recog-intrigue 2.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/sip_user_agents.xml ADDED
@@ -0,0 +1,221 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="sip_header.user_agent" protocol="sip" database_type="service">
3
+ <!--
4
+ SIP User Agent header values are matched against these patterns to fingerprint SIP devices.
5
+ -->
6
+ <!-- Axis devices -->
7
+ <fingerprint pattern="(?i)^AXIS (\S+) Network Video Door Station$">
8
+ <description>Axis Network Video Door stations, which have voice</description>
9
+ <example hw.product="A8105-E">AXIS A8105-E Network Video Door Station</example>
10
+ <param pos="0" name="hw.vendor" value="Axis"/>
11
+ <param pos="0" name="hw.device" value="Web cam"/>
12
+ <param pos="0" name="hw.family" value="Network Video Door Station"/>
13
+ <param pos="1" name="hw.product"/>
14
+ <param pos="0" name="os.vendor" value="AXIS"/>
15
+ <param pos="0" name="os.family" value="Linux"/>
16
+ </fingerprint>
17
+ <fingerprint pattern="(?i)^AXIS (\S+) Network (?:Audio Bridge|(?:Cabinet|Horn) Speaker)$">
18
+ <description>Axis Network audio devices</description>
19
+ <example hw.product="C3003-E">AXIS C3003-E Network Horn Speaker</example>
20
+ <example hw.product="C8033">AXIS C8033 Network Audio Bridge</example>
21
+ <example hw.product="C1004-E">AXIS C1004-E Network Cabinet Speaker</example>
22
+ <param pos="0" name="hw.vendor" value="Axis"/>
23
+ <param pos="0" name="hw.family" value="Network Audio"/>
24
+ <param pos="1" name="hw.product"/>
25
+ <param pos="0" name="os.vendor" value="AXIS"/>
26
+ <param pos="0" name="os.family" value="Linux"/>
27
+ </fingerprint>
28
+ <!-- Cisco Devices -->
29
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.x]+)$">
30
+ <description>Cisco SIPGateway</description>
31
+ <example>Cisco-SIPGateway/IOS-12.x</example>
32
+ <param pos="0" name="os.vendor" value="Cisco"/>
33
+ <param pos="0" name="os.product" value="IOS"/>
34
+ <param pos="1" name="os.version"/>
35
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
36
+ </fingerprint>
37
+ <!-- AVM.DE Devices -->
38
+ <fingerprint pattern="^FRITZ!OS$">
39
+ <description>AVM FritzOS Device</description>
40
+ <example>FRITZ!OS</example>
41
+ <param pos="0" name="os.vendor" value="AVM"/>
42
+ <param pos="0" name="os.product" value="FRITZ!BOX"/>
43
+ </fingerprint>
44
+ <fingerprint pattern="^(?:AVM )?(FRITZ!Box .*) +(\d+\.\d+\.\d+)">
45
+ <description>AVM FritzBox</description>
46
+ <example>AVM FRITZ!Box Fon 06.03.13</example>
47
+ <example>AVM FRITZ!Box Fon 06.03.65 (Jun 7 2005)</example>
48
+ <example>AVM FRITZ!Box Fon 5010 Annex A (ITA) 48.04.46 (Sep 14 2007)</example>
49
+ <example>AVM FRITZ!Box Fon 5012 (UI) 25.03.90 (3.01.03 tested by accredited T-Com test lab) (Oct 28 2005)</example>
50
+ <example>AVM FRITZ!Box Fon 5113 Annex A 83.04.69 (Dec 2 2008)</example>
51
+ <example>AVM FRITZ!Box Fon 5124 56.04.77 (Feb 14 2014)</example>
52
+ <example>AVM FRITZ!Box Fon 7170 Annex A.B ML Speedport W701V 58.04.67 (Dec 18 2008)</example>
53
+ <example>AVM FRITZ!Box 3272 126.05.50 (Feb 27 2013)</example>
54
+ <example>AVM FRITZ!Box 7170 Annex A 58.04.85 (Apr 4 2011)</example>
55
+ <example>AVM FRITZ!Box 7312 117.05.23 TAL (Jun 1 2012)</example>
56
+ <example>AVM FRITZ!Box WLAN 3270 v3 Edition Italia 125.05.52 (Feb 7 2014)</example>
57
+ <example>AVM FRITZ!Box Speedport W701V Annex A 58.04.82 (May 12 2010)</example>
58
+ <param pos="0" name="os.vendor" value="AVM"/>
59
+ <param pos="0" name="os.family" value="FRITZ!Box"/>
60
+ <param pos="1" name="os.product"/>
61
+ <param pos="2" name="os.version"/>
62
+ </fingerprint>
63
+ <fingerprint pattern="^(?:AVM )?(FRITZ!Fon .*) +(\d+\.\d+\.\d+)">
64
+ <description>AVM FritzFon</description>
65
+ <example>AVM FRITZ!Fon 7150 (fs) 38.04.56 (Mar 31 2008)</example>
66
+ <example>AVM FRITZ!Fon WLAN 7150 Annex A 58.04.84 (Apr 4 2011)</example>
67
+ <param pos="0" name="os.vendor" value="AVM"/>
68
+ <param pos="0" name="os.family" value="FRITZ!Fon"/>
69
+ <param pos="1" name="os.product"/>
70
+ <param pos="2" name="os.version"/>
71
+ </fingerprint>
72
+ <fingerprint pattern="^(?:AVM )?(Multibox .*) +(\d+\.\d+\.\d+)">
73
+ <description>AVM Multibox</description>
74
+ <example>AVM Multibox 7390 NGN 84.05.09 (Jan 13 2012)</example>
75
+ <param pos="0" name="os.vendor" value="AVM"/>
76
+ <param pos="0" name="os.family" value="Multibox"/>
77
+ <param pos="1" name="os.product"/>
78
+ <param pos="2" name="os.version"/>
79
+ </fingerprint>
80
+ <!-- Huawei devices -->
81
+ <fingerprint pattern="(?i)^Huawei$">
82
+ <description>Huawei generic</description>
83
+ <example>Huawei</example>
84
+ <param pos="0" name="hw.vendor" value="Huawei"/>
85
+ </fingerprint>
86
+ <fingerprint pattern="(?i)^Huawei-HomeGateway/V(?:\d.*)$">
87
+ <description>Huawei Home Gateway</description>
88
+ <example>Huawei-HomeGateway/V100R001</example>
89
+ <param pos="0" name="hw.vendor" value="Huawei"/>
90
+ <param pos="0" name="hw.device" value="Broadband router"/>
91
+ <param pos="0" name="hw.product" value="Home Gateway"/>
92
+ </fingerprint>
93
+ <fingerprint pattern="(?i)^Huawei-EchoLife (HG.*)/V(?:\d.*)$">
94
+ <description>Huawei EchoLife Home Gateway</description>
95
+ <example hw.model="HG8121H">HUAWEI-EchoLife HG8121H/V3R018C00S110</example>
96
+ <param pos="0" name="hw.vendor" value="Huawei"/>
97
+ <param pos="0" name="hw.device" value="Broadband router"/>
98
+ <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
99
+ <param pos="1" name="hw.model"/>
100
+ </fingerprint>
101
+ <fingerprint pattern="(?i)^Huawei (SoftX\d+) (?:V\d.*)$">
102
+ <description>Huawei Softswitch</description>
103
+ <example hw.model="SoftX3000">Huawei SoftX3000 V300R010</example>
104
+ <param pos="0" name="hw.vendor" value="Huawei"/>
105
+ <param pos="0" name="hw.device" value="Telecom"/>
106
+ <param pos="0" name="hw.product" value="Softswitch"/>
107
+ <param pos="1" name="hw.model"/>
108
+ </fingerprint>
109
+ <fingerprint pattern="^Mitel-(\S+)-SIP-Phone ([\d\.]+) (.{12})$">
110
+ <description>Mitel SIP Phones</description>
111
+ <example hw.product="5320" hw.version="06.05.00.11" host.mac="010203040506">Mitel-5320-SIP-Phone 06.05.00.11 010203040506</example>
112
+ <param pos="0" name="hw.vendor" value="Mitel"/>
113
+ <param pos="0" name="hw.device" value="VoIP"/>
114
+ <param pos="1" name="hw.product"/>
115
+ <param pos="2" name="hw.version"/>
116
+ <param pos="3" name="host.mac"/>
117
+ </fingerprint>
118
+ <fingerprint pattern="^Mitel Border GW/(\S+)$">
119
+ <description>Mitel SIP Gateway</description>
120
+ <example hw.version="4.0.0.9">Mitel Border GW/4.0.0.9</example>
121
+ <param pos="0" name="hw.vendor" value="Mitel"/>
122
+ <param pos="0" name="hw.device" value="VoIP"/>
123
+ <param pos="0" name="hw.product" value="Border GW"/>
124
+ <param pos="1" name="hw.version"/>
125
+ </fingerprint>
126
+ <fingerprint pattern="^(?:Polycom/[\d\.]+ )?Polycom(SoundPoint|VVX|SoundStation)\S+_(\d+)-UA/([\d\.]+)(?:_(.{12}))?$">
127
+ <description>Polycom SoundPoint, SountdStation, VVX VoIP phones</description>
128
+ <example hw.version="5.8.0.13337" hw.family="VVX" hw.product="VVX 350">PolycomVVX-VVX_350-UA/5.8.0.13337</example>
129
+ <example hw.version="4.1.4.7430" hw.family="VVX" hw.product="VVX 400" host.mac="010203040506">PolycomVVX-VVX_400-UA/4.1.4.7430_010203040506</example>
130
+ <example hw.version="5.5.0.23866" hw.family="VVX" hw.product="VVX 501">Polycom/5.5.0.23866 PolycomVVX-VVX_501-UA/5.5.0.23866</example>
131
+ <example hw.version="4.0.7.2514" hw.family="SoundPoint" hw.product="SoundPoint 670">PolycomSoundPointIP-SPIP_670-UA/4.0.7.2514</example>
132
+ <example hw.version="4.0.8.1608" hw.model="7000" hw.family="SoundStation" hw.product="SoundStation 7000">PolycomSoundStationIP-SSIP_7000-UA/4.0.8.1608</example>
133
+ <param pos="0" name="hw.vendor" value="Polycom"/>
134
+ <param pos="0" name="hw.device" value="VoIP"/>
135
+ <param pos="1" name="hw.family"/>
136
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
137
+ <param pos="2" name="hw.model"/>
138
+ <param pos="3" name="hw.version"/>
139
+ <param pos="4" name="host.mac"/>
140
+ </fingerprint>
141
+ <fingerprint pattern="^(?:Polycom/[\d\.]+ )?Polycom(?:RealPresenceTrio)-Trio_(\S+)-UA/([\d\.]+)(?:_(.{12}))?$">
142
+ <description>Polycom RealPresence Trio Phones</description>
143
+ <example hw.version="5.4.0.12197" hw.product="RealPresence Trio 8800">PolycomRealPresenceTrio-Trio_8800-UA/5.4.0.12197</example>
144
+ <example hw.version="5.7.2.3123" hw.product="RealPresence Trio Visual+">PolycomRealPresenceTrio-Trio_Visual+-UA/5.7.2.3123</example>
145
+ <example hw.version="5.4.3.2389" hw.product="RealPresence Trio 8800">Polycom/5.4.3.2389 PolycomRealPresenceTrio-Trio_8800-UA/5.4.3.2389</example>
146
+ <param pos="0" name="hw.vendor" value="Polycom"/>
147
+ <param pos="0" name="hw.device" value="VoIP"/>
148
+ <param pos="0" name="hw.family" value="RealPresence"/>
149
+ <param pos="0" name="hw.product" value="RealPresence Trio {hw.model}"/>
150
+ <param pos="1" name="hw.model"/>
151
+ <param pos="2" name="hw.version"/>
152
+ <param pos="3" name="host.mac"/>
153
+ </fingerprint>
154
+ <fingerprint pattern="^Polycom ?HDX ?(\d+)(?: ?HD)?(?:/| \(Release - )([^\)]+)\)?">
155
+ <description>Polycom HDX Video Conferencing</description>
156
+ <example hw.model="9006" hw.product="HDX 9006" hw.version="3.0.6-37004">Polycom HDX 9006 (Release - 3.0.6-37004)</example>
157
+ <example hw.model="4000" hw.product="HDX 4000" hw.version="3.1.0">PolycomHDX4000/3.1.0</example>
158
+ <example hw.model="7000" hw.product="HDX 7000" hw.version="3.0.2.1-17007">Polycom HDX 7000 HD (Release - 3.0.2.1-17007)</example>
159
+ <example hw.model="8000" hw.product="HDX 8000" hw.version="3.1.7">PolycomHDX8000HD/3.1.7</example>
160
+ <param pos="0" name="hw.vendor" value="Polycom"/>
161
+ <param pos="0" name="hw.family" value="HDX"/>
162
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
163
+ <param pos="0" name="hw.product" value="HDX {hw.model}"/>
164
+ <param pos="1" name="hw.model"/>
165
+ <param pos="2" name="hw.version"/>
166
+ </fingerprint>
167
+ <fingerprint pattern="^PolycomRealPresenceGroup(\d+)/([\d\._]+)+$">
168
+ <description>Polycom RealPresence Group Video Conferencing</description>
169
+ <example hw.model="700" hw.product="RealPresence Group 700" hw.version="6.2.0">PolycomRealPresenceGroup700/6.2.0</example>
170
+ <param pos="0" name="hw.vendor" value="Polycom"/>
171
+ <param pos="0" name="hw.family" value="RealPresence Group"/>
172
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
173
+ <param pos="0" name="hw.product" value="RealPresence Group {hw.model}"/>
174
+ <param pos="1" name="hw.model"/>
175
+ <param pos="2" name="hw.version"/>
176
+ </fingerprint>
177
+ <fingerprint pattern="^Nero SIPPS IP Phone Version ([\d\.]+)+$">
178
+ <description>Nero SIPPS IP Phone</description>
179
+ <example service.version="2.0.51.16">Nero SIPPS IP Phone Version 2.0.51.16</example>
180
+ <param pos="0" name="service.vendor" value="Nero"/>
181
+ <param pos="0" name="service.family" value="SIPPS"/>
182
+ <param pos="0" name="service.protocol" value="VoIP"/>
183
+ <param pos="0" name="service.product" value="SIPPS IP Phone"/>
184
+ <param pos="1" name="service.version"/>
185
+ </fingerprint>
186
+ <fingerprint pattern="^ShoreGear/([\d\.]+)\s+\(ShoreTel \d+\)$">
187
+ <description>ShoreTel VoIP Switch</description>
188
+ <example hw.version="21.90.4128.0">ShoreGear/21.90.4128.0 (ShoreTel 15)</example>
189
+ <example hw.version="22.11.4900.0">ShoreGear/22.11.4900.0 (ShoreTel 15)</example>
190
+ <param pos="0" name="hw.vendor" value="ShoreTel"/>
191
+ <param pos="0" name="hw.device" value="VoIP Switch"/>
192
+ <param pos="1" name="hw.version"/>
193
+ </fingerprint>
194
+ <fingerprint pattern="^MERCURY-([a-fA-F0-9]{12})$">
195
+ <description>Crestron Mercury</description>
196
+ <example host.mac="00107F1ABAA0">MERCURY-00107F1ABAA0</example>
197
+ <param pos="0" name="hw.vendor" value="Crestron"/>
198
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
199
+ <param pos="0" name="hw.product" value="Mercury"/>
200
+ <param pos="0" name="os.vendor" value="Crestron"/>
201
+ <param pos="0" name="os.family" value="Linux"/>
202
+ <param pos="0" name="os.device" value="Video Conferencing"/>
203
+ <param pos="1" name="host.mac"/>
204
+ </fingerprint>
205
+ <fingerprint pattern="^IPDECT/([\d\.]+)\s+\(MAC=([a-fA-F0-9]{12}); SER=">
206
+ <description>Konftel IP Phone</description>
207
+ <example host.mac="00087B0F1D30" hw.version="03.55.0013">IPDECT/03.55.0013 (MAC=00087B0F1D30; SER= 00000; HW=1)</example>
208
+ <param pos="0" name="hw.vendor" value="Konftel"/>
209
+ <param pos="0" name="hw.device" value="VoIP"/>
210
+ <param pos="1" name="hw.version"/>
211
+ <param pos="2" name="host.mac"/>
212
+ </fingerprint>
213
+ <fingerprint pattern="^Sangoma ([^\s]+) V([a-zA-Z0-9\.]+)=?">
214
+ <description>Sangoma IP Phone</description>
215
+ <example hw.product="S305" hw.version="3.0.4.72">Sangoma S305 V3.0.4.72</example>
216
+ <param pos="0" name="hw.vendor" value="Sangoma"/>
217
+ <param pos="0" name="hw.device" value="VoIP"/>
218
+ <param pos="2" name="hw.version"/>
219
+ <param pos="1" name="hw.product"/>
220
+ </fingerprint>
221
+ </fingerprints>
data/xml/smb_native_lm.xml ADDED
@@ -0,0 +1,62 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="smb.native_lm" protocol="smb" database_type="service">
3
+ <!--
4
+ SMB fingerprints obtained from the Native LM (LAN manager) field of SMB
5
+ negotations
6
+ -->
7
+ <!-- Mac OS X -->
8
+ <fingerprint pattern="^Samba (3\.0\.28a-apple)$">
9
+ <description>Samba on OS X 10.6</description>
10
+ <example service.version="3.0.28a-apple">Samba 3.0.28a-apple</example>
11
+ <param pos="0" name="os.vendor" value="Apple"/>
12
+ <param pos="0" name="os.family" value="Mac OS X"/>
13
+ <param pos="0" name="os.product" value="Mac OS X"/>
14
+ <param pos="0" name="os.version" value="10.6"/>
15
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:10.6"/>
16
+ <param pos="0" name="service.vendor" value="Samba"/>
17
+ <param pos="0" name="service.product" value="Samba"/>
18
+ <param pos="1" name="service.version"/>
19
+ <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:{service.version}"/>
20
+ </fingerprint>
21
+ <fingerprint pattern="^Samba (3\.0\.25b-apple)$">
22
+ <description>Samba on OS X 10.5</description>
23
+ <example service.version="3.0.25b-apple">Samba 3.0.25b-apple</example>
24
+ <param pos="0" name="os.vendor" value="Apple"/>
25
+ <param pos="0" name="os.family" value="Mac OS X"/>
26
+ <param pos="0" name="os.product" value="Mac OS X"/>
27
+ <param pos="0" name="os.version" value="10.5"/>
28
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:10.5"/>
29
+ <param pos="0" name="service.vendor" value="Samba"/>
30
+ <param pos="0" name="service.product" value="Samba"/>
31
+ <param pos="1" name="service.version"/>
32
+ <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:{service.version}"/>
33
+ </fingerprint>
34
+ <!-- TODO: Detect vendor, distribution, and package versions -->
35
+ <fingerprint pattern="^Samba (\d\.\d+.\d+\w*)">
36
+ <description>Samba</description>
37
+ <example>Samba 3.0.24</example>
38
+ <example>Samba 3.0.28a</example>
39
+ <example>Samba 3.0.32-0.2-2210-SUSE-SL10.3</example>
40
+ <example>Samba 3.6.3</example>
41
+ <example>Samba 3.6.6</example>
42
+ <example>Samba 3.6.9-151.el6_4.1</example>
43
+ <param pos="0" name="service.vendor" value="Samba"/>
44
+ <param pos="0" name="service.product" value="Samba"/>
45
+ <param pos="1" name="service.version"/>
46
+ <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:{service.version}"/>
47
+ </fingerprint>
48
+ <fingerprint pattern="^Netreon LANMAN 1.0$">
49
+ <description>Netreon SAN software</description>
50
+ <example>Netreon LANMAN 1.0</example>
51
+ <param pos="0" name="service.vendor" value="Netreon"/>
52
+ </fingerprint>
53
+ <fingerprint pattern="(?i)^MikrotikSMB$">
54
+ <description>Mikrotik</description>
55
+ <example>MikrotikSMB</example>
56
+ <param pos="0" name="os.vendor" value="MikroTik"/>
57
+ <param pos="0" name="os.device" value="Router"/>
58
+ <param pos="0" name="os.family" value="RouterOS"/>
59
+ <param pos="0" name="os.product" value="RouterOS"/>
60
+ <param pos="0" name="os.cpe23" value="cpe:/o:mikrotik:routeros:-"/>
61
+ </fingerprint>
62
+ </fingerprints>
data/xml/smb_native_os.xml ADDED
@@ -0,0 +1,662 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="smb.native_os" protocol="smb" database_type="util.os">
3
+ <!--
4
+ SMB fingerprints obtained from the Native OS field of SMB negotations
5
+ -->
6
+ <fingerprint pattern="^(Windows NT \d\.\d+)$">
7
+ <description>Windows NT</description>
8
+ <example os.product="Windows NT 4.0">Windows NT 4.0</example>
9
+ <param pos="0" name="os.certainty" value="1.0"/>
10
+ <param pos="0" name="os.vendor" value="Microsoft"/>
11
+ <param pos="1" name="os.product"/>
12
+ </fingerprint>
13
+ <fingerprint pattern="^(Windows (?:95|98|ME))$">
14
+ <description>Windows 95/98/ME</description>
15
+ <example os.product="Windows 95">Windows 95</example>
16
+ <example os.product="Windows 98">Windows 98</example>
17
+ <param pos="0" name="os.certainty" value="1.0"/>
18
+ <param pos="0" name="os.vendor" value="Microsoft"/>
19
+ <param pos="1" name="os.product"/>
20
+ </fingerprint>
21
+ <fingerprint pattern="^Windows 5\.0$">
22
+ <description>Windows 2000</description>
23
+ <example>Windows 5.0</example>
24
+ <param pos="0" name="os.certainty" value="1.0"/>
25
+ <param pos="0" name="os.vendor" value="Microsoft"/>
26
+ <param pos="0" name="os.product" value="Windows 2000"/>
27
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
28
+ </fingerprint>
29
+ <fingerprint pattern="^Windows 5\.1$">
30
+ <description>Windows XP</description>
31
+ <example>Windows 5.1</example>
32
+ <param pos="0" name="os.certainty" value="1.0"/>
33
+ <param pos="0" name="os.vendor" value="Microsoft"/>
34
+ <param pos="0" name="os.product" value="Windows XP"/>
35
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:-"/>
36
+ </fingerprint>
37
+ <fingerprint pattern="^Windows XP (\d+) (Service Pack \d+)$">
38
+ <description>Windows XP with Service Pack</description>
39
+ <example os.build="2600" os.version="Service Pack 1">Windows XP 2600 Service Pack 1</example>
40
+ <param pos="0" name="os.certainty" value="1.0"/>
41
+ <param pos="0" name="os.vendor" value="Microsoft"/>
42
+ <param pos="0" name="os.product" value="Windows XP"/>
43
+ <param pos="1" name="os.build"/>
44
+ <param pos="2" name="os.version"/>
45
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:{os.version}"/>
46
+ </fingerprint>
47
+ <fingerprint pattern="^Windows XP (\d+)$">
48
+ <description>Windows XP with build number</description>
49
+ <example os.build="2600">Windows XP 2600</example>
50
+ <param pos="0" name="os.certainty" value="1.0"/>
51
+ <param pos="0" name="os.vendor" value="Microsoft"/>
52
+ <param pos="0" name="os.product" value="Windows XP"/>
53
+ <param pos="1" name="os.build"/>
54
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:-"/>
55
+ </fingerprint>
56
+ <fingerprint pattern="^Windows XP (Home|Professional)(?: Edition)?$">
57
+ <description>Windows XP without a version</description>
58
+ <example os.edition="Home">Windows XP Home Edition</example>
59
+ <example os.edition="Professional">Windows XP Professional</example>
60
+ <param pos="0" name="os.certainty" value="1.0"/>
61
+ <param pos="0" name="os.vendor" value="Microsoft"/>
62
+ <param pos="0" name="os.product" value="Windows XP"/>
63
+ <param pos="1" name="os.edition"/>
64
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:-"/>
65
+ </fingerprint>
66
+ <fingerprint pattern="^Windows \.NET">
67
+ <description>Windows Server 2003 Beta</description>
68
+ <param pos="0" name="os.certainty" value="1.0"/>
69
+ <param pos="0" name="os.vendor" value="Microsoft"/>
70
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
71
+ <param pos="0" name="os.version" value="Beta"/>
72
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:Beta"/>
73
+ </fingerprint>
74
+ <fingerprint pattern="^Windows Server 2003 R2 (\d+)$">
75
+ <description>Windows Server 2003 R2</description>
76
+ <param pos="0" name="os.certainty" value="1.0"/>
77
+ <param pos="0" name="os.vendor" value="Microsoft"/>
78
+ <param pos="0" name="os.product" value="Windows Server 2003 R2"/>
79
+ <param pos="1" name="os.build"/>
80
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
81
+ </fingerprint>
82
+ <fingerprint pattern="^Windows Server 2003 R2 (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
83
+ <description>Windows Server 2003 R2 (SP)</description>
84
+ <example os.build="3790" os.version="Service Pack 2">Windows Server 2003 R2 3790 Service Pack 2</example>
85
+ <example os.build="3790" os.version="Service Pack 2">Windows Server 2003 R2 3790 Service Pack 2, v.2825</example>
86
+ <param pos="0" name="os.certainty" value="1.0"/>
87
+ <param pos="0" name="os.vendor" value="Microsoft"/>
88
+ <param pos="0" name="os.product" value="Windows Server 2003 R2"/>
89
+ <param pos="1" name="os.build"/>
90
+ <param pos="2" name="os.version"/>
91
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:{os.version}"/>
92
+ </fingerprint>
93
+ <fingerprint pattern="^Windows Server 2003 (\d+)$">
94
+ <description>Windows Server 2003 with a build</description>
95
+ <example os.build="3790">Windows Server 2003 3790</example>
96
+ <param pos="0" name="os.certainty" value="1.0"/>
97
+ <param pos="0" name="os.vendor" value="Microsoft"/>
98
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
99
+ <param pos="1" name="os.build"/>
100
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
101
+ </fingerprint>
102
+ <fingerprint pattern="^Windows Server 2003$">
103
+ <description>Windows Server 2003 without a build</description>
104
+ <example>Windows Server 2003</example>
105
+ <param pos="0" name="os.certainty" value="1.0"/>
106
+ <param pos="0" name="os.vendor" value="Microsoft"/>
107
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
108
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
109
+ </fingerprint>
110
+ <fingerprint pattern="^Windows Server 2003 (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
111
+ <description>Windows Server 2003 (SP)</description>
112
+ <example os.build="3790" os.version="Service Pack 1">Windows Server 2003 3790 Service Pack 1, v.3309</example>
113
+ <example os.build="3790" os.version="Service Pack 2">Windows Server 2003 3790 Service Pack 2</example>
114
+ <param pos="0" name="os.certainty" value="1.0"/>
115
+ <param pos="0" name="os.vendor" value="Microsoft"/>
116
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
117
+ <param pos="1" name="os.build"/>
118
+ <param pos="2" name="os.version"/>
119
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:{os.version}"/>
120
+ </fingerprint>
121
+ <!-- Note that 2008 SP1 is technically "2008 Gold" according to Microsoft -->
122
+ <fingerprint pattern="^Windows Server 2008$">
123
+ <description>Windows Server 2008 without a build</description>
124
+ <example>Windows Server 2008</example>
125
+ <param pos="0" name="os.certainty" value="1.0"/>
126
+ <param pos="0" name="os.vendor" value="Microsoft"/>
127
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
128
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
129
+ </fingerprint>
130
+ <fingerprint pattern="^Windows Server \(R\) 2008 (\w+|\w+ \w+|\w+ \w+ \w+)(?: (?:with|without) Hyper-V|) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
131
+ <description>Windows Server 2008</description>
132
+ <example os.edition="Enterprise" os.version="Service Pack 1">Windows Server (R) 2008 Enterprise without Hyper-V 6001 Service Pack 1</example>
133
+ <example os.edition="Enterprise" os.version="Service Pack 2">Windows Server (R) 2008 Enterprise 6002 Service Pack 2, v.275</example>
134
+ <param pos="0" name="os.certainty" value="1.0"/>
135
+ <param pos="0" name="os.vendor" value="Microsoft"/>
136
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
137
+ <param pos="1" name="os.edition"/>
138
+ <param pos="2" name="os.build"/>
139
+ <param pos="3" name="os.version"/>
140
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
141
+ </fingerprint>
142
+ <fingerprint pattern="^Windows \(R\) Web Server 2008 (\d+) (Service Pack \d+)$">
143
+ <description>Windows Web Server 2008 (SP)</description>
144
+ <example os.edition="Web" os.version="Service Pack 2">Windows (R) Web Server 2008 6002 Service Pack 2</example>
145
+ <param pos="0" name="os.certainty" value="1.0"/>
146
+ <param pos="0" name="os.vendor" value="Microsoft"/>
147
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
148
+ <param pos="0" name="os.edition" value="Web"/>
149
+ <param pos="1" name="os.build"/>
150
+ <param pos="2" name="os.version"/>
151
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
152
+ </fingerprint>
153
+ <fingerprint pattern="^Windows \(R\) Web Server 2008 (\d+)$">
154
+ <description>Windows Web Server 2008</description>
155
+ <example>Windows (R) Web Server 2008 6002</example>
156
+ <param pos="0" name="os.certainty" value="1.0"/>
157
+ <param pos="0" name="os.vendor" value="Microsoft"/>
158
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
159
+ <param pos="0" name="os.edition" value="Web"/>
160
+ <param pos="1" name="os.build"/>
161
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
162
+ </fingerprint>
163
+ <!-- TODO: Need an example string -->
164
+ <fingerprint pattern="^Windows \(R\) Storage Server 2008 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
165
+ <description>Windows Server 2008 Storage (SP)</description>
166
+ <param pos="0" name="os.certainty" value="1.0"/>
167
+ <param pos="0" name="os.vendor" value="Microsoft"/>
168
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
169
+ <param pos="0" name="os.edition" value="Storage"/>
170
+ <param pos="1" name="os.build"/>
171
+ <param pos="2" name="os.version"/>
172
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
173
+ </fingerprint>
174
+ <!-- TODO: Need an example string -->
175
+ <fingerprint pattern="^Windows \(R\) Storage Server 2008 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
176
+ <description>Windows Web Server 2008 Storage</description>
177
+ <param pos="0" name="os.certainty" value="1.0"/>
178
+ <param pos="0" name="os.vendor" value="Microsoft"/>
179
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
180
+ <param pos="0" name="os.edition" value="Storage"/>
181
+ <param pos="1" name="os.build"/>
182
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
183
+ </fingerprint>
184
+ <fingerprint pattern="^Windows Server 2008 HPC Edition (\d+) (Service Pack \d+)$">
185
+ <description>Windows Server 2008 HPC</description>
186
+ <example>Windows Server 2008 HPC Edition 7601 Service Pack 1</example>
187
+ <param pos="0" name="os.certainty" value="1.0"/>
188
+ <param pos="0" name="os.vendor" value="Microsoft"/>
189
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
190
+ <param pos="0" name="os.edition" value="HPC"/>
191
+ <param pos="1" name="os.build"/>
192
+ <param pos="2" name="os.version"/>
193
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
194
+ </fingerprint>
195
+ <!-- TODO: Need an example string -->
196
+ <fingerprint pattern="^Windows Server 2008 HPC Edition (\d+)$">
197
+ <description>Windows Web Server 2008 HPC</description>
198
+ <example>Windows Server 2008 HPC Edition 7600</example>
199
+ <param pos="0" name="os.certainty" value="1.0"/>
200
+ <param pos="0" name="os.vendor" value="Microsoft"/>
201
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
202
+ <param pos="0" name="os.edition" value="HPC"/>
203
+ <param pos="1" name="os.build"/>
204
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
205
+ </fingerprint>
206
+ <!-- 2008 R2 -->
207
+ <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
208
+ <description>Windows Server 2008 R2</description>
209
+ <example>Windows Server 2008 R2 Enterprise 7601 Service Pack 1</example>
210
+ <example>Windows Server 2008 R2 Standard 7601 Service Pack 1</example>
211
+ <param pos="0" name="os.certainty" value="1.0"/>
212
+ <param pos="0" name="os.vendor" value="Microsoft"/>
213
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
214
+ <param pos="1" name="os.edition"/>
215
+ <param pos="2" name="os.build"/>
216
+ <param pos="3" name="os.version"/>
217
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
218
+ </fingerprint>
219
+ <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
220
+ <description>Windows Server 2008 R2 without Service Pack</description>
221
+ <example os.edition="Enterprise">Windows Server 2008 R2 Enterprise 7600</example>
222
+ <example os.edition="Standard">Windows Server 2008 R2 Standard 7600</example>
223
+ <example os.edition="Datacenter">Windows Server 2008 R2 Datacenter 7600</example>
224
+ <param pos="0" name="os.certainty" value="1.0"/>
225
+ <param pos="0" name="os.vendor" value="Microsoft"/>
226
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
227
+ <param pos="1" name="os.edition"/>
228
+ <param pos="2" name="os.build"/>
229
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
230
+ </fingerprint>
231
+ <fingerprint pattern="^Windows Server 2016(?: Technical Preview \d+)? (\w+|\w+ \w+|\w+ \w+ \w+)(?: Evaluation)? (\d+)$">
232
+ <description>Windows Server 2016 with a build, without service pack</description>
233
+ <example os.edition="Datacenter" os.build="14393">Windows Server 2016 Datacenter 14393</example>
234
+ <example os.edition="Standard" os.build="14393">Windows Server 2016 Standard Evaluation 14393</example>
235
+ <example os.edition="Essentials" os.build="10586">Windows Server 2016 Technical Preview 4 Essentials 10586</example>
236
+ <param pos="0" name="os.certainty" value="1.0"/>
237
+ <param pos="0" name="os.vendor" value="Microsoft"/>
238
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
239
+ <param pos="1" name="os.edition"/>
240
+ <param pos="2" name="os.build"/>
241
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
242
+ </fingerprint>
243
+ <fingerprint pattern="^Windows Storage Server 2016 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
244
+ <description>Windows Server 2016 Storage</description>
245
+ <example os.build="14393">Windows Storage Server 2016 Standard 14393</example>
246
+ <param pos="0" name="os.certainty" value="1.0"/>
247
+ <param pos="0" name="os.vendor" value="Microsoft"/>
248
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
249
+ <param pos="0" name="os.edition" value="Storage"/>
250
+ <param pos="1" name="os.build"/>
251
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
252
+ </fingerprint>
253
+ <fingerprint pattern="^Windows Web Server 2008 R2 (\d+) (Service Pack \d+)$">
254
+ <description>Windows Server 2008 R2 Web</description>
255
+ <example os.version="Service Pack 1">Windows Web Server 2008 R2 7601 Service Pack 1</example>
256
+ <param pos="0" name="os.certainty" value="1.0"/>
257
+ <param pos="0" name="os.vendor" value="Microsoft"/>
258
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
259
+ <param pos="0" name="os.edition" value="Web"/>
260
+ <param pos="1" name="os.build"/>
261
+ <param pos="2" name="os.version"/>
262
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
263
+ </fingerprint>
264
+ <fingerprint pattern="^Windows Web Server 2008 R2 (\d+)$">
265
+ <description>Windows Web Server 2008 R2 Web</description>
266
+ <example>Windows Web Server 2008 R2 7600</example>
267
+ <param pos="0" name="os.certainty" value="1.0"/>
268
+ <param pos="0" name="os.vendor" value="Microsoft"/>
269
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
270
+ <param pos="0" name="os.edition" value="Web"/>
271
+ <param pos="1" name="os.build"/>
272
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
273
+ </fingerprint>
274
+ <fingerprint pattern="^Windows Storage Server 2008 R2 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
275
+ <description>Windows Server 2008 Storage R2 (SP)</description>
276
+ <example os.version="Service Pack 1" os.build="7601">Windows Storage Server 2008 R2 Essentials 7601 Service Pack 1</example>
277
+ <param pos="0" name="os.certainty" value="1.0"/>
278
+ <param pos="0" name="os.vendor" value="Microsoft"/>
279
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
280
+ <param pos="0" name="os.edition" value="Storage"/>
281
+ <param pos="1" name="os.build"/>
282
+ <param pos="2" name="os.version"/>
283
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
284
+ </fingerprint>
285
+ <fingerprint pattern="^Windows Vista \(TM\) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
286
+ <description>Windows Vista (SP)</description>
287
+ <example os.edition="Home Premium" os.version="Service Pack 2">Windows Vista (TM) Home Premium 6002 Service Pack 2</example>
288
+ <param pos="0" name="os.certainty" value="1.0"/>
289
+ <param pos="0" name="os.vendor" value="Microsoft"/>
290
+ <param pos="0" name="os.product" value="Windows Vista"/>
291
+ <param pos="1" name="os.edition"/>
292
+ <param pos="2" name="os.build"/>
293
+ <param pos="3" name="os.version"/>
294
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_vista:{os.version}"/>
295
+ </fingerprint>
296
+ <fingerprint pattern="^Windows Vista \(TM\) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
297
+ <description>Windows Vista</description>
298
+ <example os.edition="Home Premium">Windows Vista (TM) Home Premium 6000</example>
299
+ <param pos="0" name="os.certainty" value="1.0"/>
300
+ <param pos="0" name="os.vendor" value="Microsoft"/>
301
+ <param pos="0" name="os.product" value="Windows Vista"/>
302
+ <param pos="1" name="os.edition"/>
303
+ <param pos="2" name="os.build"/>
304
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_vista:-"/>
305
+ </fingerprint>
306
+ <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
307
+ <description>Windows 7/8 (SP + Edition)</description>
308
+ <example os.edition="Enterprise" os.version="Service Pack 1">Windows 7 Enterprise 7601 Service Pack 1</example>
309
+ <example os.edition="Starter" os.version="Service Pack 1">Windows 7 Starter 7601 Service Pack 1</example>
310
+ <example os.edition="Ultimate" os.build="7601" os.version="Service Pack 1">Windows 7 Ultimate 7601 Service Pack 1, v.178</example>
311
+ <param pos="0" name="os.certainty" value="1.0"/>
312
+ <param pos="0" name="os.vendor" value="Microsoft"/>
313
+ <param pos="1" name="os.product"/>
314
+ <param pos="2" name="os.edition"/>
315
+ <param pos="3" name="os.build"/>
316
+ <param pos="4" name="os.version"/>
317
+ </fingerprint>
318
+ <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\d+) (Service Pack \d+)$">
319
+ <description>Windows 7/8 (SP)</description>
320
+ <example os.version="Service Pack 1">Windows 7 7601 Service Pack 1</example>
321
+ <param pos="0" name="os.certainty" value="1.0"/>
322
+ <param pos="0" name="os.vendor" value="Microsoft"/>
323
+ <param pos="1" name="os.product"/>
324
+ <param pos="2" name="os.build"/>
325
+ <param pos="3" name="os.version"/>
326
+ </fingerprint>
327
+ <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
328
+ <description>Windows 7/8 (Edition)</description>
329
+ <example os.edition="Enterprise">Windows 7 Enterprise 7600</example>
330
+ <example os.edition="Enterprise">Windows 8.1 Enterprise 9600</example>
331
+ <example os.edition="Enterprise">Windows 8 Enterprise 9200</example>
332
+ <param pos="0" name="os.certainty" value="1.0"/>
333
+ <param pos="0" name="os.vendor" value="Microsoft"/>
334
+ <param pos="1" name="os.product"/>
335
+ <param pos="2" name="os.edition"/>
336
+ <param pos="3" name="os.build"/>
337
+ </fingerprint>
338
+ <fingerprint pattern="^(Windows (?:7|8|8\.1)(?:| RT)) (\d+)$">
339
+ <description>Windows 7/8</description>
340
+ <example>Windows 8 9200</example>
341
+ <param pos="0" name="os.certainty" value="1.0"/>
342
+ <param pos="0" name="os.vendor" value="Microsoft"/>
343
+ <param pos="1" name="os.product"/>
344
+ <param pos="2" name="os.build"/>
345
+ </fingerprint>
346
+ <!-- Windows 2012 R2 matches go first to simplify the regular expressions -->
347
+ <!-- TODO: Need an example string -->
348
+ <fingerprint pattern="^Windows Server 2012 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
349
+ <description>Windows Server 2012 R2 (SP)</description>
350
+ <param pos="0" name="os.certainty" value="1.0"/>
351
+ <param pos="0" name="os.vendor" value="Microsoft"/>
352
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
353
+ <param pos="1" name="os.edition"/>
354
+ <param pos="2" name="os.build"/>
355
+ <param pos="3" name="os.version"/>
356
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:{os.version}"/>
357
+ </fingerprint>
358
+ <fingerprint pattern="^Windows Server 2012 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
359
+ <description>Windows Server 2012 R2</description>
360
+ <example os.edition="Standard">Windows Server 2012 R2 Standard 9600</example>
361
+ <param pos="0" name="os.certainty" value="1.0"/>
362
+ <param pos="0" name="os.vendor" value="Microsoft"/>
363
+ <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
364
+ <param pos="1" name="os.edition"/>
365
+ <param pos="2" name="os.build"/>
366
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
367
+ </fingerprint>
368
+ <!-- TODO: Need an example string -->
369
+ <fingerprint pattern="^Windows Server 2012 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
370
+ <description>Windows Server 2012 (SP)</description>
371
+ <param pos="0" name="os.certainty" value="1.0"/>
372
+ <param pos="0" name="os.vendor" value="Microsoft"/>
373
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
374
+ <param pos="1" name="os.edition"/>
375
+ <param pos="2" name="os.build"/>
376
+ <param pos="3" name="os.version"/>
377
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:{os.version}"/>
378
+ </fingerprint>
379
+ <fingerprint pattern="^Windows Server 2012 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
380
+ <description>Windows Server 2012</description>
381
+ <example>Windows Server 2012 Standard 9200</example>
382
+ <param pos="0" name="os.certainty" value="1.0"/>
383
+ <param pos="0" name="os.vendor" value="Microsoft"/>
384
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
385
+ <param pos="1" name="os.edition"/>
386
+ <param pos="2" name="os.build"/>
387
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
388
+ </fingerprint>
389
+ <fingerprint pattern="^Windows MultiPoint Server 2012 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)$">
390
+ <description>Windows MultiPoint Server 2012 (SP)</description>
391
+ <example os.build="9201" os.version="Service Pack 1">Windows MultiPoint Server 2012 Premium 9201 Service Pack 1</example>
392
+ <param pos="0" name="os.certainty" value="1.0"/>
393
+ <param pos="0" name="os.vendor" value="Microsoft"/>
394
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
395
+ <param pos="0" name="os.edition" value="MultiPoint"/>
396
+ <param pos="1" name="os.build"/>
397
+ <param pos="2" name="os.version"/>
398
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:{os.version}"/>
399
+ </fingerprint>
400
+ <fingerprint pattern="^Windows MultiPoint Server 2012 (?:\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
401
+ <description>Windows MultiPoint Server 2012</description>
402
+ <example os.build="9200">Windows MultiPoint Server 2012 Premium 9200</example>
403
+ <param pos="0" name="os.certainty" value="1.0"/>
404
+ <param pos="0" name="os.vendor" value="Microsoft"/>
405
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
406
+ <param pos="0" name="os.edition" value="MultiPoint"/>
407
+ <param pos="1" name="os.build"/>
408
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
409
+ </fingerprint>
410
+ <!-- Windows 10 Preview -->
411
+ <fingerprint pattern="^Windows 10 (\w+|\w+ \w+|\w+ \w+ \w+) Insider Preview (\d+)$">
412
+ <description>Windows 10 Enterprise Insider Preview</description>
413
+ <example os.build="10130" os.edition="Enterprise">Windows 10 Enterprise Insider Preview 10130</example>
414
+ <param pos="0" name="os.certainty" value="1.0"/>
415
+ <param pos="0" name="os.vendor" value="Microsoft"/>
416
+ <param pos="0" name="os.product" value="Windows 10"/>
417
+ <param pos="1" name="os.edition"/>
418
+ <param pos="2" name="os.build"/>
419
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_10:-"/>
420
+ </fingerprint>
421
+ <fingerprint pattern="^Windows 10 ((?:\w+|\w+ \w+|\w+ \w+ \w+)(?: LTSB(?: Evaluation)?)?) (\d+)$">
422
+ <description>Windows 10</description>
423
+ <example os.build="10130" os.edition="Enterprise">Windows 10 Enterprise 10130</example>
424
+ <example os.build="10130" os.edition="Mobile Enterprise">Windows 10 Mobile Enterprise 10130</example>
425
+ <example os.build="10130" os.edition="Mobile">Windows 10 Mobile 10130</example>
426
+ <example os.build="10130" os.edition="Home">Windows 10 Home 10130</example>
427
+ <example os.build="10130" os.edition="Education">Windows 10 Education 10130</example>
428
+ <example os.build="10130" os.edition="Professional">Windows 10 Professional 10130</example>
429
+ <example os.build="10240" os.edition="Enterprise N 2015 LTSB">Windows 10 Enterprise N 2015 LTSB 10240</example>
430
+ <example os.build="14393" os.edition="Enterprise 2016 LTSB Evaluation">Windows 10 Enterprise 2016 LTSB Evaluation 14393</example>
431
+ <param pos="0" name="os.certainty" value="1.0"/>
432
+ <param pos="0" name="os.vendor" value="Microsoft"/>
433
+ <param pos="0" name="os.product" value="Windows 10"/>
434
+ <param pos="1" name="os.edition"/>
435
+ <param pos="2" name="os.build"/>
436
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_10:-"/>
437
+ </fingerprint>
438
+ <fingerprint pattern="^VxWorks">
439
+ <description>VxWorks</description>
440
+ <example>VxWorks</example>
441
+ <param pos="0" name="os.certainty" value="0.5"/>
442
+ <param pos="0" name="os.vendor" value="Wind River"/>
443
+ <param pos="0" name="os.product" value="VxWorks"/>
444
+ <param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:-"/>
445
+ <param pos="0" name="service.vendor" value="Wind River"/>
446
+ <param pos="0" name="service.product" value="VxWorks CIFS"/>
447
+ </fingerprint>
448
+ <fingerprint pattern="^OS/400 \D(\d+)\D(\d+)\D(\d+)">
449
+ <description>OS/400</description>
450
+ <example os.version="4" os.version.version="5" os.version.version.version="0">OS/400 V4R5M0</example>
451
+ <param pos="0" name="os.vendor" value="IBM"/>
452
+ <param pos="0" name="os.product" value="OS/400"/>
453
+ <param pos="1" name="os.version"/>
454
+ <param pos="2" name="os.version.version"/>
455
+ <param pos="3" name="os.version.version.version"/>
456
+ </fingerprint>
457
+ <fingerprint pattern="^Apple Base Station$">
458
+ <description>SMB exposed via SMB shared USB disks on Apple devices</description>
459
+ <example>Apple Base Station</example>
460
+ <param pos="0" name="os.vendor" value="Apple"/>
461
+ <param pos="0" name="hw.vendor" value="Apple"/>
462
+ </fingerprint>
463
+ <fingerprint pattern="^EMC-SNAS:T([\d\.]+)?$">
464
+ <description>EMC Celerra</description>
465
+ <example service.version="7.1.80.7">EMC-SNAS:T7.1.80.7</example>
466
+ <param pos="0" name="service.vendor" value="EMC"/>
467
+ <param pos="0" name="service.product" value="Celerra"/>
468
+ <param pos="1" name="service.version"/>
469
+ <param pos="0" name="os.vendor" value="EMC"/>
470
+ <param pos="0" name="os.device" value="Storage"/>
471
+ <param pos="0" name="os.product" value="Celerra"/>
472
+ <param pos="1" name="os.version"/>
473
+ <param pos="0" name="hw.vendor" value="EMC"/>
474
+ <param pos="0" name="hw.device" value="Storage"/>
475
+ <param pos="0" name="hw.product" value="Celerra"/>
476
+ </fingerprint>
477
+ <fingerprint pattern="^Netreon OS 1.0$">
478
+ <description>Netreon SAN software</description>
479
+ <example>Netreon OS 1.0</example>
480
+ <param pos="0" name="service.vendor" value="Netreon"/>
481
+ </fingerprint>
482
+ <!-- VisionFS -->
483
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ai(\d{4})">
484
+ <description>AIX</description>
485
+ <example service.version="9876">axai9876</example>
486
+ <param pos="0" name="os.vendor" value="IBM"/>
487
+ <param pos="0" name="os.family" value="AIX"/>
488
+ <param pos="0" name="os.product" value="AIX"/>
489
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:-"/>
490
+ <param pos="0" name="service.product" value="VisionFS"/>
491
+ <param pos="1" name="service.version"/>
492
+ </fingerprint>
493
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)dg(\d{4})">
494
+ <description>DG/UX</description>
495
+ <example service.version="9876">i3dg9876</example>
496
+ <param pos="0" name="os.vendor" value="Data General"/>
497
+ <param pos="0" name="os.family" value="DG/UX"/>
498
+ <param pos="0" name="os.product" value="DG/UX"/>
499
+ <param pos="0" name="service.product" value="VisionFS"/>
500
+ <param pos="1" name="service.version"/>
501
+ </fingerprint>
502
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)dw(\d{4})">
503
+ <description>Darwin</description>
504
+ <example service.version="9876">m8dw9876</example>
505
+ <param pos="0" name="os.vendor" value="Apple"/>
506
+ <param pos="0" name="os.family" value="Mac OS X"/>
507
+ <param pos="0" name="os.product" value="Mac OS X"/>
508
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:-"/>
509
+ <param pos="0" name="service.product" value="VisionFS"/>
510
+ <param pos="1" name="service.version"/>
511
+ </fingerprint>
512
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)dy(\d{4})">
513
+ <description>DYNIX</description>
514
+ <example service.version="9876">m8dy9876</example>
515
+ <param pos="0" name="os.vendor" value="Sequent"/>
516
+ <param pos="0" name="os.family" value="Dynix"/>
517
+ <param pos="0" name="os.product" value="Dynix"/>
518
+ <param pos="0" name="service.product" value="VisionFS"/>
519
+ <param pos="1" name="service.version"/>
520
+ </fingerprint>
521
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)fb(\d{4})">
522
+ <description>FreeBSD</description>
523
+ <example service.version="9876">m8fb9876</example>
524
+ <param pos="0" name="os.vendor" value="FreeBSD"/>
525
+ <param pos="0" name="os.family" value="FreeBSD"/>
526
+ <param pos="0" name="os.product" value="FreeBSD"/>
527
+ <param pos="0" name="os.cpe23" value="cpe:/o:freebsd:freebsd:-"/>
528
+ <param pos="0" name="service.product" value="VisionFS"/>
529
+ <param pos="1" name="service.version"/>
530
+ </fingerprint>
531
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)hp(\d{4})">
532
+ <description>HP-UX</description>
533
+ <example service.version="9876">m8hp9876</example>
534
+ <param pos="0" name="os.vendor" value="HP"/>
535
+ <param pos="0" name="os.family" value="HP-UX"/>
536
+ <param pos="0" name="os.product" value="HP-UX"/>
537
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
538
+ <param pos="0" name="service.product" value="VisionFS"/>
539
+ <param pos="1" name="service.version"/>
540
+ </fingerprint>
541
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ir(\d{4})">
542
+ <description>IRIX</description>
543
+ <example service.version="9876">m8ir9876</example>
544
+ <param pos="0" name="os.vendor" value="SGI"/>
545
+ <param pos="0" name="os.family" value="Irix"/>
546
+ <param pos="0" name="os.product" value="Irix"/>
547
+ <param pos="0" name="os.cpe23" value="cpe:/o:sgi:irix:-"/>
548
+ <param pos="0" name="service.product" value="VisionFS"/>
549
+ <param pos="1" name="service.version"/>
550
+ </fingerprint>
551
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)li(\d{4})">
552
+ <description>Linux</description>
553
+ <example service.version="9876">m8li9876</example>
554
+ <param pos="0" name="os.vendor" value="Linux"/>
555
+ <param pos="0" name="os.family" value="Linux"/>
556
+ <param pos="0" name="os.product" value="Linux"/>
557
+ <param pos="0" name="os.cpe23" value="cpe:/o:linux:linux_kernel:-"/>
558
+ <param pos="0" name="service.product" value="VisionFS"/>
559
+ <param pos="1" name="service.version"/>
560
+ </fingerprint>
561
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)mo(\d{4})">
562
+ <description>SVR</description>
563
+ <example service.version="9876">m8mo9876</example>
564
+ <param pos="0" name="os.vendor" value="Motorola"/>
565
+ <param pos="0" name="os.family" value="SVR4"/>
566
+ <param pos="0" name="os.product" value="SVR"/>
567
+ <param pos="0" name="service.product" value="VisionFS"/>
568
+ <param pos="1" name="service.version"/>
569
+ </fingerprint>
570
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)o1(\d{4})">
571
+ <description>OSF/1</description>
572
+ <example service.version="9876">m8o19876</example>
573
+ <param pos="0" name="os.vendor" value="DEC"/>
574
+ <param pos="0" name="os.family" value="Digital UNIX"/>
575
+ <param pos="0" name="os.product" value="OSF/1"/>
576
+ <param pos="0" name="service.product" value="VisionFS"/>
577
+ <param pos="1" name="service.version"/>
578
+ </fingerprint>
579
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ro(\d{4})">
580
+ <description>RISC OS</description>
581
+ <example service.version="9876">m8ro9876</example>
582
+ <param pos="0" name="os.family" value="RISC OS"/>
583
+ <param pos="0" name="os.product" value="RISC OS"/>
584
+ <param pos="0" name="service.product" value="VisionFS"/>
585
+ <param pos="1" name="service.version"/>
586
+ </fingerprint>
587
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)sc(\d{4})">
588
+ <description>OpenServer</description>
589
+ <example service.version="9876">m8sc9876</example>
590
+ <param pos="0" name="os.vendor" value="SCO"/>
591
+ <param pos="0" name="os.family" value="OpenServer"/>
592
+ <param pos="0" name="os.product" value="OpenServer"/>
593
+ <param pos="0" name="service.product" value="VisionFS"/>
594
+ <param pos="1" name="service.version"/>
595
+ </fingerprint>
596
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)so(\d{4})">
597
+ <description>SunOS</description>
598
+ <example service.version="9876">m8so9876</example>
599
+ <param pos="0" name="os.vendor" value="Sun"/>
600
+ <param pos="0" name="os.family" value="SunOS"/>
601
+ <param pos="0" name="os.product" value="SunOS"/>
602
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:sunos:-"/>
603
+ <param pos="0" name="service.product" value="VisionFS"/>
604
+ <param pos="1" name="service.version"/>
605
+ </fingerprint>
606
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)su(\d{4})">
607
+ <description>Solaris</description>
608
+ <example service.version="9876">m8su9876</example>
609
+ <param pos="0" name="os.vendor" value="Sun"/>
610
+ <param pos="0" name="os.family" value="Solaris"/>
611
+ <param pos="0" name="os.product" value="Solaris"/>
612
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
613
+ <param pos="0" name="service.product" value="VisionFS"/>
614
+ <param pos="1" name="service.version"/>
615
+ </fingerprint>
616
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)sx(\d{4})">
617
+ <description>SINIX</description>
618
+ <example service.version="9876">m8sx9876</example>
619
+ <param pos="0" name="os.vendor" value="Siemens"/>
620
+ <param pos="0" name="os.family" value="SINIX"/>
621
+ <param pos="0" name="os.product" value="SINIX"/>
622
+ <param pos="0" name="service.product" value="VisionFS"/>
623
+ <param pos="1" name="service.version"/>
624
+ </fingerprint>
625
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)ul(\d{4})">
626
+ <description>Ultrix/1</description>
627
+ <example service.version="9876">m8ul9876</example>
628
+ <param pos="0" name="os.vendor" value="DEC"/>
629
+ <param pos="0" name="os.family" value="Ultrix"/>
630
+ <param pos="0" name="os.product" value="Ultrix"/>
631
+ <param pos="0" name="service.product" value="VisionFS"/>
632
+ <param pos="1" name="service.version"/>
633
+ </fingerprint>
634
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)un(\d{4})">
635
+ <description>UnixWare</description>
636
+ <example service.version="9876">m8un9876</example>
637
+ <param pos="0" name="os.vendor" value="SCO"/>
638
+ <param pos="0" name="os.family" value="UnixWare"/>
639
+ <param pos="0" name="os.product" value="UnixWare"/>
640
+ <param pos="0" name="service.product" value="VisionFS"/>
641
+ <param pos="1" name="service.version"/>
642
+ </fingerprint>
643
+ <fingerprint pattern="^(?:ax|i3|m8|mp|pa|pp|rs|sp)wi(\d{4})">
644
+ <description>Windows</description>
645
+ <example service.version="9876">m8wi9876</example>
646
+ <param pos="0" name="os.vendor" value="Microsoft"/>
647
+ <param pos="0" name="os.family" value="Windows"/>
648
+ <param pos="0" name="os.product" value="Windows"/>
649
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
650
+ <param pos="0" name="service.product" value="VisionFS"/>
651
+ <param pos="1" name="service.version"/>
652
+ </fingerprint>
653
+ <fingerprint pattern="^(?i:unix)$">
654
+ <description>Generally some Samba variant, which reports Unix</description>
655
+ <example>Unix</example>
656
+ <param pos="0" name="os.family" value="Unix"/>
657
+ <param pos="0" name="os.certainty" value="0.75"/>
658
+ <param pos="0" name="service.product" value="Samba"/>
659
+ <param pos="0" name="service.vendor" value="Samba"/>
660
+ <param pos="0" name="service.cpe23" value="cpe:/a:samba:samba:-"/>
661
+ </fingerprint>
662
+ </fingerprints>