Address Multiple Signature Matches (was: Broken signature)

[digininja]

OS Used - ALL Information (architecture, linux flavor, etc.)

Python version

The default credentials for phpIPAM come out like this in the report:

Default credentials: phpIPAM Admin / ipamadmin phpIPAM Admin / ipamadmin.

I had a look a the signature file but not sure what is happening with it so don't want to risk a broken PR trying to fix it.

[Relkci]

I think this is matching on two signatures:
signatures.txt line 353

placeholder="Username";id="username" name="ipamusername";class="login form-control input-sm"|phpIPAM Admin / ipamadmin

signatures.txt line 429

IP Management;d="username" name="ipamusername";name="ipampassword"|phpIPAM Admin / ipamadmin.

helper.py will return all matches, which is why the result looks duplicated.

            if all([x.lower() in http_object.source_code.decode().lower() for x in page_sig]):
                if http_object.default_creds is None:
                    http_object.default_creds = cred_info
                else:
                    http_object.default_creds += '\n' + cred_info

Two fixes seem reasonable:
Updating helpers.py to have a more clear delimter on multiple hits -- an output like this:

Match 1 :phpIPAM Admin / ipamadmin
Match 2: phpIPAM Admin / ipamadmin

Or, more pratically, we update the signature to be more conservative on the hit. The two signatures exist because the first had a false-negative. Perhaps the second signature is appropriately permissive, since it's hitting on both scenarios at least in this circumstance.

Probably need multiple phpIPAM version deployments to confirm.

My recommendation might to be either add a delimiter on the multiple-signature-hit in the output, or, do nothing and accept that sometimes we might have multiple sets of default creds resulting from multiple signature hits.