recog 2.0.13 → 2.0.14

Sign up to get free protection for your applications and to get access to all the features.
Files changed (52) hide show
  1. checksums.yaml +4 -4
  2. data/CONTRIBUTING.md +19 -6
  3. data/features/{xml → data}/failing_banners_fingerprints.xml +0 -0
  4. data/features/{xml → data}/matching_banners_fingerprints.xml +0 -0
  5. data/features/{xml → data}/no_tests.xml +0 -0
  6. data/features/{xml/banners.xml → data/sample_banner.txt} +0 -0
  7. data/features/{xml → data}/successful_tests.xml +0 -0
  8. data/features/{xml → data}/tests_with_failures.xml +0 -0
  9. data/features/{xml → data}/tests_with_warnings.xml +0 -0
  10. data/features/match.feature +2 -2
  11. data/features/support/env.rb +1 -1
  12. data/lib/recog/version.rb +1 -1
  13. data/misc/order.xsl +17 -0
  14. data/spec/lib/fingerprint_self_test_spec.rb +8 -0
  15. data/xml/apache_os.xml +270 -334
  16. data/xml/architecture.xml +28 -41
  17. data/xml/fingerprints.xsd +37 -0
  18. data/xml/ftp_banners.xml +52 -58
  19. data/xml/h323_callresp.xml +597 -695
  20. data/xml/hp_pjl_id.xml +370 -409
  21. data/xml/http_cookies.xml +304 -348
  22. data/xml/http_servers.xml +3202 -3483
  23. data/xml/http_wwwauth.xml +342 -409
  24. data/xml/imap_banners.xml +149 -190
  25. data/xml/mdns_device-info_txt.xml +97 -111
  26. data/xml/mdns_workstation_txt.xml +6 -6
  27. data/xml/mysql_banners.xml +99 -198
  28. data/xml/mysql_error.xml +4 -11
  29. data/xml/nntp_banners.xml +42 -45
  30. data/xml/ntp_banners.xml +2 -3
  31. data/xml/pop_banners.xml +214 -247
  32. data/xml/rsh_resp.xml +68 -76
  33. data/xml/sip_banners.xml +19 -19
  34. data/xml/sip_user_agents.xml +63 -74
  35. data/xml/smb_native_os.xml +387 -433
  36. data/xml/smtp_banners.xml +1318 -1460
  37. data/xml/smtp_debug.xml +24 -27
  38. data/xml/smtp_ehlo.xml +19 -22
  39. data/xml/smtp_expn.xml +61 -70
  40. data/xml/smtp_help.xml +139 -160
  41. data/xml/smtp_mailfrom.xml +14 -16
  42. data/xml/smtp_noop.xml +28 -31
  43. data/xml/smtp_quit.xml +16 -18
  44. data/xml/smtp_rcptto.xml +8 -10
  45. data/xml/smtp_rset.xml +12 -13
  46. data/xml/smtp_turn.xml +12 -13
  47. data/xml/smtp_vrfy.xml +66 -76
  48. data/xml/snmp_sysdescr.xml +7257 -8016
  49. data/xml/snmp_sysobjid.xml +392 -434
  50. data/xml/ssh_banners.xml +783 -867
  51. data/xml/upnp_banners.xml +594 -628
  52. metadata +11 -9
data/xml/architecture.xml CHANGED
@@ -1,45 +1,32 @@
1
- <?xml version="1.0"?>
2
-
1
+ <?xml version="1.0" encoding="UTF-8"?>
3
2
  <!--
4
3
  Generic rules for matching a machine architecture, platform, or chipset
5
4
  -->
6
-
7
5
  <fingerprints matches="architecture">
8
-
9
- <fingerprint pattern="x64|amd64|x86_64" flags="REG_ICASE">
10
- <description>x64 (x86_x64)</description>
11
- <example>Linux claw 3.11.0-15-generic #23-Ubuntu SMP Mon Dec 9 18:17:04 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux</example>
12
- <param pos="0" name="os.arch" value="x64"/>
13
- </fingerprint>
14
-
15
- <fingerprint pattern="x86|i[3456]86" flags="REG_ICASE">
16
- <description>x86</description>
17
- <example>Linux bob 3.2.0-1-generic #3-Ubuntu SMP Wed Dec 11 19:12:55 UTC 2013 i686 i686 i686 GNU/Linux</example>
18
- <param pos="0" name="os.arch" value="x86"/>
19
- </fingerprint>
20
-
21
- <fingerprint pattern="PowerPC|PPC|POWER|ppc">
22
- <description>PowerPC</description>
23
- <!-- XXX: Need an example -->
24
- <param pos="0" name="os.arch" value="ppc"/>
25
- </fingerprint>
26
-
27
- <fingerprint pattern="SPARC" flags="REG_ICASE">
28
- <description>SPARC</description>
29
- <!-- XXX: Need an example -->
30
- <param pos="0" name="os.arch" value="sparc"/>
31
- </fingerprint>
32
-
33
- <fingerprint pattern="mips" flags="REG_ICASE">
34
- <description>MIPS</description>
35
- <!-- XXX: Need an example -->
36
- <param pos="0" name="os.arch" value="mips"/>
37
- </fingerprint>
38
-
39
- <fingerprint pattern="arm" flags="REG_ICASE">
40
- <description>ARM</description>
41
- <!-- XXX: Need an example -->
42
- <param pos="0" name="os.arch" value="arm"/>
43
- </fingerprint>
44
-
45
- </fingerprints>
6
+ <fingerprint pattern="x64|amd64|x86_64" flags="REG_ICASE">
7
+ <description>x64 (x86_x64)</description>
8
+ <example>Linux claw 3.11.0-15-generic #23-Ubuntu SMP Mon Dec 9 18:17:04 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux</example>
9
+ <param pos="0" name="os.arch" value="x64"/>
10
+ </fingerprint>
11
+ <fingerprint pattern="x86|i[3456]86" flags="REG_ICASE">
12
+ <description>x86</description>
13
+ <example>Linux bob 3.2.0-1-generic #3-Ubuntu SMP Wed Dec 11 19:12:55 UTC 2013 i686 i686 i686 GNU/Linux</example>
14
+ <param pos="0" name="os.arch" value="x86"/>
15
+ </fingerprint>
16
+ <fingerprint pattern="PowerPC|PPC|POWER|ppc">
17
+ <description>PowerPC</description>
18
+ <param pos="0" name="os.arch" value="ppc"/>
19
+ </fingerprint>
20
+ <fingerprint pattern="SPARC" flags="REG_ICASE">
21
+ <description>SPARC</description>
22
+ <param pos="0" name="os.arch" value="sparc"/>
23
+ </fingerprint>
24
+ <fingerprint pattern="mips" flags="REG_ICASE">
25
+ <description>MIPS</description>
26
+ <param pos="0" name="os.arch" value="mips"/>
27
+ </fingerprint>
28
+ <fingerprint pattern="arm" flags="REG_ICASE">
29
+ <description>ARM</description>
30
+ <param pos="0" name="os.arch" value="arm"/>
31
+ </fingerprint>
32
+ </fingerprints>
data/xml/fingerprints.xsd ADDED
@@ -0,0 +1,37 @@
1
+ <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema">
2
+
3
+ <xsd:element name="fingerprints" type="fingerprints_element"/>
4
+
5
+ <xsd:complexType name="fingerprints_element">
6
+ <xsd:sequence>
7
+ <xsd:element name="fingerprint" type="fingerprint_element" minOccurs="1" maxOccurs="unbounded"/>
8
+ </xsd:sequence>
9
+ <xsd:attribute name="matches" type="xsd:string" use="optional"/>
10
+ </xsd:complexType>
11
+
12
+ <xsd:complexType name="fingerprint_element" mixed="true">
13
+ <xsd:sequence>
14
+ <xsd:element name="description" type="xsd:string" minOccurs="1" maxOccurs="1"/>
15
+ <xsd:element name="example" type="example_element" minOccurs="0" maxOccurs="unbounded"/>
16
+ <xsd:element name="param" type="param_element" minOccurs="0" maxOccurs="unbounded"/>
17
+ </xsd:sequence>
18
+ <xsd:attribute name="certainty" type="xsd:string" use="optional"/>
19
+ <xsd:attribute name="pattern" type="xsd:string" use="required"/>
20
+ <xsd:attribute name="flags" type="xsd:string" use="optional"/>
21
+ </xsd:complexType>
22
+
23
+ <xsd:complexType name="example_element">
24
+ <xsd:simpleContent>
25
+ <xsd:extension base="xsd:string">
26
+ <xsd:anyAttribute processContents="skip"/>
27
+ </xsd:extension>
28
+ </xsd:simpleContent>
29
+ </xsd:complexType>
30
+
31
+ <xsd:complexType name="param_element">
32
+ <xsd:attribute name="name" type="xsd:string" use="required"/>
33
+ <xsd:attribute name="pos" type="xsd:integer" use="required"/>
34
+ <xsd:attribute name="value" type="xsd:string" use="optional"/>
35
+ </xsd:complexType>
36
+
37
+ </xsd:schema>
data/xml/ftp_banners.xml CHANGED
@@ -1,12 +1,12 @@
1
- <?xml version="1.0"?>
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
2
  <!--
3
3
  FTP greeting messages (part of the banner after the response code) are matched
4
4
  against these patterns to fingerprint FTP servers.
5
5
  -->
6
6
  <fingerprints matches="ftp.banner">
7
7
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version ([1234]\.\d+)\)\.$">
8
- <example>xx Microsoft FTP Service (Version 3.0).</example>
9
8
  <description>Microsoft FTP Server on Windows NT</description>
9
+ <example>xx Microsoft FTP Service (Version 3.0).</example>
10
10
  <param pos="0" name="service.vendor" value="Microsoft"/>
11
11
  <param pos="0" name="service.product" value="IIS"/>
12
12
  <param pos="0" name="service.family" value="IIS"/>
@@ -18,8 +18,8 @@ against these patterns to fingerprint FTP servers.
18
18
  <param pos="1" name="host.name"/>
19
19
  </fingerprint>
20
20
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.0\)\.$">
21
- <example>xxx Microsoft FTP Service (Version 5.0).</example>
22
21
  <description>Microsoft FTP Server on Windows 2000</description>
22
+ <example>xxx Microsoft FTP Service (Version 5.0).</example>
23
23
  <param pos="0" name="service.vendor" value="Microsoft"/>
24
24
  <param pos="0" name="service.product" value="IIS"/>
25
25
  <param pos="0" name="service.family" value="IIS"/>
@@ -31,8 +31,8 @@ against these patterns to fingerprint FTP servers.
31
31
  <param pos="1" name="host.name"/>
32
32
  </fingerprint>
33
33
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.1\)\.$">
34
- <example>xxx Microsoft FTP Service (Version 5.1).</example>
35
34
  <description>Microsoft FTP Server on Windows XP, 2003 or later versions of 2000</description>
35
+ <example>xxx Microsoft FTP Service (Version 5.1).</example>
36
36
  <param pos="0" name="service.vendor" value="Microsoft"/>
37
37
  <param pos="0" name="service.product" value="IIS"/>
38
38
  <param pos="0" name="service.family" value="IIS"/>
@@ -43,8 +43,8 @@ against these patterns to fingerprint FTP servers.
43
43
  <param pos="1" name="host.name"/>
44
44
  </fingerprint>
45
45
  <fingerprint pattern="^([^ ]+) Microsoft FTP Service$">
46
- <example>hostname Microsoft FTP Service</example>
47
46
  <description>Microsoft FTP Server on Windows XP, 2003 or later without version</description>
47
+ <example>hostname Microsoft FTP Service</example>
48
48
  <param pos="0" name="service.vendor" value="Microsoft"/>
49
49
  <param pos="0" name="service.product" value="IIS"/>
50
50
  <param pos="0" name="service.family" value="IIS"/>
@@ -55,8 +55,8 @@ against these patterns to fingerprint FTP servers.
55
55
  <param pos="1" name="host.name"/>
56
56
  </fingerprint>
57
57
  <fingerprint pattern="^Microsoft FTP Service$">
58
- <example>Microsoft FTP Service</example>
59
58
  <description>Microsoft FTP Server on Windows XP, 2003 or later without version or hostname</description>
59
+ <example>Microsoft FTP Service</example>
60
60
  <param pos="0" name="service.vendor" value="Microsoft"/>
61
61
  <param pos="0" name="service.product" value="IIS"/>
62
62
  <param pos="0" name="service.family" value="IIS"/>
@@ -107,7 +107,8 @@ against these patterns to fingerprint FTP servers.
107
107
  <fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\s+([\d\.]+).*\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
108
108
  <description>FTPD on Mac OS X Server with a version</description>
109
109
  <example host.name="example.com" os.version="10.3">example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
110
- <example host.name="example.com" os.version="10.3">this is a banner. change it.&#13;&#10;example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
110
+ <example host.name="example.com" os.version="10.3">this is a banner. change it.&#13;
111
+ example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
111
112
  <param pos="0" name="service.vendor" value="Apple"/>
112
113
  <param pos="0" name="service.product" value="FTP"/>
113
114
  <param pos="0" name="os.vendor" value="Apple"/>
@@ -120,7 +121,8 @@ against these patterns to fingerprint FTP servers.
120
121
  <fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
121
122
  <description>FTPD on Mac OS X Server without a version</description>
122
123
  <example host.name="example.com">example.com FTP server (Version: Mac OS X Server) ready.</example>
123
- <example host.name="example.com">this is a banner. change it.&#13;&#10;example.com FTP server (Version: Mac OS X Server) ready.</example>
124
+ <example host.name="example.com">this is a banner. change it.&#13;
125
+ example.com FTP server (Version: Mac OS X Server) ready.</example>
124
126
  <param pos="0" name="service.vendor" value="Apple"/>
125
127
  <param pos="0" name="service.product" value="FTP"/>
126
128
  <param pos="0" name="os.vendor" value="Apple"/>
@@ -147,8 +149,8 @@ against these patterns to fingerprint FTP servers.
147
149
  <param pos="2" name="os.version"/>
148
150
  </fingerprint>
149
151
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Debian\) \[(.+)\]$">
150
- <example>ProFTPD 1.3.0rc2 Server (Debian) [host]</example>
151
152
  <description>ProFTPD on Debian Linux</description>
153
+ <example>ProFTPD 1.3.0rc2 Server (Debian) [host]</example>
152
154
  <param pos="0" name="service.family" value="ProFTPD"/>
153
155
  <param pos="0" name="service.product" value="ProFTPD"/>
154
156
  <param pos="1" name="service.version"/>
@@ -159,8 +161,8 @@ against these patterns to fingerprint FTP servers.
159
161
  <param pos="2" name="host.name"/>
160
162
  </fingerprint>
161
163
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(W.+)\) \[(.+)\]$">
162
- <example>ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
163
164
  <description>ProFTPD on a Linksys Wireless Access Point/Router</description>
165
+ <example>ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
164
166
  <param pos="0" name="service.family" value="ProFTPD"/>
165
167
  <param pos="0" name="service.product" value="ProFTPD"/>
166
168
  <param pos="1" name="service.version"/>
@@ -170,7 +172,6 @@ against these patterns to fingerprint FTP servers.
170
172
  <param pos="3" name="host.name"/>
171
173
  </fingerprint>
172
174
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(.*)\) \[(.+)\]$">
173
- <!-- TODO: find a greeting message example -->
174
175
  <description>ProFTPD on a wired Linksys device</description>
175
176
  <param pos="0" name="service.family" value="ProFTPD"/>
176
177
  <param pos="0" name="service.product" value="ProFTPD"/>
@@ -181,10 +182,10 @@ against these patterns to fingerprint FTP servers.
181
182
  <param pos="3" name="host.name"/>
182
183
  </fingerprint>
183
184
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[(.+)\]$">
185
+ <description>ProFTPD with version info but no obvious OS info</description>
184
186
  <example>ProFTPD 1.2.10 Server (Main FTP Server) [host]</example>
185
187
  <example>ProFTPD 1.2.10 Server (ProFTPD) [host]</example>
186
188
  <example>ProFTPD 1.2.10rc3 Server (ProFTPD Default Installation) [host]</example>
187
- <description>ProFTPD with version info but no obvious OS info</description>
188
189
  <param pos="0" name="service.family" value="ProFTPD"/>
189
190
  <param pos="0" name="service.product" value="ProFTPD"/>
190
191
  <param pos="1" name="service.version"/>
@@ -192,52 +193,53 @@ against these patterns to fingerprint FTP servers.
192
193
  <param pos="3" name="host.name"/>
193
194
  </fingerprint>
194
195
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server ready\.$">
195
- <example>ProFTPD 1.3.0rc2 Server ready.</example>
196
196
  <description>ProFTPD with only version info</description>
197
+ <example>ProFTPD 1.3.0rc2 Server ready.</example>
197
198
  <param pos="0" name="service.family" value="ProFTPD"/>
198
199
  <param pos="0" name="service.product" value="ProFTPD"/>
199
200
  <param pos="1" name="service.version"/>
200
201
  </fingerprint>
201
202
  <fingerprint pattern="^ProFTPD FTP Server ready\.$">
202
- <example>ProFTPD FTP Server ready.</example>
203
203
  <description>ProFTPD with no version info</description>
204
+ <example>ProFTPD FTP Server ready.</example>
204
205
  <param pos="0" name="service.family" value="ProFTPD"/>
205
206
  <param pos="0" name="service.product" value="ProFTPD"/>
206
207
  </fingerprint>
207
208
  <fingerprint pattern="^=\(&lt;\*&gt;\)=-\.:\. \(\( Welcome to Pure-FTPd ([\d.]+) \)\) \.:\.-=\(&lt;\*&gt;\)=-" flags="REG_MULTILINE">
208
- <!-- yes, the leading and trailing text is not balanced.
209
- the leading text is missing the - at the beginning -->
210
- <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-</example>
211
- <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-&#13;&#10;more stuff</example>
212
209
  <description>Pure-FTPd versions &lt;= 1.0.13 (at least as far back as 1.0.11)</description>
210
+ <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-</example>
211
+ <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-&#13;
212
+ more stuff</example>
213
213
  <param pos="0" name="service.family" value="Pure-FTPd"/>
214
214
  <param pos="0" name="service.product" value="Pure-FTPd"/>
215
215
  <param pos="1" name="service.version"/>
216
216
  </fingerprint>
217
217
  <fingerprint pattern="^-{9,10} Welcome to Pure-FTPd (.*)-{9,10}" flags="REG_MULTILINE">
218
- <example>---------- Welcome to Pure-FTPd ----------</example>
219
- <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------</example>
220
- <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;&#10;more text</example>
221
- <description>Pure-FTPd versions >= 1.0.14
218
+ <description>Pure-FTPd versions &gt;= 1.0.14
222
219
  Config data can be zero or more of: [privsep] [TLS]
223
220
  </description>
221
+ <example>---------- Welcome to Pure-FTPd ----------</example>
222
+ <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------</example>
223
+ <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;
224
+ more text</example>
224
225
  <param pos="1" name="pureftpd.config"/>
225
226
  <param pos="0" name="service.family" value="Pure-FTPd"/>
226
227
  <param pos="0" name="service.product" value="Pure-FTPd"/>
227
228
  </fingerprint>
228
229
  <fingerprint pattern="^=\(.\*.\)=-\.:\. \(\( Welcome to PureFTPd (\d+\..+) \)\) \.:\.-=\(.\*.\)=-" flags="REG_MULTILINE">
229
- <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-</example>
230
- <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-&#13;&#10;more text</example>
231
230
  <description>Older Pure-FTPd versions</description>
231
+ <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-</example>
232
+ <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-&#13;
233
+ more text</example>
232
234
  <param pos="0" name="service.family" value="Pure-FTPd"/>
233
235
  <param pos="0" name="service.product" value="Pure-FTPd"/>
234
236
  <param pos="1" name="service.version"/>
235
237
  </fingerprint>
236
238
  <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\..+)(?: for WinSock)? ready\.*$">
239
+ <description>Serv-U (only runs on Windows)</description>
237
240
  <example>Serv-U FTP-Server v2.5n for WinSock ready...</example>
238
241
  <example>Serv-U FTP Server v6.0 for WinSock ready</example>
239
242
  <example>Serv-U FTP Server v7.2 ready...</example>
240
- <description>Serv-U (only runs on Windows)</description>
241
243
  <param pos="0" name="service.vendor" value="Rhino Software"/>
242
244
  <param pos="0" name="service.product" value="Serv-U"/>
243
245
  <param pos="0" name="service.family" value="Serv-U"/>
@@ -248,8 +250,8 @@ against these patterns to fingerprint FTP servers.
248
250
  <param pos="0" name="os.product" value="Windows"/>
249
251
  </fingerprint>
250
252
  <fingerprint pattern="^zFTPServer v?(\S+), .*ready\.$" flags="REG_ICASE">
251
- <example>zFTPServer v4.0, build 2008-12-24 01:41 ready.</example>
252
253
  <description>zftpserver (only runs on Windows)</description>
254
+ <example>zFTPServer v4.0, build 2008-12-24 01:41 ready.</example>
253
255
  <param pos="0" name="service.product" value="zFTPServer"/>
254
256
  <param pos="1" name="service.version"/>
255
257
  <param pos="0" name="os.vendor" value="Microsoft"/>
@@ -258,41 +260,41 @@ against these patterns to fingerprint FTP servers.
258
260
  <param pos="0" name="os.product" value="Windows"/>
259
261
  </fingerprint>
260
262
  <fingerprint pattern="^\(vsFTPd (\d+\..+)\)(?: (.+))?$">
263
+ <description>vsFTPd (Very Secure FTP Daemon)</description>
261
264
  <example>(vsFTPd 1.1.3) host</example>
262
265
  <example>(vsFTPd 2.0.5)</example>
263
- <description>vsFTPd (Very Secure FTP Daemon)</description>
264
266
  <param pos="0" name="service.family" value="vsFTPd"/>
265
267
  <param pos="0" name="service.product" value="vsFTPd"/>
266
268
  <param pos="1" name="service.version"/>
267
269
  <param pos="2" name="host.name"/>
268
270
  </fingerprint>
269
271
  <fingerprint pattern="^ready, dude \(vsFTPd (\d+\..+): beat me, break me\)$">
270
- <example>ready, dude (vsFTPd 1.1.0: beat me, break me)</example>
271
272
  <description>vsFTPd (Very Secure FTP Daemon)</description>
273
+ <example>ready, dude (vsFTPd 1.1.0: beat me, break me)</example>
272
274
  <param pos="0" name="service.family" value="vsFTPd"/>
273
275
  <param pos="0" name="service.product" value="vsFTPd"/>
274
276
  <param pos="1" name="service.version"/>
275
277
  </fingerprint>
276
278
  <fingerprint pattern="^FileZilla Server version (\d\..+)$">
277
- <example>FileZilla Server version 0.9.2 beta</example>
278
279
  <description>FileZilla FTP Server</description>
280
+ <example>FileZilla Server version 0.9.2 beta</example>
279
281
  <param pos="0" name="service.family" value="FileZilla FTP Server"/>
280
282
  <param pos="0" name="service.product" value="FileZilla FTP Server"/>
281
283
  <param pos="1" name="service.version"/>
282
284
  </fingerprint>
283
285
  <fingerprint pattern="^\s*APC FTP server ready\.$">
284
- <example>APC FTP server ready.</example>
285
286
  <description>APC device</description>
287
+ <example>APC FTP server ready.</example>
286
288
  <param pos="0" name="service.vendor" value="APC"/>
287
289
  <param pos="0" name="service.product" value="FTP"/>
288
290
  <param pos="0" name="os.vendor" value="APC"/>
289
291
  <param pos="0" name="os.device" value="Power device"/>
290
292
  </fingerprint>
291
293
  <fingerprint pattern="^(\S+) Network Management Card AOS v(\d+\..+) FTP server ready\.$">
294
+ <description>APC power/cooling device</description>
292
295
  <example>AP7932 Network Management Card AOS v3.3.4 FTP server ready.</example>
293
296
  <example>ACRC103 Network Management Card AOS v3.6.1 FTP server ready.</example>
294
297
  <example>0G-9354-01 Network Management Card AOS v3.6.1 FTP server ready.</example>
295
- <description>APC power/cooling device</description>
296
298
  <param pos="0" name="service.vendor" value="APC"/>
297
299
  <param pos="0" name="service.product" value="AOS"/>
298
300
  <param pos="0" name="service.family" value="AOS"/>
@@ -303,10 +305,10 @@ against these patterns to fingerprint FTP servers.
303
305
  <param pos="2" name="os.version"/>
304
306
  </fingerprint>
305
307
  <fingerprint pattern="^(\S+) FTP server \(EMC-SNAS: ([^\)]+)\)(?: \S+)?$">
308
+ <description>EMC Celerra</description>
306
309
  <example>foo2 FTP server (EMC-SNAS: 5.6.47.11)</example>
307
310
  <example>foo2 FTP server (EMC-SNAS: 5.6.50.203) ready.</example>
308
311
  <example>foo4 FTP server (EMC-SNAS: 5.5.31.6) r</example>
309
- <description>EMC Celerra</description>
310
312
  <param pos="0" name="service.vendor" value="EMC"/>
311
313
  <param pos="0" name="service.product" value="Celerra"/>
312
314
  <param pos="2" name="service.version"/>
@@ -317,9 +319,9 @@ against these patterns to fingerprint FTP servers.
317
319
  <param pos="1" name="host.name"/>
318
320
  </fingerprint>
319
321
  <fingerprint pattern="^JD FTP Server Ready.*$">
322
+ <description>HP JetDirect printer</description>
320
323
  <example>JD FTP Server Ready</example>
321
324
  <example>JD FTP Server Ready.</example>
322
- <description>HP JetDirect printer</description>
323
325
  <param pos="0" name="service.vendor" value="HP"/>
324
326
  <param pos="0" name="service.product" value="JetDirect"/>
325
327
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -329,8 +331,8 @@ against these patterns to fingerprint FTP servers.
329
331
  <param pos="0" name="os.product" value="JetDirect"/>
330
332
  </fingerprint>
331
333
  <fingerprint pattern="^Check Point FireWall-1 Secure FTP server running on (.+)$">
332
- <example>Check Point FireWall-1 Secure FTP server running on host</example>
333
334
  <description>Check Point FireWall-1</description>
335
+ <example>Check Point FireWall-1 Secure FTP server running on host</example>
334
336
  <param pos="0" name="service.vendor" value="Check Point"/>
335
337
  <param pos="0" name="service.product" value="Firewall-1"/>
336
338
  <param pos="0" name="service.family" value="Firewall-1"/>
@@ -341,8 +343,8 @@ against these patterns to fingerprint FTP servers.
341
343
  <param pos="1" name="host.name"/>
342
344
  </fingerprint>
343
345
  <fingerprint pattern="^Blue Coat FTP Service$">
344
- <example>Blue Coat FTP Service</example>
345
346
  <description>Blue Coat security appliances</description>
347
+ <example>Blue Coat FTP Service</example>
346
348
  <param pos="0" name="service.vendor" value="Blue Coat"/>
347
349
  <param pos="0" name="service.product" value="Proxy"/>
348
350
  <param pos="0" name="os.vendor" value="Blue Coat"/>
@@ -355,8 +357,8 @@ against these patterns to fingerprint FTP servers.
355
357
  <param pos="0" name="service.product" value="Nepenthes"/>
356
358
  </fingerprint>
357
359
  <fingerprint pattern="^[^ ]+ IBM FTP CS (V1R\d+) at ([^,]*),.*">
358
- <example>SFTPD1 IBM FTP CS V1R4 at x.y.z, 21:02:19 on 2007-12-15.</example>
359
360
  <description>IBM z/OS FTP Service</description>
361
+ <example>SFTPD1 IBM FTP CS V1R4 at x.y.z, 21:02:19 on 2007-12-15.</example>
360
362
  <param pos="0" name="service.vendor" value="IBM"/>
361
363
  <param pos="0" name="service.product" value="z/OS FTP Server"/>
362
364
  <param pos="0" name="os.vendor" value="IBM"/>
@@ -367,8 +369,8 @@ against these patterns to fingerprint FTP servers.
367
369
  <param pos="2" name="host.name"/>
368
370
  </fingerprint>
369
371
  <fingerprint pattern="^FTP server \(IBM 4690 TCP/IP FTP Version 1\.0\) ready\.">
370
- <example>FTP server (IBM 4690 TCP/IP FTP Version 1.0) ready.</example>
371
372
  <description>IBM 4690 FTP Service</description>
373
+ <example>FTP server (IBM 4690 TCP/IP FTP Version 1.0) ready.</example>
372
374
  <param pos="0" name="service.vendor" value="IBM"/>
373
375
  <param pos="0" name="service.product" value="4690 FTP Server"/>
374
376
  <param pos="0" name="os.vendor" value="IBM"/>
@@ -377,24 +379,24 @@ against these patterns to fingerprint FTP servers.
377
379
  <param pos="0" name="os.device" value="Point of sale"/>
378
380
  </fingerprint>
379
381
  <fingerprint pattern="^([^ ]+) NcFTPd Server \(licensed copy\) ready\.$">
380
- <example>ftp.example.com NcFTPd Server (licensed copy) ready.</example>
381
382
  <description>NcFTPd Server
382
383
  http://www.ncftp.com/ncftpd/</description>
384
+ <example>ftp.example.com NcFTPd Server (licensed copy) ready.</example>
383
385
  <param pos="0" name="service.vendor" value="NcFTP Software"/>
384
386
  <param pos="0" name="service.product" value="NcFTPd Server"/>
385
387
  <param pos="1" name="host.name"/>
386
388
  </fingerprint>
387
389
  <fingerprint pattern="^(\S+) DCS-2100 FTP server ready\.$">
388
- <example>hostname DCS-2100 FTP server ready.</example>
389
390
  <description>D-Link DCS-2100 wireless internet camera</description>
391
+ <example>hostname DCS-2100 FTP server ready.</example>
390
392
  <param pos="0" name="os.vendor" value="D-Link"/>
391
393
  <param pos="0" name="os.product" value="DCS-2100"/>
392
394
  <param pos="0" name="os.device" value="Web cam"/>
393
395
  <param pos="1" name="host.name"/>
394
396
  </fingerprint>
395
397
  <fingerprint pattern="^Secure Gateway FTP server ready\.$">
396
- <example>Secure Gateway FTP server ready.</example>
397
398
  <description>Raptor firewall</description>
399
+ <example>Secure Gateway FTP server ready.</example>
398
400
  <param pos="0" name="os.vendor" value="Symantec"/>
399
401
  <param pos="0" name="os.family" value="Raptor"/>
400
402
  <param pos="0" name="os.product" value="Raptor"/>
@@ -409,30 +411,30 @@ against these patterns to fingerprint FTP servers.
409
411
  <param pos="0" name="os.device" value="Storage"/>
410
412
  </fingerprint>
411
413
  <fingerprint pattern="^AXIS (\S+) (?:(?:Fixed Dome )?Network(?: Fixed Dome)? Camera) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
414
+ <description>Axis Network Camera</description>
412
415
  <example os.product="2100" os.version="2.43">Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
413
416
  <example os.product="207" os.version="4.40.1">AXIS 207 Network Camera 4.40.1 (Apr 16 2007) ready.</example>
414
417
  <example os.product="216FD" os.version="4.47">AXIS 216FD Network Fixed Dome Camera 4.47 (Mar 13 2008) ready.</example>
415
418
  <example os.product="M3203" os.version="5.12.1">AXIS M3203 Fixed Dome Network Camera 5.12.1 (Feb 07 2011) ready.</example>
416
- <description>Axis Network Camera</description>
417
419
  <param pos="0" name="os.vendor" value="Axis"/>
418
420
  <param pos="0" name="os.device" value="Web cam"/>
419
421
  <param pos="1" name="os.product"/>
420
422
  <param pos="2" name="os.version"/>
421
423
  </fingerprint>
422
424
  <fingerprint pattern="^AXIS (\S+) Video (?:Encoder Blade|Server|Decoder) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
425
+ <description>Axis Video encoders/servers</description>
423
426
  <example>AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
424
427
  <example>AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
425
428
  <example>AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
426
- <description>Axis Video encoders/servers</description>
427
429
  <param pos="0" name="os.vendor" value="Axis"/>
428
430
  <param pos="1" name="os.product"/>
429
431
  <param pos="2" name="os.version"/>
430
432
  </fingerprint>
431
433
  <fingerprint pattern="^AXIS (\S+) .*FTP Network Print Server V?([\d\.]+\S+) .* ready\.?$" flags="REG_ICASE">
434
+ <description>Axis print servers</description>
432
435
  <example>AXIS 5600+ (rev 3) FTP Network Print Server V7.00 Sep 10 2004 ready.</example>
433
436
  <example>AXIS 560 FTP Network Print Server V6.00 Jul 7 1999 ready.</example>
434
437
  <example>AXIS 5470e FTP Network Print Server V6.30.beta2 Sep 25 2002 ready.</example>
435
- <description>Axis print servers</description>
436
438
  <param pos="0" name="os.vendor" value="Axis"/>
437
439
  <param pos="0" name="os.device" value="Print server"/>
438
440
  <param pos="1" name="os.product"/>
@@ -484,7 +486,7 @@ against these patterns to fingerprint FTP servers.
484
486
  <param pos="0" name="os.device" value="Printer"/>
485
487
  <param pos="1" name="os.product"/>
486
488
  </fingerprint>
487
- <fingerprint pattern="^FUJI XEROX DocuPrint (.*)$" certainity="1.0">
489
+ <fingerprint pattern="^FUJI XEROX DocuPrint (.*)$" certainty="1.0">
488
490
  <description>FUJI XEROX DocuPrint Series of Printers</description>
489
491
  <example>FUJI XEROX DocuPrint 3055</example>
490
492
  <example>FUJI XEROX DocuPrint C1190 FS</example>
@@ -519,17 +521,17 @@ against these patterns to fingerprint FTP servers.
519
521
  <param pos="1" name="os.product"/>
520
522
  </fingerprint>
521
523
  <fingerprint pattern="^(?:Tornado-)?VxWorks \((?:VxWorks)?([^\)]+)\) FTP server(?: ready)?$" flags="REG_ICASE">
524
+ <description>VxWorks with version information</description>
522
525
  <example>VxWorks (5.3.1) FTP server ready</example>
523
526
  <example>VxWorks (VxWorks5.5.1) FTP server ready</example>
524
527
  <example>Tornado-vxWorks (VxWorks5.5.1) FTP server</example>
525
- <description>VxWorks with version information</description>
526
528
  <param pos="0" name="os.vendor" value="Wind River"/>
527
529
  <param pos="0" name="os.product" value="VxWorks"/>
528
530
  <param pos="1" name="os.version"/>
529
531
  </fingerprint>
530
532
  <fingerprint pattern="^Tornado-vxWorks FTP server ready$" flags="REG_ICASE">
531
- <example>Tornado-vxWorks FTP server ready</example>
532
533
  <description>VxWorks without version information</description>
534
+ <example>Tornado-vxWorks FTP server ready</example>
533
535
  <param pos="0" name="os.vendor" value="Wind River"/>
534
536
  <param pos="0" name="os.product" value="VxWorks"/>
535
537
  </fingerprint>
@@ -851,7 +853,6 @@ against these patterns to fingerprint FTP servers.
851
853
  <param pos="2" name="hw.series"/>
852
854
  <param pos="3" name="os.version"/>
853
855
  </fingerprint>
854
-
855
856
  <fingerprint pattern="^(\S+) FTP server \((?:HP|Compaq) Tru64 UNIX Version (\S+)\) ready\.?$">
856
857
  <description>Digital/Compaq/HP Tru64 Unix</description>
857
858
  <example host.name="example.com" os.version="5.60">example.com FTP server (Compaq Tru64 UNIX Version 5.60) ready.</example>
@@ -862,7 +863,6 @@ against these patterns to fingerprint FTP servers.
862
863
  <param pos="1" name="host.name"/>
863
864
  <param pos="2" name="os.version"/>
864
865
  </fingerprint>
865
-
866
866
  <fingerprint pattern="^(\S+) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
867
867
  <description>Digital/Compaq/HP Tru64 Unix</description>
868
868
  <example host.name="example.com" os.version="5.60">example.com FTP server (Digital UNIX Version 5.60) ready.</example>
@@ -873,7 +873,6 @@ against these patterns to fingerprint FTP servers.
873
873
  <param pos="1" name="host.name"/>
874
874
  <param pos="2" name="os.version"/>
875
875
  </fingerprint>
876
-
877
876
  <fingerprint pattern="^(\S+) FTP server \(MikroTik ([\d\.]+)\) ready\.?$">
878
877
  <description>MikroTik</description>
879
878
  <example host.name="example.com" os.version="6.18">example.com FTP server (MikroTik 6.18) ready</example>
@@ -882,13 +881,11 @@ against these patterns to fingerprint FTP servers.
882
881
  <param pos="1" name="host.name"/>
883
882
  <param pos="2" name="os.version"/>
884
883
  </fingerprint>
885
-
886
884
  <fingerprint pattern="^(\S+) FTP server ready\.?$" flags="REG_ICASE">
887
885
  <description>Generic FTP fingerprint with a hostname</description>
888
886
  <example host.name="example.com">example.com FTP server ready.</example>
889
887
  <param pos="1" name="host.name"/>
890
888
  </fingerprint>
891
-
892
889
  <fingerprint pattern="^(\S+) FTP server \(Version (\d.*)\) ready\.?$" flags="REG_ICASE">
893
890
  <description>Generic FTP fingerprint with a hostname and a version for a generic FTP implementation</description>
894
891
  <example host.name="example.com" service.version="6.00LS">example.com FTP server (Version 6.00LS) ready.</example>
@@ -896,7 +893,6 @@ against these patterns to fingerprint FTP servers.
896
893
  <param pos="1" name="host.name"/>
897
894
  <param pos="2" name="service.version"/>
898
895
  </fingerprint>
899
-
900
896
  <fingerprint pattern="^FTP (?:server|service)?(?: is)? ready\.?$" flags="REG_ICASE">
901
897
  <description>Generic FTP fingerprint without a hostname</description>
902
898
  <example>FTP server is ready.</example>
@@ -904,12 +900,10 @@ against these patterns to fingerprint FTP servers.
904
900
  <example>FTP Server Ready</example>
905
901
  <example>FTP service ready.</example>
906
902
  </fingerprint>
907
-
908
903
  <fingerprint pattern="^Welcom to ProRat Ftp Server$">
909
- <description>The FTP server of the ProRat malware</description>
910
- <example>Welcom to ProRat Ftp Server</example>
911
- <param pos="0" name="service.vendor" value="Pro Group"/>
912
- <param pos="0" name="service.product" value="ProRat"/>
904
+ <description>The FTP server of the ProRat malware</description>
905
+ <example>Welcom to ProRat Ftp Server</example>
906
+ <param pos="0" name="service.vendor" value="Pro Group"/>
907
+ <param pos="0" name="service.product" value="ProRat"/>
913
908
  </fingerprint>
914
-
915
909
  </fingerprints>