id: niagara-fox-info-enum

info:
  name: Niagara Fox Protocol Information Enumeration
  author: pussycat0x
  severity: info
  description: |
    Niagara Fox Protocol is a building automation protocol used between the Niagara software systems by Tridium.
  metadata:
    max-request: 2
    verified: true
    shodan-query: 'product:"Niagara Fox"'
  reference:
    - https://nmap.org/nsedoc/scripts/fox-info.html
  tags: network,fox,niagara

tcp:
  - inputs:
      - data: "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\n};;\n"
    host:
      - "{{Hostname}}"
      - "{{Host}}:1911"

    matchers:
      - type: word
        words:
          - "fox.version"

    extractors:
      - type: regex
        regex:
          - "fox.version=s:([0-9.]+)"
          - "hostName=s:([0-9.]+)"
          - "hostAddress=s:([0-9.]+)"
          - "app.name=s:([A-Za-z0-9]+)"
          - "app.version=s:([0-9.]+)"
          - "vm.name=s:([A-Za-z ()0-9]+)"
          - "vm.version=s:([0-9._-a-z]+)"
          - "os.name=s:([A-Z]+)"
          - "os.version=s:([0-9.]+)"