recog-intrigue 2.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/smtp_debug.xml ADDED
@@ -0,0 +1,39 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.14">
3
+ <!--
4
+ SMTP response lines to the DEBUG command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^500 No way!$">
13
+ <description>Exim</description>
14
+ <example>500 No way!</example>
15
+ <param pos="0" name="service.vendor" value="exim"/>
16
+ <param pos="0" name="service.family" value="exim"/>
17
+ <param pos="0" name="service.product" value="exim"/>
18
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="^250[ -] *Debug set -NOT!$">
21
+ <description>TIS FWTK and derivatives (other firewalls, like Gauntlet, are derived from TIS)</description>
22
+ <param pos="0" name="service.vendor" value="TIS"/>
23
+ <param pos="0" name="service.family" value="FWTK"/>
24
+ <param pos="0" name="service.product" value="FWTK"/>
25
+ </fingerprint>
26
+ <fingerprint pattern="^500[ -]What\? I don't understand that\.$">
27
+ <description>Alt-N MDaemon SMTP</description>
28
+ <example>500 What? I don't understand that.</example>
29
+ <param pos="0" name="service.vendor" value="Alt-N"/>
30
+ <param pos="0" name="service.family" value="MDaemon"/>
31
+ <param pos="0" name="service.product" value="MDaemon"/>
32
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
33
+ <param pos="0" name="os.vendor" value="Microsoft"/>
34
+ <param pos="0" name="os.family" value="Windows"/>
35
+ <param pos="0" name="os.product" value="Windows"/>
36
+ <param pos="0" name="os.arch" value="x86"/>
37
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
38
+ </fingerprint>
39
+ </fingerprints>
data/xml/smtp_ehlo.xml ADDED
@@ -0,0 +1,49 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.19">
3
+ <!--
4
+ SMTP response lines to the EHLO command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX&quot; unrecognized$">
13
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server</description>
14
+ <param pos="0" name="os.vendor" value="Cisco"/>
15
+ <param pos="0" name="os.family" value="PIX"/>
16
+ <param pos="0" name="os.product" value="PIX"/>
17
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
18
+ </fingerprint>
19
+ <!--
20
+ Don't try to infer a fingerprint from XEXCH50, because if we do, it might overwrite
21
+ a very precise MS IIS SMTP service or MS Exchange Server fingerprint found with the
22
+ help of smtp_banners.xml. Instead, this case is handled specially by the Jess rule
23
+ smtp-iis-xexch50-svc-fingerprint. -mrb
24
+
25
+ <fingerprint pattern="^250[ -] *XEXCH50.*$">
26
+ <description>
27
+ Microsoft Exchange/IIS server
28
+ </description>
29
+ <param pos="0" name="service.vendor" value="Microsoft"/>
30
+ <param pos="0" name="service.family" value="IIS"/>
31
+ <param pos="0" name="service.product" value="IIS"/>
32
+ <param pos="0" name="os.vendor" value="Microsoft"/>
33
+ <param pos="0" name="os.family" value="Windows"/>
34
+ <param pos="0" name="os.product" value="Windows"/>
35
+ </fingerprint>
36
+ -->
37
+ <fingerprint pattern="^221[ -]See ya in cyberspace$">
38
+ <description>221 See ya in cyberspace</description>
39
+ <param pos="0" name="service.vendor" value="Alt-N"/>
40
+ <param pos="0" name="service.family" value="MDaemon"/>
41
+ <param pos="0" name="service.product" value="MDaemon"/>
42
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
43
+ <param pos="0" name="os.vendor" value="Microsoft"/>
44
+ <param pos="0" name="os.family" value="Windows"/>
45
+ <param pos="0" name="os.product" value="Windows"/>
46
+ <param pos="0" name="os.arch" value="x86"/>
47
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
48
+ </fingerprint>
49
+ </fingerprints>
data/xml/smtp_expn.xml ADDED
@@ -0,0 +1,82 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.16">
3
+ <!--
4
+ SMTP response lines to the EXPN command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX.*&quot; unrecognized$">
13
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server - expn variant</description>
14
+ <param pos="0" name="os.vendor" value="Cisco"/>
15
+ <param pos="0" name="os.family" value="PIX"/>
16
+ <param pos="0" name="os.product" value="PIX"/>
17
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
18
+ </fingerprint>
19
+ <fingerprint pattern="^550[ -]EXPN not available to \(.+\) \[.+\] *$">
20
+ <description>Exim - expn variant 1</description>
21
+ <example>550 EXPN not available to (foo.bar.com) [192.168.0.1]</example>
22
+ <param pos="0" name="service.vendor" value="exim"/>
23
+ <param pos="0" name="service.family" value="exim"/>
24
+ <param pos="0" name="service.product" value="exim"/>
25
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
26
+ </fingerprint>
27
+ <fingerprint pattern="^550[ -]EXPN not available to [^ ]+ \(.+\) \[.+\] *$">
28
+ <description>Exim - expn variant 2</description>
29
+ <example>550 EXPN not available to evil.com (foo.bar.com) [192.168.0.1]</example>
30
+ <param pos="0" name="service.vendor" value="exim"/>
31
+ <param pos="0" name="service.family" value="exim"/>
32
+ <param pos="0" name="service.product" value="exim"/>
33
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
34
+ </fingerprint>
35
+ <fingerprint pattern="^500[ -]Don't you wish! *$">
36
+ <description>GNAT box SMTP</description>
37
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
38
+ <param pos="0" name="service.family" value="GNAT Box"/>
39
+ <param pos="0" name="service.product" value="GNAT Box"/>
40
+ </fingerprint>
41
+ <!-- VM SMTP server doesn't like brackets in EXPN commands... -->
42
+ <fingerprint pattern="^501[ -]Syntax Error\. Only ListId or Userid allowed as argument to this command *$">
43
+ <description>IBM VM SMTP</description>
44
+ <param pos="0" name="service.vendor" value="IBM"/>
45
+ <param pos="0" name="service.family" value="VM"/>
46
+ <param pos="0" name="service.product" value="VM"/>
47
+ </fingerprint>
48
+ <fingerprint pattern="^550[ -]lists are confidential *$">
49
+ <description>Ipswitch IMail Server - expn variant</description>
50
+ <example>550 lists are confidential</example>
51
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
52
+ <param pos="0" name="service.family" value="IMail Server"/>
53
+ <param pos="0" name="service.product" value="IMail Server"/>
54
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:-"/>
55
+ </fingerprint>
56
+ <fingerprint pattern="^502[ -]command is not active$">
57
+ <description>Alt-N MDaemon - expn variant</description>
58
+ <example>502 command is not active</example>
59
+ <param pos="0" name="service.vendor" value="Alt-N"/>
60
+ <param pos="0" name="service.family" value="MDaemon"/>
61
+ <param pos="0" name="service.product" value="MDaemon"/>
62
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
63
+ <param pos="0" name="os.vendor" value="Microsoft"/>
64
+ <param pos="0" name="os.family" value="Windows"/>
65
+ <param pos="0" name="os.product" value="Windows"/>
66
+ <param pos="0" name="os.arch" value="x86"/>
67
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
68
+ </fingerprint>
69
+ <fingerprint pattern="^252 Unable to EXPN &quot;.*&quot;, but will accept message and attempt delivery *$">
70
+ <description>Lotus Domino</description>
71
+ <param pos="0" name="service.vendor" value="Lotus"/>
72
+ <param pos="0" name="service.family" value="Lotus Domino"/>
73
+ <param pos="0" name="service.product" value="Lotus Domino"/>
74
+ </fingerprint>
75
+ <fingerprint pattern="^550[ -]Unable to find list '.*'\.$">
76
+ <description>Seattle Labs SLMail</description>
77
+ <example>550 Unable to find list 'list'.</example>
78
+ <param pos="0" name="service.vendor" value="Seattle Labs"/>
79
+ <param pos="0" name="service.family" value="SLMail"/>
80
+ <param pos="0" name="service.product" value="SLMail"/>
81
+ </fingerprint>
82
+ </fingerprints>
data/xml/smtp_help.xml ADDED
@@ -0,0 +1,157 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.18">
3
+ <!--
4
+ SMTP response lines to the HELP command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^214[ -]This is ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
13
+ <description>ArgoSoft mail server HELP response with version</description>
14
+ <example service.version="1.4.0.3">214-This is ArGoSoft Mail Server, Version 1.4 (1.4.0.3)</example>
15
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
16
+ <param pos="0" name="service.family" value="Mail Server"/>
17
+ <param pos="0" name="service.product" value="Mail Server"/>
18
+ <param pos="1" name="service.version"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="^214[ -].*support@argosoft\.com *$">
21
+ <description>ArgoSoft mail server HELP response</description>
22
+ <example>214-To report bug, send mail to support@argosoft.com</example>
23
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
24
+ <param pos="0" name="service.family" value="Mail Server"/>
25
+ <param pos="0" name="service.product" value="Mail Server"/>
26
+ </fingerprint>
27
+ <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX&quot; unrecognized$">
28
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server</description>
29
+ <param pos="0" name="os.vendor" value="Cisco"/>
30
+ <param pos="0" name="os.family" value="PIX"/>
31
+ <param pos="0" name="os.product" value="PIX"/>
32
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
33
+ </fingerprint>
34
+ <fingerprint pattern="^500[ -]5.5.1 unrecognised command HELP$">
35
+ <description>Eudora IMS uses the British spelling "unrecognised"</description>
36
+ <param pos="0" name="service.vendor" value="Eudora"/>
37
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
38
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
39
+ <param pos="0" name="os.vendor" value="Apple"/>
40
+ <param pos="0" name="os.family" value="Mac OS"/>
41
+ <param pos="0" name="os.product" value="Mac OS"/>
42
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
43
+ </fingerprint>
44
+ <fingerprint pattern="^214[ -]([^ ]+) is running the IBM VM operating system$">
45
+ <description>IBM VM</description>
46
+ <param pos="0" name="service.vendor" value="IBM"/>
47
+ <param pos="0" name="service.family" value="VM"/>
48
+ <param pos="0" name="service.product" value="VM"/>
49
+ <param pos="1" name="host.name"/>
50
+ </fingerprint>
51
+ <!--
52
+ Shouldn't we ignore XEXCH50 for the same reasons than described in the XEXCH50 regex
53
+ in smtp_ehlo.xml ? -mrb
54
+ -->
55
+ <fingerprint pattern="^214[ -].* XEXCH50 *.*$">
56
+ <description>Microsoft Exchange/IIS server</description>
57
+ <param pos="0" name="service.vendor" value="Microsoft"/>
58
+ <param pos="0" name="service.family" value="Exchange Server"/>
59
+ <param pos="0" name="service.product" value="Exchange Server"/>
60
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
61
+ <param pos="0" name="os.vendor" value="Microsoft"/>
62
+ <param pos="0" name="os.family" value="Windows"/>
63
+ <param pos="0" name="os.product" value="Windows"/>
64
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
65
+ </fingerprint>
66
+ <fingerprint pattern="^214[ -]Help system currently inactive\.$">
67
+ <description>Alt-N MDaemon - 214 Help system currently inactive.</description>
68
+ <param pos="0" name="service.vendor" value="Alt-N"/>
69
+ <param pos="0" name="service.family" value="MDaemon"/>
70
+ <param pos="0" name="service.product" value="MDaemon"/>
71
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
72
+ <param pos="0" name="os.vendor" value="Microsoft"/>
73
+ <param pos="0" name="os.family" value="Windows"/>
74
+ <param pos="0" name="os.product" value="Windows"/>
75
+ <param pos="0" name="os.arch" value="x86"/>
76
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
77
+ </fingerprint>
78
+ <fingerprint pattern="^214[ -].*This is MERAK ([^ ]+\.[^ ]+\.[^ ]+).*$">
79
+ <description> Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)</description>
80
+ <param pos="0" name="service.vendor" value="Merak"/>
81
+ <param pos="0" name="service.family" value="Mail Server"/>
82
+ <param pos="0" name="service.product" value="Mail Server"/>
83
+ <param pos="1" name="service.version"/>
84
+ </fingerprint>
85
+ <fingerprint pattern="^214[ -].*This is Merak ([^ ]+\.[^ ]+\.[^ ]+).*$">
86
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x) - variant 1</description>
87
+ <param pos="0" name="service.vendor" value="Merak"/>
88
+ <param pos="0" name="service.family" value="Mail Server"/>
89
+ <param pos="0" name="service.product" value="Mail Server"/>
90
+ <param pos="1" name="service.version"/>
91
+ </fingerprint>
92
+ <fingerprint pattern="^214[ -].*bugs@merakmail\.com.*$">
93
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x) - email variant</description>
94
+ <param pos="0" name="service.vendor" value="Merak"/>
95
+ <param pos="0" name="service.family" value="Mail Server"/>
96
+ <param pos="0" name="service.product" value="Mail Server"/>
97
+ </fingerprint>
98
+ <fingerprint pattern="^214[ -].*bugs@icewarp\.com.*$">
99
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x) - icewarp variant </description>
100
+ <param pos="0" name="service.vendor" value="Merak"/>
101
+ <param pos="0" name="service.family" value="Mail Server"/>
102
+ <param pos="0" name="service.product" value="Mail Server"/>
103
+ </fingerprint>
104
+ <fingerprint pattern="^214[ -]qmail home page: http://pobox.com/~djb/qmail.html *$">
105
+ <description>QMail - help variant</description>
106
+ <example>214 qmail home page: http://pobox.com/~djb/qmail.html</example>
107
+ <param pos="0" name="service.vendor" value="qmail"/>
108
+ <param pos="0" name="service.family" value="qmail"/>
109
+ <param pos="0" name="service.product" value="qmail"/>
110
+ </fingerprint>
111
+ <fingerprint pattern="^214[ -].*contact the Digital Customer Support Center at 1-800-354-9000.*$">
112
+ <description>Sendmail on Digital OSF UNIX</description>
113
+ <param pos="0" name="service.family" value="Sendmail"/>
114
+ <param pos="0" name="service.product" value="Sendmail"/>
115
+ <param pos="0" name="service.certainty" value="0.85"/>
116
+ <param pos="0" name="os.vendor" value="DEC"/>
117
+ <param pos="0" name="os.family" value="Digital UNIX"/>
118
+ <param pos="0" name="os.product" value="OSF/1"/>
119
+ </fingerprint>
120
+ <fingerprint pattern="^214[ -]2.0.0 This is [s|S]endmail version ([^ ]+)$">
121
+ <description>Sendmail often returns version information for HELP, even when the greeting is obscured</description>
122
+ <param pos="0" name="service.family" value="Sendmail"/>
123
+ <param pos="0" name="service.product" value="Sendmail"/>
124
+ <param pos="1" name="service.version"/>
125
+ </fingerprint>
126
+ <fingerprint pattern="^214[ -]This is [s|S]endmail version ([^ ]+)$">
127
+ <description>Sendmail often returns version information for HELP - variant 1</description>
128
+ <param pos="0" name="service.family" value="Sendmail"/>
129
+ <param pos="0" name="service.product" value="Sendmail"/>
130
+ <param pos="1" name="service.version"/>
131
+ </fingerprint>
132
+ <fingerprint pattern="^502[ -]5\.3\.0 Sendmail ([^ ]+) -- HELP not implemented$">
133
+ <description>Sendmail - help not implemented variant</description>
134
+ <example>502 5.3.0 Sendmail 8.11.2 -- HELP not implemented</example>
135
+ <param pos="0" name="service.family" value="Sendmail"/>
136
+ <param pos="0" name="service.product" value="Sendmail"/>
137
+ <param pos="1" name="service.version"/>
138
+ </fingerprint>
139
+ <fingerprint pattern="^214[ -].*sendmail-bugs@sendmail\.org.*$">
140
+ <description>Sendmail often returns version information for HELP - email variant</description>
141
+ <param pos="0" name="service.family" value="Sendmail"/>
142
+ <param pos="0" name="service.product" value="Sendmail"/>
143
+ <param pos="0" name="service.certainty" value="0.85"/>
144
+ </fingerprint>
145
+ <fingerprint pattern="^241[ -].*$">
146
+ <description>ZMailer versions earlier than 2.99.21 mistakenly return the status code 241 on some HELP response lines (instead of 214).</description>
147
+ <param pos="0" name="service.vendor" value="ZMailer"/>
148
+ <param pos="0" name="service.family" value="ZMailer"/>
149
+ <param pos="0" name="service.product" value="ZMailer"/>
150
+ </fingerprint>
151
+ <fingerprint pattern="^214[ -].*Yoyodyne Propulsion.*$">
152
+ <description>ZMailer has distinctive default HELP text in smtpserver.conf</description>
153
+ <param pos="0" name="service.vendor" value="ZMailer"/>
154
+ <param pos="0" name="service.family" value="ZMailer"/>
155
+ <param pos="0" name="service.product" value="ZMailer"/>
156
+ </fingerprint>
157
+ </fingerprints>
data/xml/smtp_mailfrom.xml ADDED
@@ -0,0 +1,20 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service">
3
+ <!--
4
+ This file is currently unused.
5
+ -->
6
+ <fingerprint pattern="250 .* is syntactically correct *">
7
+ <description>exim</description>
8
+ <example>250 &lt;nosuchuser@rapid7.com&gt; is syntactically correct</example>
9
+ <param pos="0" name="service.vendor" value="exim"/>
10
+ <param pos="0" name="service.family" value="exim"/>
11
+ <param pos="0" name="service.product" value="exim"/>
12
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
13
+ </fingerprint>
14
+ <fingerprint pattern="501[ -]System error\. *">
15
+ <description>GNAT Box SMTP</description>
16
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
17
+ <param pos="0" name="service.family" value="GNAT Box"/>
18
+ <param pos="0" name="service.product" value="GNAT Box"/>
19
+ </fingerprint>
20
+ </fingerprints>
data/xml/smtp_noop.xml ADDED
@@ -0,0 +1,44 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.17">
3
+ <!--
4
+ SMTP response lines to the NOOP command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+
12
+ -->
13
+ <fingerprint pattern="^220 OK.*$">
14
+ <description>CheckPoint FireWall-1 returns code 220 for NOOP command (instead of 250)</description>
15
+ <param pos="0" name="service.vendor" value="Check Point"/>
16
+ <param pos="0" name="service.family" value="Check Point"/>
17
+ <param pos="0" name="service.product" value="Firewall-1"/>
18
+ <param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="^250[ -]2.0.0 doing nothing$">
21
+ <description>Eudora IMS - noop variant</description>
22
+ <example>250 2.0.0 doing nothing</example>
23
+ <param pos="0" name="service.vendor" value="Eudora"/>
24
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
25
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
26
+ <param pos="0" name="os.vendor" value="Apple"/>
27
+ <param pos="0" name="os.family" value="Mac OS"/>
28
+ <param pos="0" name="os.product" value="Mac OS"/>
29
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
30
+ </fingerprint>
31
+ <fingerprint pattern="^250[ -]Why is there an NOOP instruction\?$">
32
+ <description>Alt-N MDaemon - noop variant</description>
33
+ <example>250 Why is there an NOOP instruction?</example>
34
+ <param pos="0" name="service.vendor" value="Alt-N"/>
35
+ <param pos="0" name="service.family" value="MDaemon"/>
36
+ <param pos="0" name="service.product" value="MDaemon"/>
37
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
38
+ <param pos="0" name="os.vendor" value="Microsoft"/>
39
+ <param pos="0" name="os.family" value="Windows"/>
40
+ <param pos="0" name="os.product" value="Windows"/>
41
+ <param pos="0" name="os.arch" value="x86"/>
42
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
43
+ </fingerprint>
44
+ </fingerprints>
data/xml/smtp_quit.xml ADDED
@@ -0,0 +1,29 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service" preference="0.11">
3
+ <!--
4
+ SMTP response lines to the QUIT command are matched against these patterns
5
+ (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ See comment at the top of smtp_banners.xml for additional info.
8
+
9
+ 'preference' note: This value has been set so as to implement the ordering
10
+ of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
+ -->
12
+ <fingerprint pattern="^221[ -]See ya in cyberspace$">
13
+ <description>221 See ya in cyberspace</description>
14
+ <param pos="0" name="service.vendor" value="Alt-N"/>
15
+ <param pos="0" name="service.family" value="MDaemon"/>
16
+ <param pos="0" name="service.product" value="MDaemon"/>
17
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
18
+ <param pos="0" name="os.vendor" value="Microsoft"/>
19
+ <param pos="0" name="os.family" value="Windows"/>
20
+ <param pos="0" name="os.product" value="Windows"/>
21
+ <param pos="0" name="os.arch" value="x86"/>
22
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
23
+ </fingerprint>
24
+ <fingerprint pattern="^503[ -]5\.5\.0 Not accepting any command except QUIT$">
25
+ <description>Raptor Firewall</description>
26
+ <example>503 5.5.0 Not accepting any command except QUIT</example>
27
+ <param pos="0" name="service.product" value="raptor"/>
28
+ </fingerprint>
29
+ </fingerprints>
data/xml/smtp_rcptto.xml ADDED
@@ -0,0 +1,25 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="smtp" database_type="service">
3
+ <!--
4
+ <fingerprint pattern="501[ -]Invalid domain *">
5
+ <description> Description here</description>
6
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
7
+ <param pos="0" name="service.family" value="GNAT Box"/>
8
+ <param pos="0" name="service.product" value="GNAT Box"/>
9
+ </fingerprint>
10
+
11
+ <fingerprint pattern="550[ -]System error\. *">
12
+ <description>and here</description>
13
+ <param pos="0" name="service.vendor" value="Global Technology Associates"/>
14
+ <param pos="0" name="service.family" value="GNAT Box"/>
15
+ <param pos="0" name="service.product" value="GNAT Box"/>
16
+ </fingerprint>
17
+ -->
18
+ <fingerprint pattern="550[ -]not local host .*, not a gateway *">
19
+ <description>550 not local host foo.bar, not a gateway</description>
20
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
21
+ <param pos="0" name="service.family" value="IMail Server"/>
22
+ <param pos="0" name="service.product" value="IMail Server"/>
23
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:-"/>
24
+ </fingerprint>
25
+ </fingerprints>