Skip to content

Commit fe7dd55

Browse files
mandatoryprogrammermandatoryprogrammer
committed
Updated fingerprint scheme to be more logical per moloch's suggestion
1 parent f6a6a00 commit fe7dd55

File tree

5 files changed

+30
-29
lines changed

5 files changed

+30
-29
lines changed

‎README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,14 @@ An example fingerprint database can be seen below:
1515
var fingerprints = [
1616
{
1717
'name': "ASUS RT-N66U",
18-
'fingerprints': ["/images/New_ui/asustitle.png","/images/loading.gif","/images/alertImg.png","/images/New_ui/networkmap/line_one.png","/images/New_ui/networkmap/lock.png","/images/New_ui/networkmap/line_two.png","/index_style.css","/form_style.css","/NM_style.css","/other.css"],
18+
'resources': ["/images/New_ui/asustitle.png","/images/loading.gif","/images/alertImg.png","/images/New_ui/networkmap/line_one.png","/images/New_ui/networkmap/lock.png","/images/New_ui/networkmap/line_two.png","/index_style.css","/form_style.css","/NM_style.css","/other.css"],
1919
'callback': function( ip ) {
2020
// Insert exploit here
2121
},
2222
},
2323
{
2424
'name': "Linksys WRT54G",
25-
'fingerprints': ["/UILinksys.gif","/UI_10.gif","/UI_07.gif","/UI_06.gif","/UI_03.gif","/UI_02.gif","/UI_Cisco.gif","/style.css"],
25+
'resources': ["/UILinksys.gif","/UI_10.gif","/UI_07.gif","/UI_06.gif","/UI_03.gif","/UI_02.gif","/UI_Cisco.gif","/style.css"],
2626
'callback': function( ip ) {
2727
// Insert exploit here
2828
},
@@ -34,7 +34,7 @@ The above database contains fingerprints for two devices, the *ASUS RT-N66U* WiF
3434

3535
Each database entry has the following:
3636
* ``name``: A field to identify what device the fingerprint is for. This could be something like *HP Officejet 4500 printer* or *Linksys WRT54G Router*.
37-
* ```fingerprints```: This is an array of relative links to resources such as CSS stylesheets, images, or even JavaScript files. If you expect these resources to be on a non-standard port such as ``8080``, set the resource with the port included: ```:8080/unique.css```. Keep in mind using external resources with active content such as JavaScript is dangerous as it can interrupt the regular flow of execution.
37+
* ```resources```: This is an array of relative links to resources such as CSS stylesheets, images, or even JavaScript files. If you expect these resources to be on a non-standard port such as ``8080``, set the resource with the port included: ```:8080/unique.css```. Keep in mind using external resources with active content such as JavaScript is dangerous as it can interrupt the regular flow of execution.
3838
* ```callback```: If all of these resources are found to exist on the enumerated host then the ```callback``` function is called with a single argument of the device's IP address.
3939

4040
By creating your own fingerprints you can build custom exploits that will be launched against internal devices once they are detected by sonar.js. Common exploits include things such as Cross-site Request Forgery (CSRF), Cross-site Scripting (XSS), etc. The idea being that you can use these vulnerabilities to do things such as modifying router DNS configurations, dumping files from an internal fileserver, and more.

‎fingerprint_db.js

+18-18
Original file line numberDiff line numberDiff line change
@@ -4,126 +4,126 @@
44
var fingerprints = [
55
{
66
'name': "ASUS RT-N66U",
7-
'fingerprints': [["/images/New_ui/networkmap/linetwo2.png",270,2],["/images/alertImg.png",92,92],["/switcherplugin/iphone_switch_container_off.png",75,32],"/NM_style.css","/form_style.css","/general.js","/device-map/formcontrol.js","/ajax.js","/state.js","/jquery.js","/switcherplugin/jquery.iphone-switch.js","/device-map/router.asp",["/images/New_ui/asustitle.png",218,54],["/images/loading.gif",66,66],["/images/New_ui/networkmap/line_one.png",7,22],["/images/New_ui/networkmap/lock.png",23,23],["/images/New_ui/networkmap/line_two.png",180,57],"/index_style.css","/other.css","/md5.js","/popup.js","/disk_functions.js","/client_function.js","/help.js","/detect.js"],
7+
'resources': [["/images/New_ui/networkmap/linetwo2.png",270,2],["/images/alertImg.png",92,92],["/switcherplugin/iphone_switch_container_off.png",75,32],"/NM_style.css","/form_style.css","/general.js","/device-map/formcontrol.js","/ajax.js","/state.js","/jquery.js","/switcherplugin/jquery.iphone-switch.js","/device-map/router.asp",["/images/New_ui/asustitle.png",218,54],["/images/loading.gif",66,66],["/images/New_ui/networkmap/line_one.png",7,22],["/images/New_ui/networkmap/lock.png",23,23],["/images/New_ui/networkmap/line_two.png",180,57],"/index_style.css","/other.css","/md5.js","/popup.js","/disk_functions.js","/client_function.js","/help.js","/detect.js"],
88
'callback': function( ip ) {
99
// Insert exploit here
1010
},
1111
},
1212
{
1313
'name': "ASUS RT-AC66U",
14-
'fingerprints': ["/images/New_ui/asustitle.png","/images/loading.gif","/images/alertImg.png","/images/white%20arrow.png","/images/New_ui/networkmap/line_one.png","/images/New_ui/networkmap/unlock.png","/images/New_ui/networkmap/line_two.png","/images/quotabar.gif","/index_style.css","/form_style.css","/NM_style.css","/other.css"],
14+
'resources': ["/images/New_ui/asustitle.png","/images/loading.gif","/images/alertImg.png","/images/white%20arrow.png","/images/New_ui/networkmap/line_one.png","/images/New_ui/networkmap/unlock.png","/images/New_ui/networkmap/line_two.png","/images/quotabar.gif","/index_style.css","/form_style.css","/NM_style.css","/other.css"],
1515
'callback': function( ip ) {
1616
// Insert exploit here
1717
},
1818
},
1919
{
2020
'name': "ASUS RT-N16",
21-
'fingerprints': ["/images/top-03.gif","/images/top.gif","/images/DrsurfImg.gif","/images/m-button-07end.gif","/images/quotabar.gif","/index_style.css","/form_style.css","/NM_style.css","/other.css"],
21+
'resources': ["/images/top-03.gif","/images/top.gif","/images/DrsurfImg.gif","/images/m-button-07end.gif","/images/quotabar.gif","/index_style.css","/form_style.css","/NM_style.css","/other.css"],
2222
'callback': function( ip ) {
2323
// Insert exploit here
2424
},
2525
},
2626
{
2727
'name': "Linksys WRT54G",
28-
'fingerprints': ["/UILinksys.gif","/UI_10.gif","/UI_07.gif","/UI_06.gif","/UI_03.gif","/UI_02.gif","/UI_Cisco.gif","/style.css"],
28+
'resources': ["/UILinksys.gif","/UI_10.gif","/UI_07.gif","/UI_06.gif","/UI_03.gif","/UI_02.gif","/UI_Cisco.gif","/style.css"],
2929
'callback': function( ip ) {
3030
// Insert exploit here
3131
},
3232
},
3333
{
3434
'name': "TPLINK Archer C7 AC1750",
35-
'fingerprints': ["/dynaform/css_main.css", "/dynaform/css_help.css", "/images/top1_1.jpg", "/images/blue.jpg", "/images/top_bg.jpg", "/images/top1_2.jpg"],
35+
'resources': ["/dynaform/css_main.css", "/dynaform/css_help.css", "/images/top1_1.jpg", "/images/blue.jpg", "/images/top_bg.jpg", "/images/top1_2.jpg"],
3636
'callback': function( ip ) {
3737
// Insert exploit here
3838
},
3939
},
4040
{
4141
'name': "TPLINK Archer C7 AC1750 (Logged Out)",
42-
'fingerprints': [["/login/top1_1.jpg",280,87],["/login/top2.jpg",770,3]],
42+
'resources': [["/login/top1_1.jpg",280,87],["/login/top2.jpg",770,3]],
4343
'callback': function( ip ) {
4444
// Insert exploit here
4545
},
4646
},
4747
{
4848
'name': "Epson WF-3520 Printer",
49-
'fingerprints': ["/PRESENTATION/IMAGE/EPSONLOGO.PNG","/PRESENTATION/IMAGE/SEPARATOR.PNG","/PRESENTATION/IMAGE/EC_ILL.PNG","/PRESENTATION/IMAGE/GCP_ILL.PNG","/PRESENTATION/IMAGE/C_B_ILL.PNG","/PRESENTATION/IMAGE/B_C_ILL.PNG","/PRESENTATION/IMAGE/AIRP_ILL.PNG","/PRESENTATION/IMAGE/PRTINFO_ILL.PNG","/PRESENTATION/IMAGE/EC_BTN.PNG","/PRESENTATION/IMAGE/GCP_BTN.PNG","/PRESENTATION/IMAGE/C_B_BTN.PNG","/PRESENTATION/IMAGE/B_C_BTN.PNG","/PRESENTATION/IMAGE/AIRP_BTN.PNG","/PRESENTATION/IMAGE/PRTINFO_BTN.PNG"],
49+
'resources': ["/PRESENTATION/IMAGE/EPSONLOGO.PNG","/PRESENTATION/IMAGE/SEPARATOR.PNG","/PRESENTATION/IMAGE/EC_ILL.PNG","/PRESENTATION/IMAGE/GCP_ILL.PNG","/PRESENTATION/IMAGE/C_B_ILL.PNG","/PRESENTATION/IMAGE/B_C_ILL.PNG","/PRESENTATION/IMAGE/AIRP_ILL.PNG","/PRESENTATION/IMAGE/PRTINFO_ILL.PNG","/PRESENTATION/IMAGE/EC_BTN.PNG","/PRESENTATION/IMAGE/GCP_BTN.PNG","/PRESENTATION/IMAGE/C_B_BTN.PNG","/PRESENTATION/IMAGE/B_C_BTN.PNG","/PRESENTATION/IMAGE/AIRP_BTN.PNG","/PRESENTATION/IMAGE/PRTINFO_BTN.PNG"],
5050
'callback': function( ip ) {
5151
// Insert exploit here
5252
},
5353
},
5454
{
5555
'name': "Cisco Xfinity XB3 Modem",
56-
'fingerprints': [["/cmn/img/logo_title.png",92,30],["/cmn/img/icn_battery.png",9,114],["/cmn/img/icn_on_off.png",15,66],"/cmn/css/common-min.css","/cmn/css/print.css","/cmn/css/lib/jquery.radioswitch.css","/cmn/js/lang_en.js","/cmn/js/lib/jquery-1.9.1.js","/cmn/js/lib/jquery-migrate-1.2.1.js","/cmn/js/lib/jquery.validate.js","/cmn/js/lib/jquery.alerts.js","/cmn/js/lib/jquery.alerts.progress.js","/cmn/js/lib/jquery.ciscoExt.js","/cmn/js/lib/jquery.highContrastDetect.js","/cmn/js/lib/jquery.radioswitch.js","/cmn/js/lib/jquery.virtualDialog.js","/cmn/js/utilityFunctions.js","/cmn/js/comcast.js"],
56+
'resources': [["/cmn/img/logo_title.png",92,30],["/cmn/img/icn_battery.png",9,114],["/cmn/img/icn_on_off.png",15,66],"/cmn/css/common-min.css","/cmn/css/print.css","/cmn/css/lib/jquery.radioswitch.css","/cmn/js/lang_en.js","/cmn/js/lib/jquery-1.9.1.js","/cmn/js/lib/jquery-migrate-1.2.1.js","/cmn/js/lib/jquery.validate.js","/cmn/js/lib/jquery.alerts.js","/cmn/js/lib/jquery.alerts.progress.js","/cmn/js/lib/jquery.ciscoExt.js","/cmn/js/lib/jquery.highContrastDetect.js","/cmn/js/lib/jquery.radioswitch.js","/cmn/js/lib/jquery.virtualDialog.js","/cmn/js/utilityFunctions.js","/cmn/js/comcast.js"],
5757
'callback': function( ip ) {
5858
// Insert exploit here
5959
},
6060
},
6161
{
6262
'name': "Brother HL-2150N series Printer",
63-
'fingerprints': [["/pbio/brother.gif",144,52],["/printer/hl2150n.gif",144,16],["/printer/ball.gif",15,11],["/pbio/key_user.gif",24,11],["/pbio/bar_v.gif",24,1],["/pbio/bar_h.gif",24,1],["/pbio/key_admin.gif",24,11],["/printer/key_help.gif",36,39],["/printer/spacer.gif",1,1],["/pbio/model_s.gif",144,45],["/printer/dispLCD.gif",20,15],["/printer/noneLCD.gif",20,15],["/pbio/AutoRfOff.gif",80,50],["/printer/cot.gif",39,35],["/printer/loc.gif",39,35],"/printer/printer.css"],
63+
'resources': [["/pbio/brother.gif",144,52],["/printer/hl2150n.gif",144,16],["/printer/ball.gif",15,11],["/pbio/key_user.gif",24,11],["/pbio/bar_v.gif",24,1],["/pbio/bar_h.gif",24,1],["/pbio/key_admin.gif",24,11],["/printer/key_help.gif",36,39],["/printer/spacer.gif",1,1],["/pbio/model_s.gif",144,45],["/printer/dispLCD.gif",20,15],["/printer/noneLCD.gif",20,15],["/pbio/AutoRfOff.gif",80,50],["/printer/cot.gif",39,35],["/printer/loc.gif",39,35],"/printer/printer.css"],
6464
'callback': function( ip ) {
6565
// Insert exploit here
6666
},
6767
},
6868
{
6969
'name': "Brother HL-2250DN series Printer",
70-
'fingerprints': [["/pbio/brother.gif",144,52],["/printer/hl2250dn.gif",144,16],["/printer/ball.gif",15,11],["/pbio/key_user.gif",24,11],["/pbio/bar_v.gif",24,1],["/pbio/bar_h.gif",24,1],["/pbio/key_admin.gif",24,11],["/printer/key_help.gif",36,39],["/printer/spacer.gif",1,1],["/pbio/model_s.gif",144,45],["/printer/noneLCD.gif",20,15],["/pbio/AutoRfOff.gif",80,50],["/printer/cot.gif",39,35],["/printer/loc.gif",39,35],"/printer/printer.css"],
70+
'resources': [["/pbio/brother.gif",144,52],["/printer/hl2250dn.gif",144,16],["/printer/ball.gif",15,11],["/pbio/key_user.gif",24,11],["/pbio/bar_v.gif",24,1],["/pbio/bar_h.gif",24,1],["/pbio/key_admin.gif",24,11],["/printer/key_help.gif",36,39],["/printer/spacer.gif",1,1],["/pbio/model_s.gif",144,45],["/printer/noneLCD.gif",20,15],["/pbio/AutoRfOff.gif",80,50],["/printer/cot.gif",39,35],["/printer/loc.gif",39,35],"/printer/printer.css"],
7171
'callback': function( ip ) {
7272
// Insert exploit here
7373
},
7474
},
7575
{
7676
'name': "Cisco SPA504G IP Phone",
77-
'fingerprints': [["/pageBackground.jpg",1260,1024],["/cisco_logo_header.png",62,33]],
77+
'resources': [["/pageBackground.jpg",1260,1024],["/cisco_logo_header.png",62,33]],
7878
'callback': function( ip ) {
7979
// Insert exploit here
8080
},
8181
},
8282
{
8383
'name': "GE Security 1809 Universal Interface",
84-
'fingerprints': [["/images/gelogo.jpg",251,59],"/links.html",["/images/1809.jpg",560,349],"/home.html"],
84+
'resources': [["/images/gelogo.jpg",251,59],"/links.html",["/images/1809.jpg",560,349],"/home.html"],
8585
'callback': function( ip ) {
8686
// Insert exploit here
8787
},
8888
},
8989
{
9090
'name': "Denon CEOL Piccolo DRA-N5 Network Audio Player",
91-
'fingerprints': ["/SETUP/formCssDefault.css","/SETUP/d_left_setup.asp","/goform/formCssDefault.css","/SETUP/d_right_setup.asp","/dummy.asp","/css/mainMenu.css"],
91+
'resources': ["/SETUP/formCssDefault.css","/SETUP/d_left_setup.asp","/goform/formCssDefault.css","/SETUP/d_right_setup.asp","/dummy.asp","/css/mainMenu.css"],
9292
'callback': function( ip ) {
9393
// Insert exploit here
9494
},
9595
},
9696
{
9797
'name': "SIP-T41P IP Phone",
98-
'fingerprints': [["/img/btn_bg_down.png",98,28],"/js/utility.js","/language/1.English.js"],
98+
'resources': [["/img/btn_bg_down.png",98,28],"/js/utility.js","/language/1.English.js"],
9999
'callback': function( ip ) {
100100
// Insert exploit here
101101
},
102102
},
103103
{
104104
'name': "OpenWrt",
105-
'fingerprints': ["/luci-static/bootstrap/cascade.css","/luci-static/bootstrap/mobile.css","/luci-static/resources/xhr.js",["/luci-static/resources/cbi/apply.gif",16,16],["/luci-static/resources/cbi/reset.gif",16,16]],
105+
'resources': ["/luci-static/bootstrap/cascade.css","/luci-static/bootstrap/mobile.css","/luci-static/resources/xhr.js",["/luci-static/resources/cbi/apply.gif",16,16],["/luci-static/resources/cbi/reset.gif",16,16]],
106106
'callback': function( ip ) {
107107
// Insert exploit here
108108
},
109109
},
110110
{
111111
'name': "Cisco Small Business Switch",
112-
'fingerprints': [["/images/cisco_pageBackground.jpg",1260,1024],["/images/cisco_logo_header.png",62,33],["/images/ContextMessageArrow_DownT.gif",16,16],["/images/login_progress.gif",16,16],["/images/normalHoverButton.gif",180,49],["/images/pressedButton.png",180,49],["/images/button_hover.png",1,22],["/images/button_pressed.png",1,22],["/images/cisco_button_hover-60.gif",60,24],["/images/cisco_button_normal-60.gif",60,24],["/images/cisco_button_pressed-60.gif",60,24],"/scripts/jquery.js","/scripts/jquery.cookie.js"],
112+
'resources': [["/images/cisco_pageBackground.jpg",1260,1024],["/images/cisco_logo_header.png",62,33],["/images/ContextMessageArrow_DownT.gif",16,16],["/images/login_progress.gif",16,16],["/images/normalHoverButton.gif",180,49],["/images/pressedButton.png",180,49],["/images/button_hover.png",1,22],["/images/button_pressed.png",1,22],["/images/cisco_button_hover-60.gif",60,24],["/images/cisco_button_normal-60.gif",60,24],["/images/cisco_button_pressed-60.gif",60,24],"/scripts/jquery.js","/scripts/jquery.cookie.js"],
113113
'callback': function( ip ) {
114114
// Insert exploit here
115115
},
116116
},
117117
{
118118
'name': "Thomson TG789vn Router",
119-
'fingerprints': [["/images/home.gif",50,50],["/images/stxx__xl.gif",50,50],["/images/bbc__xl.gif",50,50],["/images/tbox__xl.gif",50,50],["/images/hnw___xl.gif",50,50],["/images/help.gif",50,50],["/images/spacer.gif",1,1],["/images/bull__md.gif",40,20],["/images/bbc_grxl.gif",50,50],["/images/iwla__la.gif",40,40],["/images/ieth__la.gif",40,40],["/images/ipho__la.gif",40,40],["/images/banner_back.gif",1,69],["/images/banner_left.gif",605,69],["/images/banner_right.gif",139,69],["/images/gradient.gif",1,38],"/styles.css","/util.js","/b_menu.js"],
119+
'resources': [["/images/home.gif",50,50],["/images/stxx__xl.gif",50,50],["/images/bbc__xl.gif",50,50],["/images/tbox__xl.gif",50,50],["/images/hnw___xl.gif",50,50],["/images/help.gif",50,50],["/images/spacer.gif",1,1],["/images/bull__md.gif",40,20],["/images/bbc_grxl.gif",50,50],["/images/iwla__la.gif",40,40],["/images/ieth__la.gif",40,40],["/images/ipho__la.gif",40,40],["/images/banner_back.gif",1,69],["/images/banner_left.gif",605,69],["/images/banner_right.gif",139,69],["/images/gradient.gif",1,38],"/styles.css","/util.js","/b_menu.js"],
120120
'callback': function( ip ) {
121121
// Insert exploit here
122122
},
123123
},
124124
{
125125
'name': "Huawei Home Gateway",
126-
'fingerprints': ["/html/main/refresh.asp",["/images/logo.gif",55,54],["/images/language.gif",42,38],["/images/helpmain.gif",45,44],["/images/logout.gif",45,44],"/css/stylemain.css","/js/util.js","/js/tabinfo.js","/lang/logo.res","/html/main/logo.html",["/images/info.gif",46,44],["/images/basic.gif",46,44],["/images/advance.gif",46,44],["/images/maintain.gif",46,44],"/lang/device.res","/js/menutree.js","/js/adminmenu.js","/js/usermenu.js","/html/main/menu.asp","/html/main/tab.asp","/css/contentstyle.css","/html/status/deviceinfo.asp","/lang/footer.res","/html/main/footer.html",["/images/logoback.gif",2,68],["/images/leftblock.gif",18,68],["/images/midblock.gif",2,68],["/images/firstmenu.gif",2,45],["/images/rightblock.gif",19,68],["/images/tabbar.gif",2,4],["/images/clicktableft.gif",11,25],["/images/clicktabmid.gif",2,25],["/images/clicktabright.gif",11,25],["/images/loginleft.gif",7,197],["/images/loginmid.gif",2,197],["/images/loginright.gif",7,197],["/images/helpinit.gif",2,19],],
126+
'resources': ["/html/main/refresh.asp",["/images/logo.gif",55,54],["/images/language.gif",42,38],["/images/helpmain.gif",45,44],["/images/logout.gif",45,44],"/css/stylemain.css","/js/util.js","/js/tabinfo.js","/lang/logo.res","/html/main/logo.html",["/images/info.gif",46,44],["/images/basic.gif",46,44],["/images/advance.gif",46,44],["/images/maintain.gif",46,44],"/lang/device.res","/js/menutree.js","/js/adminmenu.js","/js/usermenu.js","/html/main/menu.asp","/html/main/tab.asp","/css/contentstyle.css","/html/status/deviceinfo.asp","/lang/footer.res","/html/main/footer.html",["/images/logoback.gif",2,68],["/images/leftblock.gif",18,68],["/images/midblock.gif",2,68],["/images/firstmenu.gif",2,45],["/images/rightblock.gif",19,68],["/images/tabbar.gif",2,4],["/images/clicktableft.gif",11,25],["/images/clicktabmid.gif",2,25],["/images/clicktabright.gif",11,25],["/images/loginleft.gif",7,197],["/images/loginmid.gif",2,197],["/images/loginright.gif",7,197],["/images/helpinit.gif",2,19],],
127127
'callback': function( ip ) {
128128
// Insert exploit here
129129
},

0 commit comments

Comments
 (0)