recog-intrigue 2.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
@@ -0,0 +1,245 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="imap4.banner" protocol="imap" database_type="service" preference="0.90">
3
+ <!-- IMAP banners are matched against these patterns to fingerprint IMAP servers. -->
4
+ <fingerprint pattern="^Microsoft Exchange IMAP4rev1 server version (5\.5\.\d{4}\.\d+) \((.*)\) ready$">
5
+ <description>Microsoft Exchange Server 5.5</description>
6
+ <example service.version="5.5.2448.8" host.name="foo.bar">Microsoft Exchange IMAP4rev1 server version 5.5.2448.8 (foo.bar) ready</example>
7
+ <param pos="0" name="service.vendor" value="Microsoft"/>
8
+ <param pos="0" name="service.family" value="Exchange Server"/>
9
+ <param pos="0" name="service.product" value="Exchange Server 5.5"/>
10
+ <param pos="1" name="service.version"/>
11
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
12
+ <param pos="0" name="os.vendor" value="Microsoft"/>
13
+ <param pos="0" name="os.family" value="Windows"/>
14
+ <param pos="0" name="os.product" value="Windows"/>
15
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
16
+ <param pos="2" name="host.name"/>
17
+ </fingerprint>
18
+ <fingerprint pattern="^Microsoft Exchange 2000 IMAP4rev1 server version (6\.0\.\d{4}\.\d+) \((.*)\) ready\.$">
19
+ <description>Microsoft Exchange Server 2000</description>
20
+ <example service.version="6.0.6249.0" host.name="foo.bar">Microsoft Exchange 2000 IMAP4rev1 server version 6.0.6249.0 (foo.bar) ready.</example>
21
+ <param pos="0" name="service.vendor" value="Microsoft"/>
22
+ <param pos="0" name="service.family" value="Exchange Server"/>
23
+ <param pos="0" name="service.product" value="Exchange 2000 Server"/>
24
+ <param pos="1" name="service.version"/>
25
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
26
+ <param pos="0" name="os.vendor" value="Microsoft"/>
27
+ <param pos="0" name="os.family" value="Windows"/>
28
+ <param pos="0" name="os.product" value="Windows"/>
29
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
30
+ <param pos="2" name="host.name"/>
31
+ </fingerprint>
32
+ <fingerprint pattern="^Microsoft Exchange Server 2003 IMAP4rev1 server version (6\.5\.\d{4}\.\d+) \((.*)\) ready\.$">
33
+ <description>Microsoft Exchange Server 2003</description>
34
+ <example service.version="6.5.7638.1" host.name="foo.bar">Microsoft Exchange Server 2003 IMAP4rev1 server version 6.5.7638.1 (foo.bar) ready.</example>
35
+ <param pos="0" name="service.vendor" value="Microsoft"/>
36
+ <param pos="0" name="service.family" value="Exchange Server"/>
37
+ <param pos="0" name="service.product" value="Exchange 2003 Server"/>
38
+ <param pos="1" name="service.version"/>
39
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
40
+ <param pos="0" name="os.vendor" value="Microsoft"/>
41
+ <param pos="0" name="os.family" value="Windows"/>
42
+ <param pos="0" name="os.product" value="Windows"/>
43
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
44
+ <param pos="2" name="host.name"/>
45
+ </fingerprint>
46
+ <fingerprint pattern="^Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version (6\.5\.\d{4}\.\d+) \((.*)\),.*$">
47
+ <description>Microsoft Exchange Server 2003, German</description>
48
+ <example service.version="6.5.7638.1" host.name="foo.bar">Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version 6.5.7638.1 (foo.bar), steht zur Verfgung.</example>
49
+ <param pos="0" name="service.vendor" value="Microsoft"/>
50
+ <param pos="0" name="service.family" value="Exchange Server"/>
51
+ <param pos="0" name="service.product" value="Exchange 2003 Server"/>
52
+ <param pos="1" name="service.version"/>
53
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
54
+ <param pos="0" name="os.vendor" value="Microsoft"/>
55
+ <param pos="0" name="os.family" value="Windows"/>
56
+ <param pos="0" name="os.product" value="Windows"/>
57
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
58
+ <param pos="2" name="host.name"/>
59
+ </fingerprint>
60
+ <fingerprint pattern="^Microsoft Exchange Server 2007 IMAP4 service ready$">
61
+ <description>Microsoft Exchange Server 2007</description>
62
+ <example>Microsoft Exchange Server 2007 IMAP4 service ready</example>
63
+ <param pos="0" name="service.vendor" value="Microsoft"/>
64
+ <param pos="0" name="service.family" value="Exchange Server"/>
65
+ <param pos="0" name="service.product" value="Exchange 2007 Server"/>
66
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
67
+ <param pos="0" name="os.vendor" value="Microsoft"/>
68
+ <param pos="0" name="os.family" value="Windows"/>
69
+ <param pos="0" name="os.product" value="Windows"/>
70
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
71
+ </fingerprint>
72
+ <fingerprint pattern="^The Microsoft Exchange IMAP4 service is ready\.?$">
73
+ <description>Microsoft Exchange Server</description>
74
+ <example>The Microsoft Exchange IMAP4 service is ready.</example>
75
+ <param pos="0" name="service.vendor" value="Microsoft"/>
76
+ <param pos="0" name="service.family" value="Exchange Server"/>
77
+ <param pos="0" name="service.product" value="Exchange Server"/>
78
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
79
+ <param pos="0" name="os.vendor" value="Microsoft"/>
80
+ <param pos="0" name="os.family" value="Windows"/>
81
+ <param pos="0" name="os.product" value="Windows"/>
82
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
83
+ </fingerprint>
84
+ <fingerprint pattern="^Domino IMAP4 Server Release (\d+\.\d+.*) ready (.+)$">
85
+ <description>IBM Lotus Notes/Domino</description>
86
+ <example service.version="9.0.1FP9" host.time="Thu, 4 Apr 2019 20:19:31 +0200">Domino IMAP4 Server Release 9.0.1FP9 ready Thu, 4 Apr 2019 20:19:31 +0200</example>
87
+ <param pos="0" name="service.vendor" value="IBM"/>
88
+ <param pos="0" name="service.family" value="Lotus Domino"/>
89
+ <param pos="0" name="service.product" value="Lotus Domino"/>
90
+ <param pos="1" name="service.version"/>
91
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
92
+ <param pos="2" name="host.time"/>
93
+ </fingerprint>
94
+ <fingerprint pattern="^Domino IMAP4 Server V\.?(\d+\.\d+.*) ready (.+)$">
95
+ <description>IBM Lotus Notes/Domino - variant 2</description>
96
+ <param pos="0" name="service.vendor" value="IBM"/>
97
+ <param pos="0" name="service.family" value="Lotus Domino"/>
98
+ <param pos="0" name="service.product" value="Lotus Domino"/>
99
+ <param pos="1" name="service.version"/>
100
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
101
+ <param pos="2" name="host.time"/>
102
+ </fingerprint>
103
+ <fingerprint pattern="^[dD]ovecot (?:DA )?ready\.$">
104
+ <description>Dovecot Secure IMAP Server</description>
105
+ <example>Dovecot ready.</example>
106
+ <example>Dovecot DA ready.</example>
107
+ <param pos="0" name="service.family" value="Dovecot"/>
108
+ <param pos="0" name="service.product" value="Dovecot"/>
109
+ </fingerprint>
110
+ <fingerprint pattern="^Courier-IMAP ready. Copyright \d+-\d+">
111
+ <description>Courier MTA IMAP</description>
112
+ <example>Courier-IMAP ready. Copyright 1998-2002 Double Precision, Inc. See COPYING for distribution information.</example>
113
+ <param pos="0" name="service.vendor" value="Double Precision"/>
114
+ <param pos="0" name="service.family" value="Courier MTA"/>
115
+ <param pos="0" name="service.product" value="Courier IMAP"/>
116
+ </fingerprint>
117
+ <fingerprint pattern="^(\S+) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
118
+ <description>Nortel CallPilot</description>
119
+ <example>nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
120
+ <example>test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
121
+ <param pos="0" name="service.vendor" value="Nortel"/>
122
+ <param pos="0" name="service.product" value="CallPilot"/>
123
+ <param pos="2" name="service.version"/>
124
+ <param pos="0" name="service.cpe23" value="cpe:/a:nortel:callpilot:{service.version}"/>
125
+ <param pos="1" name="host.name"/>
126
+ </fingerprint>
127
+ <fingerprint pattern="^(\S+) Zimbra IMAP4rev1 server ready\.?$">
128
+ <description>VMware Zimbra IMAP</description>
129
+ <example host.name="foo.bar">foo.bar Zimbra IMAP4rev1 server ready</example>
130
+ <param pos="0" name="service.vendor" value="VMware"/>
131
+ <param pos="0" name="service.product" value="Zimbra"/>
132
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:-"/>
133
+ <param pos="1" name="host.name"/>
134
+ </fingerprint>
135
+ <fingerprint pattern="^(\S+) Zimbra (\S+) IMAP4rev1 server ready\.?$">
136
+ <description>VMware Zimbra IMAP with service version</description>
137
+ <example host.name="foo.bar" service.version="7.0.0_GA_3079">foo.bar Zimbra 7.0.0_GA_3079 IMAP4rev1 server ready</example>
138
+ <param pos="0" name="service.vendor" value="VMware"/>
139
+ <param pos="0" name="service.product" value="Zimbra"/>
140
+ <param pos="2" name="service.version"/>
141
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:{service.version}"/>
142
+ <param pos="1" name="host.name"/>
143
+ </fingerprint>
144
+ <fingerprint pattern="^(.+) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
145
+ <description>CMU Cyrus IMAP on Mac OS X</description>
146
+ <example host.name="example.com" service.version="2.2.12" os.version="10.4.0">example.com Cyrus IMAP4 v2.2.12-OS X 10.4.0 server ready</example>
147
+ <example host.name="example.com" service.version="2.3.8" os.version="10.5">example.com Cyrus IMAP4 v2.3.8-OS X Server 10.5: 9A562 server ready</example>
148
+ <param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
149
+ <param pos="0" name="service.family" value="Cyrus MTA"/>
150
+ <param pos="0" name="service.product" value="Cyrus IMAP"/>
151
+ <param pos="2" name="service.version"/>
152
+ <param pos="0" name="os.vendor" value="Apple"/>
153
+ <param pos="0" name="os.family" value="Mac OS X"/>
154
+ <param pos="0" name="os.product" value="Mac OS X"/>
155
+ <param pos="3" name="os.version"/>
156
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:{os.version}"/>
157
+ <param pos="1" name="host.name"/>
158
+ </fingerprint>
159
+ <fingerprint pattern="^(.+) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
160
+ <description>CMU Cyrus IMAP</description>
161
+ <example host.name="example.com" service.version="2.3.7">example.com Cyrus IMAP4 v2.3.7 server ready</example>
162
+ <example host.name="example.com" service.version="2.4.8-Invoca-RPM-2.4.8-1">example.com Cyrus IMAP Murder v2.4.8-Invoca-RPM-2.4.8-1 server ready</example>
163
+ <param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
164
+ <param pos="0" name="service.family" value="Cyrus MTA"/>
165
+ <param pos="0" name="service.product" value="Cyrus IMAP"/>
166
+ <param pos="2" name="service.version"/>
167
+ <param pos="1" name="host.name"/>
168
+ </fingerprint>
169
+ <!--
170
+
171
+ // Washington University imapd
172
+ IMAP_FP_PARSERS[0] = new PatternParser(
173
+ "^IMAP4rev1 v(.*) server ready$");
174
+ IMAP_FP_PARSERS[0].addConstantParam("product", "wu-imapd");
175
+ IMAP_FP_PARSERS[0].addParamSpec(1, "version");
176
+
177
+ // Washington University imapd (newer versions)
178
+ IMAP_FP_PARSERS[1] = new PatternParser(
179
+ "^IMAP4rev1 (.*) at (.*)$");
180
+ IMAP_FP_PARSERS[1].addConstantParam("product", "wu-imapd");
181
+ IMAP_FP_PARSERS[1].addParamSpec(1, "version");
182
+ IMAP_FP_PARSERS[1].addParamSpec(2, "server-time");
183
+
184
+ // University of Washington IMAP (imap-uw)
185
+ * OK <host> IMAP4rev1 2001.315 at Fri, 20 Jul 2007 21:51:34 -0700 (PDT)
186
+ * OK <host> IMAP4rev1 2001.315rh at Mon, 23 Jul 2007 07:56:09 -0500 (CDT)
187
+ * OK <host> IMAP4rev1 2004.357-p2k server ready at Mon, 23 Jul 2007 01:56:26 -0400 (EDT)
188
+ * OK <host> IMAP4rev1 2004.357s at Mon, 23 Jul 2007 15:17:56 +0000 (GMT)
189
+ * OK <host> IMAP4rev1 2004.357w at Tue, 24 Jul 2007 19:36:11 -0600 (MDT)
190
+
191
+ // cPanel Hosting Automation
192
+ // 10.8.0 (build 89) - BETA Tree - Change the imap version from 2003.339-cpanel to 2003.339p-cpanel to indicate the security patch has been applied.
193
+ // The patch has still be applied to 1.8.0 build 60+, we just show this now to avoid confusion.
194
+ * OK <host> IMAP4rev1 2003.339-cpanel at Sun, 22 Jul 2007 07:35:36 -0500 (CDT)
195
+ * OK <host> IMAP4rev1 2003.339p-cpanel at Sun, 22 Jul 2007 13:09:04 -0500 (CDT)
196
+
197
+ // PMDF IMAP
198
+ // * OK <system> PMDF IMAP4rev1 V6.1 (Message store V6.1)
199
+ // * OK xxx PMDF IMAP4rev1 V6.0-24 (Message store V6.0-24)
200
+ // * OK xxx PMDF IMAP4rev1 V6.0-9
201
+ IMAP_FP_PARSERS[5] = new PatternParser(
202
+ "^([^\\s]+) PMDF IMAP4rev1 V([^\\s]+).*$");
203
+ IMAP_FP_PARSERS[5].addConstantParam("product", "PMDF");
204
+ IMAP_FP_PARSERS[5].addParamSpec(1, "hostname");
205
+ IMAP_FP_PARSERS[5].addParamSpec(2, "version");
206
+
207
+ // PMDF IMAP (for VMS v7.1-2!)
208
+ IMAP_FP_PARSERS[6] = new PatternParser(
209
+ "^IMAP4 Server PMDF(.*) at (.*)$");
210
+ IMAP_FP_PARSERS[6].addConstantParam("product", "PMDF");
211
+ IMAP_FP_PARSERS[6].addParamSpec(1, "version");
212
+ IMAP_FP_PARSERS[6].addParamSpec(2, "server-time");
213
+
214
+ // Eudora Internet Mail Server
215
+ IMAP_FP_PARSERS[7] = new PatternParser(
216
+ "^Eudora Internet Mail Server (.*) .*$");
217
+ IMAP_FP_PARSERS[7].addConstantParam("product", "eudoraims");
218
+ IMAP_FP_PARSERS[7].addParamSpec(1, "version");
219
+
220
+ // Eudora Qualcomm WorldMail
221
+ // * OK WorldMail IMAP4 Server 6.1.19.0 ready
222
+ IMAP_FP_PARSERS[8] = new PatternParser(
223
+ "^WorldMail IMAP4 Server ([^\\s]+) ready$");
224
+ IMAP_FP_PARSERS[8].addConstantParam("product", "worldmail");
225
+ IMAP_FP_PARSERS[8].addParamSpec(1, "version");
226
+
227
+ // GNU Mailutils. Note that there is no version information
228
+ IMAP_FP_PARSERS[9] = new PatternParser("^IMAP4rev1$");
229
+ IMAP_FP_PARSERS[9].addConstantParam("product", "GNU Mailutils");
230
+
231
+ * OK <host> IMAP4rev1 MDaemon 8.1.4 ready
232
+ * OK <host> /bin/sh IMAP server ready
233
+ * OK IMAP/POP ready.
234
+ * OK IMAP4 Server (IMail 6.04)
235
+ * OK IMAP4rev1 server
236
+ * OK IMAP4rev1 SmarterMail
237
+ * OK IMAP4rev1 SmartMax IMAPMax 5 Ready
238
+ * OK imapfront ready. + stunnel
239
+ * OK <host> mailserver ready.
240
+ * OK Merak 8.0.3 IMAP4rev1 Mon, 23 Jul 2007 18:22:49 +0100
241
+ * OK <host> Sendmail Advanced Message Server IMAP4rev1 (1.3.2/390)
242
+ * OK Welcome IMAP Server
243
+
244
+ -->
245
+ </fingerprints>
@@ -0,0 +1,711 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="ldap.search_result" protocol="ldap" database_type="service" preference=".80">
3
+ <!--
4
+ Notes: Ruby will fail to build the RegExp if it contains \x84 which is a standard
5
+ byte in ASN.1 Sequence length fields.
6
+ -->
7
+ <!--
8
+ Samba - position prior to Windows entries due to regex. When testing new
9
+ Samba fingerprints make sure you disable the matches for the version of
10
+ Windows that Samba is eumlating or else the Windows fallback fingerprint for
11
+ the given OS version may match.
12
+ -->
13
+ <fingerprint pattern="(?m:vendorName1.\x04.Samba.*domainControllerFunctionality1.{1,5}\x04\x014)">
14
+ <description>Samba Active Directory Controller</description>
15
+ <example _encoding="base64">
16
+ dmVuZG9yTmFtZTEfBB1TYW1iYSBUZWFtIChodHRwOi8vc2FtYmEub3JnKS5kYXRhLnJlbW92Z
17
+ WQuBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTEDBAE0MB4=
18
+ </example>
19
+ <param pos="0" name="service.vendor" value="Samba"/>
20
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
21
+ </fingerprint>
22
+ <fingerprint pattern="(?m:vendorName1.\x04.Samba.*domainFunctionality1.\x04\x0100.\x04\x13forestFunctionality1\x03\x04\x0100)">
23
+ <description>Samba Active Directory Controller emulating Windows 2000</description>
24
+ <example _encoding="base64">
25
+ dmVuZG9yTmFtZTEfBB1TYW1iYSBUZWFtIChodHRwOi8vc2FtYmEub3JnKS5kYXRhLnJlbW92Z
26
+ WQuZG9tYWluRnVuY3Rpb25hbGl0eTEDBAEwMBoEE2ZvcmVzdEZ1bmN0aW9uYWxpdHkxAwQBMD
27
+ AeBBQ=
28
+ </example>
29
+ <param pos="0" name="service.vendor" value="Samba"/>
30
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
31
+ </fingerprint>
32
+ <!--
33
+ Windows Active Directory and Lightweight Directory Server (ADAM)
34
+
35
+ domainControllerFunctionality reference:
36
+ https://msdn.microsoft.com/en-us/library/cc223272.aspx
37
+
38
+ supportedCapabilities reference (for Windows 2000)
39
+ https://msdn.microsoft.com/en-us/library/cc223359.aspx
40
+
41
+ 1.2.840.113556.1.4.800 = Active Directory Controller
42
+ 1.2.840.113556.1.4.1851 = Lightweight Directory Server / ADAM
43
+ -->
44
+ <!-- Windows 2016 -->
45
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x017)">
46
+ <description>Active Directory Controller on Windows Server 2016</description>
47
+ <example _encoding="base64">
48
+ dGllczGEAAAAlQQWMS4yLjg0MC4xMTM1NTYuMS40LjgwMAQuZGF0YS5yZW1vdmVkLjCEAAAAK
49
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATc=
50
+ </example>
51
+ <param pos="0" name="service.vendor" value="Microsoft"/>
52
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
53
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
54
+ <param pos="0" name="os.vendor" value="Microsoft"/>
55
+ <param pos="0" name="os.family" value="Windows"/>
56
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
57
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
58
+ </fingerprint>
59
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x017)">
60
+ <description>Microsoft LDS on Windows Server Server 2016</description>
61
+ <example _encoding="base64">
62
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLjCEAAAAK
63
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATc=
64
+ </example>
65
+ <param pos="0" name="service.vendor" value="Microsoft"/>
66
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
67
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
68
+ <param pos="0" name="os.vendor" value="Microsoft"/>
69
+ <param pos="0" name="os.family" value="Windows"/>
70
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
71
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
72
+ </fingerprint>
73
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x017)">
74
+ <description>Windows Server Server 2016</description>
75
+ <example _encoding="base64">
76
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNw==
77
+ </example>
78
+ <param pos="0" name="os.vendor" value="Microsoft"/>
79
+ <param pos="0" name="os.family" value="Windows"/>
80
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
81
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
82
+ </fingerprint>
83
+ <!-- Windows 2012 R2 -->
84
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x016)">
85
+ <description>Active Directory Controller on Windows Server 2012 R2</description>
86
+ <example _encoding="base64">
87
+ ZXMxhAAAAJUEFjEuMi44NDAuMTEzNTU2LjEuNC44MDAELmRhdGEucmVtb3ZlZC6EAAAAKAQdZ
88
+ G9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATYw
89
+ </example>
90
+ <param pos="0" name="service.vendor" value="Microsoft"/>
91
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
92
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
93
+ <param pos="0" name="os.vendor" value="Microsoft"/>
94
+ <param pos="0" name="os.family" value="Windows"/>
95
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
96
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
97
+ </fingerprint>
98
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x016)">
99
+ <description>Microsoft LDS on Windows Server Server 2012 R2</description>
100
+ <example _encoding="base64">
101
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLoQAAAAoB
102
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNjA=
103
+ </example>
104
+ <param pos="0" name="service.vendor" value="Microsoft"/>
105
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
106
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
107
+ <param pos="0" name="os.vendor" value="Microsoft"/>
108
+ <param pos="0" name="os.family" value="Windows"/>
109
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
110
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
111
+ </fingerprint>
112
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x016)">
113
+ <description>Windows Server Server 2012 R2</description>
114
+ <example _encoding="base64">
115
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNjA=
116
+ </example>
117
+ <param pos="0" name="os.vendor" value="Microsoft"/>
118
+ <param pos="0" name="os.family" value="Windows"/>
119
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
120
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
121
+ </fingerprint>
122
+ <!-- Windows 2012 -->
123
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x015)">
124
+ <description>Active Directory Controller on Windows Server 2012</description>
125
+ <example _encoding="base64">
126
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQwhAAAACgEH
127
+ WRvbWFpbkNvbnRyb2xsZXJGdW5jdGlvbmFsaXR5MYQAAAADBAE1MA==
128
+ </example>
129
+ <param pos="0" name="service.vendor" value="Microsoft"/>
130
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
131
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
132
+ <param pos="0" name="os.vendor" value="Microsoft"/>
133
+ <param pos="0" name="os.family" value="Windows"/>
134
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
135
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
136
+ </fingerprint>
137
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x015)">
138
+ <description>Microsoft LDS on Windows Server 2012 R2</description>
139
+ <example _encoding="base64">
140
+ ZXMxhAAAAK8EFzEuMi44NDAuMTEzNTU2LjEuNC4xODUxBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
141
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNTA=
142
+ </example>
143
+ <param pos="0" name="service.vendor" value="Microsoft"/>
144
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
145
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
146
+ <param pos="0" name="os.vendor" value="Microsoft"/>
147
+ <param pos="0" name="os.family" value="Windows"/>
148
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
149
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
150
+ </fingerprint>
151
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x015)">
152
+ <description>Windows Server Server 2012</description>
153
+ <example _encoding="base64">
154
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNTA=
155
+ </example>
156
+ <param pos="0" name="os.vendor" value="Microsoft"/>
157
+ <param pos="0" name="os.family" value="Windows"/>
158
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
159
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
160
+ </fingerprint>
161
+ <!-- Windows 2008 R2 -->
162
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x014)">
163
+ <description>Active Directory Controller on Windows Server 2008 R2</description>
164
+ <example _encoding="base64">
165
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
166
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNDA=
167
+ </example>
168
+ <param pos="0" name="service.vendor" value="Microsoft"/>
169
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
170
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
171
+ <param pos="0" name="os.vendor" value="Microsoft"/>
172
+ <param pos="0" name="os.family" value="Windows"/>
173
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
174
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
175
+ </fingerprint>
176
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x014)">
177
+ <description>Microsoft LDS on Windows Server Server 2008 R2</description>
178
+ <example _encoding="base64">
179
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLoQAAAAoB
180
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNDA=
181
+ </example>
182
+ <param pos="0" name="service.vendor" value="Microsoft"/>
183
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
184
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
185
+ <param pos="0" name="os.vendor" value="Microsoft"/>
186
+ <param pos="0" name="os.family" value="Windows"/>
187
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
188
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
189
+ </fingerprint>
190
+ <!--
191
+ This generic match for domainControllerFunctionality = 4 will capture
192
+ current Samba implementations. Disable the fingerprint below when testing Samba
193
+ -->
194
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x014)">
195
+ <description>Windows Server Server 2008 R2</description>
196
+ <example _encoding="base64">
197
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNDA=
198
+ </example>
199
+ <param pos="0" name="os.vendor" value="Microsoft"/>
200
+ <param pos="0" name="os.family" value="Windows"/>
201
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
202
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
203
+ </fingerprint>
204
+ <!-- Windows 2008 -->
205
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x013)">
206
+ <description>Active Directory Controller on Windows Server 2008</description>
207
+ <example _encoding="base64">
208
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
209
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMzA=
210
+ </example>
211
+ <param pos="0" name="service.vendor" value="Microsoft"/>
212
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
213
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
214
+ <param pos="0" name="os.vendor" value="Microsoft"/>
215
+ <param pos="0" name="os.family" value="Windows"/>
216
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
217
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
218
+ </fingerprint>
219
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x013)">
220
+ <description>Microsoft LDS on Windows Server 2008</description>
221
+ <example _encoding="base64">
222
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLjCEAAAAK
223
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATMw
224
+ </example>
225
+ <param pos="0" name="service.vendor" value="Microsoft"/>
226
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
227
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
228
+ <param pos="0" name="os.vendor" value="Microsoft"/>
229
+ <param pos="0" name="os.family" value="Windows"/>
230
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
231
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
232
+ </fingerprint>
233
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x013)">
234
+ <description>Windows Server Server 2008</description>
235
+ <example _encoding="base64">
236
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMzA=
237
+ </example>
238
+ <param pos="0" name="os.vendor" value="Microsoft"/>
239
+ <param pos="0" name="os.family" value="Windows"/>
240
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
241
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
242
+ </fingerprint>
243
+ <!-- Windows 2003 -->
244
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x012)">
245
+ <description>Active Directory Controller on Windows Server 2003</description>
246
+ <example _encoding="base64">
247
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
248
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMjA=
249
+ </example>
250
+ <param pos="0" name="service.vendor" value="Microsoft"/>
251
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
252
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
253
+ <param pos="0" name="os.vendor" value="Microsoft"/>
254
+ <param pos="0" name="os.family" value="Windows"/>
255
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
256
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
257
+ </fingerprint>
258
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x012)">
259
+ <description>Microsoft LDS on Windows Server 2003</description>
260
+ <example _encoding="base64">
261
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLjCEAAAAK
262
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATIw
263
+ </example>
264
+ <param pos="0" name="service.vendor" value="Microsoft"/>
265
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
266
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
267
+ <param pos="0" name="os.vendor" value="Microsoft"/>
268
+ <param pos="0" name="os.family" value="Windows"/>
269
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
270
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
271
+ </fingerprint>
272
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x012)">
273
+ <description>Windows Server Server 2003</description>
274
+ <example _encoding="base64">
275
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMjA=
276
+ </example>
277
+ <param pos="0" name="os.vendor" value="Microsoft"/>
278
+ <param pos="0" name="os.family" value="Windows"/>
279
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
280
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
281
+ </fingerprint>
282
+ <!-- Win Server 2000 Service Pack 3 only has two matching supportedCapabilities OIDs, match them and look for explicit end-->
283
+ <fingerprint pattern="(?im:supportedCapabilities1.{1,5}\x04\x161.2.840.113556.1.4.800\x04\x171.2.840.113556.1.4.17910.{1,5}\x04.(?:supportedControl|isSynchronized))">
284
+ <description>Active Directory Controller on Windows Server 2000 SP 3</description>
285
+ <example _encoding="base64">
286
+ c3VwcG9ydGVkQ2FwYWJpbGl0aWVzMTEEFjEuMi44NDAuMTEzNTU2LjEuNC44MDAEFzEuMi44N
287
+ DAuMTEzNTU2LjEuNC4xNzkxMEQEEHN1cHBvcnRlZENvbnRyb2x8
288
+ </example>
289
+ <example _encoding="base64">
290
+ c3VwcG9ydGVkQ2FwYWJpbGl0aWVzMTEEFjEuMi44NDAuMTEzNTU2LjEuNC44MDAEFzEuMi44N
291
+ DAuMTEzNTU2LjEuNC4xNzkxMIQAAAAcBA5pc1N5bmNocm9uaXplZDE=
292
+ </example>
293
+ <param pos="0" name="service.vendor" value="Microsoft"/>
294
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
295
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
296
+ <param pos="0" name="os.vendor" value="Microsoft"/>
297
+ <param pos="0" name="os.family" value="Windows"/>
298
+ <param pos="0" name="os.product" value="Windows Server 2000"/>
299
+ <param pos="0" name="os.version" value="Windows Server 2000 SP3"/>
300
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:Windows Server 2000 SP3"/>
301
+ </fingerprint>
302
+ <!-- Win Server 2000 RTM only has a single matching supportedCapabilities OID, match it and look for explicit end-->
303
+ <fingerprint pattern="(?im:supportedCapabilities1.{1,5}\x04\x161.2.840.113556.1.4.8000.{1,5}\x04.isSynchronized1)">
304
+ <description>Active Directory Controller on Windows Server 2000</description>
305
+ <example _encoding="base64">
306
+ c3VwcG9ydGVkQ2FwYWJpbGl0aWVzMYQAAAAYBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwMIQAA
307
+ AAcBA5pc1N5bmNocm9uaXplZDE=
308
+ </example>
309
+ <param pos="0" name="service.vendor" value="Microsoft"/>
310
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
311
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
312
+ <param pos="0" name="os.vendor" value="Microsoft"/>
313
+ <param pos="0" name="os.family" value="Windows"/>
314
+ <param pos="0" name="os.product" value="Windows Server 2000"/>
315
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
316
+ </fingerprint>
317
+ <!-- End of Microsoft Windows Section -->
318
+ <fingerprint pattern="(?im:top\x04..penLDAProotDSE)">
319
+ <description>OpenLDAP</description>
320
+ <example _encoding="base64">
321
+ dm9iamVjdENsYXNzMRYEA3RvcAQPT3BlbkxEQVByb290RFNFMA==
322
+ </example>
323
+ <param pos="0" name="service.vendor" value="OpenLDAP"/>
324
+ <param pos="0" name="service.product" value="OpenLDAP"/>
325
+ <param pos="0" name="service.cpe23" value="cpe:/a:openldap:openldap:-"/>
326
+ </fingerprint>
327
+ <fingerprint pattern="(?i:namingcontexts1.\x04.fn=ContactRoot0.[\x02\x04])">
328
+ <description>Kerio Connect</description>
329
+ <example service.product="Connect" _encoding="base64">
330
+ bmFtaW5nQ29udGV4dHMxEAQOZm49Q29udGFjdFJvb3QwKAQUZGVmYXVsdE5hbWluZ0NvbnRle
331
+ HQx
332
+ </example>
333
+ <param pos="0" name="service.vendor" value="Kerio"/>
334
+ <param pos="0" name="service.product" value="Connect"/>
335
+ </fingerprint>
336
+ <fingerprint pattern="(?im:vmwPlatformServicesControllerVersion1.\x04.(\d\.\d\.\d)0.)">
337
+ <description>VMware Platform Services Controller</description>
338
+ <example service.version="6.0.0" _encoding="base64">
339
+ dm13UGxhdGZvcm1TZXJ2aWNlc0NvbnRyb2xsZXJWZXJzaW9uMQcEBTYuMC4wMCc=
340
+ </example>
341
+ <param pos="0" name="service.vendor" value="VMware"/>
342
+ <param pos="0" name="service.product" value="Platform Services Controller"/>
343
+ <param pos="1" name="service.version"/>
344
+ </fingerprint>
345
+ <!-- Fedora / 389 Project family -->
346
+ <!-- http://directory.fedoraproject.org/docs/389ds/FAQ/history.html -->
347
+ <fingerprint pattern="(?i:vendorname1.\x04.Fedora Project0.\x04\rvendorversion1.\x04.Fedora-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+))">
348
+ <description>Fedora Project Fedora Directory Server</description>
349
+ <example service.version="1.0.4 B2006.312.5450" _encoding="base64">
350
+ dmVuZG9yTmFtZTEQBA5GZWRvcmEgUHJvamVjdDA3BA12ZW5kb3JWZXJzaW9uMSYEJEZlZG9yY
351
+ S1EaXJlY3RvcnkvMS4wLjQgQjIwMDYuMzEyLjU0NTA=
352
+ </example>
353
+ <example service.version="1.0.4 B2007.304.11380" _encoding="base64">
354
+ dmVuZG9yTmFtZTEQBA5GZWRvcmEgUHJvamVjdDA4BA12ZW5kb3JWZXJzaW9uMScEJUZlZG9yY
355
+ S1EaXJlY3RvcnkvMS4wLjQgQjIwMDcuMzA0LjExMzgw
356
+ </example>
357
+ <param pos="0" name="service.vendor" value="Red Hat"/>
358
+ <param pos="0" name="service.product" value="Fedora Directory Server"/>
359
+ <param pos="1" name="service.version"/>
360
+ </fingerprint>
361
+ <fingerprint pattern="(?i:vendorname1.\x04.389 Project0.\x04\rvendorversion1.\x04.389-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+))">
362
+ <description>389 Project 389 Directory Server</description>
363
+ <example service.version="1.2.11.25 B2013.325.19510" _encoding="base64">
364
+ dmVuZG9yTmFtZTENBAszODkgUHJvamVjdDA5BA12ZW5kb3JWZXJzaW9uMSgEJjM4OS1EaXJlY
365
+ 3RvcnkvMS4yLjExLjI1IEIyMDEzLjMyNS4xOTUxMA==
366
+ </example>
367
+ <param pos="0" name="service.vendor" value="389 Project"/>
368
+ <param pos="0" name="service.product" value="389 Directory Server"/>
369
+ <param pos="1" name="service.version"/>
370
+ </fingerprint>
371
+ <fingerprint pattern="(?im:vendorName1.\x04.CentOS0.\x04\rvendorVersion1.\x04.CentOS-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+).\x04\v)">
372
+ <description>CentOS CentOS Directory Server</description>
373
+ <example service.version="8.2.8 B2012.041.12270" _encoding="base64">
374
+ dmVuZG9yTmFtZTEIBAZDZW50T1MwOAQNdmVuZG9yVmVyc2lvbjEnBCVDZW50T1MtRGlyZWN0b
375
+ 3J5LzguMi44IEIyMDEyLjA0MS4xMjI3MC8ECw==
376
+ </example>
377
+ <param pos="0" name="service.vendor" value="CentOS"/>
378
+ <param pos="0" name="service.product" value="CentOS Directory Server"/>
379
+ <param pos="1" name="service.version"/>
380
+ </fingerprint>
381
+ <fingerprint pattern="(?im:vendorName1.\x04.Red Hat(?:, Inc.)?0.\x04\rvendorVersion1.\x04.Red Hat-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+).\x04\v)">
382
+ <description>Red Hat Red Hat Directory Server</description>
383
+ <example service.version="8.2.0 B2010.210.0590" _encoding="base64">
384
+ dmVuZG9yTmFtZTEJBAdSZWQgSGF0MDgEDXZlbmRvclZlcnNpb24xJwQlUmVkIEhhdC1EaXJlY
385
+ 3RvcnkvOC4yLjAgQjIwMTAuMjEwLjA1OTAgBAs=
386
+ </example>
387
+ <param pos="0" name="service.vendor" value="Red Hat"/>
388
+ <param pos="0" name="service.product" value="Red Hat Directory Server"/>
389
+ <param pos="1" name="service.version"/>
390
+ <param pos="0" name="service.cpe23" value="cpe:/a:redhat:directory_server:{service.version}"/>
391
+ </fingerprint>
392
+ <fingerprint pattern="(?i:vendorname1.\x04.Netscape Communications Corp.0.\x04\rvendorversion1.\x04.Netscape-Directory/(\d\.\d[\d.]* B\d+\.\d+\.\d+).\x04\v)">
393
+ <description>Netscape Directory Server</description>
394
+ <example service.version="6.11 B2002.281.08530" _encoding="base64">
395
+ dmVuZG9yTmFtZTEfBB1OZXRzY2FwZSBDb21tdW5pY2F0aW9ucyBDb3JwLjA5BA12ZW5kb3JWZ
396
+ XJzaW9uMSgEJk5ldHNjYXBlLURpcmVjdG9yeS82LjExIEIyMDAyLjI4MS4wODUzMC8ECw==
397
+ </example>
398
+ <example service.version="6.11 B2002.281.08530" _encoding="base64">
399
+ dmVuZG9ybmFtZTEfBB1OZXRzY2FwZSBDb21tdW5pY2F0aW9ucyBDb3JwLjA5BA12ZW5kb3J2Z
400
+ XJzaW9uMSgEJk5ldHNjYXBlLURpcmVjdG9yeS82LjExIEIyMDAyLjI4MS4wODUzMC8ECw==
401
+ </example>
402
+ <param pos="0" name="service.vendor" value="Netscape"/>
403
+ <param pos="0" name="service.product" value="Netscape Directory Server"/>
404
+ <param pos="1" name="service.version"/>
405
+ </fingerprint>
406
+ <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Release (\d+\.\d+[\w .]*)0.\x04.dominomajminversion)">
407
+ <description>IBM (Lotus) Domino LDAP Server - majminversion variant</description>
408
+ <example service.version="8.5.3" _encoding="base64">
409
+ SUJNIExvdHVzIFNvZnR3YXJlMCAEDXZlbmRvcnZlcnNpb24xDwQNUmVsZWFzZSA4LjUuMzAeB
410
+ BNkb21pbm9tYWptaW52ZXJzaW9uMQcE
411
+ </example>
412
+ <example service.version="9.0.1FP6 HF130" _encoding="base64">
413
+ SUJNIExvdHVzIFNvZnR3YXJlMCkEDXZlbmRvcnZlcnNpb24xGAQWUmVsZWFzZSA5LjAuMUZQN
414
+ iBIRjEzMDAeBBNkb21pbm9tYWptaW52ZXJzaW9uMQcE
415
+ </example>
416
+ <param pos="0" name="service.vendor" value="IBM"/>
417
+ <param pos="0" name="service.product" value="Domino LDAP Server"/>
418
+ <param pos="1" name="service.version"/>
419
+ </fingerprint>
420
+ <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Release (\d+\.\d+[\w .]*)0\f)">
421
+ <description>IBM (Lotus) Domino LDAP Server</description>
422
+ <example service.version="9.0.1FP4 HF523" _encoding="base64">
423
+ dmVuZG9ybmFtZTEUBBJJQk0gTG90dXMgU29mdHdhcmUwKQQNdmVuZG9ydmVyc2lvbjEYBBZSZ
424
+ WxlYXNlIDkuMC4xRlA0IEhGNTIzMAwC
425
+ </example>
426
+ <param pos="0" name="service.vendor" value="IBM"/>
427
+ <param pos="0" name="service.product" value="Domino LDAP Server"/>
428
+ <param pos="1" name="service.version"/>
429
+ </fingerprint>
430
+ <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Build (V[\w .]*)0.\x04.dominomajminversion)">
431
+ <description>IBM (Lotus) Domino LDAP Server - build variant</description>
432
+ <example service.version="V902_12302013" _encoding="base64">
433
+ SUJNIExvdHVzIFNvZnR3YXJlMCYEDXZlbmRvcnZlcnNpb24xFQQTQnVpbGQgVjkwMl8xMjMwM
434
+ jAxMzAeBBNkb21pbm9tYWptaW52ZXJzaW9uMQcE
435
+ </example>
436
+ <param pos="0" name="service.vendor" value="IBM"/>
437
+ <param pos="0" name="service.product" value="Domino LDAP Server"/>
438
+ <param pos="1" name="service.version"/>
439
+ </fingerprint>
440
+ <!-- Attachmate Group (NetIQ) purchased Novell in 2011, and then merged w/ Micro Focus in 2014 -->
441
+ <fingerprint pattern="(?im:vendorName1\x13\x04\x11NetIQ Corporation0.\x04\rvendorVersion.{4}LDAP Agent for NetIQ eDirectory (\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
442
+ <description>NetIQ LDAP Agent for eDirectory</description>
443
+ <example service.version="8.8 SP8 (20808.06)" _encoding="base64">
444
+ eDA0CnZlbmRvck5hbWUxEwQRTmV0SVEgQ29ycG9yYXRpb24wRQQNdmVuZG9yVmVyc2lvbjE0B
445
+ DJMREFQIEFnZW50IGZvciBOZXRJUSBlRGlyZWN0b3J5IDguOCBTUDggKDIwODA4LjA2KTBJBA
446
+ ==
447
+ </example>
448
+ <param pos="0" name="service.vendor" value="NetIQ"/>
449
+ <param pos="0" name="service.product" value="LDAP Agent for eDirectory"/>
450
+ <param pos="1" name="service.version"/>
451
+ </fingerprint>
452
+ <fingerprint pattern="(?im:vendorName1\x0E\x04\fNovell, Inc.0.\x04\rvendorVersion.{4}LDAP Agent for Novell eDirectory (\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
453
+ <description>Novell LDAP Agent for eDirectory</description>
454
+ <example service.version="8.7.3.8 (10554.99)" _encoding="base64">
455
+ dmVuZG9yTmFtZTEOBAxOb3ZlbGwsIEluYy4wRgQNdmVuZG9yVmVyc2lvbjE1BDNMREFQIEFnZ
456
+ W50IGZvciBOb3ZlbGwgZURpcmVjdG9yeSA4LjcuMy44ICgxMDU1NC45OSkwKQQ=
457
+ </example>
458
+ <example service.version="8.8 SP4 (20217.05)" _encoding="base64">
459
+ dmVuZG9yTmFtZTEOBAxOb3ZlbGwsIEluYy4wRgQNdmVuZG9yVmVyc2lvbjE1BDNMREFQIEFnZ
460
+ W50IGZvciBOb3ZlbGwgZURpcmVjdG9yeSA4LjggU1A0ICgyMDIxNy4wNSkwHQQ=
461
+ </example>
462
+ <param pos="0" name="service.vendor" value="Novell"/>
463
+ <param pos="0" name="service.product" value="LDAP Agent for eDirectory"/>
464
+ <param pos="1" name="service.version"/>
465
+ </fingerprint>
466
+ <fingerprint pattern="(?im:vendorName1\x0E\x04\fNovell, Inc.0/\x04\rvendorVersion1\x1E\x04\x1CeDirectory v(\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
467
+ <description>Novell eDirectory</description>
468
+ <example service.version="8.6.2 (10350.18)" _encoding="base64">
469
+ dmVuZG9yTmFtZTEOBAxOb3ZlbGwsIEluYy4wLwQNdmVuZG9yVmVyc2lvbjEeBBxlRGlyZWN0b
470
+ 3J5IHY4LjYuMiAoMTAzNTAuMTgpMCcE
471
+ </example>
472
+ <param pos="0" name="service.vendor" value="Novell"/>
473
+ <param pos="0" name="service.product" value="eDirectory"/>
474
+ <param pos="1" name="service.version"/>
475
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:edirectory:{service.version}"/>
476
+ </fingerprint>
477
+ <!-- Various iterations of Sun, now Oracle, Directory Server -->
478
+ <fingerprint pattern="(?i:vendorname1\x18\x04\x16Sun Microsystems, Inc.0.+\x04\rvendorversion1.{1,2}\x04.{1,2}Sun[- ]Java\(tm\)[- ]System[- ]Directory(?: Server)?/(\d\.\d+[\w.]*)0.{1,3}\x04)">
479
+ <description>Sun Java(TM) System Directory Server</description>
480
+ <example service.version="5.2_Patch_6" _encoding="base64">
481
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMEMEDXZlbmRvclZlcnNpb24xM
482
+ gQwU3VuIEphdmEoVE0pIFN5c3RlbSBEaXJlY3RvcnkgU2VydmVyLzUuMl9QYXRjaF82MC8E
483
+ </example>
484
+ <example service.version="6.2_PR_CUMULATIVE_6_2_6597523_6527909" _encoding="base64">
485
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMFYEDXZlbmRvclZlcnNpb24xR
486
+ QRDU3VuLUphdmEodG0pLVN5c3RlbS1EaXJlY3RvcnkvNi4yX1BSX0NVTVVMQVRJVkVfNl8yXz
487
+ Y1OTc1MjNfNjUyNzkwOTBNBA==
488
+ </example>
489
+ <example service.version="6.3.1" _encoding="base64">
490
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDYEDXZlbmRvclZlcnNpb24xJ
491
+ QQjU3VuLUphdmEodG0pLVN5c3RlbS1EaXJlY3RvcnkvNi4zLjEwLwQ=
492
+ </example>
493
+ <example service.version="6.3.1.1.1" _encoding="base64">
494
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDoEDXZlbmRvclZlcnNpb24xK
495
+ QQnU3VuLUphdmEodG0pLVN5c3RlbS1EaXJlY3RvcnkvNi4zLjEuMS4xMIGJBA==
496
+ </example>
497
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
498
+ <param pos="0" name="service.product" value="Sun Java System Directory Server"/>
499
+ <param pos="1" name="service.version"/>
500
+ </fingerprint>
501
+ <fingerprint pattern="(?i:vendorname1\x18\x04\x16Sun Microsystems, Inc.0.\x04\rvendorversion1.\x04.Sun-Directory-Server/([\w.]+)0.{1,3}\x04)">
502
+ <description>Sun Directory Server</description>
503
+ <example service.version="7.0" _encoding="base64">
504
+ dmVuZG9ybmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMCsEDXZlbmRvcnZlcnNpb24xG
505
+ gQYU3VuLURpcmVjdG9yeS1TZXJ2ZXIvNy4wMC8E
506
+ </example>
507
+ <example service.version="7.0_sec" _encoding="base64">
508
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMC8EDXZlbmRvclZlcnNpb24xH
509
+ gQcU3VuLURpcmVjdG9yeS1TZXJ2ZXIvNy4wX3NlYzAgBA==
510
+ </example>
511
+ <example service.version="11.1.1.3.0" _encoding="base64">
512
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDIEDXZlbmRvclZlcnNpb24xI
513
+ QQfU3VuLURpcmVjdG9yeS1TZXJ2ZXIvMTEuMS4xLjMuMDAgBA==
514
+ </example>
515
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
516
+ <param pos="0" name="service.product" value="Sun Directory Server"/>
517
+ <param pos="1" name="service.version"/>
518
+ </fingerprint>
519
+ <fingerprint pattern="(?i:vendorname1\x14\x04\x12Oracle Corporation0.\x04\rvendorversion1.\x04.Sun-Directory-Server/([\w.]+)[0 ].{1,3}\x04)">
520
+ <description>Oracle Sun Directory Server</description>
521
+ <example service.version="11.1.1.7.2" _encoding="base64">
522
+ dmVuZG9yTmFtZTEUBBJPcmFjbGUgQ29ycG9yYXRpb24wMgQNdmVuZG9yVmVyc2lvbjEhBB9Td
523
+ W4tRGlyZWN0b3J5LVNlcnZlci8xMS4xLjEuNy4yMCAE
524
+ </example>
525
+ <example service.version="11.1.1.7.0_PR_16776826_16841985" _encoding="base64">
526
+ dmVuZG9yTmFtZTEUBBJPcmFjbGUgQ29ycG9yYXRpb24wRwQNdmVuZG9yVmVyc2lvbjE2BDRTd
527
+ W4tRGlyZWN0b3J5LVNlcnZlci8xMS4xLjEuNy4wX1BSXzE2Nzc2ODI2XzE2ODQxOTg1ME0E
528
+ </example>
529
+ <param pos="0" name="service.vendor" value="Oracle"/>
530
+ <param pos="0" name="service.product" value="Sun Directory Server"/>
531
+ <param pos="1" name="service.version"/>
532
+ </fingerprint>
533
+ <fingerprint pattern="(?im:vendorName1\x17\x04\x15Sun Microsystems, Inc0.\x04\rvendorVersion1.\x04.Directory Proxy Server ([\w.]+)0.\x04)">
534
+ <description>Sun Directory Proxy Server</description>
535
+ <example service.version="11.1.1.7.1" _encoding="base64">
536
+ dmVuZG9yTmFtZTEXBBVTdW4gTWljcm9zeXN0ZW1zLCBJbmMwNAQNdmVuZG9yVmVyc2lvbjEjB
537
+ CFEaXJlY3RvcnkgUHJveHkgU2VydmVyIDExLjEuMS43LjEwRQQ=
538
+ </example>
539
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
540
+ <param pos="0" name="service.product" value="Sun Directory Proxy Server"/>
541
+ <param pos="1" name="service.version"/>
542
+ </fingerprint>
543
+ <!-- Very old, rare, same family as above. Roll into those? -->
544
+ <fingerprint pattern="(?i:vendorname1.\x04.Sun Microsystems, Inc.0.\x04\rvendorversion1.\x04.Sun-ONE-Directory/([\w.]+)0.\x04)">
545
+ <description>Sun ONE Directory Server</description>
546
+ <example service.version="5.2" _encoding="base64">
547
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMCgEDXZlbmRvclZlcnNpb24xF
548
+ wQVU3VuLU9ORS1EaXJlY3RvcnkvNS4yMC8E
549
+ </example>
550
+ <example service.version="5.2_Patch_1" _encoding="base64">
551
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDAEDXZlbmRvclZlcnNpb24xH
552
+ wQdU3VuLU9ORS1EaXJlY3RvcnkvNS4yX1BhdGNoXzEwPgQ=
553
+ </example>
554
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
555
+ <param pos="0" name="service.product" value="Sun ONE Directory Server"/>
556
+ <param pos="1" name="service.version"/>
557
+ </fingerprint>
558
+ <!-- IBM [Tivoli | Security] Directory Server -->
559
+ <fingerprint pattern="(?im:International Business Machines \(IBM\)0.*\x04\rvendorversion1.\x00\x00\x00.\x04.([\d.]+)0.\x00.*ibm-osregistrycontext1.\x00\x00\x00.\x04.OS400-SYS=)">
560
+ <description>IBM Security Directory Server on OS/400 (IBM i)</description>
561
+ <example service.version="5.2" _encoding="base64">
562
+ SW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyAoSUJNKTCEAAAAGgQNdmVuZG9ydmVyc
563
+ 2lvbjGEAAAABQQDNS4yMIQAAAArBBxpYm0tc2xhcGRpc2NvbmZpZ3VyYXRpb25tb2RlMYQAAA
564
+ AHBAVGQUxTRTCEAAAARAQVaWJtLW9zcmVnaXN0cnljb250ZXh0MYQAAAAnBCVPUzQwMC1TWVM9
565
+ </example>
566
+ <param pos="0" name="os.vendor" value="IBM"/>
567
+ <param pos="0" name="os.family" value="OS/400"/>
568
+ <param pos="0" name="os.product" value="OS/400 (IBM i)"/>
569
+ <param pos="0" name="service.vendor" value="IBM"/>
570
+ <param pos="0" name="service.product" value="Security Directory Server"/>
571
+ <param pos="1" name="service.version"/>
572
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:security_directory_server:{service.version}"/>
573
+ </fingerprint>
574
+ <fingerprint pattern="(?im:vendorname1.+?\x04%International Business Machines \(IBM\)0.+?\x04\rvendorversion1.+?\x04.([\d.]+)0.[\x00\x02\x04])">
575
+ <description>IBM Security Directory Server</description>
576
+ <example service.version="5.1" _encoding="base64">
577
+ dmVuZG9ybmFtZTGEAAAAJwQlSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyAoSUJNK
578
+ TCEAAAAGgQNdmVuZG9ydmVyc2lvbjGEAAAABQQDNS4xMIQA
579
+ </example>
580
+ <example service.version="6.3.1" _encoding="base64">
581
+ dmVuZG9ybmFtZTGEAAAAJwQlSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyAoSUJNK
582
+ TCEAAAAHAQNdmVuZG9ydmVyc2lvbjGEAAAABwQFNi4zLjEwhAA=
583
+ </example>
584
+ <param pos="0" name="service.vendor" value="IBM"/>
585
+ <param pos="0" name="service.product" value="Security Directory Server"/>
586
+ <param pos="1" name="service.version"/>
587
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:security_directory_server:{service.version}"/>
588
+ </fingerprint>
589
+ <fingerprint pattern="(?im:vendorName1.\x00\x00\x00\v\x04\tMirapoint0.\x00\x00\x00.\x04\rvendorVersion1.\x00\x00\x00.\x04.([\d.]+)0.\x00)">
590
+ <description>Mirapoint LDAP Server</description>
591
+ <example service.version="3.2" _encoding="base64">
592
+ dmVuZG9yTmFtZTGEAAAACwQJTWlyYXBvaW50MIQAAAAaBA12ZW5kb3JWZXJzaW9uMYQAAAAFB
593
+ AMzLjIwhAA=
594
+ </example>
595
+ <param pos="0" name="service.vendor" value="Mirapoint"/>
596
+ <param pos="0" name="service.product" value="LDAP Server"/>
597
+ <param pos="1" name="service.version"/>
598
+ </fingerprint>
599
+ <fingerprint pattern="(?im:orcldirectoryversion1.{1,5}\x04.OID ([\d.]+)0.\x00\x00)">
600
+ <description>Oracle Internet Directory</description>
601
+ <example service.version="9.0.4.0.0" _encoding="base64">
602
+ b3JjbGRpcmVjdG9yeXZlcnNpb24xhAAAAA8EDU9JRCA5LjAuNC4wLjAwhAAAAA==
603
+ </example>
604
+ <param pos="0" name="service.vendor" value="Oracle"/>
605
+ <param pos="0" name="service.product" value="Internet Directory Server"/>
606
+ <param pos="1" name="service.version"/>
607
+ </fingerprint>
608
+ <fingerprint pattern="(?im:orcldirectoryversion1.{1,5}\x04.OVD ([\d.]+)0.\x04)">
609
+ <description>Oracle Virtual Directory</description>
610
+ <example service.version="11.1.1.6.0" _encoding="base64">
611
+ b3JjbGRpcmVjdG9yeXZlcnNpb24xEAQOT1ZEIDExLjEuMS42LjAwLgQSc3VwcG9ydGVkRQ==
612
+ </example>
613
+ <param pos="0" name="service.vendor" value="Oracle"/>
614
+ <param pos="0" name="service.product" value="Virtual Directory Server"/>
615
+ <param pos="1" name="service.version"/>
616
+ </fingerprint>
617
+ <fingerprint pattern="(?im:metaProductID.*\x04\vmetaVersion1\r\x04.([\d.]+)0.\x04)">
618
+ <description>estos MetaDirectory</description>
619
+ <example service.version="3.5.22.4291" _encoding="base64">
620
+ BA1tZXRhUHJvZHVjdElEMQYEBDExMDIwHAQLbWV0YVZlcnNpb24xDQQLMy41LjIyLjQyOTEwF
621
+ gQ=
622
+ </example>
623
+ <param pos="0" name="service.vendor" value="estos"/>
624
+ <param pos="0" name="service.product" value="MetaDirectory Server"/>
625
+ <param pos="1" name="service.version"/>
626
+ <param pos="0" name="os.vendor" value="Microsoft"/>
627
+ <param pos="0" name="os.family" value="Windows"/>
628
+ </fingerprint>
629
+ <fingerprint pattern="(?im:dsaVersion1.\x04,DC Directory Server v(\d+\.\d+[\d.]* \([\w. ]+\))0.\x04)">
630
+ <description>Cisco Data Connection Directory</description>
631
+ <example service.version="8.1.00 (build 20150305)" _encoding="base64">
632
+ ZHNhVmVyc2lvbjEuBCxEQyBEaXJlY3RvcnkgU2VydmVyIHY4LjEuMDAgKGJ1aWxkIDIwMTUwM
633
+ zA1KTBeBAs=
634
+ </example>
635
+ <param pos="0" name="service.vendor" value="Cisco"/>
636
+ <param pos="0" name="service.product" value="Data Connection Directory"/>
637
+ <param pos="1" name="service.version"/>
638
+ </fingerprint>
639
+ <!-- Unbound -->
640
+ <fingerprint pattern="(?im:vendorName1.\x04.UnboundID Corp.0.\x04\rvendorVersion1.\x04.UnboundID Directory Server ([\d.]+)0\f)">
641
+ <description>UnboundID Directory Server</description>
642
+ <example service.version="5.1.5.2" _encoding="base64">
643
+ dmVuZG9yTmFtZTERBA9VbmJvdW5kSUQgQ29ycC4wNQQNdmVuZG9yVmVyc2lvbjEkBCJVbmJvd
644
+ W5kSUQgRGlyZWN0b3J5IFNlcnZlciA1LjEuNS4yMAw=
645
+ </example>
646
+ <param pos="0" name="service.vendor" value="UnboundID"/>
647
+ <param pos="0" name="service.product" value="UnboundID Directory Server"/>
648
+ <param pos="1" name="service.version"/>
649
+ </fingerprint>
650
+ <fingerprint pattern="(?im:vendorName1.\x04.UnboundID Corp.0.\x04\rvendorVersion1.\x04.UnboundID Directory Proxy Server ([\d.]+)0\f)">
651
+ <description>UnboundID Directory Proxy Server</description>
652
+ <example service.version="4.7.0.7" _encoding="base64">
653
+ dmVuZG9yTmFtZTERBA9VbmJvdW5kSUQgQ29ycC4wOwQNdmVuZG9yVmVyc2lvbjEqBChVbmJvd
654
+ W5kSUQgRGlyZWN0b3J5IFByb3h5IFNlcnZlciA0LjcuMC43MAw=
655
+ </example>
656
+ <param pos="0" name="service.vendor" value="UnboundID"/>
657
+ <param pos="0" name="service.product" value="UnboundID Directory Proxy Server"/>
658
+ <param pos="1" name="service.version"/>
659
+ </fingerprint>
660
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.IPVA-\w+-)" flags="REG_MULTILINE">
661
+ <description>innovaphone VoIP Gateway Virtual Appliance</description>
662
+ <example _encoding="base64">
663
+ Dm5hbWluZ0NvbnRleHRzMQoECGNuPUtQQlgwMCIED2xkYXBTZXJ2aWNlTmFtZTEPBA1JUFZBL
664
+ TNmLTAwLTBjMAwC
665
+ </example>
666
+ <param pos="0" name="service.vendor" value="innovaphone"/>
667
+ <param pos="0" name="service.family" value="VoiP Gateway"/>
668
+ <param pos="0" name="service.product" value="IPVA"/>
669
+ </fingerprint>
670
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IP\d+)-\w+-)" flags="REG_MULTILINE">
671
+ <description>innovaphone VoIP Gateway</description>
672
+ <example service.product="IP800" _encoding="base64">
673
+ bmFtaW5nQ29udGV4dHMxCgQIY249S1BCWDAwIwQPbGRhcFNlcnZpY2VOYW1lMRAEDklQODAwL
674
+ TA2LTJiLTYxMA==
675
+ </example>
676
+ <param pos="0" name="service.vendor" value="innovaphone"/>
677
+ <param pos="0" name="service.family" value="VoiP Gateway"/>
678
+ <param pos="1" name="service.product"/>
679
+ </fingerprint>
680
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IPBS\d*)-\w+-)">
681
+ <description>Ascom IP-DECT Base Station</description>
682
+ <example service.product="IPBS2" _encoding="base64">
683
+ bmFtaW5nQ29udGV4dHMxCQQHY249UEJYMDAjBA9sZGFwU2VydmljZU5hbWUxEAQOSVBCUzItM
684
+ TktYjEtZTcw
685
+ </example>
686
+ <param pos="0" name="service.vendor" value="Ascom"/>
687
+ <param pos="0" name="service.family" value="IP-DECT Base Station"/>
688
+ <param pos="1" name="service.product"/>
689
+ </fingerprint>
690
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IPBL\d*)-\w+-)">
691
+ <description>Ascom IP-DECT Gateway</description>
692
+ <example service.product="IPBL" _encoding="base64">
693
+ bmFtaW5nQ29udGV4dHMxCQQHY249UEJYMDAiBA9sZGFwU2VydmljZU5hbWUxDwQNSVBCTC0zM
694
+ C0yYy0yNTA=
695
+ </example>
696
+ <param pos="0" name="service.vendor" value="Ascom"/>
697
+ <param pos="0" name="service.family" value="IP-DECT Gateway"/>
698
+ <param pos="1" name="service.product"/>
699
+ </fingerprint>
700
+ <fingerprint pattern="(?im:o=Scalix0.\x04.subschemasubentry1.\x04.cn=subSchema,o=Scalix0.\x04.*\x04.xserverversion1.\x04.(\d\d\.\d+\.[\w.-]+)0.\x02)">
701
+ <description>Scalix LDAP Server</description>
702
+ <example service.version="11.4.6.13676" _encoding="base64">
703
+ bz1NeUNvbnRhY3RzBAhvPVNjYWxpeDAsBBFzdWJzY2hlbWFzdWJlbnRyeTEXBBVjbj1zdWJTY
704
+ 2hlbWEsbz1TY2FsaXgwDQQJYWx0c2VydmVyMQAwHgQUc3VwcG9ydGVkbGRhcHZlcnNpb24xBg
705
+ QBMgQBMzAgBA54c2VydmVydmVyc2lvbjEOBAwxMS40LjYuMTM2NzYwDAI=
706
+ </example>
707
+ <param pos="0" name="service.vendor" value="Scalix"/>
708
+ <param pos="0" name="service.product" value="LDAP Server"/>
709
+ <param pos="1" name="service.version"/>
710
+ </fingerprint>
711
+ </fingerprints>