super simple fingerprinter for DCEPT cred serving server

dcept-fingerprint.rb

#!/usr/bin/env ruby
#Fingerprints SecureWorks DCEPT
#@atucom

require 'net/http'
require 'json'

if ARGV.empty?
    puts "Fingerprints destination HTTP service for DCEPT"
    puts "\t Usage: #{$0} IP[:port] "
else
  targethost = ARGV[0]
  random_string = (0...8).map { (65 + rand(26)).chr }.join
  uri = URI("http://#{targethost}/?machine=#{random_string}")
  http_body = Net::HTTP.get(uri)
  if http_body =~ /^\{'d'/
    http_body.gsub!("'",'"') #JSON parser expects everything inside doublequotes, not single
    http_body.gsub!(",p:",',"p":') #p var needs to be inside doublequotes as well
    parsed_json = JSON.load(http_body)
    if parsed_json.length <= 3 and parsed_json.has_key? 'u' and parsed_json.has_key? 'p'
      puts "#{targethost} - FOUND DCEPT"
    end
    else
      puts "#{targethost} - NOT DCEPT"
  end
end