id: niagara-fox-info-enum

info:
  name: Niagara Fox Protocol Information Enumeration
  author: pussycat0x
  severity: info
  description: |
    Niagara Fox Protocol is a building automation protocol used between the Niagara software systems by Tridium.
  reference:
    - https://nmap.org/nsedoc/scripts/fox-info.html
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"Niagara Fox"
  tags: network,fox,niagara,enum,tcp,discovery
tcp:
  - inputs:
      - data: "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\n};;\n"
    host:
      - "{{Hostname}}"
    port: 1911

    matchers:
      - type: word
        words:
          - "fox.version"

    extractors:
      - type: regex
        regex:
          - "fox.version=s:([0-9.]+)"
          - "hostName=s:([0-9.]+)"
          - "hostAddress=s:([0-9.]+)"
          - "app.name=s:([A-Za-z0-9]+)"
          - "app.version=s:([0-9.]+)"
          - "vm.name=s:([A-Za-z ()0-9]+)"
          - "vm.version=s:([0-9._-a-z]+)"
          - "os.name=s:([A-Z]+)"
          - "os.version=s:([0-9.]+)"
# digest: 4a0a00473045022018e6b318393b194161bff221dfad85c253cca8735f4ffdf1909be0e3c61f8c5b022100ffe5a48558476c62980b064fd72b5ed535f8d6b08b04e3e22db3d0ebd2f6be0e:922c64590222798bb761d5b6d8e72950