63 lines
1.6 KiB
Go
63 lines
1.6 KiB
Go
/*
|
|
©AngelaMos | 2026
|
|
scanner.go
|
|
|
|
HTTP scanner detection by user-agent fingerprinting
|
|
|
|
Matches incoming User-Agent headers against known automated scanning
|
|
tools. Returns the tool family name for tagging events when a scanner
|
|
is identified, enabling correlation of probe activity.
|
|
*/
|
|
|
|
package httpd
|
|
|
|
import "strings"
|
|
|
|
var scannerPatterns = map[string]string{
|
|
"nuclei": "nuclei",
|
|
"sqlmap": "sqlmap",
|
|
"nmap": "nmap",
|
|
"zgrab": "zgrab",
|
|
"masscan": "masscan",
|
|
"nikto": "nikto",
|
|
"gobuster": "gobuster",
|
|
"dirbuster": "dirbuster",
|
|
"wfuzz": "wfuzz",
|
|
"ffuf": "ffuf",
|
|
"burp": "burpsuite",
|
|
"acunetix": "acunetix",
|
|
"openvas": "openvas",
|
|
"nessus": "nessus",
|
|
"w3af": "w3af",
|
|
"arachni": "arachni",
|
|
"whatweb": "whatweb",
|
|
"wpscan": "wpscan",
|
|
"joomscan": "joomscan",
|
|
"metasploit": "metasploit",
|
|
"hydra": "hydra",
|
|
"scrapy": "scrapy",
|
|
"python-requests": "python-requests",
|
|
"go-http-client": "go-http-client",
|
|
"libwww-perl": "libwww-perl",
|
|
"censys": "censys",
|
|
"shodan": "shodan",
|
|
"netcraft": "netcraft",
|
|
"curl/": "curl",
|
|
"wget/": "wget",
|
|
"httpx": "httpx",
|
|
"feroxbuster": "feroxbuster",
|
|
"dnsrecon": "dnsrecon",
|
|
"testssl": "testssl",
|
|
"sslscan": "sslscan",
|
|
}
|
|
|
|
func DetectScanner(userAgent string) string {
|
|
lower := strings.ToLower(userAgent)
|
|
for pattern, name := range scannerPatterns {
|
|
if strings.Contains(lower, pattern) {
|
|
return name
|
|
}
|
|
}
|
|
return ""
|
|
}
|