recog-intrigue 2.3.7 → 2.3.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (70) hide show
  1. checksums.yaml +4 -4
  2. data/.github/SECURITY.md +35 -0
  3. data/.gitignore +9 -0
  4. data/CONTRIBUTING.md +136 -37
  5. data/README.md +18 -16
  6. data/bin/recog_cleanup +16 -0
  7. data/bin/recog_standardize +30 -6
  8. data/cpe-remap.yaml +38 -1
  9. data/identifiers/README.md +9 -0
  10. data/identifiers/hw_device.txt +77 -0
  11. data/identifiers/hw_family.txt +96 -0
  12. data/identifiers/hw_product.txt +328 -0
  13. data/identifiers/os_architecture.txt +6 -6
  14. data/identifiers/os_device.txt +45 -3
  15. data/identifiers/os_family.txt +206 -41
  16. data/identifiers/os_product.txt +238 -17
  17. data/identifiers/service_family.txt +144 -57
  18. data/identifiers/service_product.txt +385 -83
  19. data/identifiers/vendor.txt +554 -68
  20. data/lib/recog/version.rb +1 -1
  21. data/requirements.txt +1 -1
  22. data/update_cpes.py +4 -1
  23. data/xml/apache_modules.xml +292 -5
  24. data/xml/apache_os.xml +41 -2
  25. data/xml/architecture.xml +11 -3
  26. data/xml/dns_versionbind.xml +200 -26
  27. data/xml/favicons.xml +1701 -0
  28. data/xml/ftp_banners.xml +256 -23
  29. data/xml/h323_callresp.xml +112 -12
  30. data/xml/hp_pjl_id.xml +47 -5
  31. data/xml/html_title.xml +1156 -70
  32. data/xml/http_cookies.xml +69 -11
  33. data/xml/http_servers.xml +1094 -107
  34. data/xml/http_wwwauth.xml +143 -27
  35. data/xml/imap_banners.xml +62 -13
  36. data/xml/ldap_searchresult.xml +81 -9
  37. data/xml/mdns_device-info_txt.xml +194 -17
  38. data/xml/mdns_workstation_txt.xml +4 -2
  39. data/xml/mysql_banners.xml +233 -40
  40. data/xml/mysql_error.xml +113 -6
  41. data/xml/nntp_banners.xml +10 -2
  42. data/xml/ntp_banners.xml +93 -9
  43. data/xml/operating_system.xml +90 -3
  44. data/xml/pop_banners.xml +87 -33
  45. data/xml/rsh_resp.xml +11 -2
  46. data/xml/rtsp_servers.xml +43 -23
  47. data/xml/sip_banners.xml +6 -11
  48. data/xml/sip_user_agents.xml +29 -2
  49. data/xml/smb_native_lm.xml +10 -2
  50. data/xml/smb_native_os.xml +80 -2
  51. data/xml/smtp_banners.xml +233 -13
  52. data/xml/smtp_debug.xml +6 -4
  53. data/xml/smtp_ehlo.xml +7 -5
  54. data/xml/smtp_expn.xml +13 -4
  55. data/xml/smtp_help.xml +23 -4
  56. data/xml/smtp_mailfrom.xml +5 -2
  57. data/xml/smtp_noop.xml +6 -5
  58. data/xml/smtp_quit.xml +5 -4
  59. data/xml/smtp_rcptto.xml +5 -2
  60. data/xml/smtp_rset.xml +4 -4
  61. data/xml/smtp_turn.xml +4 -4
  62. data/xml/smtp_vrfy.xml +14 -4
  63. data/xml/snmp_sysdescr.xml +741 -32
  64. data/xml/snmp_sysobjid.xml +47 -2
  65. data/xml/ssh_banners.xml +255 -81
  66. data/xml/telnet_banners.xml +503 -30
  67. data/xml/x11_banners.xml +26 -3
  68. data/xml/x509_issuers.xml +37 -13
  69. data/xml/x509_subjects.xml +214 -52
  70. metadata +12 -5
data/xml/http_wwwauth.xml CHANGED
@@ -1,6 +1,7 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="http_header.wwwauth" protocol="http" database_type="service" preference="0.85">
3
3
  <!-- HTTP WWW-Authenticate headers are matched against these patterns to fingerprint HTTP servers. -->
4
+
4
5
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;access&quot;$">
5
6
  <description>Cisco IOS 11.x</description>
6
7
  <example>Basic realm="access"</example>
@@ -18,6 +19,7 @@
18
19
  <param pos="0" name="hw.vendor" value="Cisco"/>
19
20
  <param pos="0" name="hw.device" value="Router"/>
20
21
  </fingerprint>
22
+
21
23
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]15[ _]or[ _]view[ _]access&quot;$">
22
24
  <description>Cisco IOS 12.x - view access variant</description>
23
25
  <example>Basic realm="level_15 or view_access"</example>
@@ -36,6 +38,7 @@
36
38
  <param pos="0" name="hw.vendor" value="Cisco"/>
37
39
  <param pos="0" name="hw.device" value="Router"/>
38
40
  </fingerprint>
41
+
39
42
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]\d\d?[ _]access&quot;$">
40
43
  <description>Cisco IOS 12.x</description>
41
44
  <example>Basic realm="level_15_access"</example>
@@ -54,9 +57,10 @@
54
57
  <param pos="0" name="hw.vendor" value="Cisco"/>
55
58
  <param pos="0" name="hw.device" value="Router"/>
56
59
  </fingerprint>
60
+
57
61
  <fingerprint pattern="^Basic realm=&quot;(NetVanta [^&quot;]+)&quot;$" certainty="1.0">
58
62
  <description>ADTRAN Netvanta Router</description>
59
- <example hw.product="NetVanta 1238 PoE">Basic realm=&quot;NetVanta 1238 PoE&quot;</example>
63
+ <example hw.product="NetVanta 1238 PoE">Basic realm="NetVanta 1238 PoE"</example>
60
64
  <param pos="0" name="os.device" value="Router"/>
61
65
  <param pos="0" name="os.vendor" value="ADTRAN"/>
62
66
  <param pos="0" name="os.family" value="NetVanta"/>
@@ -65,11 +69,13 @@
65
69
  <param pos="0" name="hw.family" value="NetVanta"/>
66
70
  <param pos="1" name="hw.product"/>
67
71
  </fingerprint>
72
+
68
73
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;.*$">
69
74
  <description>Generic Cisco CWMP/CPE equipment</description>
70
75
  <example>Basic realm="Cisco_CCSP_CWMP_TCPCR"</example>
71
76
  <param pos="0" name="hw.vendor" value="Cisco"/>
72
77
  </fingerprint>
78
+
73
79
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;FW-1. Reason: no user Server &quot;$">
74
80
  <description>Check Point FireWall-1</description>
75
81
  <example>Basic realm="FW-1. Reason: no user Server "</example>
@@ -82,12 +88,15 @@
82
88
  <param pos="0" name="os.family" value="Firewall-1"/>
83
89
  <param pos="0" name="os.product" value="Firewall-1"/>
84
90
  </fingerprint>
91
+
85
92
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;.*">
86
93
  <description>cPanel</description>
87
94
  <example>Basic realm="cPanel"</example>
88
95
  <param pos="0" name="service.vendor" value="cPanel"/>
89
96
  <param pos="0" name="service.product" value="cPanel"/>
97
+ <param pos="0" name="service.cpe23" value="cpe:/a:cpanel:cpanel:-"/>
90
98
  </fingerprint>
99
+
91
100
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;APC Management Card&quot;$">
92
101
  <description>APC device</description>
93
102
  <example>Basic realm="APC Management Card"</example>
@@ -96,6 +105,7 @@
96
105
  <param pos="0" name="os.vendor" value="APC"/>
97
106
  <param pos="0" name="os.device" value="Power device"/>
98
107
  </fingerprint>
108
+
99
109
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
100
110
  <description>Generic ADSL modems/routers</description>
101
111
  <example>Basic realm="ADSL Modem"</example>
@@ -104,22 +114,27 @@
104
114
  <example>Basic realm="ADSL2+ Router"</example>
105
115
  <param pos="0" name="hw.device" value="ADSL Modem"/>
106
116
  </fingerprint>
117
+
107
118
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;.*$">
108
119
  <description>Generic Broadband modems/routers</description>
109
120
  <example>Basic realm="Broadband Router"</example>
110
121
  <param pos="0" name="hw.device" value="Broadband router"/>
111
122
  </fingerprint>
123
+
112
124
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
113
125
  <description>Generic DSL modems/routers</description>
114
126
  <example>Basic realm="DSL Modem"</example>
115
127
  <param pos="0" name="hw.device" value="DSL Modem"/>
116
128
  </fingerprint>
129
+
117
130
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;.*$">
118
131
  <description>Generic DVR</description>
119
132
  <example>Basic realm="DVR"</example>
120
133
  <param pos="0" name="hw.device" value="DVR"/>
121
134
  </fingerprint>
135
+
122
136
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
137
+
123
138
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;.*$">
124
139
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
125
140
  <example>Basic realm="hikvision"</example>
@@ -127,19 +142,23 @@
127
142
  <param pos="0" name="service.product" value="Hikvision Web Server"/>
128
143
  <param pos="0" name="os.vendor" value="Hikvision"/>
129
144
  <param pos="0" name="os.device" value="DVR"/>
145
+ <param pos="0" name="hw.vendor" value="Hikvision"/>
130
146
  <param pos="0" name="hw.device" value="DVR"/>
131
147
  </fingerprint>
148
+
132
149
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;.*$">
133
150
  <description>Merit LILIN generic device</description>
134
151
  <example>Basic realm="Merit LILIN Ent. Co., Ltd,"</example>
135
152
  <example>Basic realm="Merit LILIN Ent. Co., Ltd."</example>
136
153
  <param pos="0" name="hw.vendor" value="Merit LILIN"/>
137
154
  </fingerprint>
155
+
138
156
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;.*$">
139
157
  <description>Generic WAP</description>
140
158
  <example>Basic realm="Wireless Access Point"</example>
141
159
  <param pos="0" name="hw.device" value="WAP"/>
142
160
  </fingerprint>
161
+
143
162
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;.*$">
144
163
  <description>Generic IP Cameras</description>
145
164
  <example>Basic realm="camera"</example>
@@ -147,6 +166,7 @@
147
166
  <example>Basic realm="Mini Dome IP Camera"</example>
148
167
  <param pos="0" name="hw.device" value="Web cam"/>
149
168
  </fingerprint>
169
+
150
170
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
151
171
  <description>D-Link DCS IP Cameras</description>
152
172
  <example hw.product="DCS-5222LB1">Basic realm="DCS-5222LB1"</example>
@@ -155,6 +175,7 @@
155
175
  <param pos="0" name="hw.device" value="Web cam"/>
156
176
  <param pos="1" name="hw.product"/>
157
177
  </fingerprint>
178
+
158
179
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
159
180
  <description>GoAhead webserver</description>
160
181
  <example>Basic realm="GoAhead"</example>
@@ -162,25 +183,19 @@
162
183
  <param pos="0" name="service.product" value="GoAhead Webserver"/>
163
184
  <param pos="0" name="service.family" value="GoAhead Webserver"/>
164
185
  </fingerprint>
186
+
165
187
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
166
188
  <description>Kubernetes master nodes</description>
167
189
  <example>Basic realm="kubernetes-master"</example>
168
190
  <param pos="0" name="service.vendor" value="Kubernetes"/>
169
191
  </fingerprint>
170
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
171
- <description>Netgear Orbi</description>
172
- <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
173
- <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
174
- <param pos="0" name="hw.vendor" value="Netgear"/>
175
- <param pos="0" name="hw.device" value="WAP"/>
176
- <param pos="0" name="hw.family" value="Orbi"/>
177
- <param pos="1" name="hw.product"/>
178
- </fingerprint>
192
+
179
193
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
180
194
  <description>Ruijie Networks generic</description>
181
195
  <example>Digest realm="RUIJIE-CPE"</example>
182
196
  <param pos="0" name="hw.vendor" value="Ruijie"/>
183
197
  </fingerprint>
198
+
184
199
  <fingerprint pattern="^Basic realm=&quot;SpeedTouch&quot;$">
185
200
  <description>Thomson SpeedTouch xDSL router - short variant</description>
186
201
  <example>Basic realm="SpeedTouch"</example>
@@ -194,6 +209,7 @@
194
209
  <param pos="0" name="hw.family" value="SpeedTouch"/>
195
210
  <param pos="0" name="hw.device" value="Broadband router"/>
196
211
  </fingerprint>
212
+
197
213
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch \(([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2})\)&quot;$">
198
214
  <description>Thomson SpeedTouch xDSL router</description>
199
215
  <example host.mac="00-90-D0-F9-91-52">Basic realm="SpeedTouch (00-90-D0-F9-91-52)"</example>
@@ -209,10 +225,12 @@
209
225
  <param pos="0" name="hw.device" value="Broadband router"/>
210
226
  <param pos="1" name="host.mac"/>
211
227
  </fingerprint>
228
+
212
229
  <!--
213
230
  Really need some examples for the fingerprints below. The regex and params
214
231
  imply that the nonce inlcudes the MAC address.
215
232
  -->
233
+
216
234
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
217
235
  <description>Thomson SpeedTouch xDSL router - qop variant</description>
218
236
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -227,6 +245,7 @@
227
245
  <param pos="0" name="hw.device" value="Broadband router"/>
228
246
  <param pos="1" name="host.mac"/>
229
247
  </fingerprint>
248
+
230
249
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ST (\d+) R 5.x Telecom Italia&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
231
250
  <description>Thomson SpeedTouch xDSL router - Telecom Italia</description>
232
251
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -241,6 +260,7 @@
241
260
  <param pos="1" name="os.product"/>
242
261
  <param pos="2" name="host.mac"/>
243
262
  </fingerprint>
263
+
244
264
  <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;.*$">
245
265
  <description>Thomson generic devices</description>
246
266
  <example>Digest realm="Thomson Gateway"</example>
@@ -248,6 +268,7 @@
248
268
  <param pos="0" name="hw.vendor" value="Thomson"/>
249
269
  <param pos="0" name="hw.device" value="Broadband router"/>
250
270
  </fingerprint>
271
+
251
272
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
252
273
  <description>Huawei xDSL routers</description>
253
274
  <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
@@ -263,6 +284,7 @@
263
284
  <param pos="0" name="hw.family" value="MT"/>
264
285
  <param pos="1" name="hw.product"/>
265
286
  </fingerprint>
287
+
266
288
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;.*$">
267
289
  <description>Huawei Home Gateway Routers</description>
268
290
  <example>Basic realm="HuaweiHomeGateway"</example>
@@ -270,6 +292,7 @@
270
292
  <param pos="0" name="hw.device" value="Broadband router"/>
271
293
  <param pos="0" name="hw.product" value="Home Gateway"/>
272
294
  </fingerprint>
295
+
273
296
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;.*$">
274
297
  <description>Huawei EchoLife Home Gateways</description>
275
298
  <example>Basic realm="EchoLife Portal de Inicio"</example>
@@ -278,6 +301,7 @@
278
301
  <param pos="0" name="hw.device" value="Broadband router"/>
279
302
  <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
280
303
  </fingerprint>
304
+
281
305
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
282
306
  <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
283
307
  <example hw.product="WRT54G">Basic realm="WRT54G"</example>
@@ -291,6 +315,7 @@
291
315
  <param pos="0" name="hw.device" value="WAP"/>
292
316
  <param pos="1" name="hw.product"/>
293
317
  </fingerprint>
318
+
294
319
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
295
320
  <description>TP-LINK SoHo Router - dash variant</description>
296
321
  <example>Basic realm="TD-W8901G"</example>
@@ -300,6 +325,7 @@
300
325
  <param pos="0" name="os.device" value="Router"/>
301
326
  <param pos="1" name="os.product"/>
302
327
  </fingerprint>
328
+
303
329
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
304
330
  <description>TP-LINK SoHo Router</description>
305
331
  <example>Basic realm="TD854W"</example>
@@ -310,6 +336,7 @@
310
336
  <param pos="0" name="os.device" value="Router"/>
311
337
  <param pos="1" name="os.product"/>
312
338
  </fingerprint>
339
+
313
340
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
314
341
  <description>TP-LINK SoHo Router - verbose variant</description>
315
342
  <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
@@ -332,27 +359,31 @@
332
359
  <param pos="0" name="os.device" value="WAP"/>
333
360
  <param pos="1" name="os.product"/>
334
361
  </fingerprint>
362
+
335
363
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
336
364
  <description>TP-LINK Routers</description>
337
365
  <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
338
366
  <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
339
367
  <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
340
- <param pos="0" name="hw.vendor" value="TP-Link"/>
368
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
341
369
  <param pos="0" name="hw.device" value="Router"/>
342
370
  <param pos="1" name="hw.product"/>
343
371
  </fingerprint>
372
+
344
373
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;.*$">
345
374
  <description>TP-LINK IP-Cameras</description>
346
375
  <example>Basic realm="TP-LINK IP-Camera"</example>
347
- <param pos="0" name="hw.vendor" value="TP-Link"/>
376
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
348
377
  <param pos="0" name="hw.device" value="Web cam"/>
349
378
  </fingerprint>
379
+
350
380
  <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
351
381
  <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>
352
382
  <example>Digest qop="auth", realm="Broadcom Management Service", nonce="AAAAAAAAAAAAAP//DwHpMwYy1zc=", algorithm="MD5"</example>
353
383
  <param pos="0" name="service.vendor" value="Broadcom"/>
354
384
  <param pos="0" name="service.product" value="Management Service"/>
355
385
  </fingerprint>
386
+
356
387
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;.*$">
357
388
  <description>Samba Web Administration Tool (SWAT)</description>
358
389
  <example>Basic realm="SWAT"</example>
@@ -360,6 +391,7 @@
360
391
  <param pos="0" name="service.family" value="Samba"/>
361
392
  <param pos="0" name="service.product" value="SWAT"/>
362
393
  </fingerprint>
394
+
363
395
  <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
364
396
  <description>SPIP publishing system (www.spip.net)</description>
365
397
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
@@ -367,6 +399,7 @@
367
399
  <param pos="0" name="service.product" value="SPIP"/>
368
400
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
369
401
  </fingerprint>
402
+
370
403
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
371
404
  <description>HP Instant Support Enterprise Edition with a hostname</description>
372
405
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
@@ -374,6 +407,7 @@
374
407
  <param pos="0" name="service.product" value="ISEE"/>
375
408
  <param pos="1" name="host.name"/>
376
409
  </fingerprint>
410
+
377
411
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
378
412
  <description>Generic F5 Big-IP</description>
379
413
  <example>Basic realm="BIG-IP"</example>
@@ -382,7 +416,9 @@
382
416
  <param pos="0" name="service.product" value="BIG-IP LTM"/>
383
417
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
384
418
  </fingerprint>
419
+
385
420
  <!-- HP ProCurve -->
421
+
386
422
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[3]\d{3}A)&quot;$">
387
423
  <description>HP ProCurve Hubs</description>
388
424
  <example os.product="J3295A">Basic realm="HP J3295A"</example>
@@ -391,6 +427,7 @@
391
427
  <param pos="0" name="os.device" value="Hub"/>
392
428
  <param pos="1" name="os.product"/>
393
429
  </fingerprint>
430
+
394
431
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[489]\d{3}A)&quot;$">
395
432
  <description>HP ProCurve Switches</description>
396
433
  <example os.product="J4110A">Basic realm="HP J4110A"</example>
@@ -402,11 +439,13 @@
402
439
  <param pos="0" name="os.device" value="Switch"/>
403
440
  <param pos="1" name="os.product"/>
404
441
  </fingerprint>
442
+
405
443
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;.*$">
406
444
  <description>Assorted Sercomm CPE devices</description>
407
445
  <example>Digest realm="SERCOMM CPE Authentication"</example>
408
446
  <param pos="0" name="hw.vendor" value="Sercomm"/>
409
447
  </fingerprint>
448
+
410
449
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;.*$">
411
450
  <description>Tivo DVR</description>
412
451
  <example>Digest realm="TiVo DVR"</example>
@@ -414,12 +453,14 @@
414
453
  <param pos="0" name="hw.family" value="DVR"/>
415
454
  <param pos="0" name="hw.device" value="DVR"/>
416
455
  </fingerprint>
456
+
417
457
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;.*$">
418
458
  <description>Ubee Cable Modems</description>
419
459
  <example>Digest qop="auth", realm="Ubee", nonce="1544738973"</example>
420
460
  <param pos="0" name="hw.vendor" value="Ubee"/>
421
461
  <param pos="0" name="hw.device" value="Broadband router"/>
422
462
  </fingerprint>
463
+
423
464
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;XDB&quot;$">
424
465
  <description>Web server providing web services for Oracle's XML DB.</description>
425
466
  <example>Basic realm="XDB"</example>
@@ -427,11 +468,13 @@
427
468
  <param pos="0" name="service.product" value="XML DB"/>
428
469
  <param pos="0" name="service.family" value="Oracle"/>
429
470
  </fingerprint>
471
+
430
472
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;.*$">
431
473
  <description>Assorted ZTE CPE devices</description>
432
474
  <example>Digest realm="cpe@zte.com"</example>
433
475
  <param pos="0" name="hw.vendor" value="ZTE"/>
434
476
  </fingerprint>
477
+
435
478
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;.*$">
436
479
  <description>ZTE ZXHN router</description>
437
480
  <example>Basic realm="ZXHN H108L"</example>
@@ -440,6 +483,7 @@
440
483
  <param pos="0" name="hw.family" value="ZXHN"/>
441
484
  <param pos="1" name="hw.product"/>
442
485
  </fingerprint>
486
+
443
487
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;.*$">
444
488
  <description>ZTE ZXV router</description>
445
489
  <example hw.product="ZXV10 W300">Basic realm="ZXV10 W300"</example>
@@ -448,20 +492,98 @@
448
492
  <param pos="0" name="hw.family" value="ZXV"/>
449
493
  <param pos="1" name="hw.product"/>
450
494
  </fingerprint>
495
+
496
+ <fingerprint pattern="(?i)^(?:Basic|Digest)\s+realm=&quot;Siqura&quot;$">
497
+ <description>Siqura Video Encoder</description>
498
+ <example>Basic realm="Siqura"</example>
499
+ <param pos="0" name="os.vendor" value="Siqura"/>
500
+ <param pos="0" name="os.family" value="Linux"/>
501
+ <param pos="0" name="hw.vendor" value="Siqura"/>
502
+ <param pos="0" name="hw.device" value="Video Encoder"/>
503
+ </fingerprint>
504
+
505
+ <fingerprint pattern="^Digest realm=&quot;(Orbit-351)&quot;">
506
+ <description>Steinsvik Orbit 351 IP Camera (Truen TCAM Rebrand)</description>
507
+ <example hw.product="Orbit-351">Digest realm="Orbit-351", nonce="0000040dY892418598785d2a2304a74adf22f6098f2792", stale=FALSE</example>
508
+ <param pos="0" name="hw.vendor" value="Steinsvik"/>
509
+ <param pos="0" name="hw.device" value="Web cam"/>
510
+ <param pos="1" name="hw.product"/>
511
+ <param pos="0" name="os.vendor" value="Steinsvik"/>
512
+ <param pos="0" name="os.family" value="Linux"/>
513
+ <param pos="0" name="os.product" value="Linux"/>
514
+ </fingerprint>
515
+
516
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
517
+ <description>Netgear Orbi</description>
518
+ <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
519
+ <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
520
+ <example hw.product="Orbi-mini">Basic realm="NETGEAR Orbi-mini"</example>
521
+ <param pos="0" name="hw.vendor" value="Netgear"/>
522
+ <param pos="0" name="hw.device" value="WAP"/>
523
+ <param pos="0" name="hw.family" value="Orbi"/>
524
+ <param pos="1" name="hw.product"/>
525
+ </fingerprint>
526
+
527
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;.*$">
528
+ <description>Netgear Routers</description>
529
+ <example hw.product="DG834">Basic realm="NETGEAR DG834 "</example>
530
+ <example hw.product="C7000v2">Basic realm="NETGEAR C7000v2"</example>
531
+ <example hw.product="R7000P">Basic realm="NETGEAR R7000P"</example>
532
+ <param pos="0" name="hw.vendor" value="Netgear"/>
533
+ <param pos="0" name="hw.device" value="Router"/>
534
+ <param pos="1" name="hw.product"/>
535
+ </fingerprint>
536
+
537
+ <!-- Fallback to the most generic Netgear match -->
538
+
539
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;.*$">
540
+ <description>Netgear Unspecified Router</description>
541
+ <example>Basic realm="Netgear"</example>
542
+ <param pos="0" name="hw.vendor" value="Netgear"/>
543
+ <param pos="0" name="hw.device" value="Router"/>
544
+ </fingerprint>
545
+
546
+ <!-- This fingerprint is suspect, as it's missing the Basic/Digest qualifier -->
547
+
548
+ <fingerprint pattern="^(?:NETGEAR|NetGear) Router ([a-zA-Z0-9\-\+]+)$">
549
+ <description>Netgear Routers w/o Authentication Type</description>
550
+ <example hw.product="WNR2000v4">NETGEAR Router WNR2000v4</example>
551
+ <example hw.product="R6100">NETGEAR Router R6100</example>
552
+ <param pos="0" name="hw.vendor" value="Netgear"/>
553
+ <param pos="0" name="hw.device" value="Router"/>
554
+ <param pos="1" name="hw.product"/>
555
+ </fingerprint>
556
+
557
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
558
+ <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
559
+ <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
560
+ <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
561
+ <param pos="0" name="service.product" value="RemoteView"/>
562
+ <param pos="0" name="service.family" value="RemoteView"/>
563
+ <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
564
+ <param pos="0" name="hw.family" value="Primergy"/>
565
+ <param pos="0" name="hw.product" value="Primergy"/>
566
+ <param pos="1" name="host.name"/>
567
+ </fingerprint>
568
+
451
569
  <!-- a variety of headers we currently just ignore -->
570
+
452
571
  <fingerprint pattern="(?i)^NTLM$">
453
572
  <description>Ignore NTLM-only</description>
454
573
  <example>NTLM</example>
455
574
  <example>Ntlm</example>
456
575
  </fingerprint>
576
+
457
577
  <fingerprint pattern="^Negotiate$">
458
578
  <description>Ignore Negotiate-only</description>
459
579
  <example>Negotiate</example>
460
580
  </fingerprint>
581
+
461
582
  <!--
462
583
  Using a wildcard . instead of ['&quot;] in the following line will result in
463
584
  this fingerprint matching examples from other fingerprints.
464
585
  -->
586
+
465
587
  <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
466
588
  <description>Ignore null/empty/period/index.</description>
467
589
  <example>Basic realm="null"</example>
@@ -471,37 +593,30 @@
471
593
  <example>Basic realm='/'</example>
472
594
  <example>Basic realm="index.html"</example>
473
595
  </fingerprint>
596
+
474
597
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;.*$">
475
598
  <description>Ignore realms with an IPv4 address</description>
476
599
  <example>Basic realm="192.168.0.1"</example>
477
600
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
478
601
  </fingerprint>
602
+
479
603
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;.*$">
480
604
  <description>Ignore generic 'config' realms</description>
481
605
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
482
606
  </fingerprint>
483
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
484
- <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
485
- <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
486
- <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
487
- <param pos="0" name="service.product" value="RemoteView"/>
488
- <param pos="0" name="service.family" value="RemoteView"/>
489
- <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
490
- <param pos="0" name="hw.family" value="Primergy"/>
491
- <param pos="0" name="hw.product" value="Primergy"/>
492
- <param pos="1" name="host.name"/>
493
- </fingerprint>
607
+
494
608
  <!--
495
609
  Temporarily disable this version-less fingerprint because it overrode the
496
610
  one in http_servers.xml (see NEX-1255).
497
-
498
611
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Lyris ListManager: enter email address and password&quot;$">
499
612
  <description>Lyris ListManager</description>
500
613
  <example>Basic realm="Lyris ListManager: enter email address and password"</example>
501
614
  <param pos="0" name="service.vendor" value="Lyris"/>
502
615
  <param pos="0" name="service.product" value="ListManager"/>
503
616
  </fingerprint>
617
+
504
618
  -->
619
+
505
620
  <!--
506
621
  Basic realm= StarVoice
507
622
  Basic realm="802.11g Remote-Motion CCD Network Camera"
@@ -549,7 +664,6 @@ Basic realm="Login to Vigor 3300"
549
664
  Basic realm="Login"
550
665
  Basic realm="MR314"
551
666
  Basic realm="NetComm NB1300"
552
- Basic realm="NETGEAR DG834 "
553
667
  Basic realm="NetLinx"
554
668
  Basic realm="Netopia-2000"
555
669
  Basic realm="Netopia-3000"
@@ -589,7 +703,9 @@ Digest realm="HiPER", domain="222.66.99.209", qop="auth", nonce="aa81b6584c4716f
589
703
  Digest realm="i3micro VRG", nonce="1186428394", qop="auth", algorithm=MD5
590
704
  Digest realm="WatchGuard SOHO Configuration",qop="auth",nonce="7c8e98007db668881687bd538e6e8581"
591
705
  -->
706
+
592
707
  <!-- This is in various PHP coding examples, but is not a reliable FP source:
593
708
  Basic realm="User Login"
594
709
  -->
595
- </fingerprints>
710
+
711
+ </fingerprints>