recog-intrigue 2.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/telnet_banners.xml ADDED
@@ -0,0 +1,1595 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints protocol="telnet" database_type="service" preference=".80">
3
+ <!--
4
+ TELNET banners with CR/LF/whitespace trimmed from either end.
5
+ Examples with CR, LF, etc must be base64 encoded in order to past tests.
6
+ Please follow the style established below.
7
+ -->
8
+ <!--
9
+ The following 'assert nothing' block is intended to handle banners so simple
10
+ that they cannot be attributed to a product or vendor. They are at the
11
+ beginning of the file as a performance tweak given how frequenty they occur.
12
+
13
+ NOTE:
14
+ Due to the multi-line nature of TELNET banners the regex are leveraging \A
15
+ instead of ^ to prevent matching in the beginning of a 'line' (^) instead of
16
+ at the beginning of the string (\A). This has been verified to work with
17
+ Ruby, Python, Java, and Golang.
18
+ -->
19
+ <fingerprint pattern="\A(?i)(?:\r|\n)*login:\s*$">
20
+ <description>bare 'login:' -- assert nothing.</description>
21
+ <example>login:</example>
22
+ </fingerprint>
23
+ <fingerprint pattern="\A(?i)(?:\r|\n)*User(?:name)?\s*:\s*$">
24
+ <description>bare 'Username:' -- assert nothing.</description>
25
+ <example>Username:</example>
26
+ <example>User:</example>
27
+ </fingerprint>
28
+ <fingerprint pattern="\A(?i)(?:\r|\n)*Password:\s*$">
29
+ <description>bare 'Password:' -- assert nothing.</description>
30
+ <example>Password:</example>
31
+ </fingerprint>
32
+ <fingerprint pattern="\A(?i)(?:\r|\n)*Account:\s*$">
33
+ <description>bare 'Account:' -- assert nothing.</description>
34
+ <example>Account:</example>
35
+ </fingerprint>
36
+ <fingerprint pattern="\A(?i)Connection refused(?:\r|\n)*$">
37
+ <description>bare 'Connection refused' -- assert nothing.</description>
38
+ <example>Connection refused</example>
39
+ </fingerprint>
40
+ <!-- end of assert nothing block -->
41
+ <fingerprint pattern="^(?:\r|\n)*User Access Verification(?:\r|\n)+(?:Username|Password):\s*$">
42
+ <description>Cisco switch or router - user access variant</description>
43
+ <!-- User Access Verification\r\n\r\nUsername: -->
44
+ <example _encoding="base64">VXNlciBBY2Nlc3MgVmVyaWZpY2F0aW9uDQoNClVzZXJuYW1lOgo=</example>
45
+ <!-- User Access Verification\r\n\r\nPassword: -->
46
+ <example _encoding="base64">VXNlciBBY2Nlc3MgVmVyaWZpY2F0aW9uDQoNClBhc3N3b3JkOgo=</example>
47
+ <param pos="0" name="service.vendor" value="Cisco"/>
48
+ <param pos="0" name="os.vendor" value="Cisco"/>
49
+ <param pos="0" name="hw.vendor" value="Cisco"/>
50
+ </fingerprint>
51
+ <fingerprint pattern="^(?:\r|\n)*Password required, but none set(?:\r|\n)*$">
52
+ <description>Cisco switch or router - password not set variant</description>
53
+ <example>Password required, but none set</example>
54
+ <param pos="0" name="service.vendor" value="Cisco"/>
55
+ <param pos="0" name="os.vendor" value="Cisco"/>
56
+ <param pos="0" name="hw.vendor" value="Cisco"/>
57
+ </fingerprint>
58
+ <fingerprint pattern="^(?:\r|\n)*MikroTik v([\w.]+)(?: \(\w+\))?(?:\r|\n)+Login:\s*$">
59
+ <description>MikroTik RouterOS</description>
60
+ <!-- MikroTik v5.2\r\nLogin: -->
61
+ <example _encoding="base64" os.version="5.2">TWlrcm9UaWsgdjUuMg0KTG9naW46Cg==</example>
62
+ <!-- MikroTik v6.42.3 (stable)\r\nLogin: -->
63
+ <example _encoding="base64" os.version="6.42.3">TWlrcm9UaWsgdjYuNDIuMyAoc3RhYmxlKQ0KTG9naW46Cg==</example>
64
+ <!-- MikroTik v6.40.8 (bugfix)\r\nLogin: -->
65
+ <example _encoding="base64" os.version="6.40.8">TWlrcm9UaWsgdjYuNDAuOCAoYnVnZml4KQ0KTG9naW46Cg==</example>
66
+ <!-- MikroTik v6.36rc12 (testing)\r\nLogin: -->
67
+ <example _encoding="base64" os.version="6.36rc12">TWlrcm9UaWsgdjYuMzZyYzEyICh0ZXN0aW5nKQ0KTG9naW46Cg==</example>
68
+ <param pos="0" name="os.vendor" value="MikroTik"/>
69
+ <param pos="0" name="os.device" value="Router"/>
70
+ <param pos="0" name="os.product" value="RouterOS"/>
71
+ <param pos="1" name="os.version"/>
72
+ <param pos="0" name="os.cpe23" value="cpe:/o:mikrotik:routeros:{os.version}"/>
73
+ <param pos="0" name="hw.vendor" value="MikroTik"/>
74
+ <param pos="0" name="hw.device" value="Router"/>
75
+ </fingerprint>
76
+ <fingerprint pattern="^(?:\r|\n)?ZXHN (\w+)(?: V([\d.]+))?(?:\r|\n)*Login:\s*$">
77
+ <description>ZTE ZXHN router</description>
78
+ <!-- ZXHN H108N\r\nLogin: -->
79
+ <example _encoding="base64" hw.product="H108N">WlhITiBIMTA4Tg0KTG9naW46Cg==</example>
80
+ <!-- ZXHN H298A V1.1\r\nLogin: -->
81
+ <example _encoding="base64" hw.product="H298A" hw.version="1.1">WlhITiBIMjk4QSBWMS4xDQpMb2dpbjoK</example>
82
+ <!-- ZXHN H367N\r\n\rLogin: -->
83
+ <example _encoding="base64" hw.product="H367N">WlhITiBIMzY3Tg0KDUxvZ2luOgo=</example>
84
+ <param pos="0" name="hw.vendor" value="ZTE"/>
85
+ <param pos="0" name="hw.device" value="Router"/>
86
+ <param pos="0" name="hw.family" value="ZXHN"/>
87
+ <param pos="1" name="hw.product"/>
88
+ <param pos="2" name="hw.version"/>
89
+ </fingerprint>
90
+ <fingerprint pattern="^(F6\d+\w?)\r\n\rLogin:\s*$">
91
+ <description>ZTE F6xx series GPON router</description>
92
+ <!-- F668\r\n\rLogin: -->
93
+ <example _encoding="base64" hw.product="F668">RjY2OA0KDUxvZ2luOgo=</example>
94
+ <!-- F612W\r\n\rLogin: -->
95
+ <example _encoding="base64" hw.product="F612W">RjYxMlcNCg1Mb2dpbjoK</example>
96
+ <param pos="0" name="hw.vendor" value="ZTE"/>
97
+ <param pos="0" name="hw.device" value="Router"/>
98
+ <param pos="1" name="hw.product"/>
99
+ </fingerprint>
100
+ <fingerprint pattern="^(?:\r|\n)*DD-WRT v([\d.]+)(?:-(\w+))? ([\w-]+) \(c\) \d{4} NewMedia-NET GmbH(?:\r|\n)+Release: \d+\/\d+\/\d+ \(SVN revision: ([:\w]+)\)(?:\r|\n)+.* login:\s*$">
101
+ <description>DD-WRT - 24 family</description>
102
+ <!-- DD-WRT v24-sp2 mini (c) 2013 NewMedia-NET GmbH\r\nRelease: 05/27/13 (SVN revision: 21676)\r\n\r\nDD-WRT login: -->
103
+ <example _encoding="base64" os.version="24" os.version.version="sp2" os.edition="mini" os.build="21676">
104
+ REQtV1JUIHYyNC1zcDIgbWluaSAoYykgMjAxMyBOZXdNZWRpYS1ORVQgR21iSA0KUmVsZWFzZ
105
+ TogMDUvMjcvMTMgKFNWTiByZXZpc2lvbjogMjE2NzYpDQoNCkRELVdSVCBsb2dpbjoK
106
+ </example>
107
+ <!-- DD-WRT v24 micro (c) 2010 NewMedia-NET GmbH\r\nRelease: 08/07/10 (SVN revision: 14896)\r\n\r\nProliant DL980R07 X6550 8-core 4P SAS login: -->
108
+ <example _encoding="base64" os.version="24" os.edition="micro" os.build="14896">
109
+ REQtV1JUIHYyNCBtaWNybyAoYykgMjAxMCBOZXdNZWRpYS1ORVQgR21iSA0KUmVsZWFzZTogM
110
+ DgvMDcvMTAgKFNWTiByZXZpc2lvbjogMTQ4OTYpDQoNClByb2xpYW50IERMOTgwUjA3IFg2NT
111
+ UwIDgtY29yZSA0UCBTQVMgbG9naW46Cg==
112
+ </example>
113
+ <param pos="0" name="os.vendor" value="DD-WRT"/>
114
+ <param pos="0" name="os.product" value="DD-WRT"/>
115
+ <param pos="0" name="os.device" value="Router"/>
116
+ <param pos="1" name="os.version"/>
117
+ <param pos="2" name="os.version.version"/>
118
+ <param pos="3" name="os.edition"/>
119
+ <param pos="4" name="os.build"/>
120
+ <param pos="0" name="hw.device" value="Router"/>
121
+ </fingerprint>
122
+ <fingerprint pattern="^(?:\r|\n)*DD-WRT v(3.\d)-(r([\w]+)) ([\w-]+) \(c\) \d{4} NewMedia-NET GmbH(?:\r|\n)+Release: \d+\/\d+\/\d+(?:\r|\n)+.* login:\s*$">
123
+ <description>DD-WRT - 3.0 family</description>
124
+ <!-- DD-WRT v3.0-r34886M std (c) 2018 NewMedia-NET GmbH\r\nRelease: 02/10/18\r\n\r\nwibrate login: -->
125
+ <example _encoding="base64" os.version="3.0" os.version.version="r34886M" os.edition="std" os.build="34886M">
126
+ REQtV1JUIHYzLjAtcjM0ODg2TSBzdGQgKGMpIDIwMTggTmV3TWVkaWEtTkVUIEdtYkgNClJlb
127
+ GVhc2U6IDAyLzEwLzE4DQoNCndpYnJhdGUgbG9naW46Cg==
128
+ </example>
129
+ <param pos="0" name="os.vendor" value="DD-WRT"/>
130
+ <param pos="0" name="os.product" value="DD-WRT"/>
131
+ <param pos="0" name="os.device" value="Router"/>
132
+ <param pos="1" name="os.version"/>
133
+ <param pos="2" name="os.version.version"/>
134
+ <param pos="3" name="os.build"/>
135
+ <param pos="4" name="os.edition"/>
136
+ <param pos="0" name="hw.device" value="Router"/>
137
+ </fingerprint>
138
+ <fingerprint pattern="^(TD-\w+) [\d.]+ DSL Modem Router(?:\r|\n)+Authorization failed after trying \d+ times!!!\.(?:\r|\n)+Please login after \d+ seconds!\s*$">
139
+ <description>TP-LINK TD Family DSL Modem/Router</description>
140
+ <!-- TD-W8960N 5.0 DSL Modem Router\r\nAuthorization failed after trying 5 times!!!.\r\nPlease login after 416 seconds! -->
141
+ <example _encoding="base64" hw.product="TD-W8960N">
142
+ VEQtVzg5NjBOIDUuMCBEU0wgTW9kZW0gUm91dGVyDQpBdXRob3JpemF0aW9uIGZhaWxlZCBhZ
143
+ nRlciB0cnlpbmcgNSB0aW1lcyEhIS4NClBsZWFzZSBsb2dpbiBhZnRlciA0MTYgc2Vjb25kcy
144
+ E=
145
+ </example>
146
+ <param pos="0" name="hw.vendor" value="TP-Link"/>
147
+ <param pos="1" name="hw.product"/>
148
+ <param pos="0" name="hw.device" value="Router"/>
149
+ </fingerprint>
150
+ <fingerprint pattern="^(?:\r|\n)*ZyXEL login:$">
151
+ <description>ZyXEL simple</description>
152
+ <example>ZyXEL login:</example>
153
+ <param pos="0" name="hw.vendor" value="ZyXEL"/>
154
+ </fingerprint>
155
+ <fingerprint pattern="^ZyXEL \w?DSL Router\r\nLogin:$">
156
+ <description>ZyXEL Router - simple</description>
157
+ <!-- ZyXEL VDSL Router\r\nLogin: -->
158
+ <example _encoding="base64">WnlYRUwgVkRTTCBSb3V0ZXINCkxvZ2luOgo=</example>
159
+ <param pos="0" name="hw.vendor" value="ZyXEL"/>
160
+ <param pos="0" name="hw.device" value="Router"/>
161
+ </fingerprint>
162
+ <fingerprint pattern="^Debian GNU\/Linux 9(?:\r|\n)+([\w.-]+) login:\s*$">
163
+ <description>Debian 9.0 (stretch)</description>
164
+ <!-- Debian GNU/Linux 9\r\nserver-01.2 login: -->
165
+ <example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA5DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
166
+ <param pos="0" name="os.vendor" value="Debian"/>
167
+ <param pos="0" name="os.family" value="Linux"/>
168
+ <param pos="0" name="os.product" value="Linux"/>
169
+ <param pos="0" name="os.version" value="9.0"/>
170
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:9.0"/>
171
+ <param pos="1" name="host.name"/>
172
+ </fingerprint>
173
+ <fingerprint pattern="^Debian GNU\/Linux 8(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
174
+ <description>Debian 8.0 (jessie)</description>
175
+ <!-- Debian GNU/Linux 8\r\nserver-01.2 login: -->
176
+ <example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA4DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
177
+ <param pos="0" name="os.vendor" value="Debian"/>
178
+ <param pos="0" name="os.family" value="Linux"/>
179
+ <param pos="0" name="os.product" value="Linux"/>
180
+ <param pos="0" name="os.version" value="8.0"/>
181
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
182
+ <param pos="1" name="host.name"/>
183
+ </fingerprint>
184
+ <fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 7(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
185
+ <description>Debian 7.0 (wheezy)</description>
186
+ <!-- Debian GNU/Linux 7\r\nserver-01.2 login: -->
187
+ <example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA3DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
188
+ <param pos="0" name="os.vendor" value="Debian"/>
189
+ <param pos="0" name="os.family" value="Linux"/>
190
+ <param pos="0" name="os.product" value="Linux"/>
191
+ <param pos="0" name="os.version" value="7.0"/>
192
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
193
+ <param pos="1" name="host.name"/>
194
+ </fingerprint>
195
+ <fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 6(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
196
+ <description>Debian 6.0 (sqeeze)</description>
197
+ <!-- Debian GNU/Linux 6.0\r\nserver-01.2 login: -->
198
+ <example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA2LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
199
+ <param pos="0" name="os.vendor" value="Debian"/>
200
+ <param pos="0" name="os.family" value="Linux"/>
201
+ <param pos="0" name="os.product" value="Linux"/>
202
+ <param pos="0" name="os.version" value="6.0"/>
203
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:6.0"/>
204
+ <param pos="1" name="host.name"/>
205
+ </fingerprint>
206
+ <fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 5(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
207
+ <description>Debian 5.0 (lenny)</description>
208
+ <!-- Debian GNU/Linux 5.0\r\nserver-01.2 login: -->
209
+ <example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA1LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
210
+ <param pos="0" name="os.vendor" value="Debian"/>
211
+ <param pos="0" name="os.family" value="Linux"/>
212
+ <param pos="0" name="os.product" value="Linux"/>
213
+ <param pos="0" name="os.version" value="5.0"/>
214
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:5.0"/>
215
+ <param pos="1" name="host.name"/>
216
+ </fingerprint>
217
+ <fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 4(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
218
+ <description>Debian 4.0 (etch)</description>
219
+ <!-- Debian GNU/Linux 4.0\r\nserver-01.2 login: -->
220
+ <example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA0LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
221
+ <param pos="0" name="os.vendor" value="Debian"/>
222
+ <param pos="0" name="os.family" value="Linux"/>
223
+ <param pos="0" name="os.product" value="Linux"/>
224
+ <param pos="0" name="os.version" value="4.0"/>
225
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:4.0"/>
226
+ <param pos="1" name="host.name"/>
227
+ </fingerprint>
228
+ <fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux (3.\d)(?: [\w.-]+)?(?:\r|\n)+([\w.-]+) login:\s*$">
229
+ <description>Debian 3.x (woody/sarge)</description>
230
+ <!-- Debian GNU/Linux 3.1\r\nserver-01.2 login: -->
231
+ <example _encoding="base64" os.version="3.1" host.name="server-01.2">
232
+ RGViaWFuIEdOVS9MaW51eCAzLjENCnNlcnZlci0wMS4yIGxvZ2luOgo=
233
+ </example>
234
+ <param pos="0" name="os.vendor" value="Debian"/>
235
+ <param pos="0" name="os.family" value="Linux"/>
236
+ <param pos="0" name="os.product" value="Linux"/>
237
+ <param pos="1" name="os.version"/>
238
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:{os.version}"/>
239
+ <param pos="2" name="host.name"/>
240
+ </fingerprint>
241
+ <fingerprint pattern="^(?:\r|\n)*Ubuntu ([\d.]+)(?: LTS)?(?:\r|\n)+([\w.-]+) login:\s*$">
242
+ <description>Ubuntu - most versions</description>
243
+ <!-- Ubuntu 16.04.4 LTS\r\nserver-01.2 login: -->
244
+ <example _encoding="base64" os.version="16.04.4" host.name="server-01.2">
245
+ VWJ1bnR1IDE2LjA0LjQgTFRTDQpzZXJ2ZXItMDEuMiBsb2dpbjoK
246
+ </example>
247
+ <!-- Ubuntu 17.04\r\nnginx login: -->
248
+ <example _encoding="base64" os.version="17.04" host.name="nginx">
249
+ VWJ1bnR1IDE3LjA0DQpuZ2lueCBsb2dpbjoK
250
+ </example>
251
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
252
+ <param pos="0" name="os.family" value="Linux"/>
253
+ <param pos="0" name="os.product" value="Ubuntu Linux"/>
254
+ <param pos="1" name="os.version"/>
255
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:{os.version}"/>
256
+ <param pos="2" name="host.name"/>
257
+ </fingerprint>
258
+ <fingerprint pattern="(?:\r|\n)*Debian GNU\/Linux (2.\d)(?: [\w.-]+)?(?:\r|\n)+([\w.-]+) login:\s*">
259
+ <description>Debian 2.x (hamm/slink/potato)</description>
260
+ <!-- Debian GNU/Linux 2.2\r\nserver-01.2 login: -->
261
+ <example _encoding="base64" os.version="2.2" host.name="server-01.2">
262
+ RGViaWFuIEdOVS9MaW51eCAyLjINCnNlcnZlci0wMS4yIGxvZ2luOgo=
263
+ </example>
264
+ <!-- Debian GNU/Linux 2.2 localhost.localdomain\r\nmoon login: -->
265
+ <example _encoding="base64" os.version="2.2" host.name="moon">
266
+ RGViaWFuIEdOVS9MaW51eCAyLjIgbG9jYWxob3N0LmxvY2FsZG9tYWluDQptb29uIGxvZ2luOgo=
267
+ </example>
268
+ <param pos="0" name="os.vendor" value="Debian"/>
269
+ <param pos="0" name="os.family" value="Linux"/>
270
+ <param pos="0" name="os.product" value="Linux"/>
271
+ <param pos="1" name="os.version"/>
272
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:{os.version}"/>
273
+ <param pos="2" name="host.name"/>
274
+ </fingerprint>
275
+ <fingerprint pattern="^CentOS release ([\d.]+) \(Final\)(?:\r|\n)+Kernel ([\w.-]+) on an (\w+)(?:\r|\n)+(?:([\w.-]+) )?login:\s*$">
276
+ <description>CentOS</description>
277
+ <!-- CentOS release 5.9 (Final)\r\nKernel 2.6.18-348.6.1.el5 on an i686\r\nlogin: -->
278
+ <example _encoding="base64" os.version="5.9" linux.kernel.version="2.6.18-348.6.1.el5" os.arch="i686">
279
+ Q2VudE9TIHJlbGVhc2UgNS45IChGaW5hbCkNCktlcm5lbCAyLjYuMTgtMzQ4LjYuMS5lbDUgb
280
+ 24gYW4gaTY4Ng0KbG9naW46Cg==
281
+ </example>
282
+ <!-- CentOS release 6.10 (Final)\r\nKernel 2.6.32-754.2.1.el6.x86_64 on an x86_64\r\nserver-01.2 login: -->
283
+ <example _encoding="base64" os.version="6.10" linux.kernel.version="2.6.32-754.2.1.el6.x86_64" os.arch="x86_64" host.name="server-01.2">
284
+ Q2VudE9TIHJlbGVhc2UgNi4xMCAoRmluYWwpDQpLZXJuZWwgMi42LjMyLTc1NC4yLjEuZWw2L
285
+ ng4Nl82NCBvbiBhbiB4ODZfNjQNCnNlcnZlci0wMS4yIGxvZ2luOgo=
286
+ </example>
287
+ <param pos="0" name="os.vendor" value="CentOS"/>
288
+ <param pos="0" name="os.family" value="Linux"/>
289
+ <param pos="0" name="os.product" value="Linux"/>
290
+ <param pos="1" name="os.version"/>
291
+ <param pos="2" name="linux.kernel.version"/>
292
+ <param pos="3" name="os.arch"/>
293
+ <param pos="0" name="os.cpe23" value="cpe:/o:centos:centos:{os.version}"/>
294
+ <param pos="4" name="host.name"/>
295
+ </fingerprint>
296
+ <fingerprint pattern="^(?:\r|\n)*(RT-AC\d\d\w) login:\s*$">
297
+ <description>Asus Wireless Access Point/Router - RT-AC prefix</description>
298
+ <example hw.product="RT-AC54U">RT-AC54U login:</example>
299
+ <example hw.product="RT-AC68R">RT-AC68R login:</example>
300
+ <param pos="0" name="os.family" value="Linux"/>
301
+ <param pos="0" name="os.product" value="Linux"/>
302
+ <param pos="0" name="hw.vendor" value="Asus"/>
303
+ <param pos="0" name="hw.device" value="WAP"/>
304
+ <param pos="1" name="hw.product"/>
305
+ </fingerprint>
306
+ <fingerprint pattern="^(?:\r|\n)*(AC\d\d00) login:\s*$">
307
+ <description>Asus Wireless Access Point/Router - AC prefix</description>
308
+ <example hw.product="AC1000">AC1000 login:</example>
309
+ <example hw.product="AC3000">AC3000 login:</example>
310
+ <param pos="0" name="os.family" value="Linux"/>
311
+ <param pos="0" name="os.product" value="Linux"/>
312
+ <param pos="0" name="hw.vendor" value="Asus"/>
313
+ <param pos="0" name="hw.device" value="WAP"/>
314
+ <param pos="1" name="hw.product"/>
315
+ </fingerprint>
316
+ <fingerprint pattern="^(?:\r|\n)*(Air5\d+\w{0,2}) login:\s*$">
317
+ <description>Airties</description>
318
+ <example hw.product="Air5650">Air5650 login:</example>
319
+ <example hw.product="Air5650TT">Air5650TT login:</example>
320
+ <param pos="0" name="hw.vendor" value="Airties"/>
321
+ <param pos="0" name="hw.device" value="WAP"/>
322
+ <param pos="1" name="hw.product"/>
323
+ </fingerprint>
324
+ <fingerprint pattern="^Amazon Linux AMI release ([\d.]+)(?:\r|\n)+Kernel ([\w.-]+) on an (\w+)(?:\r|\n)+(?:([\w.-]+) )?login:\s*$">
325
+ <description>Amazon Linux AMI</description>
326
+ <!-- Amazon Linux AMI release 2013.09\r\nKernel 3.4.68-59.97.amzn1.x86_64 on an x86_64\r\nserver-01.2 login: -->
327
+ <example _encoding="base64" os.version="2013.09" linux.kernel.version="3.4.68-59.97.amzn1.x86_64" os.arch="x86_64" host.name="server-01.2">
328
+ QW1hem9uIExpbnV4IEFNSSByZWxlYXNlIDIwMTMuMDkNCktlcm5lbCAzLjQuNjgtNTkuOTcuY
329
+ W16bjEueDg2XzY0IG9uIGFuIHg4Nl82NA0Kc2VydmVyLTAxLjIgbG9naW46Cg==
330
+ </example>
331
+ <param pos="0" name="os.vendor" value="Amazon"/>
332
+ <param pos="0" name="os.family" value="Linux"/>
333
+ <param pos="0" name="os.product" value="Linux"/>
334
+ <param pos="1" name="os.version"/>
335
+ <param pos="2" name="linux.kernel.version"/>
336
+ <param pos="3" name="os.arch"/>
337
+ <param pos="4" name="host.name"/>
338
+ </fingerprint>
339
+ <fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)/([\w]+) ALCATEL (SR [\S]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
340
+ <description>ALCATEL Service Router running TiMOS</description>
341
+ <!-- TiMOS-C-12.0.R12 cpm/hops64 ALCATEL SR 7750 Copyright (c) 2000-2015 Alcatel-Lucent.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
342
+ <example _encoding="base64" os.version="12.0.R12" hw.product="SR 7750" os.arch="hops64">
343
+ VGlNT1MtQy0xMi4wLlIxMiBjcG0vaG9wczY0IEFMQ0FURUwgU1IgNzc1MCBDb3B5cmlnaHQgK
344
+ GMpIDIwMDAtMjAxNSBBbGNhdGVsLUx1Y2VudC4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQ
345
+ pCcmV2aXR5DQpMb2dpbjoK
346
+ </example>
347
+ <param pos="0" name="os.vendor" value="ALCATEL"/>
348
+ <param pos="0" name="os.product" value="TimOS"/>
349
+ <param pos="0" name="os.device" value="Router"/>
350
+ <param pos="1" name="os.version"/>
351
+ <param pos="2" name="os.arch"/>
352
+ <param pos="0" name="hw.vendor" value="ALCATEL"/>
353
+ <param pos="0" name="hw.family" value="Service Router"/>
354
+ <param pos="0" name="hw.device" value="Router"/>
355
+ <param pos="3" name="hw.product"/>
356
+ </fingerprint>
357
+ <!-- Nokia purchased Alcatel Lucent, finalized in Nov 2016 -->
358
+ <fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia ([\S]+ [SRX]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
359
+ <description>Nokia Service Router running TiMOS</description>
360
+ <!-- TiMOS-C-14.0.R5 cpm/hops64 Nokia 7750 SR Copyright (c) 2000-2016 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
361
+ <example _encoding="base64" os.version="14.0.R5" os.arch="hops64" hw.product="7750 SR">
362
+ VGlNT1MtQy0xNC4wLlI1IGNwbS9ob3BzNjQgTm9raWEgNzc1MCBTUiBDb3B5cmlnaHQgKGMpI
363
+ DIwMDAtMjAxNiBOb2tpYS4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQpCcmV2aXR5DQpMb2
364
+ dpbjoK
365
+ </example>
366
+ <!-- TiMOS-C-14.0.R10 cpm/hops64 Nokia 7950 XRS Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
367
+ <example _encoding="base64" os.version="14.0.R10" os.arch="hops64" hw.product="7950 XRS">
368
+ VGlNT1MtQy0xNC4wLlIxMCBjcG0vaG9wczY0IE5va2lhIDc5NTAgWFJTIENvcHlyaWdodCAoY
369
+ ykgMjAwMC0yMDE3IE5va2lhLg0NCkJhbm5lciBTaG9ydGVuZWQgRm9yIA0NCkJyZXZpdHkNCk
370
+ xvZ2luOgo=
371
+ </example>
372
+ <param pos="0" name="os.vendor" value="Nokia"/>
373
+ <param pos="0" name="os.product" value="TimOS"/>
374
+ <param pos="0" name="os.device" value="Router"/>
375
+ <param pos="1" name="os.version"/>
376
+ <param pos="2" name="os.arch"/>
377
+ <param pos="0" name="hw.vendor" value="Nokia"/>
378
+ <param pos="0" name="hw.family" value="Service Router"/>
379
+ <param pos="0" name="hw.device" value="Router"/>
380
+ <param pos="3" name="hw.product"/>
381
+ </fingerprint>
382
+ <fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia (SAS[+\w\s-]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
383
+ <description>Nokia Service Access Switch running TiMOS</description>
384
+ <!-- TiMOS-B-8.0.R12 both/hops Nokia SAS-Mxp 22F2C 4SFP+ 7210 Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
385
+ <example _encoding="base64" os.version="8.0.R12" os.arch="hops" hw.product="SAS-Mxp 22F2C 4SFP+ 7210">
386
+ VGlNT1MtQi04LjAuUjEyIGJvdGgvaG9wcyBOb2tpYSBTQVMtTXhwIDIyRjJDIDRTRlArIDcyM
387
+ TAgQ29weXJpZ2h0IChjKSAyMDAwLTIwMTcgTm9raWEuDQ0KQmFubmVyIFNob3J0ZW5lZCBGb3
388
+ IgDQ0KQnJldml0eQ0KTG9naW46Cg==
389
+ </example>
390
+ <!-- TiMOS-B-9.0.R9 both/mpc Nokia SAS-M 24F 2XFP 7210 Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
391
+ <example _encoding="base64" os.version="9.0.R9" os.arch="mpc" hw.product="SAS-M 24F 2XFP 7210">
392
+ VGlNT1MtQi05LjAuUjkgYm90aC9tcGMgTm9raWEgU0FTLU0gMjRGIDJYRlAgNzIxMCBDb3B5c
393
+ mlnaHQgKGMpIDIwMDAtMjAxNyBOb2tpYS4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQpCcm
394
+ V2aXR5DQpMb2dpbjoK
395
+ </example>
396
+ <param pos="0" name="os.vendor" value="Nokia"/>
397
+ <param pos="0" name="os.product" value="TimOS"/>
398
+ <param pos="0" name="os.device" value="Switch"/>
399
+ <param pos="1" name="os.version"/>
400
+ <param pos="2" name="os.arch"/>
401
+ <param pos="0" name="hw.vendor" value="Nokia"/>
402
+ <param pos="0" name="hw.family" value="Service Access Switch"/>
403
+ <param pos="0" name="hw.device" value="Switch"/>
404
+ <param pos="3" name="hw.product"/>
405
+ </fingerprint>
406
+ <fingerprint pattern="^(?:\r|\n)*Grandstream (HT[\d-]+)\s+(?:V\d\.\d\w?\s+)?Command Shell Copyright \d\d\d\d-\d\d\d\d(?:\r|\n)+Password:\s*$">
407
+ <description>Grandstream HandyTone Analog Telephone Adapters</description>
408
+ <!-- Grandstream HT812 Command Shell Copyright 2006-2017\r\nPassword: -->
409
+ <example _encoding="base64" hw.product="HT812">
410
+ R3JhbmRzdHJlYW0gSFQ4MTIgQ29tbWFuZCBTaGVsbCBDb3B5cmlnaHQgMjAwNi0yMDE3DQpQY
411
+ XNzd29yZDoK
412
+ </example>
413
+ <!-- Grandstream HT-502 V2.0A Command Shell Copyright 2006-2014\r\nPassword: -->
414
+ <example _encoding="base64" hw.product="HT-502">
415
+ R3JhbmRzdHJlYW0gSFQtNTAyICBWMi4wQSBDb21tYW5kIFNoZWxsIENvcHlyaWdodCAyMDA2L
416
+ TIwMTQNClBhc3N3b3JkOgo=
417
+ </example>
418
+ <param pos="0" name="hw.vendor" value="Grandstream"/>
419
+ <param pos="0" name="hw.family" value="HandyTone"/>
420
+ <param pos="0" name="hw.device" value="VoIP"/>
421
+ <param pos="1" name="hw.product"/>
422
+ </fingerprint>
423
+ <fingerprint pattern="^(?:\r|\n)*Grandstream (GXW[\d-]+)\s+(?:V\d\.\d\w?\s+)?Command Shell Copyright \d\d\d\d(?:-\d\d\d\d)?(?:\r|\n)+Password:\s*$">
424
+ <description>Grandstream Analog VoIP Gateways</description>
425
+ <!-- Grandstream GXW-4008 V1.5A Command Shell Copyright 2006-2015\r\nPassword: -->
426
+ <example _encoding="base64" hw.product="GXW-4008">
427
+ R3JhbmRzdHJlYW0gR1hXLTQwMDggIFYxLjVBIENvbW1hbmQgU2hlbGwgQ29weXJpZ2h0IDIwM
428
+ DYtMjAxNQ0KUGFzc3dvcmQ6Cg==
429
+ </example>
430
+ <!-- Grandstream GXW4216 V2.3B Command Shell Copyright 2015\r\nPassword: -->
431
+ <example _encoding="base64" hw.product="GXW4216">
432
+ R3JhbmRzdHJlYW0gR1hXNDIxNiAgVjIuM0IgQ29tbWFuZCBTaGVsbCBDb3B5cmlnaHQgMjAxN
433
+ Q0KUGFzc3dvcmQ6Cg==
434
+ </example>
435
+ <param pos="0" name="hw.vendor" value="Grandstream"/>
436
+ <param pos="0" name="hw.family" value="GXW"/>
437
+ <param pos="0" name="hw.device" value="VoIP"/>
438
+ <param pos="1" name="hw.product"/>
439
+ </fingerprint>
440
+ <fingerprint pattern="^(?:\r|\n|\s)*Grandstream (GXV[\w-]+)\s+(?:V\d\.\d\w?\s+)?Shell Command.Copyight \d\d\d\d-\d\d\d\d(?:\r|\n)+Username:\s*$">
441
+ <description>Grandstream IP Cameras</description>
442
+ <!-- Grandstream GXV3674_FHD_VF Shell Command.Copyight 2011-2014\r\nUsername: -->
443
+ <example _encoding="base64" hw.product="GXV3674_FHD_VF">
444
+ R3JhbmRzdHJlYW0gR1hWMzY3NF9GSERfVkYgICAgU2hlbGwgQ29tbWFuZC5Db3B5aWdodCAyM
445
+ DExLTIwMTQNClVzZXJuYW1lOgo=
446
+ </example>
447
+ <param pos="0" name="hw.vendor" value="Grandstream"/>
448
+ <param pos="0" name="hw.family" value="GXV"/>
449
+ <param pos="0" name="hw.device" value="Web cam"/>
450
+ <param pos="1" name="hw.product"/>
451
+ </fingerprint>
452
+ <fingerprint pattern="^(?:\r|\n)*Welcome to Polycom RMX\s*(\w+) \(COP\) Console Utility(?:\r|\n)+Copyright \(C\) \d\d\d\d-\d\d\d\d POLYCOM(?:\r|\n)+Password:\s*$">
453
+ <description>Polycom Real Time Media Conferencing</description>
454
+ <!-- Welcome to Polycom RMX 500 (COP) Console Utility\r\n\rCopyright (C) 2008-2010 POLYCOM\r\n\r\r\n\rPassword: -->
455
+ <example _encoding="base64" hw.product="500">
456
+ V2VsY29tZSB0byBQb2x5Y29tIFJNWCA1MDAgKENPUCkgQ29uc29sZSBVdGlsaXR5DQoNQ29we
457
+ XJpZ2h0IChDKSAyMDA4LTIwMTAgUE9MWUNPTQ0KDQ0KDVBhc3N3b3JkOgo=
458
+ </example>
459
+ <!-- Welcome to Polycom RMX 1000C (COP) Console Utility\r\n\rCopyright (C) 2008-2012 POLYCOM\r\n\r\r\n\rPassword: -->
460
+ <example _encoding="base64" hw.product="1000C">
461
+ V2VsY29tZSB0byBQb2x5Y29tIFJNWCAxMDAwQyAoQ09QKSBDb25zb2xlIFV0aWxpdHkNCg1Db
462
+ 3B5cmlnaHQgKEMpIDIwMDgtMjAxMiBQT0xZQ09NDQoNDQoNUGFzc3dvcmQ6Cg==
463
+ </example>
464
+ <param pos="0" name="hw.vendor" value="Polycom"/>
465
+ <param pos="0" name="hw.family" value="RMX"/>
466
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
467
+ <param pos="1" name="hw.product"/>
468
+ </fingerprint>
469
+ <fingerprint pattern="^(?:\r|\n)*Hi, my name is :\s+[\w.\s-]+(?:\r|\n)+Here is what I know about myself:(?:\r|\n)+Model:\s+VSX (\w+)(?:\r|\n)+Serial Number:\s+(\w+)(?:\r|\n)+Software Version:\s+Release ([\d.-]+)\s">
470
+ <description>Polycom Video Conferencing - VSX Family</description>
471
+ <!-- Hi, my name is : Something Pity\r\nHere is what I know about myself:\r\nModel: VSX 6000A\r\nSerial Number: 00070906FC34F6\r\nSoftware Version: Release 9.0.6.2-103 - 04Sep2011 21:27\r\nBuild Information: ecomman -->
472
+ <example _encoding="base64" hw.product="6000A" host.id="00070906FC34F6" os.version="9.0.6.2-103">
473
+ SGksIG15IG5hbWUgaXMgOiAgICAgU29tZXRoaW5nIFBpdHkNCkhlcmUgaXMgd2hhdCBJIGtub
474
+ 3cgYWJvdXQgbXlzZWxmOg0KTW9kZWw6ICAgICAgICAgICAgICAgVlNYIDYwMDBBDQpTZXJpYW
475
+ wgTnVtYmVyOiAgICAgICAwMDA3MDkwNkZDMzRGNg0KU29mdHdhcmUgVmVyc2lvbjogICAgUmV
476
+ sZWFzZSA5LjAuNi4yLTEwMyAtIDA0U2VwMjAxMSAyMToyNw0KQnVpbGQgSW5mb3JtYXRpb246
477
+ ICAgZWNvbW1hbgo=
478
+ </example>
479
+ <param pos="0" name="hw.vendor" value="Polycom"/>
480
+ <param pos="0" name="hw.family" value="VSX"/>
481
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
482
+ <param pos="1" name="hw.product"/>
483
+ <param pos="2" name="host.id"/>
484
+ <param pos="3" name="os.version"/>
485
+ </fingerprint>
486
+ <fingerprint pattern="Polycom Command Shell(?:\r|\n)+XCOM host:\s+localhost port: \d+">
487
+ <description>Polycom Diagnotic Service</description>
488
+ <!-- Polycom Command Shell\r\r\nXCOM host: localhost port: 4121\r\r\nTTY name: /dev/pts/0\r\r\nSession type: telnet\r\r\nNCF\r\nNCF\r\n2018-08-15 18:03:10 DEBUG -->
489
+ <example _encoding="base64">
490
+ UG9seWNvbSBDb21tYW5kIFNoZWxsDQ0KWENPTSBob3N0OiAgICBsb2NhbGhvc3QgcG9ydDogN
491
+ DEyMQ0NClRUWSBuYW1lOiAgICAgL2Rldi9wdHMvMA0NClNlc3Npb24gdHlwZTogdGVsbmV0DQ
492
+ 0KTkNGDQpOQ0YNCjIwMTgtMDgtMTUgMTg6MDM6MTAgREVCVUcK
493
+ </example>
494
+ <param pos="0" name="hw.vendor" value="Polycom"/>
495
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
496
+ </fingerprint>
497
+ <fingerprint pattern="^Welcome to the Windows CE Telnet Service on (WEBBOX[\w.-]+)(?:\r|\n)+login:\s*$">
498
+ <description>Sunny WebBox Windows CE</description>
499
+ <!-- Welcome to the Windows CE Telnet Service on WEBBOX150000000\r\n\r\nlogin: -->
500
+ <example _encoding="base64" host.name="WEBBOX150000000">
501
+ V2VsY29tZSB0byB0aGUgV2luZG93cyBDRSBUZWxuZXQgU2VydmljZSBvbiBXRUJCT1gxNTAwM
502
+ DAwMDANCg0KbG9naW46Cg==
503
+ </example>
504
+ <param pos="0" name="hw.vendor" value="SMA Solar Technology Ag"/>
505
+ <param pos="0" name="hw.family" value="Sunny"/>
506
+ <param pos="0" name="hw.product" value="WebBox"/>
507
+ <param pos="0" name="hw.device" value="Power device"/>
508
+ <param pos="0" name="os.vendor" value="Microsoft"/>
509
+ <param pos="0" name="os.family" value="Windows"/>
510
+ <param pos="0" name="os.product" value="Windows CE"/>
511
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_ce:-"/>
512
+ <param pos="1" name="host.name"/>
513
+ </fingerprint>
514
+ <fingerprint pattern="^Welcome to the Windows CE Telnet Service on ([\w.-]+)(?:\r|\n)+login:\s*$">
515
+ <description>Windows CE</description>
516
+ <!-- Welcome to the Windows CE Telnet Service on MY-CE-DEVICE\r\n\r\nlogin: -->
517
+ <example _encoding="base64" host.name="MY-CE-DEVICE">
518
+ V2VsY29tZSB0byB0aGUgV2luZG93cyBDRSBUZWxuZXQgU2VydmljZSBvbiBNWS1DRS1ERVZJQ
519
+ 0UNCg0KbG9naW46Cg==
520
+ </example>
521
+ <param pos="0" name="os.vendor" value="Microsoft"/>
522
+ <param pos="0" name="os.family" value="Windows"/>
523
+ <param pos="0" name="os.product" value="Windows CE"/>
524
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_ce:-"/>
525
+ <param pos="1" name="host.name"/>
526
+ </fingerprint>
527
+ <fingerprint pattern="^(?:\r|\n)*HP JetDirect(?:\r|\n)+$">
528
+ <description>HP Printer - Jet Direct</description>
529
+ <!-- HP JetDirect\r\nPassword is not set\r\n\r\nPlease type "menu" for the MENU system, \r\nor "?" for help, or "/" for current settings.\r\n> -->
530
+ <example _encoding="base64">
531
+ SFAgSmV0RGlyZWN0DQpQYXNzd29yZCBpcyBub3Qgc2V0DQoNClBsZWFzZSB0eXBlICJtZW51I
532
+ iBmb3IgdGhlIE1FTlUgc3lzdGVtLCANCm9yICI/IiBmb3IgaGVscCwgb3IgIi8iIGZvciBjdX
533
+ JyZW50IHNldHRpbmdzLg0KPgo=
534
+ </example>
535
+ <!-- HP JetDirect\r\n\r\nEnter username: -->
536
+ <example _encoding="base64">SFAgSmV0RGlyZWN0DQoNCkVudGVyIHVzZXJuYW1lOgo=</example>
537
+ <param pos="0" name="service.vendor" value="HP"/>
538
+ <param pos="0" name="service.product" value="JetDirect"/>
539
+ <param pos="0" name="service.family" value="JetDirect"/>
540
+ <param pos="0" name="os.vendor" value="HP"/>
541
+ <param pos="0" name="os.device" value="Printer"/>
542
+ <param pos="0" name="os.family" value="JetDirect"/>
543
+ <param pos="0" name="os.product" value="JetDirect"/>
544
+ <param pos="0" name="hw.vendor" value="HP"/>
545
+ <param pos="0" name="hw.family" value="JetDirect"/>
546
+ <param pos="0" name="hw.product" value="JetDirect"/>
547
+ <param pos="0" name="hw.device" value="Printer"/>
548
+ </fingerprint>
549
+ <fingerprint pattern="^(?:\r|\n)*%connection closed by remote host!(?:\x00)?$">
550
+ <description>HP switch blocking connection using network ACL</description>
551
+ <!-- %connection closed by remote host! -->
552
+ <example _encoding="base64">JWNvbm5lY3Rpb24gY2xvc2VkIGJ5IHJlbW90ZSBob3N0IQ==</example>
553
+ <param pos="0" name="hw.vendor" value="HP"/>
554
+ <param pos="0" name="hw.device" value="Switch"/>
555
+ </fingerprint>
556
+ <fingerprint pattern="^(?:\r|\n)*Welcome Visiting Huawei Home Gateway\r\nCopyright by Huawei Technologies Co., Ltd.\r\n\r\nLogin:$">
557
+ <description>Huawei HG series Home Gateway routers</description>
558
+ <!-- Welcome Visiting Huawei Home Gateway\r\nCopyright by Huawei Technologies Co., Ltd.\r\n\r\nLogin: -->
559
+ <example _encoding="base64">
560
+ V2VsY29tZSBWaXNpdGluZyBIdWF3ZWkgSG9tZSBHYXRld2F5DQpDb3B5cmlnaHQgYnkgSHVhd
561
+ 2VpIFRlY2hub2xvZ2llcyBDby4sIEx0ZC4NCg0KTG9naW46Cg==
562
+ </example>
563
+ <param pos="0" name="hw.vendor" value="Huawei"/>
564
+ <param pos="0" name="hw.device" value="Router"/>
565
+ </fingerprint>
566
+ <fingerprint pattern="^(?:\r|\n)*Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.(?:(?:\r|\n)+Login authentication)?(?:\r|\n)+Username:$">
567
+ <description>Huawei Router</description>
568
+ <!-- Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.\r\n\r\nLogin authentication\r\n\r\n\r\nUsername: -->
569
+ <example _encoding="base64">
570
+ V2FybmluZzogVGVsbmV0IGlzIG5vdCBhIHNlY3VyZSBwcm90b2NvbCwgYW5kIGl0IGlzIHJlY
571
+ 29tbWVuZGVkIHRvIHVzZSBTdGVsbmV0Lg0KDQpMb2dpbiBhdXRoZW50aWNhdGlvbg0KDQoNCl
572
+ VzZXJuYW1lOgo=
573
+ </example>
574
+ <param pos="0" name="hw.vendor" value="Huawei"/>
575
+ <param pos="0" name="hw.device" value="Router"/>
576
+ </fingerprint>
577
+ <fingerprint pattern="^(?:\r|\n)*(?:% Password expiration warning.\r\n)?-+\r\nCisco Configuration Professional \(Cisco CP\) is installed on this device. \r\nThis feature requires the one-time use of the username">
578
+ <description>Cisco router - Cisco Configuration Pro variant</description>
579
+ <!-- There are are roughly 69 dash characters before the CRLF in the banner below but can't be included in XML comments. -->
580
+ <!-- \r\nCisco Configuration Professional (Cisco CP) is installed on this device. \r\nThis feature requires the one-time use of the username -->
581
+ <example _encoding="base64">
582
+ LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
583
+ S0tLS0tLS0tLS0tLS0tLS0NCkNpc2NvIENvbmZpZ3VyYXRpb24gUHJvZmVzc2lvbmFsIChDaX
584
+ NjbyBDUCkgaXMgaW5zdGFsbGVkIG9uIHRoaXMgZGV2aWNlLiANClRoaXMgZmVhdHVyZSByZXF
585
+ 1aXJlcyB0aGUgb25lLXRpbWUgdXNlIG9mIHRoZSB1c2VybmFtZQo=
586
+ </example>
587
+ <param pos="0" name="service.vendor" value="Cisco"/>
588
+ <param pos="0" name="os.vendor" value="Cisco"/>
589
+ <param pos="0" name="os.family" value="IOS"/>
590
+ <param pos="0" name="os.product" value="IOS"/>
591
+ <param pos="0" name="os.device" value="Router"/>
592
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:-"/>
593
+ <param pos="0" name="hw.vendor" value="Cisco"/>
594
+ <param pos="0" name="hw.device" value="Router"/>
595
+ </fingerprint>
596
+ <fingerprint pattern="^(?m)(?:\r|\n)*Catalyst 1900 Management Console(?:\r|\n)+.*Ethernet Address:\s+([\w-]+)(?:\r|\n)+.*Model Number:\s+([\w-]+)(?:\r|\n)+System Serial Number:\s+(\w+)(?:\r|\n)+Power Supply" flags="REG_MULTILINE">
597
+ <description>Cisco Catalyst 1900</description>
598
+ <!-- Catalyst 1900, unlike other Catalyst models, didn't run CatOS or IOS -->
599
+ <!-- Catalyst 1900 Management Console\r\nCopyright (c) Cisco Systems, Inc. 1993-1998\r\nAll rights reserved.\r\nEnterprise Edition Software\r\nEthernet Address: 00-AA-19-38-AA-00\r\n\r\nPCA Number: 73-31AA-AA\r\nPCA Serial Number: FAB033AAAAA\r\nModel Number: WS-C1924-EN\r\nSystem Serial Number: FAB0341AAAA\r\nPower Supply S/N: -->
600
+ <example _encoding="base64" host.mac="00-AA-19-38-AA-00" hw.model="WS-C1924-EN" host.id="FAB0341AAAA">
601
+ Q2F0YWx5c3QgMTkwMCBNYW5hZ2VtZW50IENvbnNvbGUNCkNvcHlyaWdodCAoYykgQ2lzY28gU
602
+ 3lzdGVtcywgSW5jLiAgMTk5My0xOTk4DQpBbGwgcmlnaHRzIHJlc2VydmVkLg0KRW50ZXJwcm
603
+ lzZSBFZGl0aW9uIFNvZnR3YXJlDQpFdGhlcm5ldCBBZGRyZXNzOiAgICAgIDAwLUFBLTE5LTM
604
+ 4LUFBLTAwDQoNClBDQSBOdW1iZXI6ICAgICAgICAgICAgNzMtMzFBQS1BQQ0KUENBIFNlcmlh
605
+ bCBOdW1iZXI6ICAgICBGQUIwMzNBQUFBQQ0KTW9kZWwgTnVtYmVyOiAgICAgICAgICBXUy1DM
606
+ TkyNC1FTg0KU3lzdGVtIFNlcmlhbCBOdW1iZXI6ICBGQUIwMzQxQUFBQQ0KUG93ZXIgU3VwcG
607
+ x5IFMvTjogICAK
608
+ </example>
609
+ <param pos="0" name="service.vendor" value="Cisco"/>
610
+ <param pos="0" name="os.vendor" value="Cisco"/>
611
+ <param pos="0" name="os.device" value="Switch"/>
612
+ <param pos="0" name="hw.vendor" value="Cisco"/>
613
+ <param pos="0" name="hw.product" value="Catalyst 1900"/>
614
+ <param pos="0" name="hw.device" value="Switch"/>
615
+ <param pos="1" name="host.mac"/>
616
+ <param pos="2" name="hw.model"/>
617
+ <param pos="3" name="host.id"/>
618
+ </fingerprint>
619
+ <fingerprint pattern="^192.0.0.64 login:\s*$">
620
+ <description>Hikvision cameras and NVRs (multiple)</description>
621
+ <example>192.0.0.64 login:</example>
622
+ <param pos="0" name="os.vendor" value="Hikvision"/>
623
+ <param pos="0" name="hw.vendor" value="Hikvision"/>
624
+ </fingerprint>
625
+ <fingerprint pattern="^Remote Management Console\r\nlogin:\s*$">
626
+ <description>Juniper Netscreen</description>
627
+ <!-- Remote Management Console\r\nlogin: -->
628
+ <example _encoding="base64">UmVtb3RlIE1hbmFnZW1lbnQgQ29uc29sZQ0KbG9naW46Cg==</example>
629
+ <param pos="0" name="os.vendor" value="Juniper"/>
630
+ <param pos="0" name="os.device" value="Firewall"/>
631
+ <param pos="0" name="os.family" value="ScreenOS"/>
632
+ <param pos="0" name="os.product" value="ScreenOS"/>
633
+ <param pos="0" name="os.cpe23" value="cpe:/o:juniper:screenos:-"/>
634
+ <param pos="0" name="hw.vendor" value="Juniper"/>
635
+ <param pos="0" name="hw.device" value="Firewall"/>
636
+ <param pos="0" name="hw.product" value="NetScreen"/>
637
+ </fingerprint>
638
+ <fingerprint pattern="^(?:\r|\n)*(FGT\w{13}) login:\s*$">
639
+ <description>Fortinet FortiGate - w/ autogenerated hostname</description>
640
+ <example host.name="FGT60C3G13001111">FGT60C3G13001111 login:</example>
641
+ <param pos="0" name="os.vendor" value="Fortinet"/>
642
+ <param pos="0" name="os.family" value="FortiOS"/>
643
+ <param pos="0" name="os.product" value="FortiOS"/>
644
+ <param pos="0" name="os.device" value="Firewall"/>
645
+ <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
646
+ <param pos="0" name="hw.vendor" value="Fortinet"/>
647
+ <param pos="0" name="hw.family" value="FortiGate"/>
648
+ <param pos="0" name="hw.device" value="Firewall"/>
649
+ <param pos="1" name="host.name"/>
650
+ </fingerprint>
651
+ <fingerprint pattern="^(?:\r|\n)*KWS-1043N login:\s*$">
652
+ <description>Clipcomm KWS router</description>
653
+ <example hw.product="KWS-1043N">KWS-1043N login:</example>
654
+ <param pos="0" name="hw.vendor" value="Clipcomm"/>
655
+ <param pos="0" name="hw.device" value="Router"/>
656
+ <param pos="0" name="hw.product" value="KWS-1043N"/>
657
+ </fingerprint>
658
+ <fingerprint pattern="^(?:\r|\n)*(SMCD3\w+-\w\w\w) login:\s*$">
659
+ <description>SMC Cable Modem</description>
660
+ <example hw.product="SMCD3GN2-BIZ">SMCD3GN2-BIZ login:</example>
661
+ <param pos="0" name="hw.vendor" value="SMC Networks"/>
662
+ <param pos="0" name="hw.device" value="Cable Modem"/>
663
+ <param pos="1" name="hw.product"/>
664
+ </fingerprint>
665
+ <fingerprint pattern="^(?:\r|\n)*ADB-4820CD login:\s*$">
666
+ <description>ADB ADB-4820CD DVR</description>
667
+ <example>ADB-4820CD login:</example>
668
+ <param pos="0" name="hw.vendor" value="ADB"/>
669
+ <param pos="0" name="hw.device" value="DVR"/>
670
+ <param pos="0" name="hw.product" value="ADB-4820CD"/>
671
+ </fingerprint>
672
+ <fingerprint pattern="^(?:\r|\n)*IMDVRS login:\s*$">
673
+ <description>Rifatron IMDVRS DVR</description>
674
+ <example>IMDVRS login:</example>
675
+ <param pos="0" name="hw.vendor" value="Rifatron"/>
676
+ <param pos="0" name="hw.family" value="IMDVR"/>
677
+ <param pos="0" name="hw.device" value="DVR"/>
678
+ </fingerprint>
679
+ <fingerprint pattern="^(?:\r|\n)*Ruijie login:\s*$">
680
+ <description>Ruijie device (likely router/switch)</description>
681
+ <example>Ruijie login:</example>
682
+ <param pos="0" name="hw.vendor" value="Ruijie"/>
683
+ </fingerprint>
684
+ <fingerprint pattern="^Welcome to Microsoft Telnet Service \r\n\n\rlogin:\s*$">
685
+ <description>Microsoft Windows</description>
686
+ <!-- Welcome to Microsoft Telnet Service \r\n\n\rlogin: -->
687
+ <example _encoding="base64">V2VsY29tZSB0byBNaWNyb3NvZnQgVGVsbmV0IFNlcnZpY2UgDQoKDWxvZ2luOgo=</example>
688
+ <param pos="0" name="os.vendor" value="Microsoft"/>
689
+ <param pos="0" name="os.family" value="Windows"/>
690
+ <param pos="0" name="os.product" value="Windows"/>
691
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
692
+ </fingerprint>
693
+ <!-- The following fingerprints are for generic Broadcom hardware where the
694
+ vendor has left the default banner in place. These could be rebadged by
695
+ ZTE, CenturyLink, Sky, Huawei, etc.
696
+ -->
697
+ <fingerprint pattern="^(BCM\d+) (?:Broadband|ADSL|xDSL|DSL) Router\r\nLogin:\s*">
698
+ <description>OEM'd Broadcom Router</description>
699
+ <!-- BCM963268 Broadband Router\r\nLogin: -->
700
+ <example _encoding="base64" hw.product="BCM963268">QkNNOTYzMjY4IEJyb2FkYmFuZCBSb3V0ZXINCkxvZ2luOgo=</example>
701
+ <param pos="0" name="hw.device" value="Router"/>
702
+ <param pos="1" name="hw.product"/>
703
+ </fingerprint>
704
+ <fingerprint pattern="^(BCM\d+) Broadband Router\r\nTelnet is Disabled in WAN Side$">
705
+ <description>OEM'd Broadcom Router - telnet disabled on WAN side</description>
706
+ <!-- BCM963268 Broadband Router\r\nTelnet is Disabled in WAN Side -->
707
+ <example _encoding="base64" hw.product="BCM963268">QkNNOTYzMjY4IEJyb2FkYmFuZCBSb3V0ZXINClRlbG5ldCBpcyBEaXNhYmxlZCBpbiBXQU4gU2lkZQo=</example>
708
+ <param pos="0" name="hw.device" value="Router"/>
709
+ <param pos="1" name="hw.product"/>
710
+ </fingerprint>
711
+ <fingerprint pattern="^(?m)(BCM\d+) Broadband Router\r\n.*Please input the verification code:$" flags="REG_MULTILINE">
712
+ <description>OEM'd Broadcom Router - input validation code</description>
713
+ <!-- BCM96318 Broadband Router\r\n====================================================\r\n * * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * * * * \r\n====================================================\r\nPlease input the verification code: -->
714
+ <example _encoding="base64" hw.product="BCM96318">
715
+ QkNNOTYzMTggQnJvYWRiYW5kIFJvdXRlcg0KPT09PT09PT09PT09PT09PT09PT09PT09PT09P
716
+ T09PT09PT09PT09PT09PT09PT09PT09PQ0KICAgICogKiAgICAgICAgICogKiAqICogICAgIC
717
+ AqICogKiAqICAgICAgKiAqICogKiAgIA0KICAgICAgKiAgICAgICAgICogICAgICAgICAgICA
718
+ gICAgICAqICAgICAgKiAgICAgKiAgIA0KICAgICAgKiAgICAgICAgICogKiAqICogICAgICAq
719
+ ICogKiAqICAgICAgKiAqICogKiAgIA0KICAgICAgKiAgICAgICAgICogICAgICogICAgICAgI
720
+ CAgICAqICAgICAgICAgICAgKiAgIA0KICAgICAgKiAgICAgICAgICogICAgICogICAgICAgIC
721
+ AgICAqICAgICAgICAgICAgKiAgIA0KICAgKiAqICogKiAgICAgICogKiAqICogICAgICAqICo
722
+ gKiAqICAgICAgKiAqICogKiAgIA0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
723
+ PT09PT09PT09PT09PT09PT09PQ0KUGxlYXNlIGlucHV0IHRoZSB2ZXJpZmljYXRpb24gY29kZ
724
+ ToK
725
+ </example>
726
+ <param pos="0" name="hw.device" value="Router"/>
727
+ <param pos="1" name="hw.product"/>
728
+ </fingerprint>
729
+ <fingerprint pattern="^(BCM\d+) Broadband Router\r\nMaximum number of incorrect account entries exceeded.">
730
+ <description>OEM'd Broadcom Router - Max incorrect tries - variant 1</description>
731
+ <!-- BCM96328 Broadband Router\r\nMaximum number of incorrect account entries exceeded. -->
732
+ <example _encoding="base64" hw.product="BCM96328">
733
+ QkNNOTYzMjggQnJvYWRiYW5kIFJvdXRlcg0KTWF4aW11bSBudW1iZXIgb2YgaW5jb3JyZWN0I
734
+ GFjY291bnQgZW50cmllcyBleGNlZWRlZC4K
735
+ </example>
736
+ <param pos="0" name="hw.device" value="Router"/>
737
+ <param pos="1" name="hw.product"/>
738
+ </fingerprint>
739
+ <fingerprint pattern="^(BCM\d+) Broadband Router\r\nSorry, you need to wait for \d+ second before next login attempt.(?:\r|\n)*">
740
+ <description>OEM'd Broadcom Router - Max incorrect tries - variant 2</description>
741
+ <!-- BCM96816 Broadband Router\r\nSorry, you need to wait for 119 second before next login attempt. -->
742
+ <example _encoding="base64" hw.product="BCM96816">
743
+ QkNNOTY4MTYgQnJvYWRiYW5kIFJvdXRlcg0KU29ycnksIHlvdSBuZWVkIHRvIHdhaXQgZm9yI
744
+ DExOSBzZWNvbmQgYmVmb3JlIG5leHQgbG9naW4gYXR0ZW1wdC4K
745
+ </example>
746
+ <param pos="0" name="hw.device" value="Router"/>
747
+ <param pos="1" name="hw.product"/>
748
+ </fingerprint>
749
+ <!-- Moxa Industrial Solutions-->
750
+ <fingerprint pattern="^(?:\r|\n)*NPort (NP6[\w-]+)(?:\r|\n|\x00)+Console terminal type">
751
+ <description>Moxa NPort Terminal Server - 6xxx Series</description>
752
+ <!-- NPort NP6610-32\r\u0000\nConsole terminal type (1: ansi/vt100, 2: vt52) : 1 -->
753
+ <example _encoding="base64" hw.product="NP6610-32">
754
+ TlBvcnQgTlA2NjEwLTMyDQAKQ29uc29sZSB0ZXJtaW5hbCB0eXBlICgxOiBhbnNpL3Z0MTAwLC
755
+ AyOiB2dDUyKSA6IDE=
756
+ </example>
757
+ <param pos="0" name="hw.vendor" value="Moxa"/>
758
+ <param pos="0" name="hw.family" value="NPort"/>
759
+ <param pos="0" name="hw.device" value="Device Server"/>
760
+ <param pos="1" name="hw.product"/>
761
+ </fingerprint>
762
+ <fingerprint pattern="^Model name\s+: NPort (IA-\d+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+System uptime">
763
+ <description>Moxa NPort Device Server - IA Series</description>
764
+ <!-- Model name : NPort IA-5250\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 281\r\u0000\nFirmware version : 1.6 Build 17060616\r\u0000\nSystem uptime : 31 days, 06h:03m:45s\r\u0000\n\r\u0000\nPlease keyin your password: -->
765
+ <example _encoding="base64" hw.product="IA-5250" host.mac="00:90:E8:AA:AA:AA" host.id="281" os.version="1.6" os.version.version="17060616">
766
+ TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IElBLTUyNTANAApNQUMgYWRkcmVzcyAgICAgIDogM
767
+ DA6OTA6RTg6QUE6QUE6QUENAApTZXJpYWwgTm8uICAgICAgIDogMjgxDQAKRmlybXdhcmUgdm
768
+ Vyc2lvbiA6IDEuNiBCdWlsZCAxNzA2MDYxNg0AClN5c3RlbSB1cHRpbWUgICAgOiAzMSBkYXl
769
+ zLCAwNmg6MDNtOjQ1cw0ACg0AClBsZWFzZSBrZXlpbiB5b3VyIHBhc3N3b3JkOg==
770
+ </example>
771
+ <param pos="0" name="hw.vendor" value="Moxa"/>
772
+ <param pos="0" name="hw.family" value="NPort"/>
773
+ <param pos="0" name="hw.device" value="Device Server"/>
774
+ <param pos="1" name="hw.product"/>
775
+ <param pos="2" name="host.mac"/>
776
+ <param pos="3" name="host.id"/>
777
+ <param pos="4" name="os.version"/>
778
+ <param pos="5" name="os.version.version"/>
779
+ </fingerprint>
780
+ <fingerprint pattern="^(?:\r|\n|\x00|-)*Model name\s+: NPort (5[\w-]+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
781
+ <description>Moxa NPort Device Server - 5xxx Series</description>
782
+ <!-- Some versions of the banner below have a line full of dashes which cannot be included in the example comment -->
783
+ <!-- Model name : NPort 5610-8-DT\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9522\r\u0000\nFirmware version : 2.2 Build 11090613\r\u0000\nSystem uptime : 8 days, 02h:11m:44s\r\u0000\n\r\u0000\nPlease keyin your password: -->
784
+ <example _encoding="base64" hw.product="5610-8-DT" host.mac="00:90:E8:AA:AA:AA" host.id="9522" os.version="2.2" os.version.version="11090613">
785
+ TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IDU2MTAtOC1EVA0ACk1BQyBhZGRyZXNzICAgICAgO
786
+ iAwMDo5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NTIyDQAKRmlybXdhcm
787
+ UgdmVyc2lvbiA6IDIuMiBCdWlsZCAxMTA5MDYxMw0AClN5c3RlbSB1cHRpbWUgICAgOiA4IGR
788
+ heXMsIDAyaDoxMW06NDRzDQAKDQAKUGxlYXNlIGtleWluIHlvdXIgcGFzc3dvcmQ6
789
+ </example>
790
+ <param pos="0" name="hw.vendor" value="Moxa"/>
791
+ <param pos="0" name="hw.family" value="NPort"/>
792
+ <param pos="0" name="hw.device" value="Device Server"/>
793
+ <param pos="1" name="hw.product"/>
794
+ <param pos="2" name="host.mac"/>
795
+ <param pos="3" name="host.id"/>
796
+ <param pos="4" name="os.version"/>
797
+ <param pos="5" name="os.version.version"/>
798
+ </fingerprint>
799
+ <fingerprint pattern="^Model name\s+: MGate (MB3[\w-]+)(?:\r|\n|\x00|)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
800
+ <description>Moxa MGate Modbus Gateway</description>
801
+ <!-- Model name : MGate MB3180\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9474\r\u0000\nFirmware version : 1.2 Build 09101913\r\u0000\nSystem uptime : 15 days, 16h:37m:48s\r\u0000\n\r\u0000\nPlease keyin your password: -->
802
+ <example _encoding="base64" hw.product="MB3180" host.mac="00:90:E8:AA:AA:AA" host.id="9474" os.version="1.2" os.version.version="09101913">
803
+ TW9kZWwgbmFtZSAgICAgICA6IE1HYXRlIE1CMzE4MA0ACk1BQyBhZGRyZXNzICAgICAgOiAwM
804
+ Do5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NDc0DQAKRmlybXdhcmUgdm
805
+ Vyc2lvbiA6IDEuMiBCdWlsZCAwOTEwMTkxMw0AClN5c3RlbSB1cHRpbWUgICAgOiAxNSBkYXl
806
+ zLCAxNmg6MzdtOjQ4cw0ACg0AClBsZWFzZSBrZXlpbiB5b3VyIHBhc3N3b3JkOg==
807
+ </example>
808
+ <param pos="0" name="hw.vendor" value="Moxa"/>
809
+ <param pos="0" name="hw.family" value="MGate"/>
810
+ <param pos="0" name="hw.device" value="Industrial Control"/>
811
+ <param pos="1" name="hw.product"/>
812
+ <param pos="2" name="host.mac"/>
813
+ <param pos="3" name="host.id"/>
814
+ <param pos="4" name="os.version"/>
815
+ <param pos="5" name="os.version.version"/>
816
+ </fingerprint>
817
+ <fingerprint pattern="^Model name\s+: (NE[\w-]+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
818
+ <description>Moxa NE Series Embedded device server</description>
819
+ <!-- Model name : NE-4110S\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No : 3616\r\u0000\nFirmware version : 4.1 Build 07061517\r\u0000\n\r\u0000\nPlease keyin your password: -->
820
+ <example _encoding="base64" hw.product="NE-4110S" host.mac="00:90:E8:AA:AA:AA" host.id="3616" os.version="4.1" os.version.version="07061517">
821
+ TW9kZWwgbmFtZSAgICAgICA6IE5FLTQxMTBTDQAKTUFDIGFkZHJlc3MgICAgICA6IDAwOjkwO
822
+ kU4OkFBOkFBOkFBDQAKU2VyaWFsIE5vICAgICAgICA6IDM2MTYNAApGaXJtd2FyZSB2ZXJzaW
823
+ 9uIDogNC4xIEJ1aWxkIDA3MDYxNTE3DQAKDQAKUGxlYXNlIGtleWluIHlvdXIgcGFzc3dvcmQ6
824
+ </example>
825
+ <param pos="0" name="hw.vendor" value="Moxa"/>
826
+ <param pos="0" name="hw.family" value="NE"/>
827
+ <param pos="0" name="hw.device" value="Device Server"/>
828
+ <param pos="1" name="hw.product"/>
829
+ <param pos="2" name="host.mac"/>
830
+ <param pos="3" name="host.id"/>
831
+ <param pos="4" name="os.version"/>
832
+ <param pos="5" name="os.version.version"/>
833
+ </fingerprint>
834
+ <fingerprint pattern="^Red Hat Linux release ([^\\s]+)\\s*.*$">
835
+ <description>RedHat general purpose linux</description>
836
+ <!-- Red Hat Linux release 9 (Shrike)\nKernel 2.4.20-8 on an i686\nlogin: -->
837
+ <example _encoding="base64" os.version="9 (Shrike)">
838
+ UmVkIEhhdCBMaW51eCByZWxlYXNlIDkgKFNocmlrZSlcbktlcm5lbCAyLjQuMjAtOCBvbiBhbiBpNjg2XG5sb2dpbjo=
839
+ </example>
840
+ <param pos="0" name="os.vendor" value="RedHat"/>
841
+ <param pos="0" name="os.family" value="Linux"/>
842
+ <param pos="0" name="os.device" value="Linux"/>
843
+ <param pos="1" name="os.version"/>
844
+ </fingerprint>
845
+ <fingerprint pattern="^(?m)Red Hat Enterprise Linux ES release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
846
+ <description>RedHat Enterprise Linux ES</description>
847
+ <!-- Red Hat Enterprise Linux ES release 3 (Taroon Update 9\nKernel 2.4.21-47.EL on an x86_64\nlogin: -->
848
+ <example _encoding="base64" os.version="3" linux.kernel.version="2.4.21-47.EL" os.arch="x86_64">
849
+ UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IEVTIHJlbGVhc2UgMyAoVGFyb29uIFVwZGF0ZSA5KQpLZXJuZWwgMi40LjIxLTQ3Lk
850
+ VMIG9uIGFuIHg4Nl82NApsb2dpbjo=
851
+ </example>
852
+ <param pos="0" name="os.vendor" value="RedHat"/>
853
+ <param pos="0" name="os.family" value="Linux"/>
854
+ <param pos="0" name="os.product" value="Linux"/>
855
+ <param pos="1" name="os.version"/>
856
+ <param pos="2" name="linux.kernel.version"/>
857
+ <param pos="3" name="os.arch"/>
858
+ <param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:{os.version}"/>
859
+ </fingerprint>
860
+ <fingerprint pattern="^(?m)Red Hat Enterprise Linux AS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
861
+ <description>RedHat Enterprise Linux AS</description>
862
+ <!-- Red Hat Enterprise Linux AS release 5.8 (Tikanga)\nKernel 2.6.18-308.11.1.el5 on an x86_64\nlogin: -->
863
+ <example _encoding="base64" os.version="5.8" linux.kernel.version="2.6.18-308.11.1.el5" os.arch="x86_64">
864
+ UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IEFTIHJlbGVhc2UgNS44IChUaWthbmdhKQpLZXJuZWwgM
865
+ i42LjE4LTMwOC4xMS4xLmVsNSBvbiBhbiB4ODZfNjQKbG9naW46
866
+ </example>
867
+ <param pos="0" name="os.vendor" value="RedHat"/>
868
+ <param pos="0" name="os.family" value="Linux"/>
869
+ <param pos="0" name="os.product" value="RedHat Enterprise AS"/>
870
+ <param pos="1" name="os.version"/>
871
+ <param pos="2" name="linux.kernel.version"/>
872
+ <param pos="3" name="os.arch"/>
873
+ </fingerprint>
874
+ <fingerprint pattern="^(?m)Red Hat Enterprise Linux WS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*)" flags="REG_MULTILINE">
875
+ <description>RedHat Enterprise Linux WS</description>
876
+ <!--Red Hat Enterprise Linux WS release 2.1 (Tampa) \nKernel 2.4.9-e.40smp on an i686 \nlogin: -->
877
+ <example _encoding="base64" os.version="2.1" linux.kernel.version="2.4.9-e.40smp" os.arch="i686">
878
+ UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IFdTIHJlbGVhc2UgMi4xIChUYW1wY
879
+ SkgCktlcm5lbCAyLjQuOS1lLjQwc21wIG9uIGFuIGk2ODYgCmxvZ2luOiA=
880
+ </example>
881
+ <param pos="0" name="os.vendor" value="RedHat"/>
882
+ <param pos="0" name="os.family" value="Linux"/>
883
+ <param pos="0" name="os.product" value="RedHat Enterprise WS"/>
884
+ <param pos="1" name="os.version"/>
885
+ <param pos="2" name="linux.kernel.version"/>
886
+ <param pos="3" name="os.arch"/>
887
+ </fingerprint>
888
+ <fingerprint pattern="^(?m)Fedora Core.release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d).*$" flags="REG_MULTILINE">
889
+ <description>Fedora Core Release</description>
890
+ <!-- Fedora Core release 1 (Yarrow)\nKernel 2.4.20-13.9ensim-3.5.0-13 on an i686\nlogin:-->
891
+ <example _encoding="base64" os.version="1" linux.kernel.version="2.4.20-13.9ensim-3.5.0-13" os.arch="i686">
892
+ RmVkb3JhIENvcmUgcmVsZWFzZSAxIChZYXJyb3cpCktlcm5lbCAyLjQuMjAtMTMuOWVuc2ltLTMuNS4wLTEzIG9uIGFuIGk2ODYKbG9naW46
893
+ </example>
894
+ <param pos="0" name="os.vendor" value="Redhat"/>
895
+ <param pos="0" name="os.family" value="Linux"/>
896
+ <param pos="0" name="os.product" value="Fedora"/>
897
+ <param pos="1" name="os.version"/>
898
+ <param pos="2" name="linux.kernel.version"/>
899
+ <param pos="3" name="os.arch"/>
900
+ <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora:{os.version}"/>
901
+ </fingerprint>
902
+ <fingerprint pattern="^(?m)Welcome to SuSE Linux (.*) \(([^\)]+)\) - Kernel (.*) .*">
903
+ <description>SuSE Linux</description>
904
+ <!-- Welcome to SuSE Linux 7.0 (i386) - Kernel 2.2.16-RAID (0). 2VG029037\n\nlogin: -->
905
+ <example _encoding="base64" os.version="7.0" os.arch="i386" linux.kernel.version="2.2.16-RAID (0). 2VG029037">
906
+ V2VsY29tZSB0byBTdVNFIExpbnV4IDcuMCAoaTM4NikgLSBLZXJuZWwgMi4yLjE2LVJBSUQgKDApLiAyVkcwMjkwMzcgCgpsb2dpbjo=
907
+ </example>
908
+ <param pos="0" name="os.vendor" value="SUSE"/>
909
+ <param pos="0" name="os.family" value="Linux"/>
910
+ <param pos="0" name="os.product" value="Linux"/>
911
+ <param pos="1" name="os.version"/>
912
+ <param pos="2" name="os.arch"/>
913
+ <param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:{os.version}"/>
914
+ <param pos="3" name="linux.kernel.version"/>
915
+ </fingerprint>
916
+ <fingerprint pattern="^Turbolinux ApplianceServer (\d+\.\d+).*">
917
+ <description>Turbolinux ApplianceServer</description>
918
+ <!--Turbolinux ApplianceServer 4.0 (Atlas2) Linux 2.6.32-431.23.3.el6.x86_64 on a x86_64\n(senyo191x89.digitalink.ne.jp) TTY: 12:15 on Tuesday, 02 October 2018 login: -->
919
+ <example _encoding="base64" os.version="4.0">
920
+ VHVyYm9saW51eCBBcHBsaWFuY2VTZXJ2ZXIgNC4wIChBdGxhczIpIExpbnV4IDIuNi4zMi00MzEuMjMuMy5lbDYueDg
921
+ 2XzY0IG9uIGEgeDg2XzY0IChzZW55bzE5MXg4OS5kaWdpdGFsaW5rLm5lLmpwKSBUVFk6IDEyOjE1IG9uIFR1ZXNkYX
922
+ ksIDAyIE9jdG9iZXIgMjAxOCBsb2dpbjog
923
+ </example>
924
+ <param pos="0" name="os.vendor" value="Turbolinux"/>
925
+ <param pos="0" name="os.family" value="Linux"/>
926
+ <param pos="0" name="os.product" value="Linux"/>
927
+ <param pos="1" name="os.version"/>
928
+ </fingerprint>
929
+ <fingerprint pattern="^UnixWare ([^ ]+).*$">
930
+ <description>UnixWare</description>
931
+ <!-- UnixWare 2.1.3 (profil) (pts/3)\n\n\nlogin: -->
932
+ <example _encoding="base64" os.version="2.1.3">
933
+ VW5peFdhcmUgMi4xLjMgKHByb2ZpbCkgKHB0cy8zKQoKCgpsb2dpbjog
934
+ </example>
935
+ <param pos="0" name="os.vendor" value="SCO"/>
936
+ <param pos="0" name="os.family" value="UnixWare"/>
937
+ <param pos="0" name="os.device" value="UnixWare"/>
938
+ <param pos="0" name="os.product" value="UnixWare"/>
939
+ <param pos="1" name="os.version"/>
940
+ </fingerprint>
941
+ <fingerprint pattern="^Telnet Server Build (5.*)">
942
+ <description>Windows 2000</description>
943
+ <!--Microsoft (R) Windows NT (TM) Version 4.00 (Build 1381)\nWelcome to Microsoft Telnet Service \nTelnet Server Build 5.00.99034.1\nlogin: -->
944
+ <example _encoding="base64" os.version="5.00.99034.1">
945
+ TWljcm9zb2Z0IChSKSBXaW5kb3dzIE5UIChUTSkgVmVyc2lvbiA0LjAwIChCdWlsZCAxMzgxKQpXZWxj
946
+ b21lIHRvIE1pY3Jvc29mdCBUZWxuZXQgU2VydmljZSAKVGVsbmV0IFNlcnZlciBCdWlsZCA1LjAwLjk5MDM0LjEKCmxvZ2luOiA=
947
+ </example>
948
+ <param pos="0" name="os.vendor" value="Microsoft"/>
949
+ <param pos="0" name="os.family" value="Windows"/>
950
+ <param pos="0" name="os.product" value="Windows 2000"/>
951
+ <param pos="1" name="os.version"/>
952
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:{os.version}"/>
953
+ </fingerprint>
954
+ <fingerprint pattern="^Welcome. Type return, enter password at # prompt">
955
+ <description>Brother Printer</description>
956
+ <!-- Welcome. Type return, enter password at # prompt -->
957
+ <example _encoding="base64">
958
+ V2VsY29tZS4gVHlwZSByZXR1cm4sIGVudGVyIHBhc3N3b3JkIGF0ICMgcHJvbXB0Cg==
959
+ </example>
960
+ <param pos="0" name="os.vendor" value="Brother"/>
961
+ <param pos="0" name="os.family" value="Brother"/>
962
+ <param pos="0" name="os.device" value="Printer"/>
963
+ <param pos="0" name="os.product" value="Brother Printer"/>
964
+ </fingerprint>
965
+ <fingerprint pattern="^(.*) Copyright by ARESCOM">
966
+ <description>Arescom System</description>
967
+ <!--NDS1260HE-TLI Copyright by ARESCOM 2002\n\n\nPassword: -->
968
+ <example _encoding="base64" os.model="NDS1260HE-TLI">
969
+ TkRTMTI2MEhFLVRMSSBDb3B5cmlnaHQgYnkgQVJFU0NPTSAyMDAyCgoKClBhc3N3b3JkOgo=
970
+ </example>
971
+ <param pos="0" name="os.vendor" value="Arescom"/>
972
+ <param pos="0" name="os.device" value="WAP"/>
973
+ <param pos="1" name="os.model"/>
974
+ </fingerprint>
975
+ <fingerprint pattern="^Welcome to ViewStation">
976
+ <description>Polycom ViewStation Video Vonference System</description>
977
+ <!-- Welcome to ViewStation\nPassword: -->
978
+ <example _encoding="base64">
979
+ V2VsY29tZSB0byBWaWV3U3RhdGlvbgoKUGFzc3dvcmQ6
980
+ </example>
981
+ <param pos="0" name="os.vendor" value="Polycom"/>
982
+ <param pos="0" name="os.device" value="ViewStation"/>
983
+ </fingerprint>
984
+ <fingerprint pattern="^FlowPoint\/(.*) SDSL \[ATM\] Router .*v(.*) Ready">
985
+ <!--FlowPoint/2200 SDSL [ATM] Router fp2200-12 v3.0.2 Ready\nLogin: -->
986
+ <description>FlowPoint 2200 DSL router</description>
987
+ <example _encoding="base64" hw.model="2200" os.version="3.0.2">
988
+ Rmxvd1BvaW50LzIyMDAgU0RTTCBbQVRNXSBSb3V0ZXIgZnAyMjAwLTEyIHYzLjAuMiBSZWFkeQpMb2dpbjog
989
+ </example>
990
+ <param pos="0" name="os.vendor" value="Flowpoint"/>
991
+ <param pos="0" name="hw.device" value="Broadband router"/>
992
+ <param pos="0" name="hw.product" value="DSL Router"/>
993
+ <param pos="1" name="hw.model"/>
994
+ <param pos="2" name="os.version"/>
995
+ </fingerprint>
996
+ <fingerprint pattern="^GlobespanVirata Inc\., Software Release (.*)">
997
+ <description>GlobespanVirata broadband router</description>
998
+ <!--GlobespanVirata Inc., Software Release 2.1.040407a3_u_e_A\nCopyright (c) 2001-2003 by GlobespanVirata, Inc.\n\nlogin: -->
999
+ <example _encoding="base64" os.version="2.1.040407a3_u_e_A">
1000
+ R2xvYmVzcGFuVmlyYXRhIEluYy4sIFNvZnR3YXJlIFJlbGVhc2UgMi4xLjA0MDQwN2EzX3VfZV9BCgpDb3B5cmlnaHQgKG
1001
+ MpIDIwMDEtMjAwMyBieSBHbG9iZXNwYW5WaXJhdGEsIEluYy4KCgpsb2dpbjog
1002
+ </example>
1003
+ <param pos="0" name="os.vendor" value="Conexant"/>
1004
+ <param pos="0" name="hw.device" value="Broadband router"/>
1005
+ <param pos="1" name="os.version"/>
1006
+ </fingerprint>
1007
+ <fingerprint pattern="^VxWorks login:">
1008
+ <description>VxWorks embedded device</description>
1009
+ <example>VxWorks login: </example>
1010
+ <param pos="0" name="os.family" value="VxWorks"/>
1011
+ </fingerprint>
1012
+ <fingerprint pattern=".*Nortel.*Passport ([^ ]*) .*Software Release ([^ ]*).*">
1013
+ <description>Nortel Passport</description>
1014
+ <!-- *********************************************\n\n\n* Copyright (c) 2003 Nortel Networks, Inc. *\n\n\n* All Rights Reserved *\n\n\n* Passport 8010 *\n\n\n* Software Release 3.5.0.0 *\n\n\n*********************************************\n\n\n\n\nLogin: -->
1015
+ <example _encoding="base64" os.product="8010" os.version="3.5.0.0">
1016
+ KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG5cblxuKiBDb3B5cmlnaHQgKG
1017
+ MpIDIwMDMgTm9ydGVsIE5ldHdvcmtzLCBJbmMuICAqXG5cblxuKiBBbGwgUmlnaHRzIFJlc2VydmVkICAgICAg
1018
+ ICAgICAgICAgICAgICAgICAqXG5cblxuKiBQYXNzcG9ydCA4MDEwICAgICAgICAgICAgICAgICAgICAgICAgIC
1019
+ AgICAqXG5cblxuKiBTb2Z0d2FyZSBSZWxlYXNlIDMuNS4wLjAgICAgICAgICAgICAgICAgICAqXG5cblxuKioq
1020
+ KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG5cblxuXG5cbkxvZ2luOg==
1021
+ </example>
1022
+ <param pos="0" name="os.vendor" value="Nortel"/>
1023
+ <param pos="0" name="os.device" value="Switch"/>
1024
+ <param pos="1" name="os.product"/>
1025
+ <param pos="2" name="os.version"/>
1026
+ </fingerprint>
1027
+ <fingerprint pattern="^IPSO.* \((.*)\) \(tty.*\)">
1028
+ <description>Checkpoint Firewall-1 running on a Nokia IPSO appliance</description>
1029
+ <!-- IPSO/i386 (BJ-IDC-FW2) (ttyp7)\n\n\nThis system is for authorized use only.\n\n\n\n\n\n\nlogin: -->
1030
+ <example _encoding="base64" host.name="BJ-IDC-FW2">
1031
+ SVBTTy9pMzg2IChCSi1JREMtRlcyKSAodHR5cDcpCgoKClRoaXMgc3lzdGVtIGlzIGZvciBhdXRob3Jpem
1032
+ VkIHVzZSBvbmx5LgoKCgoKCgoKbG9naW46IA==
1033
+ </example>
1034
+ <param pos="0" name="os.vendor" value="Check Point"/>
1035
+ <param pos="0" name="os.family" value="Check Point"/>
1036
+ <param pos="0" name="os.device" value="Firewall"/>
1037
+ <param pos="0" name="os.product" value="IPSO"/>
1038
+ <param pos="1" name="host.name"/>
1039
+ </fingerprint>
1040
+ <fingerprint pattern="Tasman Networks Inc.*Telnet Login">
1041
+ <description>Tasman Networks Login</description>
1042
+ <!-- #\n# Tasman Networks Inc. Telnet Login\n#Escape character is '^]'\n\n\n\nlogin: -->
1043
+ <!-- Dashes removed from example banner due to xml issue -->
1044
+ <example _encoding="base64" os.vendor="Tasman Networks">
1045
+ Iy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0
1046
+ tLS0tLS0tCiMgVGFzbWFuIE5ldHdvcmtzIEluYy4gVGVsbmV0IExvZ2luCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS
1047
+ 0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpFc2NhcGUgY2hhcmFjd
1048
+ GVyIGlzICdeXScuCgoKICAgICAgICAKbG9naW46IA==
1049
+ </example>
1050
+ <param pos="0" name="os.vendor" value="Tasman Networks"/>
1051
+ <param pos="0" name="os.device" value="Router"/>
1052
+ <param pos="0" name="os.product" value="Tasman Networks router"/>
1053
+ </fingerprint>
1054
+ <fingerprint pattern="Pragma Systems">
1055
+ <description>MS Windows running Pragma TelnetD server</description>
1056
+ <!-- Welcome to Gemadept Logistics RF Server\n(C) Copyright 1994-2012 Pragma Systems, Inc.\nlogin name: -->
1057
+ <example _encoding="base64">
1058
+ V2VsY29tZSB0byBHZW1hZGVwdCBMb2dpc3RpY3MgUkYgU2VydmVyCihDKSBDb3B5cmlnaHQgMTk5NC0yMDEyIFB
1059
+ yYWdtYSBTeXN0ZW1zLCBJbmMuCgpsb2dpbiBuYW1lOiA=
1060
+ </example>
1061
+ <param pos="0" name="os.vendor" value="Microsoft"/>
1062
+ <param pos="0" name="os.family" value="Windows"/>
1063
+ <param pos="0" name="os.product" value="Windows"/>
1064
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1065
+ </fingerprint>
1066
+ <fingerprint pattern="^Application Required. No Installation Default">
1067
+ <description>probably IBM AS/400 running TN3270 or 5250 emulation server</description>
1068
+ <!-- Application Required. No Installation Default\nEnter Application Name: -->
1069
+ <example _encoding="base64">
1070
+ QXBwbGljYXRpb24gUmVxdWlyZWQuIE5vIEluc3RhbGxhdGlvbiBEZWZhdWx0ICAgICAgICA
1071
+ gICAgICAgICAgICAgICAgICAgICAgICAgIApFbnRlciBBcHBsaWNhdGlvbiBOYW1lOg==
1072
+ </example>
1073
+ <param pos="0" name="os.vendor" value="IBM"/>
1074
+ <param pos="0" name="os.family" value="OS/400"/>
1075
+ <param pos="0" name="os.product" value="OS/400"/>
1076
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:-"/>
1077
+ </fingerprint>
1078
+ <fingerprint pattern="^This copy of the Ataman TCP Remote Logon Services">
1079
+ <description>Windows NT/2k/2k3 running Ataman telnet server</description>
1080
+ <!-- This copy of the Ataman TCP Remote Logon Services is registered as licensed to:\nECI2/DDMS\nAccount Name: -->
1081
+ <example _encoding="base64">
1082
+ VGhpcyBjb3B5IG9mIHRoZSBBdGFtYW4gVENQIFJlbW90ZSBMb2dvbiBTZXJ2aWNlcyBpcyByZWdpc3RlcmVkIG
1083
+ FzIGxpY2Vuc2VkIHRvOgoJRUNJMi9ERE1TCgpBY2NvdW50IE5hbWU6IA==
1084
+ </example>
1085
+ <param pos="0" name="os.vendor" value="Microsoft"/>
1086
+ <param pos="0" name="os.family" value="Windows"/>
1087
+ <param pos="0" name="os.product" value="Windows"/>
1088
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1089
+ </fingerprint>
1090
+ <fingerprint pattern="Cobalt Linux release\W(.*)\W\(.*">
1091
+ <description>Cobalt Linux</description>
1092
+ <!-- Cobalt Linux release 6.0 (Shinkansen)\nKernel 2.2.16C37_III on an i586\nlogin: -->
1093
+ <example _encoding="base64" os.version="6.0">
1094
+ Q29iYWx0IExpbnV4IHJlbGVhc2UgNi4wIChTaGlua2Fuc2VuKQpLZXJuZWwgMi4yLjE2QzM3X0lJSSBvbiBhbiBpNTg2CmxvZ2luOiA=
1095
+ </example>
1096
+ <param pos="0" name="os.vendor" value="Cobalt"/>
1097
+ <param pos="0" name="os.family" value="Linux"/>
1098
+ <param pos="0" name="os.product" value="Linux"/>
1099
+ <param pos="1" name="os.version"/>
1100
+ </fingerprint>
1101
+ <fingerprint pattern="^Check Point FireWall-1 authenticated Telnet server running on (.*)">
1102
+ <description>Check Point Firewall-1</description>
1103
+ <!-- Check Point FireWall-1 authenticated Telnet server running on gaatdrf2\nUser: -->
1104
+ <example _encoding="base64" host.name="gaatdrf2">
1105
+ Q2hlY2sgUG9pbnQgRmlyZVdhbGwtMSBhdXRoZW50aWNhdGVkIFRlbG5ldCBzZXJ2ZXIgcnVubmluZyBvbiBnYWF0ZHJmMgoKVXNlcjog
1106
+ </example>
1107
+ <param pos="0" name="os.vendor" value="Checkpoint"/>
1108
+ <param pos="0" name="os.family" value="Checkpoint"/>
1109
+ <param pos="0" name="os.device" value="Firewall"/>
1110
+ <param pos="0" name="os.product" value="Checkpoint FW1"/>
1111
+ <param pos="1" name="host.name"/>
1112
+ </fingerprint>
1113
+ <fingerprint pattern="^Raptor Firewall">
1114
+ <description>Raptor Firewall</description>
1115
+ <!-- Raptor Firewall Secure Gateway.\nHostname: -->
1116
+ <example _encoding="base64">
1117
+ UmFwdG9yIEZpcmV3YWxsIFNlY3VyZSBHYXRld2F5LgoKSG9zdG5hbWU6IA==
1118
+ </example>
1119
+ <param pos="0" name="os.vendor" value="Symantec"/>
1120
+ <param pos="0" name="os.family" value="Raptor"/>
1121
+ <param pos="0" name="os.device" value="Firewall"/>
1122
+ <param pos="0" name="os.product" value="Raptor"/>
1123
+ </fingerprint>
1124
+ <fingerprint pattern="UNIX\(r\) System V Release (\d*.\d*)">
1125
+ <description>SunOS (Solaris)</description>
1126
+ <!-- Raptor Firewall Secure Gateway.\nHostname: -->
1127
+ <example _encoding="base64" os.version="4.0">
1128
+ VU5JWChyKSBTeXN0ZW0gViBSZWxlYXNlIDQuMCAoVGhlLVNlcnZlcikKCgoKbG9naW46IA==
1129
+ </example>
1130
+ <param pos="0" name="os.vendor" value="Sun"/>
1131
+ <param pos="0" name="os.family" value="Solaris"/>
1132
+ <param pos="0" name="os.product" value="Solaris"/>
1133
+ <param pos="1" name="os.version"/>
1134
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
1135
+ </fingerprint>
1136
+ <fingerprint pattern="Solaris (.*)">
1137
+ <description>Solaris</description>
1138
+ <!-- Seattle Community Network Sun Solaris 1.1.1.B\nPlease login as 'visitor' if you are a visitorn\n\nSunOS UNIX (scn)\n\n\nlogin:-->
1139
+ <example _encoding="base64" os.version="1.1.1.B">
1140
+ U2VhdHRsZSBDb21tdW5pdHkgTmV0d29yayBTdW4gU29sYXJpcyAxLjEuMS5CClBsZWFzZSBsb2dpbiBhcyAndml
1141
+ zaXRvcicgaWYgeW91IGFyZSBhIHZpc2l0b3IKCgpTdW5PUyBVTklYIChzY24pCgoKCmxvZ2luOg==
1142
+ </example>
1143
+ <param pos="0" name="os.vendor" value="Sun"/>
1144
+ <param pos="0" name="os.family" value="Solaris"/>
1145
+ <param pos="0" name="os.product" value="Solaris"/>
1146
+ <param pos="1" name="os.version"/>
1147
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
1148
+ </fingerprint>
1149
+ <fingerprint pattern="^Digital UNIX \(([^)]+).*">
1150
+ <description>Digital Unix</description>
1151
+ <!-- Digital UNIX (journal) (ttyp2)\n\n\nlogin: -->
1152
+ <example _encoding="base64" host.name="journal">
1153
+ RGlnaXRhbCBVTklYIChqb3VybmFsKSAodHR5cDIpCgoKCmxvZ2luOiA=
1154
+ </example>
1155
+ <param pos="0" name="os.vendor" value="HP"/>
1156
+ <param pos="0" name="os.family" value="Digital Unix"/>
1157
+ <param pos="0" name="os.product" value="Digital Unix"/>
1158
+ <param pos="1" name="host.name"/>
1159
+ </fingerprint>
1160
+ <fingerprint pattern="^(?m)Compaq Tru64 UNIX V(.*) \(Rev. (.*\d)\) .*">
1161
+ <description>Compaq Tru64 UNIX V</description>
1162
+ <!-- Compaq Tru64 UNIX V5.1B (Rev. 2650) (docalpha) (pts/11)\n\n\n\n\nlogin: -->
1163
+ <example _encoding="base64" os.version="5.1B" os.rev="2650">
1164
+ Q29tcGFxIFRydTY0IFVOSVggVjUuMUIgKFJldi4gMjY1MCkgKGRvY2FscGhhKSAocHRzLzExKQoKCgoKCmxvZ2luOg==
1165
+ </example>
1166
+ <param pos="0" name="os.vendor" value="HP"/>
1167
+ <param pos="0" name="os.family" value="Digital Unix"/>
1168
+ <param pos="0" name="os.product" value="TRU64"/>
1169
+ <param pos="1" name="os.version"/>
1170
+ <param pos="2" name="os.rev"/>
1171
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:tru64:{os.version}"/>
1172
+ </fingerprint>
1173
+ <fingerprint pattern="HP-UX ([^ ]+) [A-Z]\.([^ ]+) ([^ ]+) ([^ ]+)\s([^ ]+\)).*$">
1174
+ <description>System HP-UX</description>
1175
+ <!-- HP-UX ctout B.11.11 U 9000/800 (tc)\nlogin: -->
1176
+ <example _encoding="base64" host.name="ctout" os.version="11.11" hw.series="9000/800" hw.model="(tc)">
1177
+ SFAtVVggY3RvdXQgQi4xMS4xMSBVIDkwMDAvODAwICh0YykKCmxvZ2luOiA=
1178
+ </example>
1179
+ <param pos="0" name="os.vendor" value="HP"/>
1180
+ <param pos="0" name="os.family" value="HP-UX"/>
1181
+ <param pos="0" name="os.product" value="HP-UX"/>
1182
+ <param pos="1" name="host.name"/>
1183
+ <param pos="2" name="os.version"/>
1184
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:{os.version}"/>
1185
+ <param pos="3" name="hw.version"/>
1186
+ <param pos="4" name="hw.series"/>
1187
+ <param pos="5" name="hw.model"/>
1188
+ </fingerprint>
1189
+ <fingerprint pattern="^Data ONTAP">
1190
+ <description>A NetApp apliance</description>
1191
+ <!-- Data ONTAP (s500.)\nlogin: -->
1192
+ <example _encoding="base64">RGF0YSBPTlRBUCAoczUwMC4pCmxvZ2luOiA=</example>
1193
+ <param pos="0" name="os.vendor" value="NetApp"/>
1194
+ <param pos="0" name="os.family" value="Data ONTAP"/>
1195
+ <param pos="0" name="os.product" value="Data ONTAP"/>
1196
+ <param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:-"/>
1197
+ </fingerprint>
1198
+ <fingerprint pattern="OpenVMS.*Version\sV([^\s]+).*">
1199
+ <description>OpenVMS</description>
1200
+ <!-- Welcome to OpenVMS (TM) Alpha Operating System, Version V8.4 - NOT70\n\nUsername: -->
1201
+ <example _encoding="base64" os.version="8.4">
1202
+ IFdlbGNvbWUgdG8gT3BlblZNUyAoVE0pIEFscGhhIE9wZXJhdGluZyBTeXN0Z
1203
+ W0sIFZlcnNpb24gVjguNCAgICAgLSBOT1Q3MAoKClVzZXJuYW1lOiA=
1204
+ </example>
1205
+ <param pos="0" name="os.vendor" value="HP"/>
1206
+ <param pos="0" name="os.family" value="OpenVMS"/>
1207
+ <param pos="0" name="os.product" value="VMS"/>
1208
+ <param pos="1" name="os.version"/>
1209
+ </fingerprint>
1210
+ <fingerprint pattern="^(?m)SCO OpenServer\(TM\) Release ([^ ]+).*$">
1211
+ <description>SCO OpenServer</description>
1212
+ <!-- SCO OpenServer(TM) Release 5 (bomdia.co.za) (ttyp6)\nlogin: -->
1213
+ <example _encoding="base64" os.version="5">
1214
+ U0NPIE9wZW5TZXJ2ZXIoVE0pIFJlbGVhc2UgNSAoYm9tZGlhLmNvLnphKSAodHR5cDYpCgpsb2dpbjo=
1215
+ </example>
1216
+ <param pos="0" name="os.vendor" value="SCO"/>
1217
+ <param pos="0" name="os.family" value="OpenServer"/>
1218
+ <param pos="0" name="os.product" value="OpenServer"/>
1219
+ <param pos="1" name="os.version"/>
1220
+ </fingerprint>
1221
+ <fingerprint pattern="^% Username: timeout expired!">
1222
+ <description>Some kind of Cisco device</description>
1223
+ <!-- % Username: timeout expired!-->
1224
+ <example _encoding="base64">
1225
+ JSBVc2VybmFtZTogIHRpbWVvdXQgZXhwaXJlZCE=
1226
+ </example>
1227
+ <param pos="0" name="os.vendor" value="Cisco"/>
1228
+ <param pos="0" name="os.family" value="IOS"/>
1229
+ <param pos="0" name="os.product" value="IOS"/>
1230
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:-"/>
1231
+ </fingerprint>
1232
+ <fingerprint pattern="^Welcome to MKS Telnet Server Version">
1233
+ <description>Windows running MKS Telnet Server</description>
1234
+ <example _encoding="base64">
1235
+ V2VsY29tZSB0byBNS1MgVGVsbmV0IFNlcnZlciBWZXJzaW9uIDQuNzAuMDAwMC4KbG9naW46IA==
1236
+ </example>
1237
+ <param pos="0" name="os.vendor" value="Microsoft"/>
1238
+ <param pos="0" name="os.family" value="Windows"/>
1239
+ <param pos="0" name="os.product" value="Windows"/>
1240
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1241
+ </fingerprint>
1242
+ <fingerprint pattern="^Sorry, this system is engaged\.">
1243
+ <description>an embedded print server</description>
1244
+ <example>Sorry, this system is engaged.</example>
1245
+ <param pos="0" name="os.vendor" value="Epson"/>
1246
+ <param pos="0" name="os.device" value="Printer"/>
1247
+ </fingerprint>
1248
+ <fingerprint pattern="^TELNET session now in ESTABLISHED state">
1249
+ <description>an Allied Telesyn router</description>
1250
+ <!-- TELNET session now in ESTABLISHED state\n\nGEO-003 login: -->
1251
+ <example _encoding="base64">
1252
+ VEVMTkVUIHNlc3Npb24gbm93IGluIEVTVEFCTElTSEVEIHN0YXRlCgpHRU8tMDAzIGxvZ2luOiA=
1253
+ </example>
1254
+ <param pos="0" name="os.vendor" value="Allied Telesyn"/>
1255
+ <param pos="0" name="os.device" value="Router"/>
1256
+ <param pos="0" name="os.product" value="Allied Telesyn router"/>
1257
+ </fingerprint>
1258
+ <fingerprint pattern="^CONEXANT SYSTEMS.*ACCESS RUNNER ADSL">
1259
+ <description>a Conexant ADSL router</description>
1260
+ <!-- CONEXANT SYSTEMS, INC. ACCESS RUNNER ADSL CONSOLE PORT>>>LOGON PASSWORD>3.27****** -->
1261
+ <example _encoding="base64">
1262
+ Q09ORVhBTlQgU1lTVEVNUywgSU5DLiBBQ0NFU1MgUlVOTkVSIEFEU0wgQ09OU09MRSBQ
1263
+ T1JUPj4+TE9HT04gUEFTU1dPUkQ+My4yNyoqKioqKg==
1264
+ </example>
1265
+ <param pos="0" name="os.vendor" value="Conexant"/>
1266
+ <param pos="0" name="os.device" value="Broadband router"/>
1267
+ <param pos="0" name="os.product" value="AccessRunner ADSL router"/>
1268
+ </fingerprint>
1269
+ <fingerprint pattern="^System administrator is connecting from">
1270
+ <description>a DrayTek Vigor SOHO Router</description>
1271
+ <!-- System administrator is connecting from 54.39.173.86\n\nReject the connection request !!! -->
1272
+ <example _encoding="base64">
1273
+ U3lzdGVtIGFkbWluaXN0cmF0b3IgaXMgY29ubmVjdGluZyBmcm9tIDU0LjM5LjE3My44NgoKUmVqZWN0IH
1274
+ RoZSBjb25uZWN0aW9uIHJlcXVlc3QgISEh
1275
+ </example>
1276
+ <param pos="0" name="hw.vendor" value="DrayTek"/>
1277
+ <param pos="0" name="hw.device" value="Broadband router"/>
1278
+ <param pos="0" name="hw.product" value="Vigor"/>
1279
+ </fingerprint>
1280
+ <fingerprint pattern=".*Version\s(\d*.\d*)\/OpenBSD.*">
1281
+ <description>OpenBSD</description>
1282
+ <!-- 220 killer09 FTP server (Version 6.4/OpenBSD/Linux-ftpd-0.17) ready. -->
1283
+ <example _encoding="base64" os.version="6.4">
1284
+ MjIwIGtpbGxlcjA5IEZUUCBzZXJ2ZXIgKFZlcnNpb24gNi40L09wZW5CU0QvTGludXgtZnRwZC0wLjE3KSByZWFkeS4K
1285
+ </example>
1286
+ <param pos="0" name="os.vendor" value="OpenBSD"/>
1287
+ <param pos="0" name="os.family" value="OpenBSD"/>
1288
+ <param pos="0" name="os.product" value="OpenBSD"/>
1289
+ <param pos="1" name="os.version"/>
1290
+ <param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:{os.version}"/>
1291
+ </fingerprint>
1292
+ <fingerprint pattern="^FreeBSD\/([^\\s]+)\s+\(([^\s]+)\)">
1293
+ <description>a FreeBSD</description>
1294
+ <!-- FreeBSD/amd64 (ms.gymspgs.cz) (pts/0)\n\n\n\nlogin: -->
1295
+ <example _encoding="base64" os.arch="amd64" host.name="ms.gymspgs.cz">
1296
+ RnJlZUJTRC9hbWQ2NCAobXMuZ3ltc3Bncy5jeikgKHB0cy8wKQoKCgpsb2dpbjo=
1297
+ </example>
1298
+ <param pos="0" name="os.vendor" value="FreeBSD"/>
1299
+ <param pos="0" name="os.family" value="FreeBSD"/>
1300
+ <param pos="0" name="os.product" value="FreeBSD"/>
1301
+ <param pos="1" name="os.arch"/>
1302
+ <param pos="0" name="os.cpe23" value="cpe:/o:freebsd:freebsd:-"/>
1303
+ <param pos="2" name="host.name"/>
1304
+ </fingerprint>
1305
+ <fingerprint pattern="^NetBSD">
1306
+ <description>NetBSD</description>
1307
+ <!-- NetBSD/evbsh3 (Fukuyama.Host_AKS_0555_WL-v2.60d) (ttyp1) -->
1308
+ <example _encoding="base64">
1309
+ TmV0QlNEL21lc3NpbWlwcyAoKSAodHR5cDMpCgpsb2dpbjog
1310
+ </example>
1311
+ <param pos="0" name="os.vendor" value="NetBSD"/>
1312
+ <param pos="0" name="os.family" value="NetBSD"/>
1313
+ <param pos="0" name="os.product" value="NetBSD"/>
1314
+ <param pos="0" name="os.cpe23" value="cpe:/o:netbsd:netbsd:-"/>
1315
+ </fingerprint>
1316
+ <fingerprint pattern="^IRIX\W\((.*)\)">
1317
+ <description>SGI IRIX</description>
1318
+ <!-- IRIX (artemis.biol.uoa.gr)\n\n\n\nlogin: -->
1319
+ <example _encoding="base64" host.name="artemis.biol.uoa.gr">
1320
+ SVJJWCAoYXJ0ZW1pcy5iaW9sLnVvYS5ncikKCgoKbG9naW46IA==
1321
+ </example>
1322
+ <param pos="0" name="os.vendor" value="SGI"/>
1323
+ <param pos="0" name="os.family" value="IRIX"/>
1324
+ <param pos="0" name="os.product" value="IRIX"/>
1325
+ <param pos="0" name="os.cpe23" value="cpe:/o:sgi:irix:-"/>
1326
+ <param pos="1" name="host.name"/>
1327
+ </fingerprint>
1328
+ <fingerprint pattern="(?m)(ES|RS)\s([^\s]+) System Software, Version ([^\s]+).*Riverstone Networks" flags="REG_MULTILINE">
1329
+ <description>a Riverstone router</description>
1330
+ <!-- Using '+' instead of '-' due to xml issue -->
1331
+ <!-- ++++++++++++++++++++++++++++++++++\nES 10170 System Software, Version 9.3.0.4\n
1332
+ Riverstone Networks, Inc., Copyright (c) 2000-2003. All rights reserved.\nSystem started on 2018-09-06 15:58:\n
1333
+ +++++++++++++++++++++++++++++++++++++++ -->
1334
+ <example _encoding="base64" os.product="10170" os.version="9.3.0.4" os.family="ES">
1335
+ LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
1336
+ S0tLS0tLQpFUyAxMDE3MCBTeXN0ZW0gU29mdHdhcmUsIFZlcnNpb24gOS4zLjAuNApSaXZlcnN0b25lIE5ldH
1337
+ dvcmtzLCBJbmMuLCBDb3B5cmlnaHQgKGMpIDIwMDAtMjAwMy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KU3lzdGV
1338
+ tIHN0YXJ0ZWQgb24gMjAxOC0wOS0wNiAxNTo1ODozMAotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1339
+ LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS4uLg==
1340
+ </example>
1341
+ <!-- +++++++++++++++++++++++++++++++++++++++\nRS 10170 System Software, Version 9.3.0.5\n
1342
+ Riverstone Networks, Inc., Copyright (c) 2000-2003. All rights reserved.\nSystem started on 2018-09-06 15:58:\n
1343
+ +++++++++++++++++++++++++++++++++++++++ -->
1344
+ <example _encoding="base64" os.product="8000" os.version="9.3.0.5" os.family="RS">
1345
+ LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
1346
+ S0tLS0tLQpSUyA4MDAwIFN5c3RlbSBTb2Z0d2FyZSwgVmVyc2lvbiA5LjMuMC41ClJpdmVyc3RvbmUgTmV0d2
1347
+ 9ya3MsIEluYy4sIENvcHlyaWdodCAoYykgMjAwMC0yMDA0LiBBbGwgcmlnaHRzIHJlc2VydmVkLgpTeXN0ZW0
1348
+ gc3RhcnRlZCBvbiAyMDE4LTEwLTExIDIyOjAyOjAzCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1349
+ LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS4uLg==
1350
+ </example>
1351
+ <param pos="0" name="os.vendor" value="Riverstone"/>
1352
+ <param pos="0" name="os.device" value="Router"/>
1353
+ <param pos="1" name="os.family"/>
1354
+ <param pos="2" name="os.product"/>
1355
+ <param pos="3" name="os.version"/>
1356
+ </fingerprint>
1357
+ <fingerprint pattern="^HP ([^\s]+) ProCurve Switch">
1358
+ <description>HP ProCurve Switch</description>
1359
+ <!-- ==============================================================================\nHP J4121A ProCurve Switch 4000M\n
1360
+ Firmware revision v2.2.3\n\nCopyright (C) 1991-2004 Hewlett-Packard Co. All Rights Reserved.\n\n
1361
+ RESTRICTED RIGHTS LEGEND\n\n Use, duplication, or disclosure by the Government is subject to restrictions\n\n
1362
+ as set forth in subdivision (b) (3) (ii) of the Rights in Technical Data and\n\nComputer Software clause at 52.227-7013.\n\n
1363
+ HEWLETT-PACKARD COMPANY, 3000 Hanover St., Palo Alto, CA 94303\n\n\nWe'd like to keep you up to date about:\n*
1364
+ Software feature updates\n* New product announcements\n* Special events\n\n\nPlease register your
1365
+ products now at: www.ProCurve.com\n==============================================================================\n
1366
+ \n\nUsername: -->
1367
+ <example _encoding="base64" os.product="J4121A">
1368
+ PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09P
1369
+ T09PT09PT09PT09PT09PT09PT09PT09CkhQIEo0MTIxQSBQcm9DdXJ2ZSBTd2l0Y2ggNDAwME
1370
+ 0KRmlybXdhcmUgcmV2aXNpb24gdjIuMi4zCgpDb3B5cmlnaHQgKEMpIDE5OTEtMjAwNCBIZXd
1371
+ sZXR0LVBhY2thcmQgQ28uIEFsbCBSaWdodHMgUmVzZXJ2ZWQuCgogICAgICAgICAgICAgICAg
1372
+ ICAgICAgICBSRVNUUklDVEVEIFJJR0hUUyBMRUdFTkQKCiBVc2UsIGR1cGxpY2F0aW9uLCBvc
1373
+ iBkaXNjbG9zdXJlIGJ5IHRoZSBHb3Zlcm5tZW50IGlzIHN1YmplY3QgdG8gcmVzdHJpY3Rpb2
1374
+ 5zCiAKIGFzIHNldCBmb3J0aCBpbiBzdWJkaXZpc2lvbiAoYikgKDMpIChpaSkgb2YgdGhlIFJ
1375
+ pZ2h0cyBpbiBUZWNobmljYWwgRGF0YSBhbmQKIAogQ29tcHV0ZXIgU29mdHdhcmUgY2xhdXNl
1376
+ IGF0IDUyLjIyNy03MDEzLgoKICAgICAgSEVXTEVUVC1QQUNLQVJEIENPTVBBTlksIDMwMDAgS
1377
+ GFub3ZlciBTdC4sIFBhbG8gQWx0bywgQ0EgOTQzMDMKCiAgICAgICAgICAgICAgICAgICAgIC
1378
+ AgIApXZSdkIGxpa2UgdG8ga2VlcCB5b3UgdXAgdG8gZGF0ZSBhYm91dDoKICogU29mdHdhcmU
1379
+ gZmVhdHVyZSB1cGRhdGVzCiAqIE5ldyBwcm9kdWN0IGFubm91bmNlbWVudHMKICogU3BlY2lh
1380
+ bCBldmVudHMKCiAgICAgICAgICAgICAgICAgICAgICAgIApQbGVhc2UgcmVnaXN0ZXIgeW91c
1381
+ iBwcm9kdWN0cyBub3cgYXQ6IHd3dy5Qcm9DdXJ2ZS5jb20KPT09PT09PT09PT09PT09PT09PT
1382
+ 09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0
1383
+ 9PT09CgoKVXNlcm5hbWU6IA==
1384
+ </example>
1385
+ <param pos="0" name="os.vendor" value="HP"/>
1386
+ <param pos="0" name="os.family" value="ProCurve"/>
1387
+ <param pos="0" name="os.device" value="Switch"/>
1388
+ <param pos="1" name="os.product"/>
1389
+ </fingerprint>
1390
+ <fingerprint pattern="^(?m).*ConnectUPS">
1391
+ <description>PowerWare ConnectUPS</description>
1392
+ <!-- +============================================================================+\n| [ ConnectUPS Web/SNMP
1393
+ Card Configuration Utility ] |\n+============================================================================+\n
1394
+ \nEnter Password: -->
1395
+ <example _encoding="base64">
1396
+ Kz09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0
1397
+ 9PT09PT09PT09PT09PT0rCnwgICAgICAgICAgICBbIENvbm5lY3RVUFMgV2ViL1NOTVAgQ2FyZCBDb25maW
1398
+ d1cmF0aW9uIFV0aWxpdHkgXSAgICAgICAgICAgICAgfAorPT09PT09PT09PT09PT09PT09PT09PT09PT09P
1399
+ T09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PSsKCkVudGVyIFBhc3N3
1400
+ b3JkOiA=
1401
+ </example>
1402
+ <param pos="0" name="os.vendor" value="PowerWare"/>
1403
+ <param pos="0" name="os.family" value="ConnectUPS"/>
1404
+ <param pos="0" name="os.device" value="UPS"/>
1405
+ <param pos="0" name="os.product" value="ConnectUPS"/>
1406
+ </fingerprint>
1407
+ <fingerprint pattern="^Imagistics.*im">
1408
+ <description>an Imagistics device</description>
1409
+ <!-- Imagistics im3511/im4511 Ver 01.00.20 TELNET server.\nCopyright(c) 2001-2005, silex technology, Inc.\nlogin: -->
1410
+ <example _encoding="base64">
1411
+ SW1hZ2lzdGljcyBpbTM1MTEvaW00NTExIFZlciAwMS4wMC4yMCBURUxORVQgc2VydmVyLgpDb3B5cmlnaH
1412
+ QoYykgMjAwMS0yMDA1LCBzaWxleCB0ZWNobm9sb2d5LCBJbmMuCmxvZ2luOiA=
1413
+ </example>
1414
+ <param pos="0" name="os.vendor" value="Imagistics"/>
1415
+ <param pos="0" name="os.family" value="Imagistics"/>
1416
+ <param pos="0" name="os.device" value="Multifunction Device"/>
1417
+ <param pos="0" name="os.product" value="im"/>
1418
+ </fingerprint>
1419
+ <fingerprint pattern="^NRG Maintenance Shell">
1420
+ <description>a Ricoh NRG device</description>
1421
+ <!-- NRG Maintenance Shell. \nUser access verification.\nlogin: -->
1422
+ <example _encoding="base64">
1423
+ TlJHIE1haW50ZW5hbmNlIFNoZWxsLiAgIAoKVXNlciBhY2Nlc3MgdmVyaWZpY2F0aW9uLgoKbG9naW46
1424
+ </example>
1425
+ <param pos="0" name="os.vendor" value="Ricoh"/>
1426
+ <param pos="0" name="os.device" value="Printer"/>
1427
+ <param pos="0" name="os.product" value="NRG Printer"/>
1428
+ </fingerprint>
1429
+ <fingerprint pattern="^SHARP (AR-[^\\s]+) Ver ([^\\s]+) TELNET server">
1430
+ <description>SHARP AR Series multifunction device</description>
1431
+ <!-- SHARP AR-M351U Ver 01.00.18 TELNET server.\nCopyright(c) 2001-2005, silex technology, Inc.\nlogin: -->
1432
+ <example _encoding="base64" os.product="AR-M351U" os.version="01.00.18">
1433
+ U0hBUlAgQVItTTM1MVUgVmVyIDAxLjAwLjE4IFRFTE5FVCBzZXJ2ZXIuCkNvcHlyaWdodChjKSAyMDAx
1434
+ LTIwMDUsIHNpbGV4IHRlY2hub2xvZ3ksIEluYy4KbG9naW46IA==
1435
+ </example>
1436
+ <param pos="0" name="os.vendor" value="Sharp"/>
1437
+ <param pos="0" name="os.family" value="Sharp AR Series"/>
1438
+ <param pos="0" name="os.device" value="Multifunction Device"/>
1439
+ <param pos="1" name="os.product"/>
1440
+ <param pos="2" name="os.version"/>
1441
+ </fingerprint>
1442
+ <fingerprint pattern="^SHARP (MX-[^\\s]+) Ver ([^\\s]+) TELNET server">
1443
+ <description>SHARP MX Series multifunction device</description>
1444
+ <!-- SHARP MX-3610N Ver 01.05.00.0o.18 TELNET server.\nCopyright(C) 2005- SHARP CORPORATION\nCopyright(C) 2005-
1445
+ silex technology, Inc.\nlogin: -->
1446
+ <example _encoding="base64" os.product="MX-3610N" os.version="01.05.00.0o.18">
1447
+ U0hBUlAgTVgtMzYxME4gVmVyIDAxLjA1LjAwLjBvLjE4IFRFTE5FVCBzZXJ2ZXIuCkNvcHlyaWdodC
1448
+ hDKSAyMDA1LSAgICAgU0hBUlAgQ09SUE9SQVRJT04KQ29weXJpZ2h0KEMpIDIwMDUtICAgICBzaWxl
1449
+ eCB0ZWNobm9sb2d5LCBJbmMuCmxvZ2luOiA=
1450
+ </example>
1451
+ <param pos="0" name="os.vendor" value="Sharp"/>
1452
+ <param pos="0" name="os.family" value="Sharp MX Series"/>
1453
+ <param pos="0" name="os.device" value="Multifunction Device"/>
1454
+ <param pos="1" name="os.product"/>
1455
+ <param pos="2" name="os.version"/>
1456
+ </fingerprint>
1457
+ <fingerprint pattern="^(?m).*Welcome to MELCO Print Server.*Server Name *: *([^ ]*)\W.*Server Model *: *([^ ]*).*F \/ W Version *: *([^ ]*).*MAC Address *: *(.. .. .. .. .. ..).*$">
1458
+ <description>System is a Buffalo/MELCO Embedded Print Server</description>
1459
+ <!-- ***********************************\n* Welcome to MELCO Print Server *\n* Telnet Console *\n***********************************
1460
+ \n \nServer Name: PS-B04E8E\nServer Model: LPV 2 - TX 1\nF / W Version: 2.00 J \nMAC Address: AE 32 EA 21 BB E3\n
1461
+ Uptime: 0 days, 00: 00: 12\n \nPlease Enter Password:"-->
1462
+ <example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" os.model="LPV" os.address="AE 32 EA 21 BB E3">
1463
+ KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiogV2VsY29tZSB0byBNRUxDTyBQc
1464
+ mludCBTZXJ2ZXIgKlxuKiBUZWxuZXQgQ29uc29sZSAqXG4qKioqKioqKioqKioqKioqKioqKioqKi
1465
+ oqKioqKioqKioqKlxuIFxuU2VydmVyIE5hbWU6IFBTLUIwNEU4RVxuU2VydmVyIE1vZGVsOiBMUFY
1466
+ gMiAtIFRYIDFcbkYgLyBXIFZlcnNpb246IDIuMDAgSiBcbk1BQyBBZGRyZXNzOiBBRSAzMiBFQSAy
1467
+ MSBCQiBFM1xuVXB0aW1lOiAwIGRheXMsIDAwOiAwMDogMTJcbiBcblBsZWFzZSBFbnRlciBQYXNzd
1468
+ 29yZDoi
1469
+ </example>
1470
+ <param pos="0" name="os.vendor" value="Buffalo"/>
1471
+ <param pos="0" name="os.family" value="PrintServer"/>
1472
+ <param pos="0" name="os.device" value="Printer"/>
1473
+ <param pos="1" name="host.id"/>
1474
+ <param pos="2" name="os.model"/>
1475
+ <param pos="3" name="os.version"/>
1476
+ <param pos="4" name="os.address"/>
1477
+ </fingerprint>
1478
+ <fingerprint pattern="^(?m)AIX Version\W(\d).*">
1479
+ <description>System is IBM AIX v</description>
1480
+ <!-- AIX Version 6\nCopyright IBM Corporation, 1982, 2007.\nlogin: -->
1481
+ <example _encoding="base64" os.version="6">
1482
+ QUlYIFZlcnNpb24gNgpDb3B5cmlnaHQgSUJNIENvcnBvcmF0aW9uLCAxOTgyLCAyMDA3Lgpsb2dpbjogCg==
1483
+ </example>
1484
+ <param pos="0" name="os.vendor" value="IBM"/>
1485
+ <param pos="0" name="os.family" value="AIX"/>
1486
+ <param pos="0" name="os.product" value="AIX"/>
1487
+ <param pos="1" name="os.version"/>
1488
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1489
+ </fingerprint>
1490
+ <fingerprint pattern="^(?m)CIMC Debug Firmware Utility Shell\W([^\s]+).*">
1491
+ <description>System is Cisco UCS Device</description>
1492
+ <!-- CIMC Debug Firmware Utility Shell\nfake-ucs-device-3-1-p login: -->
1493
+ <example _encoding="base64" host.name="fake-ucs-device-3-1-p">
1494
+ Q0lNQyBEZWJ1ZyBGaXJtd2FyZSBVdGlsaXR5IFNoZWxsCmZha2UtdWNzLWRldmljZS0zLTEtcCBsb2dpbjogCg==
1495
+ </example>
1496
+ <param pos="0" name="os.vendor" value="Cisco"/>
1497
+ <param pos="0" name="os.family" value="UCS"/>
1498
+ <param pos="0" name="os.device" value="Network Management Device"/>
1499
+ <param pos="0" name="os.product" value="UCS Device"/>
1500
+ <param pos="1" name="host.name"/>
1501
+ </fingerprint>
1502
+ <fingerprint pattern="^(?m)HP ProLiant.*v(\d+.\d+)">
1503
+ <description>Sytem is HP ProLiant server</description>
1504
+ <!-- HP ProLiant BL e-Class Integrated Administrator v2.00
1505
+ Copyright 2005 Hewlett-Packard Development Group, L.P.
1506
+ WARNING: This is a private system. Do not attempt to login unless you are an
1507
+ authorized user. Any authorized or unauthorized access and use may be moni-
1508
+ tored and can result in criminal or civil prosecution under applicable law.
1509
+ IA-00508BEBAA59 login: -->
1510
+ <example _encoding="base64" os.version="2.00">
1511
+ SFAgUHJvTGlhbnQgQkwgZS1DbGFzcyBJbnRlZ3JhdGVkIEFkbWluaXN0cmF0b3IgdjIuMDAKICAgICAgI
1512
+ CAgQ29weXJpZ2h0IDIwMDUgSGV3bGV0dC1QYWNrYXJkIERldmVsb3BtZW50IEdyb3VwLCBMLlAuCgogIC
1513
+ AgICAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0
1514
+ tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQogICAgICAgICBXQVJOSU5HOiBUaGlzIGlzIGEgcHJpdmF0ZSBz
1515
+ eXN0ZW0uICBEbyBub3QgYXR0ZW1wdCB0byBsb2dpbiB1bmxlc3MgeW91IGFyZSBhbgogICAgICAgICBhd
1516
+ XRob3JpemVkIHVzZXIuICBBbnkgYXV0aG9yaXplZCBvciB1bmF1dGhvcml6ZWQgYWNjZXNzIGFuZCB1c2
1517
+ UgbWF5IGJlIG1vbmktCiAgICAgICAgIHRvcmVkIGFuZCBjYW4gcmVzdWx0IGluIGNyaW1pbmFsIG9yIGN
1518
+ pdmlsIHByb3NlY3V0aW9uIHVuZGVyIGFwcGxpY2FibGUgbGF3LgogICAgICAgICAtLS0tLS0tLS0tLS0t
1519
+ LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
1520
+ S0tLQoKCiAgICAgICAgIElBLTAwNTA4QkVCQUE1OSBsb2dpbjo=
1521
+ </example>
1522
+ <param pos="0" name="os.vendor" value="HP"/>
1523
+ <param pos="0" name="os.family" value="ProLiant"/>
1524
+ <param pos="0" name="os.product" value="ProLiant"/>
1525
+ <param pos="1" name="os.version"/>
1526
+ </fingerprint>
1527
+ <fingerprint pattern="^Power Measurement Ltd. Meter ION ([[:alnum:]]+)">
1528
+ <!-- Power Measurement Ltd. Meter ION 7330V271 ETH ETH7330V272
1529
+ Serial#: PB-0204A058-11
1530
+
1531
+ login: -->
1532
+ <description>Power Measurement ION Power Meter</description>
1533
+ <example _encoding="base64" hw.vendor="Power Measurement Ltd." hw.family="ION" hw.version="7330V271">
1534
+ UG93ZXIgTWVhc3VyZW1lbnQgTHRkLiBNZXRlciBJT04gNzMzMFYyNzEgRVRIIEVUSDczMzBWMjcyCg1TZ
1535
+ XJpYWwjOiBQQi0wMjA0QTA1OC0xMQoNCg1sb2dpbjo=
1536
+ </example>
1537
+ <param pos="0" name="hw.vendor" value = "Power Measurement Ltd."/>
1538
+ <param pos="0" name="hw.family" value = "ION"/>
1539
+ <param pos="1" name="hw.version"/>
1540
+ </fingerprint>
1541
+ <fingerprint pattern="^GW25 v([[:digit:]\.]+) - Intelligent Power Meters GPRS Gateway[[:space:]]+Developed by Satelitech">
1542
+ <!-- GW25 v1.2.1 - Intelligent Power Meters GPRS Gateway
1543
+ Developed by Satelitech S.A for ESG Dilec
1544
+ Enter password: -->
1545
+ <description>Satelitech Power Meter</description>
1546
+ <example _encoding="base64" hw.vendor="Satelitech" hw.family="GW25" hw.version="1.2.1">
1547
+ R1cyNSB2MS4yLjEgLSBJbnRlbGxpZ2VudCBQb3dlciBNZXRlcnMgR1BSUyBHYXRld2F5Cg1EZXZlbG9wZ
1548
+ WQgYnkgU2F0ZWxpdGVjaCBTLkEgZm9yIEVTRyBEaWxlYwoNRW50ZXIgcGFzc3dvcmQ6
1549
+ </example>
1550
+ <param pos="0" name="hw.vendor" value = "Satelitech"/>
1551
+ <param pos="0" name="hw.family" value = "GW25"/>
1552
+ <param pos="1" name="hw.version"/>
1553
+ </fingerprint>
1554
+ <fingerprint pattern="^RDK \(A Yocto Project based Distro\) ([^ ]+) Docsis-Gateway">
1555
+ <!-- RDK (A Yocto Project based Distro) 2.0 Docsis-Gateway
1556
+
1557
+ Docsis-Gateway login: -->
1558
+ <description>DOCSIS Cable Modem Running RDK</description>
1559
+ <example _encoding="base64" hw.device="DOCSIS Cable Modem" os.vendor="Yocto" os.product="RDK" os.version="2.0">
1560
+ UkRLIChBIFlvY3RvIFByb2plY3QgYmFzZWQgRGlzdHJvKSAyLjAgRG9jc2lzLUdhdGV3YXkNCg0NCg1Eb
1561
+ 2NzaXMtR2F0ZXdheSBsb2dpbjo=
1562
+ </example>
1563
+ <param pos="0" name="hw.device" value = "DOCSIS Cable Modem"/>
1564
+ <param pos="0" name="os.vendor" value = "Yocto"/>
1565
+ <param pos="0" name="os.product" value = "RDK"/>
1566
+ <param pos="1" name="os.version"/>
1567
+ </fingerprint>
1568
+ <fingerprint pattern="^RICOH Maintenance Shell">
1569
+ <description>a Ricoh device</description>
1570
+ <!-- RICOH Maintenance Shell.
1571
+ User access verification.
1572
+ login:-->
1573
+ <example _encoding="base64">
1574
+ UklDT0ggTWFpbnRlbmFuY2UgU2hlbGwuICAgCg1Vc2VyIGFjY2VzcyB2ZXJpZmljYXRpb24uCg1sb2dpbjo=
1575
+ </example>
1576
+ <param pos="0" name="os.vendor" value="Ricoh"/>
1577
+ <param pos="0" name="os.device" value="Printer"/>
1578
+ </fingerprint>
1579
+ <fingerprint pattern="Precise/RTCS v([\d\.]+) Telnet server">
1580
+ <description>Liebert UPS</description>
1581
+ <!-- Precise/RTCS v2.90.00 Telnet server
1582
+ Service Port Manager Active
1583
+
1584
+ <Esc> Ends Session
1585
+ -->
1586
+ <example _encoding="base64" os.version="2.90.00">
1587
+ UHJlY2lzZS9SVENTIHYyLjkwLjAwIFRlbG5ldCBzZXJ2ZXIKCgpTZXJ2aWNlIFBvcnQgTWFuYWdlciBBY3RpdmUKCjxFc2M+IEVuZHMgU2Vzc2lvbgoKroot
1588
+ </example>
1589
+ <param pos="0" name="hw.device" value="Power device"/>
1590
+ <param pos="0" name="hw.vendor" value="Liebert"/>
1591
+ <param pos="0" name="os.device" value="Power device"/>
1592
+ <param pos="0" name="os.vendor" value="Liebert"/>
1593
+ <param pos="1" name="os.version"/>
1594
+ </fingerprint>
1595
+ </fingerprints>