recog-intrigue 2.3.7 → 2.3.14

data/xml/imap_banners.xml

@@ -1,6 +1,7 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="imap4.banner" protocol="imap" database_type="service" preference="0.90">
   <!-- IMAP banners are matched against these patterns to fingerprint IMAP servers. -->
+
   <fingerprint pattern="^Microsoft Exchange IMAP4rev1 server version (5\.5\.\d{4}\.\d+) \((.*)\) ready$">
     <description>Microsoft Exchange Server 5.5</description>
     <example service.version="5.5.2448.8" host.name="foo.bar">Microsoft Exchange IMAP4rev1 server version 5.5.2448.8 (foo.bar) ready</example>
@@ -15,6 +16,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
     <param pos="2" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Exchange 2000 IMAP4rev1 server version (6\.0\.\d{4}\.\d+) \((.*)\) ready\.$">
     <description>Microsoft Exchange Server 2000</description>
     <example service.version="6.0.6249.0" host.name="foo.bar">Microsoft Exchange 2000 IMAP4rev1 server version 6.0.6249.0 (foo.bar) ready.</example>
@@ -29,6 +31,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
     <param pos="2" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Exchange Server 2003 IMAP4rev1 server version (6\.5\.\d{4}\.\d+) \((.*)\) ready\.$">
     <description>Microsoft Exchange Server 2003</description>
     <example service.version="6.5.7638.1" host.name="foo.bar">Microsoft Exchange Server 2003 IMAP4rev1 server version 6.5.7638.1 (foo.bar) ready.</example>
@@ -43,6 +46,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
     <param pos="2" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version (6\.5\.\d{4}\.\d+) \((.*)\),.*$">
     <description>Microsoft Exchange Server 2003, German</description>
     <example service.version="6.5.7638.1" host.name="foo.bar">Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version 6.5.7638.1 (foo.bar), steht zur Verfgung.</example>
@@ -57,6 +61,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
     <param pos="2" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Exchange Server 2007 IMAP4 service ready$">
     <description>Microsoft Exchange Server 2007</description>
     <example>Microsoft Exchange Server 2007 IMAP4 service ready</example>
@@ -69,6 +74,7 @@
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
   </fingerprint>
+
   <fingerprint pattern="^The Microsoft Exchange IMAP4 service is ready\.?$">
     <description>Microsoft Exchange Server</description>
     <example>The Microsoft Exchange IMAP4 service is ready.</example>
@@ -81,6 +87,7 @@
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Domino IMAP4 Server Release (\d+\.\d+.*) ready (.+)$">
     <description>IBM Lotus Notes/Domino</description>
     <example service.version="9.0.1FP9" host.time="Thu, 4 Apr 2019 20:19:31 +0200">Domino IMAP4 Server Release 9.0.1FP9 ready Thu, 4 Apr 2019 20:19:31 +0200</example>
@@ -91,6 +98,7 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
     <param pos="2" name="host.time"/>
   </fingerprint>
+
   <fingerprint pattern="^Domino IMAP4 Server V\.?(\d+\.\d+.*) ready (.+)$">
     <description>IBM Lotus Notes/Domino - variant 2</description>
     <param pos="0" name="service.vendor" value="IBM"/>
@@ -100,13 +108,56 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
     <param pos="2" name="host.time"/>
   </fingerprint>
+
   <fingerprint pattern="^[dD]ovecot (?:DA )?ready\.$">
     <description>Dovecot Secure IMAP Server</description>
     <example>Dovecot ready.</example>
     <example>Dovecot DA ready.</example>
+    <param pos="0" name="service.vendor" value="Dovecot"/>
+    <param pos="0" name="service.family" value="Dovecot"/>
+    <param pos="0" name="service.product" value="Dovecot"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:dovecot:dovecot:-"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Dovecot \(Ubuntu\) ready\.$">
+    <description>Dovecot Secure IMAP Server - Ubuntu variant</description>
+    <example>Dovecot (Ubuntu) ready.</example>
+    <param pos="0" name="service.vendor" value="Dovecot"/>
+    <param pos="0" name="service.family" value="Dovecot"/>
+    <param pos="0" name="service.product" value="Dovecot"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:dovecot:dovecot:-"/>
+    <param pos="0" name="os.vendor" value="Ubuntu"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Dovecot \(Debian\) ready\.$">
+    <description>Dovecot Secure IMAP Server - Debian variant</description>
+    <example>Dovecot (Debian) ready.</example>
+    <param pos="0" name="service.vendor" value="Dovecot"/>
+    <param pos="0" name="service.family" value="Dovecot"/>
+    <param pos="0" name="service.product" value="Dovecot"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:dovecot:dovecot:-"/>
+    <param pos="0" name="os.vendor" value="Debian"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Dovecot \(Raspbian\) ready\.$">
+    <description>Dovecot Secure IMAP Server - Raspbian variant</description>
+    <example>Dovecot (Raspbian) ready.</example>
+    <param pos="0" name="service.vendor" value="Dovecot"/>
     <param pos="0" name="service.family" value="Dovecot"/>
     <param pos="0" name="service.product" value="Dovecot"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:dovecot:dovecot:-"/>
+    <param pos="0" name="os.vendor" value="Raspbian"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="hw.product" value="Raspberry Pi"/>
   </fingerprint>
+
   <fingerprint pattern="^Courier-IMAP ready. Copyright \d+-\d+">
     <description>Courier MTA IMAP</description>
     <example>Courier-IMAP ready. Copyright 1998-2002 Double Precision, Inc. See COPYING for distribution information.</example>
@@ -114,6 +165,7 @@
     <param pos="0" name="service.family" value="Courier MTA"/>
     <param pos="0" name="service.product" value="Courier IMAP"/>
   </fingerprint>
+
   <fingerprint pattern="^(\S+) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
     <description>Nortel CallPilot</description>
     <example>nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
@@ -124,6 +176,7 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:nortel:callpilot:{service.version}"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^(\S+) Zimbra IMAP4rev1 server ready\.?$">
     <description>VMware Zimbra IMAP</description>
     <example host.name="foo.bar">foo.bar Zimbra IMAP4rev1 server ready</example>
@@ -132,6 +185,7 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:-"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^(\S+) Zimbra (\S+) IMAP4rev1 server ready\.?$">
     <description>VMware Zimbra IMAP with service version</description>
     <example host.name="foo.bar" service.version="7.0.0_GA_3079">foo.bar Zimbra 7.0.0_GA_3079 IMAP4rev1 server ready</example>
@@ -141,6 +195,7 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:{service.version}"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^(.+) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
     <description>CMU Cyrus IMAP on Mac OS X</description>
     <example host.name="example.com" service.version="2.2.12" os.version="10.4.0">example.com Cyrus IMAP4 v2.2.12-OS X 10.4.0 server ready</example>
@@ -149,6 +204,7 @@
     <param pos="0" name="service.family" value="Cyrus MTA"/>
     <param pos="0" name="service.product" value="Cyrus IMAP"/>
     <param pos="2" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:cmu:cyrus_imap_server:{service.version}"/>
     <param pos="0" name="os.vendor" value="Apple"/>
     <param pos="0" name="os.family" value="Mac OS X"/>
     <param pos="0" name="os.product" value="Mac OS X"/>
@@ -156,6 +212,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:{os.version}"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^(.+) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
     <description>CMU Cyrus IMAP</description>
     <example host.name="example.com" service.version="2.3.7">example.com Cyrus IMAP4 v2.3.7 server ready</example>
@@ -164,36 +221,33 @@
     <param pos="0" name="service.family" value="Cyrus MTA"/>
     <param pos="0" name="service.product" value="Cyrus IMAP"/>
     <param pos="2" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:cmu:cyrus_imap_server:{service.version}"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
-  <!--
 
+  <!--
       // Washington University imapd
       IMAP_FP_PARSERS[0] = new PatternParser(
          "^IMAP4rev1 v(.*) server ready$");
       IMAP_FP_PARSERS[0].addConstantParam("product", "wu-imapd");
       IMAP_FP_PARSERS[0].addParamSpec(1, "version");
-
       // Washington University imapd (newer versions)
       IMAP_FP_PARSERS[1] = new PatternParser(
          "^IMAP4rev1 (.*) at (.*)$");
       IMAP_FP_PARSERS[1].addConstantParam("product", "wu-imapd");
       IMAP_FP_PARSERS[1].addParamSpec(1, "version");
       IMAP_FP_PARSERS[1].addParamSpec(2, "server-time");
-
 // University of Washington IMAP (imap-uw)
 * OK <host> IMAP4rev1 2001.315 at Fri, 20 Jul 2007 21:51:34 -0700 (PDT)
 * OK <host> IMAP4rev1 2001.315rh at Mon, 23 Jul 2007 07:56:09 -0500 (CDT)
 * OK <host> IMAP4rev1 2004.357-p2k server ready at Mon, 23 Jul 2007 01:56:26 -0400 (EDT)
 * OK <host> IMAP4rev1 2004.357s at Mon, 23 Jul 2007 15:17:56 +0000 (GMT)
 * OK <host> IMAP4rev1 2004.357w at Tue, 24 Jul 2007 19:36:11 -0600 (MDT)
-
 // cPanel Hosting Automation
 // 10.8.0 (build 89) - BETA Tree - Change the imap version from 2003.339-cpanel to 2003.339p-cpanel to indicate the security patch has been applied.
 // The patch has still be applied to 1.8.0 build 60+, we just show this now to avoid confusion.
 * OK <host> IMAP4rev1 2003.339-cpanel at Sun, 22 Jul 2007 07:35:36 -0500 (CDT)
 * OK <host> IMAP4rev1 2003.339p-cpanel at Sun, 22 Jul 2007 13:09:04 -0500 (CDT)
-
       // PMDF IMAP
       // * OK <system> PMDF IMAP4rev1 V6.1 (Message store V6.1)
       // * OK xxx PMDF IMAP4rev1 V6.0-24 (Message store V6.0-24)
@@ -203,31 +257,26 @@
       IMAP_FP_PARSERS[5].addConstantParam("product", "PMDF");
       IMAP_FP_PARSERS[5].addParamSpec(1, "hostname");
       IMAP_FP_PARSERS[5].addParamSpec(2, "version");
-
       // PMDF IMAP (for VMS v7.1-2!)
       IMAP_FP_PARSERS[6] = new PatternParser(
          "^IMAP4 Server PMDF(.*) at (.*)$");
       IMAP_FP_PARSERS[6].addConstantParam("product", "PMDF");
       IMAP_FP_PARSERS[6].addParamSpec(1, "version");
       IMAP_FP_PARSERS[6].addParamSpec(2, "server-time");
-
       // Eudora Internet Mail Server
       IMAP_FP_PARSERS[7] = new PatternParser(
          "^Eudora Internet Mail Server (.*) .*$");
       IMAP_FP_PARSERS[7].addConstantParam("product", "eudoraims");
       IMAP_FP_PARSERS[7].addParamSpec(1, "version");
-
       // Eudora Qualcomm WorldMail
       // * OK WorldMail IMAP4 Server 6.1.19.0 ready
       IMAP_FP_PARSERS[8] = new PatternParser(
          "^WorldMail IMAP4 Server ([^\\s]+) ready$");
       IMAP_FP_PARSERS[8].addConstantParam("product", "worldmail");
       IMAP_FP_PARSERS[8].addParamSpec(1, "version");
-
       // GNU Mailutils.  Note that there is no version information
       IMAP_FP_PARSERS[9] = new PatternParser("^IMAP4rev1$");
       IMAP_FP_PARSERS[9].addConstantParam("product", "GNU Mailutils");
-
 * OK <host> IMAP4rev1 MDaemon 8.1.4 ready
 * OK <host> /bin/sh IMAP server ready
 * OK IMAP/POP ready.
@@ -240,6 +289,6 @@
 * OK Merak 8.0.3 IMAP4rev1 Mon, 23 Jul 2007 18:22:49 +0100
 * OK <host> Sendmail Advanced Message Server IMAP4rev1 (1.3.2/390)
 * OK Welcome IMAP Server
-
 -->
-</fingerprints>
+
+</fingerprints>

data/xml/ldap_searchresult.xml

@@ -1,15 +1,17 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="ldap.search_result" protocol="ldap" database_type="service" preference=".80">
   <!--
     Notes: Ruby will fail to build the RegExp if it contains \x84 which is a standard
           byte in ASN.1 Sequence length fields.
   -->
+
   <!--
     Samba - position prior to Windows entries due to regex. When testing new
     Samba fingerprints make sure you disable the matches for the version of
     Windows that Samba is eumlating or else the Windows fallback fingerprint for
     the given OS version may match.
   -->
+
   <fingerprint pattern="(?m:vendorName1.\x04.Samba.*domainControllerFunctionality1.{1,5}\x04\x014)">
     <description>Samba Active Directory Controller</description>
     <example _encoding="base64">
@@ -19,6 +21,7 @@
     <param pos="0" name="service.vendor" value="Samba"/>
     <param pos="0" name="service.product" value="Active Directory Controller"/>
   </fingerprint>
+
   <fingerprint pattern="(?m:vendorName1.\x04.Samba.*domainFunctionality1.\x04\x0100.\x04\x13forestFunctionality1\x03\x04\x0100)">
     <description>Samba Active Directory Controller emulating Windows 2000</description>
     <example _encoding="base64">
@@ -29,19 +32,19 @@
     <param pos="0" name="service.vendor" value="Samba"/>
     <param pos="0" name="service.product" value="Active Directory Controller"/>
   </fingerprint>
+
   <!--
     Windows Active Directory and Lightweight Directory Server (ADAM)
-
     domainControllerFunctionality reference:
       https://msdn.microsoft.com/en-us/library/cc223272.aspx
-
     supportedCapabilities reference (for Windows 2000)
       https://msdn.microsoft.com/en-us/library/cc223359.aspx
-
       1.2.840.113556.1.4.800  = Active Directory Controller
       1.2.840.113556.1.4.1851 = Lightweight Directory Server / ADAM
   -->
+
   <!-- Windows 2016 -->
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x017)">
     <description>Active Directory Controller on Windows Server 2016</description>
     <example _encoding="base64">
@@ -56,6 +59,7 @@
     <param pos="0" name="os.product" value="Windows Server 2016"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x017)">
     <description>Microsoft LDS on Windows Server Server 2016</description>
     <example _encoding="base64">
@@ -70,6 +74,7 @@
     <param pos="0" name="os.product" value="Windows Server 2016"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x017)">
     <description>Windows Server Server 2016</description>
     <example _encoding="base64">
@@ -80,7 +85,9 @@
     <param pos="0" name="os.product" value="Windows Server 2016"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
   </fingerprint>
+
   <!-- Windows 2012 R2 -->
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x016)">
     <description>Active Directory Controller on Windows Server 2012 R2</description>
     <example _encoding="base64">
@@ -95,6 +102,7 @@
     <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x016)">
     <description>Microsoft LDS on Windows Server Server 2012 R2</description>
     <example _encoding="base64">
@@ -109,6 +117,7 @@
     <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x016)">
     <description>Windows Server Server 2012 R2</description>
     <example _encoding="base64">
@@ -119,7 +128,9 @@
     <param pos="0" name="os.product" value="Windows Server 2012 R2"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <!-- Windows 2012 -->
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x015)">
     <description>Active Directory Controller on Windows Server 2012</description>
     <example _encoding="base64">
@@ -134,6 +145,7 @@
     <param pos="0" name="os.product" value="Windows Server 2012"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x015)">
     <description>Microsoft LDS on Windows Server 2012 R2</description>
     <example _encoding="base64">
@@ -148,6 +160,7 @@
     <param pos="0" name="os.product" value="Windows Server 2012"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x015)">
     <description>Windows Server Server 2012</description>
     <example _encoding="base64">
@@ -158,7 +171,9 @@
     <param pos="0" name="os.product" value="Windows Server 2012"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
   </fingerprint>
+
   <!-- Windows 2008 R2 -->
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x014)">
     <description>Active Directory Controller on Windows Server 2008 R2</description>
     <example _encoding="base64">
@@ -173,6 +188,7 @@
     <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x014)">
     <description>Microsoft LDS on Windows Server Server 2008 R2</description>
     <example _encoding="base64">
@@ -187,10 +203,12 @@
     <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <!--
     This generic match for domainControllerFunctionality =  4 will capture
     current Samba implementations.  Disable the fingerprint below when testing Samba
   -->
+
   <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x014)">
     <description>Windows Server Server 2008 R2</description>
     <example _encoding="base64">
@@ -201,7 +219,9 @@
     <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <!-- Windows 2008 -->
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x013)">
     <description>Active Directory Controller on Windows Server 2008</description>
     <example _encoding="base64">
@@ -216,6 +236,7 @@
     <param pos="0" name="os.product" value="Windows Server 2008"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x013)">
     <description>Microsoft LDS on Windows Server 2008</description>
     <example _encoding="base64">
@@ -230,6 +251,7 @@
     <param pos="0" name="os.product" value="Windows Server 2008"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x013)">
     <description>Windows Server Server 2008</description>
     <example _encoding="base64">
@@ -240,7 +262,9 @@
     <param pos="0" name="os.product" value="Windows Server 2008"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
   </fingerprint>
+
   <!-- Windows 2003 -->
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.800.*domainControllerFunctionality1.{1,5}\x04\x012)">
     <description>Active Directory Controller on Windows Server 2003</description>
     <example _encoding="base64">
@@ -255,6 +279,7 @@
     <param pos="0" name="os.product" value="Windows Server 2003"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:1.2.840.113556.1.4.1851.*domainControllerFunctionality1.{1,5}\x04\x012)">
     <description>Microsoft LDS on Windows Server 2003</description>
     <example _encoding="base64">
@@ -269,6 +294,7 @@
     <param pos="0" name="os.product" value="Windows Server 2003"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:domainControllerFunctionality1.{1,5}\x04\x012)">
     <description>Windows Server Server 2003</description>
     <example _encoding="base64">
@@ -279,7 +305,9 @@
     <param pos="0" name="os.product" value="Windows Server 2003"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
   </fingerprint>
+
   <!-- Win Server 2000 Service Pack 3 only has two matching supportedCapabilities OIDs, match them and look for explicit end-->
+
   <fingerprint pattern="(?im:supportedCapabilities1.{1,5}\x04\x161.2.840.113556.1.4.800\x04\x171.2.840.113556.1.4.17910.{1,5}\x04.(?:supportedControl|isSynchronized))">
     <description>Active Directory Controller on Windows Server 2000 SP 3</description>
     <example _encoding="base64">
@@ -299,7 +327,9 @@
     <param pos="0" name="os.version" value="Windows Server 2000 SP3"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:Windows Server 2000 SP3"/>
   </fingerprint>
+
   <!-- Win Server 2000 RTM only has a single matching supportedCapabilities OID, match it and look for explicit end-->
+
   <fingerprint pattern="(?im:supportedCapabilities1.{1,5}\x04\x161.2.840.113556.1.4.8000.{1,5}\x04.isSynchronized1)">
     <description>Active Directory Controller on Windows Server 2000</description>
     <example _encoding="base64">
@@ -314,7 +344,9 @@
     <param pos="0" name="os.product" value="Windows Server 2000"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
   </fingerprint>
+
   <!-- End of Microsoft Windows Section -->
+
   <fingerprint pattern="(?im:top\x04..penLDAProotDSE)">
     <description>OpenLDAP</description>
     <example _encoding="base64">
@@ -324,6 +356,7 @@
     <param pos="0" name="service.product" value="OpenLDAP"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:openldap:openldap:-"/>
   </fingerprint>
+
   <fingerprint pattern="(?i:namingcontexts1.\x04.fn=ContactRoot0.[\x02\x04])">
     <description>Kerio Connect</description>
     <example service.product="Connect" _encoding="base64">
@@ -333,6 +366,7 @@
     <param pos="0" name="service.vendor" value="Kerio"/>
     <param pos="0" name="service.product" value="Connect"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vmwPlatformServicesControllerVersion1.\x04.(\d\.\d\.\d)0.)">
     <description>VMware Platform Services Controller</description>
     <example service.version="6.0.0" _encoding="base64">
@@ -342,8 +376,11 @@
     <param pos="0" name="service.product" value="Platform Services Controller"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <!-- Fedora / 389 Project family -->
+
   <!--  http://directory.fedoraproject.org/docs/389ds/FAQ/history.html  -->
+
   <fingerprint pattern="(?i:vendorname1.\x04.Fedora Project0.\x04\rvendorversion1.\x04.Fedora-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+))">
     <description>Fedora Project Fedora Directory Server</description>
     <example service.version="1.0.4 B2006.312.5450" _encoding="base64">
@@ -358,6 +395,7 @@
     <param pos="0" name="service.product" value="Fedora Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?i:vendorname1.\x04.389 Project0.\x04\rvendorversion1.\x04.389-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+))">
     <description>389 Project 389 Directory Server</description>
     <example service.version="1.2.11.25 B2013.325.19510" _encoding="base64">
@@ -368,6 +406,7 @@
     <param pos="0" name="service.product" value="389 Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorName1.\x04.CentOS0.\x04\rvendorVersion1.\x04.CentOS-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+).\x04\v)">
     <description>CentOS CentOS Directory Server</description>
     <example service.version="8.2.8 B2012.041.12270" _encoding="base64">
@@ -378,6 +417,7 @@
     <param pos="0" name="service.product" value="CentOS Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorName1.\x04.Red Hat(?:, Inc.)?0.\x04\rvendorVersion1.\x04.Red Hat-Directory/(\d\.\d[\w.]* B\d+\.\d+\.\d+).\x04\v)">
     <description>Red Hat Red Hat Directory Server</description>
     <example service.version="8.2.0 B2010.210.0590" _encoding="base64">
@@ -389,6 +429,7 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:redhat:directory_server:{service.version}"/>
   </fingerprint>
+
   <fingerprint pattern="(?i:vendorname1.\x04.Netscape Communications Corp.0.\x04\rvendorversion1.\x04.Netscape-Directory/(\d\.\d[\d.]* B\d+\.\d+\.\d+).\x04\v)">
     <description>Netscape Directory Server</description>
     <example service.version="6.11 B2002.281.08530" _encoding="base64">
@@ -403,6 +444,7 @@
     <param pos="0" name="service.product" value="Netscape Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Release (\d+\.\d+[\w .]*)0.\x04.dominomajminversion)">
     <description>IBM (Lotus) Domino LDAP Server - majminversion variant</description>
     <example service.version="8.5.3" _encoding="base64">
@@ -417,6 +459,7 @@
     <param pos="0" name="service.product" value="Domino LDAP Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Release (\d+\.\d+[\w .]*)0\f)">
     <description>IBM (Lotus) Domino LDAP Server</description>
     <example service.version="9.0.1FP4 HF523" _encoding="base64">
@@ -427,6 +470,7 @@
     <param pos="0" name="service.product" value="Domino LDAP Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Build (V[\w .]*)0.\x04.dominomajminversion)">
     <description>IBM (Lotus) Domino LDAP Server - build variant</description>
     <example service.version="V902_12302013" _encoding="base64">
@@ -437,7 +481,9 @@
     <param pos="0" name="service.product" value="Domino LDAP Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <!-- Attachmate Group (NetIQ) purchased Novell in 2011, and then merged w/ Micro Focus in 2014 -->
+
   <fingerprint pattern="(?im:vendorName1\x13\x04\x11NetIQ Corporation0.\x04\rvendorVersion.{4}LDAP Agent for NetIQ eDirectory (\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
     <description>NetIQ LDAP Agent for eDirectory</description>
     <example service.version="8.8 SP8 (20808.06)" _encoding="base64">
@@ -449,6 +495,7 @@
     <param pos="0" name="service.product" value="LDAP Agent for eDirectory"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorName1\x0E\x04\fNovell, Inc.0.\x04\rvendorVersion.{4}LDAP Agent for Novell eDirectory (\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
     <description>Novell LDAP Agent for eDirectory</description>
     <example service.version="8.7.3.8 (10554.99)" _encoding="base64">
@@ -463,6 +510,7 @@
     <param pos="0" name="service.product" value="LDAP Agent for eDirectory"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorName1\x0E\x04\fNovell, Inc.0/\x04\rvendorVersion1\x1E\x04\x1CeDirectory v(\d+\.\d+[\d.]* [\w ]*\([\d.]+\))0.\x04)">
     <description>Novell eDirectory</description>
     <example service.version="8.6.2 (10350.18)" _encoding="base64">
@@ -474,7 +522,9 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:novell:edirectory:{service.version}"/>
   </fingerprint>
+
   <!-- Various iterations of Sun, now Oracle, Directory Server -->
+
   <fingerprint pattern="(?i:vendorname1\x18\x04\x16Sun Microsystems, Inc.0.+\x04\rvendorversion1.{1,2}\x04.{1,2}Sun[- ]Java\(tm\)[- ]System[- ]Directory(?: Server)?/(\d\.\d+[\w.]*)0.{1,3}\x04)">
     <description>Sun Java(TM) System Directory Server</description>
     <example service.version="5.2_Patch_6" _encoding="base64">
@@ -494,10 +544,11 @@
       dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDoEDXZlbmRvclZlcnNpb24xK
       QQnU3VuLUphdmEodG0pLVN5c3RlbS1EaXJlY3RvcnkvNi4zLjEuMS4xMIGJBA==
     </example>
-    <param pos="0" name="service.vendor" value="Sun Microsystems"/>
+    <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.product" value="Sun Java System Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?i:vendorname1\x18\x04\x16Sun Microsystems, Inc.0.\x04\rvendorversion1.\x04.Sun-Directory-Server/([\w.]+)0.{1,3}\x04)">
     <description>Sun Directory Server</description>
     <example service.version="7.0" _encoding="base64">
@@ -512,10 +563,11 @@
       dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDIEDXZlbmRvclZlcnNpb24xI
       QQfU3VuLURpcmVjdG9yeS1TZXJ2ZXIvMTEuMS4xLjMuMDAgBA==
     </example>
-    <param pos="0" name="service.vendor" value="Sun Microsystems"/>
+    <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.product" value="Sun Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?i:vendorname1\x14\x04\x12Oracle Corporation0.\x04\rvendorversion1.\x04.Sun-Directory-Server/([\w.]+)[0 ].{1,3}\x04)">
     <description>Oracle Sun Directory Server</description>
     <example service.version="11.1.1.7.2" _encoding="base64">
@@ -530,17 +582,20 @@
     <param pos="0" name="service.product" value="Sun Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorName1\x17\x04\x15Sun Microsystems, Inc0.\x04\rvendorVersion1.\x04.Directory Proxy Server ([\w.]+)0.\x04)">
     <description>Sun Directory Proxy Server</description>
     <example service.version="11.1.1.7.1" _encoding="base64">
       dmVuZG9yTmFtZTEXBBVTdW4gTWljcm9zeXN0ZW1zLCBJbmMwNAQNdmVuZG9yVmVyc2lvbjEjB
       CFEaXJlY3RvcnkgUHJveHkgU2VydmVyIDExLjEuMS43LjEwRQQ=
     </example>
-    <param pos="0" name="service.vendor" value="Sun Microsystems"/>
+    <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.product" value="Sun Directory Proxy Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <!-- Very old, rare, same family as above. Roll into those? -->
+
   <fingerprint pattern="(?i:vendorname1.\x04.Sun Microsystems, Inc.0.\x04\rvendorversion1.\x04.Sun-ONE-Directory/([\w.]+)0.\x04)">
     <description>Sun ONE Directory Server</description>
     <example service.version="5.2" _encoding="base64">
@@ -551,11 +606,13 @@
       dmVuZG9yTmFtZTEYBBZTdW4gTWljcm9zeXN0ZW1zLCBJbmMuMDAEDXZlbmRvclZlcnNpb24xH
       wQdU3VuLU9ORS1EaXJlY3RvcnkvNS4yX1BhdGNoXzEwPgQ=
     </example>
-    <param pos="0" name="service.vendor" value="Sun Microsystems"/>
+    <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.product" value="Sun ONE Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <!-- IBM [Tivoli | Security] Directory Server -->
+
   <fingerprint pattern="(?im:International Business Machines \(IBM\)0.*\x04\rvendorversion1.\x00\x00\x00.\x04.([\d.]+)0.\x00.*ibm-osregistrycontext1.\x00\x00\x00.\x04.OS400-SYS=)">
     <description>IBM Security Directory Server on OS/400 (IBM i)</description>
     <example service.version="5.2" _encoding="base64">
@@ -571,6 +628,7 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:ibm:security_directory_server:{service.version}"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorname1.+?\x04%International Business Machines \(IBM\)0.+?\x04\rvendorversion1.+?\x04.([\d.]+)0.[\x00\x02\x04])">
     <description>IBM Security Directory Server</description>
     <example service.version="5.1" _encoding="base64">
@@ -586,6 +644,7 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:ibm:security_directory_server:{service.version}"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorName1.\x00\x00\x00\v\x04\tMirapoint0.\x00\x00\x00.\x04\rvendorVersion1.\x00\x00\x00.\x04.([\d.]+)0.\x00)">
     <description>Mirapoint LDAP Server</description>
     <example service.version="3.2" _encoding="base64">
@@ -596,6 +655,7 @@
     <param pos="0" name="service.product" value="LDAP Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:orcldirectoryversion1.{1,5}\x04.OID ([\d.]+)0.\x00\x00)">
     <description>Oracle Internet Directory</description>
     <example service.version="9.0.4.0.0" _encoding="base64">
@@ -605,6 +665,7 @@
     <param pos="0" name="service.product" value="Internet Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:orcldirectoryversion1.{1,5}\x04.OVD ([\d.]+)0.\x04)">
     <description>Oracle Virtual Directory</description>
     <example service.version="11.1.1.6.0" _encoding="base64">
@@ -614,6 +675,7 @@
     <param pos="0" name="service.product" value="Virtual Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:metaProductID.*\x04\vmetaVersion1\r\x04.([\d.]+)0.\x04)">
     <description>estos MetaDirectory</description>
     <example service.version="3.5.22.4291" _encoding="base64">
@@ -626,6 +688,7 @@
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="0" name="os.family" value="Windows"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:dsaVersion1.\x04,DC Directory Server v(\d+\.\d+[\d.]* \([\w. ]+\))0.\x04)">
     <description>Cisco Data Connection Directory</description>
     <example service.version="8.1.00 (build 20150305)" _encoding="base64">
@@ -636,7 +699,9 @@
     <param pos="0" name="service.product" value="Data Connection Directory"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <!-- Unbound -->
+
   <fingerprint pattern="(?im:vendorName1.\x04.UnboundID Corp.0.\x04\rvendorVersion1.\x04.UnboundID Directory Server ([\d.]+)0\f)">
     <description>UnboundID Directory Server</description>
     <example service.version="5.1.5.2" _encoding="base64">
@@ -647,6 +712,7 @@
     <param pos="0" name="service.product" value="UnboundID Directory Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:vendorName1.\x04.UnboundID Corp.0.\x04\rvendorVersion1.\x04.UnboundID Directory Proxy Server ([\d.]+)0\f)">
     <description>UnboundID Directory Proxy Server</description>
     <example service.version="4.7.0.7" _encoding="base64">
@@ -657,6 +723,7 @@
     <param pos="0" name="service.product" value="UnboundID Directory Proxy Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.IPVA-\w+-)" flags="REG_MULTILINE">
     <description>innovaphone VoIP Gateway Virtual Appliance</description>
     <example _encoding="base64">
@@ -667,6 +734,7 @@
     <param pos="0" name="service.family" value="VoiP Gateway"/>
     <param pos="0" name="service.product" value="IPVA"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IP\d+)-\w+-)" flags="REG_MULTILINE">
     <description>innovaphone VoIP Gateway</description>
     <example service.product="IP800" _encoding="base64">
@@ -677,6 +745,7 @@
     <param pos="0" name="service.family" value="VoiP Gateway"/>
     <param pos="1" name="service.product"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IPBS\d*)-\w+-)">
     <description>Ascom IP-DECT Base Station</description>
     <example service.product="IPBS2" _encoding="base64">
@@ -687,6 +756,7 @@
     <param pos="0" name="service.family" value="IP-DECT Base Station"/>
     <param pos="1" name="service.product"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:namingContexts1.\x04.cn=.?pbx.*\x04.ldapServiceName1.\x04.(IPBL\d*)-\w+-)">
     <description>Ascom IP-DECT Gateway</description>
     <example service.product="IPBL" _encoding="base64">
@@ -697,6 +767,7 @@
     <param pos="0" name="service.family" value="IP-DECT Gateway"/>
     <param pos="1" name="service.product"/>
   </fingerprint>
+
   <fingerprint pattern="(?im:o=Scalix0.\x04.subschemasubentry1.\x04.cn=subSchema,o=Scalix0.\x04.*\x04.xserverversion1.\x04.(\d\d\.\d+\.[\w.-]+)0.\x02)">
     <description>Scalix LDAP Server</description>
     <example service.version="11.4.6.13676" _encoding="base64">
@@ -708,4 +779,5 @@
     <param pos="0" name="service.product" value="LDAP Server"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
-</fingerprints>
+
+</fingerprints>