Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions DNS.md
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
### DNS

The `DNS` object SHALL be used to describe the DNS configuration of a specific `Host`. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below. See DNS.md file for futher usage for the [`Host`](Host.md) object(s).
The `DNS` object SHALL be used to describe the DNS configuration of a specific `host`. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below. See DNS.md file for futher usage for the [`host`](Host.md) object(s).


The `DNS` object has the following attributes defined:
* `type`* - MUST be the type of object. In this case, `DNS`.
* `A` - MUST be the list of IPv4 addresses that resolve from an A record lookup of this `Host`s FQDN
* `AAAA` - MUST be the list of IPv6 addresses that resolve from an AAAA record lookup of this `Host`'s FQDN
* `CNAME` - MUST be the list of FQDNs that resolve from a CNAME record lookup of this `Host`'s FQDN
* `PTR` - MUST be the list of FQDNs that resolve from a PTR record lookup of this `Host`'s IP
* `A` - MUST be the list of IPv4 addresses that resolve from an A record lookup of this `host`s FQDN
* `AAAA` - MUST be the list of IPv6 addresses that resolve from an AAAA record lookup of this `host`'s FQDN
* `CNAME` - MUST be the list of FQDNs that resolve from a CNAME record lookup of this `host`'s FQDN
* `PTR` - MUST be the list of FQDNs that resolve from a PTR record lookup of this `host`'s IP
* `MX` - MUST be the list of FQDNs that resolve from an MX record lookup of this `Hosts`'s FQDN
* `NS` - MUST be the list of FQDNs that resolve from a NS record lookup of this `Hosts`'s FQDN
* `TXT` - MUST be the list of strings that resolve from a TXT record lookup of this `Hosts`'s FQDN
Expand All @@ -17,13 +17,13 @@ The `DNS` object has the following attributes defined:

Example:
```
{"type":"Host","fqdn":"example.acme.com","ip":"192.168.0.1","domain":"acme.com","company":"Acme","dns":{"type":"DNS","A":["192.168.0.1", "192.168.0.2"],"AAAA":["fe80::1"],"CNAME":["ex.acme.com"],"PTR":["ex.acme.com"],"MX":["example-acme-com.mail.protection.outlook.com"],"NS":["nameserver.acme.com"],TXT":["txtRecordString"]}}
{"type":"host","fqdn":"example.acme.com","ip":"192.168.0.1","domain":"acme.com","company":"Acme","dns":{"type":"DNS","A":["192.168.0.1", "192.168.0.2"],"AAAA":["fe80::1"],"CNAME":["ex.acme.com"],"PTR":["ex.acme.com"],"MX":["example-acme-com.mail.protection.outlook.com"],"NS":["nameserver.acme.com"],TXT":["txtRecordString"]}}
```

Pretty Printed:
```
{
"type":"Host",
"type":"host",
"fqdn":"example.acme.com",
"ip":"192.168.0.1",
"domain":"acme.com",
Expand Down
26 changes: 13 additions & 13 deletions Host.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
### Host
### host

The `Host` object SHALL be used to describe a specific profile of a computer. There MAY be multiple `Host` objects to a single device, or multiple devices to a single `Host` as is seen fit by the user. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below.
The `host` object SHALL be used to describe a specific profile of a computer. There MAY be multiple `host` objects to a single device, or multiple devices to a single `host` as is seen fit by the user. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below.

The `Host` object has the following attributes defined:
* `type`* - MUST be the type of object. In this case, `Host`
* `fqdn`** - MUST be the FQDN (Fully Qualified Domain Name) that resolves to this `Host`
* `ip`** - MUST be the IPv4 or IPv6 address to route to this `Host`
* `domain` - MUST be the [second-level domain](https://en.wikipedia.org/wiki/Second-level_domain) for this `Host`
* `company` - MUST be the company which owns this `Host`
* `dns` - MUST be the [`DNS`](DNS.md) object(s) that describe(s) this `Host`
* `ports` - MUST be a map (key-value pair) with two keys: `tcp` and `udp`. These two keys MUST have values which are also maps (key-value pairs) which correlate a single number between 0-65535 (representing a port) to a [`Service`](Service.md) object (NOTE: Since JSON doesn't allow numbers to be keys, a string representation of the number must be used). If a port is closed, then it SHOULD NOT have an entry in the key-value pair under its respective `tcp` or `udp` designation. However, in the circumstance that data needs to be stored on a port that was open and is now closed, the [`Service`](Service.md) object's `active` attribute should be used to delimit that the port is closed. If a port is open, but no [`Service`](Service.md) object has been constructed, it should be left with a blank object `{}`. Otherwise, the port's value pair MUST point to its respective [`Service`](Service.md) object.
The `host` object has the following attributes defined:
* `type`* - MUST be the type of object. In this case, `host`
* `fqdn`** - MUST be the FQDN (Fully Qualified Domain Name) that resolves to this `host`
* `ip`** - MUST be the IPv4 or IPv6 address to route to this `host`
* `domain` - MUST be the [second-level domain](https://en.wikipedia.org/wiki/Second-level_domain) for this `host`
* `company` - MUST be the company which owns this `host`
* `dns` - MUST be the [`DNS`](DNS.md) object(s) that describe(s) this `host`
* `ports` - MUST be a map (key-value pair) with two keys: `tcp` and `udp`. These two keys MUST have values which are also maps (key-value pairs) which correlate a single number between 0-65535 (representing a port) to a [`service`](Service.md) object (NOTE: Since JSON doesn't allow numbers to be keys, a string representation of the number must be used). If a port is closed, then it SHOULD NOT have an entry in the key-value pair under its respective `tcp` or `udp` designation. However, in the circumstance that data needs to be stored on a port that was open and is now closed, the [`service`](Service.md) object's `active` attribute should be used to delimit that the port is closed. If a port is open, but no [`service`](Service.md) object has been constructed, it should be left with a blank object `{}`. Otherwise, the port's value pair MUST point to its respective [`service`](Service.md) object.

\* Required attributes
\*\* At least one of these attributes is required
Expand All @@ -18,7 +18,7 @@ Example:

```
[
{"type":"Host","fqdn":"example.acme.com","ip":"192.168.0.1","domain":"acme.com","company":"Acme","dns":{...},"ports":{"tcp":{"80":{},"443":{"type":"Service","protocol":"https"}},"udp":{...}}}
{"type":"host","fqdn":"example.acme.com","ip":"192.168.0.1","domain":"acme.com","company":"Acme","dns":{...},"ports":{"tcp":{"80":{},"443":{"type":"service","protocol":"https"}},"udp":{...}}}
]
```

Expand All @@ -27,7 +27,7 @@ Pretty Printed:
```
[
{
"type":"Host",
"type":"host",
"fqdn":"example.acme.com",
"ip":"192.168.0.1",
"domain":"acme.com",
Expand All @@ -36,7 +36,7 @@ Pretty Printed:
"ports":{
"tcp":{
"80":{},
"443":{"type":"Service", "protocol":"https"}
"443":{"type":"service", "protocol":"https"}
},
"udp":{...}
}
Expand Down
20 changes: 10 additions & 10 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,27 +9,27 @@ The internal structure of a ReconJSON file MUST be as follows:

```
[
{"type":"Host"},
{"type":"Host"},
{"type":"Host"},
{"type":"Host"}
{"type":"host"},
{"type":"host"},
{"type":"host"},
{"type":"host"}
]
```

The first line of a ReconJSON file MUST be a left bracket `[` (ASCII 91) and the last line MUST be a right bracket `]` (ASCII 93). In between these brackets MUST be one or more `Host` objects. These objects MUST be collapsed JSON objects stored on a single line. These lines MUST be separated by a comma `,` (ASCII 44) and a single linefeed character `\n` (ASCII 10). The `Host` object on the last line MUST NOT have a trailing comma `,` (ASCII 44), but MUST have a trailing linefeed character `\n` (ASCII 10).
The first line of a ReconJSON file MUST be a left bracket `[` (ASCII 91) and the last line MUST be a right bracket `]` (ASCII 93). In between these brackets MUST be one or more `host` objects. These objects MUST be collapsed JSON objects stored on a single line. These lines MUST be separated by a comma `,` (ASCII 44) and a single linefeed character `\n` (ASCII 10). The `host` object on the last line MUST NOT have a trailing comma `,` (ASCII 44), but MUST have a trailing linefeed character `\n` (ASCII 10).

This format is pure JSON, with the `Host` objects collapsed into a single line. The reasoning behind this decision is to provide a file that can easily be parsed by programming languages' JSON libraries while also producing a file that is grep-able and one which a simple `wc -l` command will immediately convey the correct number of hosts to the user (number of lines - 2).
This format is pure JSON, with the `host` objects collapsed into a single line. The reasoning behind this decision is to provide a file that can easily be parsed by programming languages' JSON libraries while also producing a file that is grep-able and one which a simple `wc -l` command will immediately convey the correct number of hosts to the user (number of lines - 2).

When placing data into arrays, the data SHOULD be sorted alphabetically (or numerically) if not otherwise specified.


## Types

The following types are defined within the ReconJSON standard:
* `Host`: The object used to describe a specific profile of a computer. For more details, see [Host.md](/Host.md)
* `DNS`: The object used to describe the DNS configuration of a specific `Host`. For more details, see [DNS.md](/DNS.md)
* `Service`: The object used to describe a specific program running on a port. For more details, see [Service.md](/Service.md)
* `ServiceDescriptor`: The object used to describe a specific attribute or configuration of the `Service` object. For more details, see both the `ServiceDescriptor` spec doc ([ServiceDescriptor.md](/ServiceDescriptor.md)) and the `ServiceDescriptors` folder ([ServiceDescriptors](/ServiceDescriptors))
* `host`: The object used to describe a specific profile of a computer. For more details, see [Host.md](/Host.md)
* `DNS`: The object used to describe the DNS configuration of a specific `host`. For more details, see [DNS.md](/DNS.md)
* `service`: The object used to describe a specific program running on a port. For more details, see [Service.md](/Service.md)
* `serviceDescriptor`: The object used to describe a specific attribute or configuration of the `service` object. For more details, see both the `serviceDescriptor` spec doc ([ServiceDescriptor.md](/ServiceDescriptor.md)) and the `ServiceDescriptors` folder ([ServiceDescriptors](/ServiceDescriptors))


## Contributing
Expand Down
20 changes: 10 additions & 10 deletions Service.md
Original file line number Diff line number Diff line change
@@ -1,31 +1,31 @@
### Service
### service

The `Service` object SHALL be used to describe a specific program running on a port. There MAY only be one [`Service`](Service.md) object per port in the [`Host`](Host.md) object's `port` attribute. `Service` objects MAY have child objects called `ServiceDescriptor`(s). These objects are defined in more detail in the `ServiceDescriptor.md` file, but they are generally used to give program specific information. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below.
The `service` object SHALL be used to describe a specific program running on a port. There MAY only be one [`service`](Service.md) object per port in the [`Host`](Host.md) object's `port` attribute. `service` objects MAY have child objects called `serviceDescriptor`(s). These objects are defined in more detail in the `ServiceDescriptor.md` file, but they are generally used to give program specific information. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below.

The `Service` object has the following attributes defined:
* `type`* - MUST be the type of object. In this case, `Service`
The `service` object has the following attributes defined:
* `type`* - MUST be the type of object. In this case, `service`
* `active` - MUST be the Boolean variable representing whether this service is active or not. `true` for active, `false` for inactive. If this value is not set, the service SHOULD be assumed to be be active.
* `protocol` - MUST be the protocol by which this `Service` communicates
* `banner` - MUST be the banner that identifies this `Service`
* `serviceDescriptors` - MUST be a key-value pairing of the `name` of a certain `ServiceDescriptor` IN THE SINGULAR to a list of these objects. This allows a user to quickly access only the `ServiceDescriptor` desired.
* `protocol` - MUST be the protocol by which this `service` communicates
* `banner` - MUST be the banner that identifies this `service`
* `serviceDescriptors` - MUST be a key-value pairing of the `name` of a certain `serviceDescriptor` IN THE SINGULAR to a list of these objects. This allows a user to quickly access only the `serviceDescriptor` desired.

\* Required attributes

Example:
```
{"type":"Service","protocol":"http","banner":"Apache 1.0","serviceDescriptors":{"httpUrl":[{"type":"ServiceDescriptor","path":"/test","screenshot":"/root/screenshots/screenshot.jpg","code":"200","content-type":"text/html","length":"1024"}]}}
{"type":"service","protocol":"http","banner":"Apache 1.0","serviceDescriptors":{"httpUrl":[{"type":"serviceDescriptor","path":"/test","screenshot":"/root/screenshots/screenshot.jpg","code":"200","content-type":"text/html","length":"1024"}]}}
```

Pretty Printed:
```
{
"type":"Service",
"type":"service",
"protocol":"http",
"banner":"Apache 1.0",
"serviceDescriptors":{
"httpUrl":[
{
"type":"ServiceDescriptor",
"type":"serviceDescriptor",
"name":"httpUrl",
"path":"/test",
"screenshot":"/root/screenshots/screenshot.jpg",
Expand Down
24 changes: 12 additions & 12 deletions ServiceDescriptor.md
Original file line number Diff line number Diff line change
@@ -1,32 +1,32 @@
### ServiceDescriptor
### serviceDescriptor

The `ServiceDescriptor` object SHALL be used to describe a specific attribute or configuration of the [`Service`](Service.md) object. There MAY be several `ServiceDescriptor` objects to a single [`Service`](Service.md) object. Since the `ServiceDescriptor` object is the object in which the specifics about programs are to be stored, it is impossible for the authors of this standard to construct a `ServiceDescriptor` object for each and every use case. As a result, community sourcing of this attribute is needed. There will be several `ServiceDescriptor` definitions in the `ServiceDescriptors` folder for basic use (HTTP(s) paths, HTTPS certs, and CSP Definitions) but more will be added as needed. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below or in another ServiceDescriptor spec doc.
The `serviceDescriptor` object SHALL be used to describe a specific attribute or configuration of the [`Service`](Service.md) object. There MAY be several `serviceDescriptor` objects to a single [`Service`](Service.md) object. Since the `serviceDescriptor` object is the object in which the specifics about programs are to be stored, it is impossible for the authors of this standard to construct a `serviceDescriptor` object for each and every use case. As a result, community sourcing of this attribute is needed. There will be several `serviceDescriptor` definitions in the `ServiceDescriptors` folder for basic use (HTTP(s) paths, HTTPS certs, and CSP Definitions) but more will be added as needed. If attribute values are not known, they MUST NOT be included unless specified otherwise in the description below or in another serviceDescriptor spec doc.

`ServiceDescriptor` objects SHOULD be returned in the context of a `Host > Port > Service`. However they MAY be returned by themselves. As such, `ServiceDescritors` SHOULD contain information to help identifiy which `Host`, `Port`, and `Service` to which they belong.
`serviceDescriptor` objects SHOULD be returned in the context of a `host > port > service`. However they MAY be returned by themselves. As such, `ServiceDescritors` SHOULD contain information to help identifiy which `host`, `port`, and `service` to which they belong.


The `ServiceDescriptor` object has the following attributes defined:
* `type`* - MUST be the type of object. In this case, `ServiceDescriptor`
* `name`* - MUST be a descriptive name of what data this `ServiceDescriptor` is describing
* Additional elements dynamic to service being described. See `ServiceDescriptors` folder for futher details.
The `serviceDescriptor` object has the following attributes defined:
* `type`* - MUST be the type of object. In this case, `serviceDescriptor`
* `name`* - MUST be a descriptive name of what data this `serviceDescriptor` is describing
* Additional elements dynamic to service being described. See `serviceDescriptors` folder for futher details.

\* Required attributes

Please note, the below example also includes a `Service` object for context.
Please note, the below example also includes a `service` object for context.
```
{"type":"Service","protocol":"http","banner":"Apache 1.0","serviceDescriptors":{"Directories":[{"type":"ServiceDescriptor","name":"Directories","path":"/test","screenshot":"/root/screenshots/screenshot.jpg","code":"200","content-type":"text/html","length":"1024"}]}}
{"type":"service","protocol":"http","banner":"Apache 1.0","serviceDescriptors":{"Directories":[{"type":"serviceDescriptor","name":"Directories","path":"/test","screenshot":"/root/screenshots/screenshot.jpg","code":"200","content-type":"text/html","length":"1024"}]}}
```

Pretty Printed:
```
{
"type":"Service",
"type":"service",
"protocol":"http",
"banner":"Apache 1.0",
"serviceDescriptors":{
"Paths":[
"paths":[
{
"type":"ServiceDescriptor",
"type":"serviceDescriptor",
"name":"Path",
"path":"/test",
"screenshot":"/root/screenshots/screenshot.jpg",
Expand Down
Loading