recog-intrigue 2.3.7 → 2.3.14

Sign up to get free protection for your applications and to get access to all the features.
Files changed (70) hide show
  1. checksums.yaml +4 -4
  2. data/.github/SECURITY.md +35 -0
  3. data/.gitignore +9 -0
  4. data/CONTRIBUTING.md +136 -37
  5. data/README.md +18 -16
  6. data/bin/recog_cleanup +16 -0
  7. data/bin/recog_standardize +30 -6
  8. data/cpe-remap.yaml +38 -1
  9. data/identifiers/README.md +9 -0
  10. data/identifiers/hw_device.txt +77 -0
  11. data/identifiers/hw_family.txt +96 -0
  12. data/identifiers/hw_product.txt +328 -0
  13. data/identifiers/os_architecture.txt +6 -6
  14. data/identifiers/os_device.txt +45 -3
  15. data/identifiers/os_family.txt +206 -41
  16. data/identifiers/os_product.txt +238 -17
  17. data/identifiers/service_family.txt +144 -57
  18. data/identifiers/service_product.txt +385 -83
  19. data/identifiers/vendor.txt +554 -68
  20. data/lib/recog/version.rb +1 -1
  21. data/requirements.txt +1 -1
  22. data/update_cpes.py +4 -1
  23. data/xml/apache_modules.xml +292 -5
  24. data/xml/apache_os.xml +41 -2
  25. data/xml/architecture.xml +11 -3
  26. data/xml/dns_versionbind.xml +200 -26
  27. data/xml/favicons.xml +1701 -0
  28. data/xml/ftp_banners.xml +256 -23
  29. data/xml/h323_callresp.xml +112 -12
  30. data/xml/hp_pjl_id.xml +47 -5
  31. data/xml/html_title.xml +1156 -70
  32. data/xml/http_cookies.xml +69 -11
  33. data/xml/http_servers.xml +1094 -107
  34. data/xml/http_wwwauth.xml +143 -27
  35. data/xml/imap_banners.xml +62 -13
  36. data/xml/ldap_searchresult.xml +81 -9
  37. data/xml/mdns_device-info_txt.xml +194 -17
  38. data/xml/mdns_workstation_txt.xml +4 -2
  39. data/xml/mysql_banners.xml +233 -40
  40. data/xml/mysql_error.xml +113 -6
  41. data/xml/nntp_banners.xml +10 -2
  42. data/xml/ntp_banners.xml +93 -9
  43. data/xml/operating_system.xml +90 -3
  44. data/xml/pop_banners.xml +87 -33
  45. data/xml/rsh_resp.xml +11 -2
  46. data/xml/rtsp_servers.xml +43 -23
  47. data/xml/sip_banners.xml +6 -11
  48. data/xml/sip_user_agents.xml +29 -2
  49. data/xml/smb_native_lm.xml +10 -2
  50. data/xml/smb_native_os.xml +80 -2
  51. data/xml/smtp_banners.xml +233 -13
  52. data/xml/smtp_debug.xml +6 -4
  53. data/xml/smtp_ehlo.xml +7 -5
  54. data/xml/smtp_expn.xml +13 -4
  55. data/xml/smtp_help.xml +23 -4
  56. data/xml/smtp_mailfrom.xml +5 -2
  57. data/xml/smtp_noop.xml +6 -5
  58. data/xml/smtp_quit.xml +5 -4
  59. data/xml/smtp_rcptto.xml +5 -2
  60. data/xml/smtp_rset.xml +4 -4
  61. data/xml/smtp_turn.xml +4 -4
  62. data/xml/smtp_vrfy.xml +14 -4
  63. data/xml/snmp_sysdescr.xml +741 -32
  64. data/xml/snmp_sysobjid.xml +47 -2
  65. data/xml/ssh_banners.xml +255 -81
  66. data/xml/telnet_banners.xml +503 -30
  67. data/xml/x11_banners.xml +26 -3
  68. data/xml/x509_issuers.xml +37 -13
  69. data/xml/x509_subjects.xml +214 -52
  70. metadata +12 -5
data/xml/http_wwwauth.xml CHANGED
@@ -1,6 +1,7 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="http_header.wwwauth" protocol="http" database_type="service" preference="0.85">
3
3
  <!-- HTTP WWW-Authenticate headers are matched against these patterns to fingerprint HTTP servers. -->
4
+
4
5
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;access&quot;$">
5
6
  <description>Cisco IOS 11.x</description>
6
7
  <example>Basic realm="access"</example>
@@ -18,6 +19,7 @@
18
19
  <param pos="0" name="hw.vendor" value="Cisco"/>
19
20
  <param pos="0" name="hw.device" value="Router"/>
20
21
  </fingerprint>
22
+
21
23
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]15[ _]or[ _]view[ _]access&quot;$">
22
24
  <description>Cisco IOS 12.x - view access variant</description>
23
25
  <example>Basic realm="level_15 or view_access"</example>
@@ -36,6 +38,7 @@
36
38
  <param pos="0" name="hw.vendor" value="Cisco"/>
37
39
  <param pos="0" name="hw.device" value="Router"/>
38
40
  </fingerprint>
41
+
39
42
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]\d\d?[ _]access&quot;$">
40
43
  <description>Cisco IOS 12.x</description>
41
44
  <example>Basic realm="level_15_access"</example>
@@ -54,9 +57,10 @@
54
57
  <param pos="0" name="hw.vendor" value="Cisco"/>
55
58
  <param pos="0" name="hw.device" value="Router"/>
56
59
  </fingerprint>
60
+
57
61
  <fingerprint pattern="^Basic realm=&quot;(NetVanta [^&quot;]+)&quot;$" certainty="1.0">
58
62
  <description>ADTRAN Netvanta Router</description>
59
- <example hw.product="NetVanta 1238 PoE">Basic realm=&quot;NetVanta 1238 PoE&quot;</example>
63
+ <example hw.product="NetVanta 1238 PoE">Basic realm="NetVanta 1238 PoE"</example>
60
64
  <param pos="0" name="os.device" value="Router"/>
61
65
  <param pos="0" name="os.vendor" value="ADTRAN"/>
62
66
  <param pos="0" name="os.family" value="NetVanta"/>
@@ -65,11 +69,13 @@
65
69
  <param pos="0" name="hw.family" value="NetVanta"/>
66
70
  <param pos="1" name="hw.product"/>
67
71
  </fingerprint>
72
+
68
73
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;.*$">
69
74
  <description>Generic Cisco CWMP/CPE equipment</description>
70
75
  <example>Basic realm="Cisco_CCSP_CWMP_TCPCR"</example>
71
76
  <param pos="0" name="hw.vendor" value="Cisco"/>
72
77
  </fingerprint>
78
+
73
79
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;FW-1. Reason: no user Server &quot;$">
74
80
  <description>Check Point FireWall-1</description>
75
81
  <example>Basic realm="FW-1. Reason: no user Server "</example>
@@ -82,12 +88,15 @@
82
88
  <param pos="0" name="os.family" value="Firewall-1"/>
83
89
  <param pos="0" name="os.product" value="Firewall-1"/>
84
90
  </fingerprint>
91
+
85
92
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;.*">
86
93
  <description>cPanel</description>
87
94
  <example>Basic realm="cPanel"</example>
88
95
  <param pos="0" name="service.vendor" value="cPanel"/>
89
96
  <param pos="0" name="service.product" value="cPanel"/>
97
+ <param pos="0" name="service.cpe23" value="cpe:/a:cpanel:cpanel:-"/>
90
98
  </fingerprint>
99
+
91
100
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;APC Management Card&quot;$">
92
101
  <description>APC device</description>
93
102
  <example>Basic realm="APC Management Card"</example>
@@ -96,6 +105,7 @@
96
105
  <param pos="0" name="os.vendor" value="APC"/>
97
106
  <param pos="0" name="os.device" value="Power device"/>
98
107
  </fingerprint>
108
+
99
109
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
100
110
  <description>Generic ADSL modems/routers</description>
101
111
  <example>Basic realm="ADSL Modem"</example>
@@ -104,22 +114,27 @@
104
114
  <example>Basic realm="ADSL2+ Router"</example>
105
115
  <param pos="0" name="hw.device" value="ADSL Modem"/>
106
116
  </fingerprint>
117
+
107
118
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;.*$">
108
119
  <description>Generic Broadband modems/routers</description>
109
120
  <example>Basic realm="Broadband Router"</example>
110
121
  <param pos="0" name="hw.device" value="Broadband router"/>
111
122
  </fingerprint>
123
+
112
124
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
113
125
  <description>Generic DSL modems/routers</description>
114
126
  <example>Basic realm="DSL Modem"</example>
115
127
  <param pos="0" name="hw.device" value="DSL Modem"/>
116
128
  </fingerprint>
129
+
117
130
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;.*$">
118
131
  <description>Generic DVR</description>
119
132
  <example>Basic realm="DVR"</example>
120
133
  <param pos="0" name="hw.device" value="DVR"/>
121
134
  </fingerprint>
135
+
122
136
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
137
+
123
138
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;.*$">
124
139
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
125
140
  <example>Basic realm="hikvision"</example>
@@ -127,19 +142,23 @@
127
142
  <param pos="0" name="service.product" value="Hikvision Web Server"/>
128
143
  <param pos="0" name="os.vendor" value="Hikvision"/>
129
144
  <param pos="0" name="os.device" value="DVR"/>
145
+ <param pos="0" name="hw.vendor" value="Hikvision"/>
130
146
  <param pos="0" name="hw.device" value="DVR"/>
131
147
  </fingerprint>
148
+
132
149
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;.*$">
133
150
  <description>Merit LILIN generic device</description>
134
151
  <example>Basic realm="Merit LILIN Ent. Co., Ltd,"</example>
135
152
  <example>Basic realm="Merit LILIN Ent. Co., Ltd."</example>
136
153
  <param pos="0" name="hw.vendor" value="Merit LILIN"/>
137
154
  </fingerprint>
155
+
138
156
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;.*$">
139
157
  <description>Generic WAP</description>
140
158
  <example>Basic realm="Wireless Access Point"</example>
141
159
  <param pos="0" name="hw.device" value="WAP"/>
142
160
  </fingerprint>
161
+
143
162
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;.*$">
144
163
  <description>Generic IP Cameras</description>
145
164
  <example>Basic realm="camera"</example>
@@ -147,6 +166,7 @@
147
166
  <example>Basic realm="Mini Dome IP Camera"</example>
148
167
  <param pos="0" name="hw.device" value="Web cam"/>
149
168
  </fingerprint>
169
+
150
170
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
151
171
  <description>D-Link DCS IP Cameras</description>
152
172
  <example hw.product="DCS-5222LB1">Basic realm="DCS-5222LB1"</example>
@@ -155,6 +175,7 @@
155
175
  <param pos="0" name="hw.device" value="Web cam"/>
156
176
  <param pos="1" name="hw.product"/>
157
177
  </fingerprint>
178
+
158
179
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
159
180
  <description>GoAhead webserver</description>
160
181
  <example>Basic realm="GoAhead"</example>
@@ -162,25 +183,19 @@
162
183
  <param pos="0" name="service.product" value="GoAhead Webserver"/>
163
184
  <param pos="0" name="service.family" value="GoAhead Webserver"/>
164
185
  </fingerprint>
186
+
165
187
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
166
188
  <description>Kubernetes master nodes</description>
167
189
  <example>Basic realm="kubernetes-master"</example>
168
190
  <param pos="0" name="service.vendor" value="Kubernetes"/>
169
191
  </fingerprint>
170
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
171
- <description>Netgear Orbi</description>
172
- <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
173
- <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
174
- <param pos="0" name="hw.vendor" value="Netgear"/>
175
- <param pos="0" name="hw.device" value="WAP"/>
176
- <param pos="0" name="hw.family" value="Orbi"/>
177
- <param pos="1" name="hw.product"/>
178
- </fingerprint>
192
+
179
193
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
180
194
  <description>Ruijie Networks generic</description>
181
195
  <example>Digest realm="RUIJIE-CPE"</example>
182
196
  <param pos="0" name="hw.vendor" value="Ruijie"/>
183
197
  </fingerprint>
198
+
184
199
  <fingerprint pattern="^Basic realm=&quot;SpeedTouch&quot;$">
185
200
  <description>Thomson SpeedTouch xDSL router - short variant</description>
186
201
  <example>Basic realm="SpeedTouch"</example>
@@ -194,6 +209,7 @@
194
209
  <param pos="0" name="hw.family" value="SpeedTouch"/>
195
210
  <param pos="0" name="hw.device" value="Broadband router"/>
196
211
  </fingerprint>
212
+
197
213
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch \(([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2})\)&quot;$">
198
214
  <description>Thomson SpeedTouch xDSL router</description>
199
215
  <example host.mac="00-90-D0-F9-91-52">Basic realm="SpeedTouch (00-90-D0-F9-91-52)"</example>
@@ -209,10 +225,12 @@
209
225
  <param pos="0" name="hw.device" value="Broadband router"/>
210
226
  <param pos="1" name="host.mac"/>
211
227
  </fingerprint>
228
+
212
229
  <!--
213
230
  Really need some examples for the fingerprints below. The regex and params
214
231
  imply that the nonce inlcudes the MAC address.
215
232
  -->
233
+
216
234
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
217
235
  <description>Thomson SpeedTouch xDSL router - qop variant</description>
218
236
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -227,6 +245,7 @@
227
245
  <param pos="0" name="hw.device" value="Broadband router"/>
228
246
  <param pos="1" name="host.mac"/>
229
247
  </fingerprint>
248
+
230
249
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ST (\d+) R 5.x Telecom Italia&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
231
250
  <description>Thomson SpeedTouch xDSL router - Telecom Italia</description>
232
251
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -241,6 +260,7 @@
241
260
  <param pos="1" name="os.product"/>
242
261
  <param pos="2" name="host.mac"/>
243
262
  </fingerprint>
263
+
244
264
  <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;.*$">
245
265
  <description>Thomson generic devices</description>
246
266
  <example>Digest realm="Thomson Gateway"</example>
@@ -248,6 +268,7 @@
248
268
  <param pos="0" name="hw.vendor" value="Thomson"/>
249
269
  <param pos="0" name="hw.device" value="Broadband router"/>
250
270
  </fingerprint>
271
+
251
272
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
252
273
  <description>Huawei xDSL routers</description>
253
274
  <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
@@ -263,6 +284,7 @@
263
284
  <param pos="0" name="hw.family" value="MT"/>
264
285
  <param pos="1" name="hw.product"/>
265
286
  </fingerprint>
287
+
266
288
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;.*$">
267
289
  <description>Huawei Home Gateway Routers</description>
268
290
  <example>Basic realm="HuaweiHomeGateway"</example>
@@ -270,6 +292,7 @@
270
292
  <param pos="0" name="hw.device" value="Broadband router"/>
271
293
  <param pos="0" name="hw.product" value="Home Gateway"/>
272
294
  </fingerprint>
295
+
273
296
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;.*$">
274
297
  <description>Huawei EchoLife Home Gateways</description>
275
298
  <example>Basic realm="EchoLife Portal de Inicio"</example>
@@ -278,6 +301,7 @@
278
301
  <param pos="0" name="hw.device" value="Broadband router"/>
279
302
  <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
280
303
  </fingerprint>
304
+
281
305
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
282
306
  <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
283
307
  <example hw.product="WRT54G">Basic realm="WRT54G"</example>
@@ -291,6 +315,7 @@
291
315
  <param pos="0" name="hw.device" value="WAP"/>
292
316
  <param pos="1" name="hw.product"/>
293
317
  </fingerprint>
318
+
294
319
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
295
320
  <description>TP-LINK SoHo Router - dash variant</description>
296
321
  <example>Basic realm="TD-W8901G"</example>
@@ -300,6 +325,7 @@
300
325
  <param pos="0" name="os.device" value="Router"/>
301
326
  <param pos="1" name="os.product"/>
302
327
  </fingerprint>
328
+
303
329
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
304
330
  <description>TP-LINK SoHo Router</description>
305
331
  <example>Basic realm="TD854W"</example>
@@ -310,6 +336,7 @@
310
336
  <param pos="0" name="os.device" value="Router"/>
311
337
  <param pos="1" name="os.product"/>
312
338
  </fingerprint>
339
+
313
340
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
314
341
  <description>TP-LINK SoHo Router - verbose variant</description>
315
342
  <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
@@ -332,27 +359,31 @@
332
359
  <param pos="0" name="os.device" value="WAP"/>
333
360
  <param pos="1" name="os.product"/>
334
361
  </fingerprint>
362
+
335
363
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
336
364
  <description>TP-LINK Routers</description>
337
365
  <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
338
366
  <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
339
367
  <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
340
- <param pos="0" name="hw.vendor" value="TP-Link"/>
368
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
341
369
  <param pos="0" name="hw.device" value="Router"/>
342
370
  <param pos="1" name="hw.product"/>
343
371
  </fingerprint>
372
+
344
373
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;.*$">
345
374
  <description>TP-LINK IP-Cameras</description>
346
375
  <example>Basic realm="TP-LINK IP-Camera"</example>
347
- <param pos="0" name="hw.vendor" value="TP-Link"/>
376
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
348
377
  <param pos="0" name="hw.device" value="Web cam"/>
349
378
  </fingerprint>
379
+
350
380
  <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
351
381
  <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>
352
382
  <example>Digest qop="auth", realm="Broadcom Management Service", nonce="AAAAAAAAAAAAAP//DwHpMwYy1zc=", algorithm="MD5"</example>
353
383
  <param pos="0" name="service.vendor" value="Broadcom"/>
354
384
  <param pos="0" name="service.product" value="Management Service"/>
355
385
  </fingerprint>
386
+
356
387
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;.*$">
357
388
  <description>Samba Web Administration Tool (SWAT)</description>
358
389
  <example>Basic realm="SWAT"</example>
@@ -360,6 +391,7 @@
360
391
  <param pos="0" name="service.family" value="Samba"/>
361
392
  <param pos="0" name="service.product" value="SWAT"/>
362
393
  </fingerprint>
394
+
363
395
  <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
364
396
  <description>SPIP publishing system (www.spip.net)</description>
365
397
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
@@ -367,6 +399,7 @@
367
399
  <param pos="0" name="service.product" value="SPIP"/>
368
400
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
369
401
  </fingerprint>
402
+
370
403
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
371
404
  <description>HP Instant Support Enterprise Edition with a hostname</description>
372
405
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
@@ -374,6 +407,7 @@
374
407
  <param pos="0" name="service.product" value="ISEE"/>
375
408
  <param pos="1" name="host.name"/>
376
409
  </fingerprint>
410
+
377
411
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
378
412
  <description>Generic F5 Big-IP</description>
379
413
  <example>Basic realm="BIG-IP"</example>
@@ -382,7 +416,9 @@
382
416
  <param pos="0" name="service.product" value="BIG-IP LTM"/>
383
417
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
384
418
  </fingerprint>
419
+
385
420
  <!-- HP ProCurve -->
421
+
386
422
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[3]\d{3}A)&quot;$">
387
423
  <description>HP ProCurve Hubs</description>
388
424
  <example os.product="J3295A">Basic realm="HP J3295A"</example>
@@ -391,6 +427,7 @@
391
427
  <param pos="0" name="os.device" value="Hub"/>
392
428
  <param pos="1" name="os.product"/>
393
429
  </fingerprint>
430
+
394
431
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[489]\d{3}A)&quot;$">
395
432
  <description>HP ProCurve Switches</description>
396
433
  <example os.product="J4110A">Basic realm="HP J4110A"</example>
@@ -402,11 +439,13 @@
402
439
  <param pos="0" name="os.device" value="Switch"/>
403
440
  <param pos="1" name="os.product"/>
404
441
  </fingerprint>
442
+
405
443
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;.*$">
406
444
  <description>Assorted Sercomm CPE devices</description>
407
445
  <example>Digest realm="SERCOMM CPE Authentication"</example>
408
446
  <param pos="0" name="hw.vendor" value="Sercomm"/>
409
447
  </fingerprint>
448
+
410
449
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;.*$">
411
450
  <description>Tivo DVR</description>
412
451
  <example>Digest realm="TiVo DVR"</example>
@@ -414,12 +453,14 @@
414
453
  <param pos="0" name="hw.family" value="DVR"/>
415
454
  <param pos="0" name="hw.device" value="DVR"/>
416
455
  </fingerprint>
456
+
417
457
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;.*$">
418
458
  <description>Ubee Cable Modems</description>
419
459
  <example>Digest qop="auth", realm="Ubee", nonce="1544738973"</example>
420
460
  <param pos="0" name="hw.vendor" value="Ubee"/>
421
461
  <param pos="0" name="hw.device" value="Broadband router"/>
422
462
  </fingerprint>
463
+
423
464
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;XDB&quot;$">
424
465
  <description>Web server providing web services for Oracle's XML DB.</description>
425
466
  <example>Basic realm="XDB"</example>
@@ -427,11 +468,13 @@
427
468
  <param pos="0" name="service.product" value="XML DB"/>
428
469
  <param pos="0" name="service.family" value="Oracle"/>
429
470
  </fingerprint>
471
+
430
472
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;.*$">
431
473
  <description>Assorted ZTE CPE devices</description>
432
474
  <example>Digest realm="cpe@zte.com"</example>
433
475
  <param pos="0" name="hw.vendor" value="ZTE"/>
434
476
  </fingerprint>
477
+
435
478
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;.*$">
436
479
  <description>ZTE ZXHN router</description>
437
480
  <example>Basic realm="ZXHN H108L"</example>
@@ -440,6 +483,7 @@
440
483
  <param pos="0" name="hw.family" value="ZXHN"/>
441
484
  <param pos="1" name="hw.product"/>
442
485
  </fingerprint>
486
+
443
487
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;.*$">
444
488
  <description>ZTE ZXV router</description>
445
489
  <example hw.product="ZXV10 W300">Basic realm="ZXV10 W300"</example>
@@ -448,20 +492,98 @@
448
492
  <param pos="0" name="hw.family" value="ZXV"/>
449
493
  <param pos="1" name="hw.product"/>
450
494
  </fingerprint>
495
+
496
+ <fingerprint pattern="(?i)^(?:Basic|Digest)\s+realm=&quot;Siqura&quot;$">
497
+ <description>Siqura Video Encoder</description>
498
+ <example>Basic realm="Siqura"</example>
499
+ <param pos="0" name="os.vendor" value="Siqura"/>
500
+ <param pos="0" name="os.family" value="Linux"/>
501
+ <param pos="0" name="hw.vendor" value="Siqura"/>
502
+ <param pos="0" name="hw.device" value="Video Encoder"/>
503
+ </fingerprint>
504
+
505
+ <fingerprint pattern="^Digest realm=&quot;(Orbit-351)&quot;">
506
+ <description>Steinsvik Orbit 351 IP Camera (Truen TCAM Rebrand)</description>
507
+ <example hw.product="Orbit-351">Digest realm="Orbit-351", nonce="0000040dY892418598785d2a2304a74adf22f6098f2792", stale=FALSE</example>
508
+ <param pos="0" name="hw.vendor" value="Steinsvik"/>
509
+ <param pos="0" name="hw.device" value="Web cam"/>
510
+ <param pos="1" name="hw.product"/>
511
+ <param pos="0" name="os.vendor" value="Steinsvik"/>
512
+ <param pos="0" name="os.family" value="Linux"/>
513
+ <param pos="0" name="os.product" value="Linux"/>
514
+ </fingerprint>
515
+
516
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
517
+ <description>Netgear Orbi</description>
518
+ <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
519
+ <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
520
+ <example hw.product="Orbi-mini">Basic realm="NETGEAR Orbi-mini"</example>
521
+ <param pos="0" name="hw.vendor" value="Netgear"/>
522
+ <param pos="0" name="hw.device" value="WAP"/>
523
+ <param pos="0" name="hw.family" value="Orbi"/>
524
+ <param pos="1" name="hw.product"/>
525
+ </fingerprint>
526
+
527
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;.*$">
528
+ <description>Netgear Routers</description>
529
+ <example hw.product="DG834">Basic realm="NETGEAR DG834 "</example>
530
+ <example hw.product="C7000v2">Basic realm="NETGEAR C7000v2"</example>
531
+ <example hw.product="R7000P">Basic realm="NETGEAR R7000P"</example>
532
+ <param pos="0" name="hw.vendor" value="Netgear"/>
533
+ <param pos="0" name="hw.device" value="Router"/>
534
+ <param pos="1" name="hw.product"/>
535
+ </fingerprint>
536
+
537
+ <!-- Fallback to the most generic Netgear match -->
538
+
539
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;.*$">
540
+ <description>Netgear Unspecified Router</description>
541
+ <example>Basic realm="Netgear"</example>
542
+ <param pos="0" name="hw.vendor" value="Netgear"/>
543
+ <param pos="0" name="hw.device" value="Router"/>
544
+ </fingerprint>
545
+
546
+ <!-- This fingerprint is suspect, as it's missing the Basic/Digest qualifier -->
547
+
548
+ <fingerprint pattern="^(?:NETGEAR|NetGear) Router ([a-zA-Z0-9\-\+]+)$">
549
+ <description>Netgear Routers w/o Authentication Type</description>
550
+ <example hw.product="WNR2000v4">NETGEAR Router WNR2000v4</example>
551
+ <example hw.product="R6100">NETGEAR Router R6100</example>
552
+ <param pos="0" name="hw.vendor" value="Netgear"/>
553
+ <param pos="0" name="hw.device" value="Router"/>
554
+ <param pos="1" name="hw.product"/>
555
+ </fingerprint>
556
+
557
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
558
+ <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
559
+ <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
560
+ <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
561
+ <param pos="0" name="service.product" value="RemoteView"/>
562
+ <param pos="0" name="service.family" value="RemoteView"/>
563
+ <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
564
+ <param pos="0" name="hw.family" value="Primergy"/>
565
+ <param pos="0" name="hw.product" value="Primergy"/>
566
+ <param pos="1" name="host.name"/>
567
+ </fingerprint>
568
+
451
569
  <!-- a variety of headers we currently just ignore -->
570
+
452
571
  <fingerprint pattern="(?i)^NTLM$">
453
572
  <description>Ignore NTLM-only</description>
454
573
  <example>NTLM</example>
455
574
  <example>Ntlm</example>
456
575
  </fingerprint>
576
+
457
577
  <fingerprint pattern="^Negotiate$">
458
578
  <description>Ignore Negotiate-only</description>
459
579
  <example>Negotiate</example>
460
580
  </fingerprint>
581
+
461
582
  <!--
462
583
  Using a wildcard . instead of ['&quot;] in the following line will result in
463
584
  this fingerprint matching examples from other fingerprints.
464
585
  -->
586
+
465
587
  <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
466
588
  <description>Ignore null/empty/period/index.</description>
467
589
  <example>Basic realm="null"</example>
@@ -471,37 +593,30 @@
471
593
  <example>Basic realm='/'</example>
472
594
  <example>Basic realm="index.html"</example>
473
595
  </fingerprint>
596
+
474
597
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;.*$">
475
598
  <description>Ignore realms with an IPv4 address</description>
476
599
  <example>Basic realm="192.168.0.1"</example>
477
600
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
478
601
  </fingerprint>
602
+
479
603
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;.*$">
480
604
  <description>Ignore generic 'config' realms</description>
481
605
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
482
606
  </fingerprint>
483
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
484
- <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
485
- <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
486
- <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
487
- <param pos="0" name="service.product" value="RemoteView"/>
488
- <param pos="0" name="service.family" value="RemoteView"/>
489
- <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
490
- <param pos="0" name="hw.family" value="Primergy"/>
491
- <param pos="0" name="hw.product" value="Primergy"/>
492
- <param pos="1" name="host.name"/>
493
- </fingerprint>
607
+
494
608
  <!--
495
609
  Temporarily disable this version-less fingerprint because it overrode the
496
610
  one in http_servers.xml (see NEX-1255).
497
-
498
611
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Lyris ListManager: enter email address and password&quot;$">
499
612
  <description>Lyris ListManager</description>
500
613
  <example>Basic realm="Lyris ListManager: enter email address and password"</example>
501
614
  <param pos="0" name="service.vendor" value="Lyris"/>
502
615
  <param pos="0" name="service.product" value="ListManager"/>
503
616
  </fingerprint>
617
+
504
618
  -->
619
+
505
620
  <!--
506
621
  Basic realm= StarVoice
507
622
  Basic realm="802.11g Remote-Motion CCD Network Camera"
@@ -549,7 +664,6 @@ Basic realm="Login to Vigor 3300"
549
664
  Basic realm="Login"
550
665
  Basic realm="MR314"
551
666
  Basic realm="NetComm NB1300"
552
- Basic realm="NETGEAR DG834 "
553
667
  Basic realm="NetLinx"
554
668
  Basic realm="Netopia-2000"
555
669
  Basic realm="Netopia-3000"
@@ -589,7 +703,9 @@ Digest realm="HiPER", domain="222.66.99.209", qop="auth", nonce="aa81b6584c4716f
589
703
  Digest realm="i3micro VRG", nonce="1186428394", qop="auth", algorithm=MD5
590
704
  Digest realm="WatchGuard SOHO Configuration",qop="auth",nonce="7c8e98007db668881687bd538e6e8581"
591
705
  -->
706
+
592
707
  <!-- This is in various PHP coding examples, but is not a reliable FP source:
593
708
  Basic realm="User Login"
594
709
  -->
595
- </fingerprints>
710
+
711
+ </fingerprints>