id: niagara-fox-info-enum

info:
  name: Niagara Fox Protocol Information Enumeration
  author: pussycat0x
  severity: info
  description: |
    Niagara Fox Protocol is a building automation protocol used between the Niagara software systems by Tridium.
  reference:
    - https://nmap.org/nsedoc/scripts/fox-info.html
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"Niagara Fox"
  tags: network,fox,niagara,enum,tcp
tcp:
  - inputs:
      - data: "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\n};;\n"
    host:
      - "{{Hostname}}"
    port: 1911

    matchers:
      - type: word
        words:
          - "fox.version"

    extractors:
      - type: regex
        regex:
          - "fox.version=s:([0-9.]+)"
          - "hostName=s:([0-9.]+)"
          - "hostAddress=s:([0-9.]+)"
          - "app.name=s:([A-Za-z0-9]+)"
          - "app.version=s:([0-9.]+)"
          - "vm.name=s:([A-Za-z ()0-9]+)"
          - "vm.version=s:([0-9._-a-z]+)"
          - "os.name=s:([A-Z]+)"
          - "os.version=s:([0-9.]+)"
# digest: 4b0a00483046022100dbb76226a6d02f1d7a7903703ee308d6da12ed4a6897e37fb5e736c7ea1e0cc6022100b30dcc74743582737b185b307f01dd67cef25c1269344f343cd5310967a3c53f:922c64590222798bb761d5b6d8e72950