recog-intrigue 2.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/rsh_resp.xml ADDED
@@ -0,0 +1,76 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="rsh" database_type="service">
3
+ <!--
4
+ Rservices responses to requests are matched against these patterns to fingerprint the OSes of servers.
5
+ -->
6
+ <fingerprint pattern="^.Permission denied: Error 0$">
7
+ <description>Digital Unix rlogind</description>
8
+ <example>xPermission denied: Error 0</example>
9
+ <param pos="0" name="os.vendor" value="HP"/>
10
+ <param pos="0" name="os.family" value="Digital Unix"/>
11
+ </fingerprint>
12
+ <fingerprint pattern="^.Winsock RSHD/NT: Protocol negotiation error\..+$|^.in\.rlogind: Permission denied\..+$" flags="REG_DOT_NEWLINE">
13
+ <description>Windows rlogind</description>
14
+ <example>xWinsock RSHD/NT: Protocol negotiation error.
15
+ 0</example>
16
+ <example>xin.rlogind: Permission denied.
17
+ </example>
18
+ <param pos="0" name="os.vendor" value="Microsoft"/>
19
+ <param pos="0" name="os.family" value="Windows"/>
20
+ </fingerprint>
21
+ <fingerprint pattern="^.permission denied\..+$" flags="REG_DOT_NEWLINE">
22
+ <description>Solaris rlogind</description>
23
+ <example>xpermission denied.
24
+ </example>
25
+ <param pos="0" name="os.vendor" value="Sun"/>
26
+ <param pos="0" name="os.family" value="Solaris"/>
27
+ <param pos="0" name="os.product" value="Solaris"/>
28
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
29
+ </fingerprint>
30
+ <fingerprint pattern="^.rlogind: Acc.s refus.\..+$" flags="REG_DOT_NEWLINE">
31
+ <description>AIX rlogind</description>
32
+ <example>xrlogind: Accxs refusx.
33
+ </example>
34
+ <param pos="0" name="os.vendor" value="IBM"/>
35
+ <param pos="0" name="os.family" value="AIX"/>
36
+ <param pos="0" name="os.product" value="AIX"/>
37
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:-"/>
38
+ </fingerprint>
39
+ <fingerprint pattern="^.rlogind: Host name for your address \([\d.]+\) unknown\..*$" flags="REG_DOT_NEWLINE">
40
+ <description>A/UX rlogind</description>
41
+ <example>xrlogind: Host name for your address (127.0.0.1) unknown.
42
+ </example>
43
+ <param pos="0" name="os.vendor" value="Apple"/>
44
+ <param pos="0" name="os.family" value="A/UX"/>
45
+ </fingerprint>
46
+ <fingerprint pattern="^.rexecd: Login incorrect\..*$" flags="REG_DOT_NEWLINE">
47
+ <description>HP-UX rexecd</description>
48
+ <example>xrexecd: Login incorrect.
49
+ </example>
50
+ <param pos="0" name="os.vendor" value="HP"/>
51
+ <param pos="0" name="os.family" value="HP-UX"/>
52
+ <param pos="0" name="os.product" value="HP-UX"/>
53
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
54
+ </fingerprint>
55
+ <fingerprint pattern="^.rexecd: [-\d]+.*$" flags="REG_DOT_NEWLINE">
56
+ <description>AIX rexecd</description>
57
+ <example>xrexecd: 0-1 The login is not correct.
58
+ </example>
59
+ <param pos="0" name="os.vendor" value="IBM"/>
60
+ <param pos="0" name="os.family" value="AIX"/>
61
+ <param pos="0" name="os.product" value="AIX"/>
62
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:-"/>
63
+ </fingerprint>
64
+ <fingerprint pattern="^.remshd: (?:getservbyname.+|Kerberos Authentication not enabled\..+|Error! Kerberos authentication failed)$" flags="REG_DOT_NEWLINE">
65
+ <description>HP-UX rshd</description>
66
+ <example>xremshd: getservbyname
67
+ </example>
68
+ <example>xremshd: Kerberos Authentication not enabled.
69
+ </example>
70
+ <example>xremshd: Error! Kerberos authentication failed</example>
71
+ <param pos="0" name="os.vendor" value="HP"/>
72
+ <param pos="0" name="os.family" value="HP-UX"/>
73
+ <param pos="0" name="os.product" value="HP-UX"/>
74
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
75
+ </fingerprint>
76
+ </fingerprints>
data/xml/rtsp_servers.xml ADDED
@@ -0,0 +1,76 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="rtsp_header.server" protocol="rtsp" database_type="service" preference="0.85">
3
+ <fingerprint pattern="^Flussonic \(http:\/\/www.flussonic.com\/\) ([\d\.]+)$">
4
+ <description>Flussonic Media Server</description>
5
+ <example service.version="19.04">Flussonic (http://www.flussonic.com/) 19.04</example>
6
+ <example service.version="20.01">Flussonic (http://www.flussonic.com/) 20.01</example>
7
+ <param pos="0" name="service.vendor" value="Flussonic"/>
8
+ <param pos="0" name="service.product" value="Flussonic Media Server" />
9
+ <param pos="1" name="service.version" />
10
+ </fingerprint>
11
+ <fingerprint pattern="^Hipcam RealServer\/V([\d\.]+)$">
12
+ <description>Hipcam IP camera running the RealServer RTSP server.</description>
13
+ <example service.version="1.0">Hipcam RealServer/V1.0</example>
14
+ <param pos="0" name="service.vendor" value="RealNetworks"/>
15
+ <param pos="0" name="service.product" value="RealServer" />
16
+ <param pos="1" name="service.version" />
17
+ <param pos="0" name="hw.vendor" value="Hipcam" />
18
+ <param pos="0" name="hw.device" value="IP Camera" />
19
+ </fingerprint>
20
+ <fingerprint pattern="^Dahua Rtsp Server$">
21
+ <description>Dahua IP Camera</description>
22
+ <example>Dahua Rtsp Server</example>
23
+ <param pos="0" name="service.vendor" value="Dahua"/>
24
+ <param pos="0" name="hw.vendor" value="Dahua" />
25
+ <param pos="0" name="hw.device" value="IP Camera" />
26
+ </fingerprint>
27
+ <fingerprint pattern="^GStreamer RTSP server$">
28
+ <description>GStreamer RTSP Server (https://github.com/GStreamer/gst-rtsp-server)</description>
29
+ <example>GStreamer RTSP server</example>
30
+ <param pos="0" name="service.vendor" value="GStreamer"/>
31
+ <param pos="0" name="service.product" value="GStreamer RTSP Server" />
32
+ </fingerprint>
33
+ <fingerprint pattern="^WMServer\/([\d\.]+)$">
34
+ <description>Windows Media Server</description>
35
+ <example service.version="9.1.1.3862">WMServer/9.1.1.3862</example>
36
+ <example service.version="9.5.6001.22609">WMServer/9.5.6001.22609</example>
37
+ <param pos="0" name="service.vendor" value="Microsoft"/>
38
+ <param pos="0" name="service.product" value="Windows Media Server" />
39
+ <param pos="0" name="service.family" value="Windows Media Server"/>
40
+ <param pos="1" name="service.version" />
41
+ <param pos="0" name="os.vendor" value="Microsoft"/>
42
+ <param pos="0" name="os.family" value="Windows"/>
43
+ </fingerprint>
44
+ <fingerprint pattern="^Wowza (Streaming Engine|Media Server) ([\d\.]+) build(\d*)$">
45
+ <description>Wowza Media Systems Streaming Video Services</description>
46
+ <example service.version="4.7.7" service.version.version="20181108145350" service.product="Streaming Engine">Wowza Streaming Engine 4.7.7 build20181108145350</example>
47
+ <example service.version="3.6.4" service.version.version="9641" service.product="Media Server">Wowza Media Server 3.6.4 build9641</example>
48
+ <param pos="0" name="service.vendor" value="Wowza Media Systems"/>
49
+ <param pos="1" name="service.product" />
50
+ <param pos="2" name="service.version" />
51
+ <param pos="3" name="service.version.version" />
52
+ </fingerprint>
53
+ <fingerprint pattern="^HiIpcam\/V\d+R\d+ VodServer\/[\d\.]+$">
54
+ <description>Foscam IP Camera</description>
55
+ <example>HiIpcam/V100R003 VodServer/1.0.0</example>
56
+ <param pos="0" name="hw.vendor" value="Foscam" />
57
+ <param pos="0" name="hw.device" value="IP Camera" />
58
+ </fingerprint>
59
+ <fingerprint pattern="^Indigo\-Security\/[\d\.]+$">
60
+ <description>Indigo Security IP Camera</description>
61
+ <example>Indigo-Security/1.0</example>
62
+ <param pos="0" name="hw.vendor" value="Indigo Security" />
63
+ <param pos="0" name="hw.device" value="IP Camera" />
64
+ </fingerprint>
65
+ <fingerprint pattern="^Cisco MediaSense Media Server$">
66
+ <description>Cisco MediaSense Media Server (RTSP)</description>
67
+ <example>Cisco MediaSense Media Server</example>
68
+ <param pos="0" name="service.vendor" value="Cisco"/>
69
+ <param pos="0" name="service.product" value="MediaSense Media Server"/>
70
+ <param pos="0" name="service.cpe23" value="cpe:2.3:a:cisco:mediasense:-"/>
71
+ <param pos="0" name="os.vendor" value="Cisco"/>
72
+ <param pos="0" name="hw.vendor" value="Cisco"/>
73
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
74
+ <param pos="0" name="hw.product" value="MediaSense Server"/>
75
+ </fingerprint>
76
+ </fingerprints>
data/xml/sip_banners.xml ADDED
@@ -0,0 +1,359 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="sip_header.server" protocol="sip" database_type="service">
3
+ <!--
4
+ SIP Server header values are matched against these patterns to fingerprint SIP devices.
5
+ -->
6
+
7
+ <!-- Cisco/Tandberg Products -->
8
+
9
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)\.x$">
10
+ <description>Cisco IOS SIP Gateway w/ Vague Version</description>
11
+ <example os.version="12">Cisco-SIPGateway/IOS-12.x</example>
12
+ <param pos="0" name="service.vendor" value="Cisco"/>
13
+ <param pos="0" name="service.family" value="IOS"/>
14
+ <param pos="0" name="service.product" value="IOS"/>
15
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
16
+ <param pos="0" name="os.vendor" value="Cisco"/>
17
+ <param pos="0" name="os.family" value="IOS"/>
18
+ <param pos="0" name="os.product" value="IOS"/>
19
+ <param pos="0" name="os.certainty" value="0.8"/>
20
+ <param pos="1" name="os.version"/>
21
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
22
+ <param pos="0" name="hw.vendor" value="Cisco"/>
23
+ <param pos="0" name="hw.device" value="Router"/>
24
+ </fingerprint>
25
+
26
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)$">
27
+ <description>Cisco IOS SIP Gateway w/ Full Version</description>
28
+ <example os.version="15.2.4.M3">Cisco-SIPGateway/IOS-15.2.4.M3</example>
29
+ <example os.version="15.2.2.T1">Cisco-SIPGateway/IOS-15.2.2.T1</example>
30
+ <example os.version="15.2.3.T">Cisco-SIPGateway/IOS-15.2.3.T</example>
31
+ <example os.version="15.4.3.S5">Cisco-SIPGateway/IOS-15.4.3.S5</example>
32
+ <example os.version="15.6.3.M0a">Cisco-SIPGateway/IOS-15.6.3.M0a</example>
33
+ <example os.version="16.3.6">Cisco-SIPGateway/IOS-16.3.6</example>
34
+ <param pos="0" name="service.vendor" value="Cisco"/>
35
+ <param pos="0" name="service.family" value="IOS"/>
36
+ <param pos="0" name="service.product" value="IOS"/>
37
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
38
+ <param pos="0" name="os.vendor" value="Cisco"/>
39
+ <param pos="0" name="os.family" value="IOS"/>
40
+ <param pos="0" name="os.product" value="IOS"/>
41
+ <param pos="0" name="os.certainty" value="1.0"/>
42
+ <param pos="1" name="os.version"/>
43
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
44
+ <param pos="0" name="hw.vendor" value="Cisco"/>
45
+ <param pos="0" name="hw.device" value="Router"/>
46
+ </fingerprint>
47
+
48
+ <fingerprint pattern="^Cisco-CP-?(\d+G?)(?:-\S+)?/([\d\.]+)">
49
+ <description>Cisco CP VoIP Phone</description>
50
+ <example hw.model="7960G" hw.version="8.0">Cisco-CP7960G/8.0</example>
51
+ <example hw.model="7912" hw.version="8.0.1">Cisco-CP7912/8.0.1-060412A</example>
52
+ <example hw.model="7821" hw.version="11.0.0">Cisco-CP-7821-3PCC/11.0.0</example>
53
+ <example hw.model="6841" hw.version="11.1.1">Cisco-CP-6841-3PCC/11.1.1 (00727826a4e1) (sip68xx.11-1-1MPP-897.loads)</example>
54
+ <param pos="0" name="os.vendor" value="Cisco"/>
55
+ <param pos="0" name="os.device" value="VoIP"/>
56
+ <param pos="0" name="hw.vendor" value="Cisco"/>
57
+ <param pos="0" name="hw.product" value="CP"/>
58
+ <param pos="0" name="hw.device" value="VoIP"/>
59
+ <param pos="1" name="hw.model"/>
60
+ <param pos="2" name="hw.version"/>
61
+ </fingerprint>
62
+
63
+ <fingerprint pattern="(?:Cisco|Linksys)/(SPA\d+[DG]?\d?)-([\d\.a-zA-Z]+)">
64
+ <description>Cisco/Linksys SPA VoIP Phone</description>
65
+ <example hw.model="SPA112" hw.version="1.4.1SR1">Cisco/SPA112-1.4.1SR1(002)d-hisec</example>
66
+ <example hw.model="SPA122" hw.version="1.3.3">Cisco/SPA122-1.3.3(004)</example>
67
+ <example hw.model="SPA922" hw.version="6.1.5">PhoneSystems.net aabbccddeeff Linksys/SPA922-6.1.5(a)</example>
68
+ <example hw.model="SPA232D" hw.version="1.4.1">Cisco/SPA232D-1.4.1(002_282)</example>
69
+ <example hw.model="SPA504G" hw.version="7.5.2">Cisco/SPA504G-7.5.2</example>
70
+ <example hw.model="SPA525G2" hw.version="7.6.1">Cisco/SPA525G2-7.6.1</example>
71
+ <example hw.model="SPA922" hw.version="6.1.5">Linksys/SPA922-6.1.5</example>
72
+ <param pos="0" name="os.vendor" value="Cisco"/>
73
+ <param pos="0" name="os.device" value="VoIP"/>
74
+ <param pos="0" name="hw.vendor" value="Cisco"/>
75
+ <param pos="0" name="hw.product" value="SPA"/>
76
+ <param pos="0" name="hw.device" value="VoIP"/>
77
+ <param pos="1" name="hw.model"/>
78
+ <param pos="2" name="hw.version"/>
79
+ </fingerprint>
80
+
81
+ <fingerprint pattern="(?:Cisco|Linksys)(?: |/)(PAP2T?)(?:-|/)(\S+)$">
82
+ <description>Cisco/Linksys VoIP / Internet Phone adapter</description>
83
+ <example hw.version="3.1.22(LS)" hw.model="PAP2">PhoneSystems.net aabbccddeeff Linksys/PAP2-3.1.22(LS)</example>
84
+ <example hw.version="3.1.9(LSc)" hw.model="PAP2">aabbccddeeff Linksys/PAP2-3.1.9(LSc)</example>
85
+ <example hw.version="3.52.12X" hw.model="PAP2T">Linksys PAP2T/3.52.12X</example>
86
+ <example hw.version="2.0.10(LSb)" hw.model="PAP2">iLinksys/PAP2-2.0.10(LSb)</example>
87
+ <example hw.version="3.1.16(LS)" hw.model="PAP2T">Linksys/PAP2T-3.1.16(LS)</example>
88
+ <param pos="0" name="os.vendor" value="Cisco"/>
89
+ <param pos="0" name="os.device" value="VoIP"/>
90
+ <param pos="0" name="hw.vendor" value="Cisco"/>
91
+ <param pos="0" name="hw.product" value="Internet Phone Adapter"/>
92
+ <param pos="0" name="hw.device" value="VoIP"/>
93
+ <param pos="1" name="hw.model"/>
94
+ <param pos="2" name="hw.version"/>
95
+ </fingerprint>
96
+
97
+ <fingerprint pattern="^Cisco/(SRP\d+)-([\d\.]+)">
98
+ <description>Cisco Services Ready Platforms (SRP) Router</description>
99
+ <example hw.model="SRP541" hw.version="1.2.6">Cisco/SRP541-1.2.6(003)</example>
100
+ <example hw.model="SRP527" hw.version="1.02.03">Cisco/SRP527-1.02.03(002)</example>
101
+ <param pos="0" name="os.vendor" value="Cisco"/>
102
+ <param pos="0" name="os.device" value="Router"/>
103
+ <param pos="0" name="hw.vendor" value="Cisco"/>
104
+ <param pos="0" name="hw.product" value="SRP"/>
105
+ <param pos="0" name="hw.device" value="Router"/>
106
+ <param pos="1" name="hw.model"/>
107
+ <param pos="2" name="hw.version"/>
108
+ </fingerprint>
109
+
110
+ <fingerprint pattern="(?:Cisco|Linksys)/(WRP\d+)-(\S+)$">
111
+ <description>Cisco/Linksys WRP Wireless Router</description>
112
+ <example hw.version="2.00.26" hw.model="WRP400">aabbccddeeff_FinalStage_Linksys/WRP400-2.00.26</example>
113
+ <example hw.version="1.01.08" hw.model="WRP200">Linksys/WRP200-1.01.08</example>
114
+ <example hw.version="1.00.05B2" hw.model="WRP400">Linksys/WRP400-1.00.05B2</example>
115
+ <param pos="0" name="os.vendor" value="Cisco"/>
116
+ <param pos="0" name="os.device" value="Router"/>
117
+ <param pos="0" name="hw.vendor" value="Cisco"/>
118
+ <param pos="0" name="hw.product" value="Wireless Router"/>
119
+ <param pos="0" name="hw.device" value="Router"/>
120
+ <param pos="1" name="hw.model"/>
121
+ <param pos="2" name="hw.version"/>
122
+ </fingerprint>
123
+
124
+ <fingerprint pattern="^TANDBERG/(\d+) \((.*)\) Cisco-(\S+)$">
125
+ <description>Cisco/Tandberg TelePresence w/Cisco Model Name</description>
126
+ <example os.version="TC7.3.7.01c84fd" tandberg.model="528" hw.product="EX60">TANDBERG/528 (TC7.3.7.01c84fd) Cisco-EX60</example>
127
+ <example os.version="ce9.6.0.76c1685b70e" tandberg.model="529" hw.product="RoomKitMini">TANDBERG/529 (ce9.6.0.76c1685b70e) Cisco-RoomKitMini</example>
128
+ <param pos="0" name="os.vendor" value="Tandberg"/>
129
+ <param pos="0" name="os.family" value="Linux"/>
130
+ <param pos="0" name="os.product" value="Linux"/>
131
+ <param pos="1" name="tandberg.model"/>
132
+ <param pos="2" name="os.version"/>
133
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
134
+ <param pos="0" name="hw.vendor" value="Cisco"/>
135
+ <param pos="0" name="hw.family" value="TelePresence"/>
136
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
137
+ <param pos="3" name="hw.product"/>
138
+ </fingerprint>
139
+
140
+ <fingerprint pattern="^(TANDBERG/(\d+)) \((\S+).*\)$">
141
+ <description>Cisco/Tandberg TelePresence</description>
142
+ <example os.version="TC7.0.2.aecf2d9" tandberg.model="519" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
143
+ <example os.version="X12.5.2" tandberg.model="4137" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
144
+ <example os.version="X8.2.1" hw.product="TANDBERG/4130">TANDBERG/4130 (X8.2.1)</example>
145
+ <example os.version="XC2.2.1-b2bua-1.0" hw.product="TANDBERG/4353" tandberg.model="4353">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
146
+ <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516" tandberg.model="516">TANDBERG/516 (TC5.1.4.295090)</example>
147
+ <example os.version="TCNC5.1.4.295090" hw.product="TANDBERG/517" tandberg.model="517">TANDBERG/517 (TCNC5.1.4.295090)</example>
148
+ <param pos="0" name="os.vendor" value="Tandberg"/>
149
+ <param pos="0" name="os.family" value="Linux"/>
150
+ <param pos="0" name="os.product" value="Linux"/>
151
+ <param pos="2" name="tandberg.model"/>
152
+ <param pos="3" name="os.version"/>
153
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
154
+ <param pos="0" name="hw.vendor" value="Cisco"/>
155
+ <param pos="0" name="hw.family" value="TelePresence"/>
156
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
157
+ <param pos="1" name="hw.product"/>
158
+ </fingerprint>
159
+
160
+ <!-- Various -->
161
+
162
+ <fingerprint pattern="EnGenius_Router$">
163
+ <description>EnGenius DuraFon IP Phone</description>
164
+ <example>EnGenius_Router</example>
165
+ <param pos="0" name="hw.vendor" value="enGenius"/>
166
+ <param pos="0" name="hw.product" value="DuraFon"/>
167
+ <param pos="0" name="hw.device" value="VoIP"/>
168
+ </fingerprint>
169
+
170
+ <fingerprint pattern="(?i)^Huawei (SoftX\d+) (?:V\d.*)$">
171
+ <description>Huawei Softswitch</description>
172
+ <example hw.model="SoftX3000">Huawei SoftX3000 V300R006</example>
173
+ <param pos="0" name="hw.vendor" value="Huawei"/>
174
+ <param pos="0" name="hw.device" value="Telecom"/>
175
+ <param pos="0" name="hw.product" value="Softswitch"/>
176
+ <param pos="1" name="hw.model"/>
177
+ </fingerprint>
178
+
179
+ <fingerprint pattern="(?i)^SIP/1.0 \(Huawei\)$">
180
+ <description>Huawei generic</description>
181
+ <example>SIP/1.0 (Huawei)</example>
182
+ <param pos="0" name="hw.vendor" value="Huawei"/>
183
+ </fingerprint>
184
+
185
+ <fingerprint pattern="^M5T SIP(?: Stack|-UA SAFE)/v?([\d\.]+)">
186
+ <description>Media5 Corporation SIP Stack</description>
187
+ <example service.version="4.1.2.2">M5T SIP Stack/4.1.2.2</example>
188
+ <example service.version="3.6.4.8">M5T SIP-UA SAFE/v3.6.4.8</example>
189
+ <example service.version="4.1.2.2">M5T SIP Stack/4.1.2.2alliu</example>
190
+ <param pos="0" name="service.vendor" value="Media5 Corporation"/>
191
+ <param pos="0" name="service.product" value="SIP Stack"/>
192
+ <param pos="1" name="service.version"/>
193
+ <param pos="0" name="hw.device" value="VoIP"/>
194
+ </fingerprint>
195
+
196
+ <fingerprint pattern="^Tilgin Vood ([^_\s]+)">
197
+ <description>Tilgin Vood</description>
198
+ <example hw.model="HG238x">Tilgin Vood HG238x_ESx000-02_07_03_26</example>
199
+ <example hw.model="HG27xx">Tilgin Vood HG27xx</example>
200
+ <example hw.model="452W">Tilgin Vood 452W_S_3_4_2_RC_2</example>
201
+ <param pos="0" name="hw.vendor" value="Tilgin"/>
202
+ <param pos="0" name="hw.product" value="Vood"/>
203
+ <param pos="1" name="hw.model"/>
204
+ </fingerprint>
205
+
206
+ <fingerprint pattern="^(F\d{3})/VT?(\d(?:[\d\.A-Z]+))$">
207
+ <description>ZTE GPON Router</description>
208
+ <example hw.product="F620" hw.version="3.30.20P5T4S">F620/V3.30.20P5T4S</example>
209
+ <example hw.product="F660" hw.version="2.22.21P1T14S">F660/V2.22.21P1T14S</example>
210
+ <example hw.product="F668" hw.version="2.30.22P1T9">F668/VT2.30.22P1T9</example>
211
+ <param pos="0" name="hw.vendor" value="ZTE"/>
212
+ <param pos="0" name="hw.device" value="Router"/>
213
+ <param pos="1" name="hw.product"/>
214
+ <param pos="2" name="hw.version"/>
215
+ </fingerprint>
216
+
217
+ <fingerprint pattern="^ZXDSL (\S+)/V?(\d(?:[\d\.A-Z_]+))$">
218
+ <description>ZTE ZXDSL router</description>
219
+ <example hw.product="931VII" hw.version="2.0.00.OTET06">ZXDSL 931VII/V2.0.00.OTET06</example>
220
+ <param pos="0" name="hw.vendor" value="ZTE"/>
221
+ <param pos="0" name="hw.device" value="Router"/>
222
+ <param pos="0" name="hw.family" value="ZXDSL"/>
223
+ <param pos="1" name="hw.product"/>
224
+ <param pos="2" name="hw.version"/>
225
+ </fingerprint>
226
+
227
+ <fingerprint pattern="^(?:ZXHN )?(H\d{3}N)/V?(\d(?:[\d\.A-Z_]+))$">
228
+ <description>ZTE ZXHN router</description>
229
+ <example hw.product="H218N" hw.version="1.02.01_ERS">ZXHN H218N/V1.02.01_ERS</example>
230
+ <example hw.product="H367N" hw.version="1.0.4">ZXHN H367N/V1.0.4</example>
231
+ <example hw.product="H218N" hw.version="1.02.01">ZXHN H218N/V1.02.01</example>
232
+ <example hw.product="H208N" hw.version="1.0.2T02">ZXHN H208N/V1.0.2T02</example>
233
+ <example hw.product="H368N" hw.version="1.10.00T10">H368N/V1.10.00T10</example>
234
+ <param pos="0" name="hw.vendor" value="ZTE"/>
235
+ <param pos="0" name="hw.device" value="Router"/>
236
+ <param pos="0" name="hw.family" value="ZXHN"/>
237
+ <param pos="1" name="hw.product"/>
238
+ <param pos="2" name="hw.version"/>
239
+ </fingerprint>
240
+
241
+ <fingerprint pattern="^Aastra ([^/]+)/([a-zA-Z0-9\.\-]+)$">
242
+ <description>Aastra IP Phone</description>
243
+ <example hw.product="6865i" os.version="4.2.0.2023">Aastra 6865i/4.2.0.2023</example>
244
+ <param pos="0" name="os.vendor" value="Aastra"/>
245
+ <param pos="0" name="os.family" value="VoIP"/>
246
+ <param pos="0" name="os.product" value="VoIP"/>
247
+ <param pos="2" name="os.version"/>
248
+ <param pos="0" name="hw.vendor" value="Aastra"/>
249
+ <param pos="0" name="hw.family" value="VoIP"/>
250
+ <param pos="0" name="hw.device" value="VoIP"/>
251
+ <param pos="1" name="hw.product"/>
252
+ </fingerprint>
253
+
254
+ <fingerprint pattern="^(?:Audiocodes-Sip-Gateway-)?(\S+) FX[A-Z_]+/v.(\S+)$">
255
+ <description>Audiocodes-Sip-Gateway</description>
256
+ <example hw.product="MP-124" os.version="6.00A.034.003">Audiocodes-Sip-Gateway-MP-124 FXS/v.6.00A.034.003</example>
257
+ <example hw.product="MP-124" os.version="6.60A.342.003">MP-124 FXS/v.6.60A.342.003</example>
258
+ <example hw.product="MP-114" os.version="6.60A.241.010">MP-114 FXS_FXO/v.6.60A.241.010</example>
259
+ <param pos="0" name="os.vendor" value="Audiocodes"/>
260
+ <param pos="0" name="os.family" value="SIP Gateway"/>
261
+ <param pos="2" name="os.version"/>
262
+ <param pos="0" name="hw.vendor" value="Audiocodes"/>
263
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
264
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
265
+ <param pos="1" name="hw.product"/>
266
+ </fingerprint>
267
+
268
+ <fingerprint pattern="^Wildix GW-(\S+)$">
269
+ <description>Wildix SIP Gateway</description>
270
+ <example os.version="5.0.3.42145">Wildix GW-5.0.3.42145</example>
271
+ <param pos="0" name="os.vendor" value="Wildix"/>
272
+ <param pos="0" name="os.family" value="SIP Gateway"/>
273
+ <param pos="1" name="os.version"/>
274
+ <param pos="0" name="hw.vendor" value="Wildix"/>
275
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
276
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
277
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
278
+ </fingerprint>
279
+
280
+ <fingerprint pattern="^Wildix GW$">
281
+ <description>Wildix SIP Gateway w/o Version</description>
282
+ <example>Wildix GW</example>
283
+ <param pos="0" name="os.vendor" value="Wildix"/>
284
+ <param pos="0" name="os.family" value="SIP Gateway"/>
285
+ <param pos="0" name="hw.vendor" value="Wildix"/>
286
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
287
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
288
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
289
+ </fingerprint>
290
+
291
+ <fingerprint pattern="^Asterisk PBX (\S+)$">
292
+ <description>Asterisk PBX w/ Version</description>
293
+ <example service.version="13.18.0-6.7.1.1.rl.1538157944.1c65507">Asterisk PBX 13.18.0-6.7.1.1.rl.1538157944.1c65507</example>
294
+ <example service.version="16.2.1~dfsg-1">Asterisk PBX 16.2.1~dfsg-1</example>
295
+ <param pos="0" name="service.vendor" value="Asterisk"/>
296
+ <param pos="0" name="service.family" value="PBX"/>
297
+ <param pos="0" name="service.product" value="PBX"/>
298
+ <param pos="1" name="service.version"/>
299
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:{service.version}"/>
300
+ </fingerprint>
301
+
302
+ <fingerprint pattern="^Asterisk PBX$">
303
+ <description>Asterisk PBX w/o Version</description>
304
+ <example>Asterisk PBX</example>
305
+ <param pos="0" name="service.vendor" value="Asterisk"/>
306
+ <param pos="0" name="service.family" value="PBX"/>
307
+ <param pos="0" name="service.product" value="PBX"/>
308
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:-"/>
309
+ </fingerprint>
310
+
311
+ <fingerprint pattern="^FPBX-(\S+)$">
312
+ <description>FreePBX</description>
313
+ <example service.version="12.0.70(11.20.0)">FPBX-12.0.70(11.20.0)</example>
314
+ <example service.version="2.11.0(11.20.0)">FPBX-2.11.0(11.20.0)</example>
315
+ <param pos="0" name="service.vendor" value="FreePBX"/>
316
+ <param pos="0" name="service.family" value="PBX"/>
317
+ <param pos="0" name="service.product" value="PBX"/>
318
+ <param pos="1" name="service.version"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:freepbx:freepbx:{service.version}"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^kamailio \((\S+) \((.*)\)\)$">
323
+ <description>Kamailio SIP Server</description>
324
+ <example service.version="4.4.4" kamailio.platform="x86_64/linux">kamailio (4.4.4 (x86_64/linux))</example>
325
+ <param pos="0" name="service.vendor" value="Kamailio"/>
326
+ <param pos="0" name="service.family" value="SIP Server"/>
327
+ <param pos="0" name="service.product" value="SIP Server"/>
328
+ <param pos="1" name="service.version"/>
329
+ <param pos="2" name="kamailio.platform"/>
330
+ <param pos="0" name="service.cpe23" value="cpe:/a:kamailio:kamailio:{service.version}"/>
331
+ </fingerprint>
332
+
333
+ <!-- This match covers multiple product families and should be split up further -->
334
+ <fingerprint pattern="^Algo-([^/]+)/(.*)$">
335
+ <description>Algo SIP Device</description>
336
+ <example hw.product="8186" os.version="1.7">Algo-8186/1.7</example>
337
+ <param pos="0" name="os.vendor" value="Algo"/>
338
+ <param pos="0" name="os.family" value="SIP Device"/>
339
+ <param pos="2" name="os.version"/>
340
+ <param pos="0" name="hw.vendor" value="Algo"/>
341
+ <param pos="0" name="hw.family" value="SIP Device"/>
342
+ <param pos="0" name="hw.device" value="SIP Device"/>
343
+ <param pos="1" name="hw.product"/>
344
+ </fingerprint>
345
+
346
+ <fingerprint pattern="^(?:SIParator|Ingate-Firewall)/(\S+)$">
347
+ <description>Ingate SIParator Firewall</description>
348
+ <example os.version="5.0.10">Ingate-Firewall/5.0.10</example>
349
+ <example os.version="6.0.4">SIParator/6.0.4</example>
350
+ <param pos="0" name="os.vendor" value="Ingate"/>
351
+ <param pos="0" name="os.family" value="SIP Gateway"/>
352
+ <param pos="1" name="os.version"/>
353
+ <param pos="0" name="hw.vendor" value="Ingate"/>
354
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
355
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
356
+ <param pos="0" name="hw.product" value="SIParator Firewall"/>
357
+ </fingerprint>
358
+
359
+ </fingerprints>