recog 0.01

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (75) hide show
  1. data/.gitignore +3 -0
  2. data/.rspec +2 -0
  3. data/Gemfile +9 -0
  4. data/Gemfile.lock +42 -0
  5. data/LICENSE +23 -0
  6. data/README.md +63 -0
  7. data/bin/recog_export.rb +81 -0
  8. data/bin/recog_match.rb +51 -0
  9. data/bin/recog_verify.rb +45 -0
  10. data/features/match.feature +16 -0
  11. data/features/support/env.rb +5 -0
  12. data/features/verify.feature +31 -0
  13. data/features/xml/banners.xml +2 -0
  14. data/features/xml/failing_banners_fingerprints.xml +20 -0
  15. data/features/xml/matching_banners_fingerprints.xml +22 -0
  16. data/features/xml/no_tests.xml +53 -0
  17. data/features/xml/successful_tests.xml +33 -0
  18. data/features/xml/tests_with_failures.xml +10 -0
  19. data/features/xml/tests_with_warnings.xml +10 -0
  20. data/lib/recog.rb +3 -0
  21. data/lib/recog/db.rb +38 -0
  22. data/lib/recog/db_manager.rb +27 -0
  23. data/lib/recog/fingerprint.rb +60 -0
  24. data/lib/recog/formatter.rb +51 -0
  25. data/lib/recog/match_reporter.rb +77 -0
  26. data/lib/recog/matcher.rb +60 -0
  27. data/lib/recog/matcher_factory.rb +14 -0
  28. data/lib/recog/nizer.rb +263 -0
  29. data/lib/recog/verifier.rb +46 -0
  30. data/lib/recog/verifier_factory.rb +13 -0
  31. data/lib/recog/verify_reporter.rb +85 -0
  32. data/lib/recog/version.rb +3 -0
  33. data/recog.gemspec +34 -0
  34. data/spec/data/best_os_match_1.yml +17 -0
  35. data/spec/data/best_os_match_2.yml +17 -0
  36. data/spec/data/best_service_match_1.yml +17 -0
  37. data/spec/data/smb_native_os.txt +31 -0
  38. data/spec/data/test_fingerprints.xml +24 -0
  39. data/spec/lib/db_spec.rb +89 -0
  40. data/spec/lib/formatter_spec.rb +69 -0
  41. data/spec/lib/match_reporter_spec.rb +90 -0
  42. data/spec/lib/nizer_spec.rb +124 -0
  43. data/spec/lib/verify_reporter_spec.rb +112 -0
  44. data/xml/apache_os.xml +295 -0
  45. data/xml/architecture.xml +45 -0
  46. data/xml/ftp_banners.xml +808 -0
  47. data/xml/h323_callresp.xml +701 -0
  48. data/xml/hp_pjl_id.xml +435 -0
  49. data/xml/http_cookies.xml +379 -0
  50. data/xml/http_servers.xml +3326 -0
  51. data/xml/http_wwwauth.xml +412 -0
  52. data/xml/imap_banners.xml +267 -0
  53. data/xml/nntp_banners.xml +51 -0
  54. data/xml/ntp_banners.xml +538 -0
  55. data/xml/pop_banners.xml +452 -0
  56. data/xml/rsh_resp.xml +90 -0
  57. data/xml/sip_banners.xml +14 -0
  58. data/xml/smb_native_os.xml +385 -0
  59. data/xml/smtp_banners.xml +1738 -0
  60. data/xml/smtp_debug.xml +45 -0
  61. data/xml/smtp_ehlo.xml +53 -0
  62. data/xml/smtp_expn.xml +95 -0
  63. data/xml/smtp_help.xml +212 -0
  64. data/xml/smtp_mailfrom.xml +24 -0
  65. data/xml/smtp_noop.xml +45 -0
  66. data/xml/smtp_quit.xml +31 -0
  67. data/xml/smtp_rcptto.xml +33 -0
  68. data/xml/smtp_rset.xml +23 -0
  69. data/xml/smtp_turn.xml +23 -0
  70. data/xml/smtp_vrfy.xml +109 -0
  71. data/xml/snmp_sysdescr.xml +8008 -0
  72. data/xml/snmp_sysobjid.xml +284 -0
  73. data/xml/ssh_banners.xml +790 -0
  74. data/xml/upnp_banners.xml +590 -0
  75. metadata +190 -0
data/xml/snmp_sysobjid.xml ADDED
@@ -0,0 +1,284 @@
1
+ <?xml version="1.0"?>
2
+ <!--
3
+ SNMP fingerprint definitions for SysObjectIDs. These are matched against the value of the
4
+ 'sysObjectID' (OID 1.3.6.1.2.1.1.2) variable.
5
+ -->
6
+ <fingerprints matches="snmp.sys_object_id">
7
+ <!--======================================================================
8
+ MICROSOFT
9
+ =======================================================================-->
10
+
11
+ <!--
12
+ These are baseline patterns that map to sysObjectID with their associated sysDescr.
13
+ -->
14
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.[23] Hardware: x86.*Software: Windows NT Version 4\.0.*$">
15
+ <description>Windows NT 4 on x86</description>
16
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: x86 Family 6 Model 8 Stepping 3 AT/AT COMPATIBLE - Software: Windows NT Version 4.0 (Build Number: 1381 Uniprocessor Free )</example>
17
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 6 Model 8 Stepping 3 AT/AT COMPATIBLE - Software: Windows NT Version 4.0 (Build Number: 1381 Uniprocessor Free )</example>
18
+ <param pos="0" name="os.vendor" value="Microsoft"/>
19
+ <param pos="0" name="os.family" value="Windows"/>
20
+ <param pos="0" name="os.product" value="Windows NT Server"/>
21
+ <param pos="0" name="os.version" value="4.0"/>
22
+ <param pos="0" name="os.device" value="General"/>
23
+ <param pos="0" name="os.arch" value="x86"/>
24
+ </fingerprint>
25
+
26
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: x86.*Software: Windows 2000 Version 5\.0.*$">
27
+ <description>Windows 2000 on x86</description>
28
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: x86 Family 15 Model 4 Stepping 8 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor Free)</example>
29
+ <param pos="0" name="os.vendor" value="Microsoft"/>
30
+ <param pos="0" name="os.family" value="Windows"/>
31
+ <param pos="0" name="os.product" value="Windows 2000 Server"/>
32
+ <param pos="0" name="os.device" value="General"/>
33
+ <param pos="0" name="os.arch" value="x86"/>
34
+ </fingerprint>
35
+
36
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows 2000 Version 5\.0.*$">
37
+ <description>Windows 2000 on x86</description>
38
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 4 Stepping 8 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor Free)</example>
39
+ <param pos="0" name="os.vendor" value="Microsoft"/>
40
+ <param pos="0" name="os.family" value="Windows"/>
41
+ <param pos="0" name="os.product" value="Windows 2000 Datacenter Server"/>
42
+ <param pos="0" name="os.device" value="General"/>
43
+ <param pos="0" name="os.arch" value="x86"/>
44
+ </fingerprint>
45
+
46
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: x86.*Software: Windows Version 5\.2.*$">
47
+ <description>Windows Server 2003 on x86</description>
48
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: x86 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
49
+ <param pos="0" name="os.vendor" value="Microsoft"/>
50
+ <param pos="0" name="os.family" value="Windows"/>
51
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
52
+ <param pos="0" name="os.device" value="General"/>
53
+ <param pos="0" name="os.arch" value="x86"/>
54
+ </fingerprint>
55
+
56
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows Version 5\.2.*$">
57
+ <description>Windows Server 2003 on x86</description>
58
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
59
+ <param pos="0" name="os.vendor" value="Microsoft"/>
60
+ <param pos="0" name="os.family" value="Windows"/>
61
+ <param pos="0" name="os.product" value="Windows Server 2003, Datacenter Edition"/>
62
+ <param pos="0" name="os.device" value="General"/>
63
+ <param pos="0" name="os.arch" value="x86"/>
64
+ </fingerprint>
65
+
66
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: \S+64.*Software: Windows Version 5\.2.*$">
67
+ <description>Windows Server 2003 on x86_64</description>
68
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
69
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 6 Model 15 Stepping 6 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
70
+ <param pos="0" name="os.vendor" value="Microsoft"/>
71
+ <param pos="0" name="os.family" value="Windows"/>
72
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
73
+ <param pos="0" name="os.device" value="General"/>
74
+ <param pos="0" name="os.arch" value="x86_64"/>
75
+ </fingerprint>
76
+
77
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: \S+64.*Software: Windows Version 5\.2.*$">
78
+ <description>Windows Server 2003 on x86_64</description>
79
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
80
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 6 Model 15 Stepping 6 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
81
+ <param pos="0" name="os.vendor" value="Microsoft"/>
82
+ <param pos="0" name="os.family" value="Windows"/>
83
+ <param pos="0" name="os.product" value="Windows Server 2003, Datacenter Edition"/>
84
+ <param pos="0" name="os.device" value="General"/>
85
+ <param pos="0" name="os.arch" value="x86_64"/>
86
+ </fingerprint>
87
+
88
+ <fingerprint pattern="^Microsoft Windows CE Version ([\d.]+).*$">
89
+ <description>Windows CE</description>
90
+ <example>Microsoft Windows CE Version 4.20 (Build 0)</example>
91
+ <example>Microsoft Windows CE Version 4.20 (Build 1088)</example>
92
+ <param pos="0" name="os.vendor" value="Microsoft"/>
93
+ <param pos="0" name="os.family" value="Windows"/>
94
+ <param pos="0" name="os.product" value="Windows CE"/>
95
+ <param pos="0" name="os.device" value="General"/>
96
+ <param pos="1" name="os.version"/>
97
+ </fingerprint>
98
+
99
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: x86.*Software: Windows Version 6\.0 \(Build 6001.*$">
100
+ <description>Windows Server 2008 on x86</description>
101
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: x86 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
102
+ <param pos="0" name="os.vendor" value="Microsoft"/>
103
+ <param pos="0" name="os.family" value="Windows"/>
104
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
105
+ <param pos="0" name="os.device" value="General"/>
106
+ <param pos="0" name="os.arch" value="x86"/>
107
+ </fingerprint>
108
+
109
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows Version 6\.0 \(Build 6001.*$">
110
+ <description>Windows Server 2008 Datacenter on x86</description>
111
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
112
+ <param pos="0" name="os.vendor" value="Microsoft"/>
113
+ <param pos="0" name="os.family" value="Windows"/>
114
+ <param pos="0" name="os.product" value="Windows Server 2008 Datacenter Edition"/>
115
+ <param pos="0" name="os.device" value="General"/>
116
+ <param pos="0" name="os.arch" value="x86"/>
117
+ </fingerprint>
118
+
119
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6001.*$">
120
+ <description>Windows Server 2008 on x86_64</description>
121
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
122
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
123
+ <param pos="0" name="os.vendor" value="Microsoft"/>
124
+ <param pos="0" name="os.family" value="Windows"/>
125
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
126
+ <param pos="0" name="os.device" value="General"/>
127
+ <param pos="0" name="os.arch" value="x86_64"/>
128
+ </fingerprint>
129
+
130
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6001.*$">
131
+ <description>Windows Server 2008 Datacenter on x86_64</description>
132
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
133
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
134
+ <param pos="0" name="os.vendor" value="Microsoft"/>
135
+ <param pos="0" name="os.family" value="Windows"/>
136
+ <param pos="0" name="os.product" value="Windows Server 2008 Datacenter Edition"/>
137
+ <param pos="0" name="os.device" value="General"/>
138
+ <param pos="0" name="os.arch" value="x86_64"/>
139
+ </fingerprint>
140
+
141
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: x86.*Software: Windows Version 6\.0 \(Build 6002.*$">
142
+ <description>Windows Server 2008 SP2 on x86</description>
143
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: x86 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
144
+ <param pos="0" name="os.vendor" value="Microsoft"/>
145
+ <param pos="0" name="os.family" value="Windows"/>
146
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
147
+ <param pos="0" name="os.device" value="General"/>
148
+ <param pos="0" name="os.version" value="SP2"/>
149
+ <param pos="0" name="os.arch" value="x86"/>
150
+ </fingerprint>
151
+
152
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows Version 6\.0 \(Build 6002.*$">
153
+ <description>Windows Server 2008 Datacenter SP2 on x86</description>
154
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
155
+ <param pos="0" name="os.vendor" value="Microsoft"/>
156
+ <param pos="0" name="os.family" value="Windows"/>
157
+ <param pos="0" name="os.product" value="Windows Server 2008 Datacenter Edition"/>
158
+ <param pos="0" name="os.device" value="General"/>
159
+ <param pos="0" name="os.version" value="SP2"/>
160
+ <param pos="0" name="os.arch" value="x86"/>
161
+ </fingerprint>
162
+
163
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6002.*$">
164
+ <description>Windows Server 2008 SP2 on x86_64</description>
165
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
166
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
167
+ <param pos="0" name="os.vendor" value="Microsoft"/>
168
+ <param pos="0" name="os.family" value="Windows"/>
169
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
170
+ <param pos="0" name="os.device" value="General"/>
171
+ <param pos="0" name="os.version" value="SP2"/>
172
+ <param pos="0" name="os.arch" value="x86_64"/>
173
+ </fingerprint>
174
+
175
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6002.*$">
176
+ <description>Windows Server 2008 Datacenter SP2 on x86_64</description>
177
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
178
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
179
+ <param pos="0" name="os.vendor" value="Microsoft"/>
180
+ <param pos="0" name="os.family" value="Windows"/>
181
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
182
+ <param pos="0" name="os.device" value="General"/>
183
+ <param pos="0" name="os.version" value="SP2"/>
184
+ <param pos="0" name="os.arch" value="x86_64"/>
185
+ </fingerprint>
186
+
187
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: x86.*Software: Windows Version 6\.1 \(Build 7600.*$">
188
+ <description>Windows Server 2008 R2 on x86</description>
189
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: x86 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
190
+ <param pos="0" name="os.vendor" value="Microsoft"/>
191
+ <param pos="0" name="os.family" value="Windows"/>
192
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
193
+ <param pos="0" name="os.device" value="General"/>
194
+ <param pos="0" name="os.arch" value="x86"/>
195
+ </fingerprint>
196
+
197
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows Version 6\.1 \(Build 7600.*$">
198
+ <description>Windows Server 2008 Datacenter R2 on x86</description>
199
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
200
+ <param pos="0" name="os.vendor" value="Microsoft"/>
201
+ <param pos="0" name="os.family" value="Windows"/>
202
+ <param pos="0" name="os.product" value="Windows Server 2008 R2, Datacenter Edition"/>
203
+ <param pos="0" name="os.device" value="General"/>
204
+ <param pos="0" name="os.arch" value="x86"/>
205
+ </fingerprint>
206
+
207
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7600.*$">
208
+ <description>Windows Server 2008 R2 on x86_64</description>
209
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
210
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
211
+ <param pos="0" name="os.vendor" value="Microsoft"/>
212
+ <param pos="0" name="os.family" value="Windows"/>
213
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
214
+ <param pos="0" name="os.device" value="General"/>
215
+ <param pos="0" name="os.arch" value="x86_64"/>
216
+ </fingerprint>
217
+
218
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7600.*$">
219
+ <description>Windows Server 2008 Datacenter R2 on x86_64</description>
220
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
221
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
222
+ <param pos="0" name="os.vendor" value="Microsoft"/>
223
+ <param pos="0" name="os.family" value="Windows"/>
224
+ <param pos="0" name="os.product" value="Windows Server 2008 R2, Datacenter Edition"/>
225
+ <param pos="0" name="os.device" value="General"/>
226
+ <param pos="0" name="os.arch" value="x86_64"/>
227
+ </fingerprint>
228
+
229
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: x86.*Software: Windows Version 6\.1 \(Build 7601.*$">
230
+ <description>Windows Server 2008 R2 SP1 on x86</description>
231
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: x86 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
232
+ <param pos="0" name="os.vendor" value="Microsoft"/>
233
+ <param pos="0" name="os.family" value="Windows"/>
234
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
235
+ <param pos="0" name="os.device" value="General"/>
236
+ <param pos="0" name="os.version" value="SP1"/>
237
+ <param pos="0" name="os.arch" value="x86"/>
238
+ </fingerprint>
239
+
240
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows Version 6\.1 \(Build 7601.*$">
241
+ <description>Windows Server 2008 Datacenter R2 SP1 on x86</description>
242
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
243
+ <param pos="0" name="os.vendor" value="Microsoft"/>
244
+ <param pos="0" name="os.family" value="Windows"/>
245
+ <param pos="0" name="os.product" value="Windows Server 2008 R2, Datacenter Edition"/>
246
+ <param pos="0" name="os.device" value="General"/>
247
+ <param pos="0" name="os.version" value="SP1"/>
248
+ <param pos="0" name="os.arch" value="x86"/>
249
+ </fingerprint>
250
+
251
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7601.*$">
252
+ <description>Windows Server 2008 R2 SP1 on x86_64</description>
253
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
254
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
255
+ <param pos="0" name="os.vendor" value="Microsoft"/>
256
+ <param pos="0" name="os.family" value="Windows"/>
257
+ <param pos="0" name="os.product" value="Windows Server 2008 R2"/>
258
+ <param pos="0" name="os.device" value="General"/>
259
+ <param pos="0" name="os.version" value="SP1"/>
260
+ <param pos="0" name="os.arch" value="x86_64"/>
261
+ </fingerprint>
262
+
263
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7601.*$">
264
+ <description>Windows Server 2008 Datacenter R2 SP1 on x86_64</description>
265
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
266
+ <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
267
+ <param pos="0" name="os.vendor" value="Microsoft"/>
268
+ <param pos="0" name="os.family" value="Windows"/>
269
+ <param pos="0" name="os.product" value="Windows Server 2008 R2, Datacenter Edition"/>
270
+ <param pos="0" name="os.device" value="General"/>
271
+ <param pos="0" name="os.version" value="SP1"/>
272
+ <param pos="0" name="os.arch" value="x86_64"/>
273
+ </fingerprint>
274
+
275
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.2 \(Build 9200.*$">
276
+ <description>Windows Server 2012 on x86_64</description>
277
+ <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 6 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.2 (Build 9200 Multiprocessor Free)</example>
278
+ <param pos="0" name="os.vendor" value="Microsoft"/>
279
+ <param pos="0" name="os.family" value="Windows"/>
280
+ <param pos="0" name="os.product" value="Windows Server 2012"/>
281
+ <param pos="0" name="os.device" value="General"/>
282
+ <param pos="0" name="os.arch" value="x86_64"/>
283
+ </fingerprint>
284
+ </fingerprints>
data/xml/ssh_banners.xml ADDED
@@ -0,0 +1,790 @@
1
+ <?xml version="1.0"?>
2
+ <!--
3
+ SSH "software revision and comment" strings (official RFC nomenclature for the part of
4
+ the identification string after "SSH-x.x-") are matched against these patterns to
5
+ fingerprint SSH servers.
6
+ -->
7
+
8
+ <fingerprints matches="ssh.banner">
9
+
10
+
11
+ <!-- Honeypot SSH server banners are useless for fingerprinting -->
12
+ <fingerprint pattern="honeypot" flags="REG_ICASE">
13
+ <description>Honeypot SSH</description>
14
+ <!-- assert nothing -->
15
+ </fingerprint>
16
+
17
+ <fingerprint pattern="^RomSShell_([\d\.]+)$">
18
+ <description>Allegro RomSShell SSH</description>
19
+ <example>RomSShell_4.62</example>
20
+ <param pos="0" name="service.vendor" value="Allegro"/>
21
+ <param pos="0" name="service.product" value="RomSShell"/>
22
+ <param pos="1" name="service.version"/>
23
+ </fingerprint>
24
+
25
+ <fingerprint pattern="^mpSSH_([\d\.]+)$">
26
+ <description>HP Integrated Lights Out Manager (ILOM) usually bundled with HP servers</description>
27
+ <example>mpSSH_0.0.1</example>
28
+ <param pos="0" name="service.vendor" value="HP"/>
29
+ <param pos="0" name="service.product" value="Integrated Lights Out Manager"/>
30
+ <param pos="0" name="hw.vendor" value="HP"/>
31
+ <param pos="0" name="os.device" value="Lights Out Management"/>
32
+ <param pos="1" name="service.version"/>
33
+ </fingerprint>
34
+
35
+ <fingerprint pattern="^Serv-U_([\d\.]+)$">
36
+ <description>Serv-U SSH</description>
37
+ <example>Serv-U_7.4.0.1</example>
38
+ <param pos="0" name="service.vendor" value="Rhino Software"/>
39
+ <param pos="0" name="service.product" value="Serv-U"/>
40
+ <param pos="1" name="service.version"/>
41
+ </fingerprint>
42
+
43
+ <fingerprint pattern="WS_FTP-SSH_([\d\.]+)$">
44
+ <description>WS_FTP Server with SSH</description>
45
+ <example>WS_FTP-SSH_6.1.1</example>
46
+ <example>WS_FTP-SSH_7.0</example>
47
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
48
+ <param pos="0" name="service.product" value="WS_FTP"/>
49
+ <param pos="1" name="service.version"/>
50
+ </fingerprint>
51
+
52
+ <fingerprint pattern="^OpenSSH_([^\s]+)\s+(FreeBSD[ -].*)$">
53
+ <description>OpenSSH running on FreeBSD</description>
54
+ <param pos="1" name="service.version"/>
55
+ <param pos="2" name="openssh.comment"/>
56
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
57
+ <param pos="0" name="service.family" value="OpenSSH"/>
58
+ <param pos="0" name="service.product" value="OpenSSH"/>
59
+ <param pos="0" name="os.vendor" value="FreeBSD"/>
60
+ <param pos="0" name="os.device" value="General"/>
61
+ <param pos="0" name="os.family" value="FreeBSD"/>
62
+ <param pos="0" name="os.product" value="FreeBSD"/>
63
+ </fingerprint>
64
+
65
+ <fingerprint pattern="^OpenSSH_([^\s]+)\s+(NetBSD[ -].*)$">
66
+ <description>OpenSSH running on NetBSD</description>
67
+ <param pos="1" name="service.version"/>
68
+ <param pos="2" name="openssh.comment"/>
69
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
70
+ <param pos="0" name="service.family" value="OpenSSH"/>
71
+ <param pos="0" name="service.product" value="OpenSSH"/>
72
+ <param pos="0" name="os.vendor" value="NetBSD"/>
73
+ <param pos="0" name="os.device" value="General"/>
74
+ <param pos="0" name="os.family" value="NetBSD"/>
75
+ <param pos="0" name="os.product" value="NetBSD"/>
76
+ </fingerprint>
77
+
78
+ <fingerprint pattern="^OpenSSH_(4\.1p1) (Debian-7ubuntu4)$">
79
+ <description>OpenSSH running on Ubuntu 5.10</description>
80
+ <example>OpenSSH_4.1p1 Debian-7ubuntu4</example>
81
+ <param pos="1" name="service.version"/>
82
+ <param pos="2" name="openssh.comment"/>
83
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
84
+ <param pos="0" name="service.family" value="OpenSSH"/>
85
+ <param pos="0" name="service.product" value="OpenSSH"/>
86
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
87
+ <param pos="0" name="os.device" value="General"/>
88
+ <param pos="0" name="os.family" value="Linux"/>
89
+ <param pos="0" name="os.product" value="Linux"/>
90
+ <param pos="0" name="os.version" value="5.10"/>
91
+ </fingerprint>
92
+
93
+ <fingerprint pattern="^OpenSSH_(4\.2p1) (Debian-7ubuntu3.*)$">
94
+ <description>OpenSSH running on Ubuntu 6.04</description>
95
+ <example>OpenSSH_4.2p1 Debian-7ubuntu3.1</example>
96
+ <example>OpenSSH_4.2p1 Debian-7ubuntu3.2</example>
97
+ <param pos="1" name="service.version"/>
98
+ <param pos="2" name="openssh.comment"/>
99
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
100
+ <param pos="0" name="service.family" value="OpenSSH"/>
101
+ <param pos="0" name="service.product" value="OpenSSH"/>
102
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
103
+ <param pos="0" name="os.device" value="General"/>
104
+ <param pos="0" name="os.family" value="Linux"/>
105
+ <param pos="0" name="os.product" value="Linux"/>
106
+ <param pos="0" name="os.version" value="6.04"/>
107
+ </fingerprint>
108
+
109
+ <fingerprint pattern="^OpenSSH_(4\.3p2) (Debian-8ubuntu1.*)$">
110
+ <description>OpenSSH running on Ubuntu 7.04</description>
111
+ <example>OpenSSH_4.3p2 Debian-8ubuntu1.4</example>
112
+ <param pos="1" name="service.version"/>
113
+ <param pos="2" name="openssh.comment"/>
114
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
115
+ <param pos="0" name="service.family" value="OpenSSH"/>
116
+ <param pos="0" name="service.product" value="OpenSSH"/>
117
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
118
+ <param pos="0" name="os.device" value="General"/>
119
+ <param pos="0" name="os.family" value="Linux"/>
120
+ <param pos="0" name="os.product" value="Linux"/>
121
+ <param pos="0" name="os.version" value="7.04"/>
122
+ </fingerprint>
123
+
124
+ <fingerprint pattern="^OpenSSH_(4\.6p1) (Debian-5ubuntu0.*)$">
125
+ <description>OpenSSH running on Ubuntu 7.10</description>
126
+ <example>OpenSSH_4.6p1 Debian-5ubuntu0.2</example>
127
+ <example>OpenSSH_4.6p1 Debian-5ubuntu0.5</example>
128
+ <example>OpenSSH_4.6p1 Debian-5ubuntu0.6</example>
129
+ <param pos="1" name="service.version"/>
130
+ <param pos="2" name="openssh.comment"/>
131
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
132
+ <param pos="0" name="service.family" value="OpenSSH"/>
133
+ <param pos="0" name="service.product" value="OpenSSH"/>
134
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
135
+ <param pos="0" name="os.device" value="General"/>
136
+ <param pos="0" name="os.family" value="Linux"/>
137
+ <param pos="0" name="os.product" value="Linux"/>
138
+ <param pos="0" name="os.version" value="7.10"/>
139
+ </fingerprint>
140
+
141
+ <fingerprint pattern="^OpenSSH_(4\.7p1) (Debian-8ubuntu1.*)$">
142
+ <description>OpenSSH running on Ubuntu 8.04</description>
143
+ <example>OpenSSH_4.7p1 Debian-8ubuntu1.2</example>
144
+ <param pos="1" name="service.version"/>
145
+ <param pos="2" name="openssh.comment"/>
146
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
147
+ <param pos="0" name="service.family" value="OpenSSH"/>
148
+ <param pos="0" name="service.product" value="OpenSSH"/>
149
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
150
+ <param pos="0" name="os.device" value="General"/>
151
+ <param pos="0" name="os.family" value="Linux"/>
152
+ <param pos="0" name="os.product" value="Linux"/>
153
+ <param pos="0" name="os.version" value="8.04"/>
154
+ </fingerprint>
155
+
156
+ <fingerprint pattern="^OpenSSH_(5\.1p1) (Debian-3ubuntu1)$">
157
+ <description>OpenSSH running on Ubuntu 8.10</description>
158
+ <example>OpenSSH_5.1p1 Debian-3ubuntu1</example>
159
+ <param pos="1" name="service.version"/>
160
+ <param pos="2" name="openssh.comment"/>
161
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
162
+ <param pos="0" name="service.family" value="OpenSSH"/>
163
+ <param pos="0" name="service.product" value="OpenSSH"/>
164
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
165
+ <param pos="0" name="os.device" value="General"/>
166
+ <param pos="0" name="os.family" value="Linux"/>
167
+ <param pos="0" name="os.product" value="Linux"/>
168
+ <param pos="0" name="os.version" value="8.10"/>
169
+ </fingerprint>
170
+
171
+ <fingerprint pattern="^OpenSSH_(5\.1p1) (Debian-5ubuntu1)$">
172
+ <description>OpenSSH running on Ubuntu 9.04</description>
173
+ <example>OpenSSH_5.1p1 Debian-5ubuntu1</example>
174
+ <param pos="1" name="service.version"/>
175
+ <param pos="2" name="openssh.comment"/>
176
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
177
+ <param pos="0" name="service.family" value="OpenSSH"/>
178
+ <param pos="0" name="service.product" value="OpenSSH"/>
179
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
180
+ <param pos="0" name="os.device" value="General"/>
181
+ <param pos="0" name="os.family" value="Linux"/>
182
+ <param pos="0" name="os.product" value="Linux"/>
183
+ <param pos="0" name="os.version" value="9.04"/>
184
+ </fingerprint>
185
+
186
+ <fingerprint pattern="^OpenSSH_(5\.1p1) (Debian-6ubuntu2)$">
187
+ <description>OpenSSH running on Ubuntu 9.10</description>
188
+ <example>OpenSSH_5.1p1 Debian-6ubuntu2</example>
189
+ <param pos="1" name="service.version"/>
190
+ <param pos="2" name="openssh.comment"/>
191
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
192
+ <param pos="0" name="service.family" value="OpenSSH"/>
193
+ <param pos="0" name="service.product" value="OpenSSH"/>
194
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
195
+ <param pos="0" name="os.device" value="General"/>
196
+ <param pos="0" name="os.family" value="Linux"/>
197
+ <param pos="0" name="os.product" value="Linux"/>
198
+ <param pos="0" name="os.version" value="9.10"/>
199
+ </fingerprint>
200
+
201
+ <fingerprint pattern="^OpenSSH_(5\.3p1) (Debian-3ubuntu3)$">
202
+ <description>OpenSSH running on Ubuntu 10.04 (lucid)</description>
203
+ <example>OpenSSH_5.3p1 Debian-3ubuntu3</example>
204
+ <param pos="1" name="service.version"/>
205
+ <param pos="2" name="openssh.comment"/>
206
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
207
+ <param pos="0" name="service.family" value="OpenSSH"/>
208
+ <param pos="0" name="service.product" value="OpenSSH"/>
209
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
210
+ <param pos="0" name="os.device" value="General"/>
211
+ <param pos="0" name="os.family" value="Linux"/>
212
+ <param pos="0" name="os.product" value="Linux"/>
213
+ <param pos="0" name="os.version" value="10.04"/>
214
+ </fingerprint>
215
+
216
+ <fingerprint pattern="^OpenSSH_(5\.3p1) (Debian-3ubuntu4)$">
217
+ <description>OpenSSH running on Ubuntu 10.04 (lucid) update 1</description>
218
+ <example>OpenSSH_5.3p1 Debian-3ubuntu4</example>
219
+ <param pos="1" name="service.version"/>
220
+ <param pos="2" name="openssh.comment"/>
221
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
222
+ <param pos="0" name="service.family" value="OpenSSH"/>
223
+ <param pos="0" name="service.product" value="OpenSSH"/>
224
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
225
+ <param pos="0" name="os.device" value="General"/>
226
+ <param pos="0" name="os.family" value="Linux"/>
227
+ <param pos="0" name="os.product" value="Linux"/>
228
+ <param pos="0" name="os.version" value="10.04"/>
229
+ </fingerprint>
230
+
231
+ <fingerprint pattern="^OpenSSH_(5\.3p1) (Debian-3ubuntu[56])$">
232
+ <description>OpenSSH running on Ubuntu 10.04 (lucid) update 2</description>
233
+ <example>OpenSSH_5.3p1 Debian-3ubuntu5</example>
234
+ <example>OpenSSH_5.3p1 Debian-3ubuntu6</example>
235
+ <param pos="1" name="service.version"/>
236
+ <param pos="2" name="openssh.comment"/>
237
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
238
+ <param pos="0" name="service.family" value="OpenSSH"/>
239
+ <param pos="0" name="service.product" value="OpenSSH"/>
240
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
241
+ <param pos="0" name="os.device" value="General"/>
242
+ <param pos="0" name="os.family" value="Linux"/>
243
+ <param pos="0" name="os.product" value="Linux"/>
244
+ <param pos="0" name="os.version" value="10.04"/>
245
+ </fingerprint>
246
+
247
+ <fingerprint pattern="^OpenSSH_(5\.3p1) (Debian-3ubuntu7)$">
248
+ <description>OpenSSH running on Ubuntu 10.04 (lucid) update 3 or update 4</description>
249
+ <example>OpenSSH_5.3p1 Debian-3ubuntu7</example>
250
+ <param pos="1" name="service.version"/>
251
+ <param pos="2" name="openssh.comment"/>
252
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
253
+ <param pos="0" name="service.family" value="OpenSSH"/>
254
+ <param pos="0" name="service.product" value="OpenSSH"/>
255
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
256
+ <param pos="0" name="os.device" value="General"/>
257
+ <param pos="0" name="os.family" value="Linux"/>
258
+ <param pos="0" name="os.product" value="Linux"/>
259
+ <param pos="0" name="os.version" value="10.04"/>
260
+ </fingerprint>
261
+
262
+ <fingerprint pattern="^OpenSSH_(5\.5p1) (Debian-4ubuntu[45])$">
263
+ <description>OpenSSH running on Ubuntu 10.10</description>
264
+ <example>OpenSSH_5.5p1 Debian-4ubuntu4</example>
265
+ <example>OpenSSH_5.5p1 Debian-4ubuntu5</example>
266
+ <param pos="1" name="service.version"/>
267
+ <param pos="2" name="openssh.comment"/>
268
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
269
+ <param pos="0" name="service.family" value="OpenSSH"/>
270
+ <param pos="0" name="service.product" value="OpenSSH"/>
271
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
272
+ <param pos="0" name="os.device" value="General"/>
273
+ <param pos="0" name="os.family" value="Linux"/>
274
+ <param pos="0" name="os.product" value="Linux"/>
275
+ <param pos="0" name="os.version" value="10.10"/>
276
+ </fingerprint>
277
+
278
+ <fingerprint pattern="^OpenSSH_(5\.8p1) (Debian-1ubuntu3)$">
279
+ <description>OpenSSH running on Ubuntu 11.04</description>
280
+ <example>OpenSSH_5.8p1 Debian-1ubuntu3</example>
281
+ <param pos="1" name="service.version"/>
282
+ <param pos="2" name="openssh.comment"/>
283
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
284
+ <param pos="0" name="service.family" value="OpenSSH"/>
285
+ <param pos="0" name="service.product" value="OpenSSH"/>
286
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
287
+ <param pos="0" name="os.device" value="General"/>
288
+ <param pos="0" name="os.family" value="Linux"/>
289
+ <param pos="0" name="os.product" value="Linux"/>
290
+ <param pos="0" name="os.version" value="11.04"/>
291
+ </fingerprint>
292
+
293
+ <fingerprint pattern="^OpenSSH_(5\.8p1) (Debian-7ubuntu1)$">
294
+ <description>OpenSSH running on Ubuntu 11.10</description>
295
+ <example>OpenSSH_5.8p1 Debian-7ubuntu1</example>
296
+ <param pos="1" name="service.version"/>
297
+ <param pos="2" name="openssh.comment"/>
298
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
299
+ <param pos="0" name="service.family" value="OpenSSH"/>
300
+ <param pos="0" name="service.product" value="OpenSSH"/>
301
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
302
+ <param pos="0" name="os.device" value="General"/>
303
+ <param pos="0" name="os.family" value="Linux"/>
304
+ <param pos="0" name="os.product" value="Linux"/>
305
+ <param pos="0" name="os.version" value="11.10"/>
306
+ </fingerprint>
307
+
308
+ <fingerprint pattern="^OpenSSH_(5\.9p1) (Debian-5ubuntu1(?:\.3|))$">
309
+ <description>OpenSSH running on Ubuntu 12.04</description>
310
+ <example>OpenSSH_5.9p1 Debian-5ubuntu1</example>
311
+ <param pos="1" name="service.version"/>
312
+ <param pos="2" name="openssh.comment"/>
313
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
314
+ <param pos="0" name="service.family" value="OpenSSH"/>
315
+ <param pos="0" name="service.product" value="OpenSSH"/>
316
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
317
+ <param pos="0" name="os.device" value="General"/>
318
+ <param pos="0" name="os.family" value="Linux"/>
319
+ <param pos="0" name="os.product" value="Linux"/>
320
+ <param pos="0" name="os.version" value="12.04"/>
321
+ </fingerprint>
322
+
323
+ <fingerprint pattern="^OpenSSH_(6\.0p1) (Debian-3ubuntu1)$">
324
+ <description>OpenSSH running on Ubuntu 12.10</description>
325
+ <example>OpenSSH_6.0p1 Debian-3ubuntu1</example>
326
+ <param pos="1" name="service.version"/>
327
+ <param pos="2" name="openssh.comment"/>
328
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
329
+ <param pos="0" name="service.family" value="OpenSSH"/>
330
+ <param pos="0" name="service.product" value="OpenSSH"/>
331
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
332
+ <param pos="0" name="os.device" value="General"/>
333
+ <param pos="0" name="os.family" value="Linux"/>
334
+ <param pos="0" name="os.product" value="Linux"/>
335
+ <param pos="0" name="os.version" value="12.10"/>
336
+ </fingerprint>
337
+
338
+ <fingerprint pattern="^OpenSSH_(6\.1p1) (Debian-4)$">
339
+ <description>OpenSSH running on Ubuntu 13.04</description>
340
+ <example>OpenSSH_6.1p1 Debian-4</example>
341
+ <param pos="1" name="service.version"/>
342
+ <param pos="2" name="openssh.comment"/>
343
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
344
+ <param pos="0" name="service.family" value="OpenSSH"/>
345
+ <param pos="0" name="service.product" value="OpenSSH"/>
346
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
347
+ <param pos="0" name="os.device" value="General"/>
348
+ <param pos="0" name="os.family" value="Linux"/>
349
+ <param pos="0" name="os.product" value="Linux"/>
350
+ <param pos="0" name="os.version" value="13.04"/>
351
+ </fingerprint>
352
+
353
+ <fingerprint pattern="^OpenSSH_(6\.6p1) (Ubuntu-2ubuntu1)$">
354
+ <description>OpenSSH running on Ubuntu 14.04</description>
355
+ <example>OpenSSH_6.6p1 Ubuntu-2ubuntu1</example>
356
+ <param pos="1" name="service.version"/>
357
+ <param pos="2" name="openssh.comment"/>
358
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
359
+ <param pos="0" name="service.family" value="OpenSSH"/>
360
+ <param pos="0" name="service.product" value="OpenSSH"/>
361
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
362
+ <param pos="0" name="os.device" value="General"/>
363
+ <param pos="0" name="os.family" value="Linux"/>
364
+ <param pos="0" name="os.product" value="Linux"/>
365
+ <param pos="0" name="os.version" value="14.04"/>
366
+ </fingerprint>
367
+
368
+ <fingerprint pattern="^OpenSSH_([^\s]+)\s+((?:Debian|Ubuntu).+ubuntu.*)$">
369
+ <description>OpenSSH running on Ubuntu</description>
370
+ <param pos="1" name="service.version"/>
371
+ <param pos="2" name="openssh.comment"/>
372
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
373
+ <param pos="0" name="service.family" value="OpenSSH"/>
374
+ <param pos="0" name="service.product" value="OpenSSH"/>
375
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
376
+ <param pos="0" name="os.device" value="General"/>
377
+ <param pos="0" name="os.family" value="Linux"/>
378
+ <param pos="0" name="os.product" value="Linux"/>
379
+ </fingerprint>
380
+
381
+ <fingerprint pattern="^OpenSSH_([^\s]+)\s+(Debian.+etch.*)$">
382
+ <description>OpenSSH running on Debian 4.0 (etch)</description>
383
+ <param pos="1" name="service.version"/>
384
+ <param pos="2" name="openssh.comment"/>
385
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
386
+ <param pos="0" name="service.family" value="OpenSSH"/>
387
+ <param pos="0" name="service.product" value="OpenSSH"/>
388
+ <param pos="0" name="os.vendor" value="Debian"/>
389
+ <param pos="0" name="os.device" value="General"/>
390
+ <param pos="0" name="os.family" value="Linux"/>
391
+ <param pos="0" name="os.product" value="Linux"/>
392
+ <param pos="0" name="os.version" value="4.0"/>
393
+ </fingerprint>
394
+
395
+ <fingerprint pattern="^OpenSSH_([^\s]+)\s+(Debian.+sarge.*)$">
396
+ <description>OpenSSH running on Debian 3.1 (sarge)</description>
397
+ <param pos="1" name="service.version"/>
398
+ <param pos="2" name="openssh.comment"/>
399
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
400
+ <param pos="0" name="service.family" value="OpenSSH"/>
401
+ <param pos="0" name="service.product" value="OpenSSH"/>
402
+ <param pos="0" name="os.vendor" value="Debian"/>
403
+ <param pos="0" name="os.device" value="General"/>
404
+ <param pos="0" name="os.family" value="Linux"/>
405
+ <param pos="0" name="os.product" value="Linux"/>
406
+ <param pos="0" name="os.version" value="3.1"/>
407
+ </fingerprint>
408
+
409
+ <fingerprint pattern="^OpenSSH_([^\s]+)\s+(Debian.+woody.*)$">
410
+ <description>OpenSSH running on Debian 3.0 (woody)</description>
411
+ <param pos="1" name="service.version"/>
412
+ <param pos="2" name="openssh.comment"/>
413
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
414
+ <param pos="0" name="service.family" value="OpenSSH"/>
415
+ <param pos="0" name="service.product" value="OpenSSH"/>
416
+ <param pos="0" name="os.vendor" value="Debian"/>
417
+ <param pos="0" name="os.device" value="General"/>
418
+ <param pos="0" name="os.family" value="Linux"/>
419
+ <param pos="0" name="os.product" value="Linux"/>
420
+ <param pos="0" name="os.version" value="3.0"/>
421
+ </fingerprint>
422
+
423
+ <fingerprint pattern="^OpenSSH_([^\s]+)\s+(Debian.*)$">
424
+ <description>OpenSSH running on Debian (unknown version)</description>
425
+ <param pos="1" name="service.version"/>
426
+ <param pos="2" name="openssh.comment"/>
427
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
428
+ <param pos="0" name="service.family" value="OpenSSH"/>
429
+ <param pos="0" name="service.product" value="OpenSSH"/>
430
+ <param pos="0" name="os.vendor" value="Debian"/>
431
+ <param pos="0" name="os.device" value="General"/>
432
+ <param pos="0" name="os.family" value="Linux"/>
433
+ <param pos="0" name="os.product" value="Linux"/>
434
+ </fingerprint>
435
+
436
+ <fingerprint pattern="^OpenSSH_(.*)\+(CAN-[0-9]{4}-[0-9]{4})$">
437
+ <description>OpenSSH with CVE patch, as seen in Mac OS X</description>
438
+ <param pos="1" name="service.version"/>
439
+ <param pos="2" name="openssh.cvepatch"/>
440
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
441
+ <param pos="0" name="service.family" value="OpenSSH"/>
442
+ <param pos="0" name="service.product" value="OpenSSH"/>
443
+ <param pos="0" name="os.vendor" value="Apple"/>
444
+ <param pos="0" name="os.device" value="General"/>
445
+ <param pos="0" name="os.family" value="Mac OS X"/>
446
+ <param pos="0" name="os.product" value="Mac OS X"/>
447
+ </fingerprint>
448
+
449
+ <fingerprint pattern="^OpenSSH_(.*)_Mikrotik_v(.*)$">
450
+ <description>Huawei Versatile Routing Platform (VRP)</description>
451
+ <param pos="1" name="service.version"/>
452
+ <param pos="2" name="os.version"/>
453
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
454
+ <param pos="0" name="service.family" value="OpenSSH"/>
455
+ <param pos="0" name="service.product" value="OpenSSH"/>
456
+ <param pos="0" name="os.vendor" value="MikroTik"/>
457
+ <param pos="0" name="os.device" value="Router"/>
458
+ <param pos="0" name="os.family" value="RouterOS"/>
459
+ <param pos="0" name="os.product" value="RouterOS"/>
460
+ </fingerprint>
461
+
462
+ <fingerprint pattern="^OpenSSH_(.*) in DesktopAuthority (.*)$">
463
+ <!-- OpenSSH_3.8 in DesktopAuthority 5.55.030 -->
464
+ <description>DesktopAuthority SSH</description>
465
+ <param pos="1" name="service.version"/>
466
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
467
+ <param pos="0" name="service.family" value="OpenSSH"/>
468
+ <param pos="0" name="service.product" value="OpenSSH"/>
469
+ <param pos="0" name="os.vendor" value="Microsoft"/>
470
+ <param pos="0" name="os.family" value="Windows"/>
471
+ <param pos="0" name="os.product" value="Windows"/>
472
+ </fingerprint>
473
+
474
+ <!-- SSH-1.99-OpenSSH_4.3p2-4.cern-hpn-CERN-4.3p2-4.cern -->
475
+
476
+ <fingerprint pattern="^OpenSSH_?([^\s]*)\s*(.*)$">
477
+ <description>Catch all for OpenSSH based SSH servers
478
+ ******************** NOTE ********************
479
+ Be sure to put any specific OpenSSH derivative
480
+ checks above this block.
481
+ ******************** NOTE ********************
482
+ </description>
483
+ <param pos="1" name="service.version"/>
484
+ <param pos="2" name="openssh.comment"/>
485
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
486
+ <param pos="0" name="service.family" value="OpenSSH"/>
487
+ <param pos="0" name="service.product" value="OpenSSH"/>
488
+ </fingerprint>
489
+
490
+ <!-- TODO: Handle "vpn3" banners for Cisco 3000 VPN Concentrators (need example banners first) -->
491
+
492
+ <fingerprint pattern="^Cisco-(.*)$">
493
+ <description>Cisco SSH banner (could be IOS or PIX).
494
+ The version always seems to be 1.25</description>
495
+ <param pos="1" name="service.version"/>
496
+ <param pos="0" name="service.vendor" value="Cisco"/>
497
+ <param pos="0" name="service.product" value="SSH"/>
498
+ <param pos="0" name="os.vendor" value="Cisco"/>
499
+ <!-- temporary workaround for NEX-2123: assume it is IOS -->
500
+ <param pos="0" name="os.product" value="IOS"/>
501
+ <param pos="0" name="os.certainty" value="0.8"/>
502
+ </fingerprint>
503
+
504
+ <fingerprint pattern="^CISCO_WLC$">
505
+ <description>SSH banner from a Cisco Wireless LAN Controller (WLC)</description>
506
+ <example>CISCO_WLC</example>
507
+ <param pos="0" name="service.vendor" value="Cisco"/>
508
+ <param pos="0" name="service.product" value="SSH"/>
509
+ <param pos="0" name="os.vendor" value="Cisco"/>
510
+ <param pos="0" name="os.product" value="Wireless LAN Controller"/>
511
+ </fingerprint>
512
+
513
+ <fingerprint pattern="^Sun_SSH_(.*)$">
514
+ <description>Sun SSH banner</description>
515
+ <param pos="1" name="service.version"/>
516
+ <param pos="0" name="service.vendor" value="Sun"/>
517
+ <param pos="0" name="service.product" value="SSH"/>
518
+ <param pos="0" name="os.vendor" value="Sun"/>
519
+ <param pos="0" name="os.family" value="Solaris"/>
520
+ <param pos="0" name="os.product" value="Solaris"/>
521
+ </fingerprint>
522
+
523
+ <fingerprint pattern="^SSH Protocol Compatible Server SCS (.*)$">
524
+ <description>Netscreen</description>
525
+ <param pos="1" name="service.version"/>
526
+ <param pos="0" name="service.vendor" value="Juniper"/>
527
+ <param pos="0" name="service.family" value="NetScreen"/>
528
+ <param pos="0" name="service.product" value="NetScreen"/>
529
+ <param pos="0" name="os.vendor" value="Juniper"/>
530
+ <param pos="0" name="os.device" value="Firewall"/>
531
+ <param pos="0" name="os.family" value="ScreenOS"/>
532
+ <param pos="0" name="os.product" value="ScreenOS"/>
533
+ </fingerprint>
534
+
535
+ <fingerprint pattern="^NetScreen$">
536
+ <description>Netscreen</description>
537
+ <param pos="0" name="service.vendor" value="Juniper"/>
538
+ <param pos="0" name="service.family" value="NetScreen"/>
539
+ <param pos="0" name="service.product" value="NetScreen"/>
540
+ <param pos="0" name="os.vendor" value="Juniper"/>
541
+ <param pos="0" name="os.device" value="Firewall"/>
542
+ <param pos="0" name="os.family" value="ScreenOS"/>
543
+ <param pos="0" name="os.product" value="ScreenOS"/>
544
+ </fingerprint>
545
+
546
+ <fingerprint pattern="^(HUAWEI-VRP-?|VRP-)(.*)$">
547
+ <description>Huawei Versatile Routing Platform (VRP)</description>
548
+ <param pos="2" name="service.version"/>
549
+ <param pos="2" name="os.version"/>
550
+ <param pos="0" name="service.vendor" value="Huawei"/>
551
+ <param pos="0" name="service.family" value="VRP"/>
552
+ <param pos="0" name="service.product" value="VRP"/>
553
+ <param pos="0" name="os.vendor" value="Huawei"/>
554
+ <param pos="0" name="os.device" value="Router"/>
555
+ <param pos="0" name="os.family" value="VRP"/>
556
+ <param pos="0" name="os.product" value="VRP"/>
557
+ </fingerprint>
558
+
559
+ <fingerprint pattern="^([^\s]+) sshlib: GlobalScape$">
560
+ <description>GlobalScape SSH (which uses Bitvise sshlib)</description>
561
+ <param pos="1" name="service.component.version"/>
562
+ <param pos="0" name="service.component.vendor" value="Bitvise"/>
563
+ <param pos="0" name="service.component.family" value="sshlib"/>
564
+ <param pos="0" name="service.component.product" value="sshlib"/>
565
+ <param pos="0" name="service.vendor" value="GlobalScape"/>
566
+ <param pos="0" name="service.family" value="Secure FTP Server"/>
567
+ <param pos="0" name="service.product" value="Secure FTP Server"/>
568
+ <param pos="0" name="os.vendor" value="Microsoft"/>
569
+ <param pos="0" name="os.family" value="Windows"/>
570
+ <param pos="0" name="os.product" value="Windows"/>
571
+ </fingerprint>
572
+
573
+ <fingerprint pattern="^([^\s]+) sshlib: WinSSHD (.*)$">
574
+ <description>Bitvise WinSSHD (which uses Bitvise sshlib)</description>
575
+ <param pos="1" name="service.component.version"/>
576
+ <param pos="2" name="service.version"/>
577
+ <param pos="0" name="service.component.vendor" value="Bitvise"/>
578
+ <param pos="0" name="service.component.family" value="sshlib"/>
579
+ <param pos="0" name="service.component.product" value="sshlib"/>
580
+ <param pos="0" name="service.vendor" value="Bitvise"/>
581
+ <param pos="0" name="service.family" value="WinSSHD"/>
582
+ <param pos="0" name="service.product" value="WinSSHD"/>
583
+ <param pos="0" name="os.vendor" value="Microsoft"/>
584
+ <param pos="0" name="os.family" value="Windows"/>
585
+ <param pos="0" name="os.product" value="Windows"/>
586
+ </fingerprint>
587
+
588
+ <fingerprint pattern="^([^\s]+) FlowSsh: WinSSHD ([^ ]+):?.*$">
589
+ <description>Bitvise WinSSHD (which uses Bitvise flowssh)</description>
590
+ <example>1.03 FlowSsh: WinSSHD 5.09</example>
591
+ <example>1.07 FlowSsh: WinSSHD 5.20: free only for personal non-commercial use</example>
592
+ <param pos="1" name="service.component.version"/>
593
+ <param pos="2" name="service.version"/>
594
+ <param pos="0" name="service.component.vendor" value="Bitvise"/>
595
+ <param pos="0" name="service.component.family" value="flowssh"/>
596
+ <param pos="0" name="service.component.product" value="flowssh"/>
597
+ <param pos="0" name="service.vendor" value="Bitvise"/>
598
+ <param pos="0" name="service.family" value="WinSSHD"/>
599
+ <param pos="0" name="service.product" value="WinSSHD"/>
600
+ <param pos="0" name="os.vendor" value="Microsoft"/>
601
+ <param pos="0" name="os.family" value="Windows"/>
602
+ <param pos="0" name="os.product" value="Windows"/>
603
+ </fingerprint>
604
+
605
+ <fingerprint pattern="^([^\s]+) sshlib: MOVEit DMZ SSH (.*)$">
606
+ <description>MOVEit DMZ (which uses Bitvise sshlib)</description>
607
+ <param pos="1" name="service.component.version"/>
608
+ <param pos="2" name="service.version"/>
609
+ <param pos="0" name="service.component.vendor" value="Bitvise"/>
610
+ <param pos="0" name="service.component.family" value="sshlib"/>
611
+ <param pos="0" name="service.component.product" value="sshlib"/>
612
+ <param pos="0" name="service.vendor" value="Standard Networks"/>
613
+ <param pos="0" name="service.family" value="MOVEit DMZ"/>
614
+ <param pos="0" name="service.product" value="MOVEit DMZ"/>
615
+ <param pos="0" name="os.vendor" value="Microsoft"/>
616
+ <param pos="0" name="os.family" value="Windows"/>
617
+ <param pos="0" name="os.product" value="Windows"/>
618
+ </fingerprint>
619
+
620
+ <fingerprint pattern="^Pragma SecureShell\s*(.*)$">
621
+ <description>Pragma SecureShell</description>
622
+ <param pos="1" name="service.version"/>
623
+ <param pos="0" name="service.vendor" value="Pragma Systems"/>
624
+ <param pos="0" name="service.family" value="FortressSSH Server"/>
625
+ <param pos="0" name="service.product" value="FortressSSH Server"/>
626
+ <param pos="0" name="os.vendor" value="Microsoft"/>
627
+ <param pos="0" name="os.family" value="Windows"/>
628
+ <param pos="0" name="os.product" value="Windows"/>
629
+ </fingerprint>
630
+
631
+ <fingerprint pattern="^VShell_(\d+)_(\d+)_(\d+)_(\d+) VShell$">
632
+ <description>VanDyke VShell</description>
633
+ <example>VShell_3_6_2_446 VShell</example>
634
+ <param pos="1" name="service.version"/>
635
+ <param pos="2" name="service.version.version"/>
636
+ <param pos="3" name="service.version.version.version"/>
637
+ <param pos="4" name="service.version.version.version.version"/>
638
+ <param pos="0" name="service.vendor" value="VanDyke Software"/>
639
+ <param pos="0" name="service.family" value="VShell"/>
640
+ <param pos="0" name="service.product" value="VShell"/>
641
+ </fingerprint>
642
+
643
+ <fingerprint pattern="^([\s]*)\s*VShell$">
644
+ <description>VanDyke VShell</description>
645
+ <param pos="1" name="service.version"/>
646
+ <param pos="0" name="service.vendor" value="VanDyke Software"/>
647
+ <param pos="0" name="service.family" value="VShell"/>
648
+ <param pos="0" name="service.product" value="VShell"/>
649
+ </fingerprint>
650
+
651
+ <fingerprint pattern="^WRQReflectionForSecureIT_(.*)$">
652
+ <description>Attachmate Reflection (formerly WRQ Reflection for Secure IT)
653
+ </description>
654
+ <!-- versions are of the form: 6.0 Build 23 -->
655
+ <param pos="1" name="service.version"/>
656
+ <param pos="0" name="service.vendor" value="Attachmate"/>
657
+ <param pos="0" name="service.family" value="Reflection"/>
658
+ <param pos="0" name="service.product" value="Reflection"/>
659
+ </fingerprint>
660
+
661
+ <fingerprint pattern="^([^\s]*)\s*F-Secure SSH\s*(.*)$">
662
+ <!-- 3.2.3 F-Secure SSH Windows NT Server -->
663
+ <description>Attachmate Reflection (formerly F-Secure SSH)
664
+ </description>
665
+ <param pos="1" name="service.version"/>
666
+ <param pos="0" name="service.vendor" value="Attachmate"/>
667
+ <param pos="0" name="service.family" value="Reflection"/>
668
+ <param pos="0" name="service.product" value="Reflection"/>
669
+ </fingerprint>
670
+
671
+ <fingerprint pattern="^([^\s]*)\s*SSH Tectia Server$">
672
+ <!-- 5.0.1.79 SSH Tectia Server -->
673
+ <description>SSH Communications Security Tectia Server</description>
674
+ <param pos="1" name="service.version"/>
675
+ <param pos="0" name="service.vendor" value="SSH Communications Security"/>
676
+ <param pos="0" name="service.family" value="SSH Tectia Server"/>
677
+ <param pos="0" name="service.product" value="SSH Tectia Server"/>
678
+ </fingerprint>
679
+
680
+ <fingerprint pattern="^([0-9\.]+) SSH Secure Shell(?: \(non-commercial\))?$">
681
+ <example>3.2.9.1 SSH Secure Shell (non-commercial)</example>
682
+ <example>4.0.3 SSH Secure Shell</example>
683
+ <example>4.4.2.3 SSH Secure Shell</example>
684
+ <description>SSH Communications Security Tectia Server</description>
685
+ <param pos="1" name="service.version"/>
686
+ <param pos="0" name="service.vendor" value="SSH Communications Security"/>
687
+ <param pos="0" name="service.family" value="SSH Tectia Server"/>
688
+ <param pos="0" name="service.product" value="SSH Tectia Server"/>
689
+ </fingerprint>
690
+
691
+ <fingerprint pattern="^([0-9\.]+) SSH Secure Shell Windows NT Server$">
692
+ <description>Unknown Windows SSH server</description>
693
+ <example>4.0.3 SSH Secure Shell Windows NT Server</example>
694
+ <param pos="0" name="os.vendor" value="Microsoft"/>
695
+ <param pos="0" name="os.family" value="Windows"/>
696
+ <param pos="0" name="os.product" value="Windows"/>
697
+ <param pos="1" name="service.version"/>
698
+ <param pos="0" name="service.vendor" value="SSH Communications Security"/>
699
+ <param pos="0" name="service.family" value="SSH Tectia Server"/>
700
+ <param pos="0" name="service.product" value="SSH Tectia Server"/>
701
+ </fingerprint>
702
+
703
+ <fingerprint pattern="^ARRIS_(.*)$">
704
+ <description>ARRIS device (though not clear which) - www.arrisi.com</description>
705
+ <param pos="1" name="service.version"/>
706
+ <param pos="0" name="service.vendor" value="ARRIS"/>
707
+ <param pos="0" name="service.product" value="ARRIS"/>
708
+ <param pos="0" name="os.vendor" value="ARRIS"/>
709
+ <param pos="0" name="os.product" value="Unknown"/>
710
+ </fingerprint>
711
+
712
+ <fingerprint pattern="^Mocana SSH.*$">
713
+ <description>Mocana Embedded SSH (note, there seem to be spaces at the
714
+ end of the returned banner, thus the .*</description>
715
+ <param pos="0" name="service.vendor" value="Mocana"/>
716
+ <param pos="0" name="service.family" value="Embedded SSH Server"/>
717
+ <param pos="0" name="service.product" value="Embedded SSH Server"/>
718
+ </fingerprint>
719
+
720
+ <fingerprint pattern="^FreSSH\.(.*)$">
721
+ <description>FreSSH</description>
722
+ <param pos="1" name="service.version"/>
723
+ <param pos="0" name="service.family" value="FreSSH"/>
724
+ <param pos="0" name="service.product" value="FreSSH"/>
725
+ </fingerprint>
726
+
727
+ <fingerprint pattern="^RomCliSecure_(.*)$">
728
+ <description>RomCliSecure appears to be the Adtran NetVanta products</description>
729
+ <param pos="1" name="service.version"/>
730
+ <param pos="0" name="service.vendor" value="Adtran"/>
731
+ <param pos="0" name="service.family" value="NetVanta"/>
732
+ <param pos="0" name="service.product" value="NetVanta"/>
733
+ <param pos="0" name="os.vendor" value="Adtran"/>
734
+ <param pos="0" name="os.family" value="NetVanta"/>
735
+ <param pos="0" name="os.product" value="NetVanta"/>
736
+ </fingerprint>
737
+
738
+ <fingerprint pattern="^.*MultiNet.*$">
739
+ <description>Process Software MultiNet is a suite of network apps for OpenVMS</description>
740
+ <param pos="0" name="service.vendor" value="Process Software"/>
741
+ <param pos="0" name="service.family" value="MultiNet"/>
742
+ <param pos="0" name="service.product" value="MultiNet"/>
743
+ <param pos="0" name="os.vendor" value="HP"/>
744
+ <param pos="0" name="os.family" value="OpenVMS"/>
745
+ <param pos="0" name="os.product" value="OpenVMS"/>
746
+ </fingerprint>
747
+
748
+ <fingerprint pattern="^dropbear_(.*)$">
749
+ <!-- dropbear_0.36 -->
750
+ <!-- dropbear_0.44test4 -->
751
+ <description>Dropbear - http://matt.ucc.asn.au/dropbear/dropbear.html</description>
752
+ <param pos="1" name="service.version"/>
753
+ <param pos="0" name="service.family" value="Dropbear"/>
754
+ <param pos="0" name="service.product" value="Dropbear"/>
755
+ </fingerprint>
756
+
757
+ <fingerprint pattern="^lancom$">
758
+ <description>LANCOM Systems - http://www.lancom-systems.de/</description>
759
+ <param pos="0" name="service.vendor" value="LANCOM Systems"/>
760
+ <param pos="0" name="service.family" value="SSH"/>
761
+ <param pos="0" name="service.product" value="SSH"/>
762
+ <param pos="0" name="os.vendor" value="LANCOM Systems"/>
763
+ <param pos="0" name="os.product" value="Unknown"/>
764
+ </fingerprint>
765
+
766
+ <fingerprint pattern="^0$">
767
+ <description>MOVEit DMZ</description>
768
+ <param pos="0" name="service.vendor" value="Standard Networks"/>
769
+ <param pos="0" name="service.family" value="MOVEit DMZ"/>
770
+ <param pos="0" name="service.product" value="MOVEit DMZ"/>
771
+ <param pos="0" name="os.vendor" value="Microsoft"/>
772
+ <param pos="0" name="os.family" value="Windows"/>
773
+ <param pos="0" name="os.product" value="Windows"/>
774
+ </fingerprint>
775
+
776
+ <!--
777
+ 1.2.22j4rad
778
+ 2.40
779
+ 2.0.12
780
+ Server-VII
781
+ 9.9.1
782
+ IPSSH-1.10.0
783
+ -->
784
+
785
+ <!--
786
+ Possibly Nortel Passport
787
+ SSH_2.1.1
788
+ -->
789
+
790
+ </fingerprints>