recog-intrigue 2.3.7

data/features/data/failing_banners_fingerprints.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<fingerprints>
+  <fingerprint pattern="^=\(.\*.\)=-\.:\. \(\( Welcome to PureFTPd (\d+\..+) \)\) \.:\.-=\(.\*.\)=-$">
+    <example>=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-</example>
+    <description>Older Pure-FTPd versions</description>
+    <param pos="0" name="service.family" value="Pure-FTPd"/>
+    <param pos="0" name="service.product" value="Pure-FTPd"/>
+    <param pos="1" name="service.version"/>
+  </fingerprint>
+  <fingerprint pattern="^(\S+) FTP Server \(Solaris (\S+)\) ready\.?$" flags="REG_ICASE">
+    <description>SunOS/Solaris</description>
+    <example>example.com FTP server (Solaris 5.7) ready.</example>
+    <param pos="0" name="os.vendor" value="Sun"/>
+    <param pos="0" name="os.family" value="Solaris"/>
+    <param pos="0" name="os.product" value="Solaris"/>
+    <param pos="0" name="os.device" value="General"/>
+    <param pos="1" name="host.name"/>
+    <param pos="2" name="os.version"/>
+  </fingerprint>
+</fingerprints>

data/features/data/matching_banners_fingerprints.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<fingerprints protocol="ftp" database_type="service">
+  <fingerprint pattern="^-{10} Welcome to Pure-FTPd (.*)-{10}$">
+    <example>---------- Welcome to Pure-FTPd ----------</example>
+    <description>Pure-FTPd
+      Config data can be zero or more of: [privsep] [TLS]
+      </description>
+    <param pos="1" name="pureftpd.config"/>
+    <param pos="0" name="service.family" value="Pure-FTPd"/>
+    <param pos="0" name="service.product" value="Pure-FTPd"/>
+    <param pos="0" name="service.protocol" value="ftp"/>
+  </fingerprint>
+  <fingerprint pattern="^(\S+) FTP Server \(SunOS (\S+)\) ready\.?$" flags="REG_ICASE">
+    <description>SunOS/Solaris</description>
+    <example>example.com FTP server (SunOS 5.7) ready.</example>
+    <param pos="0" name="os.vendor" value="Sun"/>
+    <param pos="0" name="os.family" value="Solaris"/>
+    <param pos="0" name="os.product" value="Solaris"/>
+    <param pos="0" name="os.device" value="General"/>
+    <param pos="1" name="host.name"/>
+    <param pos="2" name="os.version"/>
+  </fingerprint>
+</fingerprints>

data/features/data/multiple_banners_fingerprints.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<fingerprints>
+  <fingerprint pattern="FTP">
+    <example>---- FTP Stuff ----</example>
+    <example>FTP server</example>
+    <description>Generic FTP,
+      Checks for the existence of the word FTP in the line
+    </description>
+    <!-- Asserting nothing -->
+  </fingerprint>
+  <fingerprint pattern="^-{10} Welcome to Pure-FTPd (.*)-{10}$">
+    <example>---------- Welcome to Pure-FTPd ----------</example>
+    <description>Pure-FTPd
+      Config data can be zero or more of: [privsep] [TLS]
+    </description>
+    <param pos="1" name="pureftpd.config"/>
+    <param pos="0" name="service.family" value="Pure-FTPd"/>
+    <param pos="0" name="service.product" value="Pure-FTPd"/>
+    <param pos="0" name="service.protocol" value="ftp"/>
+  </fingerprint>
+  <fingerprint pattern="^(\S+) FTP Server \(SunOS (\S+)\) ready\.?$" flags="REG_ICASE">
+    <description>SunOS/Solaris</description>
+    <example>example.com FTP server (SunOS 5.7) ready.</example>
+    <param pos="0" name="service.protocol" value="ftp"/>
+    <param pos="0" name="os.vendor" value="Sun"/>
+    <param pos="0" name="os.family" value="Solaris"/>
+    <param pos="0" name="os.product" value="Solaris"/>
+    <param pos="0" name="os.device" value="General"/>
+    <param pos="1" name="host.name"/>
+    <param pos="2" name="os.version"/>
+  </fingerprint>
+</fingerprints>

data/features/data/no_tests.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0"?>
+<fingerprints>
+</fingerprints>

data/features/data/sample_banner.txt

@@ -0,0 +1,2 @@
+---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
+polaris FTP server (SunOS 5.8) ready.

data/features/data/successful_tests.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<fingerprints>
+   <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.x]+)$">
+      <description>Cisco SIPGateway</description>
+      <example os.version="12.x">Cisco-SIPGateway/IOS-12.x</example>
+      <param pos="0" name="os.vendor" value="Cisco"/>
+      <param pos="0" name="os.product" value="IOS"/>
+      <param pos="1" name="os.version"/>
+   </fingerprint>
+   <fingerprint pattern="^bar ([\d.]+)$">
+     <description>bar test</description>
+     <example os.version="1.0" >bar 1.0</example>
+     <example os.version="2.0" >bar 2.0</example>
+     <example os.version="2.1" >bar 2.1</example>
+     <param pos="1" name="os.version" />
+     <param pos="0" name="os.name" value="Bar" />
+   </fingerprint>
+</fingerprints>

data/features/data/tests_with_failures.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<fingerprints>
+   <fingerprint pattern="^foo$">
+     <description>foo test</description>
+     <!-- Fail: doesn't match -->
+     <example>bar</example>
+   </fingerprint>
+   <fingerprint pattern="^This matches$">
+     <!-- Warn: no name -->
+     <!-- Fail: doesn't match -->
+     <example>This almost matches</example>
+   </fingerprint>
+   <fingerprint pattern="^(\S+) ([\d.]+)$">
+     <description>bar test</description>
+     <!-- Fail: expected os.version doesn't match the capture group -->
+     <example os.version="5.0" >bar 1.0</example>
+     <param pos="2" name="os.version" />
+     <param pos="1" name="os.name" value="Bar" />
+   </fingerprint>
+</fingerprints>

data/features/data/tests_with_warnings.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<fingerprints>
+  <fingerprint pattern="^-{10} Welcome to Pure-FTPd (.*)-{10}$">
+    <example pureftpd.config="">---------- Welcome to Pure-FTPd ----------</example>
+    <description>Pure-FTPd</description>
+    <param pos="1" name="pureftpd.config"/>
+    <param pos="0" name="service.family" value="Pure-FTPd"/>
+    <param pos="0" name="service.product" value="Pure-FTPd"/>
+  </fingerprint>
+  <fingerprint pattern="^-{10} Welcome to Pure-FTPd (.*)-{10}$">
+    <!-- should warn with no examples -->
+    <description>Pure-FTPd</description>
+    <param pos="1" name="pureftpd.config"/>
+    <param pos="0" name="service.family" value="Pure-FTPd"/>
+    <param pos="0" name="service.product" value="Pure-FTPd"/>
+  </fingerprint>
+</fingerprints>

data/features/match.feature

@@ -0,0 +1,36 @@
+Feature: Match
+  @no-clobber
+  Scenario: Finds matches
+    When I run `recog_match matching_banners_fingerprints.xml sample_banner.txt`
+    Then it should pass with:
+      """
+      MATCH: {"matched"=>"Pure-FTPd Config data can be zero or more of: [privsep] [TLS]", "pureftpd.config"=>"[privsep] [TLS] ", "service.family"=>"Pure-FTPd", "service.product"=>"Pure-FTPd", "service.protocol"=>"ftp", "fingerprint_db"=>"matching_banners_fingerprints", "data"=>"---------- Welcome to Pure-FTPd [privsep] [TLS] ----------"}
+      MATCH: {"matched"=>"SunOS/Solaris", "os.vendor"=>"Sun", "os.family"=>"Solaris", "os.product"=>"Solaris", "os.device"=>"General", "host.name"=>"polaris", "os.version"=>"5.8", "service.protocol"=>"ftp", "fingerprint_db"=>"matching_banners_fingerprints", "data"=>"polaris FTP server (SunOS 5.8) ready."}
+      """
+
+  @no-clobber
+  Scenario: Fails at finding matches
+    When I run `recog_match failing_banners_fingerprints.xml sample_banner.txt`
+    Then it should pass with:
+      """
+      FAIL: ---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
+      FAIL: polaris FTP server (SunOS 5.8) ready
+      """
+
+  @no-clobber
+  Scenario: Finds multiple matches
+    When I run `recog_match multiple_banners_fingerprints.xml sample_banner.txt --multi-match`
+    Then it should pass with:
+      """
+      MATCHES: {"matched"=>"Generic FTP, Checks for the existence of the word FTP in the line", "service.protocol"=>"", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"---------- Welcome to Pure-FTPd [privsep] [TLS] ----------"},{"matched"=>"Pure-FTPd Config data can be zero or more of: [privsep] [TLS]", "pureftpd.config"=>"[privsep] [TLS] ", "service.family"=>"Pure-FTPd", "service.product"=>"Pure-FTPd", "service.protocol"=>"ftp", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"---------- Welcome to Pure-FTPd [privsep] [TLS] ----------"}
+      MATCHES: {"matched"=>"Generic FTP, Checks for the existence of the word FTP in the line", "service.protocol"=>"", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"polaris FTP server (SunOS 5.8) ready."},{"matched"=>"SunOS/Solaris", "service.protocol"=>"ftp", "os.vendor"=>"Sun", "os.family"=>"Solaris", "os.product"=>"Solaris", "os.device"=>"General", "host.name"=>"polaris", "os.version"=>"5.8", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"polaris FTP server (SunOS 5.8) ready."}
+      """
+
+  @no-clobber
+  Scenario: Finds first matches using no-multi-match flag
+    When I run `recog_match multiple_banners_fingerprints.xml sample_banner.txt --no-multi-match`
+    Then it should pass with:
+    """
+    MATCH: {"matched"=>"Generic FTP, Checks for the existence of the word FTP in the line", "service.protocol"=>"", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"---------- Welcome to Pure-FTPd [privsep] [TLS] ----------"}
+    MATCH: {"matched"=>"Generic FTP, Checks for the existence of the word FTP in the line", "service.protocol"=>"", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"polaris FTP server (SunOS 5.8) ready."}
+    """

data/features/support/aruba.rb

@@ -0,0 +1,3 @@
+Aruba.configure do |config|
+  config.working_directory = 'features/data'
+end

data/features/support/env.rb

@@ -0,0 +1,6 @@
+require 'aruba/cucumber'
+
+Before do
+  @dirs = ["features/data"]
+  @aruba_timeout_seconds = 30
+end

data/features/verify.feature

@@ -0,0 +1,48 @@
+Feature: Verify
+  @no-clobber
+  Scenario: No tests
+    When I run `recog_verify no_tests.xml`
+    Then it should pass with:
+      """
+      SUMMARY: Test completed with 0 successful, 0 warnings, and 0 failures
+      """
+
+  @no-clobber
+  Scenario: Successful tests
+    When I run `recog_verify successful_tests.xml`
+    Then it should pass with:
+      """
+      SUMMARY: Test completed with 4 successful, 0 warnings, and 0 failures
+      """
+
+  @no-clobber
+  Scenario: Tests with warnings, warnings enabled
+    When I run `recog_verify tests_with_warnings.xml`
+    Then it should fail with:
+      """
+      WARN: 'Pure-FTPd' has no test cases
+      WARN: 'Pure-FTPd' is missing an example that checks for parameter 'pureftpd.config' messsage which is derived from a capture group
+      SUMMARY: Test completed with 1 successful, 2 warnings, and 0 failures
+      """
+    And the exit status should be 2
+
+  @no-clobber
+  Scenario: Tests with warnings, warnings disabled
+    When I run `recog_verify --no-warnings tests_with_warnings.xml`
+    Then it should pass with:
+      """
+      SUMMARY: Test completed with 1 successful, 0 warnings, and 0 failures
+      """
+
+  @no-clobber
+  Scenario: Tests with failures
+    When I run `recog_verify tests_with_failures.xml`
+    Then it should fail with:
+      """
+      FAIL: 'foo test' failed to match "bar" with (?-mix:^foo$)'
+      FAIL: '' failed to match "This almost matches" with (?-mix:^This matches$)'
+      FAIL: 'bar test's os.name is a non-zero pos but specifies a value of 'Bar'
+      FAIL: 'bar test' failed to find expected capture group os.version '5.0'. Result was 1.0
+      SUMMARY: Test completed with 0 successful, 0 warnings, and 4 failures
+      """
+    And the exit status should be 4

data/identifiers/README.md

@@ -0,0 +1,47 @@
+# Recog: Identifiers
+
+This directory contains lists of standard identifiers for mapping Recog matches. The goal is define a standard set of constants to represent known software, hardware, vendors, and categories.
+
+This is currently incomplete and will be updated as standardization work moves forward.
+
+Fingerprints should use these identifiers whenever possible; if a different name or syntax for a given identifier is preferred, this should be implemented in the application through a mapping function.
+
+## Lists
+
+### Vendors
+
+`vendor.txt` defines known vendor names, covering services, operating systems, and hardware.
+
+### Operating Systems
+
+`os_architecture.txt` defines known CPU types.
+
+`os_product.txt` defines known operating system names.
+
+`os_family.txt` defines known operating system families.
+
+`os_device.txt` defines known types of devices by function or purpose.
+
+### Services
+
+`service_product.txt` defines known service product names.
+
+`service_family.txt` defines known service product families.
+
+### Software
+
+`software_product.txt` defines known software product names.
+
+`software_family.txt` defines known software product families.
+
+`software_class.txt` defines known types of software by function or purpose.
+
+## Pending Work
+
+  * All existing fingerprints should be correlated against these lists to identify mismatches and updated accordingly.
+
+  * All net new identifiers from the existing fingerprints should be merged into these lists.
+
+  * All fingerprint assertions should be enumerated, documented, and standardized where possible (`host.mac`, etc).
+
+  * Hardware identifiers should be enumerated, consolidated, and standardized.

data/identifiers/os_architecture.txt

@@ -0,0 +1,20 @@
+680xx
+880xx
+Alpha
+ARM
+ARM64
+ia64
+iSeries
+MIPS
+MIPS64
+MPC
+PA
+PowerPC
+pSeries
+Risc
+s390
+s390x
+Sparc
+System/6000
+x86
+x86_64

data/identifiers/os_device.txt

@@ -0,0 +1,52 @@
+BBS
+Bridge
+Broadband router
+Console server
+CSU/DSU
+Domain controller
+DSLAM
+Encryption accelerator
+Fax server
+File server
+Firewall
+Game console
+General
+Hub
+IPS
+KVM
+Lights Out Management
+Load balancer
+Mainframe
+Management
+Monitoring
+Multifunction Device
+Multiplexer
+NAC
+Network management device
+PBX
+PDA
+Point of sale
+Power device
+Print server
+Printer
+Remote access server
+Router
+Scanner
+Server
+Specialized
+Storage
+Switch
+Tablet
+Tape library
+Telecom
+Terminal server
+UPS
+Virtualization host
+VoIP
+VPN
+WAP
+Web cam
+Web proxy
+Web server
+Workstation
+X terminal

data/identifiers/os_family.txt

@@ -0,0 +1,160 @@
+A/UX
+Adaptive Security Appliance
+Aficio
+AirPort
+AIX
+AmigaOS
+AMOS
+AOS
+AOS/VS
+APC
+Atari
+AtheOS
+AuspexOS
+BeOS
+BIG-IP
+Brocade
+BSD
+BSDi
+CacheOS
+CatOS
+CBOS
+CentOS
+Check Point
+Clix
+ComOS
+ConnectUPS
+Content Networking System
+ConvexOS
+Cyras
+CyROS
+DART
+Data ONTAP
+Dell Remote Access Controller
+DG/UX
+Digital UNIX
+Domain/OS
+DOS
+Dynix
+Embedded
+ES
+ExtremeWare
+Firewall-1
+Fortinet
+FreeBSD
+GAiA
+GigaVUE HD
+GigaVUE TA
+HI-UX
+HP-UX
+Hurd
+iLO
+IM Series
+Imagistics
+Integrated Dell Remote Access Controller
+IOS
+IPS
+IPSO
+Irix
+Ironware
+JetDirect
+Junos
+KA9Q
+LaserJet
+Linux
+lwIP
+LynxOS
+Mac OS
+Mac OS X
+Mach
+Madge CrossFire
+MAXserver
+MedNet
+Minix
+MPE/iX
+MT
+MVS
+NC Series
+NetBSD
+NetCache
+Netopia
+NetOS
+NetStation
+NetVanta
+NetWare
+NewsOS
+Newton OS
+Nexpose
+NEXTSTEP
+NmpSW
+NX-OS
+OpenBSD
+OpenROUTE
+OpenServer
+OpenVMS
+OS/2
+OS/390
+OS/400
+OS-9
+PacketShaper pSOS
+PalmOS
+Palo Alto
+PAN-OS
+PIX
+Plan9
+ProCurve
+ProLiant
+QNX
+Raptor
+Reliant UNIX
+RISC OS
+RouterOS
+RS
+RT
+SAN-OS
+SCO UNIX
+ScreenOS
+SHARP AR Series
+SHARP MX Series
+SINIX
+Solaris
+SpeedTouch
+SPP-UX
+SSL-VPN
+StackTOS
+SunOS
+SVR4
+Tahoe OS
+Tandem NSK
+Taos
+ThreadX
+TINIOS
+TiOS
+TOPS-20
+Tru64 UNIX
+Ubuntu
+UCOS
+UCS
+Ultrasound Device
+Ultrix
+UnicOS
+Unisys
+UnixWare
+UX/4800
+VG200
+VirtuOS
+VM
+VM/CMS
+VM/ESA
+VMS
+VMware ESX/ESXi
+VOS
+VRP
+VxWorks
+WAAS
+Wide Format Printer
+Windows
+Worldgroup
+xMach
+z/OS
+ZyNOS