recog 2.0.13 → 2.0.14
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CONTRIBUTING.md +19 -6
- data/features/{xml → data}/failing_banners_fingerprints.xml +0 -0
- data/features/{xml → data}/matching_banners_fingerprints.xml +0 -0
- data/features/{xml → data}/no_tests.xml +0 -0
- data/features/{xml/banners.xml → data/sample_banner.txt} +0 -0
- data/features/{xml → data}/successful_tests.xml +0 -0
- data/features/{xml → data}/tests_with_failures.xml +0 -0
- data/features/{xml → data}/tests_with_warnings.xml +0 -0
- data/features/match.feature +2 -2
- data/features/support/env.rb +1 -1
- data/lib/recog/version.rb +1 -1
- data/misc/order.xsl +17 -0
- data/spec/lib/fingerprint_self_test_spec.rb +8 -0
- data/xml/apache_os.xml +270 -334
- data/xml/architecture.xml +28 -41
- data/xml/fingerprints.xsd +37 -0
- data/xml/ftp_banners.xml +52 -58
- data/xml/h323_callresp.xml +597 -695
- data/xml/hp_pjl_id.xml +370 -409
- data/xml/http_cookies.xml +304 -348
- data/xml/http_servers.xml +3202 -3483
- data/xml/http_wwwauth.xml +342 -409
- data/xml/imap_banners.xml +149 -190
- data/xml/mdns_device-info_txt.xml +97 -111
- data/xml/mdns_workstation_txt.xml +6 -6
- data/xml/mysql_banners.xml +99 -198
- data/xml/mysql_error.xml +4 -11
- data/xml/nntp_banners.xml +42 -45
- data/xml/ntp_banners.xml +2 -3
- data/xml/pop_banners.xml +214 -247
- data/xml/rsh_resp.xml +68 -76
- data/xml/sip_banners.xml +19 -19
- data/xml/sip_user_agents.xml +63 -74
- data/xml/smb_native_os.xml +387 -433
- data/xml/smtp_banners.xml +1318 -1460
- data/xml/smtp_debug.xml +24 -27
- data/xml/smtp_ehlo.xml +19 -22
- data/xml/smtp_expn.xml +61 -70
- data/xml/smtp_help.xml +139 -160
- data/xml/smtp_mailfrom.xml +14 -16
- data/xml/smtp_noop.xml +28 -31
- data/xml/smtp_quit.xml +16 -18
- data/xml/smtp_rcptto.xml +8 -10
- data/xml/smtp_rset.xml +12 -13
- data/xml/smtp_turn.xml +12 -13
- data/xml/smtp_vrfy.xml +66 -76
- data/xml/snmp_sysdescr.xml +7257 -8016
- data/xml/snmp_sysobjid.xml +392 -434
- data/xml/ssh_banners.xml +783 -867
- data/xml/upnp_banners.xml +594 -628
- metadata +11 -9
data/xml/http_cookies.xml
CHANGED
|
@@ -1,285 +1,256 @@
|
|
|
1
|
-
<?xml version="1.0"?>
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
<!--
|
|
3
3
|
Set-Cookie HTTP header values are matched against these patterns to fingerprint HTTP
|
|
4
4
|
servers.
|
|
5
5
|
-->
|
|
6
|
-
|
|
7
6
|
<fingerprints matches="http_header.cookie">
|
|
8
|
-
|
|
9
|
-
|
|
7
|
+
<fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=.*">
|
|
8
|
+
<description>
|
|
10
9
|
Adobe (Macromedia) ColdFusion uses various cookies.
|
|
11
10
|
See http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_17915&sliceId=1
|
|
12
11
|
and http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_17919&sliceId=2
|
|
13
12
|
</description>
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
<description>CakePHP http://www.cakephp.org/</description>
|
|
72
|
-
<param pos="1" name="cookie"/>
|
|
73
|
-
<param pos="0" name="service.family" value="PHP"/>
|
|
74
|
-
<param pos="0" name="service.product" value="CakePHP"/>
|
|
75
|
-
</fingerprint>
|
|
76
|
-
|
|
77
|
-
<fingerprint pattern="^(ARPT)=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})([A-Z]+).*">
|
|
78
|
-
<description>Cisco 11000 Series Content Service Switch (CSS)
|
|
13
|
+
<param pos="1" name="cookie"/>
|
|
14
|
+
<param pos="0" name="service.vendor" value="Adobe"/>
|
|
15
|
+
<param pos="0" name="service.family" value="ColdFusion"/>
|
|
16
|
+
<param pos="0" name="service.product" value="ColdFusion"/>
|
|
17
|
+
</fingerprint>
|
|
18
|
+
<fingerprint pattern="^(Apache)=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]+);.*">
|
|
19
|
+
<description>Apache</description>
|
|
20
|
+
<param pos="1" name="cookie"/>
|
|
21
|
+
<param pos="2" name="system.time.micros"/>
|
|
22
|
+
<param pos="0" name="service.vendor" value="Apache"/>
|
|
23
|
+
<param pos="0" name="service.family" value="Apache"/>
|
|
24
|
+
<param pos="0" name="service.product" value="HTTPD"/>
|
|
25
|
+
</fingerprint>
|
|
26
|
+
<fingerprint pattern="^(JServSessionIdroot)=.*">
|
|
27
|
+
<description>Apache JServ</description>
|
|
28
|
+
<param pos="1" name="cookie"/>
|
|
29
|
+
<param pos="0" name="service.vendor" value="Apache"/>
|
|
30
|
+
<param pos="0" name="service.family" value="JServ"/>
|
|
31
|
+
<param pos="0" name="service.product" value="JServ"/>
|
|
32
|
+
</fingerprint>
|
|
33
|
+
<fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=.*">
|
|
34
|
+
<description>ATG Dynamo</description>
|
|
35
|
+
<param pos="1" name="cookie"/>
|
|
36
|
+
<param pos="0" name="service.vendor" value="ATG"/>
|
|
37
|
+
<param pos="0" name="service.family" value="Dynamo"/>
|
|
38
|
+
<param pos="0" name="service.product" value="Dynamo"/>
|
|
39
|
+
</fingerprint>
|
|
40
|
+
<fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);.*">
|
|
41
|
+
<description>BEA WebLogic (with timestamp)</description>
|
|
42
|
+
<param pos="1" name="cookie"/>
|
|
43
|
+
<param pos="2" name="system.time.millis"/>
|
|
44
|
+
<param pos="0" name="service.vendor" value="BEA"/>
|
|
45
|
+
<param pos="0" name="service.family" value="WebLogic"/>
|
|
46
|
+
<param pos="0" name="service.product" value="WebLogic"/>
|
|
47
|
+
</fingerprint>
|
|
48
|
+
<fingerprint pattern="^(WebLogicSession)=.*">
|
|
49
|
+
<description>BEA WebLogic (no timestamp)</description>
|
|
50
|
+
<param pos="1" name="cookie"/>
|
|
51
|
+
<param pos="0" name="service.vendor" value="BEA"/>
|
|
52
|
+
<param pos="0" name="service.family" value="WebLogic"/>
|
|
53
|
+
<param pos="0" name="service.product" value="WebLogic"/>
|
|
54
|
+
</fingerprint>
|
|
55
|
+
<fingerprint pattern="^(BCSI-CSC[0-9A-Za-z]+)=.*">
|
|
56
|
+
<description>BlueCoat Proxy</description>
|
|
57
|
+
<param pos="1" name="cookie"/>
|
|
58
|
+
<param pos="0" name="service.vendor" value="Blue Coat"/>
|
|
59
|
+
<param pos="0" name="service.family" value="Proxy"/>
|
|
60
|
+
<param pos="0" name="service.product" value="Proxy"/>
|
|
61
|
+
</fingerprint>
|
|
62
|
+
<fingerprint pattern="^(CAKEPHP)=.*">
|
|
63
|
+
<description>CakePHP http://www.cakephp.org/</description>
|
|
64
|
+
<param pos="1" name="cookie"/>
|
|
65
|
+
<param pos="0" name="service.family" value="PHP"/>
|
|
66
|
+
<param pos="0" name="service.product" value="CakePHP"/>
|
|
67
|
+
</fingerprint>
|
|
68
|
+
<fingerprint pattern="^(ARPT)=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})([A-Z]+).*">
|
|
69
|
+
<description>Cisco 11000 Series Content Service Switch (CSS)
|
|
79
70
|
http://www.cisco.com/warp/public/117/AP_cookies.html
|
|
80
71
|
|
|
81
72
|
The cookie value breaks down to [box-id][service-id][timeout-value]
|
|
82
73
|
unfortunately, there's no separator so it's hard to tell what the
|
|
83
74
|
actual break is between the pieces of data.
|
|
84
75
|
</description>
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
<description>Cisco 11000 Series Content Service Switch (CSS)
|
|
76
|
+
<param pos="1" name="cookie"/>
|
|
77
|
+
<param pos="2" name="host.id"/>
|
|
78
|
+
<param pos="3" name="host.ip"/>
|
|
79
|
+
<param pos="4" name="timeout"/>
|
|
80
|
+
<param pos="0" name="service.vendor" value="Cisco"/>
|
|
81
|
+
<param pos="0" name="service.family" value="Content Service Switch"/>
|
|
82
|
+
<param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
|
|
83
|
+
</fingerprint>
|
|
84
|
+
<fingerprint pattern="^(ARPT)=.*">
|
|
85
|
+
<description>Cisco 11000 Series Content Service Switch (CSS)
|
|
96
86
|
http://www.cisco.com/warp/public/117/AP_cookies.html
|
|
97
87
|
|
|
98
88
|
The cookie value breaks down to [box-id][service-id][timeout-value]
|
|
99
89
|
unfortunately, there's no separator so it's hard to tell what the
|
|
100
90
|
actual break is between the pieces of data.
|
|
101
91
|
</description>
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
<description>Citrix Application Protection System, Enterprise
|
|
92
|
+
<param pos="1" name="cookie"/>
|
|
93
|
+
<param pos="0" name="service.vendor" value="Cisco"/>
|
|
94
|
+
<param pos="0" name="service.family" value="Content Service Switch"/>
|
|
95
|
+
<param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
|
|
96
|
+
</fingerprint>
|
|
97
|
+
<fingerprint pattern="^(st8id)=.*">
|
|
98
|
+
<description>Citrix Application Protection System, Enterprise
|
|
110
99
|
http://support.citrix.com/article/CTX109330
|
|
111
100
|
</description>
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
<description>Ektron CMS400.net
|
|
101
|
+
<param pos="1" name="cookie"/>
|
|
102
|
+
<param pos="0" name="service.vendor" value="Citrix"/>
|
|
103
|
+
<param pos="0" name="service.family" value="Application Protection System"/>
|
|
104
|
+
<param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
|
|
105
|
+
</fingerprint>
|
|
106
|
+
<fingerprint pattern="^(EktGUID|ecm)=.*">
|
|
107
|
+
<description>Ektron CMS400.net
|
|
120
108
|
http://www.ektron.com/developers/cms400kb.cfm?id=2174
|
|
121
109
|
</description>
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
<description>F5 BIG-IP LTM
|
|
110
|
+
<param pos="1" name="cookie"/>
|
|
111
|
+
<param pos="0" name="service.vendor" value="Ektron"/>
|
|
112
|
+
<param pos="0" name="service.family" value="CMS400.NET"/>
|
|
113
|
+
<param pos="0" name="service.product" value="CMS400.NET"/>
|
|
114
|
+
</fingerprint>
|
|
115
|
+
<fingerprint pattern="^(BIGipServer([^=]+))=.*">
|
|
116
|
+
<description>F5 BIG-IP LTM
|
|
130
117
|
http://www.f5.com/solutions/deployment/pdfs/peoplesoft-ltm-dg.pdf
|
|
131
118
|
http://www.f5.com/solutions/deployment/pdfs/SAP_v94_dg.pdf
|
|
132
119
|
</description>
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
<description>F5 BIG-IP LTM
|
|
120
|
+
<param pos="1" name="cookie"/>
|
|
121
|
+
<param pos="2" name="loadbalancer.poolname"/>
|
|
122
|
+
<param pos="0" name="service.vendor" value="F5 Labs"/>
|
|
123
|
+
<param pos="0" name="service.family" value="BIG-IP"/>
|
|
124
|
+
<param pos="0" name="service.product" value="BIG-IP LTM"/>
|
|
125
|
+
</fingerprint>
|
|
126
|
+
<fingerprint pattern="^(BigIPCookie)=.*">
|
|
127
|
+
<description>F5 BIG-IP LTM
|
|
142
128
|
http://www.f5.com/solutions/deployment/pdfs/peoplesoft-ltm-dg.pdf
|
|
143
129
|
http://www.f5.com/solutions/deployment/pdfs/SAP_v94_dg.pdf
|
|
144
130
|
</description>
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
<description>HAProxy
|
|
131
|
+
<param pos="1" name="cookie"/>
|
|
132
|
+
<param pos="0" name="service.vendor" value="F5 Labs"/>
|
|
133
|
+
<param pos="0" name="service.family" value="BIG-IP"/>
|
|
134
|
+
<param pos="0" name="service.product" value="BIG-IP LTM"/>
|
|
135
|
+
</fingerprint>
|
|
136
|
+
<fingerprint pattern="^(SERVERID)=([A-Za-z0-9\-_]+)">
|
|
137
|
+
<description>HAProxy
|
|
153
138
|
http://haproxy.1wt.eu/download/1.2/doc/architecture.txt
|
|
154
139
|
</description>
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
<description>IBM Tivoli Access Manager for e-business WebSEAL
|
|
140
|
+
<param pos="1" name="cookie"/>
|
|
141
|
+
<param pos="2" name="host.name"/>
|
|
142
|
+
<param pos="0" name="service.family" value="HAProxy"/>
|
|
143
|
+
<param pos="0" name="service.product" value="HAProxy"/>
|
|
144
|
+
</fingerprint>
|
|
145
|
+
<fingerprint pattern="^(AMWEBJCT!([^!]+)!([^=]+))=.*">
|
|
146
|
+
<description>IBM Tivoli Access Manager for e-business WebSEAL
|
|
163
147
|
http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin180.htm
|
|
164
148
|
</description>
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
<description>IBM Tivoli Access Manager for e-business WebSeal
|
|
149
|
+
<param pos="1" name="cookie"/>
|
|
150
|
+
<param pos="2" name="junction.name"/>
|
|
151
|
+
<param pos="3" name="junction.cookie"/>
|
|
152
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
153
|
+
<param pos="0" name="service.family" value="Tivoli"/>
|
|
154
|
+
<param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
|
|
155
|
+
</fingerprint>
|
|
156
|
+
<fingerprint pattern="^(PD-S-SESSION-ID|PD-H-SESSION-ID|PD_STATEFUL_[^=]+)=.*">
|
|
157
|
+
<description>IBM Tivoli Access Manager for e-business WebSeal
|
|
175
158
|
http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin117.htm
|
|
176
159
|
</description>
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
<description>IBM WebSphere Load Balancer
|
|
160
|
+
<param pos="1" name="cookie"/>
|
|
161
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
162
|
+
<param pos="0" name="service.family" value="Tivoli"/>
|
|
163
|
+
<param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
|
|
164
|
+
</fingerprint>
|
|
165
|
+
<fingerprint pattern="^(IBMCBR)=.*">
|
|
166
|
+
<description>IBM WebSphere Load Balancer
|
|
185
167
|
http://www-306.ibm.com/software/webservers/appserv/doc/v51/ec/infocenter/edge/LBguide.htm
|
|
186
168
|
</description>
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
<description>Joom!Fish http://www.joomfish.net/
|
|
169
|
+
<param pos="1" name="cookie"/>
|
|
170
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
171
|
+
<param pos="0" name="service.family" value="WebSphere"/>
|
|
172
|
+
<param pos="0" name="service.product" value="WebSphere Load Balancer"/>
|
|
173
|
+
</fingerprint>
|
|
174
|
+
<fingerprint pattern="^(mbfcookie(?:\[lang\])?)=.*">
|
|
175
|
+
<description>Joom!Fish http://www.joomfish.net/
|
|
195
176
|
</description>
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
<description>Microsoft Commerce Server
|
|
177
|
+
<param pos="1" name="cookie"/>
|
|
178
|
+
<param pos="0" name="service.family" value="Joom!Fish"/>
|
|
179
|
+
<param pos="0" name="service.product" value="Joom!Fish"/>
|
|
180
|
+
</fingerprint>
|
|
181
|
+
<fingerprint pattern="^(MSCSAuth|MSCSProfile)=.*">
|
|
182
|
+
<description>Microsoft Commerce Server
|
|
203
183
|
http://msdn2.microsoft.com/en-us/library/ms953828.aspx
|
|
204
184
|
</description>
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
<description>Microsoft IIS (ASP.NET)
|
|
185
|
+
<param pos="1" name="cookie"/>
|
|
186
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
187
|
+
<param pos="0" name="service.family" value="Commerce Server"/>
|
|
188
|
+
<param pos="0" name="service.product" value="Commerce Server"/>
|
|
189
|
+
</fingerprint>
|
|
190
|
+
<fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=.*">
|
|
191
|
+
<description>Microsoft IIS (ASP.NET)
|
|
213
192
|
http://msdn2.microsoft.com/en-us/library/ms953828.aspx
|
|
214
193
|
http://support.microsoft.com/kb/899918
|
|
215
194
|
http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
|
|
216
195
|
</description>
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
259
|
-
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
|
|
275
|
-
<description>Siebel CRM</description>
|
|
276
|
-
<param pos="1" name="cookie"/>
|
|
277
|
-
<param pos="0" name="service.vendor" value="Siebel"/>
|
|
278
|
-
<param pos="0" name="service.family" value="CRM"/>
|
|
279
|
-
<param pos="0" name="service.product" value="CRM"/>
|
|
280
|
-
</fingerprint>
|
|
281
|
-
|
|
282
|
-
<!-- This fingerprint is not specific enough. Multiple products are sold under
|
|
196
|
+
<param pos="1" name="cookie"/>
|
|
197
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
198
|
+
<param pos="0" name="service.family" value="IIS"/>
|
|
199
|
+
<param pos="0" name="service.product" value="IIS"/>
|
|
200
|
+
<param pos="0" name="service.component.vendor" value="Microsoft"/>
|
|
201
|
+
<param pos="0" name="service.component.family" value="ASP.NET"/>
|
|
202
|
+
<param pos="0" name="service.component.product" value="ASP.NET"/>
|
|
203
|
+
</fingerprint>
|
|
204
|
+
<fingerprint pattern="^(AlteonP)=.*">
|
|
205
|
+
<description>Nortel Alteon Web Switch</description>
|
|
206
|
+
<param pos="1" name="cookie"/>
|
|
207
|
+
<param pos="0" name="service.vendor" value="Nortel"/>
|
|
208
|
+
<param pos="0" name="service.family" value="Alteon"/>
|
|
209
|
+
<param pos="0" name="service.product" value="Alteon Web Switch"/>
|
|
210
|
+
</fingerprint>
|
|
211
|
+
<fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=.*">
|
|
212
|
+
<description>OpenMarket/FatWire Content Server (www.fatwire.com)</description>
|
|
213
|
+
<param pos="1" name="cookie"/>
|
|
214
|
+
<param pos="0" name="service.vendor" value="FatWire"/>
|
|
215
|
+
<param pos="0" name="service.family" value="Content Server"/>
|
|
216
|
+
<param pos="0" name="service.product" value="Content Server"/>
|
|
217
|
+
</fingerprint>
|
|
218
|
+
<fingerprint pattern="^(parkinglot)=.*">
|
|
219
|
+
<description>Oversee Webserver</description>
|
|
220
|
+
<param pos="1" name="cookie"/>
|
|
221
|
+
<param pos="0" name="service.vendor" value="Oversee"/>
|
|
222
|
+
<param pos="0" name="service.family" value="Webserver"/>
|
|
223
|
+
<param pos="0" name="service.product" value="Webserver"/>
|
|
224
|
+
</fingerprint>
|
|
225
|
+
<fingerprint pattern="^(PHPSESSID|PHPSESSION)=.*">
|
|
226
|
+
<description>PHP http://www.php.net/ref.session</description>
|
|
227
|
+
<param pos="1" name="cookie"/>
|
|
228
|
+
<param pos="0" name="service.vendor" value="PHP"/>
|
|
229
|
+
<param pos="0" name="service.family" value="PHP"/>
|
|
230
|
+
<param pos="0" name="service.product" value="PHP"/>
|
|
231
|
+
</fingerprint>
|
|
232
|
+
<fingerprint pattern="^(RMID)=.*">
|
|
233
|
+
<description>RealMedia OpenAdStream</description>
|
|
234
|
+
<param pos="1" name="cookie"/>
|
|
235
|
+
<param pos="0" name="service.vendor" value="RealMedia"/>
|
|
236
|
+
<param pos="0" name="service.family" value="OpenAdStream"/>
|
|
237
|
+
<param pos="0" name="service.product" value="OpenAdStream"/>
|
|
238
|
+
</fingerprint>
|
|
239
|
+
<fingerprint pattern="^(RoxenUserID)=.*">
|
|
240
|
+
<description>Roxen WebServer</description>
|
|
241
|
+
<param pos="1" name="cookie"/>
|
|
242
|
+
<param pos="0" name="service.vendor" value="Roxen"/>
|
|
243
|
+
<param pos="0" name="service.family" value="WebServer"/>
|
|
244
|
+
<param pos="0" name="service.product" value="WebServer"/>
|
|
245
|
+
</fingerprint>
|
|
246
|
+
<fingerprint pattern="^(_sn)=.*">
|
|
247
|
+
<description>Siebel CRM</description>
|
|
248
|
+
<param pos="1" name="cookie"/>
|
|
249
|
+
<param pos="0" name="service.vendor" value="Siebel"/>
|
|
250
|
+
<param pos="0" name="service.family" value="CRM"/>
|
|
251
|
+
<param pos="0" name="service.product" value="CRM"/>
|
|
252
|
+
</fingerprint>
|
|
253
|
+
<!-- This fingerprint is not specific enough. Multiple products are sold under
|
|
283
254
|
the brand iPlanet/Sun ONE/Sun Java.
|
|
284
255
|
<fingerprint pattern="^(iPlanetUserId)=.*">
|
|
285
256
|
<description>Sun iPlanet</description>
|
|
@@ -289,128 +260,113 @@ servers.
|
|
|
289
260
|
<param pos="0" name="service.product" value="???"/>
|
|
290
261
|
</fingerprint>
|
|
291
262
|
-->
|
|
292
|
-
|
|
293
|
-
|
|
294
|
-
<description>Netscape Enterprise Server (subsequently iPlanet Web Server,
|
|
263
|
+
<fingerprint pattern="^(NSES40Session)=.*">
|
|
264
|
+
<description>Netscape Enterprise Server (subsequently iPlanet Web Server,
|
|
295
265
|
Sun ONE Web Server, presently Sun Java System Web Server)</description>
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
|
|
300
|
-
|
|
301
|
-
|
|
302
|
-
|
|
303
|
-
|
|
304
|
-
<description>Sun Java System Application Server (formerly iPlanet Application Server,
|
|
266
|
+
<param pos="1" name="cookie"/>
|
|
267
|
+
<param pos="0" name="service.vendor" value="Sun"/>
|
|
268
|
+
<param pos="0" name="service.family" value="Java System Web Server"/>
|
|
269
|
+
<param pos="0" name="service.product" value="Java System Web Server"/>
|
|
270
|
+
<param pos="0" name="service.version" value="4.0"/>
|
|
271
|
+
</fingerprint>
|
|
272
|
+
<fingerprint pattern="^(gx_session_id|JROUTE)=.*">
|
|
273
|
+
<description>Sun Java System Application Server (formerly iPlanet Application Server,
|
|
305
274
|
Sun ONE Application Server)</description>
|
|
306
|
-
|
|
307
|
-
|
|
308
|
-
|
|
309
|
-
|
|
310
|
-
|
|
311
|
-
|
|
312
|
-
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
|
|
323
|
-
|
|
324
|
-
|
|
325
|
-
|
|
326
|
-
|
|
327
|
-
|
|
328
|
-
<fingerprint pattern="^(__utm[a-z])=.*">
|
|
329
|
-
<description>Urchin Tracking Module
|
|
275
|
+
<param pos="1" name="cookie"/>
|
|
276
|
+
<param pos="0" name="service.vendor" value="Sun"/>
|
|
277
|
+
<param pos="0" name="service.family" value="Java System Application Server"/>
|
|
278
|
+
<param pos="0" name="service.product" value="Java System Application Server"/>
|
|
279
|
+
</fingerprint>
|
|
280
|
+
<fingerprint pattern="^(fe_typo_user)=.*">
|
|
281
|
+
<description>TYPO3 CMS - http://typo3.com/</description>
|
|
282
|
+
<param pos="1" name="cookie"/>
|
|
283
|
+
<param pos="0" name="service.vendor" value="TYPO3"/>
|
|
284
|
+
<param pos="0" name="service.family" value="CMS"/>
|
|
285
|
+
<param pos="0" name="service.product" value="CMS"/>
|
|
286
|
+
</fingerprint>
|
|
287
|
+
<fingerprint pattern="^(SaneID)=.*">
|
|
288
|
+
<description>Unica NetTracker - http://netinsight.unica.com/Products/NetTracker.cfm</description>
|
|
289
|
+
<param pos="1" name="cookie"/>
|
|
290
|
+
<param pos="0" name="service.vendor" value="Unica"/>
|
|
291
|
+
<param pos="0" name="service.family" value="NetTracker"/>
|
|
292
|
+
<param pos="0" name="service.product" value="NetTracker"/>
|
|
293
|
+
</fingerprint>
|
|
294
|
+
<fingerprint pattern="^(__utm[a-z])=.*">
|
|
295
|
+
<description>Urchin Tracking Module
|
|
330
296
|
http://www.google.com/support/urchin45/bin/answer.py?answer=28307&topic=7425
|
|
331
297
|
</description>
|
|
332
|
-
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
|
|
347
|
-
|
|
348
|
-
|
|
349
|
-
|
|
350
|
-
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
|
|
354
|
-
|
|
355
|
-
|
|
356
|
-
|
|
357
|
-
|
|
358
|
-
|
|
359
|
-
|
|
360
|
-
|
|
361
|
-
|
|
362
|
-
|
|
363
|
-
|
|
364
|
-
|
|
365
|
-
|
|
366
|
-
<param pos="0" name="service.product" value="Zope"/>
|
|
367
|
-
</fingerprint>
|
|
368
|
-
|
|
369
|
-
<fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+).*">
|
|
370
|
-
<description>This is the default OracleAS Portal cookie name
|
|
298
|
+
<param pos="1" name="cookie"/>
|
|
299
|
+
<param pos="0" name="service.vendor" value="Google"/>
|
|
300
|
+
<param pos="0" name="service.family" value="Urchin"/>
|
|
301
|
+
<param pos="0" name="service.product" value="Urchin Tracking Module"/>
|
|
302
|
+
</fingerprint>
|
|
303
|
+
<fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=.*">
|
|
304
|
+
<description>Vignette</description>
|
|
305
|
+
<param pos="1" name="cookie"/>
|
|
306
|
+
<param pos="0" name="service.vendor" value="Vignette"/>
|
|
307
|
+
<param pos="0" name="service.family" value="Vignette"/>
|
|
308
|
+
<param pos="0" name="service.product" value="Vignette"/>
|
|
309
|
+
</fingerprint>
|
|
310
|
+
<fingerprint pattern="^(wgSession)=.*">
|
|
311
|
+
<description>Plain Black WebGUI - http://www.plainblack.com/webgui</description>
|
|
312
|
+
<param pos="1" name="cookie"/>
|
|
313
|
+
<param pos="0" name="service.vendor" value="Plain Black"/>
|
|
314
|
+
<param pos="0" name="service.family" value="WebGUI"/>
|
|
315
|
+
<param pos="0" name="service.product" value="WebGUI"/>
|
|
316
|
+
</fingerprint>
|
|
317
|
+
<fingerprint pattern="^(WEBTRENDSID|WEBTRENDS_ID)=.*">
|
|
318
|
+
<description>WebTrends</description>
|
|
319
|
+
<param pos="1" name="cookie"/>
|
|
320
|
+
<param pos="0" name="service.vendor" value="WebTrends"/>
|
|
321
|
+
<param pos="0" name="service.family" value="WebTrends"/>
|
|
322
|
+
<param pos="0" name="service.product" value="WebTrends"/>
|
|
323
|
+
</fingerprint>
|
|
324
|
+
<fingerprint pattern="^(_ZopeId)=.*">
|
|
325
|
+
<description>Zope</description>
|
|
326
|
+
<param pos="1" name="cookie"/>
|
|
327
|
+
<param pos="0" name="service.family" value="Zope"/>
|
|
328
|
+
<param pos="0" name="service.product" value="Zope"/>
|
|
329
|
+
</fingerprint>
|
|
330
|
+
<fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+).*">
|
|
331
|
+
<description>This is the default OracleAS Portal cookie name
|
|
371
332
|
http://download.oracle.com/docs/cd/B14099_19/portal.1014/b19305/cg_app_f.htm
|
|
372
333
|
</description>
|
|
373
|
-
|
|
374
|
-
|
|
375
|
-
|
|
376
|
-
|
|
377
|
-
|
|
378
|
-
|
|
379
|
-
|
|
380
|
-
<
|
|
381
|
-
|
|
382
|
-
|
|
383
|
-
|
|
384
|
-
|
|
385
|
-
|
|
386
|
-
|
|
387
|
-
|
|
388
|
-
|
|
389
|
-
<!--
|
|
334
|
+
<param pos="1" name="cookie"/>
|
|
335
|
+
<param pos="2" name="service.version"/>
|
|
336
|
+
<param pos="0" name="service.vendor" value="Oracle"/>
|
|
337
|
+
<param pos="0" name="service.family" value="OracleAS"/>
|
|
338
|
+
<param pos="0" name="service.product" value="OracleAS Portal"/>
|
|
339
|
+
</fingerprint>
|
|
340
|
+
<fingerprint pattern="^Compaq-HMMD=[^;]+;.*$">
|
|
341
|
+
<description>HP System Management Homepage (SMH)</description>
|
|
342
|
+
<example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/</example>
|
|
343
|
+
<example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/; Secure</example>
|
|
344
|
+
<param pos="0" name="service.vendor" value="HP"/>
|
|
345
|
+
<param pos="0" name="service.family" value="SMH"/>
|
|
346
|
+
<param pos="0" name="service.product" value="SMH"/>
|
|
347
|
+
</fingerprint>
|
|
348
|
+
<!--
|
|
390
349
|
Ignore various cookies that are very generic cookies for session IDs
|
|
391
350
|
that are not necessarily indicative of any particular
|
|
392
351
|
product/device/etc. If a future fingerprint comes along that utilizes
|
|
393
352
|
a similar cookie name, you must ensure that it is located prior to
|
|
394
353
|
these and this is enforced by rspec.
|
|
395
354
|
-->
|
|
396
|
-
|
|
397
|
-
<
|
|
398
|
-
|
|
399
|
-
|
|
400
|
-
|
|
401
|
-
|
|
402
|
-
|
|
403
|
-
|
|
404
|
-
<
|
|
405
|
-
|
|
406
|
-
|
|
407
|
-
|
|
408
|
-
|
|
409
|
-
|
|
410
|
-
</
|
|
411
|
-
|
|
412
|
-
|
|
413
|
-
<description>Ignore simple SID and related cookies</description>
|
|
414
|
-
<example>sid=sfd10bf73-654458f687aa3c68b3874915f651e0ca;path=/;"</example>
|
|
415
|
-
</fingerprint>
|
|
355
|
+
<fingerprint pattern="^JSESSIONID(?:\.[^=]+)?=[^;]+;.*$" flags="REG_ICASE">
|
|
356
|
+
<description>Ignore simple JSESSIONID and related cookies</description>
|
|
357
|
+
<example>JSESSIONID=6ooov35i4l3n36qtaf8csvg0;Path=/</example>
|
|
358
|
+
<example>jsessionid=6nkp66iogcdc92720%2Dc6e4%2D4989%2Db7b2%2D5021624cfdff;Path=/;secure</example>
|
|
359
|
+
<example>JSESSIONID.c00a9623=v216643eijh19p9duve5srgf;Path=/;HttpOnly</example>
|
|
360
|
+
</fingerprint>
|
|
361
|
+
<fingerprint pattern="^_?SESSION_?ID\s*=\s*[^;]+;.*$" flags="REG_ICASE">
|
|
362
|
+
<description>Ignore simple SESSIONID and related cookies</description>
|
|
363
|
+
<example>sessionId=7dba3249cfcd4b59854055311099a294; path=/;</example>
|
|
364
|
+
<example>_session_id=7fe933db0fea13e9c872103ba2d142db; path=/; HttpOnly</example>
|
|
365
|
+
<example>sessionId =0VrS6Ro6uC5QPXKgNdqGvyUgUFtUOVwv6OWAEWcWQ3jLRtAk2TVAgAApN9yTWVz;postId=; path=/;</example>
|
|
366
|
+
<example>_session_id=18b3e173aa11db0533fd01752e81f583; path=/; HttpOnly</example>
|
|
367
|
+
</fingerprint>
|
|
368
|
+
<fingerprint pattern="^sid=[^;]+;.*$" flags="REG_ICASE">
|
|
369
|
+
<description>Ignore simple SID and related cookies</description>
|
|
370
|
+
<example>sid=sfd10bf73-654458f687aa3c68b3874915f651e0ca;path=/;"</example>
|
|
371
|
+
</fingerprint>
|
|
416
372
|
</fingerprints>
|