recog-intrigue 2.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
@@ -0,0 +1,245 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="imap4.banner" protocol="imap" database_type="service" preference="0.90">
3
+ <!-- IMAP banners are matched against these patterns to fingerprint IMAP servers. -->
4
+ <fingerprint pattern="^Microsoft Exchange IMAP4rev1 server version (5\.5\.\d{4}\.\d+) \((.*)\) ready$">
5
+ <description>Microsoft Exchange Server 5.5</description>
6
+ <example service.version="5.5.2448.8" host.name="foo.bar">Microsoft Exchange IMAP4rev1 server version 5.5.2448.8 (foo.bar) ready</example>
7
+ <param pos="0" name="service.vendor" value="Microsoft"/>
8
+ <param pos="0" name="service.family" value="Exchange Server"/>
9
+ <param pos="0" name="service.product" value="Exchange Server 5.5"/>
10
+ <param pos="1" name="service.version"/>
11
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
12
+ <param pos="0" name="os.vendor" value="Microsoft"/>
13
+ <param pos="0" name="os.family" value="Windows"/>
14
+ <param pos="0" name="os.product" value="Windows"/>
15
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
16
+ <param pos="2" name="host.name"/>
17
+ </fingerprint>
18
+ <fingerprint pattern="^Microsoft Exchange 2000 IMAP4rev1 server version (6\.0\.\d{4}\.\d+) \((.*)\) ready\.$">
19
+ <description>Microsoft Exchange Server 2000</description>
20
+ <example service.version="6.0.6249.0" host.name="foo.bar">Microsoft Exchange 2000 IMAP4rev1 server version 6.0.6249.0 (foo.bar) ready.</example>
21
+ <param pos="0" name="service.vendor" value="Microsoft"/>
22
+ <param pos="0" name="service.family" value="Exchange Server"/>
23
+ <param pos="0" name="service.product" value="Exchange 2000 Server"/>
24
+ <param pos="1" name="service.version"/>
25
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
26
+ <param pos="0" name="os.vendor" value="Microsoft"/>
27
+ <param pos="0" name="os.family" value="Windows"/>
28
+ <param pos="0" name="os.product" value="Windows"/>
29
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
30
+ <param pos="2" name="host.name"/>
31
+ </fingerprint>
32
+ <fingerprint pattern="^Microsoft Exchange Server 2003 IMAP4rev1 server version (6\.5\.\d{4}\.\d+) \((.*)\) ready\.$">
33
+ <description>Microsoft Exchange Server 2003</description>
34
+ <example service.version="6.5.7638.1" host.name="foo.bar">Microsoft Exchange Server 2003 IMAP4rev1 server version 6.5.7638.1 (foo.bar) ready.</example>
35
+ <param pos="0" name="service.vendor" value="Microsoft"/>
36
+ <param pos="0" name="service.family" value="Exchange Server"/>
37
+ <param pos="0" name="service.product" value="Exchange 2003 Server"/>
38
+ <param pos="1" name="service.version"/>
39
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
40
+ <param pos="0" name="os.vendor" value="Microsoft"/>
41
+ <param pos="0" name="os.family" value="Windows"/>
42
+ <param pos="0" name="os.product" value="Windows"/>
43
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
44
+ <param pos="2" name="host.name"/>
45
+ </fingerprint>
46
+ <fingerprint pattern="^Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version (6\.5\.\d{4}\.\d+) \((.*)\),.*$">
47
+ <description>Microsoft Exchange Server 2003, German</description>
48
+ <example service.version="6.5.7638.1" host.name="foo.bar">Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version 6.5.7638.1 (foo.bar), steht zur Verfgung.</example>
49
+ <param pos="0" name="service.vendor" value="Microsoft"/>
50
+ <param pos="0" name="service.family" value="Exchange Server"/>
51
+ <param pos="0" name="service.product" value="Exchange 2003 Server"/>
52
+ <param pos="1" name="service.version"/>
53
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
54
+ <param pos="0" name="os.vendor" value="Microsoft"/>
55
+ <param pos="0" name="os.family" value="Windows"/>
56
+ <param pos="0" name="os.product" value="Windows"/>
57
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
58
+ <param pos="2" name="host.name"/>
59
+ </fingerprint>
60
+ <fingerprint pattern="^Microsoft Exchange Server 2007 IMAP4 service ready$">
61
+ <description>Microsoft Exchange Server 2007</description>
62
+ <example>Microsoft Exchange Server 2007 IMAP4 service ready</example>
63
+ <param pos="0" name="service.vendor" value="Microsoft"/>
64
+ <param pos="0" name="service.family" value="Exchange Server"/>
65
+ <param pos="0" name="service.product" value="Exchange 2007 Server"/>
66
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
67
+ <param pos="0" name="os.vendor" value="Microsoft"/>
68
+ <param pos="0" name="os.family" value="Windows"/>
69
+ <param pos="0" name="os.product" value="Windows"/>
70
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
71
+ </fingerprint>
72
+ <fingerprint pattern="^The Microsoft Exchange IMAP4 service is ready\.?$">
73
+ <description>Microsoft Exchange Server</description>
74
+ <example>The Microsoft Exchange IMAP4 service is ready.</example>
75
+ <param pos="0" name="service.vendor" value="Microsoft"/>
76
+ <param pos="0" name="service.family" value="Exchange Server"/>
77
+ <param pos="0" name="service.product" value="Exchange Server"/>
78
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
79
+ <param pos="0" name="os.vendor" value="Microsoft"/>
80
+ <param pos="0" name="os.family" value="Windows"/>
81
+ <param pos="0" name="os.product" value="Windows"/>
82
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
83
+ </fingerprint>
84
+ <fingerprint pattern="^Domino IMAP4 Server Release (\d+\.\d+.*) ready (.+)$">
85
+ <description>IBM Lotus Notes/Domino</description>
86
+ <example service.version="9.0.1FP9" host.time="Thu, 4 Apr 2019 20:19:31 +0200">Domino IMAP4 Server Release 9.0.1FP9 ready Thu, 4 Apr 2019 20:19:31 +0200</example>
87
+ <param pos="0" name="service.vendor" value="IBM"/>
88
+ <param pos="0" name="service.family" value="Lotus Domino"/>
89
+ <param pos="0" name="service.product" value="Lotus Domino"/>
90
+ <param pos="1" name="service.version"/>
91
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
92
+ <param pos="2" name="host.time"/>
93
+ </fingerprint>
94
+ <fingerprint pattern="^Domino IMAP4 Server V\.?(\d+\.\d+.*) ready (.+)$">
95
+ <description>IBM Lotus Notes/Domino - variant 2</description>
96
+ <param pos="0" name="service.vendor" value="IBM"/>
97
+ <param pos="0" name="service.family" value="Lotus Domino"/>
98
+ <param pos="0" name="service.product" value="Lotus Domino"/>
99
+ <param pos="1" name="service.version"/>
100
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
101
+ <param pos="2" name="host.time"/>
102
+ </fingerprint>
103
+ <fingerprint pattern="^[dD]ovecot (?:DA )?ready\.$">
104
+ <description>Dovecot Secure IMAP Server</description>
105
+ <example>Dovecot ready.</example>
106
+ <example>Dovecot DA ready.</example>
107
+ <param pos="0" name="service.family" value="Dovecot"/>
108
+ <param pos="0" name="service.product" value="Dovecot"/>
109
+ </fingerprint>
110
+ <fingerprint pattern="^Courier-IMAP ready. Copyright \d+-\d+">
111
+ <description>Courier MTA IMAP</description>
112
+ <example>Courier-IMAP ready. Copyright 1998-2002 Double Precision, Inc. See COPYING for distribution information.</example>
113
+ <param pos="0" name="service.vendor" value="Double Precision"/>
114
+ <param pos="0" name="service.family" value="Courier MTA"/>
115
+ <param pos="0" name="service.product" value="Courier IMAP"/>
116
+ </fingerprint>
117
+ <fingerprint pattern="^(\S+) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
118
+ <description>Nortel CallPilot</description>
119
+ <example>nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
120
+ <example>test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
121
+ <param pos="0" name="service.vendor" value="Nortel"/>
122
+ <param pos="0" name="service.product" value="CallPilot"/>
123
+ <param pos="2" name="service.version"/>
124
+ <param pos="0" name="service.cpe23" value="cpe:/a:nortel:callpilot:{service.version}"/>
125
+ <param pos="1" name="host.name"/>
126
+ </fingerprint>
127
+ <fingerprint pattern="^(\S+) Zimbra IMAP4rev1 server ready\.?$">
128
+ <description>VMware Zimbra IMAP</description>
129
+ <example host.name="foo.bar">foo.bar Zimbra IMAP4rev1 server ready</example>
130
+ <param pos="0" name="service.vendor" value="VMware"/>
131
+ <param pos="0" name="service.product" value="Zimbra"/>
132
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:-"/>
133
+ <param pos="1" name="host.name"/>
134
+ </fingerprint>
135
+ <fingerprint pattern="^(\S+) Zimbra (\S+) IMAP4rev1 server ready\.?$">
136
+ <description>VMware Zimbra IMAP with service version</description>
137
+ <example host.name="foo.bar" service.version="7.0.0_GA_3079">foo.bar Zimbra 7.0.0_GA_3079 IMAP4rev1 server ready</example>
138
+ <param pos="0" name="service.vendor" value="VMware"/>
139
+ <param pos="0" name="service.product" value="Zimbra"/>
140
+ <param pos="2" name="service.version"/>
141
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:{service.version}"/>
142
+ <param pos="1" name="host.name"/>
143
+ </fingerprint>
144
+ <fingerprint pattern="^(.+) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
145
+ <description>CMU Cyrus IMAP on Mac OS X</description>
146
+ <example host.name="example.com" service.version="2.2.12" os.version="10.4.0">example.com Cyrus IMAP4 v2.2.12-OS X 10.4.0 server ready</example>
147
+ <example host.name="example.com" service.version="2.3.8" os.version="10.5">example.com Cyrus IMAP4 v2.3.8-OS X Server 10.5: 9A562 server ready</example>
148
+ <param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
149
+ <param pos="0" name="service.family" value="Cyrus MTA"/>
150
+ <param pos="0" name="service.product" value="Cyrus IMAP"/>
151
+ <param pos="2" name="service.version"/>
152
+ <param pos="0" name="os.vendor" value="Apple"/>
153
+ <param pos="0" name="os.family" value="Mac OS X"/>
154
+ <param pos="0" name="os.product" value="Mac OS X"/>
155
+ <param pos="3" name="os.version"/>
156
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:{os.version}"/>
157
+ <param pos="1" name="host.name"/>
158
+ </fingerprint>
159
+ <fingerprint pattern="^(.+) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
160
+ <description>CMU Cyrus IMAP</description>
161
+ <example host.name="example.com" service.version="2.3.7">example.com Cyrus IMAP4 v2.3.7 server ready</example>
162
+ <example host.name="example.com" service.version="2.4.8-Invoca-RPM-2.4.8-1">example.com Cyrus IMAP Murder v2.4.8-Invoca-RPM-2.4.8-1 server ready</example>
163
+ <param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
164
+ <param pos="0" name="service.family" value="Cyrus MTA"/>
165
+ <param pos="0" name="service.product" value="Cyrus IMAP"/>
166
+ <param pos="2" name="service.version"/>
167
+ <param pos="1" name="host.name"/>
168
+ </fingerprint>
169
+ <!--
170
+
171
+ // Washington University imapd
172
+ IMAP_FP_PARSERS[0] = new PatternParser(
173
+ "^IMAP4rev1 v(.*) server ready$");
174
+ IMAP_FP_PARSERS[0].addConstantParam("product", "wu-imapd");
175
+ IMAP_FP_PARSERS[0].addParamSpec(1, "version");
176
+
177
+ // Washington University imapd (newer versions)
178
+ IMAP_FP_PARSERS[1] = new PatternParser(
179
+ "^IMAP4rev1 (.*) at (.*)$");
180
+ IMAP_FP_PARSERS[1].addConstantParam("product", "wu-imapd");
181
+ IMAP_FP_PARSERS[1].addParamSpec(1, "version");
182
+ IMAP_FP_PARSERS[1].addParamSpec(2, "server-time");
183
+
184
+ // University of Washington IMAP (imap-uw)
185
+ * OK <host> IMAP4rev1 2001.315 at Fri, 20 Jul 2007 21:51:34 -0700 (PDT)
186
+ * OK <host> IMAP4rev1 2001.315rh at Mon, 23 Jul 2007 07:56:09 -0500 (CDT)
187
+ * OK <host> IMAP4rev1 2004.357-p2k server ready at Mon, 23 Jul 2007 01:56:26 -0400 (EDT)
188
+ * OK <host> IMAP4rev1 2004.357s at Mon, 23 Jul 2007 15:17:56 +0000 (GMT)
189
+ * OK <host> IMAP4rev1 2004.357w at Tue, 24 Jul 2007 19:36:11 -0600 (MDT)
190
+
191
+ // cPanel Hosting Automation
192
+ // 10.8.0 (build 89) - BETA Tree - Change the imap version from 2003.339-cpanel to 2003.339p-cpanel to indicate the security patch has been applied.
193
+ // The patch has still be applied to 1.8.0 build 60+, we just show this now to avoid confusion.
194
+ * OK <host> IMAP4rev1 2003.339-cpanel at Sun, 22 Jul 2007 07:35:36 -0500 (CDT)
195
+ * OK <host> IMAP4rev1 2003.339p-cpanel at Sun, 22 Jul 2007 13:09:04 -0500 (CDT)
196
+
197
+ // PMDF IMAP
198
+ // * OK <system> PMDF IMAP4rev1 V6.1 (Message store V6.1)
199
+ // * OK xxx PMDF IMAP4rev1 V6.0-24 (Message store V6.0-24)
200
+ // * OK xxx PMDF IMAP4rev1 V6.0-9
201
+ IMAP_FP_PARSERS[5] = new PatternParser(
202
+ "^([^\\s]+) PMDF IMAP4rev1 V([^\\s]+).*$");
203
+ IMAP_FP_PARSERS[5].addConstantParam("product", "PMDF");
204
+ IMAP_FP_PARSERS[5].addParamSpec(1, "hostname");
205
+ IMAP_FP_PARSERS[5].addParamSpec(2, "version");
206
+
207
+ // PMDF IMAP (for VMS v7.1-2!)
208
+ IMAP_FP_PARSERS[6] = new PatternParser(
209
+ "^IMAP4 Server PMDF(.*) at (.*)$");
210
+ IMAP_FP_PARSERS[6].addConstantParam("product", "PMDF");
211
+ IMAP_FP_PARSERS[6].addParamSpec(1, "version");
212
+ IMAP_FP_PARSERS[6].addParamSpec(2, "server-time");
213
+
214
+ // Eudora Internet Mail Server
215
+ IMAP_FP_PARSERS[7] = new PatternParser(
216
+ "^Eudora Internet Mail Server (.*) .*$");
217
+ IMAP_FP_PARSERS[7].addConstantParam("product", "eudoraims");
218
+ IMAP_FP_PARSERS[7].addParamSpec(1, "version");
219
+
220
+ // Eudora Qualcomm WorldMail
221
+ // * OK WorldMail IMAP4 Server 6.1.19.0 ready
222
+ IMAP_FP_PARSERS[8] = new PatternParser(
223
+ "^WorldMail IMAP4 Server ([^\\s]+) ready$");
224
+ IMAP_FP_PARSERS[8].addConstantParam("product", "worldmail");
225
+ IMAP_FP_PARSERS[8].addParamSpec(1, "version");
226
+
227
+ // GNU Mailutils. Note that there is no version information
228
+ IMAP_FP_PARSERS[9] = new PatternParser("^IMAP4rev1$");
229
+ IMAP_FP_PARSERS[9].addConstantParam("product", "GNU Mailutils");
230
+
231
+ * OK <host> IMAP4rev1 MDaemon 8.1.4 ready
232
+ * OK <host> /bin/sh IMAP server ready
233
+ * OK IMAP/POP ready.
234
+ * OK IMAP4 Server (IMail 6.04)
235
+ * OK IMAP4rev1 server
236
+ * OK IMAP4rev1 SmarterMail
237
+ * OK IMAP4rev1 SmartMax IMAPMax 5 Ready
238
+ * OK imapfront ready. + stunnel
239
+ * OK <host> mailserver ready.
240
+ * OK Merak 8.0.3 IMAP4rev1 Mon, 23 Jul 2007 18:22:49 +0100
241
+ * OK <host> Sendmail Advanced Message Server IMAP4rev1 (1.3.2/390)
242
+ * OK Welcome IMAP Server
243
+
244
+ -->
245
+ </fingerprints>
@@ -0,0 +1,711 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="ldap.search_result" protocol="ldap" database_type="service" preference=".80">
3
+ <!--
4
+ Notes: Ruby will fail to build the RegExp if it contains \x84 which is a standard
5
+ byte in ASN.1 Sequence length fields.
6
+ -->
7
+ <!--
8
+ Samba - position prior to Windows entries due to regex. When testing new
9
+ Samba fingerprints make sure you disable the matches for the version of
10
+ Windows that Samba is eumlating or else the Windows fallback fingerprint for
11
+ the given OS version may match.
12
+ -->
13
+ <fingerprint pattern="(?m:vendorName1.\x04.Samba.*domainControllerFunctionality1.{1,5}\x04\x014)">
14
+ <description>Samba Active Directory Controller</description>
15
+ <example _encoding="base64">
16
+ dmVuZG9yTmFtZTEfBB1TYW1iYSBUZWFtIChodHRwOi8vc2FtYmEub3JnKS5kYXRhLnJlbW92Z
17
+ WQuBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTEDBAE0MB4=
18
+ </example>
19
+ <param pos="0" name="service.vendor" value="Samba"/>
20
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
21
+ </fingerprint>
22
+ <fingerprint pattern="(?m:vendorName1.\x04.Samba.*domainFunctionality1.\x04\x0100.\x04\x13forestFunctionality1\x03\x04\x0100)">
23
+ <description>Samba Active Directory Controller emulating Windows 2000</description>
24
+ <example _encoding="base64">
25
+ dmVuZG9yTmFtZTEfBB1TYW1iYSBUZWFtIChodHRwOi8vc2FtYmEub3JnKS5kYXRhLnJlbW92Z
26
+ WQuZG9tYWluRnVuY3Rpb25hbGl0eTEDBAEwMBoEE2ZvcmVzdEZ1bmN0aW9uYWxpdHkxAwQBMD
27
+ AeBBQ=
28
+ </example>
29
+ <param pos="0" name="service.vendor" value="Samba"/>
30
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
31
+ </fingerprint>
32
+ <!--
33
+ Windows Active Directory and Lightweight Directory Server (ADAM)
34
+
35
+ domainControllerFunctionality reference:
36
+ https://msdn.microsoft.com/en-us/library/cc223272.aspx
37
+
38
+ supportedCapabilities reference (for Windows 2000)
39
+ https://msdn.microsoft.com/en-us/library/cc223359.aspx
40
+
41
+ 1.2.840.113556.1.4.800 = Active Directory Controller
42
+ 1.2.840.113556.1.4.1851 = Lightweight Directory Server / ADAM
43
+ -->
44
+ <!-- Windows 2016 -->
45
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x017)">
46
+ <description>Active Directory Controller on Windows Server 2016</description>
47
+ <example _encoding="base64">
48
+ dGllczGEAAAAlQQWMS4yLjg0MC4xMTM1NTYuMS40LjgwMAQuZGF0YS5yZW1vdmVkLjCEAAAAK
49
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATc=
50
+ </example>
51
+ <param pos="0" name="service.vendor" value="Microsoft"/>
52
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
53
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
54
+ <param pos="0" name="os.vendor" value="Microsoft"/>
55
+ <param pos="0" name="os.family" value="Windows"/>
56
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
57
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
58
+ </fingerprint>
59
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x017)">
60
+ <description>Microsoft LDS on Windows Server Server 2016</description>
61
+ <example _encoding="base64">
62
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLjCEAAAAK
63
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATc=
64
+ </example>
65
+ <param pos="0" name="service.vendor" value="Microsoft"/>
66
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
67
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
68
+ <param pos="0" name="os.vendor" value="Microsoft"/>
69
+ <param pos="0" name="os.family" value="Windows"/>
70
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
71
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
72
+ </fingerprint>
73
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x017)">
74
+ <description>Windows Server Server 2016</description>
75
+ <example _encoding="base64">
76
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNw==
77
+ </example>
78
+ <param pos="0" name="os.vendor" value="Microsoft"/>
79
+ <param pos="0" name="os.family" value="Windows"/>
80
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
81
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
82
+ </fingerprint>
83
+ <!-- Windows 2012 R2 -->
84
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x016)">
85
+ <description>Active Directory Controller on Windows Server 2012 R2</description>
86
+ <example _encoding="base64">
87
+ ZXMxhAAAAJUEFjEuMi44NDAuMTEzNTU2LjEuNC44MDAELmRhdGEucmVtb3ZlZC6EAAAAKAQdZ
88
+ G9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATYw
89
+ </example>
90
+ <param pos="0" name="service.vendor" value="Microsoft"/>
91
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
92
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
93
+ <param pos="0" name="os.vendor" value="Microsoft"/>
94
+ <param pos="0" name="os.family" value="Windows"/>
95
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
96
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
97
+ </fingerprint>
98
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x016)">
99
+ <description>Microsoft LDS on Windows Server Server 2012 R2</description>
100
+ <example _encoding="base64">
101
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLoQAAAAoB
102
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNjA=
103
+ </example>
104
+ <param pos="0" name="service.vendor" value="Microsoft"/>
105
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
106
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
107
+ <param pos="0" name="os.vendor" value="Microsoft"/>
108
+ <param pos="0" name="os.family" value="Windows"/>
109
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
110
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
111
+ </fingerprint>
112
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x016)">
113
+ <description>Windows Server Server 2012 R2</description>
114
+ <example _encoding="base64">
115
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNjA=
116
+ </example>
117
+ <param pos="0" name="os.vendor" value="Microsoft"/>
118
+ <param pos="0" name="os.family" value="Windows"/>
119
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
120
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
121
+ </fingerprint>
122
+ <!-- Windows 2012 -->
123
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x015)">
124
+ <description>Active Directory Controller on Windows Server 2012</description>
125
+ <example _encoding="base64">
126
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQwhAAAACgEH
127
+ WRvbWFpbkNvbnRyb2xsZXJGdW5jdGlvbmFsaXR5MYQAAAADBAE1MA==
128
+ </example>
129
+ <param pos="0" name="service.vendor" value="Microsoft"/>
130
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
131
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
132
+ <param pos="0" name="os.vendor" value="Microsoft"/>
133
+ <param pos="0" name="os.family" value="Windows"/>
134
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
135
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
136
+ </fingerprint>
137
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x015)">
138
+ <description>Microsoft LDS on Windows Server 2012 R2</description>
139
+ <example _encoding="base64">
140
+ ZXMxhAAAAK8EFzEuMi44NDAuMTEzNTU2LjEuNC4xODUxBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
141
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNTA=
142
+ </example>
143
+ <param pos="0" name="service.vendor" value="Microsoft"/>
144
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
145
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
146
+ <param pos="0" name="os.vendor" value="Microsoft"/>
147
+ <param pos="0" name="os.family" value="Windows"/>
148
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
149
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
150
+ </fingerprint>
151
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x015)">
152
+ <description>Windows Server Server 2012</description>
153
+ <example _encoding="base64">
154
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNTA=
155
+ </example>
156
+ <param pos="0" name="os.vendor" value="Microsoft"/>
157
+ <param pos="0" name="os.family" value="Windows"/>
158
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
159
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
160
+ </fingerprint>
161
+ <!-- Windows 2008 R2 -->
162
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x014)">
163
+ <description>Active Directory Controller on Windows Server 2008 R2</description>
164
+ <example _encoding="base64">
165
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
166
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNDA=
167
+ </example>
168
+ <param pos="0" name="service.vendor" value="Microsoft"/>
169
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
170
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
171
+ <param pos="0" name="os.vendor" value="Microsoft"/>
172
+ <param pos="0" name="os.family" value="Windows"/>
173
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
174
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
175
+ </fingerprint>
176
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x014)">
177
+ <description>Microsoft LDS on Windows Server Server 2008 R2</description>
178
+ <example _encoding="base64">
179
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLoQAAAAoB
180
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNDA=
181
+ </example>
182
+ <param pos="0" name="service.vendor" value="Microsoft"/>
183
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
184
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
185
+ <param pos="0" name="os.vendor" value="Microsoft"/>
186
+ <param pos="0" name="os.family" value="Windows"/>
187
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
188
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
189
+ </fingerprint>
190
+ <!--
191
+ This generic match for domainControllerFunctionality = 4 will capture
192
+ current Samba implementations. Disable the fingerprint below when testing Samba
193
+ -->
194
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x014)">
195
+ <description>Windows Server Server 2008 R2</description>
196
+ <example _encoding="base64">
197
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBNDA=
198
+ </example>
199
+ <param pos="0" name="os.vendor" value="Microsoft"/>
200
+ <param pos="0" name="os.family" value="Windows"/>
201
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
202
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
203
+ </fingerprint>
204
+ <!-- Windows 2008 -->
205
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x013)">
206
+ <description>Active Directory Controller on Windows Server 2008</description>
207
+ <example _encoding="base64">
208
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
209
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMzA=
210
+ </example>
211
+ <param pos="0" name="service.vendor" value="Microsoft"/>
212
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
213
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
214
+ <param pos="0" name="os.vendor" value="Microsoft"/>
215
+ <param pos="0" name="os.family" value="Windows"/>
216
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
217
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
218
+ </fingerprint>
219
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x013)">
220
+ <description>Microsoft LDS on Windows Server 2008</description>
221
+ <example _encoding="base64">
222
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLjCEAAAAK
223
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATMw
224
+ </example>
225
+ <param pos="0" name="service.vendor" value="Microsoft"/>
226
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
227
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
228
+ <param pos="0" name="os.vendor" value="Microsoft"/>
229
+ <param pos="0" name="os.family" value="Windows"/>
230
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
231
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
232
+ </fingerprint>
233
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x013)">
234
+ <description>Windows Server Server 2008</description>
235
+ <example _encoding="base64">
236
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMzA=
237
+ </example>
238
+ <param pos="0" name="os.vendor" value="Microsoft"/>
239
+ <param pos="0" name="os.family" value="Windows"/>
240
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
241
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
242
+ </fingerprint>
243
+ <!-- Windows 2003 -->
244
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x012)">
245
+ <description>Active Directory Controller on Windows Server 2003</description>
246
+ <example _encoding="base64">
247
+ aWVzMYQAAACVBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwBC5kYXRhLnJlbW92ZWQuMIQAAAAoB
248
+ B1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMjA=
249
+ </example>
250
+ <param pos="0" name="service.vendor" value="Microsoft"/>
251
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
252
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
253
+ <param pos="0" name="os.vendor" value="Microsoft"/>
254
+ <param pos="0" name="os.family" value="Windows"/>
255
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
256
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
257
+ </fingerprint>
258
+ <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x012)">
259
+ <description>Microsoft LDS on Windows Server 2003</description>
260
+ <example _encoding="base64">
261
+ aWVzMYQAAACvBBcxLjIuODQwLjExMzU1Ni4xLjQuMTg1MQQuZGF0YS5yZW1vdmVkLjCEAAAAK
262
+ AQdZG9tYWluQ29udHJvbGxlckZ1bmN0aW9uYWxpdHkxhAAAAAMEATIw
263
+ </example>
264
+ <param pos="0" name="service.vendor" value="Microsoft"/>
265
+ <param pos="0" name="service.product" value="Lightweight Directory Server"/>
266
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory_lightweight_directory_service:-"/>
267
+ <param pos="0" name="os.vendor" value="Microsoft"/>
268
+ <param pos="0" name="os.family" value="Windows"/>
269
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
270
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
271
+ </fingerprint>
272
+ <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x012)">
273
+ <description>Windows Server Server 2003</description>
274
+ <example _encoding="base64">
275
+ MIQAAAAoBB1kb21haW5Db250cm9sbGVyRnVuY3Rpb25hbGl0eTGEAAAAAwQBMjA=
276
+ </example>
277
+ <param pos="0" name="os.vendor" value="Microsoft"/>
278
+ <param pos="0" name="os.family" value="Windows"/>
279
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
280
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
281
+ </fingerprint>
282
+ <!-- Win Server 2000 Service Pack 3 only has two matching supportedCapabilities OIDs, match them and look for explicit end-->
283
+ <fingerprint pattern="(?im:supportedCapabilities1.{1,5}\x04\x161.2.840.113556.1.4.800\x04\x171.2.840.113556.1.4.17910.{1,5}\x04.(?:supportedControl|isSynchronized))">
284
+ <description>Active Directory Controller on Windows Server 2000 SP 3</description>
285
+ <example _encoding="base64">
286
+ c3VwcG9ydGVkQ2FwYWJpbGl0aWVzMTEEFjEuMi44NDAuMTEzNTU2LjEuNC44MDAEFzEuMi44N
287
+ DAuMTEzNTU2LjEuNC4xNzkxMEQEEHN1cHBvcnRlZENvbnRyb2x8
288
+ </example>
289
+ <example _encoding="base64">
290
+ c3VwcG9ydGVkQ2FwYWJpbGl0aWVzMTEEFjEuMi44NDAuMTEzNTU2LjEuNC44MDAEFzEuMi44N
291
+ DAuMTEzNTU2LjEuNC4xNzkxMIQAAAAcBA5pc1N5bmNocm9uaXplZDE=
292
+ </example>
293
+ <param pos="0" name="service.vendor" value="Microsoft"/>
294
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
295
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
296
+ <param pos="0" name="os.vendor" value="Microsoft"/>
297
+ <param pos="0" name="os.family" value="Windows"/>
298
+ <param pos="0" name="os.product" value="Windows Server 2000"/>
299
+ <param pos="0" name="os.version" value="Windows Server 2000 SP3"/>
300
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:Windows Server 2000 SP3"/>
301
+ </fingerprint>
302
+ <!-- Win Server 2000 RTM only has a single matching supportedCapabilities OID, match it and look for explicit end-->
303
+ <fingerprint pattern="(?im:supportedCapabilities1.{1,5}\x04\x161.2.840.113556.1.4.8000.{1,5}\x04.isSynchronized1)">
304
+ <description>Active Directory Controller on Windows Server 2000</description>
305
+ <example _encoding="base64">
306
+ c3VwcG9ydGVkQ2FwYWJpbGl0aWVzMYQAAAAYBBYxLjIuODQwLjExMzU1Ni4xLjQuODAwMIQAA
307
+ AAcBA5pc1N5bmNocm9uaXplZDE=
308
+ </example>
309
+ <param pos="0" name="service.vendor" value="Microsoft"/>
310
+ <param pos="0" name="service.product" value="Active Directory Controller"/>
311
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:active_directory:-"/>
312
+ <param pos="0" name="os.vendor" value="Microsoft"/>
313
+ <param pos="0" name="os.family" value="Windows"/>
314
+ <param pos="0" name="os.product" value="Windows Server 2000"/>
315
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
316
+ </fingerprint>
317
+ <!-- End of Microsoft Windows Section -->
318
+ <fingerprint pattern="(?im:top\x04..penLDAProotDSE)">
319
+ <description>OpenLDAP</description>
320
+ <example _encoding="base64">
321
+ dm9iamVjdENsYXNzMRYEA3RvcAQPT3BlbkxEQVByb290RFNFMA==
322
+ </example>
323
+ <param pos="0" name="service.vendor" value="OpenLDAP"/>
324
+ <param pos="0" name="service.product" value="OpenLDAP"/>
325
+ <param pos="0" name="service.cpe23" value="cpe:/a:openldap:openldap:-"/>
326
+ </fingerprint>
327
+ <fingerprint pattern="(?i:namingcontexts1.\x04.fn=ContactRoot0.[\x02\x04])">
328
+ <description>Kerio Connect</description>
329
+ <example service.product="Connect" _encoding="base64">
330
+ bmFtaW5nQ29udGV4dHMxEAQOZm49Q29udGFjdFJvb3QwKAQUZGVmYXVsdE5hbWluZ0NvbnRle
331
+ HQx
332
+ </example>
333
+ <param pos="0" name="service.vendor" value="Kerio"/>
334
+ <param pos="0" name="service.product" value="Connect"/>
335
+ </fingerprint>
336
+ <fingerprint pattern="(?im:vmwPlatformServicesControllerVersion1.\x04.(\d\.\d\.\d)0.)">
337
+ <description>VMware Platform Services Controller</description>
338
+ <example service.version="6.0.0" _encoding="base64">
339
+ dm13UGxhdGZvcm1TZXJ2aWNlc0NvbnRyb2xsZXJWZXJzaW9uMQcEBTYuMC4wMCc=
340
+ </example>
341
+ <param pos="0" name="service.vendor" value="VMware"/>
342
+ <param pos="0" name="service.product" value="Platform Services Controller"/>
343
+ <param pos="1" name="service.version"/>
344
+ </fingerprint>
345
+ <!-- Fedora / 389 Project family -->
346
+ <!-- http://directory.fedoraproject.org/docs/389ds/FAQ/history.html -->
347
+ <fingerprint pattern="(?i:vendorname1.\x04.Fedora Project0.\x04\rvendorversion1.\x04.Fedora-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+))">
348
+ <description>Fedora Project Fedora Directory Server</description>
349
+ <example service.version="1.0.4 B2006.312.5450" _encoding="base64">
350
+ dmVuZG9yTmFtZTEQBA5GZWRvcmEgUHJvamVjdDA3BA12ZW5kb3JWZXJzaW9uMSYEJEZlZG9yY
351
+ S1EaXJlY3RvcnkvMS4wLjQgQjIwMDYuMzEyLjU0NTA=
352
+ </example>
353
+ <example service.version="1.0.4 B2007.304.11380" _encoding="base64">
354
+ dmVuZG9yTmFtZTEQBA5GZWRvcmEgUHJvamVjdDA4BA12ZW5kb3JWZXJzaW9uMScEJUZlZG9yY
355
+ S1EaXJlY3RvcnkvMS4wLjQgQjIwMDcuMzA0LjExMzgw
356
+ </example>
357
+ <param pos="0" name="service.vendor" value="Red Hat"/>
358
+ <param pos="0" name="service.product" value="Fedora Directory Server"/>
359
+ <param pos="1" name="service.version"/>
360
+ </fingerprint>
361
+ <fingerprint pattern="(?i:vendorname1.\x04.389 Project0.\x04\rvendorversion1.\x04.389-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+))">
362
+ <description>389 Project 389 Directory Server</description>
363
+ <example service.version="1.2.11.25 B2013.325.19510" _encoding="base64">
364
+ dmVuZG9yTmFtZTENBAszODkgUHJvamVjdDA5BA12ZW5kb3JWZXJzaW9uMSgEJjM4OS1EaXJlY
365
+ 3RvcnkvMS4yLjExLjI1IEIyMDEzLjMyNS4xOTUxMA==
366
+ </example>
367
+ <param pos="0" name="service.vendor" value="389 Project"/>
368
+ <param pos="0" name="service.product" value="389 Directory Server"/>
369
+ <param pos="1" name="service.version"/>
370
+ </fingerprint>
371
+ <fingerprint pattern="(?im:vendorName1.\x04.CentOS0.\x04\rvendorVersion1.\x04.CentOS-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+).\x04\v)">
372
+ <description>CentOS CentOS Directory Server</description>
373
+ <example service.version="8.2.8 B2012.041.12270" _encoding="base64">
374
+ dmVuZG9yTmFtZTEIBAZDZW50T1MwOAQNdmVuZG9yVmVyc2lvbjEnBCVDZW50T1MtRGlyZWN0b
375
+ 3J5LzguMi44IEIyMDEyLjA0MS4xMjI3MC8ECw==
376
+ </example>
377
+ <param pos="0" name="service.vendor" value="CentOS"/>
378
+ <param pos="0" name="service.product" value="CentOS Directory Server"/>
379
+ <param pos="1" name="service.version"/>
380
+ </fingerprint>
381
+ <fingerprint pattern="(?im:vendorName1.\x04.Red Hat(?:, Inc.)?0.\x04\rvendorVersion1.\x04.Red Hat-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+).\x04\v)">
382
+ <description>Red Hat Red Hat Directory Server</description>
383
+ <example service.version="8.2.0 B2010.210.0590" _encoding="base64">
384
+ dmVuZG9yTmFtZTEJBAdSZWQgSGF0MDgEDXZlbmRvclZlcnNpb24xJwQlUmVkIEhhdC1EaXJlY
385
+ 3RvcnkvOC4yLjAgQjIwMTAuMjEwLjA1OTAgBAs=
386
+ </example>
387
+ <param pos="0" name="service.vendor" value="Red Hat"/>
388
+ <param pos="0" name="service.product" value="Red Hat Directory Server"/>
389
+ <param pos="1" name="service.version"/>
390
+ <param pos="0" name="service.cpe23" value="cpe:/a:redhat:directory_server:{service.version}"/>
391
+ </fingerprint>
392
+ <fingerprint pattern="(?i:vendorname1.\x04.Netscape Communications Corp.0.\x04\rvendorversion1.\x04.Netscape-Directory/(\d\.\d[\d.]* B\d+\.\d+\.\d+).\x04\v)">
393
+ <description>Netscape Directory Server</description>
394
+ <example service.version="6.11 B2002.281.08530" _encoding="base64">
395
+ dmVuZG9yTmFtZTEfBB1OZXRzY2FwZSBDb21tdW5pY2F0aW9ucyBDb3JwLjA5BA12ZW5kb3JWZ
396
+ XJzaW9uMSgEJk5ldHNjYXBlLURpcmVjdG9yeS82LjExIEIyMDAyLjI4MS4wODUzMC8ECw==
397
+ </example>
398
+ <example service.version="6.11 B2002.281.08530" _encoding="base64">
399
+ dmVuZG9ybmFtZTEfBB1OZXRzY2FwZSBDb21tdW5pY2F0aW9ucyBDb3JwLjA5BA12ZW5kb3J2Z
400
+ XJzaW9uMSgEJk5ldHNjYXBlLURpcmVjdG9yeS82LjExIEIyMDAyLjI4MS4wODUzMC8ECw==
401
+ </example>
402
+ <param pos="0" name="service.vendor" value="Netscape"/>
403
+ <param pos="0" name="service.product" value="Netscape Directory Server"/>
404
+ <param pos="1" name="service.version"/>
405
+ </fingerprint>
406
+ <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Release (\d+\.\d+[\w .]*)0.\x04.dominomajminversion)">
407
+ <description>IBM (Lotus) Domino LDAP Server - majminversion variant</description>
408
+ <example service.version="8.5.3" _encoding="base64">
409
+ SUJNIExvdHVzIFNvZnR3YXJlMCAEDXZlbmRvcnZlcnNpb24xDwQNUmVsZWFzZSA4LjUuMzAeB
410
+ BNkb21pbm9tYWptaW52ZXJzaW9uMQcE
411
+ </example>
412
+ <example service.version="9.0.1FP6 HF130" _encoding="base64">
413
+ SUJNIExvdHVzIFNvZnR3YXJlMCkEDXZlbmRvcnZlcnNpb24xGAQWUmVsZWFzZSA5LjAuMUZQN
414
+ iBIRjEzMDAeBBNkb21pbm9tYWptaW52ZXJzaW9uMQcE
415
+ </example>
416
+ <param pos="0" name="service.vendor" value="IBM"/>
417
+ <param pos="0" name="service.product" value="Domino LDAP Server"/>
418
+ <param pos="1" name="service.version"/>
419
+ </fingerprint>
420
+ <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Release (\d+\.\d+[\w .]*)0\f)">
421
+ <description>IBM (Lotus) Domino LDAP Server</description>
422
+ <example service.version="9.0.1FP4 HF523" _encoding="base64">
423
+ dmVuZG9ybmFtZTEUBBJJQk0gTG90dXMgU29mdHdhcmUwKQQNdmVuZG9ydmVyc2lvbjEYBBZSZ
424
+ WxlYXNlIDkuMC4xRlA0IEhGNTIzMAwC
425
+ </example>
426
+ <param pos="0" name="service.vendor" value="IBM"/>
427
+ <param pos="0" name="service.product" value="Domino LDAP Server"/>
428
+ <param pos="1" name="service.version"/>
429
+ </fingerprint>
430
+ <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Build (V[\w .]*)0.\x04.dominomajminversion)">
431
+ <description>IBM (Lotus) Domino LDAP Server - build variant</description>
432
+ <example service.version="V902_12302013" _encoding="base64">
433
+ SUJNIExvdHVzIFNvZnR3YXJlMCYEDXZlbmRvcnZlcnNpb24xFQQTQnVpbGQgVjkwMl8xMjMwM
434
+ jAxMzAeBBNkb21pbm9tYWptaW52ZXJzaW9uMQcE
435
+ </example>
436
+ <param pos="0" name="service.vendor" value="IBM"/>
437
+ <param pos="0" name="service.product" value="Domino LDAP Server"/>
438
+ <param pos="1" name="service.version"/>
439
+ </fingerprint>
440
+ <!-- Attachmate Group (NetIQ) purchased Novell in 2011, and then merged w/ Micro Focus in 2014 -->
441
+ <fingerprint pattern="(?im:vendorName1\x13\x04\x11NetIQ Corporation0.\x04\rvendorVersion.{4}LDAP Agent for NetIQ eDirectory (\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
442
+ <description>NetIQ LDAP Agent for eDirectory</description>
443
+ <example service.version="8.8 SP8 (20808.06)" _encoding="base64">
444
+ eDA0CnZlbmRvck5hbWUxEwQRTmV0SVEgQ29ycG9yYXRpb24wRQQNdmVuZG9yVmVyc2lvbjE0B
445
+ DJMREFQIEFnZW50IGZvciBOZXRJUSBlRGlyZWN0b3J5IDguOCBTUDggKDIwODA4LjA2KTBJBA
446
+ ==
447
+ </example>
448
+ <param pos="0" name="service.vendor" value="NetIQ"/>
449
+ <param pos="0" name="service.product" value="LDAP Agent for eDirectory"/>
450
+ <param pos="1" name="service.version"/>
451
+ </fingerprint>
452
+ <fingerprint pattern="(?im:vendorName1\x0E\x04\fNovell, Inc.0.\x04\rvendorVersion.{4}LDAP Agent for Novell eDirectory (\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
453
+ <description>Novell LDAP Agent for eDirectory</description>
454
+ <example service.version="8.7.3.8 (10554.99)" _encoding="base64">
455
+ dmVuZG9yTmFtZTEOBAxOb3ZlbGwsIEluYy4wRgQNdmVuZG9yVmVyc2lvbjE1BDNMREFQIEFnZ
456
+ W50IGZvciBOb3ZlbGwgZURpcmVjdG9yeSA4LjcuMy44ICgxMDU1NC45OSkwKQQ=
457
+ </example>
458
+ <example service.version="8.8 SP4 (20217.05)" _encoding="base64">
459
+ dmVuZG9yTmFtZTEOBAxOb3ZlbGwsIEluYy4wRgQNdmVuZG9yVmVyc2lvbjE1BDNMREFQIEFnZ
460
+ W50IGZvciBOb3ZlbGwgZURpcmVjdG9yeSA4LjggU1A0ICgyMDIxNy4wNSkwHQQ=
461
+ </example>
462
+ <param pos="0" name="service.vendor" value="Novell"/>
463
+ <param pos="0" name="service.product" value="LDAP Agent for eDirectory"/>
464
+ <param pos="1" name="service.version"/>
465
+ </fingerprint>
466
+ <fingerprint pattern="(?im:vendorName1\x0E\x04\fNovell, Inc.0/\x04\rvendorVersion1\x1E\x04\x1CeDirectory v(\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
467
+ <description>Novell eDirectory</description>
468
+ <example service.version="8.6.2 (10350.18)" _encoding="base64">
469
+ dmVuZG9yTmFtZTEOBAxOb3ZlbGwsIEluYy4wLwQNdmVuZG9yVmVyc2lvbjEeBBxlRGlyZWN0b
470
+ 3J5IHY4LjYuMiAoMTAzNTAuMTgpMCcE
471
+ </example>
472
+ <param pos="0" name="service.vendor" value="Novell"/>
473
+ <param pos="0" name="service.product" value="eDirectory"/>
474
+ <param pos="1" name="service.version"/>
475
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:edirectory:{service.version}"/>
476
+ </fingerprint>
477
+ <!-- Various iterations of Sun, now Oracle, Directory Server -->
478
+ <fingerprint pattern="(?i:vendorname1\x18\x04\x16Sun Microsystems, Inc.0.+\x04\rvendorversion1.{1,2}\x04.{1,2}Sun[- ]Java\(tm\)[- ]System[- ]Directory(?: Server)?/(\d\.\d+[\w.]*)0.{1,3}\x04)">
479
+ <description>Sun Java(TM) System Directory Server</description>
480
+ <example service.version="5.2_Patch_6" _encoding="base64">
481
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMEMEDXZlbmRvclZlcnNpb24xM
482
+ gQwU3VuIEphdmEoVE0pIFN5c3RlbSBEaXJlY3RvcnkgU2VydmVyLzUuMl9QYXRjaF82MC8E
483
+ </example>
484
+ <example service.version="6.2_PR_CUMULATIVE_6_2_6597523_6527909" _encoding="base64">
485
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMFYEDXZlbmRvclZlcnNpb24xR
486
+ QRDU3VuLUphdmEodG0pLVN5c3RlbS1EaXJlY3RvcnkvNi4yX1BSX0NVTVVMQVRJVkVfNl8yXz
487
+ Y1OTc1MjNfNjUyNzkwOTBNBA==
488
+ </example>
489
+ <example service.version="6.3.1" _encoding="base64">
490
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDYEDXZlbmRvclZlcnNpb24xJ
491
+ QQjU3VuLUphdmEodG0pLVN5c3RlbS1EaXJlY3RvcnkvNi4zLjEwLwQ=
492
+ </example>
493
+ <example service.version="6.3.1.1.1" _encoding="base64">
494
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDoEDXZlbmRvclZlcnNpb24xK
495
+ QQnU3VuLUphdmEodG0pLVN5c3RlbS1EaXJlY3RvcnkvNi4zLjEuMS4xMIGJBA==
496
+ </example>
497
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
498
+ <param pos="0" name="service.product" value="Sun Java System Directory Server"/>
499
+ <param pos="1" name="service.version"/>
500
+ </fingerprint>
501
+ <fingerprint pattern="(?i:vendorname1\x18\x04\x16Sun Microsystems, Inc.0.\x04\rvendorversion1.\x04.Sun-Directory-Server/([\w.]+)0.{1,3}\x04)">
502
+ <description>Sun Directory Server</description>
503
+ <example service.version="7.0" _encoding="base64">
504
+ dmVuZG9ybmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMCsEDXZlbmRvcnZlcnNpb24xG
505
+ gQYU3VuLURpcmVjdG9yeS1TZXJ2ZXIvNy4wMC8E
506
+ </example>
507
+ <example service.version="7.0_sec" _encoding="base64">
508
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMC8EDXZlbmRvclZlcnNpb24xH
509
+ gQcU3VuLURpcmVjdG9yeS1TZXJ2ZXIvNy4wX3NlYzAgBA==
510
+ </example>
511
+ <example service.version="11.1.1.3.0" _encoding="base64">
512
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDIEDXZlbmRvclZlcnNpb24xI
513
+ QQfU3VuLURpcmVjdG9yeS1TZXJ2ZXIvMTEuMS4xLjMuMDAgBA==
514
+ </example>
515
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
516
+ <param pos="0" name="service.product" value="Sun Directory Server"/>
517
+ <param pos="1" name="service.version"/>
518
+ </fingerprint>
519
+ <fingerprint pattern="(?i:vendorname1\x14\x04\x12Oracle Corporation0.\x04\rvendorversion1.\x04.Sun-Directory-Server/([\w.]+)[0 ].{1,3}\x04)">
520
+ <description>Oracle Sun Directory Server</description>
521
+ <example service.version="11.1.1.7.2" _encoding="base64">
522
+ dmVuZG9yTmFtZTEUBBJPcmFjbGUgQ29ycG9yYXRpb24wMgQNdmVuZG9yVmVyc2lvbjEhBB9Td
523
+ W4tRGlyZWN0b3J5LVNlcnZlci8xMS4xLjEuNy4yMCAE
524
+ </example>
525
+ <example service.version="11.1.1.7.0_PR_16776826_16841985" _encoding="base64">
526
+ dmVuZG9yTmFtZTEUBBJPcmFjbGUgQ29ycG9yYXRpb24wRwQNdmVuZG9yVmVyc2lvbjE2BDRTd
527
+ W4tRGlyZWN0b3J5LVNlcnZlci8xMS4xLjEuNy4wX1BSXzE2Nzc2ODI2XzE2ODQxOTg1ME0E
528
+ </example>
529
+ <param pos="0" name="service.vendor" value="Oracle"/>
530
+ <param pos="0" name="service.product" value="Sun Directory Server"/>
531
+ <param pos="1" name="service.version"/>
532
+ </fingerprint>
533
+ <fingerprint pattern="(?im:vendorName1\x17\x04\x15Sun Microsystems, Inc0.\x04\rvendorVersion1.\x04.Directory Proxy Server ([\w.]+)0.\x04)">
534
+ <description>Sun Directory Proxy Server</description>
535
+ <example service.version="11.1.1.7.1" _encoding="base64">
536
+ dmVuZG9yTmFtZTEXBBVTdW4gTWljcm9zeXN0ZW1zLCBJbmMwNAQNdmVuZG9yVmVyc2lvbjEjB
537
+ CFEaXJlY3RvcnkgUHJveHkgU2VydmVyIDExLjEuMS43LjEwRQQ=
538
+ </example>
539
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
540
+ <param pos="0" name="service.product" value="Sun Directory Proxy Server"/>
541
+ <param pos="1" name="service.version"/>
542
+ </fingerprint>
543
+ <!-- Very old, rare, same family as above. Roll into those? -->
544
+ <fingerprint pattern="(?i:vendorname1.\x04.Sun Microsystems, Inc.0.\x04\rvendorversion1.\x04.Sun-ONE-Directory/([\w.]+)0.\x04)">
545
+ <description>Sun ONE Directory Server</description>
546
+ <example service.version="5.2" _encoding="base64">
547
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMCgEDXZlbmRvclZlcnNpb24xF
548
+ wQVU3VuLU9ORS1EaXJlY3RvcnkvNS4yMC8E
549
+ </example>
550
+ <example service.version="5.2_Patch_1" _encoding="base64">
551
+ dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDAEDXZlbmRvclZlcnNpb24xH
552
+ wQdU3VuLU9ORS1EaXJlY3RvcnkvNS4yX1BhdGNoXzEwPgQ=
553
+ </example>
554
+ <param pos="0" name="service.vendor" value="Sun Microsystems"/>
555
+ <param pos="0" name="service.product" value="Sun ONE Directory Server"/>
556
+ <param pos="1" name="service.version"/>
557
+ </fingerprint>
558
+ <!-- IBM [Tivoli | Security] Directory Server -->
559
+ <fingerprint pattern="(?im:International Business Machines \(IBM\)0.*\x04\rvendorversion1.\x00\x00\x00.\x04.([\d.]+)0.\x00.*ibm-osregistrycontext1.\x00\x00\x00.\x04.OS400-SYS=)">
560
+ <description>IBM Security Directory Server on OS/400 (IBM i)</description>
561
+ <example service.version="5.2" _encoding="base64">
562
+ SW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyAoSUJNKTCEAAAAGgQNdmVuZG9ydmVyc
563
+ 2lvbjGEAAAABQQDNS4yMIQAAAArBBxpYm0tc2xhcGRpc2NvbmZpZ3VyYXRpb25tb2RlMYQAAA
564
+ AHBAVGQUxTRTCEAAAARAQVaWJtLW9zcmVnaXN0cnljb250ZXh0MYQAAAAnBCVPUzQwMC1TWVM9
565
+ </example>
566
+ <param pos="0" name="os.vendor" value="IBM"/>
567
+ <param pos="0" name="os.family" value="OS/400"/>
568
+ <param pos="0" name="os.product" value="OS/400 (IBM i)"/>
569
+ <param pos="0" name="service.vendor" value="IBM"/>
570
+ <param pos="0" name="service.product" value="Security Directory Server"/>
571
+ <param pos="1" name="service.version"/>
572
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:security_directory_server:{service.version}"/>
573
+ </fingerprint>
574
+ <fingerprint pattern="(?im:vendorname1.+?\x04%International Business Machines \(IBM\)0.+?\x04\rvendorversion1.+?\x04.([\d.]+)0.[\x00\x02\x04])">
575
+ <description>IBM Security Directory Server</description>
576
+ <example service.version="5.1" _encoding="base64">
577
+ dmVuZG9ybmFtZTGEAAAAJwQlSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyAoSUJNK
578
+ TCEAAAAGgQNdmVuZG9ydmVyc2lvbjGEAAAABQQDNS4xMIQA
579
+ </example>
580
+ <example service.version="6.3.1" _encoding="base64">
581
+ dmVuZG9ybmFtZTGEAAAAJwQlSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyAoSUJNK
582
+ TCEAAAAHAQNdmVuZG9ydmVyc2lvbjGEAAAABwQFNi4zLjEwhAA=
583
+ </example>
584
+ <param pos="0" name="service.vendor" value="IBM"/>
585
+ <param pos="0" name="service.product" value="Security Directory Server"/>
586
+ <param pos="1" name="service.version"/>
587
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:security_directory_server:{service.version}"/>
588
+ </fingerprint>
589
+ <fingerprint pattern="(?im:vendorName1.\x00\x00\x00\v\x04\tMirapoint0.\x00\x00\x00.\x04\rvendorVersion1.\x00\x00\x00.\x04.([\d.]+)0.\x00)">
590
+ <description>Mirapoint LDAP Server</description>
591
+ <example service.version="3.2" _encoding="base64">
592
+ dmVuZG9yTmFtZTGEAAAACwQJTWlyYXBvaW50MIQAAAAaBA12ZW5kb3JWZXJzaW9uMYQAAAAFB
593
+ AMzLjIwhAA=
594
+ </example>
595
+ <param pos="0" name="service.vendor" value="Mirapoint"/>
596
+ <param pos="0" name="service.product" value="LDAP Server"/>
597
+ <param pos="1" name="service.version"/>
598
+ </fingerprint>
599
+ <fingerprint pattern="(?im:orcldirectoryversion1.{1,5}\x04.OID ([\d.]+)0.\x00\x00)">
600
+ <description>Oracle Internet Directory</description>
601
+ <example service.version="9.0.4.0.0" _encoding="base64">
602
+ b3JjbGRpcmVjdG9yeXZlcnNpb24xhAAAAA8EDU9JRCA5LjAuNC4wLjAwhAAAAA==
603
+ </example>
604
+ <param pos="0" name="service.vendor" value="Oracle"/>
605
+ <param pos="0" name="service.product" value="Internet Directory Server"/>
606
+ <param pos="1" name="service.version"/>
607
+ </fingerprint>
608
+ <fingerprint pattern="(?im:orcldirectoryversion1.{1,5}\x04.OVD ([\d.]+)0.\x04)">
609
+ <description>Oracle Virtual Directory</description>
610
+ <example service.version="11.1.1.6.0" _encoding="base64">
611
+ b3JjbGRpcmVjdG9yeXZlcnNpb24xEAQOT1ZEIDExLjEuMS42LjAwLgQSc3VwcG9ydGVkRQ==
612
+ </example>
613
+ <param pos="0" name="service.vendor" value="Oracle"/>
614
+ <param pos="0" name="service.product" value="Virtual Directory Server"/>
615
+ <param pos="1" name="service.version"/>
616
+ </fingerprint>
617
+ <fingerprint pattern="(?im:metaProductID.*\x04\vmetaVersion1\r\x04.([\d.]+)0.\x04)">
618
+ <description>estos MetaDirectory</description>
619
+ <example service.version="3.5.22.4291" _encoding="base64">
620
+ BA1tZXRhUHJvZHVjdElEMQYEBDExMDIwHAQLbWV0YVZlcnNpb24xDQQLMy41LjIyLjQyOTEwF
621
+ gQ=
622
+ </example>
623
+ <param pos="0" name="service.vendor" value="estos"/>
624
+ <param pos="0" name="service.product" value="MetaDirectory Server"/>
625
+ <param pos="1" name="service.version"/>
626
+ <param pos="0" name="os.vendor" value="Microsoft"/>
627
+ <param pos="0" name="os.family" value="Windows"/>
628
+ </fingerprint>
629
+ <fingerprint pattern="(?im:dsaVersion1.\x04,DC Directory Server v(\d+\.\d+[\d.]* \([\w. ]+\))0.\x04)">
630
+ <description>Cisco Data Connection Directory</description>
631
+ <example service.version="8.1.00 (build 20150305)" _encoding="base64">
632
+ ZHNhVmVyc2lvbjEuBCxEQyBEaXJlY3RvcnkgU2VydmVyIHY4LjEuMDAgKGJ1aWxkIDIwMTUwM
633
+ zA1KTBeBAs=
634
+ </example>
635
+ <param pos="0" name="service.vendor" value="Cisco"/>
636
+ <param pos="0" name="service.product" value="Data Connection Directory"/>
637
+ <param pos="1" name="service.version"/>
638
+ </fingerprint>
639
+ <!-- Unbound -->
640
+ <fingerprint pattern="(?im:vendorName1.\x04.UnboundID Corp.0.\x04\rvendorVersion1.\x04.UnboundID Directory Server ([\d.]+)0\f)">
641
+ <description>UnboundID Directory Server</description>
642
+ <example service.version="5.1.5.2" _encoding="base64">
643
+ dmVuZG9yTmFtZTERBA9VbmJvdW5kSUQgQ29ycC4wNQQNdmVuZG9yVmVyc2lvbjEkBCJVbmJvd
644
+ W5kSUQgRGlyZWN0b3J5IFNlcnZlciA1LjEuNS4yMAw=
645
+ </example>
646
+ <param pos="0" name="service.vendor" value="UnboundID"/>
647
+ <param pos="0" name="service.product" value="UnboundID Directory Server"/>
648
+ <param pos="1" name="service.version"/>
649
+ </fingerprint>
650
+ <fingerprint pattern="(?im:vendorName1.\x04.UnboundID Corp.0.\x04\rvendorVersion1.\x04.UnboundID Directory Proxy Server ([\d.]+)0\f)">
651
+ <description>UnboundID Directory Proxy Server</description>
652
+ <example service.version="4.7.0.7" _encoding="base64">
653
+ dmVuZG9yTmFtZTERBA9VbmJvdW5kSUQgQ29ycC4wOwQNdmVuZG9yVmVyc2lvbjEqBChVbmJvd
654
+ W5kSUQgRGlyZWN0b3J5IFByb3h5IFNlcnZlciA0LjcuMC43MAw=
655
+ </example>
656
+ <param pos="0" name="service.vendor" value="UnboundID"/>
657
+ <param pos="0" name="service.product" value="UnboundID Directory Proxy Server"/>
658
+ <param pos="1" name="service.version"/>
659
+ </fingerprint>
660
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.IPVA-\w+-)" flags="REG_MULTILINE">
661
+ <description>innovaphone VoIP Gateway Virtual Appliance</description>
662
+ <example _encoding="base64">
663
+ Dm5hbWluZ0NvbnRleHRzMQoECGNuPUtQQlgwMCIED2xkYXBTZXJ2aWNlTmFtZTEPBA1JUFZBL
664
+ TNmLTAwLTBjMAwC
665
+ </example>
666
+ <param pos="0" name="service.vendor" value="innovaphone"/>
667
+ <param pos="0" name="service.family" value="VoiP Gateway"/>
668
+ <param pos="0" name="service.product" value="IPVA"/>
669
+ </fingerprint>
670
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IP\d+)-\w+-)" flags="REG_MULTILINE">
671
+ <description>innovaphone VoIP Gateway</description>
672
+ <example service.product="IP800" _encoding="base64">
673
+ bmFtaW5nQ29udGV4dHMxCgQIY249S1BCWDAwIwQPbGRhcFNlcnZpY2VOYW1lMRAEDklQODAwL
674
+ TA2LTJiLTYxMA==
675
+ </example>
676
+ <param pos="0" name="service.vendor" value="innovaphone"/>
677
+ <param pos="0" name="service.family" value="VoiP Gateway"/>
678
+ <param pos="1" name="service.product"/>
679
+ </fingerprint>
680
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IPBS\d*)-\w+-)">
681
+ <description>Ascom IP-DECT Base Station</description>
682
+ <example service.product="IPBS2" _encoding="base64">
683
+ bmFtaW5nQ29udGV4dHMxCQQHY249UEJYMDAjBA9sZGFwU2VydmljZU5hbWUxEAQOSVBCUzItM
684
+ TktYjEtZTcw
685
+ </example>
686
+ <param pos="0" name="service.vendor" value="Ascom"/>
687
+ <param pos="0" name="service.family" value="IP-DECT Base Station"/>
688
+ <param pos="1" name="service.product"/>
689
+ </fingerprint>
690
+ <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IPBL\d*)-\w+-)">
691
+ <description>Ascom IP-DECT Gateway</description>
692
+ <example service.product="IPBL" _encoding="base64">
693
+ bmFtaW5nQ29udGV4dHMxCQQHY249UEJYMDAiBA9sZGFwU2VydmljZU5hbWUxDwQNSVBCTC0zM
694
+ C0yYy0yNTA=
695
+ </example>
696
+ <param pos="0" name="service.vendor" value="Ascom"/>
697
+ <param pos="0" name="service.family" value="IP-DECT Gateway"/>
698
+ <param pos="1" name="service.product"/>
699
+ </fingerprint>
700
+ <fingerprint pattern="(?im:o=Scalix0.\x04.subschemasubentry1.\x04.cn=subSchema,o=Scalix0.\x04.*\x04.xserverversion1.\x04.(\d\d\.\d+\.[\w.-]+)0.\x02)">
701
+ <description>Scalix LDAP Server</description>
702
+ <example service.version="11.4.6.13676" _encoding="base64">
703
+ bz1NeUNvbnRhY3RzBAhvPVNjYWxpeDAsBBFzdWJzY2hlbWFzdWJlbnRyeTEXBBVjbj1zdWJTY
704
+ 2hlbWEsbz1TY2FsaXgwDQQJYWx0c2VydmVyMQAwHgQUc3VwcG9ydGVkbGRhcHZlcnNpb24xBg
705
+ QBMgQBMzAgBA54c2VydmVydmVyc2lvbjEOBAwxMS40LjYuMTM2NzYwDAI=
706
+ </example>
707
+ <param pos="0" name="service.vendor" value="Scalix"/>
708
+ <param pos="0" name="service.product" value="LDAP Server"/>
709
+ <param pos="1" name="service.version"/>
710
+ </fingerprint>
711
+ </fingerprints>