recog-intrigue 2.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/rsh_resp.xml ADDED
@@ -0,0 +1,76 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="rsh" database_type="service">
3
+ <!--
4
+ Rservices responses to requests are matched against these patterns to fingerprint the OSes of servers.
5
+ -->
6
+ <fingerprint pattern="^.Permission denied: Error 0$">
7
+ <description>Digital Unix rlogind</description>
8
+ <example>xPermission denied: Error 0</example>
9
+ <param pos="0" name="os.vendor" value="HP"/>
10
+ <param pos="0" name="os.family" value="Digital Unix"/>
11
+ </fingerprint>
12
+ <fingerprint pattern="^.Winsock RSHD/NT: Protocol negotiation error\..+$|^.in\.rlogind: Permission denied\..+$" flags="REG_DOT_NEWLINE">
13
+ <description>Windows rlogind</description>
14
+ <example>xWinsock RSHD/NT: Protocol negotiation error.
15
+ 0</example>
16
+ <example>xin.rlogind: Permission denied.
17
+ </example>
18
+ <param pos="0" name="os.vendor" value="Microsoft"/>
19
+ <param pos="0" name="os.family" value="Windows"/>
20
+ </fingerprint>
21
+ <fingerprint pattern="^.permission denied\..+$" flags="REG_DOT_NEWLINE">
22
+ <description>Solaris rlogind</description>
23
+ <example>xpermission denied.
24
+ </example>
25
+ <param pos="0" name="os.vendor" value="Sun"/>
26
+ <param pos="0" name="os.family" value="Solaris"/>
27
+ <param pos="0" name="os.product" value="Solaris"/>
28
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
29
+ </fingerprint>
30
+ <fingerprint pattern="^.rlogind: Acc.s refus.\..+$" flags="REG_DOT_NEWLINE">
31
+ <description>AIX rlogind</description>
32
+ <example>xrlogind: Accxs refusx.
33
+ </example>
34
+ <param pos="0" name="os.vendor" value="IBM"/>
35
+ <param pos="0" name="os.family" value="AIX"/>
36
+ <param pos="0" name="os.product" value="AIX"/>
37
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:-"/>
38
+ </fingerprint>
39
+ <fingerprint pattern="^.rlogind: Host name for your address \([\d.]+\) unknown\..*$" flags="REG_DOT_NEWLINE">
40
+ <description>A/UX rlogind</description>
41
+ <example>xrlogind: Host name for your address (127.0.0.1) unknown.
42
+ </example>
43
+ <param pos="0" name="os.vendor" value="Apple"/>
44
+ <param pos="0" name="os.family" value="A/UX"/>
45
+ </fingerprint>
46
+ <fingerprint pattern="^.rexecd: Login incorrect\..*$" flags="REG_DOT_NEWLINE">
47
+ <description>HP-UX rexecd</description>
48
+ <example>xrexecd: Login incorrect.
49
+ </example>
50
+ <param pos="0" name="os.vendor" value="HP"/>
51
+ <param pos="0" name="os.family" value="HP-UX"/>
52
+ <param pos="0" name="os.product" value="HP-UX"/>
53
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
54
+ </fingerprint>
55
+ <fingerprint pattern="^.rexecd: [-\d]+.*$" flags="REG_DOT_NEWLINE">
56
+ <description>AIX rexecd</description>
57
+ <example>xrexecd: 0-1 The login is not correct.
58
+ </example>
59
+ <param pos="0" name="os.vendor" value="IBM"/>
60
+ <param pos="0" name="os.family" value="AIX"/>
61
+ <param pos="0" name="os.product" value="AIX"/>
62
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:-"/>
63
+ </fingerprint>
64
+ <fingerprint pattern="^.remshd: (?:getservbyname.+|Kerberos Authentication not enabled\..+|Error! Kerberos authentication failed)$" flags="REG_DOT_NEWLINE">
65
+ <description>HP-UX rshd</description>
66
+ <example>xremshd: getservbyname
67
+ </example>
68
+ <example>xremshd: Kerberos Authentication not enabled.
69
+ </example>
70
+ <example>xremshd: Error! Kerberos authentication failed</example>
71
+ <param pos="0" name="os.vendor" value="HP"/>
72
+ <param pos="0" name="os.family" value="HP-UX"/>
73
+ <param pos="0" name="os.product" value="HP-UX"/>
74
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
75
+ </fingerprint>
76
+ </fingerprints>
data/xml/rtsp_servers.xml ADDED
@@ -0,0 +1,76 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="rtsp_header.server" protocol="rtsp" database_type="service" preference="0.85">
3
+ <fingerprint pattern="^Flussonic \(http:\/\/www.flussonic.com\/\) ([\d\.]+)$">
4
+ <description>Flussonic Media Server</description>
5
+ <example service.version="19.04">Flussonic (http://www.flussonic.com/) 19.04</example>
6
+ <example service.version="20.01">Flussonic (http://www.flussonic.com/) 20.01</example>
7
+ <param pos="0" name="service.vendor" value="Flussonic"/>
8
+ <param pos="0" name="service.product" value="Flussonic Media Server" />
9
+ <param pos="1" name="service.version" />
10
+ </fingerprint>
11
+ <fingerprint pattern="^Hipcam RealServer\/V([\d\.]+)$">
12
+ <description>Hipcam IP camera running the RealServer RTSP server.</description>
13
+ <example service.version="1.0">Hipcam RealServer/V1.0</example>
14
+ <param pos="0" name="service.vendor" value="RealNetworks"/>
15
+ <param pos="0" name="service.product" value="RealServer" />
16
+ <param pos="1" name="service.version" />
17
+ <param pos="0" name="hw.vendor" value="Hipcam" />
18
+ <param pos="0" name="hw.device" value="IP Camera" />
19
+ </fingerprint>
20
+ <fingerprint pattern="^Dahua Rtsp Server$">
21
+ <description>Dahua IP Camera</description>
22
+ <example>Dahua Rtsp Server</example>
23
+ <param pos="0" name="service.vendor" value="Dahua"/>
24
+ <param pos="0" name="hw.vendor" value="Dahua" />
25
+ <param pos="0" name="hw.device" value="IP Camera" />
26
+ </fingerprint>
27
+ <fingerprint pattern="^GStreamer RTSP server$">
28
+ <description>GStreamer RTSP Server (https://github.com/GStreamer/gst-rtsp-server)</description>
29
+ <example>GStreamer RTSP server</example>
30
+ <param pos="0" name="service.vendor" value="GStreamer"/>
31
+ <param pos="0" name="service.product" value="GStreamer RTSP Server" />
32
+ </fingerprint>
33
+ <fingerprint pattern="^WMServer\/([\d\.]+)$">
34
+ <description>Windows Media Server</description>
35
+ <example service.version="9.1.1.3862">WMServer/9.1.1.3862</example>
36
+ <example service.version="9.5.6001.22609">WMServer/9.5.6001.22609</example>
37
+ <param pos="0" name="service.vendor" value="Microsoft"/>
38
+ <param pos="0" name="service.product" value="Windows Media Server" />
39
+ <param pos="0" name="service.family" value="Windows Media Server"/>
40
+ <param pos="1" name="service.version" />
41
+ <param pos="0" name="os.vendor" value="Microsoft"/>
42
+ <param pos="0" name="os.family" value="Windows"/>
43
+ </fingerprint>
44
+ <fingerprint pattern="^Wowza (Streaming Engine|Media Server) ([\d\.]+) build(\d*)$">
45
+ <description>Wowza Media Systems Streaming Video Services</description>
46
+ <example service.version="4.7.7" service.version.version="20181108145350" service.product="Streaming Engine">Wowza Streaming Engine 4.7.7 build20181108145350</example>
47
+ <example service.version="3.6.4" service.version.version="9641" service.product="Media Server">Wowza Media Server 3.6.4 build9641</example>
48
+ <param pos="0" name="service.vendor" value="Wowza Media Systems"/>
49
+ <param pos="1" name="service.product" />
50
+ <param pos="2" name="service.version" />
51
+ <param pos="3" name="service.version.version" />
52
+ </fingerprint>
53
+ <fingerprint pattern="^HiIpcam\/V\d+R\d+ VodServer\/[\d\.]+$">
54
+ <description>Foscam IP Camera</description>
55
+ <example>HiIpcam/V100R003 VodServer/1.0.0</example>
56
+ <param pos="0" name="hw.vendor" value="Foscam" />
57
+ <param pos="0" name="hw.device" value="IP Camera" />
58
+ </fingerprint>
59
+ <fingerprint pattern="^Indigo\-Security\/[\d\.]+$">
60
+ <description>Indigo Security IP Camera</description>
61
+ <example>Indigo-Security/1.0</example>
62
+ <param pos="0" name="hw.vendor" value="Indigo Security" />
63
+ <param pos="0" name="hw.device" value="IP Camera" />
64
+ </fingerprint>
65
+ <fingerprint pattern="^Cisco MediaSense Media Server$">
66
+ <description>Cisco MediaSense Media Server (RTSP)</description>
67
+ <example>Cisco MediaSense Media Server</example>
68
+ <param pos="0" name="service.vendor" value="Cisco"/>
69
+ <param pos="0" name="service.product" value="MediaSense Media Server"/>
70
+ <param pos="0" name="service.cpe23" value="cpe:2.3:a:cisco:mediasense:-"/>
71
+ <param pos="0" name="os.vendor" value="Cisco"/>
72
+ <param pos="0" name="hw.vendor" value="Cisco"/>
73
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
74
+ <param pos="0" name="hw.product" value="MediaSense Server"/>
75
+ </fingerprint>
76
+ </fingerprints>
data/xml/sip_banners.xml ADDED
@@ -0,0 +1,359 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="sip_header.server" protocol="sip" database_type="service">
3
+ <!--
4
+ SIP Server header values are matched against these patterns to fingerprint SIP devices.
5
+ -->
6
+
7
+ <!-- Cisco/Tandberg Products -->
8
+
9
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)\.x$">
10
+ <description>Cisco IOS SIP Gateway w/ Vague Version</description>
11
+ <example os.version="12">Cisco-SIPGateway/IOS-12.x</example>
12
+ <param pos="0" name="service.vendor" value="Cisco"/>
13
+ <param pos="0" name="service.family" value="IOS"/>
14
+ <param pos="0" name="service.product" value="IOS"/>
15
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
16
+ <param pos="0" name="os.vendor" value="Cisco"/>
17
+ <param pos="0" name="os.family" value="IOS"/>
18
+ <param pos="0" name="os.product" value="IOS"/>
19
+ <param pos="0" name="os.certainty" value="0.8"/>
20
+ <param pos="1" name="os.version"/>
21
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
22
+ <param pos="0" name="hw.vendor" value="Cisco"/>
23
+ <param pos="0" name="hw.device" value="Router"/>
24
+ </fingerprint>
25
+
26
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)$">
27
+ <description>Cisco IOS SIP Gateway w/ Full Version</description>
28
+ <example os.version="15.2.4.M3">Cisco-SIPGateway/IOS-15.2.4.M3</example>
29
+ <example os.version="15.2.2.T1">Cisco-SIPGateway/IOS-15.2.2.T1</example>
30
+ <example os.version="15.2.3.T">Cisco-SIPGateway/IOS-15.2.3.T</example>
31
+ <example os.version="15.4.3.S5">Cisco-SIPGateway/IOS-15.4.3.S5</example>
32
+ <example os.version="15.6.3.M0a">Cisco-SIPGateway/IOS-15.6.3.M0a</example>
33
+ <example os.version="16.3.6">Cisco-SIPGateway/IOS-16.3.6</example>
34
+ <param pos="0" name="service.vendor" value="Cisco"/>
35
+ <param pos="0" name="service.family" value="IOS"/>
36
+ <param pos="0" name="service.product" value="IOS"/>
37
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
38
+ <param pos="0" name="os.vendor" value="Cisco"/>
39
+ <param pos="0" name="os.family" value="IOS"/>
40
+ <param pos="0" name="os.product" value="IOS"/>
41
+ <param pos="0" name="os.certainty" value="1.0"/>
42
+ <param pos="1" name="os.version"/>
43
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
44
+ <param pos="0" name="hw.vendor" value="Cisco"/>
45
+ <param pos="0" name="hw.device" value="Router"/>
46
+ </fingerprint>
47
+
48
+ <fingerprint pattern="^Cisco-CP-?(\d+G?)(?:-\S+)?/([\d\.]+)">
49
+ <description>Cisco CP VoIP Phone</description>
50
+ <example hw.model="7960G" hw.version="8.0">Cisco-CP7960G/8.0</example>
51
+ <example hw.model="7912" hw.version="8.0.1">Cisco-CP7912/8.0.1-060412A</example>
52
+ <example hw.model="7821" hw.version="11.0.0">Cisco-CP-7821-3PCC/11.0.0</example>
53
+ <example hw.model="6841" hw.version="11.1.1">Cisco-CP-6841-3PCC/11.1.1 (00727826a4e1) (sip68xx.11-1-1MPP-897.loads)</example>
54
+ <param pos="0" name="os.vendor" value="Cisco"/>
55
+ <param pos="0" name="os.device" value="VoIP"/>
56
+ <param pos="0" name="hw.vendor" value="Cisco"/>
57
+ <param pos="0" name="hw.product" value="CP"/>
58
+ <param pos="0" name="hw.device" value="VoIP"/>
59
+ <param pos="1" name="hw.model"/>
60
+ <param pos="2" name="hw.version"/>
61
+ </fingerprint>
62
+
63
+ <fingerprint pattern="(?:Cisco|Linksys)/(SPA\d+[DG]?\d?)-([\d\.a-zA-Z]+)">
64
+ <description>Cisco/Linksys SPA VoIP Phone</description>
65
+ <example hw.model="SPA112" hw.version="1.4.1SR1">Cisco/SPA112-1.4.1SR1(002)d-hisec</example>
66
+ <example hw.model="SPA122" hw.version="1.3.3">Cisco/SPA122-1.3.3(004)</example>
67
+ <example hw.model="SPA922" hw.version="6.1.5">PhoneSystems.net aabbccddeeff Linksys/SPA922-6.1.5(a)</example>
68
+ <example hw.model="SPA232D" hw.version="1.4.1">Cisco/SPA232D-1.4.1(002_282)</example>
69
+ <example hw.model="SPA504G" hw.version="7.5.2">Cisco/SPA504G-7.5.2</example>
70
+ <example hw.model="SPA525G2" hw.version="7.6.1">Cisco/SPA525G2-7.6.1</example>
71
+ <example hw.model="SPA922" hw.version="6.1.5">Linksys/SPA922-6.1.5</example>
72
+ <param pos="0" name="os.vendor" value="Cisco"/>
73
+ <param pos="0" name="os.device" value="VoIP"/>
74
+ <param pos="0" name="hw.vendor" value="Cisco"/>
75
+ <param pos="0" name="hw.product" value="SPA"/>
76
+ <param pos="0" name="hw.device" value="VoIP"/>
77
+ <param pos="1" name="hw.model"/>
78
+ <param pos="2" name="hw.version"/>
79
+ </fingerprint>
80
+
81
+ <fingerprint pattern="(?:Cisco|Linksys)(?: |/)(PAP2T?)(?:-|/)(\S+)$">
82
+ <description>Cisco/Linksys VoIP / Internet Phone adapter</description>
83
+ <example hw.version="3.1.22(LS)" hw.model="PAP2">PhoneSystems.net aabbccddeeff Linksys/PAP2-3.1.22(LS)</example>
84
+ <example hw.version="3.1.9(LSc)" hw.model="PAP2">aabbccddeeff Linksys/PAP2-3.1.9(LSc)</example>
85
+ <example hw.version="3.52.12X" hw.model="PAP2T">Linksys PAP2T/3.52.12X</example>
86
+ <example hw.version="2.0.10(LSb)" hw.model="PAP2">iLinksys/PAP2-2.0.10(LSb)</example>
87
+ <example hw.version="3.1.16(LS)" hw.model="PAP2T">Linksys/PAP2T-3.1.16(LS)</example>
88
+ <param pos="0" name="os.vendor" value="Cisco"/>
89
+ <param pos="0" name="os.device" value="VoIP"/>
90
+ <param pos="0" name="hw.vendor" value="Cisco"/>
91
+ <param pos="0" name="hw.product" value="Internet Phone Adapter"/>
92
+ <param pos="0" name="hw.device" value="VoIP"/>
93
+ <param pos="1" name="hw.model"/>
94
+ <param pos="2" name="hw.version"/>
95
+ </fingerprint>
96
+
97
+ <fingerprint pattern="^Cisco/(SRP\d+)-([\d\.]+)">
98
+ <description>Cisco Services Ready Platforms (SRP) Router</description>
99
+ <example hw.model="SRP541" hw.version="1.2.6">Cisco/SRP541-1.2.6(003)</example>
100
+ <example hw.model="SRP527" hw.version="1.02.03">Cisco/SRP527-1.02.03(002)</example>
101
+ <param pos="0" name="os.vendor" value="Cisco"/>
102
+ <param pos="0" name="os.device" value="Router"/>
103
+ <param pos="0" name="hw.vendor" value="Cisco"/>
104
+ <param pos="0" name="hw.product" value="SRP"/>
105
+ <param pos="0" name="hw.device" value="Router"/>
106
+ <param pos="1" name="hw.model"/>
107
+ <param pos="2" name="hw.version"/>
108
+ </fingerprint>
109
+
110
+ <fingerprint pattern="(?:Cisco|Linksys)/(WRP\d+)-(\S+)$">
111
+ <description>Cisco/Linksys WRP Wireless Router</description>
112
+ <example hw.version="2.00.26" hw.model="WRP400">aabbccddeeff_FinalStage_Linksys/WRP400-2.00.26</example>
113
+ <example hw.version="1.01.08" hw.model="WRP200">Linksys/WRP200-1.01.08</example>
114
+ <example hw.version="1.00.05B2" hw.model="WRP400">Linksys/WRP400-1.00.05B2</example>
115
+ <param pos="0" name="os.vendor" value="Cisco"/>
116
+ <param pos="0" name="os.device" value="Router"/>
117
+ <param pos="0" name="hw.vendor" value="Cisco"/>
118
+ <param pos="0" name="hw.product" value="Wireless Router"/>
119
+ <param pos="0" name="hw.device" value="Router"/>
120
+ <param pos="1" name="hw.model"/>
121
+ <param pos="2" name="hw.version"/>
122
+ </fingerprint>
123
+
124
+ <fingerprint pattern="^TANDBERG/(\d+) \((.*)\) Cisco-(\S+)$">
125
+ <description>Cisco/Tandberg TelePresence w/Cisco Model Name</description>
126
+ <example os.version="TC7.3.7.01c84fd" tandberg.model="528" hw.product="EX60">TANDBERG/528 (TC7.3.7.01c84fd) Cisco-EX60</example>
127
+ <example os.version="ce9.6.0.76c1685b70e" tandberg.model="529" hw.product="RoomKitMini">TANDBERG/529 (ce9.6.0.76c1685b70e) Cisco-RoomKitMini</example>
128
+ <param pos="0" name="os.vendor" value="Tandberg"/>
129
+ <param pos="0" name="os.family" value="Linux"/>
130
+ <param pos="0" name="os.product" value="Linux"/>
131
+ <param pos="1" name="tandberg.model"/>
132
+ <param pos="2" name="os.version"/>
133
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
134
+ <param pos="0" name="hw.vendor" value="Cisco"/>
135
+ <param pos="0" name="hw.family" value="TelePresence"/>
136
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
137
+ <param pos="3" name="hw.product"/>
138
+ </fingerprint>
139
+
140
+ <fingerprint pattern="^(TANDBERG/(\d+)) \((\S+).*\)$">
141
+ <description>Cisco/Tandberg TelePresence</description>
142
+ <example os.version="TC7.0.2.aecf2d9" tandberg.model="519" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
143
+ <example os.version="X12.5.2" tandberg.model="4137" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
144
+ <example os.version="X8.2.1" hw.product="TANDBERG/4130">TANDBERG/4130 (X8.2.1)</example>
145
+ <example os.version="XC2.2.1-b2bua-1.0" hw.product="TANDBERG/4353" tandberg.model="4353">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
146
+ <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516" tandberg.model="516">TANDBERG/516 (TC5.1.4.295090)</example>
147
+ <example os.version="TCNC5.1.4.295090" hw.product="TANDBERG/517" tandberg.model="517">TANDBERG/517 (TCNC5.1.4.295090)</example>
148
+ <param pos="0" name="os.vendor" value="Tandberg"/>
149
+ <param pos="0" name="os.family" value="Linux"/>
150
+ <param pos="0" name="os.product" value="Linux"/>
151
+ <param pos="2" name="tandberg.model"/>
152
+ <param pos="3" name="os.version"/>
153
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
154
+ <param pos="0" name="hw.vendor" value="Cisco"/>
155
+ <param pos="0" name="hw.family" value="TelePresence"/>
156
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
157
+ <param pos="1" name="hw.product"/>
158
+ </fingerprint>
159
+
160
+ <!-- Various -->
161
+
162
+ <fingerprint pattern="EnGenius_Router$">
163
+ <description>EnGenius DuraFon IP Phone</description>
164
+ <example>EnGenius_Router</example>
165
+ <param pos="0" name="hw.vendor" value="enGenius"/>
166
+ <param pos="0" name="hw.product" value="DuraFon"/>
167
+ <param pos="0" name="hw.device" value="VoIP"/>
168
+ </fingerprint>
169
+
170
+ <fingerprint pattern="(?i)^Huawei (SoftX\d+) (?:V\d.*)$">
171
+ <description>Huawei Softswitch</description>
172
+ <example hw.model="SoftX3000">Huawei SoftX3000 V300R006</example>
173
+ <param pos="0" name="hw.vendor" value="Huawei"/>
174
+ <param pos="0" name="hw.device" value="Telecom"/>
175
+ <param pos="0" name="hw.product" value="Softswitch"/>
176
+ <param pos="1" name="hw.model"/>
177
+ </fingerprint>
178
+
179
+ <fingerprint pattern="(?i)^SIP/1.0 \(Huawei\)$">
180
+ <description>Huawei generic</description>
181
+ <example>SIP/1.0 (Huawei)</example>
182
+ <param pos="0" name="hw.vendor" value="Huawei"/>
183
+ </fingerprint>
184
+
185
+ <fingerprint pattern="^M5T SIP(?: Stack|-UA SAFE)/v?([\d\.]+)">
186
+ <description>Media5 Corporation SIP Stack</description>
187
+ <example service.version="4.1.2.2">M5T SIP Stack/4.1.2.2</example>
188
+ <example service.version="3.6.4.8">M5T SIP-UA SAFE/v3.6.4.8</example>
189
+ <example service.version="4.1.2.2">M5T SIP Stack/4.1.2.2alliu</example>
190
+ <param pos="0" name="service.vendor" value="Media5 Corporation"/>
191
+ <param pos="0" name="service.product" value="SIP Stack"/>
192
+ <param pos="1" name="service.version"/>
193
+ <param pos="0" name="hw.device" value="VoIP"/>
194
+ </fingerprint>
195
+
196
+ <fingerprint pattern="^Tilgin Vood ([^_\s]+)">
197
+ <description>Tilgin Vood</description>
198
+ <example hw.model="HG238x">Tilgin Vood HG238x_ESx000-02_07_03_26</example>
199
+ <example hw.model="HG27xx">Tilgin Vood HG27xx</example>
200
+ <example hw.model="452W">Tilgin Vood 452W_S_3_4_2_RC_2</example>
201
+ <param pos="0" name="hw.vendor" value="Tilgin"/>
202
+ <param pos="0" name="hw.product" value="Vood"/>
203
+ <param pos="1" name="hw.model"/>
204
+ </fingerprint>
205
+
206
+ <fingerprint pattern="^(F\d{3})/VT?(\d(?:[\d\.A-Z]+))$">
207
+ <description>ZTE GPON Router</description>
208
+ <example hw.product="F620" hw.version="3.30.20P5T4S">F620/V3.30.20P5T4S</example>
209
+ <example hw.product="F660" hw.version="2.22.21P1T14S">F660/V2.22.21P1T14S</example>
210
+ <example hw.product="F668" hw.version="2.30.22P1T9">F668/VT2.30.22P1T9</example>
211
+ <param pos="0" name="hw.vendor" value="ZTE"/>
212
+ <param pos="0" name="hw.device" value="Router"/>
213
+ <param pos="1" name="hw.product"/>
214
+ <param pos="2" name="hw.version"/>
215
+ </fingerprint>
216
+
217
+ <fingerprint pattern="^ZXDSL (\S+)/V?(\d(?:[\d\.A-Z_]+))$">
218
+ <description>ZTE ZXDSL router</description>
219
+ <example hw.product="931VII" hw.version="2.0.00.OTET06">ZXDSL 931VII/V2.0.00.OTET06</example>
220
+ <param pos="0" name="hw.vendor" value="ZTE"/>
221
+ <param pos="0" name="hw.device" value="Router"/>
222
+ <param pos="0" name="hw.family" value="ZXDSL"/>
223
+ <param pos="1" name="hw.product"/>
224
+ <param pos="2" name="hw.version"/>
225
+ </fingerprint>
226
+
227
+ <fingerprint pattern="^(?:ZXHN )?(H\d{3}N)/V?(\d(?:[\d\.A-Z_]+))$">
228
+ <description>ZTE ZXHN router</description>
229
+ <example hw.product="H218N" hw.version="1.02.01_ERS">ZXHN H218N/V1.02.01_ERS</example>
230
+ <example hw.product="H367N" hw.version="1.0.4">ZXHN H367N/V1.0.4</example>
231
+ <example hw.product="H218N" hw.version="1.02.01">ZXHN H218N/V1.02.01</example>
232
+ <example hw.product="H208N" hw.version="1.0.2T02">ZXHN H208N/V1.0.2T02</example>
233
+ <example hw.product="H368N" hw.version="1.10.00T10">H368N/V1.10.00T10</example>
234
+ <param pos="0" name="hw.vendor" value="ZTE"/>
235
+ <param pos="0" name="hw.device" value="Router"/>
236
+ <param pos="0" name="hw.family" value="ZXHN"/>
237
+ <param pos="1" name="hw.product"/>
238
+ <param pos="2" name="hw.version"/>
239
+ </fingerprint>
240
+
241
+ <fingerprint pattern="^Aastra ([^/]+)/([a-zA-Z0-9\.\-]+)$">
242
+ <description>Aastra IP Phone</description>
243
+ <example hw.product="6865i" os.version="4.2.0.2023">Aastra 6865i/4.2.0.2023</example>
244
+ <param pos="0" name="os.vendor" value="Aastra"/>
245
+ <param pos="0" name="os.family" value="VoIP"/>
246
+ <param pos="0" name="os.product" value="VoIP"/>
247
+ <param pos="2" name="os.version"/>
248
+ <param pos="0" name="hw.vendor" value="Aastra"/>
249
+ <param pos="0" name="hw.family" value="VoIP"/>
250
+ <param pos="0" name="hw.device" value="VoIP"/>
251
+ <param pos="1" name="hw.product"/>
252
+ </fingerprint>
253
+
254
+ <fingerprint pattern="^(?:Audiocodes-Sip-Gateway-)?(\S+) FX[A-Z_]+/v.(\S+)$">
255
+ <description>Audiocodes-Sip-Gateway</description>
256
+ <example hw.product="MP-124" os.version="6.00A.034.003">Audiocodes-Sip-Gateway-MP-124 FXS/v.6.00A.034.003</example>
257
+ <example hw.product="MP-124" os.version="6.60A.342.003">MP-124 FXS/v.6.60A.342.003</example>
258
+ <example hw.product="MP-114" os.version="6.60A.241.010">MP-114 FXS_FXO/v.6.60A.241.010</example>
259
+ <param pos="0" name="os.vendor" value="Audiocodes"/>
260
+ <param pos="0" name="os.family" value="SIP Gateway"/>
261
+ <param pos="2" name="os.version"/>
262
+ <param pos="0" name="hw.vendor" value="Audiocodes"/>
263
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
264
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
265
+ <param pos="1" name="hw.product"/>
266
+ </fingerprint>
267
+
268
+ <fingerprint pattern="^Wildix GW-(\S+)$">
269
+ <description>Wildix SIP Gateway</description>
270
+ <example os.version="5.0.3.42145">Wildix GW-5.0.3.42145</example>
271
+ <param pos="0" name="os.vendor" value="Wildix"/>
272
+ <param pos="0" name="os.family" value="SIP Gateway"/>
273
+ <param pos="1" name="os.version"/>
274
+ <param pos="0" name="hw.vendor" value="Wildix"/>
275
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
276
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
277
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
278
+ </fingerprint>
279
+
280
+ <fingerprint pattern="^Wildix GW$">
281
+ <description>Wildix SIP Gateway w/o Version</description>
282
+ <example>Wildix GW</example>
283
+ <param pos="0" name="os.vendor" value="Wildix"/>
284
+ <param pos="0" name="os.family" value="SIP Gateway"/>
285
+ <param pos="0" name="hw.vendor" value="Wildix"/>
286
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
287
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
288
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
289
+ </fingerprint>
290
+
291
+ <fingerprint pattern="^Asterisk PBX (\S+)$">
292
+ <description>Asterisk PBX w/ Version</description>
293
+ <example service.version="13.18.0-6.7.1.1.rl.1538157944.1c65507">Asterisk PBX 13.18.0-6.7.1.1.rl.1538157944.1c65507</example>
294
+ <example service.version="16.2.1~dfsg-1">Asterisk PBX 16.2.1~dfsg-1</example>
295
+ <param pos="0" name="service.vendor" value="Asterisk"/>
296
+ <param pos="0" name="service.family" value="PBX"/>
297
+ <param pos="0" name="service.product" value="PBX"/>
298
+ <param pos="1" name="service.version"/>
299
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:{service.version}"/>
300
+ </fingerprint>
301
+
302
+ <fingerprint pattern="^Asterisk PBX$">
303
+ <description>Asterisk PBX w/o Version</description>
304
+ <example>Asterisk PBX</example>
305
+ <param pos="0" name="service.vendor" value="Asterisk"/>
306
+ <param pos="0" name="service.family" value="PBX"/>
307
+ <param pos="0" name="service.product" value="PBX"/>
308
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:-"/>
309
+ </fingerprint>
310
+
311
+ <fingerprint pattern="^FPBX-(\S+)$">
312
+ <description>FreePBX</description>
313
+ <example service.version="12.0.70(11.20.0)">FPBX-12.0.70(11.20.0)</example>
314
+ <example service.version="2.11.0(11.20.0)">FPBX-2.11.0(11.20.0)</example>
315
+ <param pos="0" name="service.vendor" value="FreePBX"/>
316
+ <param pos="0" name="service.family" value="PBX"/>
317
+ <param pos="0" name="service.product" value="PBX"/>
318
+ <param pos="1" name="service.version"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:freepbx:freepbx:{service.version}"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^kamailio \((\S+) \((.*)\)\)$">
323
+ <description>Kamailio SIP Server</description>
324
+ <example service.version="4.4.4" kamailio.platform="x86_64/linux">kamailio (4.4.4 (x86_64/linux))</example>
325
+ <param pos="0" name="service.vendor" value="Kamailio"/>
326
+ <param pos="0" name="service.family" value="SIP Server"/>
327
+ <param pos="0" name="service.product" value="SIP Server"/>
328
+ <param pos="1" name="service.version"/>
329
+ <param pos="2" name="kamailio.platform"/>
330
+ <param pos="0" name="service.cpe23" value="cpe:/a:kamailio:kamailio:{service.version}"/>
331
+ </fingerprint>
332
+
333
+ <!-- This match covers multiple product families and should be split up further -->
334
+ <fingerprint pattern="^Algo-([^/]+)/(.*)$">
335
+ <description>Algo SIP Device</description>
336
+ <example hw.product="8186" os.version="1.7">Algo-8186/1.7</example>
337
+ <param pos="0" name="os.vendor" value="Algo"/>
338
+ <param pos="0" name="os.family" value="SIP Device"/>
339
+ <param pos="2" name="os.version"/>
340
+ <param pos="0" name="hw.vendor" value="Algo"/>
341
+ <param pos="0" name="hw.family" value="SIP Device"/>
342
+ <param pos="0" name="hw.device" value="SIP Device"/>
343
+ <param pos="1" name="hw.product"/>
344
+ </fingerprint>
345
+
346
+ <fingerprint pattern="^(?:SIParator|Ingate-Firewall)/(\S+)$">
347
+ <description>Ingate SIParator Firewall</description>
348
+ <example os.version="5.0.10">Ingate-Firewall/5.0.10</example>
349
+ <example os.version="6.0.4">SIParator/6.0.4</example>
350
+ <param pos="0" name="os.vendor" value="Ingate"/>
351
+ <param pos="0" name="os.family" value="SIP Gateway"/>
352
+ <param pos="1" name="os.version"/>
353
+ <param pos="0" name="hw.vendor" value="Ingate"/>
354
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
355
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
356
+ <param pos="0" name="hw.product" value="SIParator Firewall"/>
357
+ </fingerprint>
358
+
359
+ </fingerprints>