id: niagara-fox-info-enum

info:
  name: Niagara Fox Protocol Information Enumeration
  author: pussycat0x
  severity: info
  description: |
    Niagara Fox Protocol is a building automation protocol used between the Niagara software systems by Tridium.
  reference:
    - https://nmap.org/nsedoc/scripts/fox-info.html
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"Niagara Fox"
  tags: network,fox,niagara,enum,tcp
tcp:
  - inputs:
      - data: "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\n};;\n"
    host:
      - "{{Hostname}}"
    port: 1911

    matchers:
      - type: word
        words:
          - "fox.version"

    extractors:
      - type: regex
        regex:
          - "fox.version=s:([0-9.]+)"
          - "hostName=s:([0-9.]+)"
          - "hostAddress=s:([0-9.]+)"
          - "app.name=s:([A-Za-z0-9]+)"
          - "app.version=s:([0-9.]+)"
          - "vm.name=s:([A-Za-z ()0-9]+)"
          - "vm.version=s:([0-9._-a-z]+)"
          - "os.name=s:([A-Z]+)"
          - "os.version=s:([0-9.]+)"
# digest: 4b0a00483046022100e46c70ad8750089ecc6ec9ec7ad06ef9e5a67c43ee012fe940ab74487367b082022100b888e361878a8e658fd45c127416e165d6541ba6019e87b52a0c799a49e16bed:922c64590222798bb761d5b6d8e72950