Merge pull request #1 from theworlddw/main

转换了ehole的一些指纹

finger/ehole/04WebServer.yml

@@ -0,0 +1,23 @@
+name: fingerprint-yaml-04WebServer
+manual: false
+detail:
+    fingerprint:
+        name: 04WebServer
+    fofa: header="04WebServer" || title="04WebServer"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.raw_header.bcontains(bytes("04WebServer"))
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("04WebServer")
+expression: r0() || r1()

finger/ehole/08CMS.yml

@@ -0,0 +1,44 @@
+name: fingerprint-yaml-08CMS
+manual: false
+detail:
+    fingerprint:
+        name: 08CMS
+    fofa: body="content=\"08cms" && body="typeof(_08cms" || body="content=\"08CMS" || body="typeof(_08cms)" || body="content=\"08cms" || body="typeof_08cms"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('content="08cms') && response.body_string.contains("typeof(_08cms")
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('content="08CMS')
+    r2:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("typeof(_08cms)")
+    r3:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('content="08cms')
+    r4:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("typeof_08cms")
+expression: r0() || r1() || r2() || r3() || r4()

finger/ehole/1024cms.yml

@@ -0,0 +1,44 @@
+name: fingerprint-yaml-1024cms
+manual: false
+detail:
+    fingerprint:
+        name: 1024cms
+    fofa: body="Powered by 1024 CMS" || body="generator\" content=\"1024 CMS (c)" || body="content=\"1024 CMS" || body="<div id=\"otatfpowered\"><a href=\"http://www.1024cms.com\" target=\"_blank\">Powered by 1024 CMS</a></div></div>" || body="<meta name=\"generator\" content=\"1024 CMS (c) 2008 Treble Designs. This is free software, and you may redistribute it under the Attribution-Non-Commercial-Share Alike 2.0 license (http://creativecommons.org/licenses/by-nc-sa/2.0/uk/). 1024 CMS comes with absolutely no warranty, for details, see the license (http://creativecommons.org/licenses/by-nc-sa/2.0/uk/).\" />"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("Powered by 1024 CMS")
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('generator" content="1024 CMS (c)')
+    r2:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('content="1024 CMS')
+    r3:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('<div id="otatfpowered"><a href="http://www.1024cms.com" target="_blank">Powered by 1024 CMS</a></div></div>')
+    r4:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('<meta name="generator" content="1024 CMS (c) 2008 Treble Designs. This is free software, and you may redistribute it under the Attribution-Non-Commercial-Share Alike 2.0 license (http://creativecommons.org/licenses/by-nc-sa/2.0/uk/). 1024 CMS comes with absolutely no warranty, for details, see the license (http://creativecommons.org/licenses/by-nc-sa/2.0/uk/)." />')
+expression: r0() || r1() || r2() || r3() || r4()

finger/ehole/1039_jxt.yml

@@ -0,0 +1,16 @@
+name: fingerprint-yaml-1039_jxt
+manual: false
+detail:
+    fingerprint:
+        name: 1039_jxt
+    fofa: title="1039_jxt"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("1039_jxt")
+expression: r0()

finger/ehole/1039soft-JiaXiao.yml

@@ -0,0 +1,51 @@
+name: fingerprint-yaml-1039soft-JiaXiao
+manual: false
+detail:
+    fingerprint:
+        name: 1039soft-JiaXiao
+    fofa: body="name=\"hid_qu_type\" id=\"hid_qu_type\"" && body="/handler/validatecode.ashx?id=" || body="txtyzm" && body="/handler/validatecode.ashx?id=" || body="name=\"hid_qu_type\" id=\"hid_qu_type\"" || body="/handler/validatecode.ashx?id=" || body="txtyzm" || title="登录_1039家校通"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('name="hid_qu_type" id="hid_qu_type"') && response.body_string.contains("/handler/validatecode.ashx?id=")
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("txtyzm") && response.body_string.contains("/handler/validatecode.ashx?id=")
+    r2:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains('name="hid_qu_type" id="hid_qu_type"')
+    r3:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("/handler/validatecode.ashx?id=")
+    r4:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("txtyzm")
+    r5:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("登录_1039家校通")
+expression: r0() || r1() || r2() || r3() || r4() || r5()

finger/ehole/1039家校通.yml

@@ -0,0 +1,23 @@
+name: fingerprint-yaml-1039家校通
+manual: false
+detail:
+    fingerprint:
+        name: 1039家校通
+    fofa: header="1039家校通" || title="1039家校通"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.raw_header.bcontains(bytes("1039家校通"))
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("1039家校通")
+expression: r0() || r1()

finger/ehole/115CMS.yml

@@ -0,0 +1,23 @@
+name: fingerprint-yaml-115CMS
+manual: false
+detail:
+    fingerprint:
+        name: 115CMS
+    fofa: body="115CMS" || title="115CMS"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("115CMS")
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("115CMS")
+expression: r0() || r1()

finger/ehole/123phpshop电商系统.yml

@@ -0,0 +1,23 @@
+name: fingerprint-yaml-123phpshop电商系统
+manual: false
+detail:
+    fingerprint:
+        name: 123phpshop电商系统
+    fofa: header="123phpshop电商系统" || title="123phpshop电商系统"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.raw_header.bcontains(bytes("123phpshop电商系统"))
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("123phpshop电商系统")
+expression: r0() || r1()

finger/ehole/128UU酒店预订系统PHP版.yml

@@ -0,0 +1,16 @@
+name: fingerprint-yaml-128UU酒店预订系统PHP版
+manual: false
+detail:
+    fingerprint:
+        name: 128UU酒店预订系统PHP版
+    fofa: title="128UU酒店预订系统PHP版"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("128UU酒店预订系统PHP版")
+expression: r0()

finger/ehole/129二维码生活垂直搜索引擎.yml

@@ -0,0 +1,16 @@
+name: fingerprint-yaml-129二维码生活垂直搜索引擎
+manual: false
+detail:
+    fingerprint:
+        name: 129二维码生活垂直搜索引擎
+    fofa: title="129二维码生活垂直搜索引擎"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("129二维码生活垂直搜索引擎")
+expression: r0()

finger/ehole/12样_12yang团购系统.yml

@@ -0,0 +1,16 @@
+name: fingerprint-yaml-12样_12yang团购系统
+manual: false
+detail:
+    fingerprint:
+        name: 12样_12yang团购系统
+    fofa: title="12样_12yang团购系统"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("12样_12yang团购系统")
+expression: r0()

finger/ehole/135topCMS.yml

@@ -0,0 +1,23 @@
+name: fingerprint-yaml-135topCMS
+manual: false
+detail:
+    fingerprint:
+        name: 135topCMS
+    fofa: body="135topCMS" || title="135topCMS"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.body_string.contains("135topCMS")
+    r1:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("135topCMS")
+expression: r0() || r1()

finger/ehole/150Mbps-Wireless-Router.yml

@@ -0,0 +1,16 @@
+name: fingerprint-yaml-150Mbps-Wireless-Router
+manual: false
+detail:
+    fingerprint:
+        name: 150Mbps-Wireless-Router
+    fofa: title="150mbps wireless router"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("150mbps wireless router")
+expression: r0()

finger/ehole/162100分类信息.yml

@@ -0,0 +1,16 @@
+name: fingerprint-yaml-162100分类信息
+manual: false
+detail:
+    fingerprint:
+        name: 162100分类信息
+    fofa: title="162100分类信息"
+transport: http
+rules:
+    r0:
+        request:
+            cache: true
+            method: GET
+            path: /
+            follow_redirects: true
+        expression: response.title_string.contains("162100分类信息")
+expression: r0()