recog-intrigue 2.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/http_wwwauth.xml ADDED
@@ -0,0 +1,595 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="http_header.wwwauth" protocol="http" database_type="service" preference="0.85">
3
+ <!-- HTTP WWW-Authenticate headers are matched against these patterns to fingerprint HTTP servers. -->
4
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;access&quot;$">
5
+ <description>Cisco IOS 11.x</description>
6
+ <example>Basic realm="access"</example>
7
+ <param pos="0" name="service.vendor" value="Cisco"/>
8
+ <param pos="0" name="service.product" value="IOS"/>
9
+ <param pos="0" name="service.family" value="IOS"/>
10
+ <param pos="0" name="service.version" value="11"/>
11
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:11"/>
12
+ <param pos="0" name="os.vendor" value="Cisco"/>
13
+ <param pos="0" name="os.device" value="Router"/>
14
+ <param pos="0" name="os.family" value="IOS"/>
15
+ <param pos="0" name="os.product" value="IOS"/>
16
+ <param pos="0" name="os.version" value="11"/>
17
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:11"/>
18
+ <param pos="0" name="hw.vendor" value="Cisco"/>
19
+ <param pos="0" name="hw.device" value="Router"/>
20
+ </fingerprint>
21
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]15[ _]or[ _]view[ _]access&quot;$">
22
+ <description>Cisco IOS 12.x - view access variant</description>
23
+ <example>Basic realm="level_15 or view_access"</example>
24
+ <example>Basic realm="level_15_or_view_access"</example>
25
+ <param pos="0" name="service.vendor" value="Cisco"/>
26
+ <param pos="0" name="service.product" value="IOS"/>
27
+ <param pos="0" name="service.family" value="IOS"/>
28
+ <param pos="0" name="service.version" value="12"/>
29
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:12"/>
30
+ <param pos="0" name="os.vendor" value="Cisco"/>
31
+ <param pos="0" name="os.device" value="Router"/>
32
+ <param pos="0" name="os.family" value="IOS"/>
33
+ <param pos="0" name="os.product" value="IOS"/>
34
+ <param pos="0" name="os.version" value="12"/>
35
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:12"/>
36
+ <param pos="0" name="hw.vendor" value="Cisco"/>
37
+ <param pos="0" name="hw.device" value="Router"/>
38
+ </fingerprint>
39
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]\d\d?[ _]access&quot;$">
40
+ <description>Cisco IOS 12.x</description>
41
+ <example>Basic realm="level_15_access"</example>
42
+ <example>Basic realm="level 15 access"</example>
43
+ <param pos="0" name="service.vendor" value="Cisco"/>
44
+ <param pos="0" name="service.product" value="IOS"/>
45
+ <param pos="0" name="service.family" value="IOS"/>
46
+ <param pos="0" name="service.version" value="12"/>
47
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:12"/>
48
+ <param pos="0" name="os.vendor" value="Cisco"/>
49
+ <param pos="0" name="os.device" value="Router"/>
50
+ <param pos="0" name="os.family" value="IOS"/>
51
+ <param pos="0" name="os.product" value="IOS"/>
52
+ <param pos="0" name="os.version" value="12"/>
53
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:12"/>
54
+ <param pos="0" name="hw.vendor" value="Cisco"/>
55
+ <param pos="0" name="hw.device" value="Router"/>
56
+ </fingerprint>
57
+ <fingerprint pattern="^Basic realm=&quot;(NetVanta [^&quot;]+)&quot;$" certainty="1.0">
58
+ <description>ADTRAN Netvanta Router</description>
59
+ <example hw.product="NetVanta 1238 PoE">Basic realm=&quot;NetVanta 1238 PoE&quot;</example>
60
+ <param pos="0" name="os.device" value="Router"/>
61
+ <param pos="0" name="os.vendor" value="ADTRAN"/>
62
+ <param pos="0" name="os.family" value="NetVanta"/>
63
+ <param pos="0" name="hw.device" value="Router"/>
64
+ <param pos="0" name="hw.vendor" value="ADTRAN"/>
65
+ <param pos="0" name="hw.family" value="NetVanta"/>
66
+ <param pos="1" name="hw.product"/>
67
+ </fingerprint>
68
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;.*$">
69
+ <description>Generic Cisco CWMP/CPE equipment</description>
70
+ <example>Basic realm="Cisco_CCSP_CWMP_TCPCR"</example>
71
+ <param pos="0" name="hw.vendor" value="Cisco"/>
72
+ </fingerprint>
73
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;FW-1. Reason: no user Server &quot;$">
74
+ <description>Check Point FireWall-1</description>
75
+ <example>Basic realm="FW-1. Reason: no user Server "</example>
76
+ <param pos="0" name="service.vendor" value="Check Point"/>
77
+ <param pos="0" name="service.product" value="Firewall-1"/>
78
+ <param pos="0" name="service.family" value="Firewall-1"/>
79
+ <param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
80
+ <param pos="0" name="os.vendor" value="Check Point"/>
81
+ <param pos="0" name="os.device" value="Firewall"/>
82
+ <param pos="0" name="os.family" value="Firewall-1"/>
83
+ <param pos="0" name="os.product" value="Firewall-1"/>
84
+ </fingerprint>
85
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;.*">
86
+ <description>cPanel</description>
87
+ <example>Basic realm="cPanel"</example>
88
+ <param pos="0" name="service.vendor" value="cPanel"/>
89
+ <param pos="0" name="service.product" value="cPanel"/>
90
+ </fingerprint>
91
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;APC Management Card&quot;$">
92
+ <description>APC device</description>
93
+ <example>Basic realm="APC Management Card"</example>
94
+ <param pos="0" name="service.vendor" value="APC"/>
95
+ <param pos="0" name="service.product" value="HTTP"/>
96
+ <param pos="0" name="os.vendor" value="APC"/>
97
+ <param pos="0" name="os.device" value="Power device"/>
98
+ </fingerprint>
99
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
100
+ <description>Generic ADSL modems/routers</description>
101
+ <example>Basic realm="ADSL Modem"</example>
102
+ <example>Basic realm="ADSL Modem/Router"</example>
103
+ <example>Basic realm="ADSL Router"</example>
104
+ <example>Basic realm="ADSL2+ Router"</example>
105
+ <param pos="0" name="hw.device" value="ADSL Modem"/>
106
+ </fingerprint>
107
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;.*$">
108
+ <description>Generic Broadband modems/routers</description>
109
+ <example>Basic realm="Broadband Router"</example>
110
+ <param pos="0" name="hw.device" value="Broadband router"/>
111
+ </fingerprint>
112
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
113
+ <description>Generic DSL modems/routers</description>
114
+ <example>Basic realm="DSL Modem"</example>
115
+ <param pos="0" name="hw.device" value="DSL Modem"/>
116
+ </fingerprint>
117
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;.*$">
118
+ <description>Generic DVR</description>
119
+ <example>Basic realm="DVR"</example>
120
+ <param pos="0" name="hw.device" value="DVR"/>
121
+ </fingerprint>
122
+ <!-- Hikvision is OEMd by a number of DVR manufacturers -->
123
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;.*$">
124
+ <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
125
+ <example>Basic realm="hikvision"</example>
126
+ <param pos="0" name="service.vendor" value="Hikvision"/>
127
+ <param pos="0" name="service.product" value="Hikvision Web Server"/>
128
+ <param pos="0" name="os.vendor" value="Hikvision"/>
129
+ <param pos="0" name="os.device" value="DVR"/>
130
+ <param pos="0" name="hw.device" value="DVR"/>
131
+ </fingerprint>
132
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;.*$">
133
+ <description>Merit LILIN generic device</description>
134
+ <example>Basic realm="Merit LILIN Ent. Co., Ltd,"</example>
135
+ <example>Basic realm="Merit LILIN Ent. Co., Ltd."</example>
136
+ <param pos="0" name="hw.vendor" value="Merit LILIN"/>
137
+ </fingerprint>
138
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;.*$">
139
+ <description>Generic WAP</description>
140
+ <example>Basic realm="Wireless Access Point"</example>
141
+ <param pos="0" name="hw.device" value="WAP"/>
142
+ </fingerprint>
143
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;.*$">
144
+ <description>Generic IP Cameras</description>
145
+ <example>Basic realm="camera"</example>
146
+ <example>Basic realm="IPCamera Login"</example>
147
+ <example>Basic realm="Mini Dome IP Camera"</example>
148
+ <param pos="0" name="hw.device" value="Web cam"/>
149
+ </fingerprint>
150
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
151
+ <description>D-Link DCS IP Cameras</description>
152
+ <example hw.product="DCS-5222LB1">Basic realm="DCS-5222LB1"</example>
153
+ <example hw.product="DCS-2530L">Basic realm="DCS-2530L"</example>
154
+ <param pos="0" name="hw.vendor" value="D-Link"/>
155
+ <param pos="0" name="hw.device" value="Web cam"/>
156
+ <param pos="1" name="hw.product"/>
157
+ </fingerprint>
158
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
159
+ <description>GoAhead webserver</description>
160
+ <example>Basic realm="GoAhead"</example>
161
+ <param pos="0" name="service.vendor" value="Oracle"/>
162
+ <param pos="0" name="service.product" value="GoAhead Webserver"/>
163
+ <param pos="0" name="service.family" value="GoAhead Webserver"/>
164
+ </fingerprint>
165
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
166
+ <description>Kubernetes master nodes</description>
167
+ <example>Basic realm="kubernetes-master"</example>
168
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
169
+ </fingerprint>
170
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
171
+ <description>Netgear Orbi</description>
172
+ <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
173
+ <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
174
+ <param pos="0" name="hw.vendor" value="Netgear"/>
175
+ <param pos="0" name="hw.device" value="WAP"/>
176
+ <param pos="0" name="hw.family" value="Orbi"/>
177
+ <param pos="1" name="hw.product"/>
178
+ </fingerprint>
179
+ <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
180
+ <description>Ruijie Networks generic</description>
181
+ <example>Digest realm="RUIJIE-CPE"</example>
182
+ <param pos="0" name="hw.vendor" value="Ruijie"/>
183
+ </fingerprint>
184
+ <fingerprint pattern="^Basic realm=&quot;SpeedTouch&quot;$">
185
+ <description>Thomson SpeedTouch xDSL router - short variant</description>
186
+ <example>Basic realm="SpeedTouch"</example>
187
+ <param pos="0" name="service.vendor" value="Thomson"/>
188
+ <param pos="0" name="service.product" value="SpeedTouch"/>
189
+ <param pos="0" name="service.family" value="SpeedTouch"/>
190
+ <param pos="0" name="os.vendor" value="Thomson"/>
191
+ <param pos="0" name="os.device" value="Broadband router"/>
192
+ <param pos="0" name="os.family" value="SpeedTouch"/>
193
+ <param pos="0" name="hw.vendor" value="Thomson"/>
194
+ <param pos="0" name="hw.family" value="SpeedTouch"/>
195
+ <param pos="0" name="hw.device" value="Broadband router"/>
196
+ </fingerprint>
197
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch \(([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2})\)&quot;$">
198
+ <description>Thomson SpeedTouch xDSL router</description>
199
+ <example host.mac="00-90-D0-F9-91-52">Basic realm="SpeedTouch (00-90-D0-F9-91-52)"</example>
200
+ <param pos="0" name="service.vendor" value="Thomson"/>
201
+ <param pos="0" name="service.product" value="SpeedTouch"/>
202
+ <param pos="0" name="service.family" value="SpeedTouch"/>
203
+ <param pos="0" name="os.vendor" value="Thomson"/>
204
+ <param pos="0" name="os.device" value="Broadband router"/>
205
+ <param pos="0" name="os.family" value="SpeedTouch"/>
206
+ <param pos="0" name="os.product" value="SpeedTouch"/>
207
+ <param pos="0" name="hw.vendor" value="Thomson"/>
208
+ <param pos="0" name="hw.family" value="SpeedTouch"/>
209
+ <param pos="0" name="hw.device" value="Broadband router"/>
210
+ <param pos="1" name="host.mac"/>
211
+ </fingerprint>
212
+ <!--
213
+ Really need some examples for the fingerprints below. The regex and params
214
+ imply that the nonce inlcudes the MAC address.
215
+ -->
216
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
217
+ <description>Thomson SpeedTouch xDSL router - qop variant</description>
218
+ <param pos="0" name="service.vendor" value="Thomson"/>
219
+ <param pos="0" name="service.product" value="SpeedTouch"/>
220
+ <param pos="0" name="service.family" value="SpeedTouch"/>
221
+ <param pos="0" name="os.vendor" value="Thomson"/>
222
+ <param pos="0" name="os.device" value="Broadband router"/>
223
+ <param pos="0" name="os.family" value="SpeedTouch"/>
224
+ <param pos="0" name="os.product" value="SpeedTouch"/>
225
+ <param pos="0" name="hw.vendor" value="Thomson"/>
226
+ <param pos="0" name="hw.family" value="SpeedTouch"/>
227
+ <param pos="0" name="hw.device" value="Broadband router"/>
228
+ <param pos="1" name="host.mac"/>
229
+ </fingerprint>
230
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ST (\d+) R 5.x Telecom Italia&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
231
+ <description>Thomson SpeedTouch xDSL router - Telecom Italia</description>
232
+ <param pos="0" name="service.vendor" value="Thomson"/>
233
+ <param pos="0" name="service.product" value="SpeedTouch"/>
234
+ <param pos="0" name="service.family" value="SpeedTouch"/>
235
+ <param pos="0" name="os.vendor" value="Thomson"/>
236
+ <param pos="0" name="os.device" value="Broadband router"/>
237
+ <param pos="0" name="os.family" value="SpeedTouch"/>
238
+ <param pos="0" name="hw.vendor" value="Thomson"/>
239
+ <param pos="0" name="hw.family" value="SpeedTouch"/>
240
+ <param pos="0" name="hw.device" value="Broadband router"/>
241
+ <param pos="1" name="os.product"/>
242
+ <param pos="2" name="host.mac"/>
243
+ </fingerprint>
244
+ <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;.*$">
245
+ <description>Thomson generic devices</description>
246
+ <example>Digest realm="Thomson Gateway"</example>
247
+ <example>Basic realm="Thomson"</example>
248
+ <param pos="0" name="hw.vendor" value="Thomson"/>
249
+ <param pos="0" name="hw.device" value="Broadband router"/>
250
+ </fingerprint>
251
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
252
+ <description>Huawei xDSL routers</description>
253
+ <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
254
+ <param pos="0" name="service.vendor" value="Huawei"/>
255
+ <param pos="0" name="service.family" value="MT"/>
256
+ <param pos="1" name="service.product"/>
257
+ <param pos="0" name="os.vendor" value="Huawei"/>
258
+ <param pos="0" name="os.device" value="Broadband router"/>
259
+ <param pos="0" name="os.family" value="MT"/>
260
+ <param pos="1" name="os.product"/>
261
+ <param pos="0" name="hw.vendor" value="Huawei"/>
262
+ <param pos="0" name="hw.device" value="Broadband router"/>
263
+ <param pos="0" name="hw.family" value="MT"/>
264
+ <param pos="1" name="hw.product"/>
265
+ </fingerprint>
266
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;.*$">
267
+ <description>Huawei Home Gateway Routers</description>
268
+ <example>Basic realm="HuaweiHomeGateway"</example>
269
+ <param pos="0" name="hw.vendor" value="Huawei"/>
270
+ <param pos="0" name="hw.device" value="Broadband router"/>
271
+ <param pos="0" name="hw.product" value="Home Gateway"/>
272
+ </fingerprint>
273
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;.*$">
274
+ <description>Huawei EchoLife Home Gateways</description>
275
+ <example>Basic realm="EchoLife Portal de Inicio"</example>
276
+ <example>Basic realm="EchoLife Home Gateway"</example>
277
+ <param pos="0" name="hw.vendor" value="Huawei"/>
278
+ <param pos="0" name="hw.device" value="Broadband router"/>
279
+ <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
280
+ </fingerprint>
281
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
282
+ <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
283
+ <example hw.product="WRT54G">Basic realm="WRT54G"</example>
284
+ <example hw.product="WRT54GL">Basic realm="WRT54GL"</example>
285
+ <example hw.product="WRT54GSV4">Basic realm="WRT54GSV4"</example>
286
+ <example hw.product="WRT54GCv3">Basic realm="WRT54GCv3"</example>
287
+ <param pos="0" name="os.vendor" value="Linksys"/>
288
+ <param pos="0" name="os.device" value="WAP"/>
289
+ <param pos="1" name="os.product"/>
290
+ <param pos="0" name="hw.vendor" value="Linksys"/>
291
+ <param pos="0" name="hw.device" value="WAP"/>
292
+ <param pos="1" name="hw.product"/>
293
+ </fingerprint>
294
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
295
+ <description>TP-LINK SoHo Router - dash variant</description>
296
+ <example>Basic realm="TD-W8901G"</example>
297
+ <example>Basic realm="TD-8840T 2.0"</example>
298
+ <example>Basic realm="TD-8811"</example>
299
+ <param pos="0" name="os.vendor" value="TP-LINK"/>
300
+ <param pos="0" name="os.device" value="Router"/>
301
+ <param pos="1" name="os.product"/>
302
+ </fingerprint>
303
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
304
+ <description>TP-LINK SoHo Router</description>
305
+ <example>Basic realm="TD854W"</example>
306
+ <example>Basic realm="TD811"</example>
307
+ <example>Basic realm="TD821"</example>
308
+ <example>Basic realm="TD841"</example>
309
+ <param pos="0" name="os.vendor" value="TP-LINK"/>
310
+ <param pos="0" name="os.device" value="Router"/>
311
+ <param pos="1" name="os.product"/>
312
+ </fingerprint>
313
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
314
+ <description>TP-LINK SoHo Router - verbose variant</description>
315
+ <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
316
+ <example>Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
317
+ <example>Basic realm="TP-LINK Wireless Range Extender WA850RE"</example>
318
+ <example>Basic realm="TP-LINK Wireless AP WA501G"</example>
319
+ <example>Basic realm="TP-LINK Wireless N Access Point WA701ND"</example>
320
+ <example>Basic realm="TP-LINK Wireless N Access Point WA901ND"</example>
321
+ <example>Basic realm="TP-LINK Wireless AP WA601G"</example>
322
+ <example>Basic realm="TP-LINK Wireless AP WR710N"</example>
323
+ <example>Basic realm="TP-LINK Wireless AP WR700N"</example>
324
+ <example>Basic realm="TP-LINK Wireless Range Extender WA750RE"</example>
325
+ <example>Basic realm="TP-LINK Wireless AP WR702N"</example>
326
+ <example>Basic realm="TP-LINK Wireless AP WR800N"</example>
327
+ <example>Basic realm="TP-LINK Wireless Range Extender WA730RE"</example>
328
+ <example>Basic realm="TP-LINK Wireless N Access Point WA805N"</example>
329
+ <example>Basic realm="TP-LINK Wireless N Access Point WA701N"</example>
330
+ <example>Basic realm="TP-LINK Wireless AP WR706N"</example>
331
+ <param pos="0" name="os.vendor" value="TP-LINK"/>
332
+ <param pos="0" name="os.device" value="WAP"/>
333
+ <param pos="1" name="os.product"/>
334
+ </fingerprint>
335
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
336
+ <description>TP-LINK Routers</description>
337
+ <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
338
+ <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
339
+ <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
340
+ <param pos="0" name="hw.vendor" value="TP-Link"/>
341
+ <param pos="0" name="hw.device" value="Router"/>
342
+ <param pos="1" name="hw.product"/>
343
+ </fingerprint>
344
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;.*$">
345
+ <description>TP-LINK IP-Cameras</description>
346
+ <example>Basic realm="TP-LINK IP-Camera"</example>
347
+ <param pos="0" name="hw.vendor" value="TP-Link"/>
348
+ <param pos="0" name="hw.device" value="Web cam"/>
349
+ </fingerprint>
350
+ <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
351
+ <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>
352
+ <example>Digest qop="auth", realm="Broadcom Management Service", nonce="AAAAAAAAAAAAAP//DwHpMwYy1zc=", algorithm="MD5"</example>
353
+ <param pos="0" name="service.vendor" value="Broadcom"/>
354
+ <param pos="0" name="service.product" value="Management Service"/>
355
+ </fingerprint>
356
+ <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;.*$">
357
+ <description>Samba Web Administration Tool (SWAT)</description>
358
+ <example>Basic realm="SWAT"</example>
359
+ <param pos="0" name="service.vendor" value="Samba"/>
360
+ <param pos="0" name="service.family" value="Samba"/>
361
+ <param pos="0" name="service.product" value="SWAT"/>
362
+ </fingerprint>
363
+ <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
364
+ <description>SPIP publishing system (www.spip.net)</description>
365
+ <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
366
+ <param pos="0" name="service.vendor" value="SPIP"/>
367
+ <param pos="0" name="service.product" value="SPIP"/>
368
+ <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
369
+ </fingerprint>
370
+ <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
371
+ <description>HP Instant Support Enterprise Edition with a hostname</description>
372
+ <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
373
+ <param pos="0" name="service.vendor" value="HP"/>
374
+ <param pos="0" name="service.product" value="ISEE"/>
375
+ <param pos="1" name="host.name"/>
376
+ </fingerprint>
377
+ <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
378
+ <description>Generic F5 Big-IP</description>
379
+ <example>Basic realm="BIG-IP"</example>
380
+ <param pos="0" name="service.vendor" value="F5"/>
381
+ <param pos="0" name="service.family" value="BIG-IP"/>
382
+ <param pos="0" name="service.product" value="BIG-IP LTM"/>
383
+ <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
384
+ </fingerprint>
385
+ <!-- HP ProCurve -->
386
+ <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[3]\d{3}A)&quot;$">
387
+ <description>HP ProCurve Hubs</description>
388
+ <example os.product="J3295A">Basic realm="HP J3295A"</example>
389
+ <param pos="0" name="os.vendor" value="HP"/>
390
+ <param pos="0" name="os.family" value="ProCurve"/>
391
+ <param pos="0" name="os.device" value="Hub"/>
392
+ <param pos="1" name="os.product"/>
393
+ </fingerprint>
394
+ <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[489]\d{3}A)&quot;$">
395
+ <description>HP ProCurve Switches</description>
396
+ <example os.product="J4110A">Basic realm="HP J4110A"</example>
397
+ <example os.product="J8164A">Basic realm="ProCurve J8164A"</example>
398
+ <example os.product="J8165A">Basic realm="HP J8165A"</example>
399
+ <example os.product="J9021A">Basic realm="HP J9021A"</example>
400
+ <param pos="0" name="os.vendor" value="HP"/>
401
+ <param pos="0" name="os.family" value="ProCurve"/>
402
+ <param pos="0" name="os.device" value="Switch"/>
403
+ <param pos="1" name="os.product"/>
404
+ </fingerprint>
405
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;.*$">
406
+ <description>Assorted Sercomm CPE devices</description>
407
+ <example>Digest realm="SERCOMM CPE Authentication"</example>
408
+ <param pos="0" name="hw.vendor" value="Sercomm"/>
409
+ </fingerprint>
410
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;.*$">
411
+ <description>Tivo DVR</description>
412
+ <example>Digest realm="TiVo DVR"</example>
413
+ <param pos="0" name="hw.vendor" value="Tivo"/>
414
+ <param pos="0" name="hw.family" value="DVR"/>
415
+ <param pos="0" name="hw.device" value="DVR"/>
416
+ </fingerprint>
417
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;.*$">
418
+ <description>Ubee Cable Modems</description>
419
+ <example>Digest qop="auth", realm="Ubee", nonce="1544738973"</example>
420
+ <param pos="0" name="hw.vendor" value="Ubee"/>
421
+ <param pos="0" name="hw.device" value="Broadband router"/>
422
+ </fingerprint>
423
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;XDB&quot;$">
424
+ <description>Web server providing web services for Oracle's XML DB.</description>
425
+ <example>Basic realm="XDB"</example>
426
+ <param pos="0" name="service.vendor" value="Oracle"/>
427
+ <param pos="0" name="service.product" value="XML DB"/>
428
+ <param pos="0" name="service.family" value="Oracle"/>
429
+ </fingerprint>
430
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;.*$">
431
+ <description>Assorted ZTE CPE devices</description>
432
+ <example>Digest realm="cpe@zte.com"</example>
433
+ <param pos="0" name="hw.vendor" value="ZTE"/>
434
+ </fingerprint>
435
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;.*$">
436
+ <description>ZTE ZXHN router</description>
437
+ <example>Basic realm="ZXHN H108L"</example>
438
+ <param pos="0" name="hw.vendor" value="ZTE"/>
439
+ <param pos="0" name="hw.device" value="Router"/>
440
+ <param pos="0" name="hw.family" value="ZXHN"/>
441
+ <param pos="1" name="hw.product"/>
442
+ </fingerprint>
443
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;.*$">
444
+ <description>ZTE ZXV router</description>
445
+ <example hw.product="ZXV10 W300">Basic realm="ZXV10 W300"</example>
446
+ <param pos="0" name="hw.vendor" value="ZTE"/>
447
+ <param pos="0" name="hw.device" value="Router"/>
448
+ <param pos="0" name="hw.family" value="ZXV"/>
449
+ <param pos="1" name="hw.product"/>
450
+ </fingerprint>
451
+ <!-- a variety of headers we currently just ignore -->
452
+ <fingerprint pattern="(?i)^NTLM$">
453
+ <description>Ignore NTLM-only</description>
454
+ <example>NTLM</example>
455
+ <example>Ntlm</example>
456
+ </fingerprint>
457
+ <fingerprint pattern="^Negotiate$">
458
+ <description>Ignore Negotiate-only</description>
459
+ <example>Negotiate</example>
460
+ </fingerprint>
461
+ <!--
462
+ Using a wildcard . instead of ['&quot;] in the following line will result in
463
+ this fingerprint matching examples from other fingerprints.
464
+ -->
465
+ <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
466
+ <description>Ignore null/empty/period/index.</description>
467
+ <example>Basic realm="null"</example>
468
+ <example>Basic realm="."</example>
469
+ <example>Basic realm=""</example>
470
+ <example>Basic realm="/"</example>
471
+ <example>Basic realm='/'</example>
472
+ <example>Basic realm="index.html"</example>
473
+ </fingerprint>
474
+ <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;.*$">
475
+ <description>Ignore realms with an IPv4 address</description>
476
+ <example>Basic realm="192.168.0.1"</example>
477
+ <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
478
+ </fingerprint>
479
+ <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;.*$">
480
+ <description>Ignore generic 'config' realms</description>
481
+ <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
482
+ </fingerprint>
483
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
484
+ <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
485
+ <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
486
+ <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
487
+ <param pos="0" name="service.product" value="RemoteView"/>
488
+ <param pos="0" name="service.family" value="RemoteView"/>
489
+ <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
490
+ <param pos="0" name="hw.family" value="Primergy"/>
491
+ <param pos="0" name="hw.product" value="Primergy"/>
492
+ <param pos="1" name="host.name"/>
493
+ </fingerprint>
494
+ <!--
495
+ Temporarily disable this version-less fingerprint because it overrode the
496
+ one in http_servers.xml (see NEX-1255).
497
+
498
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Lyris ListManager: enter email address and password&quot;$">
499
+ <description>Lyris ListManager</description>
500
+ <example>Basic realm="Lyris ListManager: enter email address and password"</example>
501
+ <param pos="0" name="service.vendor" value="Lyris"/>
502
+ <param pos="0" name="service.product" value="ListManager"/>
503
+ </fingerprint>
504
+ -->
505
+ <!--
506
+ Basic realm= StarVoice
507
+ Basic realm="802.11g Remote-Motion CCD Network Camera"
508
+ Basic realm="Access to Workgroup Switch FX5124"
509
+ Basic realm="ADSL Modem"
510
+ Basic realm="ADSL Modem/Router"
511
+ Basic realm="ADSL Router"
512
+ Basic realm="ADSL2+ Router"
513
+ // Nomadix Access Gateway (AG)
514
+ Basic realm="AG "
515
+ Basic realm="AG"
516
+ Basic realm="Broad Net Mux Corp."
517
+ Basic realm="Cayman-3000"
518
+ Basic realm="Cayman3000 "
519
+ Basic realm="Cayman3000"
520
+ Basic realm="ClubInternet"
521
+ Basic realm="Comcast Home Networking"
522
+ // MegaBit Gear TE xxxx
523
+ Basic realm="Config"
524
+ Basic realm="configuration"
525
+ Basic realm="Connecting to router"
526
+ Basic realm="DB102 ADSL 2/2+ Modem"
527
+ Basic realm="Default: admin/1234"
528
+ Basic realm="device"
529
+ Basic realm="DFL Admin Interface"
530
+ Basic realm="DI-804HV"
531
+ Basic realm="dreambox"
532
+ Basic Realm="DSL-500G Admin Login"
533
+ Basic Realm="DSL-500G"
534
+ Basic Realm="DSL-504G"
535
+ Basic realm="DSL Router"
536
+ Basic realm="DSL WLAN Modem 200"
537
+ Basic realm="Ecco Chimbote"
538
+ Basic realm="Efficient Networks Web User Interface"
539
+ Basic realm="General User"
540
+ Basic realm="geschuetzter Bereich"
541
+ Basic realm="Home Gateway"
542
+ Basic realm="iBoot"
543
+ Basic realm="IES-1000/SAM1008"
544
+ Basic realm="Instant Internet"
545
+ Basic realm="IR IP Camera"
546
+ Basic realm="Linksys BEFSR41/BEFSR11/BEFSRU31"
547
+ Basic realm="Login to the Router Web Configurator"
548
+ Basic realm="Login to Vigor 3300"
549
+ Basic realm="Login"
550
+ Basic realm="MR314"
551
+ Basic realm="NetComm NB1300"
552
+ Basic realm="NETGEAR DG834 "
553
+ Basic realm="NetLinx"
554
+ Basic realm="Netopia-2000"
555
+ Basic realm="Netopia-3000"
556
+ Basic realm="NXU-2"
557
+ Basic realm="OCR-812"
558
+ Basic realm="P653HWI-13"
559
+ Basic realm="Please enter your user name and password on DSL-502T"
560
+ Basic realm="pmdf1"
561
+ Basic realm="Prestige 643"
562
+ Basic realm="Prestige 650H-17"
563
+ Basic realm="Prestige 650H-E1"
564
+ Basic realm="Prestige 792H"
565
+ Basic realm="Private zone"
566
+ Basic realm="privileged access"
567
+ Basic realm="quenta"
568
+ Basic realm="Radware"
569
+ Basic realm="READONLY"
570
+ Basic realm="Roadside"
571
+ Basic realm="Siemens ADSL SL2-141-I"
572
+ Basic realm="Siemens Web User Interface"
573
+ Basic realm="System Configuration"
574
+ Basic realm="TrendChip ADSL Router"
575
+ Basic realm="USR ADSL Gateway"
576
+ Basic realm="Viking"
577
+ basic realm="Vina Technologies T1 Integrator"
578
+ Basic realm="WA3002-g1"
579
+ Basic realm="Web Management"
580
+ Basic realm="Web Manager"
581
+ Basic realm="WebAdmin"
582
+ Basic realm="Webr@cer 8001"
583
+ Basic realm="Wireless Access Point"
584
+ Basic realm="WL-5460AP v2"
585
+ Basic realm="WL500g.Premium"
586
+ Basic realm="WL500W"
587
+ Basic realm="XG6545p2 VoIP Gateway"
588
+ Digest realm="HiPER", domain="222.66.99.209", qop="auth", nonce="aa81b6584c4716f22f1d20e1747c5841", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5", stale="FALSE"
589
+ Digest realm="i3micro VRG", nonce="1186428394", qop="auth", algorithm=MD5
590
+ Digest realm="WatchGuard SOHO Configuration",qop="auth",nonce="7c8e98007db668881687bd538e6e8581"
591
+ -->
592
+ <!-- This is in various PHP coding examples, but is not a reliable FP source:
593
+ Basic realm="User Login"
594
+ -->
595
+ </fingerprints>