recog 2.0.13 → 2.0.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CONTRIBUTING.md +19 -6
- data/features/{xml → data}/failing_banners_fingerprints.xml +0 -0
- data/features/{xml → data}/matching_banners_fingerprints.xml +0 -0
- data/features/{xml → data}/no_tests.xml +0 -0
- data/features/{xml/banners.xml → data/sample_banner.txt} +0 -0
- data/features/{xml → data}/successful_tests.xml +0 -0
- data/features/{xml → data}/tests_with_failures.xml +0 -0
- data/features/{xml → data}/tests_with_warnings.xml +0 -0
- data/features/match.feature +2 -2
- data/features/support/env.rb +1 -1
- data/lib/recog/version.rb +1 -1
- data/misc/order.xsl +17 -0
- data/spec/lib/fingerprint_self_test_spec.rb +8 -0
- data/xml/apache_os.xml +270 -334
- data/xml/architecture.xml +28 -41
- data/xml/fingerprints.xsd +37 -0
- data/xml/ftp_banners.xml +52 -58
- data/xml/h323_callresp.xml +597 -695
- data/xml/hp_pjl_id.xml +370 -409
- data/xml/http_cookies.xml +304 -348
- data/xml/http_servers.xml +3202 -3483
- data/xml/http_wwwauth.xml +342 -409
- data/xml/imap_banners.xml +149 -190
- data/xml/mdns_device-info_txt.xml +97 -111
- data/xml/mdns_workstation_txt.xml +6 -6
- data/xml/mysql_banners.xml +99 -198
- data/xml/mysql_error.xml +4 -11
- data/xml/nntp_banners.xml +42 -45
- data/xml/ntp_banners.xml +2 -3
- data/xml/pop_banners.xml +214 -247
- data/xml/rsh_resp.xml +68 -76
- data/xml/sip_banners.xml +19 -19
- data/xml/sip_user_agents.xml +63 -74
- data/xml/smb_native_os.xml +387 -433
- data/xml/smtp_banners.xml +1318 -1460
- data/xml/smtp_debug.xml +24 -27
- data/xml/smtp_ehlo.xml +19 -22
- data/xml/smtp_expn.xml +61 -70
- data/xml/smtp_help.xml +139 -160
- data/xml/smtp_mailfrom.xml +14 -16
- data/xml/smtp_noop.xml +28 -31
- data/xml/smtp_quit.xml +16 -18
- data/xml/smtp_rcptto.xml +8 -10
- data/xml/smtp_rset.xml +12 -13
- data/xml/smtp_turn.xml +12 -13
- data/xml/smtp_vrfy.xml +66 -76
- data/xml/snmp_sysdescr.xml +7257 -8016
- data/xml/snmp_sysobjid.xml +392 -434
- data/xml/ssh_banners.xml +783 -867
- data/xml/upnp_banners.xml +594 -628
- metadata +11 -9
data/xml/mysql_error.xml
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
<?xml version="1.0"?>
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
<!--
|
|
3
3
|
Upon successful connection to a MySQL/derivative TCP endpoint, if the
|
|
4
4
|
connecting client is not allowed to speak to the MySQL service (for
|
|
@@ -160,7 +160,6 @@
|
|
|
160
160
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
161
161
|
<param pos="0" name="service.product" value="MySQL"/>
|
|
162
162
|
</fingerprint>
|
|
163
|
-
|
|
164
163
|
<!-- ER_HOST_IS_BLOCKED -->
|
|
165
164
|
<fingerprint pattern="Stroj '[^']+' je zablokován kvůli mnoha chybám při připojování. Odblokujete použitím 'mysqladmin flush-hosts'">
|
|
166
165
|
<description>Oracle MySQL error ER_HOST_IS_BLOCKED (cze)</description>
|
|
@@ -295,7 +294,6 @@
|
|
|
295
294
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
296
295
|
<param pos="0" name="service.product" value="MySQL"/>
|
|
297
296
|
</fingerprint>
|
|
298
|
-
|
|
299
297
|
<!-- ER_CANT_CREATE_THREAD -->
|
|
300
298
|
<fingerprint pattern="Nemohu vytvořit nový thread \(errno -?\d+\). Pokud je ještě nějaká volná paměť, podívejte se do manuálu na část o chybách specifických pro jednotlivé operační systémy">
|
|
301
299
|
<description>Oracle MySQL error ER_CANT_CREATE_THREAD (cze)</description>
|
|
@@ -423,7 +421,6 @@
|
|
|
423
421
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
424
422
|
<param pos="0" name="service.product" value="MySQL"/>
|
|
425
423
|
</fingerprint>
|
|
426
|
-
|
|
427
424
|
<!-- ER_CON_COUNT_ERROR -->
|
|
428
425
|
<fingerprint pattern="Příliš mnoho spojení">
|
|
429
426
|
<description>Oracle MySQL error ER_CON_COUNT_ERROR (cze)</description>
|
|
@@ -586,7 +583,6 @@
|
|
|
586
583
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
587
584
|
<param pos="0" name="service.product" value="MySQL"/>
|
|
588
585
|
</fingerprint>
|
|
589
|
-
|
|
590
586
|
<!-- ER_BAD_HOST_ERROR -->
|
|
591
587
|
<fingerprint pattern="Nemohu zjistit jméno stroje pro Vaši adresu">
|
|
592
588
|
<description>Oracle MySQL error ER_BAD_HOST_ERROR (cze)</description>
|
|
@@ -749,26 +745,23 @@
|
|
|
749
745
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
750
746
|
<param pos="0" name="service.product" value="MySQL"/>
|
|
751
747
|
</fingerprint>
|
|
752
|
-
|
|
753
748
|
<fingerprint pattern="^Host '[^']+' is not allowed to connect to this MariaDB server$">
|
|
754
|
-
<example>Host '10.10.10.10' is not allowed to connect to this MariaDB server</example>
|
|
755
749
|
<description>MariaDB MariaDB - Error: Host not allowed to connect (English) </description>
|
|
750
|
+
<example>Host '10.10.10.10' is not allowed to connect to this MariaDB server</example>
|
|
756
751
|
<param pos="0" name="service.vendor" value="MariaDB"/>
|
|
757
752
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
758
753
|
<param pos="0" name="service.product" value="MariaDB"/>
|
|
759
754
|
</fingerprint>
|
|
760
|
-
|
|
761
755
|
<fingerprint pattern="^#07000Proxy Warning - IP Forbidden$">
|
|
762
|
-
<example>#07000Proxy Warning - IP Forbidden</example>
|
|
763
756
|
<description>Oracle MySQL Proxy - Error: Host not allowed to connect</description>
|
|
757
|
+
<example>#07000Proxy Warning - IP Forbidden</example>
|
|
764
758
|
<param pos="0" name="service.vendor" value="Oracle"/>
|
|
765
759
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
766
760
|
<param pos="0" name="service.product" value="MySQL Proxy"/>
|
|
767
761
|
</fingerprint>
|
|
768
|
-
|
|
769
762
|
<fingerprint pattern="^\(proxy\) all backends are down$">
|
|
770
|
-
<example>(proxy) all backends are down</example>
|
|
771
763
|
<description>Oracle MySQL Proxy - Error: Backends down</description>
|
|
764
|
+
<example>(proxy) all backends are down</example>
|
|
772
765
|
<param pos="0" name="service.vendor" value="Oracle"/>
|
|
773
766
|
<param pos="0" name="service.family" value="MySQL"/>
|
|
774
767
|
<param pos="0" name="service.product" value="MySQL Proxy"/>
|
data/xml/nntp_banners.xml
CHANGED
|
@@ -1,51 +1,48 @@
|
|
|
1
|
-
<?xml version="1.0"?>
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
<!--
|
|
3
3
|
NNTP greeting messages (part of the banner after the response code) are matched
|
|
4
4
|
against these patterns to fingerprint NNTP servers.
|
|
5
5
|
-->
|
|
6
|
-
|
|
7
6
|
<fingerprints matches="nntp.banner">
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
<param pos="0" name="os.product" value="Windows"/>
|
|
50
|
-
</fingerprint>
|
|
7
|
+
<fingerprint pattern="^NNTP Service (?:.*) Version: (5.0.2195.[0-9]+) .*$">
|
|
8
|
+
<description>Microsoft IIS NNTP Server on Windows 2000</description>
|
|
9
|
+
<example>NNTP Service 5.00.0984 Version: 5.0.2195.7034 Posting Allowed</example>
|
|
10
|
+
<example>NNTP Service 5.00.0984 Version: 5.0.2195.5329 Posting Allowed</example>
|
|
11
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
12
|
+
<param pos="0" name="service.product" value="IIS"/>
|
|
13
|
+
<param pos="0" name="service.family" value="IIS"/>
|
|
14
|
+
<param pos="1" name="service.version"/>
|
|
15
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
16
|
+
<param pos="0" name="os.device" value="General"/>
|
|
17
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
18
|
+
<param pos="0" name="os.product" value="Windows 2000"/>
|
|
19
|
+
<param pos="1" name="ms.nttp.version"/>
|
|
20
|
+
</fingerprint>
|
|
21
|
+
<fingerprint pattern="^NNTP Service (?:.*) Version: (6.0.3790.[0-9]+) .*$">
|
|
22
|
+
<description>Microsoft IIS NNTP Server on Windows Server 2003</description>
|
|
23
|
+
<example>NNTP Service 6.0.3790.3959 Version: 6.0.3790.3959 Posting Allowed</example>
|
|
24
|
+
<example>NNTP Service 6.0.3790.206 Version: 6.0.3790.206 Posting Allowed</example>
|
|
25
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
26
|
+
<param pos="0" name="service.product" value="IIS"/>
|
|
27
|
+
<param pos="0" name="service.family" value="IIS"/>
|
|
28
|
+
<param pos="1" name="service.version"/>
|
|
29
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
30
|
+
<param pos="0" name="os.device" value="General"/>
|
|
31
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
32
|
+
<param pos="0" name="os.product" value="Windows Server 2003"/>
|
|
33
|
+
<param pos="1" name="ms.nttp.version"/>
|
|
34
|
+
</fingerprint>
|
|
35
|
+
<fingerprint pattern="^NNTP Service Microsoft. Internet Services (?:.*) Version: (?:[^ ]+) .*$">
|
|
36
|
+
<description>Older Microsoft IIS NNTP Servers</description>
|
|
37
|
+
<example>NNTP Service Microsoft. Internet Services 5.00 Version: 5.0.2068.0 Posting Allowed</example>
|
|
38
|
+
<example>NNTP Service Microsoft. Internet Services 5.00.7515. Version: 5.0.0.7515 Posting Allowed</example>
|
|
39
|
+
<example>NNTP Service Microsoft. Internet Services 5.5 Version: 5.5.1726.0 Posting Allowed</example>
|
|
40
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
41
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
42
|
+
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
43
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
44
|
+
<param pos="0" name="os.device" value="General"/>
|
|
45
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
46
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
47
|
+
</fingerprint>
|
|
51
48
|
</fingerprints>
|
data/xml/ntp_banners.xml
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
<?xml version="1.0"?>
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
<!--
|
|
3
3
|
NTP "banners", taken from a readvar response
|
|
4
4
|
-->
|
|
@@ -79,7 +79,6 @@ NTP "banners", taken from a readvar response
|
|
|
79
79
|
<param pos="0" name="os.product" value="Windows 7"/>
|
|
80
80
|
<param pos="3" name="os.arch"/>
|
|
81
81
|
</fingerprint>
|
|
82
|
-
|
|
83
82
|
<fingerprint pattern="^.*version="ntpd (\S+)[^"]+",.*system="Equallogic \(R\) storage array"" flags="REG_DOT_NEWLINE,REG_ICASE">
|
|
84
83
|
<description>ntpd running on an EqualLogic Storage Array that includes the NTP version</description>
|
|
85
84
|
<example>
|
|
@@ -231,7 +230,7 @@ NTP "banners", taken from a readvar response
|
|
|
231
230
|
<param pos="0" name="os.product" value="BSD/OS"/>
|
|
232
231
|
<param pos="1" name="os.arch"/>
|
|
233
232
|
<param pos="2" name="os.version"/>
|
|
234
|
-
</fingerprint
|
|
233
|
+
</fingerprint>
|
|
235
234
|
<fingerprint pattern="^.*system="BSD/OS"" flags="REG_DOT_NEWLINE,REG_ICASE">
|
|
236
235
|
<description>BSD/OS without a version or arch</description>
|
|
237
236
|
<example>
|
data/xml/pop_banners.xml
CHANGED
|
@@ -1,254 +1,222 @@
|
|
|
1
|
-
<?xml version="1.0"?>
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
<!--
|
|
3
3
|
POP3 greeting messages (part of the banner after the status indicator +OK or -ERR) are
|
|
4
4
|
matched against these patterns to fingerprint POP3 servers.
|
|
5
5
|
-->
|
|
6
|
-
|
|
7
6
|
<fingerprints matches="pop3.banner">
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
</
|
|
34
|
-
|
|
35
|
-
<
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
<
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
</
|
|
162
|
-
|
|
163
|
-
<
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
<
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
<
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
<param pos="1" name="os.version"/>
|
|
222
|
-
<!-- the version coming from this service is usually accurate for the major version
|
|
223
|
-
but horribly wrong for the minor and patch levels, therefore drop the certainty
|
|
224
|
-
in lieu of a "quality" attribute for fingerprints -->
|
|
225
|
-
<param pos="0" name="os.certainty" value="0.5"/>
|
|
226
|
-
</fingerprint>
|
|
227
|
-
|
|
228
|
-
<fingerprint pattern="^TCPIP POP server V\d\.\d\S-\S{3}, OpenVMS V(\d\.\d-\d)(?:\s+\S+)?\s+at\s+(\S+), .*$">
|
|
229
|
-
<description>TCP/IP Services for OpenVMS POP server</description>
|
|
230
|
-
<example os.version="7.3-2" host.name="example.com">TCPIP POP server V5.4J-15A, OpenVMS V7.3-2 Alpha at example.com, up since 2015-02-12 08:44:53 20400434.2</example>
|
|
231
|
-
<!--V5.4J-15A refers to TCP/IP Services for OpenVMS version-->
|
|
232
|
-
<param pos="0" name="service.family" value="OpenVMS"/>
|
|
233
|
-
<param pos="0" name="service.product" value="TCPIP POP server"/>
|
|
234
|
-
<param pos="0" name="service.vendor" value="HP"/>
|
|
235
|
-
<param pos="0" name="os.vendor" value="HP"/>
|
|
236
|
-
<param pos="0" name="os.family" value="OpenVMS"/>
|
|
237
|
-
<param pos="0" name="os.product" value="OpenVMS"/>
|
|
238
|
-
<param pos="0" name="os.device" value="General"/>
|
|
239
|
-
<param pos="1" name="os.version"/>
|
|
240
|
-
<param pos="2" name="host.name"/>
|
|
241
|
-
</fingerprint>
|
|
242
|
-
|
|
243
|
-
<fingerprint pattern="^Hello there\.$">
|
|
244
|
-
<example>Hello there.</example>
|
|
245
|
-
<description>Courier MTA POP</description>
|
|
246
|
-
<param pos="0" name="service.vendor" value="Double Precision"/>
|
|
247
|
-
<param pos="0" name="service.family" value="Courier MTA"/>
|
|
248
|
-
<param pos="0" name="service.product" value="Courier POP"/>
|
|
249
|
-
</fingerprint>
|
|
250
|
-
|
|
251
|
-
<!--
|
|
7
|
+
<fingerprint pattern="^([^ ]+) +Cyrus POP3 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready">
|
|
8
|
+
<description>OSX Cyrus POP</description>
|
|
9
|
+
<example host.domain="8.8.8.8" service.version="2.3.8" os.version="10.5">8.8.8.8 Cyrus POP3 v2.3.8-OS X Server 10.5: 9A562 server ready <1999107648.1324502155@8.8.8.8></example>
|
|
10
|
+
<param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
|
|
11
|
+
<param pos="0" name="service.family" value="Cyrus MTA"/>
|
|
12
|
+
<param pos="0" name="service.product" value="Cyrus POP"/>
|
|
13
|
+
<param pos="2" name="service.version"/>
|
|
14
|
+
<param pos="0" name="os.vendor" value="Apple"/>
|
|
15
|
+
<param pos="0" name="os.family" value="Mac OS X"/>
|
|
16
|
+
<param pos="0" name="os.product" value="Mac OS X"/>
|
|
17
|
+
<param pos="0" name="os.device" value="General"/>
|
|
18
|
+
<param pos="3" name="os.version"/>
|
|
19
|
+
<param pos="1" name="host.domain"/>
|
|
20
|
+
</fingerprint>
|
|
21
|
+
<fingerprint pattern="^([^ ]+) +Cyrus POP3 v([\d\.]+)">
|
|
22
|
+
<description>CMU Cyrus POP</description>
|
|
23
|
+
<example host.domain="foo" service.version="2.3">foo Cyrus POP3 v2.3</example>
|
|
24
|
+
<example host.domain="foo" service.version="2.3.14">foo Cyrus POP3 v2.3.14 server ready <13087751828270990591.1301068892@foo></example>
|
|
25
|
+
<param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
|
|
26
|
+
<param pos="0" name="service.family" value="Cyrus MTA"/>
|
|
27
|
+
<param pos="0" name="service.product" value="Cyrus POP"/>
|
|
28
|
+
<param pos="2" name="service.version"/>
|
|
29
|
+
<param pos="1" name="host.domain"/>
|
|
30
|
+
</fingerprint>
|
|
31
|
+
<fingerprint pattern="^Lotus Notes POP3 server version X[^ ]+ ready on .*$">
|
|
32
|
+
<description>IBM Lotus Notes/Domino</description>
|
|
33
|
+
<example>Lotus Notes POP3 server version X2.0 ready on foo/bar.</example>
|
|
34
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
35
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
36
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
37
|
+
</fingerprint>
|
|
38
|
+
<fingerprint pattern="^Lotus Notes POP3 server version Release ([^ ]+) ready on .*$">
|
|
39
|
+
<description>IBM Lotus Notes/Domino</description>
|
|
40
|
+
<example>Lotus Notes POP3 server version Release 8.5.1FP5 ready on foo/US.</example>
|
|
41
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
42
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
43
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
44
|
+
<param pos="1" name="service.version"/>
|
|
45
|
+
</fingerprint>
|
|
46
|
+
<fingerprint pattern="^Qpopper \(version (\d+\.\d+\.\d+), modified by Sphera Technologies\) at (.+) starting\..*$">
|
|
47
|
+
<description>Qpopper with Sphera mods</description>
|
|
48
|
+
<example>Qpopper (version 4.0.3, modified by Sphera Technologies) at domain starting. <xxx@domain></example>
|
|
49
|
+
<param pos="0" name="service.vendor" value="Sphera"/>
|
|
50
|
+
<param pos="0" name="service.family" value="Qpopper"/>
|
|
51
|
+
<param pos="0" name="service.product" value="Qpopper"/>
|
|
52
|
+
<param pos="1" name="service.version"/>
|
|
53
|
+
<param pos="2" name="host.domain"/>
|
|
54
|
+
</fingerprint>
|
|
55
|
+
<fingerprint pattern="^Qpopper \(version (\d+\.\d+\.\d+)-mysql-(.+)\) at (.+) starting\..*$">
|
|
56
|
+
<description>Qpopper with MySQL auth module</description>
|
|
57
|
+
<example>Qpopper (version 4.0.3-mysql-0.13) at domain starting. <xxx@domain></example>
|
|
58
|
+
<param pos="0" name="service.vendor" value="Qualcomm"/>
|
|
59
|
+
<param pos="0" name="service.family" value="Qpopper"/>
|
|
60
|
+
<param pos="0" name="service.product" value="Qpopper"/>
|
|
61
|
+
<param pos="1" name="service.version"/>
|
|
62
|
+
<param pos="0" name="service.component.family" value="qpopper-mysql"/>
|
|
63
|
+
<param pos="0" name="service.component.product" value="qpopper-mysql"/>
|
|
64
|
+
<param pos="2" name="service.component.version"/>
|
|
65
|
+
<param pos="3" name="host.domain"/>
|
|
66
|
+
</fingerprint>
|
|
67
|
+
<fingerprint pattern="^Qpop(?:per)? \(version ([\d\.]+)\) at (.+)(?: starting\.)?.*$" flags="REG_ICASE">
|
|
68
|
+
<description>Qpopper missing version info</description>
|
|
69
|
+
<example>Qpopper (version 4.0.16) at foo.example.com</example>
|
|
70
|
+
<example>QPOP (version 2.53) at domain starting. <xxx@domain></example>
|
|
71
|
+
<example>Qpopper (version 4.0.3) at domain starting. <xxx@domain></example>
|
|
72
|
+
<param pos="0" name="service.vendor" value="Qualcomm"/>
|
|
73
|
+
<param pos="0" name="service.family" value="Qpopper"/>
|
|
74
|
+
<param pos="0" name="service.product" value="Qpopper"/>
|
|
75
|
+
<param pos="1" name="service.version"/>
|
|
76
|
+
<param pos="2" name="host.domain"/>
|
|
77
|
+
</fingerprint>
|
|
78
|
+
<fingerprint pattern="^QPOP \(version (.*)\) at (.+) starting\..*$">
|
|
79
|
+
<description>Qpopper with missing version info</description>
|
|
80
|
+
<example>QPOP (version ?) at domain starting. <xxx@domain></example>
|
|
81
|
+
<param pos="0" name="service.vendor" value="Qualcomm"/>
|
|
82
|
+
<param pos="0" name="service.family" value="Qpopper"/>
|
|
83
|
+
<param pos="0" name="service.product" value="Qpopper"/>
|
|
84
|
+
<param pos="1" name="qpopper.version"/>
|
|
85
|
+
<param pos="2" name="host.domain"/>
|
|
86
|
+
</fingerprint>
|
|
87
|
+
<fingerprint pattern="^Microsoft Exchange Server 2003 POP3 server version (\d+\.\d+\.\d+\.\d+) (.+) ready.$">
|
|
88
|
+
<description>Microsoft Exchange Server 2003</description>
|
|
89
|
+
<example>Microsoft Exchange Server 2003 POP3 server version 6.5.6944.0 (host) ready.</example>
|
|
90
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
91
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
92
|
+
<param pos="0" name="service.product" value="Exchange 2003 Server"/>
|
|
93
|
+
<param pos="1" name="service.version"/>
|
|
94
|
+
<param pos="2" name="host.name"/>
|
|
95
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
96
|
+
<param pos="0" name="os.device" value="General"/>
|
|
97
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
98
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
99
|
+
</fingerprint>
|
|
100
|
+
<fingerprint pattern="^Microsoft Exchange 2000 POP3 server version (\d+\.\d+\.\d+\.\d+) (.+) ready.$">
|
|
101
|
+
<description>Microsoft Exchange Server 2000</description>
|
|
102
|
+
<example>Microsoft Exchange 2000 POP3 server version 6.0.6603.0 (host) ready.</example>
|
|
103
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
104
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
105
|
+
<param pos="0" name="service.product" value="Exchange 2000 Server"/>
|
|
106
|
+
<param pos="1" name="service.version"/>
|
|
107
|
+
<param pos="2" name="host.name"/>
|
|
108
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
109
|
+
<param pos="0" name="os.device" value="General"/>
|
|
110
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
111
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
112
|
+
</fingerprint>
|
|
113
|
+
<fingerprint pattern="^Microsoft Exchange POP3 server version (\d+\.\d+\.\d+\.\d+) ready$">
|
|
114
|
+
<description>Microsoft Exchange Server</description>
|
|
115
|
+
<example>Microsoft Exchange POP3 server version 5.5.2654.50 ready</example>
|
|
116
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
117
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
118
|
+
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
119
|
+
<param pos="1" name="service.version"/>
|
|
120
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
121
|
+
<param pos="0" name="os.device" value="General"/>
|
|
122
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
123
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
124
|
+
</fingerprint>
|
|
125
|
+
<fingerprint pattern="^Microsoft Windows POP3 Service Version 1.0 <.+@(.+)> ready.$">
|
|
126
|
+
<description>Microsoft POP3 Services on Windows 2003</description>
|
|
127
|
+
<example>Microsoft Windows POP3 Service Version 1.0 <xxx@host> ready.</example>
|
|
128
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
129
|
+
<param pos="0" name="service.family" value="E-mail Services"/>
|
|
130
|
+
<param pos="0" name="service.product" value="E-mail Services"/>
|
|
131
|
+
<param pos="1" name="host.name"/>
|
|
132
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
133
|
+
<param pos="0" name="os.device" value="General"/>
|
|
134
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
135
|
+
<param pos="0" name="os.product" value="Windows Server 2003"/>
|
|
136
|
+
</fingerprint>
|
|
137
|
+
<fingerprint pattern="^Microsoft Exchange Server 2007 POP3 service ready\.?$">
|
|
138
|
+
<description>Microsoft Exchange Server 2007</description>
|
|
139
|
+
<example>Microsoft Exchange Server 2007 POP3 service ready</example>
|
|
140
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
141
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
142
|
+
<param pos="0" name="service.product" value="Exchange 2007 Server"/>
|
|
143
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
144
|
+
<param pos="0" name="os.device" value="General"/>
|
|
145
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
146
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
147
|
+
</fingerprint>
|
|
148
|
+
<fingerprint pattern="^The? Microsoft Exchange POP3 service is ready\.?$">
|
|
149
|
+
<description>Microsoft Exchange Server, generic</description>
|
|
150
|
+
<example>The Microsoft Exchange POP3 service is ready.</example>
|
|
151
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
152
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
153
|
+
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
154
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
155
|
+
<param pos="0" name="os.device" value="General"/>
|
|
156
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
157
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
158
|
+
</fingerprint>
|
|
159
|
+
<fingerprint pattern="^[dD]ovecot (?:DA )?ready\.(?: <.+@(.+)>)?$">
|
|
160
|
+
<description>Dovecot Secure POP Server</description>
|
|
161
|
+
<param pos="0" name="service.family" value="Dovecot"/>
|
|
162
|
+
<param pos="0" name="service.product" value="Dovecot"/>
|
|
163
|
+
<param pos="1" name="host.name"/>
|
|
164
|
+
</fingerprint>
|
|
165
|
+
<fingerprint pattern="^(\S+) Zimbra POP3 server ready\.?$">
|
|
166
|
+
<description>VMware Zimbra POP</description>
|
|
167
|
+
<example>catfood.example.com Zimbra POP3 server ready</example>
|
|
168
|
+
<example>dogfood.example.com Zimbra POP3 server ready</example>
|
|
169
|
+
<param pos="0" name="service.vendor" value="VMware"/>
|
|
170
|
+
<param pos="0" name="service.product" value="Zimbra"/>
|
|
171
|
+
<param pos="1" name="host.name"/>
|
|
172
|
+
</fingerprint>
|
|
173
|
+
<fingerprint pattern="^(\S+) Zimbra (\S+) POP3 server ready\.?$">
|
|
174
|
+
<description>VMware Zimbra POP</description>
|
|
175
|
+
<example>example.com Zimbra 7.0.0_GA_3079 POP3 server ready</example>
|
|
176
|
+
<param pos="0" name="service.vendor" value="VMware"/>
|
|
177
|
+
<param pos="0" name="service.product" value="Zimbra"/>
|
|
178
|
+
<param pos="2" name="service.version"/>
|
|
179
|
+
<param pos="1" name="host.name"/>
|
|
180
|
+
</fingerprint>
|
|
181
|
+
<fingerprint pattern="^(?:S?POP3? server ready |Hello there.? )?<.*@([^>]+)>$">
|
|
182
|
+
<description>Generic masked POP3 server</description>
|
|
183
|
+
<example>POP3 server ready <58c29ae4-7316-429e-8109-060444ab1a28@foo.example.com></example>
|
|
184
|
+
<example><84427.1298535083@foo.example.com></example>
|
|
185
|
+
<param pos="1" name="host.name"/>
|
|
186
|
+
</fingerprint>
|
|
187
|
+
<fingerprint pattern="^ApplePasswordServer ([\d\.]+) password">
|
|
188
|
+
<description>Apple Open Directory</description>
|
|
189
|
+
<example>ApplePasswordServer 10.6.0.0 password server at 10.2.90.228 ready.</example>
|
|
190
|
+
<example>ApplePasswordServer 10.5.0.1 password serv</example>
|
|
191
|
+
<param pos="0" name="service.vendor" value="Apple"/>
|
|
192
|
+
<param pos="0" name="service.product" value="Open Directory"/>
|
|
193
|
+
<param pos="0" name="os.vendor" value="Apple"/>
|
|
194
|
+
<param pos="0" name="os.family" value="Mac OS X"/>
|
|
195
|
+
<param pos="0" name="os.product" value="Mac OS X"/>
|
|
196
|
+
<param pos="1" name="os.version"/>
|
|
197
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
198
|
+
</fingerprint>
|
|
199
|
+
<fingerprint pattern="^TCPIP POP server V\d\.\d\S-\S{3}, OpenVMS V(\d\.\d-\d)(?:\s+\S+)?\s+at\s+(\S+), .*$">
|
|
200
|
+
<description>TCP/IP Services for OpenVMS POP server</description>
|
|
201
|
+
<example os.version="7.3-2" host.name="example.com">TCPIP POP server V5.4J-15A, OpenVMS V7.3-2 Alpha at example.com, up since 2015-02-12 08:44:53 20400434.2</example>
|
|
202
|
+
<param pos="0" name="service.family" value="OpenVMS"/>
|
|
203
|
+
<param pos="0" name="service.product" value="TCPIP POP server"/>
|
|
204
|
+
<param pos="0" name="service.vendor" value="HP"/>
|
|
205
|
+
<param pos="0" name="os.vendor" value="HP"/>
|
|
206
|
+
<param pos="0" name="os.family" value="OpenVMS"/>
|
|
207
|
+
<param pos="0" name="os.product" value="OpenVMS"/>
|
|
208
|
+
<param pos="0" name="os.device" value="General"/>
|
|
209
|
+
<param pos="1" name="os.version"/>
|
|
210
|
+
<param pos="2" name="host.name"/>
|
|
211
|
+
</fingerprint>
|
|
212
|
+
<fingerprint pattern="^Hello there\.$">
|
|
213
|
+
<description>Courier MTA POP</description>
|
|
214
|
+
<example>Hello there.</example>
|
|
215
|
+
<param pos="0" name="service.vendor" value="Double Precision"/>
|
|
216
|
+
<param pos="0" name="service.family" value="Courier MTA"/>
|
|
217
|
+
<param pos="0" name="service.product" value="Courier POP"/>
|
|
218
|
+
</fingerprint>
|
|
219
|
+
<!--
|
|
252
220
|
|
|
253
221
|
; Mandrake 8.1 - uses UW IMAP
|
|
254
222
|
; +OK POP3 mandrake81-f540k v2000.70mdk server ready
|
|
@@ -471,5 +439,4 @@ matched against these patterns to fingerprint POP3 servers.
|
|
|
471
439
|
Oops, that would loop!
|
|
472
440
|
|
|
473
441
|
-->
|
|
474
|
-
|
|
475
442
|
</fingerprints>
|