod/assets/css/Aspen;FlashCopyMappingsSnapshot|nas
529529
<title>Welcome to Service Assistant</title>;svg focusable;mg alt="Java"|nas
530530
<title>Top Page - MX-M453N</title>;function loginSubmit(mode);class="invisible"|printer
531-
<title>KONICA MINOLTA PageScope Web Connection</title>;popupCopyright;index.cgi|printer
531+
<title>KONICA MINOLTA PageScope Web Connection</title>;popupCopyright;index.cgi|printer
532+
<title>Kibana</title>|secops
533+
<title>Log in - Bitbucket</title>|devops
534+
<title>Home - Grafana</title>|devops
535+
<title>JBoss Management</title>|devops
536+
<title>JFrog</title>|devops
537+
<title>Log in to Fisheye |devops
538+
<title>Chef Infra Server API</title>|devops
539+
<title>Login&nbsp;- BigFix Web Reports</title>|secops
540+
<title> BigFix </title>|secops
541+
<title>Nessus Professional / Login</title>|secops
542+
<title>Nessus Scanner (SC) / Login</title>|secops
543+
<title>Nessus</title>|secops
544+
<title>Oracle HTTP Server|appops
545+
<title>Outlook;owa|comms
546+
<title>Query Monitor Welcome;ibm|appops
547+
<title>RMF Data Portal;ibm|appops
548+
<title>RabbitMQ Management|devops
549+
<title>Red Hat Satellite - Login</title>|secops
550+
<title>Remote Support Portal;Powered by BOMGAR</title>|secops
551+
<title>Rubrik</title>;appliance|secops
552+
<title>Sign in - Matomo</title>|devops
553+
<title>Sign in;GitLab</title>|devops
554+
<title>Spring Boot Admin</title>;apache|appops
555+
<title>VMware vRealize Automation Appliance|virtualization
556+
<title>VMware vRealize Orchestrator</title>|virtualization
557+
<title>vRealize Log Insight - Login</title>|virtualization
558+
<title>vRealize Operations Manager</title>|virtualization
559+
<title>WebSphere Liberty;ibm|appops
560+
<title>Welcome to WildFly</title>|appops
561+
Vormetric Data Security Management Console</title>|secops
562+
<pre>Jenkins-Agent-Protocols:|devops
563+
<title>Dashboard [Jenkins]</title>|devops
564+
<title>CA Privileged Access Manager</title>;CA Technologies|secops
565+
<title>BigFix Inventory: Login</title>|secops
566+
<title>BMC ProactiveNet|secops
567+
BMC Discovery:|secops
568+
<title>BMC Smart Reporting</title>|secops
569+
<title>BigFix Compliance: Login</title>|secops
570+
<title>BIG-IP;F5, Inc., Seattle, Washington. All rights reserved|netdev
571+
<title>502 - Web server received an invalid response while acting as a gateway or proxy server.</title>|badgw
572+
<title>503 Service Temporarily Unavailable</title>|serviceunavailable
573+
<html><head></head><body><h1>503 Service Unavailable</h1>|serviceunavailable
574+
<title>site unavailable</title>|serviceunavailable
575+
OpsHub</title>;admin|appops
576+
<title>Symantec Privileged Access Manager</title>|secops
577+
<title>windows_exporter</title></head>;<a href="/metrics">|dataops
578+
<title>Zabbix</title>|secops
579+
<title>tomcat;installed to|dataops
580+
</head><body><pre>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/|dataops
581+
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body>|dataops
582+
<html><head></head><body>{"result":"Page not found"}</body></html>|notfound
583+
<title>404 - File or directory not found.</title>|notfound
584+
<title id="loginTitle"></title>;by Cisco Systems, Inc|netdev
585+
<html><head></head><body>Tomcat-down for maintenance|serviceunavailable
586+
<html><head><link rel="stylesheet" href="resource://content-accessible/plaintext.css"></head><body><pre>Listening to;messages.</pre></body></html>|dataops
587+
<html><head></head><body></body></html>|empty
588+
<html><head><link rel="stylesheet" href="resource://content-accessible/plaintext.css"></head><body><pre></pre></body></html>|empty
589+
<html><head></head><body>test</body></html>|empty
590+
<html><head><link rel="stylesheet" href="resource://content-accessible/plaintext.css"></head><body><pre>{"|dataops
591+
<parsererror xmlns="http://www.mozilla.org/newlayout/xml/parsererror.xml">XML Parsing Error|dataops
592+
<html><head></head><body>Kibana server is not ready yet</body></html>|serviceunavailable
593+
<vasa-provider>;<supported-versions>|dataops
594+
xmlns:s="http://schemas.xmlsoap.org/soap/envelope/|dataops
595+
<title>Alertmanager</title>;prometh|secops
596+
<title>Application Express;oracle|appops
597+
<title>Checkmarx</title>|secops
598+
<title>CodeTableDashboard</title>|devops
599+
<title>Consul by HashiCorp</title>|secops
600+
<title>DCS Event Manager: Home</title>|dataops
601+
www.solarwinds.com/documentation/dpa;action="login.iwc"|devops
602+
<title>E-Business Suite Home Page Redirect</title>|redirector
603+
<title>Elastic</title>|secops
604+
<title>Enterprise-Class Redis for Developers</title>|devops
605+
<title>Error response</title>;501|inerror
606+
<title>HAL Management Console</title>|devops
607+
<title>Home Page - My ASP.NET Application</title>|crap
608+
<title>NETFLOW Server</title>;Queue|dataops
609+
<title>Oracle HTTP Server|appops
610+
<title>Outlook</title>|comms
611+
<title>Output Manager: Home</title>;mutex|dataops
612+
<title>Task Manager: Home</title>;mutex|dataops
613+
<title>Overview – Hangfire Dashboard</title>|appops
614+
<title>Pivotal tc Server — Standard Edition</title>|appops
615+
Bitbucket</title>|devops
616+
<title>Qlik Sense login page</title>|appops
617+
<title>Red Hat</title>;Where to go from here|crap
618+
<title>Report and Dashboard Server - Log In</title>|devops
619+
<title>SOAP RPC Server</title>|dataops
620+
<title>SYSLOG Server</title>|dataops
621+
<title>Selenium Grid Hub</title></head>|appops
622+
<title>Sign in - Matomo</title>|devops
623+
<title>Solr Admin</title>|appops
624+
<title>Spring Boot Admin</title>|devops
625+
<title>TIBCO WebFOCUS ;Reporting Server</title>|secops
626+
<title>TSM Web</title>|appops
627+
<title>Vault</title>;vault/config/environment|secops
628+
title>Web Administration has moved</title>|redirect
629+
<title>Welcome to Keycloak</title>|secops
630+
<title>cAdvisor -|appops
631+
python_gc_objects_collected_total{generation;RMF_performance_procu|dataops
632+
<html><head></head><body>Tomcat-up</body></html>|crap
633+
<a href="http://nats.io/documentation/server/gnatsd-monitoring/>help</a>|dataops
634+
<meta name="author" content="VMware, Inc.">|virtualization
635+
<body><pre>ERROR: Please retry or contact support</pre></body></html>|serviceunavailable

‎Python/modules/reporting.py

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,24 +74,31 @@ def sort_data_and_write(cli_parsed, data):
7474
total_results = len(data)
7575
categories = [('highval', 'High Value Targets', 'highval'),
7676
('dirlist', 'Directory Listings', 'dirlist'),
77-
(None, 'Uncategorized', 'uncat'),
7877
('cms', 'Content Management System (CMS)', 'cms'),
7978
('idrac', 'IDRAC/ILo/Management Interfaces', 'idrac'),
8079
('nas', 'Network Attached Storage (NAS)', 'nas'),
81-
('construction', 'Under Construction', 'construction'),
80+
('comms', 'Communications', 'comms'),
81+
('devops', 'Development Operations', 'devops'),
82+
('secops', 'Security Operations', 'secops'),
83+
('appops', 'Application Operations', 'appops'),
84+
('dataops', 'Data Operations', 'dataops'),
8285
('netdev', 'Network Devices', 'netdev'),
8386
('voip', 'Voice/Video over IP (VoIP)', 'voip'),
87+
('printer', 'Printers', 'printer'),
88+
('infrastructure', 'Infrastructure', 'infrastructure'),
89+
(None, 'Uncategorized', 'uncat'),
8490
('unauth', '401/403 Unauthorized', 'unauth'),
8591
('notfound', '404 Not Found', 'notfound'),
8692
('crap', 'Splash Pages', 'crap'),
87-
('printer', 'Printers', 'printer'),
93+
('empty', 'No Significant Content', 'empty'),
94+
('construction', 'Under Construction', 'construction'),
8895
('successfulLogin', 'Successful Logins', 'successfulLogin'),
8996
('identifiedLogin', 'Identified Logins', 'identifiedLogin'),
90-
('infrastructure', 'Infrastructure', 'infrastructure'),
9197
('redirector', 'Redirecting Pages', 'redirector'),
9298
('badhost', 'Invalid Hostname', 'badhost'),
9399
('inerror', 'Internal Error', 'inerror'),
94100
('badreq', 'Bad Request', 'badreq'),
101+
('badgw', 'Bad Gateway', 'badgw'),
95102
('serviceunavailable', 'Service Unavailable', 'serviceunavailable'),
96103
]
97104
if total_results == 0:

‎Python/signatures.txt

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ parse the RedirectUrl;RedirectQueryString;nameArray;nameArray["RedirectQueryStri
215215
<title>Log In</title>;title="Go to CA Network Flow Analysis" class="login-page-logo";Network Flow Analysis</span>|CA Network Flow Analysis admin/admin
216216
<p id="powered">Powered by <a href="http://www.ruckuswireless.com">Ruckus Wireless</a></p>;<tr><th>Admin Name</th><td><input class="login_input";<tr><th>Password</th><td><input class="login_input";<title>Log In</title>|Ruckus Wireless admin/password or super/sp-admin
217217
<link rel="stylesheet" href="resources/webLogin-all.css">;<title>Polycom Login</title>;<meta http-equiv="X-UA-Compatible" content="IE=edge">;Password:</label></div></div></div>;type="text" role="textbox" size="1" name="userName" class="x-form-field x-form-text|Polycom Wireless Polycom/123 (user) Polycom/456 (admin)
218-
<title>WebTools | Home</title>;<td align="left" valign="middle" class="name">XeroxC70;set_status_refresh_interval|Xerox C70 Printer admin/1111
218+
<title>WebTools;Home</title>;<td align="left" valign="middle" class="name">XeroxC70;set_status_refresh_interval|Xerox C70 Printer admin/1111
219219
<title>S2 Netbox Login</title>;<!--License IFRAME HERE GOES HERE-->;div id="headerframe"|S2 Netbox admin/admin
220220
<title>Remote Support Portal;Powered by BOMGAR</title>;exitSurveyBox;Show Representatives Help Window;/content/access_key_input.js|Bomgar Device admin/password
221221
<title>Pritunl</title>;<link rel="icon" type="image/x-icon" href;onSubmit();login-form;var duoUserInput = document.getElementById('duo-username')|Pritunl VPN pritunl/pritunl
@@ -313,7 +313,7 @@ Internet Services;window.document.body.scrollTop;href="JavaScript:parent.fflip;p
313313
<title>Altova LicenseServer</title>;<span>Please wait...</span>;<div id="statusErrorMessage";<p class="legalese">|Altova License Server <nousername>/default
314314
Nimble Storage;/assets/vendor;/oem/settings.js;<!-- Username field -->;data-ember-modal-dialog-overlay|Nimble Storage admin/admin
315315
<title>Welcome to JBoss™</title>;JBoss Online Resources;<h3>JBoss Management</h3>;href="/status">Tomcat status</a>|JBOSS JMX Console superadmin/superadmin
316-
<title>APC | Log On</title>;function isValidBrowser();class="applyCancel"|APC Smart UPS readonly/apc
316+
<title>APC;Log On</title>;function isValidBrowser();class="applyCancel"|APC Smart UPS readonly/apc
317317
<head><title>U</title></head>;client-side JavaScript client sniff;client-side JavaScript client sniff|Sensaphone IMS-4000 admin/ims1k
318318
<title>Liebert IntelliSlot Web Card</title>;var appObj = new Object();document.appObj= appObj|Liebert IntelliSlot Web Card Liebert/Liebert
319319
<title>Lexmark CS725</title>;<img src="/images/printer_logo.png";role="heading">Embedded Web Server</div>|Lexmark CS725 <nousername>/00000
@@ -334,7 +334,7 @@ var jumpProt = jumpURL.substr(0,6).toLowerCase();var argc = setCookie.arguments.
334334
<title>Netman 204 login</title>;<form id="login" action="cgi-bin/login.cgi";onsubmit="this.submit.disabled='disabled';action="cgi-bin/view.cgi"|NetMan 204 admin/admin fwupgrade/fwupgrade user/user
335335
<title>DS-510</title>;<frameset rows="90,*" frameborder="0" framespacing="0" border="0">;<frameset rows="90,*" frameborder="0" framespacing="0" border="0">;<frame src="/en/top.htm" name="top" noresize="" scrolling="no">|Silex Print Server root/<nopassword>
336336
<title>AlienVault OSSIM;<title>AlienVault OSSIM;form name="f_login" id="f_login" method="POST"|Alienvault admin/admin
337-
<base href="/sysmgr/">;nwf-loading-indicator class="nwf-loading";upport-href="{{ 'supportHref' | Vendorizer }}|NetApp OnCommand System Manager admin/admin123
337+
<base href="/sysmgr/">;nwf-loading-indicator class="nwf-loading";upport-href="{{ 'supportHref'|NetApp OnCommand System Manager admin/admin123
338338
<title>IBM TS7700</title>;<div class="deviceImage"></div>;"productnameLabelSpan">Storage Management|IBM TS7700 admin/admin
339339
<title>Login</title>;function initDHTMLAPI() {;var cacUserName = "";hideElement("trInitName", "trInitPwd");name="login_saml" id="login_saml_form"|Palo Alto Firewall admin/admin
340340
<title>NETGEAR ProSAFE Plus Switch</title>;<div id="mainArea" class="mainArea";<a id="loginBtn" class="loginBtnStyle"|NetGear Switch nousername/password
@@ -401,4 +401,7 @@ g_strLanguage;g_bHasNote;g_strFirmware;<title>Yealink;loginbox| admin / admin
401401
IBM FlashSystem 5200;lib-prod/assets/css/Aspen;FlashCopyMappingsSnapshot| superuser / passw0rd
402402
<title>Welcome to Service Assistant</title>;svg focusable;mg alt="Java"| superuser / passw0rd
403403
<title>Top Page - MX-M453N</title>;function loginSubmit(mode);class="invisible"| administrator / admin
404-
<title>KONICA MINOLTA PageScope Web Connection</title>;popupCopyright;index.cgi| 12345678
404+
<title>KONICA MINOLTA PageScope Web Connection</title>;popupCopyright;index.cgi| 12345678
405+
<title>windows_exporter</title></head>;<a href="/metrics">| Prometheus Metrics no auth /metrics
406+
www.solarwinds.com/documentation/dpa;action="login.iwc"| Solar Winds Database Performance Analyzer / admin / blank
407+
<title>RabbitMQ Management| guest /guest - admin / changeme

0 commit comments

Comments
 (0)