recog 2.0.13 → 2.0.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (52) hide show
  1. checksums.yaml +4 -4
  2. data/CONTRIBUTING.md +19 -6
  3. data/features/{xml → data}/failing_banners_fingerprints.xml +0 -0
  4. data/features/{xml → data}/matching_banners_fingerprints.xml +0 -0
  5. data/features/{xml → data}/no_tests.xml +0 -0
  6. data/features/{xml/banners.xml → data/sample_banner.txt} +0 -0
  7. data/features/{xml → data}/successful_tests.xml +0 -0
  8. data/features/{xml → data}/tests_with_failures.xml +0 -0
  9. data/features/{xml → data}/tests_with_warnings.xml +0 -0
  10. data/features/match.feature +2 -2
  11. data/features/support/env.rb +1 -1
  12. data/lib/recog/version.rb +1 -1
  13. data/misc/order.xsl +17 -0
  14. data/spec/lib/fingerprint_self_test_spec.rb +8 -0
  15. data/xml/apache_os.xml +270 -334
  16. data/xml/architecture.xml +28 -41
  17. data/xml/fingerprints.xsd +37 -0
  18. data/xml/ftp_banners.xml +52 -58
  19. data/xml/h323_callresp.xml +597 -695
  20. data/xml/hp_pjl_id.xml +370 -409
  21. data/xml/http_cookies.xml +304 -348
  22. data/xml/http_servers.xml +3202 -3483
  23. data/xml/http_wwwauth.xml +342 -409
  24. data/xml/imap_banners.xml +149 -190
  25. data/xml/mdns_device-info_txt.xml +97 -111
  26. data/xml/mdns_workstation_txt.xml +6 -6
  27. data/xml/mysql_banners.xml +99 -198
  28. data/xml/mysql_error.xml +4 -11
  29. data/xml/nntp_banners.xml +42 -45
  30. data/xml/ntp_banners.xml +2 -3
  31. data/xml/pop_banners.xml +214 -247
  32. data/xml/rsh_resp.xml +68 -76
  33. data/xml/sip_banners.xml +19 -19
  34. data/xml/sip_user_agents.xml +63 -74
  35. data/xml/smb_native_os.xml +387 -433
  36. data/xml/smtp_banners.xml +1318 -1460
  37. data/xml/smtp_debug.xml +24 -27
  38. data/xml/smtp_ehlo.xml +19 -22
  39. data/xml/smtp_expn.xml +61 -70
  40. data/xml/smtp_help.xml +139 -160
  41. data/xml/smtp_mailfrom.xml +14 -16
  42. data/xml/smtp_noop.xml +28 -31
  43. data/xml/smtp_quit.xml +16 -18
  44. data/xml/smtp_rcptto.xml +8 -10
  45. data/xml/smtp_rset.xml +12 -13
  46. data/xml/smtp_turn.xml +12 -13
  47. data/xml/smtp_vrfy.xml +66 -76
  48. data/xml/snmp_sysdescr.xml +7257 -8016
  49. data/xml/snmp_sysobjid.xml +392 -434
  50. data/xml/ssh_banners.xml +783 -867
  51. data/xml/upnp_banners.xml +594 -628
  52. metadata +11 -9
data/xml/architecture.xml CHANGED
@@ -1,45 +1,32 @@
1
- <?xml version="1.0"?>
2
-
1
+ <?xml version="1.0" encoding="UTF-8"?>
3
2
  <!--
4
3
  Generic rules for matching a machine architecture, platform, or chipset
5
4
  -->
6
-
7
5
  <fingerprints matches="architecture">
8
-
9
- <fingerprint pattern="x64|amd64|x86_64" flags="REG_ICASE">
10
- <description>x64 (x86_x64)</description>
11
- <example>Linux claw 3.11.0-15-generic #23-Ubuntu SMP Mon Dec 9 18:17:04 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux</example>
12
- <param pos="0" name="os.arch" value="x64"/>
13
- </fingerprint>
14
-
15
- <fingerprint pattern="x86|i[3456]86" flags="REG_ICASE">
16
- <description>x86</description>
17
- <example>Linux bob 3.2.0-1-generic #3-Ubuntu SMP Wed Dec 11 19:12:55 UTC 2013 i686 i686 i686 GNU/Linux</example>
18
- <param pos="0" name="os.arch" value="x86"/>
19
- </fingerprint>
20
-
21
- <fingerprint pattern="PowerPC|PPC|POWER|ppc">
22
- <description>PowerPC</description>
23
- <!-- XXX: Need an example -->
24
- <param pos="0" name="os.arch" value="ppc"/>
25
- </fingerprint>
26
-
27
- <fingerprint pattern="SPARC" flags="REG_ICASE">
28
- <description>SPARC</description>
29
- <!-- XXX: Need an example -->
30
- <param pos="0" name="os.arch" value="sparc"/>
31
- </fingerprint>
32
-
33
- <fingerprint pattern="mips" flags="REG_ICASE">
34
- <description>MIPS</description>
35
- <!-- XXX: Need an example -->
36
- <param pos="0" name="os.arch" value="mips"/>
37
- </fingerprint>
38
-
39
- <fingerprint pattern="arm" flags="REG_ICASE">
40
- <description>ARM</description>
41
- <!-- XXX: Need an example -->
42
- <param pos="0" name="os.arch" value="arm"/>
43
- </fingerprint>
44
-
45
- </fingerprints>
6
+ <fingerprint pattern="x64|amd64|x86_64" flags="REG_ICASE">
7
+ <description>x64 (x86_x64)</description>
8
+ <example>Linux claw 3.11.0-15-generic #23-Ubuntu SMP Mon Dec 9 18:17:04 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux</example>
9
+ <param pos="0" name="os.arch" value="x64"/>
10
+ </fingerprint>
11
+ <fingerprint pattern="x86|i[3456]86" flags="REG_ICASE">
12
+ <description>x86</description>
13
+ <example>Linux bob 3.2.0-1-generic #3-Ubuntu SMP Wed Dec 11 19:12:55 UTC 2013 i686 i686 i686 GNU/Linux</example>
14
+ <param pos="0" name="os.arch" value="x86"/>
15
+ </fingerprint>
16
+ <fingerprint pattern="PowerPC|PPC|POWER|ppc">
17
+ <description>PowerPC</description>
18
+ <param pos="0" name="os.arch" value="ppc"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="SPARC" flags="REG_ICASE">
21
+ <description>SPARC</description>
22
+ <param pos="0" name="os.arch" value="sparc"/>
23
+ </fingerprint>
24
+ <fingerprint pattern="mips" flags="REG_ICASE">
25
+ <description>MIPS</description>
26
+ <param pos="0" name="os.arch" value="mips"/>
27
+ </fingerprint>
28
+ <fingerprint pattern="arm" flags="REG_ICASE">
29
+ <description>ARM</description>
30
+ <param pos="0" name="os.arch" value="arm"/>
31
+ </fingerprint>
32
+ </fingerprints>
data/xml/fingerprints.xsd ADDED
@@ -0,0 +1,37 @@
1
+ <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema">
2
+
3
+ <xsd:element name="fingerprints" type="fingerprints_element"/>
4
+
5
+ <xsd:complexType name="fingerprints_element">
6
+ <xsd:sequence>
7
+ <xsd:element name="fingerprint" type="fingerprint_element" minOccurs="1" maxOccurs="unbounded"/>
8
+ </xsd:sequence>
9
+ <xsd:attribute name="matches" type="xsd:string" use="optional"/>
10
+ </xsd:complexType>
11
+
12
+ <xsd:complexType name="fingerprint_element" mixed="true">
13
+ <xsd:sequence>
14
+ <xsd:element name="description" type="xsd:string" minOccurs="1" maxOccurs="1"/>
15
+ <xsd:element name="example" type="example_element" minOccurs="0" maxOccurs="unbounded"/>
16
+ <xsd:element name="param" type="param_element" minOccurs="0" maxOccurs="unbounded"/>
17
+ </xsd:sequence>
18
+ <xsd:attribute name="certainty" type="xsd:string" use="optional"/>
19
+ <xsd:attribute name="pattern" type="xsd:string" use="required"/>
20
+ <xsd:attribute name="flags" type="xsd:string" use="optional"/>
21
+ </xsd:complexType>
22
+
23
+ <xsd:complexType name="example_element">
24
+ <xsd:simpleContent>
25
+ <xsd:extension base="xsd:string">
26
+ <xsd:anyAttribute processContents="skip"/>
27
+ </xsd:extension>
28
+ </xsd:simpleContent>
29
+ </xsd:complexType>
30
+
31
+ <xsd:complexType name="param_element">
32
+ <xsd:attribute name="name" type="xsd:string" use="required"/>
33
+ <xsd:attribute name="pos" type="xsd:integer" use="required"/>
34
+ <xsd:attribute name="value" type="xsd:string" use="optional"/>
35
+ </xsd:complexType>
36
+
37
+ </xsd:schema>
data/xml/ftp_banners.xml CHANGED
@@ -1,12 +1,12 @@
1
- <?xml version="1.0"?>
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
2
  <!--
3
3
  FTP greeting messages (part of the banner after the response code) are matched
4
4
  against these patterns to fingerprint FTP servers.
5
5
  -->
6
6
  <fingerprints matches="ftp.banner">
7
7
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version ([1234]\.\d+)\)\.$">
8
- <example>xx Microsoft FTP Service (Version 3.0).</example>
9
8
  <description>Microsoft FTP Server on Windows NT</description>
9
+ <example>xx Microsoft FTP Service (Version 3.0).</example>
10
10
  <param pos="0" name="service.vendor" value="Microsoft"/>
11
11
  <param pos="0" name="service.product" value="IIS"/>
12
12
  <param pos="0" name="service.family" value="IIS"/>
@@ -18,8 +18,8 @@ against these patterns to fingerprint FTP servers.
18
18
  <param pos="1" name="host.name"/>
19
19
  </fingerprint>
20
20
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.0\)\.$">
21
- <example>xxx Microsoft FTP Service (Version 5.0).</example>
22
21
  <description>Microsoft FTP Server on Windows 2000</description>
22
+ <example>xxx Microsoft FTP Service (Version 5.0).</example>
23
23
  <param pos="0" name="service.vendor" value="Microsoft"/>
24
24
  <param pos="0" name="service.product" value="IIS"/>
25
25
  <param pos="0" name="service.family" value="IIS"/>
@@ -31,8 +31,8 @@ against these patterns to fingerprint FTP servers.
31
31
  <param pos="1" name="host.name"/>
32
32
  </fingerprint>
33
33
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.1\)\.$">
34
- <example>xxx Microsoft FTP Service (Version 5.1).</example>
35
34
  <description>Microsoft FTP Server on Windows XP, 2003 or later versions of 2000</description>
35
+ <example>xxx Microsoft FTP Service (Version 5.1).</example>
36
36
  <param pos="0" name="service.vendor" value="Microsoft"/>
37
37
  <param pos="0" name="service.product" value="IIS"/>
38
38
  <param pos="0" name="service.family" value="IIS"/>
@@ -43,8 +43,8 @@ against these patterns to fingerprint FTP servers.
43
43
  <param pos="1" name="host.name"/>
44
44
  </fingerprint>
45
45
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service$">
46
- <example>hostname Microsoft FTP Service</example>
47
46
  <description>Microsoft FTP Server on Windows XP, 2003 or later without version</description>
47
+ <example>hostname Microsoft FTP Service</example>
48
48
  <param pos="0" name="service.vendor" value="Microsoft"/>
49
49
  <param pos="0" name="service.product" value="IIS"/>
50
50
  <param pos="0" name="service.family" value="IIS"/>
@@ -55,8 +55,8 @@ against these patterns to fingerprint FTP servers.
55
55
  <param pos="1" name="host.name"/>
56
56
  </fingerprint>
57
57
  <fingerprint pattern="^Microsoft FTP Service$">
58
- <example>Microsoft FTP Service</example>
59
58
  <description>Microsoft FTP Server on Windows XP, 2003 or later without version or hostname</description>
59
+ <example>Microsoft FTP Service</example>
60
60
  <param pos="0" name="service.vendor" value="Microsoft"/>
61
61
  <param pos="0" name="service.product" value="IIS"/>
62
62
  <param pos="0" name="service.family" value="IIS"/>
@@ -107,7 +107,8 @@ against these patterns to fingerprint FTP servers.
107
107
  <fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\s+([\d\.]+).*\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
108
108
  <description>FTPD on Mac OS X Server with a version</description>
109
109
  <example host.name="example.com" os.version="10.3">example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
110
- <example host.name="example.com" os.version="10.3">this is a banner. change it.&#13;&#10;example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
110
+ <example host.name="example.com" os.version="10.3">this is a banner. change it.&#13;
111
+ example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
111
112
  <param pos="0" name="service.vendor" value="Apple"/>
112
113
  <param pos="0" name="service.product" value="FTP"/>
113
114
  <param pos="0" name="os.vendor" value="Apple"/>
@@ -120,7 +121,8 @@ against these patterns to fingerprint FTP servers.
120
121
  <fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
121
122
  <description>FTPD on Mac OS X Server without a version</description>
122
123
  <example host.name="example.com">example.com FTP server (Version: Mac OS X Server) ready.</example>
123
- <example host.name="example.com">this is a banner. change it.&#13;&#10;example.com FTP server (Version: Mac OS X Server) ready.</example>
124
+ <example host.name="example.com">this is a banner. change it.&#13;
125
+ example.com FTP server (Version: Mac OS X Server) ready.</example>
124
126
  <param pos="0" name="service.vendor" value="Apple"/>
125
127
  <param pos="0" name="service.product" value="FTP"/>
126
128
  <param pos="0" name="os.vendor" value="Apple"/>
@@ -147,8 +149,8 @@ against these patterns to fingerprint FTP servers.
147
149
  <param pos="2" name="os.version"/>
148
150
  </fingerprint>
149
151
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Debian\) \[(.+)\]$">
150
- <example>ProFTPD 1.3.0rc2 Server (Debian) [host]</example>
151
152
  <description>ProFTPD on Debian Linux</description>
153
+ <example>ProFTPD 1.3.0rc2 Server (Debian) [host]</example>
152
154
  <param pos="0" name="service.family" value="ProFTPD"/>
153
155
  <param pos="0" name="service.product" value="ProFTPD"/>
154
156
  <param pos="1" name="service.version"/>
@@ -159,8 +161,8 @@ against these patterns to fingerprint FTP servers.
159
161
  <param pos="2" name="host.name"/>
160
162
  </fingerprint>
161
163
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(W.+)\) \[(.+)\]$">
162
- <example>ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
163
164
  <description>ProFTPD on a Linksys Wireless Access Point/Router</description>
165
+ <example>ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
164
166
  <param pos="0" name="service.family" value="ProFTPD"/>
165
167
  <param pos="0" name="service.product" value="ProFTPD"/>
166
168
  <param pos="1" name="service.version"/>
@@ -170,7 +172,6 @@ against these patterns to fingerprint FTP servers.
170
172
  <param pos="3" name="host.name"/>
171
173
  </fingerprint>
172
174
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(.*)\) \[(.+)\]$">
173
- <!-- TODO: find a greeting message example -->
174
175
  <description>ProFTPD on a wired Linksys device</description>
175
176
  <param pos="0" name="service.family" value="ProFTPD"/>
176
177
  <param pos="0" name="service.product" value="ProFTPD"/>
@@ -181,10 +182,10 @@ against these patterns to fingerprint FTP servers.
181
182
  <param pos="3" name="host.name"/>
182
183
  </fingerprint>
183
184
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[(.+)\]$">
185
+ <description>ProFTPD with version info but no obvious OS info</description>
184
186
  <example>ProFTPD 1.2.10 Server (Main FTP Server) [host]</example>
185
187
  <example>ProFTPD 1.2.10 Server (ProFTPD) [host]</example>
186
188
  <example>ProFTPD 1.2.10rc3 Server (ProFTPD Default Installation) [host]</example>
187
- <description>ProFTPD with version info but no obvious OS info</description>
188
189
  <param pos="0" name="service.family" value="ProFTPD"/>
189
190
  <param pos="0" name="service.product" value="ProFTPD"/>
190
191
  <param pos="1" name="service.version"/>
@@ -192,52 +193,53 @@ against these patterns to fingerprint FTP servers.
192
193
  <param pos="3" name="host.name"/>
193
194
  </fingerprint>
194
195
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server ready\.$">
195
- <example>ProFTPD 1.3.0rc2 Server ready.</example>
196
196
  <description>ProFTPD with only version info</description>
197
+ <example>ProFTPD 1.3.0rc2 Server ready.</example>
197
198
  <param pos="0" name="service.family" value="ProFTPD"/>
198
199
  <param pos="0" name="service.product" value="ProFTPD"/>
199
200
  <param pos="1" name="service.version"/>
200
201
  </fingerprint>
201
202
  <fingerprint pattern="^ProFTPD FTP Server ready\.$">
202
- <example>ProFTPD FTP Server ready.</example>
203
203
  <description>ProFTPD with no version info</description>
204
+ <example>ProFTPD FTP Server ready.</example>
204
205
  <param pos="0" name="service.family" value="ProFTPD"/>
205
206
  <param pos="0" name="service.product" value="ProFTPD"/>
206
207
  </fingerprint>
207
208
  <fingerprint pattern="^=\(&lt;\*&gt;\)=-\.:\. \(\( Welcome to Pure-FTPd ([\d.]+) \)\) \.:\.-=\(&lt;\*&gt;\)=-" flags="REG_MULTILINE">
208
- <!-- yes, the leading and trailing text is not balanced.
209
- the leading text is missing the - at the beginning -->
210
- <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-</example>
211
- <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-&#13;&#10;more stuff</example>
212
209
  <description>Pure-FTPd versions &lt;= 1.0.13 (at least as far back as 1.0.11)</description>
210
+ <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-</example>
211
+ <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-&#13;
212
+ more stuff</example>
213
213
  <param pos="0" name="service.family" value="Pure-FTPd"/>
214
214
  <param pos="0" name="service.product" value="Pure-FTPd"/>
215
215
  <param pos="1" name="service.version"/>
216
216
  </fingerprint>
217
217
  <fingerprint pattern="^-{9,10} Welcome to Pure-FTPd (.*)-{9,10}" flags="REG_MULTILINE">
218
- <example>---------- Welcome to Pure-FTPd ----------</example>
219
- <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------</example>
220
- <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;&#10;more text</example>
221
- <description>Pure-FTPd versions >= 1.0.14
218
+ <description>Pure-FTPd versions &gt;= 1.0.14
222
219
  Config data can be zero or more of: [privsep] [TLS]
223
220
  </description>
221
+ <example>---------- Welcome to Pure-FTPd ----------</example>
222
+ <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------</example>
223
+ <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;
224
+ more text</example>
224
225
  <param pos="1" name="pureftpd.config"/>
225
226
  <param pos="0" name="service.family" value="Pure-FTPd"/>
226
227
  <param pos="0" name="service.product" value="Pure-FTPd"/>
227
228
  </fingerprint>
228
229
  <fingerprint pattern="^=\(.\*.\)=-\.:\. \(\( Welcome to PureFTPd (\d+\..+) \)\) \.:\.-=\(.\*.\)=-" flags="REG_MULTILINE">
229
- <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-</example>
230
- <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-&#13;&#10;more text</example>
231
230
  <description>Older Pure-FTPd versions</description>
231
+ <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-</example>
232
+ <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-&#13;
233
+ more text</example>
232
234
  <param pos="0" name="service.family" value="Pure-FTPd"/>
233
235
  <param pos="0" name="service.product" value="Pure-FTPd"/>
234
236
  <param pos="1" name="service.version"/>
235
237
  </fingerprint>
236
238
  <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\..+)(?: for WinSock)? ready\.*$">
239
+ <description>Serv-U (only runs on Windows)</description>
237
240
  <example>Serv-U FTP-Server v2.5n for WinSock ready...</example>
238
241
  <example>Serv-U FTP Server v6.0 for WinSock ready</example>
239
242
  <example>Serv-U FTP Server v7.2 ready...</example>
240
- <description>Serv-U (only runs on Windows)</description>
241
243
  <param pos="0" name="service.vendor" value="Rhino Software"/>
242
244
  <param pos="0" name="service.product" value="Serv-U"/>
243
245
  <param pos="0" name="service.family" value="Serv-U"/>
@@ -248,8 +250,8 @@ against these patterns to fingerprint FTP servers.
248
250
  <param pos="0" name="os.product" value="Windows"/>
249
251
  </fingerprint>
250
252
  <fingerprint pattern="^zFTPServer v?(\S+), .*ready\.$" flags="REG_ICASE">
251
- <example>zFTPServer v4.0, build 2008-12-24 01:41 ready.</example>
252
253
  <description>zftpserver (only runs on Windows)</description>
254
+ <example>zFTPServer v4.0, build 2008-12-24 01:41 ready.</example>
253
255
  <param pos="0" name="service.product" value="zFTPServer"/>
254
256
  <param pos="1" name="service.version"/>
255
257
  <param pos="0" name="os.vendor" value="Microsoft"/>
@@ -258,41 +260,41 @@ against these patterns to fingerprint FTP servers.
258
260
  <param pos="0" name="os.product" value="Windows"/>
259
261
  </fingerprint>
260
262
  <fingerprint pattern="^\(vsFTPd (\d+\..+)\)(?: (.+))?$">
263
+ <description>vsFTPd (Very Secure FTP Daemon)</description>
261
264
  <example>(vsFTPd 1.1.3) host</example>
262
265
  <example>(vsFTPd 2.0.5)</example>
263
- <description>vsFTPd (Very Secure FTP Daemon)</description>
264
266
  <param pos="0" name="service.family" value="vsFTPd"/>
265
267
  <param pos="0" name="service.product" value="vsFTPd"/>
266
268
  <param pos="1" name="service.version"/>
267
269
  <param pos="2" name="host.name"/>
268
270
  </fingerprint>
269
271
  <fingerprint pattern="^ready, dude \(vsFTPd (\d+\..+): beat me, break me\)$">
270
- <example>ready, dude (vsFTPd 1.1.0: beat me, break me)</example>
271
272
  <description>vsFTPd (Very Secure FTP Daemon)</description>
273
+ <example>ready, dude (vsFTPd 1.1.0: beat me, break me)</example>
272
274
  <param pos="0" name="service.family" value="vsFTPd"/>
273
275
  <param pos="0" name="service.product" value="vsFTPd"/>
274
276
  <param pos="1" name="service.version"/>
275
277
  </fingerprint>
276
278
  <fingerprint pattern="^FileZilla Server version (\d\..+)$">
277
- <example>FileZilla Server version 0.9.2 beta</example>
278
279
  <description>FileZilla FTP Server</description>
280
+ <example>FileZilla Server version 0.9.2 beta</example>
279
281
  <param pos="0" name="service.family" value="FileZilla FTP Server"/>
280
282
  <param pos="0" name="service.product" value="FileZilla FTP Server"/>
281
283
  <param pos="1" name="service.version"/>
282
284
  </fingerprint>
283
285
  <fingerprint pattern="^\s*APC FTP server ready\.$">
284
- <example>APC FTP server ready.</example>
285
286
  <description>APC device</description>
287
+ <example>APC FTP server ready.</example>
286
288
  <param pos="0" name="service.vendor" value="APC"/>
287
289
  <param pos="0" name="service.product" value="FTP"/>
288
290
  <param pos="0" name="os.vendor" value="APC"/>
289
291
  <param pos="0" name="os.device" value="Power device"/>
290
292
  </fingerprint>
291
293
  <fingerprint pattern="^(\S+) Network Management Card AOS v(\d+\..+) FTP server ready\.$">
294
+ <description>APC power/cooling device</description>
292
295
  <example>AP7932 Network Management Card AOS v3.3.4 FTP server ready.</example>
293
296
  <example>ACRC103 Network Management Card AOS v3.6.1 FTP server ready.</example>
294
297
  <example>0G-9354-01 Network Management Card AOS v3.6.1 FTP server ready.</example>
295
- <description>APC power/cooling device</description>
296
298
  <param pos="0" name="service.vendor" value="APC"/>
297
299
  <param pos="0" name="service.product" value="AOS"/>
298
300
  <param pos="0" name="service.family" value="AOS"/>
@@ -303,10 +305,10 @@ against these patterns to fingerprint FTP servers.
303
305
  <param pos="2" name="os.version"/>
304
306
  </fingerprint>
305
307
  <fingerprint pattern="^(\S+) FTP server \(EMC-SNAS: ([^\)]+)\)(?: \S+)?$">
308
+ <description>EMC Celerra</description>
306
309
  <example>foo2 FTP server (EMC-SNAS: 5.6.47.11)</example>
307
310
  <example>foo2 FTP server (EMC-SNAS: 5.6.50.203) ready.</example>
308
311
  <example>foo4 FTP server (EMC-SNAS: 5.5.31.6) r</example>
309
- <description>EMC Celerra</description>
310
312
  <param pos="0" name="service.vendor" value="EMC"/>
311
313
  <param pos="0" name="service.product" value="Celerra"/>
312
314
  <param pos="2" name="service.version"/>
@@ -317,9 +319,9 @@ against these patterns to fingerprint FTP servers.
317
319
  <param pos="1" name="host.name"/>
318
320
  </fingerprint>
319
321
  <fingerprint pattern="^JD FTP Server Ready.*$">
322
+ <description>HP JetDirect printer</description>
320
323
  <example>JD FTP Server Ready</example>
321
324
  <example>JD FTP Server Ready.</example>
322
- <description>HP JetDirect printer</description>
323
325
  <param pos="0" name="service.vendor" value="HP"/>
324
326
  <param pos="0" name="service.product" value="JetDirect"/>
325
327
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -329,8 +331,8 @@ against these patterns to fingerprint FTP servers.
329
331
  <param pos="0" name="os.product" value="JetDirect"/>
330
332
  </fingerprint>
331
333
  <fingerprint pattern="^Check Point FireWall-1 Secure FTP server running on (.+)$">
332
- <example>Check Point FireWall-1 Secure FTP server running on host</example>
333
334
  <description>Check Point FireWall-1</description>
335
+ <example>Check Point FireWall-1 Secure FTP server running on host</example>
334
336
  <param pos="0" name="service.vendor" value="Check Point"/>
335
337
  <param pos="0" name="service.product" value="Firewall-1"/>
336
338
  <param pos="0" name="service.family" value="Firewall-1"/>
@@ -341,8 +343,8 @@ against these patterns to fingerprint FTP servers.
341
343
  <param pos="1" name="host.name"/>
342
344
  </fingerprint>
343
345
  <fingerprint pattern="^Blue Coat FTP Service$">
344
- <example>Blue Coat FTP Service</example>
345
346
  <description>Blue Coat security appliances</description>
347
+ <example>Blue Coat FTP Service</example>
346
348
  <param pos="0" name="service.vendor" value="Blue Coat"/>
347
349
  <param pos="0" name="service.product" value="Proxy"/>
348
350
  <param pos="0" name="os.vendor" value="Blue Coat"/>
@@ -355,8 +357,8 @@ against these patterns to fingerprint FTP servers.
355
357
  <param pos="0" name="service.product" value="Nepenthes"/>
356
358
  </fingerprint>
357
359
  <fingerprint pattern="^[^ ]+ IBM FTP CS (V1R\d+) at ([^,]*),.*">
358
- <example>SFTPD1 IBM FTP CS V1R4 at x.y.z, 21:02:19 on 2007-12-15.</example>
359
360
  <description>IBM z/OS FTP Service</description>
361
+ <example>SFTPD1 IBM FTP CS V1R4 at x.y.z, 21:02:19 on 2007-12-15.</example>
360
362
  <param pos="0" name="service.vendor" value="IBM"/>
361
363
  <param pos="0" name="service.product" value="z/OS FTP Server"/>
362
364
  <param pos="0" name="os.vendor" value="IBM"/>
@@ -367,8 +369,8 @@ against these patterns to fingerprint FTP servers.
367
369
  <param pos="2" name="host.name"/>
368
370
  </fingerprint>
369
371
  <fingerprint pattern="^FTP server \(IBM 4690 TCP/IP FTP Version 1\.0\) ready\.">
370
- <example>FTP server (IBM 4690 TCP/IP FTP Version 1.0) ready.</example>
371
372
  <description>IBM 4690 FTP Service</description>
373
+ <example>FTP server (IBM 4690 TCP/IP FTP Version 1.0) ready.</example>
372
374
  <param pos="0" name="service.vendor" value="IBM"/>
373
375
  <param pos="0" name="service.product" value="4690 FTP Server"/>
374
376
  <param pos="0" name="os.vendor" value="IBM"/>
@@ -377,24 +379,24 @@ against these patterns to fingerprint FTP servers.
377
379
  <param pos="0" name="os.device" value="Point of sale"/>
378
380
  </fingerprint>
379
381
  <fingerprint pattern="^([^ ]+) NcFTPd Server \(licensed copy\) ready\.$">
380
- <example>ftp.example.com NcFTPd Server (licensed copy) ready.</example>
381
382
  <description>NcFTPd Server
382
383
  http://www.ncftp.com/ncftpd/</description>
384
+ <example>ftp.example.com NcFTPd Server (licensed copy) ready.</example>
383
385
  <param pos="0" name="service.vendor" value="NcFTP Software"/>
384
386
  <param pos="0" name="service.product" value="NcFTPd Server"/>
385
387
  <param pos="1" name="host.name"/>
386
388
  </fingerprint>
387
389
  <fingerprint pattern="^(\S+) DCS-2100 FTP server ready\.$">
388
- <example>hostname DCS-2100 FTP server ready.</example>
389
390
  <description>D-Link DCS-2100 wireless internet camera</description>
391
+ <example>hostname DCS-2100 FTP server ready.</example>
390
392
  <param pos="0" name="os.vendor" value="D-Link"/>
391
393
  <param pos="0" name="os.product" value="DCS-2100"/>
392
394
  <param pos="0" name="os.device" value="Web cam"/>
393
395
  <param pos="1" name="host.name"/>
394
396
  </fingerprint>
395
397
  <fingerprint pattern="^Secure Gateway FTP server ready\.$">
396
- <example>Secure Gateway FTP server ready.</example>
397
398
  <description>Raptor firewall</description>
399
+ <example>Secure Gateway FTP server ready.</example>
398
400
  <param pos="0" name="os.vendor" value="Symantec"/>
399
401
  <param pos="0" name="os.family" value="Raptor"/>
400
402
  <param pos="0" name="os.product" value="Raptor"/>
@@ -409,30 +411,30 @@ against these patterns to fingerprint FTP servers.
409
411
  <param pos="0" name="os.device" value="Storage"/>
410
412
  </fingerprint>
411
413
  <fingerprint pattern="^AXIS (\S+) (?:(?:Fixed Dome )?Network(?: Fixed Dome)? Camera) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
414
+ <description>Axis Network Camera</description>
412
415
  <example os.product="2100" os.version="2.43">Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
413
416
  <example os.product="207" os.version="4.40.1">AXIS 207 Network Camera 4.40.1 (Apr 16 2007) ready.</example>
414
417
  <example os.product="216FD" os.version="4.47">AXIS 216FD Network Fixed Dome Camera 4.47 (Mar 13 2008) ready.</example>
415
418
  <example os.product="M3203" os.version="5.12.1">AXIS M3203 Fixed Dome Network Camera 5.12.1 (Feb 07 2011) ready.</example>
416
- <description>Axis Network Camera</description>
417
419
  <param pos="0" name="os.vendor" value="Axis"/>
418
420
  <param pos="0" name="os.device" value="Web cam"/>
419
421
  <param pos="1" name="os.product"/>
420
422
  <param pos="2" name="os.version"/>
421
423
  </fingerprint>
422
424
  <fingerprint pattern="^AXIS (\S+) Video (?:Encoder Blade|Server|Decoder) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
425
+ <description>Axis Video encoders/servers</description>
423
426
  <example>AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
424
427
  <example>AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
425
428
  <example>AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
426
- <description>Axis Video encoders/servers</description>
427
429
  <param pos="0" name="os.vendor" value="Axis"/>
428
430
  <param pos="1" name="os.product"/>
429
431
  <param pos="2" name="os.version"/>
430
432
  </fingerprint>
431
433
  <fingerprint pattern="^AXIS (\S+) .*FTP Network Print Server V?([\d\.]+\S+) .* ready\.?$" flags="REG_ICASE">
434
+ <description>Axis print servers</description>
432
435
  <example>AXIS 5600+ (rev 3) FTP Network Print Server V7.00 Sep 10 2004 ready.</example>
433
436
  <example>AXIS 560 FTP Network Print Server V6.00 Jul 7 1999 ready.</example>
434
437
  <example>AXIS 5470e FTP Network Print Server V6.30.beta2 Sep 25 2002 ready.</example>
435
- <description>Axis print servers</description>
436
438
  <param pos="0" name="os.vendor" value="Axis"/>
437
439
  <param pos="0" name="os.device" value="Print server"/>
438
440
  <param pos="1" name="os.product"/>
@@ -484,7 +486,7 @@ against these patterns to fingerprint FTP servers.
484
486
  <param pos="0" name="os.device" value="Printer"/>
485
487
  <param pos="1" name="os.product"/>
486
488
  </fingerprint>
487
- <fingerprint pattern="^FUJI XEROX DocuPrint (.*)$" certainity="1.0">
489
+ <fingerprint pattern="^FUJI XEROX DocuPrint (.*)$" certainty="1.0">
488
490
  <description>FUJI XEROX DocuPrint Series of Printers</description>
489
491
  <example>FUJI XEROX DocuPrint 3055</example>
490
492
  <example>FUJI XEROX DocuPrint C1190 FS</example>
@@ -519,17 +521,17 @@ against these patterns to fingerprint FTP servers.
519
521
  <param pos="1" name="os.product"/>
520
522
  </fingerprint>
521
523
  <fingerprint pattern="^(?:Tornado-)?VxWorks \((?:VxWorks)?([^\)]+)\) FTP server(?: ready)?$" flags="REG_ICASE">
524
+ <description>VxWorks with version information</description>
522
525
  <example>VxWorks (5.3.1) FTP server ready</example>
523
526
  <example>VxWorks (VxWorks5.5.1) FTP server ready</example>
524
527
  <example>Tornado-vxWorks (VxWorks5.5.1) FTP server</example>
525
- <description>VxWorks with version information</description>
526
528
  <param pos="0" name="os.vendor" value="Wind River"/>
527
529
  <param pos="0" name="os.product" value="VxWorks"/>
528
530
  <param pos="1" name="os.version"/>
529
531
  </fingerprint>
530
532
  <fingerprint pattern="^Tornado-vxWorks FTP server ready$" flags="REG_ICASE">
531
- <example>Tornado-vxWorks FTP server ready</example>
532
533
  <description>VxWorks without version information</description>
534
+ <example>Tornado-vxWorks FTP server ready</example>
533
535
  <param pos="0" name="os.vendor" value="Wind River"/>
534
536
  <param pos="0" name="os.product" value="VxWorks"/>
535
537
  </fingerprint>
@@ -851,7 +853,6 @@ against these patterns to fingerprint FTP servers.
851
853
  <param pos="2" name="hw.series"/>
852
854
  <param pos="3" name="os.version"/>
853
855
  </fingerprint>
854
-
855
856
  <fingerprint pattern="^(\S+) FTP server \((?:HP|Compaq) Tru64 UNIX Version (\S+)\) ready\.?$">
856
857
  <description>Digital/Compaq/HP Tru64 Unix</description>
857
858
  <example host.name="example.com" os.version="5.60">example.com FTP server (Compaq Tru64 UNIX Version 5.60) ready.</example>
@@ -862,7 +863,6 @@ against these patterns to fingerprint FTP servers.
862
863
  <param pos="1" name="host.name"/>
863
864
  <param pos="2" name="os.version"/>
864
865
  </fingerprint>
865
-
866
866
  <fingerprint pattern="^(\S+) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
867
867
  <description>Digital/Compaq/HP Tru64 Unix</description>
868
868
  <example host.name="example.com" os.version="5.60">example.com FTP server (Digital UNIX Version 5.60) ready.</example>
@@ -873,7 +873,6 @@ against these patterns to fingerprint FTP servers.
873
873
  <param pos="1" name="host.name"/>
874
874
  <param pos="2" name="os.version"/>
875
875
  </fingerprint>
876
-
877
876
  <fingerprint pattern="^(\S+) FTP server \(MikroTik ([\d\.]+)\) ready\.?$">
878
877
  <description>MikroTik</description>
879
878
  <example host.name="example.com" os.version="6.18">example.com FTP server (MikroTik 6.18) ready</example>
@@ -882,13 +881,11 @@ against these patterns to fingerprint FTP servers.
882
881
  <param pos="1" name="host.name"/>
883
882
  <param pos="2" name="os.version"/>
884
883
  </fingerprint>
885
-
886
884
  <fingerprint pattern="^(\S+) FTP server ready\.?$" flags="REG_ICASE">
887
885
  <description>Generic FTP fingerprint with a hostname</description>
888
886
  <example host.name="example.com">example.com FTP server ready.</example>
889
887
  <param pos="1" name="host.name"/>
890
888
  </fingerprint>
891
-
892
889
  <fingerprint pattern="^(\S+) FTP server \(Version (\d.*)\) ready\.?$" flags="REG_ICASE">
893
890
  <description>Generic FTP fingerprint with a hostname and a version for a generic FTP implementation</description>
894
891
  <example host.name="example.com" service.version="6.00LS">example.com FTP server (Version 6.00LS) ready.</example>
@@ -896,7 +893,6 @@ against these patterns to fingerprint FTP servers.
896
893
  <param pos="1" name="host.name"/>
897
894
  <param pos="2" name="service.version"/>
898
895
  </fingerprint>
899
-
900
896
  <fingerprint pattern="^FTP (?:server|service)?(?: is)? ready\.?$" flags="REG_ICASE">
901
897
  <description>Generic FTP fingerprint without a hostname</description>
902
898
  <example>FTP server is ready.</example>
@@ -904,12 +900,10 @@ against these patterns to fingerprint FTP servers.
904
900
  <example>FTP Server Ready</example>
905
901
  <example>FTP service ready.</example>
906
902
  </fingerprint>
907
-
908
903
  <fingerprint pattern="^Welcom to ProRat Ftp Server$">
909
- <description>The FTP server of the ProRat malware</description>
910
- <example>Welcom to ProRat Ftp Server</example>
911
- <param pos="0" name="service.vendor" value="Pro Group"/>
912
- <param pos="0" name="service.product" value="ProRat"/>
904
+ <description>The FTP server of the ProRat malware</description>
905
+ <example>Welcom to ProRat Ftp Server</example>
906
+ <param pos="0" name="service.vendor" value="Pro Group"/>
907
+ <param pos="0" name="service.product" value="ProRat"/>
913
908
  </fingerprint>
914
-
915
909
  </fingerprints>