recog-intrigue 2.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/smtp_debug.xml ADDED
@@ -0,0 +1,39 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.14">
3
+ <!--
4
+ SMTP response lines to the DEBUG command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^500 No way!$">
13
+ <description>Exim</description>
14
+ <example>500 No way!</example>
15
+ <param pos="0" name="service.vendor" value="exim"/>
16
+ <param pos="0" name="service.family" value="exim"/>
17
+ <param pos="0" name="service.product" value="exim"/>
18
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="^250[ -] *Debug set -NOT!$">
21
+ <description>TIS FWTK and derivatives (other firewalls, like Gauntlet, are derived from TIS)</description>
22
+ <param pos="0" name="service.vendor" value="TIS"/>
23
+ <param pos="0" name="service.family" value="FWTK"/>
24
+ <param pos="0" name="service.product" value="FWTK"/>
25
+ </fingerprint>
26
+ <fingerprint pattern="^500[ -]What\? I don't understand that\.$">
27
+ <description>Alt-N MDaemon SMTP</description>
28
+ <example>500 What? I don't understand that.</example>
29
+ <param pos="0" name="service.vendor" value="Alt-N"/>
30
+ <param pos="0" name="service.family" value="MDaemon"/>
31
+ <param pos="0" name="service.product" value="MDaemon"/>
32
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
33
+ <param pos="0" name="os.vendor" value="Microsoft"/>
34
+ <param pos="0" name="os.family" value="Windows"/>
35
+ <param pos="0" name="os.product" value="Windows"/>
36
+ <param pos="0" name="os.arch" value="x86"/>
37
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
38
+ </fingerprint>
39
+ </fingerprints>
data/xml/smtp_ehlo.xml ADDED
@@ -0,0 +1,49 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.19">
3
+ <!--
4
+ SMTP response lines to the EHLO command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX&quot; unrecognized$">
13
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server</description>
14
+ <param pos="0" name="os.vendor" value="Cisco"/>
15
+ <param pos="0" name="os.family" value="PIX"/>
16
+ <param pos="0" name="os.product" value="PIX"/>
17
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
18
+ </fingerprint>
19
+ <!--
20
+ Don't try to infer a fingerprint from XEXCH50, because if we do, it might overwrite
21
+ a very precise MS IIS SMTP service or MS Exchange Server fingerprint found with the
22
+ help of smtp_banners.xml. Instead, this case is handled specially by the Jess rule
23
+ smtp-iis-xexch50-svc-fingerprint. -mrb
24
+
25
+ <fingerprint pattern="^250[ -] *XEXCH50.*$">
26
+ <description>
27
+ Microsoft Exchange/IIS server
28
+ </description>
29
+ <param pos="0" name="service.vendor" value="Microsoft"/>
30
+ <param pos="0" name="service.family" value="IIS"/>
31
+ <param pos="0" name="service.product" value="IIS"/>
32
+ <param pos="0" name="os.vendor" value="Microsoft"/>
33
+ <param pos="0" name="os.family" value="Windows"/>
34
+ <param pos="0" name="os.product" value="Windows"/>
35
+ </fingerprint>
36
+ -->
37
+ <fingerprint pattern="^221[ -]See ya in cyberspace$">
38
+ <description>221 See ya in cyberspace</description>
39
+ <param pos="0" name="service.vendor" value="Alt-N"/>
40
+ <param pos="0" name="service.family" value="MDaemon"/>
41
+ <param pos="0" name="service.product" value="MDaemon"/>
42
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
43
+ <param pos="0" name="os.vendor" value="Microsoft"/>
44
+ <param pos="0" name="os.family" value="Windows"/>
45
+ <param pos="0" name="os.product" value="Windows"/>
46
+ <param pos="0" name="os.arch" value="x86"/>
47
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
48
+ </fingerprint>
49
+ </fingerprints>
data/xml/smtp_expn.xml ADDED
@@ -0,0 +1,82 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.16">
3
+ <!--
4
+ SMTP response lines to the EXPN command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX.*&quot; unrecognized$">
13
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server - expn variant</description>
14
+ <param pos="0" name="os.vendor" value="Cisco"/>
15
+ <param pos="0" name="os.family" value="PIX"/>
16
+ <param pos="0" name="os.product" value="PIX"/>
17
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
18
+ </fingerprint>
19
+ <fingerprint pattern="^550[ -]EXPN not available to \(.+\) \[.+\] *$">
20
+ <description>Exim - expn variant 1</description>
21
+ <example>550 EXPN not available to (foo.bar.com) [192.168.0.1]</example>
22
+ <param pos="0" name="service.vendor" value="exim"/>
23
+ <param pos="0" name="service.family" value="exim"/>
24
+ <param pos="0" name="service.product" value="exim"/>
25
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
26
+ </fingerprint>
27
+ <fingerprint pattern="^550[ -]EXPN not available to [^ ]+ \(.+\) \[.+\] *$">
28
+ <description>Exim - expn variant 2</description>
29
+ <example>550 EXPN not available to evil.com (foo.bar.com) [192.168.0.1]</example>
30
+ <param pos="0" name="service.vendor" value="exim"/>
31
+ <param pos="0" name="service.family" value="exim"/>
32
+ <param pos="0" name="service.product" value="exim"/>
33
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
34
+ </fingerprint>
35
+ <fingerprint pattern="^500[ -]Don't you wish! *$">
36
+ <description>GNAT box SMTP</description>
37
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
38
+ <param pos="0" name="service.family" value="GNAT Box"/>
39
+ <param pos="0" name="service.product" value="GNAT Box"/>
40
+ </fingerprint>
41
+ <!-- VM SMTP server doesn't like brackets in EXPN commands... -->
42
+ <fingerprint pattern="^501[ -]Syntax Error\. Only ListId or Userid allowed as argument to this command *$">
43
+ <description>IBM VM SMTP</description>
44
+ <param pos="0" name="service.vendor" value="IBM"/>
45
+ <param pos="0" name="service.family" value="VM"/>
46
+ <param pos="0" name="service.product" value="VM"/>
47
+ </fingerprint>
48
+ <fingerprint pattern="^550[ -]lists are confidential *$">
49
+ <description>Ipswitch IMail Server - expn variant</description>
50
+ <example>550 lists are confidential</example>
51
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
52
+ <param pos="0" name="service.family" value="IMail Server"/>
53
+ <param pos="0" name="service.product" value="IMail Server"/>
54
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:-"/>
55
+ </fingerprint>
56
+ <fingerprint pattern="^502[ -]command is not active$">
57
+ <description>Alt-N MDaemon - expn variant</description>
58
+ <example>502 command is not active</example>
59
+ <param pos="0" name="service.vendor" value="Alt-N"/>
60
+ <param pos="0" name="service.family" value="MDaemon"/>
61
+ <param pos="0" name="service.product" value="MDaemon"/>
62
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
63
+ <param pos="0" name="os.vendor" value="Microsoft"/>
64
+ <param pos="0" name="os.family" value="Windows"/>
65
+ <param pos="0" name="os.product" value="Windows"/>
66
+ <param pos="0" name="os.arch" value="x86"/>
67
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
68
+ </fingerprint>
69
+ <fingerprint pattern="^252 Unable to EXPN &quot;.*&quot;, but will accept message and attempt delivery *$">
70
+ <description>Lotus Domino</description>
71
+ <param pos="0" name="service.vendor" value="Lotus"/>
72
+ <param pos="0" name="service.family" value="Lotus Domino"/>
73
+ <param pos="0" name="service.product" value="Lotus Domino"/>
74
+ </fingerprint>
75
+ <fingerprint pattern="^550[ -]Unable to find list '.*'\.$">
76
+ <description>Seattle Labs SLMail</description>
77
+ <example>550 Unable to find list 'list'.</example>
78
+ <param pos="0" name="service.vendor" value="Seattle Labs"/>
79
+ <param pos="0" name="service.family" value="SLMail"/>
80
+ <param pos="0" name="service.product" value="SLMail"/>
81
+ </fingerprint>
82
+ </fingerprints>
data/xml/smtp_help.xml ADDED
@@ -0,0 +1,157 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.18">
3
+ <!--
4
+ SMTP response lines to the HELP command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^214[ -]This is ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
13
+ <description>ArgoSoft mail server HELP response with version</description>
14
+ <example service.version="1.4.0.3">214-This is ArGoSoft Mail Server, Version 1.4 (1.4.0.3)</example>
15
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
16
+ <param pos="0" name="service.family" value="Mail Server"/>
17
+ <param pos="0" name="service.product" value="Mail Server"/>
18
+ <param pos="1" name="service.version"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="^214[ -].*support@argosoft\.com *$">
21
+ <description>ArgoSoft mail server HELP response</description>
22
+ <example>214-To report bug, send mail to support@argosoft.com</example>
23
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
24
+ <param pos="0" name="service.family" value="Mail Server"/>
25
+ <param pos="0" name="service.product" value="Mail Server"/>
26
+ </fingerprint>
27
+ <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX&quot; unrecognized$">
28
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server</description>
29
+ <param pos="0" name="os.vendor" value="Cisco"/>
30
+ <param pos="0" name="os.family" value="PIX"/>
31
+ <param pos="0" name="os.product" value="PIX"/>
32
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
33
+ </fingerprint>
34
+ <fingerprint pattern="^500[ -]5.5.1 unrecognised command HELP$">
35
+ <description>Eudora IMS uses the British spelling "unrecognised"</description>
36
+ <param pos="0" name="service.vendor" value="Eudora"/>
37
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
38
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
39
+ <param pos="0" name="os.vendor" value="Apple"/>
40
+ <param pos="0" name="os.family" value="Mac OS"/>
41
+ <param pos="0" name="os.product" value="Mac OS"/>
42
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
43
+ </fingerprint>
44
+ <fingerprint pattern="^214[ -]([^ ]+) is running the IBM VM operating system$">
45
+ <description>IBM VM</description>
46
+ <param pos="0" name="service.vendor" value="IBM"/>
47
+ <param pos="0" name="service.family" value="VM"/>
48
+ <param pos="0" name="service.product" value="VM"/>
49
+ <param pos="1" name="host.name"/>
50
+ </fingerprint>
51
+ <!--
52
+ Shouldn't we ignore XEXCH50 for the same reasons than described in the XEXCH50 regex
53
+ in smtp_ehlo.xml ? -mrb
54
+ -->
55
+ <fingerprint pattern="^214[ -].* XEXCH50 *.*$">
56
+ <description>Microsoft Exchange/IIS server</description>
57
+ <param pos="0" name="service.vendor" value="Microsoft"/>
58
+ <param pos="0" name="service.family" value="Exchange Server"/>
59
+ <param pos="0" name="service.product" value="Exchange Server"/>
60
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
61
+ <param pos="0" name="os.vendor" value="Microsoft"/>
62
+ <param pos="0" name="os.family" value="Windows"/>
63
+ <param pos="0" name="os.product" value="Windows"/>
64
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
65
+ </fingerprint>
66
+ <fingerprint pattern="^214[ -]Help system currently inactive\.$">
67
+ <description>Alt-N MDaemon - 214 Help system currently inactive.</description>
68
+ <param pos="0" name="service.vendor" value="Alt-N"/>
69
+ <param pos="0" name="service.family" value="MDaemon"/>
70
+ <param pos="0" name="service.product" value="MDaemon"/>
71
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
72
+ <param pos="0" name="os.vendor" value="Microsoft"/>
73
+ <param pos="0" name="os.family" value="Windows"/>
74
+ <param pos="0" name="os.product" value="Windows"/>
75
+ <param pos="0" name="os.arch" value="x86"/>
76
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
77
+ </fingerprint>
78
+ <fingerprint pattern="^214[ -].*This is MERAK ([^ ]+\.[^ ]+\.[^ ]+).*$">
79
+ <description> Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)</description>
80
+ <param pos="0" name="service.vendor" value="Merak"/>
81
+ <param pos="0" name="service.family" value="Mail Server"/>
82
+ <param pos="0" name="service.product" value="Mail Server"/>
83
+ <param pos="1" name="service.version"/>
84
+ </fingerprint>
85
+ <fingerprint pattern="^214[ -].*This is Merak ([^ ]+\.[^ ]+\.[^ ]+).*$">
86
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x) - variant 1</description>
87
+ <param pos="0" name="service.vendor" value="Merak"/>
88
+ <param pos="0" name="service.family" value="Mail Server"/>
89
+ <param pos="0" name="service.product" value="Mail Server"/>
90
+ <param pos="1" name="service.version"/>
91
+ </fingerprint>
92
+ <fingerprint pattern="^214[ -].*bugs@merakmail\.com.*$">
93
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x) - email variant</description>
94
+ <param pos="0" name="service.vendor" value="Merak"/>
95
+ <param pos="0" name="service.family" value="Mail Server"/>
96
+ <param pos="0" name="service.product" value="Mail Server"/>
97
+ </fingerprint>
98
+ <fingerprint pattern="^214[ -].*bugs@icewarp\.com.*$">
99
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x) - icewarp variant </description>
100
+ <param pos="0" name="service.vendor" value="Merak"/>
101
+ <param pos="0" name="service.family" value="Mail Server"/>
102
+ <param pos="0" name="service.product" value="Mail Server"/>
103
+ </fingerprint>
104
+ <fingerprint pattern="^214[ -]qmail home page: http://pobox.com/~djb/qmail.html *$">
105
+ <description>QMail - help variant</description>
106
+ <example>214 qmail home page: http://pobox.com/~djb/qmail.html</example>
107
+ <param pos="0" name="service.vendor" value="qmail"/>
108
+ <param pos="0" name="service.family" value="qmail"/>
109
+ <param pos="0" name="service.product" value="qmail"/>
110
+ </fingerprint>
111
+ <fingerprint pattern="^214[ -].*contact the Digital Customer Support Center at 1-800-354-9000.*$">
112
+ <description>Sendmail on Digital OSF UNIX</description>
113
+ <param pos="0" name="service.family" value="Sendmail"/>
114
+ <param pos="0" name="service.product" value="Sendmail"/>
115
+ <param pos="0" name="service.certainty" value="0.85"/>
116
+ <param pos="0" name="os.vendor" value="DEC"/>
117
+ <param pos="0" name="os.family" value="Digital UNIX"/>
118
+ <param pos="0" name="os.product" value="OSF/1"/>
119
+ </fingerprint>
120
+ <fingerprint pattern="^214[ -]2.0.0 This is [s|S]endmail version ([^ ]+)$">
121
+ <description>Sendmail often returns version information for HELP, even when the greeting is obscured</description>
122
+ <param pos="0" name="service.family" value="Sendmail"/>
123
+ <param pos="0" name="service.product" value="Sendmail"/>
124
+ <param pos="1" name="service.version"/>
125
+ </fingerprint>
126
+ <fingerprint pattern="^214[ -]This is [s|S]endmail version ([^ ]+)$">
127
+ <description>Sendmail often returns version information for HELP - variant 1</description>
128
+ <param pos="0" name="service.family" value="Sendmail"/>
129
+ <param pos="0" name="service.product" value="Sendmail"/>
130
+ <param pos="1" name="service.version"/>
131
+ </fingerprint>
132
+ <fingerprint pattern="^502[ -]5\.3\.0 Sendmail ([^ ]+) -- HELP not implemented$">
133
+ <description>Sendmail - help not implemented variant</description>
134
+ <example>502 5.3.0 Sendmail 8.11.2 -- HELP not implemented</example>
135
+ <param pos="0" name="service.family" value="Sendmail"/>
136
+ <param pos="0" name="service.product" value="Sendmail"/>
137
+ <param pos="1" name="service.version"/>
138
+ </fingerprint>
139
+ <fingerprint pattern="^214[ -].*sendmail-bugs@sendmail\.org.*$">
140
+ <description>Sendmail often returns version information for HELP - email variant</description>
141
+ <param pos="0" name="service.family" value="Sendmail"/>
142
+ <param pos="0" name="service.product" value="Sendmail"/>
143
+ <param pos="0" name="service.certainty" value="0.85"/>
144
+ </fingerprint>
145
+ <fingerprint pattern="^241[ -].*$">
146
+ <description>ZMailer versions earlier than 2.99.21 mistakenly return the status code 241 on some HELP response lines (instead of 214).</description>
147
+ <param pos="0" name="service.vendor" value="ZMailer"/>
148
+ <param pos="0" name="service.family" value="ZMailer"/>
149
+ <param pos="0" name="service.product" value="ZMailer"/>
150
+ </fingerprint>
151
+ <fingerprint pattern="^214[ -].*Yoyodyne Propulsion.*$">
152
+ <description>ZMailer has distinctive default HELP text in smtpserver.conf</description>
153
+ <param pos="0" name="service.vendor" value="ZMailer"/>
154
+ <param pos="0" name="service.family" value="ZMailer"/>
155
+ <param pos="0" name="service.product" value="ZMailer"/>
156
+ </fingerprint>
157
+ </fingerprints>
data/xml/smtp_mailfrom.xml ADDED
@@ -0,0 +1,20 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service">
3
+ <!--
4
+ This file is currently unused.
5
+ -->
6
+ <fingerprint pattern="250 .* is syntactically correct *">
7
+ <description>exim</description>
8
+ <example>250 &lt;nosuchuser@rapid7.com&gt; is syntactically correct</example>
9
+ <param pos="0" name="service.vendor" value="exim"/>
10
+ <param pos="0" name="service.family" value="exim"/>
11
+ <param pos="0" name="service.product" value="exim"/>
12
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
13
+ </fingerprint>
14
+ <fingerprint pattern="501[ -]System error\. *">
15
+ <description>GNAT Box SMTP</description>
16
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
17
+ <param pos="0" name="service.family" value="GNAT Box"/>
18
+ <param pos="0" name="service.product" value="GNAT Box"/>
19
+ </fingerprint>
20
+ </fingerprints>
data/xml/smtp_noop.xml ADDED
@@ -0,0 +1,44 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.17">
3
+ <!--
4
+ SMTP response lines to the NOOP command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+
12
+ -->
13
+ <fingerprint pattern="^220 OK.*$">
14
+ <description>CheckPoint FireWall-1 returns code 220 for NOOP command (instead of 250)</description>
15
+ <param pos="0" name="service.vendor" value="Check Point"/>
16
+ <param pos="0" name="service.family" value="Check Point"/>
17
+ <param pos="0" name="service.product" value="Firewall-1"/>
18
+ <param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="^250[ -]2.0.0 doing nothing$">
21
+ <description>Eudora IMS - noop variant</description>
22
+ <example>250 2.0.0 doing nothing</example>
23
+ <param pos="0" name="service.vendor" value="Eudora"/>
24
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
25
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
26
+ <param pos="0" name="os.vendor" value="Apple"/>
27
+ <param pos="0" name="os.family" value="Mac OS"/>
28
+ <param pos="0" name="os.product" value="Mac OS"/>
29
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
30
+ </fingerprint>
31
+ <fingerprint pattern="^250[ -]Why is there an NOOP instruction\?$">
32
+ <description>Alt-N MDaemon - noop variant</description>
33
+ <example>250 Why is there an NOOP instruction?</example>
34
+ <param pos="0" name="service.vendor" value="Alt-N"/>
35
+ <param pos="0" name="service.family" value="MDaemon"/>
36
+ <param pos="0" name="service.product" value="MDaemon"/>
37
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
38
+ <param pos="0" name="os.vendor" value="Microsoft"/>
39
+ <param pos="0" name="os.family" value="Windows"/>
40
+ <param pos="0" name="os.product" value="Windows"/>
41
+ <param pos="0" name="os.arch" value="x86"/>
42
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
43
+ </fingerprint>
44
+ </fingerprints>
data/xml/smtp_quit.xml ADDED
@@ -0,0 +1,29 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.11">
3
+ <!--
4
+ SMTP response lines to the QUIT command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^221[ -]See ya in cyberspace$">
13
+ <description>221 See ya in cyberspace</description>
14
+ <param pos="0" name="service.vendor" value="Alt-N"/>
15
+ <param pos="0" name="service.family" value="MDaemon"/>
16
+ <param pos="0" name="service.product" value="MDaemon"/>
17
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
18
+ <param pos="0" name="os.vendor" value="Microsoft"/>
19
+ <param pos="0" name="os.family" value="Windows"/>
20
+ <param pos="0" name="os.product" value="Windows"/>
21
+ <param pos="0" name="os.arch" value="x86"/>
22
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
23
+ </fingerprint>
24
+ <fingerprint pattern="^503[ -]5\.5\.0 Not accepting any command except QUIT$">
25
+ <description>Raptor Firewall</description>
26
+ <example>503 5.5.0 Not accepting any command except QUIT</example>
27
+ <param pos="0" name="service.product" value="raptor"/>
28
+ </fingerprint>
29
+ </fingerprints>
data/xml/smtp_rcptto.xml ADDED
@@ -0,0 +1,25 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service">
3
+ <!--
4
+ <fingerprint pattern="501[ -]Invalid domain *">
5
+ <description> Description here</description>
6
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
7
+ <param pos="0" name="service.family" value="GNAT Box"/>
8
+ <param pos="0" name="service.product" value="GNAT Box"/>
9
+ </fingerprint>
10
+
11
+ <fingerprint pattern="550[ -]System error\. *">
12
+ <description>and here</description>
13
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
14
+ <param pos="0" name="service.family" value="GNAT Box"/>
15
+ <param pos="0" name="service.product" value="GNAT Box"/>
16
+ </fingerprint>
17
+ -->
18
+ <fingerprint pattern="550[ -]not local host .*, not a gateway *">
19
+ <description>550 not local host foo.bar, not a gateway</description>
20
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
21
+ <param pos="0" name="service.family" value="IMail Server"/>
22
+ <param pos="0" name="service.product" value="IMail Server"/>
23
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:-"/>
24
+ </fingerprint>
25
+ </fingerprints>