1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
##
# This file is part of WhatWeb and may be subject to
# redistribution and commercial restrictions. Please see the WhatWeb
# web site for more information on licensing and terms of use.
# http://www.morningstarsecurity.com/research/whatweb
##
Plugin.define "Check-Point-SSL-Network-Extender" do
author "Brendan Coles <bcoles@gmail.com>" # 2011-11-24
version "0.1"
description "SSL Network Extender adds SSL VPN functionality to the IPSec VPN capabilities of VPN-1 gateways - Homepage: http://www.checkpoint.com/products/ssl_network_ext/"
# ShodanHQ results as at 2011-11-24 #
# 223 for Check Point SVN foundation
# Google results as at 2011-11-24 #
# Lots of false positives for intitle:"Check Point SSL Network Extender"
# 2 for intitle:"Check Point SSL Network Extender HELP" inurl:help_data.html
# Examples #
examples %w|
212.174.139.46
193.108.116.249
83.246.101.229
212.174.139.65
195.235.219.161
210.245.209.117
212.0.1.35
193.158.194.154
80.48.182.5
https://77.88.105.34/
https://sslvpn.lsuhsc.edu/
https://vpn.bgu.ac.il/
https://vpn.ual.com/
https://rwshi.emea.reuters.com/
https://vpn.bgu.ac.il/
https://63.97.76.67/
https://hellfire.put.poznan.pl/
https://vpn.ipp.pt/
https://sslvpn.lsuhsc.edu/
|
# Matches #
matches [
# HTTP Header # Server
{ :search=>"headers[server]", :regexp=>/^Check Point SVN foundation$/ },
# / # JavaScript
{ :regexp=>/<script src="cookies\.js"><\/script>[\s]+<script>document\.write\(conn_html\)<\/script>[\s]+<HEAD>/ },
# /help_data.html # Help Page
{ :url=>"/help_data.html", :regexp=>/<meta name=Generator content="Microsoft Word 11 \(filtered\)">[\s]+<title>Check Point SSL Network Extender HELP<\/title>/ },
# /logo.gif
{ :url=>"/logo.gif", :md5=>"a5be381441844d96e70407481e1390b1" },
# Security Gateway # HTML Comment
{ :text=>'<meta name="description" content="Webui Login Page"/> <!-- changes to this line must be reflected in sfwOverrides.js & lm_home.js -->', :string=>"Security Gateway" },
# / # Security Gateway # Version Detection
{ :version=>/<form autocomplete="off" method="post" action="\/platform\.cgi\?" target="_top">[\s]+<input type="hidden" name="thispage" value="index\.htm">[\s]+<div class="version_div">([^<]+)<\/div>/, :string=>"Security Gateway" },
]
end
|
