recog 0.01
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/.gitignore +3 -0
- data/.rspec +2 -0
- data/Gemfile +9 -0
- data/Gemfile.lock +42 -0
- data/LICENSE +23 -0
- data/README.md +63 -0
- data/bin/recog_export.rb +81 -0
- data/bin/recog_match.rb +51 -0
- data/bin/recog_verify.rb +45 -0
- data/features/match.feature +16 -0
- data/features/support/env.rb +5 -0
- data/features/verify.feature +31 -0
- data/features/xml/banners.xml +2 -0
- data/features/xml/failing_banners_fingerprints.xml +20 -0
- data/features/xml/matching_banners_fingerprints.xml +22 -0
- data/features/xml/no_tests.xml +53 -0
- data/features/xml/successful_tests.xml +33 -0
- data/features/xml/tests_with_failures.xml +10 -0
- data/features/xml/tests_with_warnings.xml +10 -0
- data/lib/recog.rb +3 -0
- data/lib/recog/db.rb +38 -0
- data/lib/recog/db_manager.rb +27 -0
- data/lib/recog/fingerprint.rb +60 -0
- data/lib/recog/formatter.rb +51 -0
- data/lib/recog/match_reporter.rb +77 -0
- data/lib/recog/matcher.rb +60 -0
- data/lib/recog/matcher_factory.rb +14 -0
- data/lib/recog/nizer.rb +263 -0
- data/lib/recog/verifier.rb +46 -0
- data/lib/recog/verifier_factory.rb +13 -0
- data/lib/recog/verify_reporter.rb +85 -0
- data/lib/recog/version.rb +3 -0
- data/recog.gemspec +34 -0
- data/spec/data/best_os_match_1.yml +17 -0
- data/spec/data/best_os_match_2.yml +17 -0
- data/spec/data/best_service_match_1.yml +17 -0
- data/spec/data/smb_native_os.txt +31 -0
- data/spec/data/test_fingerprints.xml +24 -0
- data/spec/lib/db_spec.rb +89 -0
- data/spec/lib/formatter_spec.rb +69 -0
- data/spec/lib/match_reporter_spec.rb +90 -0
- data/spec/lib/nizer_spec.rb +124 -0
- data/spec/lib/verify_reporter_spec.rb +112 -0
- data/xml/apache_os.xml +295 -0
- data/xml/architecture.xml +45 -0
- data/xml/ftp_banners.xml +808 -0
- data/xml/h323_callresp.xml +701 -0
- data/xml/hp_pjl_id.xml +435 -0
- data/xml/http_cookies.xml +379 -0
- data/xml/http_servers.xml +3326 -0
- data/xml/http_wwwauth.xml +412 -0
- data/xml/imap_banners.xml +267 -0
- data/xml/nntp_banners.xml +51 -0
- data/xml/ntp_banners.xml +538 -0
- data/xml/pop_banners.xml +452 -0
- data/xml/rsh_resp.xml +90 -0
- data/xml/sip_banners.xml +14 -0
- data/xml/smb_native_os.xml +385 -0
- data/xml/smtp_banners.xml +1738 -0
- data/xml/smtp_debug.xml +45 -0
- data/xml/smtp_ehlo.xml +53 -0
- data/xml/smtp_expn.xml +95 -0
- data/xml/smtp_help.xml +212 -0
- data/xml/smtp_mailfrom.xml +24 -0
- data/xml/smtp_noop.xml +45 -0
- data/xml/smtp_quit.xml +31 -0
- data/xml/smtp_rcptto.xml +33 -0
- data/xml/smtp_rset.xml +23 -0
- data/xml/smtp_turn.xml +23 -0
- data/xml/smtp_vrfy.xml +109 -0
- data/xml/snmp_sysdescr.xml +8008 -0
- data/xml/snmp_sysobjid.xml +284 -0
- data/xml/ssh_banners.xml +790 -0
- data/xml/upnp_banners.xml +590 -0
- metadata +190 -0
data/xml/smtp_debug.xml
ADDED
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<!--
|
|
3
|
+
SMTP response lines to the DEBUG command are matched against these patterns
|
|
4
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
|
+
|
|
6
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
-->
|
|
8
|
+
|
|
9
|
+
<fingerprints>
|
|
10
|
+
<fingerprint pattern="^500 No way!$">
|
|
11
|
+
<description>
|
|
12
|
+
Exim
|
|
13
|
+
example: 500 No way!
|
|
14
|
+
</description>
|
|
15
|
+
<param pos="0" name="service.vendor" value="exim"/>
|
|
16
|
+
<param pos="0" name="service.family" value="exim"/>
|
|
17
|
+
<param pos="0" name="service.product" value="exim"/>
|
|
18
|
+
</fingerprint>
|
|
19
|
+
|
|
20
|
+
<fingerprint pattern="^250[ -] *Debug set -NOT!$">
|
|
21
|
+
<description>
|
|
22
|
+
TIS FWTK and derivatives
|
|
23
|
+
http://www.tis.com/research/software/
|
|
24
|
+
This fingerprint may be ambiguous because other firewalls (like
|
|
25
|
+
Gauntlet) are derived from TIS
|
|
26
|
+
</description>
|
|
27
|
+
<param pos="0" name="service.vendor" value="TIS"/>
|
|
28
|
+
<param pos="0" name="service.family" value="FWTK"/>
|
|
29
|
+
<param pos="0" name="service.product" value="FWTK"/>
|
|
30
|
+
</fingerprint>
|
|
31
|
+
|
|
32
|
+
<fingerprint pattern="^500[ -]What\? I don't understand that\.$">
|
|
33
|
+
<description>
|
|
34
|
+
500 What? I don't understand that.
|
|
35
|
+
</description>
|
|
36
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
37
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
38
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
39
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
40
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
41
|
+
<param pos="0" name="os.device" value="General"/>
|
|
42
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
43
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
44
|
+
</fingerprint>
|
|
45
|
+
</fingerprints>
|
data/xml/smtp_ehlo.xml
ADDED
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<!--
|
|
3
|
+
SMTP response lines to the EHLO command are matched against these patterns
|
|
4
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
|
+
|
|
6
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
-->
|
|
8
|
+
|
|
9
|
+
<fingerprints>
|
|
10
|
+
<fingerprint pattern="^500[ -]Syntax error, command "XXXX" unrecognized$">
|
|
11
|
+
<description>
|
|
12
|
+
Cisco PIX changes the command letters to 'X' before passing
|
|
13
|
+
them to the real SMTP server.
|
|
14
|
+
</description>
|
|
15
|
+
<param pos="0" name="service.vendor" value="Cisco"/>
|
|
16
|
+
<param pos="0" name="service.family" value="PIX"/>
|
|
17
|
+
<param pos="0" name="service.product" value="PIX"/>
|
|
18
|
+
</fingerprint>
|
|
19
|
+
|
|
20
|
+
<!--
|
|
21
|
+
Don't try to infer a fingerprint from XEXCH50, because if we do, it might overwrite
|
|
22
|
+
a very precise MS IIS SMTP service or MS Exchange Server fingerprint found with the
|
|
23
|
+
help of smtp_banners.xml. Instead, this case is handled specially by the Jess rule
|
|
24
|
+
smtp-iis-xexch50-svc-fingerprint. -mrb
|
|
25
|
+
|
|
26
|
+
<fingerprint pattern="^250[ -] *XEXCH50.*$">
|
|
27
|
+
<description>
|
|
28
|
+
Microsoft Exchange/IIS server
|
|
29
|
+
</description>
|
|
30
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
31
|
+
<param pos="0" name="service.family" value="IIS"/>
|
|
32
|
+
<param pos="0" name="service.product" value="IIS"/>
|
|
33
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
34
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
35
|
+
<param pos="0" name="os.device" value="General"/>
|
|
36
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
37
|
+
</fingerprint>
|
|
38
|
+
-->
|
|
39
|
+
|
|
40
|
+
<fingerprint pattern="^221[ -]See ya in cyberspace$">
|
|
41
|
+
<description>
|
|
42
|
+
221 See ya in cyberspace
|
|
43
|
+
</description>
|
|
44
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
45
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
46
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
47
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
48
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
49
|
+
<param pos="0" name="os.device" value="General"/>
|
|
50
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
51
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
52
|
+
</fingerprint>
|
|
53
|
+
</fingerprints>
|
data/xml/smtp_expn.xml
ADDED
|
@@ -0,0 +1,95 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<!--
|
|
3
|
+
SMTP response lines to the EXPN command are matched against these patterns
|
|
4
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
|
+
|
|
6
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
-->
|
|
8
|
+
|
|
9
|
+
<fingerprints>
|
|
10
|
+
<fingerprint pattern="^500[ -]Syntax error, command "XXXX.*" unrecognized$">
|
|
11
|
+
<description>
|
|
12
|
+
Cisco PIX changes the command letters to 'X' before passing
|
|
13
|
+
them to the real SMTP server.
|
|
14
|
+
</description>
|
|
15
|
+
<param pos="0" name="service.vendor" value="Cisco"/>
|
|
16
|
+
<param pos="0" name="service.family" value="PIX"/>
|
|
17
|
+
<param pos="0" name="service.product" value="PIX"/>
|
|
18
|
+
</fingerprint>
|
|
19
|
+
|
|
20
|
+
<fingerprint pattern="^550[ -]EXPN not available to \(.+\) \[.+\] *$">
|
|
21
|
+
<description>
|
|
22
|
+
Exim
|
|
23
|
+
example: 550 EXPN not available to (foo.bar.com) [192.168.0.1]
|
|
24
|
+
</description>
|
|
25
|
+
<param pos="0" name="service.vendor" value="exim"/>
|
|
26
|
+
<param pos="0" name="service.family" value="exim"/>
|
|
27
|
+
<param pos="0" name="service.product" value="exim"/>
|
|
28
|
+
</fingerprint>
|
|
29
|
+
|
|
30
|
+
<fingerprint pattern="^550[ -]EXPN not available to [^ ]+ \(.+\) \[.+\] *$">
|
|
31
|
+
<description>
|
|
32
|
+
Exim
|
|
33
|
+
example: 550 EXPN not available to evil.com (foo.bar.com) [192.168.0.1]
|
|
34
|
+
</description>
|
|
35
|
+
<param pos="0" name="service.vendor" value="exim"/>
|
|
36
|
+
<param pos="0" name="service.family" value="exim"/>
|
|
37
|
+
<param pos="0" name="service.product" value="exim"/>
|
|
38
|
+
</fingerprint>
|
|
39
|
+
|
|
40
|
+
<fingerprint pattern="^500[ -]Don't you wish! *$">
|
|
41
|
+
<description>
|
|
42
|
+
</description>
|
|
43
|
+
<param pos="0" name="service.vendor" value="Global Technology Associates"/>
|
|
44
|
+
<param pos="0" name="service.family" value="GNAT Box"/>
|
|
45
|
+
<param pos="0" name="service.product" value="GNAT Box"/>
|
|
46
|
+
</fingerprint>
|
|
47
|
+
|
|
48
|
+
<!-- VM SMTP server doesn't like brackets in EXPN commands... -->
|
|
49
|
+
<fingerprint pattern="^501[ -]Syntax Error\. Only ListId or Userid allowed as argument to this command *$">
|
|
50
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
51
|
+
<param pos="0" name="service.family" value="VM"/>
|
|
52
|
+
<param pos="0" name="service.product" value="VM"/>
|
|
53
|
+
</fingerprint>
|
|
54
|
+
|
|
55
|
+
<fingerprint pattern="^550[ -]lists are confidential *$">
|
|
56
|
+
<description>
|
|
57
|
+
example: 550 lists are confidential
|
|
58
|
+
</description>
|
|
59
|
+
<param pos="0" name="service.vendor" value="Ipswitch"/>
|
|
60
|
+
<param pos="0" name="service.family" value="IMail Server"/>
|
|
61
|
+
<param pos="0" name="service.product" value="IMail Server"/>
|
|
62
|
+
</fingerprint>
|
|
63
|
+
|
|
64
|
+
<fingerprint pattern="^502[ -]command is not active$">
|
|
65
|
+
<description>
|
|
66
|
+
502 command is not active
|
|
67
|
+
</description>
|
|
68
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
69
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
70
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
71
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
72
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
73
|
+
<param pos="0" name="os.device" value="General"/>
|
|
74
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
75
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
76
|
+
</fingerprint>
|
|
77
|
+
|
|
78
|
+
<fingerprint pattern="^252 Unable to EXPN ".*", but will accept message and attempt delivery *$">
|
|
79
|
+
<description>
|
|
80
|
+
Lotus Domino
|
|
81
|
+
</description>
|
|
82
|
+
<param pos="0" name="service.vendor" value="Lotus"/>
|
|
83
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
84
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
85
|
+
</fingerprint>
|
|
86
|
+
|
|
87
|
+
<fingerprint pattern="^550[ -]Unable to find list '.*'\.$">
|
|
88
|
+
<description>
|
|
89
|
+
example: 550 Unable to find list 'list'.
|
|
90
|
+
</description>
|
|
91
|
+
<param pos="0" name="service.vendor" value="Seattle Labs"/>
|
|
92
|
+
<param pos="0" name="service.family" value="SLMail"/>
|
|
93
|
+
<param pos="0" name="service.product" value="SLMail"/>
|
|
94
|
+
</fingerprint>
|
|
95
|
+
</fingerprints>
|
data/xml/smtp_help.xml
ADDED
|
@@ -0,0 +1,212 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<!--
|
|
3
|
+
SMTP response lines to the HELP command are matched against these patterns
|
|
4
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
|
+
|
|
6
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
-->
|
|
8
|
+
|
|
9
|
+
<fingerprints>
|
|
10
|
+
<fingerprint pattern="^214[ -]This is ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
|
|
11
|
+
<description>
|
|
12
|
+
ArgoSoft mail server HELP response
|
|
13
|
+
Example: 214-This is ArGoSoft Mail Server, Version 1.4 (1.4.0.3)
|
|
14
|
+
</description>
|
|
15
|
+
<param pos="0" name="service.vendor" value="ArGoSoft"/>
|
|
16
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
17
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
18
|
+
<param pos="1" name="service.version"/>
|
|
19
|
+
</fingerprint>
|
|
20
|
+
|
|
21
|
+
<fingerprint pattern="^214[ -].*support@argosoft\.com *$">
|
|
22
|
+
<description>
|
|
23
|
+
ArgoSoft mail server HELP response
|
|
24
|
+
Example: 214-To report bug, send mail to support@argosoft.com
|
|
25
|
+
</description>
|
|
26
|
+
<param pos="0" name="service.vendor" value="ArGoSoft"/>
|
|
27
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
28
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
29
|
+
</fingerprint>
|
|
30
|
+
|
|
31
|
+
<fingerprint pattern="^500[ -]Syntax error, command "XXXX" unrecognized$">
|
|
32
|
+
<description>
|
|
33
|
+
Cisco PIX changes the command letters to 'X' before passing
|
|
34
|
+
them to the real SMTP server.
|
|
35
|
+
</description>
|
|
36
|
+
<param pos="0" name="service.vendor" value="Cisco"/>
|
|
37
|
+
<param pos="0" name="service.family" value="PIX"/>
|
|
38
|
+
<param pos="0" name="service.product" value="PIX"/>
|
|
39
|
+
</fingerprint>
|
|
40
|
+
|
|
41
|
+
<fingerprint pattern="^500[ -]5.5.1 unrecognised command HELP$">
|
|
42
|
+
<description>
|
|
43
|
+
Eudora IMS uses the British spelling "unrecognised"
|
|
44
|
+
</description>
|
|
45
|
+
<param pos="0" name="service.vendor" value="Eudora"/>
|
|
46
|
+
<param pos="0" name="service.family" value="Internet Mail Server"/>
|
|
47
|
+
<param pos="0" name="service.product" value="Internet Mail Server"/>
|
|
48
|
+
<param pos="0" name="os.vendor" value="Apple"/>
|
|
49
|
+
<param pos="0" name="os.family" value="Mac OS"/>
|
|
50
|
+
<param pos="0" name="os.device" value="General"/>
|
|
51
|
+
<param pos="0" name="os.product" value="Mac OS"/>
|
|
52
|
+
</fingerprint>
|
|
53
|
+
|
|
54
|
+
<fingerprint pattern="^214[ -]([^ ]+) is running the IBM VM operating system$">
|
|
55
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
56
|
+
<param pos="0" name="service.family" value="VM"/>
|
|
57
|
+
<param pos="0" name="service.product" value="VM"/>
|
|
58
|
+
<param pos="1" name="host.name"/>
|
|
59
|
+
</fingerprint>
|
|
60
|
+
|
|
61
|
+
<!--
|
|
62
|
+
Shouldn't we ignore XEXCH50 for the same reasons than described in the XEXCH50 regex
|
|
63
|
+
in smtp_ehlo.xml ? -mrb
|
|
64
|
+
-->
|
|
65
|
+
<fingerprint pattern="^214[ -].* XEXCH50 *.*$">
|
|
66
|
+
<description>
|
|
67
|
+
Microsoft Exchange/IIS server
|
|
68
|
+
</description>
|
|
69
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
70
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
71
|
+
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
72
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
73
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
74
|
+
<param pos="0" name="os.device" value="General"/>
|
|
75
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
76
|
+
</fingerprint>
|
|
77
|
+
|
|
78
|
+
<fingerprint pattern="^214[ -]Help system currently inactive\.$">
|
|
79
|
+
<description>
|
|
80
|
+
214 Help system currently inactive.
|
|
81
|
+
</description>
|
|
82
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
83
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
84
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
85
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
86
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
87
|
+
<param pos="0" name="os.device" value="General"/>
|
|
88
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
89
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
90
|
+
</fingerprint>
|
|
91
|
+
|
|
92
|
+
<fingerprint pattern="^214[ -].*This is MERAK ([^ ]+\.[^ ]+\.[^ ]+).*$">
|
|
93
|
+
<description>
|
|
94
|
+
Merak mail server http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)
|
|
95
|
+
</description>
|
|
96
|
+
<param pos="0" name="service.vendor" value="Merak"/>
|
|
97
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
98
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
99
|
+
<param pos="1" name="service.version"/>
|
|
100
|
+
</fingerprint>
|
|
101
|
+
|
|
102
|
+
<fingerprint pattern="^214[ -].*This is Merak ([^ ]+\.[^ ]+\.[^ ]+).*$">
|
|
103
|
+
<description>
|
|
104
|
+
Merak mail server http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)
|
|
105
|
+
</description>
|
|
106
|
+
<param pos="0" name="service.vendor" value="Merak"/>
|
|
107
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
108
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
109
|
+
<param pos="1" name="service.version"/>
|
|
110
|
+
</fingerprint>
|
|
111
|
+
|
|
112
|
+
<fingerprint pattern="^214[ -].*bugs@merakmail\.com.*$">
|
|
113
|
+
<description>
|
|
114
|
+
Merak mail server http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)
|
|
115
|
+
</description>
|
|
116
|
+
<param pos="0" name="service.vendor" value="Merak"/>
|
|
117
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
118
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
119
|
+
</fingerprint>
|
|
120
|
+
|
|
121
|
+
<fingerprint pattern="^214[ -].*bugs@icewarp\.com.*$">
|
|
122
|
+
<description>
|
|
123
|
+
Merak mail server http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)
|
|
124
|
+
</description>
|
|
125
|
+
<param pos="0" name="service.vendor" value="Merak"/>
|
|
126
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
127
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
128
|
+
</fingerprint>
|
|
129
|
+
|
|
130
|
+
<fingerprint pattern="^214[ -]qmail home page: http://pobox.com/~djb/qmail.html *$">
|
|
131
|
+
<description>
|
|
132
|
+
example: 214 qmail home page: http://pobox.com/~djb/qmail.html
|
|
133
|
+
</description>
|
|
134
|
+
<param pos="0" name="service.vendor" value="qmail"/>
|
|
135
|
+
<param pos="0" name="service.family" value="qmail"/>
|
|
136
|
+
<param pos="0" name="service.product" value="qmail"/>
|
|
137
|
+
</fingerprint>
|
|
138
|
+
|
|
139
|
+
<fingerprint pattern="^214[ -].*contact the Digital Customer Support Center at 1-800-354-9000.*$">
|
|
140
|
+
<description>
|
|
141
|
+
sendmail on Digital OSF UNIX
|
|
142
|
+
</description>
|
|
143
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
144
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
145
|
+
<param pos="0" name="service.certainty" value="0.85"/> <!-- no version, hence less precise than the banner -->
|
|
146
|
+
<param pos="0" name="os.vendor" value="DEC"/>
|
|
147
|
+
<param pos="0" name="os.family" value="Digital UNIX"/>
|
|
148
|
+
<param pos="0" name="os.device" value="General"/>
|
|
149
|
+
<param pos="0" name="os.product" value="OSF/1"/>
|
|
150
|
+
</fingerprint>
|
|
151
|
+
|
|
152
|
+
<fingerprint pattern="^214[ -]2.0.0 This is [s|S]endmail version ([^ ]+)$">
|
|
153
|
+
<description>
|
|
154
|
+
sendmail often returns version information for HELP, even when the
|
|
155
|
+
greeting is obscured
|
|
156
|
+
</description>
|
|
157
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
158
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
159
|
+
<param pos="1" name="service.version"/>
|
|
160
|
+
</fingerprint>
|
|
161
|
+
|
|
162
|
+
<fingerprint pattern="^214[ -]This is [s|S]endmail version ([^ ]+)$">
|
|
163
|
+
<description>
|
|
164
|
+
sendmail often returns version information for HELP, even when the
|
|
165
|
+
greeting is obscured
|
|
166
|
+
</description>
|
|
167
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
168
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
169
|
+
<param pos="1" name="service.version"/>
|
|
170
|
+
</fingerprint>
|
|
171
|
+
|
|
172
|
+
<fingerprint pattern="^502[ -]5\.3\.0 Sendmail ([^ ]+) -- HELP not implemented$">
|
|
173
|
+
<description>
|
|
174
|
+
502 5.3.0 Sendmail 8.11.2 -- HELP not implemented
|
|
175
|
+
</description>
|
|
176
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
177
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
178
|
+
<param pos="1" name="service.version"/>
|
|
179
|
+
</fingerprint>
|
|
180
|
+
|
|
181
|
+
<fingerprint pattern="^214[ -].*sendmail-bugs@sendmail\.org.*$">
|
|
182
|
+
<description>
|
|
183
|
+
sendmail often returns version information for HELP, even when the
|
|
184
|
+
greeting is obscured
|
|
185
|
+
</description>
|
|
186
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
187
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
188
|
+
<param pos="0" name="service.certainty" value="0.85"/> <!-- no version, hence less precise than the banner -->
|
|
189
|
+
</fingerprint>
|
|
190
|
+
|
|
191
|
+
<fingerprint pattern="^241[ -].*$">
|
|
192
|
+
<description>
|
|
193
|
+
ZMailer versions earlier than 2.99.21 mistakenly return the status
|
|
194
|
+
code 241 on some HELP response lines (instead of 214).
|
|
195
|
+
</description>
|
|
196
|
+
<param pos="0" name="service.vendor" value="ZMailer"/>
|
|
197
|
+
<param pos="0" name="service.family" value="ZMailer"/>
|
|
198
|
+
<param pos="0" name="service.product" value="ZMailer"/>
|
|
199
|
+
<!-- todo: it would be nice to say that this is version 2.99.21 or earlier -->
|
|
200
|
+
</fingerprint>
|
|
201
|
+
|
|
202
|
+
<fingerprint pattern="^214[ -].*Yoyodyne Propulsion.*$">
|
|
203
|
+
<description>
|
|
204
|
+
ZMailer has distinctive default HELP text in smtpserver.conf.
|
|
205
|
+
See http://www.zmailer.org/zman/zadm-smtpserver.html#ZADM-SMTPSERVER-CONF
|
|
206
|
+
</description>
|
|
207
|
+
<param pos="0" name="service.vendor" value="ZMailer"/>
|
|
208
|
+
<param pos="0" name="service.family" value="ZMailer"/>
|
|
209
|
+
<param pos="0" name="service.product" value="ZMailer"/>
|
|
210
|
+
<!-- todo: it would be nice to say that this is version 2.99.21 or earlier -->
|
|
211
|
+
</fingerprint>
|
|
212
|
+
</fingerprints>
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<!--
|
|
3
|
+
This file is currently unused.
|
|
4
|
+
-->
|
|
5
|
+
|
|
6
|
+
<fingerprints>
|
|
7
|
+
<fingerprint pattern="250 .* is syntactically correct *">
|
|
8
|
+
<description>
|
|
9
|
+
Exim
|
|
10
|
+
example: 250 <nosuchuser@rapid7.com> is syntactically correct
|
|
11
|
+
</description>
|
|
12
|
+
<param pos="0" name="service.vendor" value="exim"/>
|
|
13
|
+
<param pos="0" name="service.family" value="exim"/>
|
|
14
|
+
<param pos="0" name="service.product" value="exim"/>
|
|
15
|
+
</fingerprint>
|
|
16
|
+
|
|
17
|
+
<fingerprint pattern="501[ -]System error\. *">
|
|
18
|
+
<description>
|
|
19
|
+
</description>
|
|
20
|
+
<param pos="0" name="service.vendor" value="Global Technology Associates"/>
|
|
21
|
+
<param pos="0" name="service.family" value="GNAT Box"/>
|
|
22
|
+
<param pos="0" name="service.product" value="GNAT Box"/>
|
|
23
|
+
</fingerprint>
|
|
24
|
+
</fingerprints>
|
data/xml/smtp_noop.xml
ADDED
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<!--
|
|
3
|
+
SMTP response lines to the NOOP command are matched against these patterns
|
|
4
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
|
+
|
|
6
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
-->
|
|
8
|
+
|
|
9
|
+
<fingerprints>
|
|
10
|
+
<fingerprint pattern="^220 OK.*$">
|
|
11
|
+
<description>
|
|
12
|
+
CheckPoint FireWall-1 returns code 220 for NOOP command (instead of 250)
|
|
13
|
+
</description>
|
|
14
|
+
<param pos="0" name="service.vendor" value="Check Point"/>
|
|
15
|
+
<param pos="0" name="service.family" value="Check Point"/>
|
|
16
|
+
<param pos="0" name="service.product" value="Firewall-1"/>
|
|
17
|
+
</fingerprint>
|
|
18
|
+
|
|
19
|
+
<fingerprint pattern="^250[ -]2.0.0 doing nothing$">
|
|
20
|
+
<description>
|
|
21
|
+
Example: 250 2.0.0 doing nothing
|
|
22
|
+
</description>
|
|
23
|
+
<param pos="0" name="service.vendor" value="Eudora"/>
|
|
24
|
+
<param pos="0" name="service.family" value="Internet Mail Server"/>
|
|
25
|
+
<param pos="0" name="service.product" value="Internet Mail Server"/>
|
|
26
|
+
<param pos="0" name="os.vendor" value="Apple"/>
|
|
27
|
+
<param pos="0" name="os.family" value="Mac OS"/>
|
|
28
|
+
<param pos="0" name="os.device" value="General"/>
|
|
29
|
+
<param pos="0" name="os.product" value="Mac OS"/>
|
|
30
|
+
</fingerprint>
|
|
31
|
+
|
|
32
|
+
<fingerprint pattern="^250[ -]Why is there an NOOP instruction\?$">
|
|
33
|
+
<description>
|
|
34
|
+
250 Why is there an NOOP instruction?
|
|
35
|
+
</description>
|
|
36
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
37
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
38
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
39
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
40
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
41
|
+
<param pos="0" name="os.device" value="General"/>
|
|
42
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
43
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
44
|
+
</fingerprint>
|
|
45
|
+
</fingerprints>
|