http-fingerprints.lua: add /cdn-cgi/trace (some Cloudflare feature)
David Fifield <[email protected]> Tue, 5 Feb 2019 14:20:37 -0700
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <[email protected]> |
The attached patch adds "/cdn-cgi/trace" to http-fingerprints.lua for the http-enum script. This path seems to be a special administrative/ debugging path for sites on the Cloudflare CDN. I just happened to notice it in this blog post: https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/ To test for encrypted SNI support on your Cloudflare domain, you can visit the “/cdn-cgi/trace” page, for example, https://www.cloudflare.com/cdn-cgi/trace I didn't find any documentation for this feature or a specification of what all the fields mean, but here's what I see at https://www.cloudflare.com/cdn-cgi/trace: fl=20f275 h=www.cloudflare.com ip=77.247.181.162 ts=1549398742.213 visit_scheme=https uag=Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0 colo=AMS http=h2 loc=T1 tls=TLSv1.2 sni=plaintext I'm not sure if "/cdn-cgi/trace" is enable for all Cloudflare sites, or if it's an option the site owner can configure. Accessing just "/cdn-cgi/" seems to give a 404. A search at https://community.cloudflare.com/search?q=cdn-cgi shows that there are many other paths that may appear under /cdn-cgi/, but some of them, for example the email address obfuscation, are definitely optional. /cdn-cgi/apps/head/[random].js /cdn-cgi/scripts/cf.challenge.js /cdn-cgi/scripts/cf.common.js /cdn-cgi/scripts/zepto.min.js /cdn-cgi/scripts/[random]/cloudflare-static/email-decode.min.js /cdn-cgi/pe/bag2 _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/
0001-Add-cdn-cgi-trace-Cloudflare-to-http-fingerprints.lu.patch
(text/x-diff, 1.8 KB)
From 42c9399b265e61f486caf79db08c5fa69543c7e1 Mon Sep 17 00:00:00 2001 From: David Fifield <[email protected]> Date: Tue, 5 Feb 2019 14:05:34 -0700 Subject: [PATCH] Add "/cdn-cgi/trace" (Cloudflare) to http-fingerprints.lua. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I haven't found documentation on this, but it seems to be a feature specific to Cloudflare. I saw it mentioned at this blog post: https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/. To test for encrypted SNI support on your Cloudflare domain, you can visit the “/cdn-cgi/trace” page, for example, https://www.cloudflare.com/cdn-cgi/trace (replace www.cloudflare.com with your own domain). If the browser encrypted the SNI you should see sni=encrypted in the trace output. For me just now, https://www.cloudflare.com/cdn-cgi/trace shows: fl=20f275 h=www.cloudflare.com ip=77.247.181.162 ts=1549398742.213 visit_scheme=https uag=Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0 colo=AMS http=h2 loc=T1 tls=TLSv1.2 sni=plaintext --- nselib/data/http-fingerprints.lua | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/nselib/data/http-fingerprints.lua b/nselib/data/http-fingerprints.lua index 6fe256aef..a265ed44f 100644 --- a/nselib/data/http-fingerprints.lua +++ b/nselib/data/http-fingerprints.lua @@ -5298,6 +5298,18 @@ table.insert(fingerprints, { } }); +table.insert(fingerprints, { + category = 'management', + probes = { + "/cdn-cgi/trace" + }, + matches = { + { + output = "Cloudflare cdn-cgi trace script" + }, + } + }); + ------------------------------------------------ ---- PRINTERS, WEBCAMS, PROJECTORS ---- ------------------------------------------------ -- 2.11.0