Project Sonar HTTP updates (#273)

* Initial PR * Project Sonar updates * more fingerprints * Additional Netweaver
rapid7 · Jul 14, 2020 · be1d75e · be1d75e
1 parent 7024eef
commit be1d75e
Show file tree

Hide file tree

Showing 2 changed files with 285 additions and 16 deletions.
diff --git a/xml/http_cookies.xml b/xml/http_cookies.xml
@@ -138,7 +138,7 @@
     <param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
   </fingerprint>
 
-  <fingerprint pattern="^NSC_(?:AAAC|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS)=.*">
+  <fingerprint pattern="^NSC_(?:AAAC|BASEURL|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS|USER)=.*">
     <description>Citrix NetScaler</description>
     <example>NSC_AAAC=xyz;</example>
     <example>NSC_TEMP=xyz;</example>
@@ -170,8 +170,9 @@
     <param pos="0" name="service.product" value="CMS400.NET"/>
   </fingerprint>
 
-  <fingerprint pattern="^(BIGipServer([^=]+))=.*">
+  <fingerprint pattern="(?i)^(BIGipServer([^=]+))=.*">
     <description>F5 BIG-IP LTM - Server variant</description>
+    <example loadbalancer.poolname="CustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
     <param pos="1" name="cookie"/>
     <param pos="2" name="loadbalancer.poolname"/>
     <param pos="0" name="service.vendor" value="F5"/>
@@ -408,7 +409,8 @@
     <param pos="2" name="service.version"/>
     <param pos="0" name="service.vendor" value="Oracle"/>
     <param pos="0" name="service.family" value="OracleAS"/>
-    <param pos="0" name="service.product" value="OracleAS Portal"/>
+    <param pos="0" name="service.product" value="Application Server Portal"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:oracle:application_server_portal:{service.version}"/>
   </fingerprint>
 
   <fingerprint pattern="^Compaq-HMMD=[^;]+;.*$">