recog 2.0.2 → 2.0.4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (10) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/fingerprint.rb +1 -0
  3. data/lib/recog/version.rb +1 -1
  4. data/xml/ftp_banners.xml +41 -4
  5. data/xml/http_servers.xml +54 -16
  6. data/xml/ntp_banners.xml +54 -0
  7. data/xml/smtp_banners.xml +123 -8
  8. data/xml/snmp_sysdescr.xml +97 -36
  9. data/xml/ssh_banners.xml +23 -5
  10. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 4d0880aa5a5cd1e10fa8183009a690fc68714576
4
- data.tar.gz: 55226bd9acf2c7c225a3124d668cf3e2e45e5a98
3
+ metadata.gz: 6658b1a0db868ef63c21649455ae64a7278dfe98
4
+ data.tar.gz: aa65f71001901ef71867cdef929463436d0f2876
5
5
  SHA512:
6
- metadata.gz: fc0bdb44da83731fd6f89d980e190452ec608214d3bbfa01215019a410596e9f8f8c781c5fe5ed5bf525651dea476839ddce98ba7f1ead3c09b29d14b6d1d11c
7
- data.tar.gz: 60f9022a1720e422a5d4558e98960c4c9efe4fe5ee4cee04064eb05b4b757a5b0d75fa40c5e80cd2cbe1a1a6b4da0a1950ba36ff27196da1727699a5f37b3b72
6
+ metadata.gz: c76a54a3b53c0ad113e47ed41e0890bf2a93a9f496b644d7f42a70ce414b4add1eb9a0f50f519fa8c18bc592fdcfd93f9ad362633872e22514b208d9a7eb4ece
7
+ data.tar.gz: 0ce9bb4c5333affcfc63cc9cf1f03f770b5caa122799d16b4e60da653a1cd92b2a054cb2fffa4496d75f9ccc01b1d581c3b01456314ea723cc861ac27e1f8761
data/lib/recog/fingerprint.rb CHANGED
@@ -42,6 +42,7 @@ class Fingerprint
42
42
  # @param match_string [String]
43
43
  # @return [Hash,nil] Keys will be host, service, and os attributes
44
44
  def match(match_string)
45
+ # match_string.force_encoding('BINARY') if match_string
45
46
  match_data = @regex.match(match_string)
46
47
  return if match_data.nil?
47
48
 
data/lib/recog/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Recog
2
- VERSION = '2.0.2'
2
+ VERSION = '2.0.4'
3
3
  end
data/xml/ftp_banners.xml CHANGED
@@ -93,11 +93,12 @@ against these patterns to fingerprint FTP servers.
93
93
  <param pos="1" name="host.name"/>
94
94
  <param pos="2" name="service.version"/>
95
95
  </fingerprint>
96
- <fingerprint pattern="^(\S+)(?: \S+)? FTP Server \(Version wu(?:ftpd)?-([\d\.]+).*\) ready.?$" flags="REG_ICASE">
96
+ <fingerprint pattern="^(\S+)(?: \S+)? FTP Server \((?:Revision [\d\.]+ )?Version wu(?:ftpd)?-([\d\.]+).*\) ready.?$" flags="REG_ICASE">
97
97
  <description>WU-FTPD on various OS</description>
98
- <example>example.com FTP server (Version wu-2.6.2(1) Sat Jul 19 16:21:30 UTC 2008) ready.</example>
99
- <example>example.com 192.168.0.1 FTP server (Version wu-2.6.2(1) Wed Sep 21 11:16:21 MEST 2005) ready.</example>
100
- <example>example.com FTP server (Version wu-2.6.2-11.73.1) ready.</example>
98
+ <example host.name="example.com" service.version="2.6.2">example.com FTP server (Version wu-2.6.2(1) Sat Jul 19 16:21:30 UTC 2008) ready.</example>
99
+ <example host.name="example.com" service.version="2.6.2">example.com 192.168.0.1 FTP server (Version wu-2.6.2(1) Wed Sep 21 11:16:21 MEST 2005) ready.</example>
100
+ <example host.name="example.com" service.version="2.6.2">example.com FTP server (Version wu-2.6.2-11.73.1) ready.</example>
101
+ <example host.name="example.com" service.version="2.6.1">example.com FTP server (Revision 5.0 Version wuftpd-2.6.1 Thu Apr 29 06:48:40 GMT 2010) ready.</example>
101
102
  <param pos="0" name="service.vendor" value="Washington University"/>
102
103
  <param pos="0" name="service.product" value="WU-FTPD"/>
103
104
  <param pos="1" name="host.name"/>
@@ -817,4 +818,40 @@ against these patterns to fingerprint FTP servers.
817
818
  <param pos="2" name="hw.series"/>
818
819
  <param pos="3" name="os.version"/>
819
820
  </fingerprint>
821
+
822
+ <fingerprint pattern="^(\S+) FTP server \((?:HP|Compaq) Tru64 UNIX Version (\S+)\) ready\.?$">
823
+ <description>Digital/Compaq/HP Tru64 Unix</description>
824
+ <example host.name="example.com" os.version="5.60">example.com FTP server (Compaq Tru64 UNIX Version 5.60) ready.</example>
825
+ <param pos="0" name="os.vendor" value="HP"/>
826
+ <param pos="0" name="os.family" value="Unix"/>
827
+ <param pos="0" name="os.product" value="Tru64 Unix"/>
828
+ <param pos="0" name="os.device" value="General"/>
829
+ <param pos="1" name="host.name"/>
830
+ <param pos="2" name="os.version"/>
831
+ </fingerprint>
832
+
833
+ <fingerprint pattern="^(\S+) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
834
+ <description>Digital/Compaq/HP Tru64 Unix</description>
835
+ <example host.name="example.com" os.version="5.60">example.com FTP server (Digital UNIX Version 5.60) ready.</example>
836
+ <param pos="0" name="os.vendor" value="HP"/>
837
+ <param pos="0" name="os.family" value="Unix"/>
838
+ <param pos="0" name="os.product" value="Digital Unix"/>
839
+ <param pos="0" name="os.device" value="General"/>
840
+ <param pos="1" name="host.name"/>
841
+ <param pos="2" name="os.version"/>
842
+ </fingerprint>
843
+
844
+ <fingerprint pattern="^(\S+) FTP server ready.?$" flags="REG_ICASE">
845
+ <description>Generic FTP fingerprint with a hostname</description>
846
+ <example host.name="example.com">example.com FTP server ready.</example>
847
+ <param pos="1" name="host.name"/>
848
+ </fingerprint>
849
+
850
+ <fingerprint pattern="^FTP (?:server|service)?(?: is)? ready\.?$" flags="REG_ICASE">
851
+ <description>Generic FTP fingerprint without a hostname</description>
852
+ <example>FTP server is ready.</example>
853
+ <example>FTP Server ready.</example>
854
+ <example>FTP Server Ready</example>
855
+ <example>FTP service ready.</example>
856
+ </fingerprint>
820
857
  </fingerprints>
data/xml/http_servers.xml CHANGED
@@ -1874,7 +1874,15 @@
1874
1874
  <param pos="0" name="service.product" value="HTTP"/>
1875
1875
  <param pos="0" name="service.family" value="Compaq HTTP Server"/>
1876
1876
  <param pos="1" name="service.version"/>
1877
- </fingerprint>
1877
+ </fingerprint>
1878
+
1879
+ <fingerprint pattern="^HPSMH$">
1880
+ <description>HP System Management Homepage (SMH)</description>
1881
+ <example>HPSMH</example>
1882
+ <param pos="0" name="service.vendor" value="HP"/>
1883
+ <param pos="0" name="service.family" value="SMH"/>
1884
+ <param pos="0" name="service.product" value="SMH"/>
1885
+ </fingerprint>
1878
1886
 
1879
1887
  <fingerprint pattern="^eHTTP[/ ]v?(\d+\.\d+)" flags="REG_ICASE">
1880
1888
  <example service.version="1.1">EHTTP/1.1</example>
@@ -1896,6 +1904,7 @@
1896
1904
  <example service.component.version="0.0.1">BBC 2.6.0.7; com.hp.openview.Coda 0.0.1</example>
1897
1905
  <param pos="0" name="service.vendor" value="HP"/>
1898
1906
  <param pos="0" name="service.family" value="OpenView"/>
1907
+ <param pos="0" name="service.product" value="OpenView"/>
1899
1908
  <param pos="0" name="service.component.vendor" value="HP"/>
1900
1909
  <param pos="0" name="service.component.family" value="OpenView"/>
1901
1910
  <param pos="0" name="service.component.product" value="CODA"/>
@@ -1907,6 +1916,7 @@
1907
1916
  <example service.component.version="11.00.044">BBC 11.00.044; ovbbcrcp 11.00.044</example>
1908
1917
  <param pos="0" name="service.vendor" value="HP"/>
1909
1918
  <param pos="0" name="service.family" value="OpenView"/>
1919
+ <param pos="0" name="service.product" value="OpenView"/>
1910
1920
  <param pos="0" name="service.component.vendor" value="HP"/>
1911
1921
  <param pos="0" name="service.component.family" value="OpenView"/>
1912
1922
  <param pos="0" name="service.component.product" value="Reverse Channel Proxy"/>
@@ -1919,6 +1929,7 @@
1919
1929
  <example service.component.version="2.6.0.7">BBC 2.6.0.7; com.hp.openview.bbc.LLBServer 2.6.0.7</example>
1920
1930
  <param pos="0" name="service.vendor" value="HP"/>
1921
1931
  <param pos="0" name="service.family" value="OpenView"/>
1932
+ <param pos="0" name="service.product" value="OpenView"/>
1922
1933
  <param pos="0" name="service.component.vendor" value="HP"/>
1923
1934
  <param pos="0" name="service.component.family" value="OpenView"/>
1924
1935
  <param pos="0" name="service.component.product" value="LLBServer"/>
@@ -1931,6 +1942,7 @@
1931
1942
  <example service.component.version="11.10.035">BBC 11.10.035; ovbbccb 11.10.035</example>
1932
1943
  <param pos="0" name="service.vendor" value="HP"/>
1933
1944
  <param pos="0" name="service.family" value="OpenView"/>
1945
+ <param pos="0" name="service.product" value="OpenView"/>
1934
1946
  <param pos="0" name="service.component.vendor" value="HP"/>
1935
1947
  <param pos="0" name="service.component.family" value="OpenView"/>
1936
1948
  <param pos="0" name="service.component.product" value="Communication Broker"/>
@@ -1942,6 +1954,7 @@
1942
1954
  <example>BBC 11.13.007; ovbbccb unknown version</example>
1943
1955
  <param pos="0" name="service.vendor" value="HP"/>
1944
1956
  <param pos="0" name="service.family" value="OpenView"/>
1957
+ <param pos="0" name="service.product" value="OpenView"/>
1945
1958
  <param pos="0" name="service.component.vendor" value="HP"/>
1946
1959
  <param pos="0" name="service.component.family" value="OpenView"/>
1947
1960
  <param pos="0" name="service.component.product" value="Communication Broker"/>
@@ -2680,10 +2693,11 @@
2680
2693
  <param pos="0" name="os.product" value="JetDirect"/>
2681
2694
  </fingerprint>
2682
2695
 
2683
- <fingerprint pattern="^HP HTTP Server; HP ((\S+) \S+)">
2696
+ <fingerprint pattern="^HP HTTP Server; (?:Hewlett-Packard )?HP ((\S+) \S+)">
2684
2697
  <description>HP Printer</description>
2685
- <example>HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
2686
- <example>HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2698
+ <example os.product="Photosmart C309a" os.family="Photosmart">HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
2699
+ <example os.product="Officejet 6500" os.family="Officejet">HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2700
+ <example os.product="Designjet T520" os.family="Designjet">HP HTTP Server; Hewlett-Packard HP Designjet T520 36in - ABC123; Serial Number: 0123456789; Built:Tue Sep 09, 2014 08:32:54AM {012345678901}</example>
2687
2701
  <param pos="0" name="service.vendor" value="HP"/>
2688
2702
  <param pos="0" name="service.product" value="JetDirect"/>
2689
2703
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -2708,13 +2722,7 @@
2708
2722
  <param pos="0" name="os.product" value="JetDirect"/>
2709
2723
  </fingerprint>
2710
2724
 
2711
- <!-- This is not the normal form (with a space before version).
2712
- Since this version is vulnerable to a DoS attack, I suspect
2713
- it is actually a bogus banner generated by a honeypot.
2714
-
2715
- Allegro-Software-RomPager/ 2.10
2716
- -->
2717
- <fingerprint pattern="^(?:Allegro-Software-)?RomPager/(\S+)">
2725
+ <fingerprint pattern="^(?:Allegro-Software-)?RomPager/\s*(\S+)">
2718
2726
  <description>Embedded HTTP server used by many vendors and device
2719
2727
  types, including APC, 3Com, Andover Controls, Cisco VoIP, D-Link,
2720
2728
  Extreme Networks, Foundry Networks, Konica Minolta, Kronos
@@ -2723,6 +2731,7 @@
2723
2731
  <example service.version="4.01">Allegro-Software-RomPager/4.01</example>
2724
2732
  <example service.version="4.07">RomPager/4.07 UPnP/1.0</example>
2725
2733
  <example service.version="4.30b3">Allegro-Software-RomPager/4.30b3</example>
2734
+ <example service.version="2.10">Allegro-Software-RomPager/ 2.10</example>
2726
2735
  <param pos="0" name="service.vendor" value="Allegro Software"/>
2727
2736
  <param pos="0" name="service.product" value="RomPager"/>
2728
2737
  <param pos="1" name="service.version"/>
@@ -3093,6 +3102,15 @@
3093
3102
  <param pos="0" name="apache.variant" value="HP Web Jetadmin"/>
3094
3103
  <param pos="1" name="service.version"/>
3095
3104
  <param pos="2" name="apache.info"/>
3105
+ </fingerprint>
3106
+
3107
+ <fingerprint pattern="^HP Web Jetadmin ([\d\.]+)(?: \([^\)]+\))?$">
3108
+ <description>HP printers, perhaps Apache, but we can't say for sure</description>
3109
+ <example service.version="10.3.85669">HP Web Jetadmin 10.3.85669</example>
3110
+ <example service.version="10.3.91358">HP Web Jetadmin 10.3.91358 (10.3 SR5)</example>
3111
+ <param pos="0" name="service.vendor" value="HP"/>
3112
+ <param pos="0" name="service.product" value="Web Jetadmin"/>
3113
+ <param pos="1" name="service.version"/>
3096
3114
  </fingerprint>
3097
3115
 
3098
3116
  <fingerprint pattern="^Citrix Web PN Server$">
@@ -3134,6 +3152,14 @@
3134
3152
  <param pos="1" name="service.version"/>
3135
3153
  </fingerprint>
3136
3154
 
3155
+ <fingerprint pattern="^Embedthis-http$">
3156
+ <example>Embedthis-http</example>
3157
+ <description>An embedded web server for hosting dynamic web applications.</description>
3158
+ <param pos="0" name="service.vendor" value="Embedthis"/>
3159
+ <param pos="0" name="service.product" value="Appweb"/>
3160
+ <param pos="0" name="service.family" value="Appweb"/>
3161
+ </fingerprint>
3162
+
3137
3163
  <fingerprint pattern="^Avaya CMBE/((?:\d+\.)*\d+)$">
3138
3164
  <example>Avaya CMBE/2.0.0</example>
3139
3165
  <example>Avaya CMBE/2</example>
@@ -3146,16 +3172,23 @@
3146
3172
 
3147
3173
 
3148
3174
  <fingerprint pattern="^Rapid Logic/((?:\d+\.)*\d+)$">
3149
- <example>Rapid Logic/1.1</example>
3150
- <example>Rapid Logic/1</example>
3175
+ <example service.version="1.1">Rapid Logic/1.1</example>
3176
+ <example service.version="1">Rapid Logic/1</example>
3151
3177
  <description>Embedded web server by Rapid Logic, which was acquired by Wind River.</description>
3152
3178
  <!-- From Googling, it sounds like this is just referred to as the
3153
3179
  Rapid Logic web server. -->
3154
3180
  <param pos="0" name="service.vendor" value="Wind River"/>
3155
3181
  <param pos="0" name="service.product" value="Rapid Logic"/>
3156
3182
  <param pos="1" name="service.version"/>
3157
- </fingerprint>
3183
+ </fingerprint>
3158
3184
 
3185
+ <fingerprint pattern="^WindRiver-WebServer/((?:\d+\.)*\d+)$">
3186
+ <example service.version="4.4">WindRiver-WebServer/4.4</example>
3187
+ <description>Wind River HTTP server</description>
3188
+ <param pos="0" name="service.vendor" value="Wind River"/>
3189
+ <param pos="0" name="service.product" value="WebServer"/>
3190
+ <param pos="1" name="service.version"/>
3191
+ </fingerprint>
3159
3192
 
3160
3193
  <fingerprint pattern="^Sophos Email Appliance$">
3161
3194
  <example>Sophos Email Appliance</example>
@@ -3453,7 +3486,12 @@
3453
3486
  <param pos="0" name="service.vendor" value="CloudFlare"/>
3454
3487
  <param pos="0" name="service.product" value="CloudFlare Load Balancer"/>
3455
3488
  <param pos="0" name="service.family" value="CloudFlare"/>
3456
- </fingerprint>
3489
+ </fingerprint>
3457
3490
 
3491
+ <fingerprint pattern="^gSOAP/([\d\.]+)$">
3492
+ <example service.version="2.7">gSOAP/2.7</example>
3493
+ <description>gSOAP</description>
3494
+ <param pos="0" name="service.product" value="gSOAP"/>
3495
+ <param pos="1" name="service.version"/>
3496
+ </fingerprint>
3458
3497
  </fingerprints>
3459
-
data/xml/ntp_banners.xml CHANGED
@@ -258,6 +258,60 @@ NTP "banners", taken from a readvar response
258
258
  <param pos="3" name="os.version.version"/>
259
259
  <param pos="0" name="os.certainty" value="0.9"/>
260
260
  </fingerprint>
261
+ <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?12\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
262
+ <description>ntpd running on Mac OSX 10.8/Mountain Lion</description>
263
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="1.0">
264
+ version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
265
+ processor="x86_64", system="Darwin/12.1.0", leap=3, stratum=16,
266
+ </example>
267
+ <param pos="0" name="service.family" value="NTP"/>
268
+ <param pos="0" name="service.product" value="NTP"/>
269
+ <param pos="1" name="service.version"/>
270
+ <param pos="0" name="os.vendor" value="Apple"/>
271
+ <param pos="0" name="os.family" value="Mac OS X"/>
272
+ <param pos="0" name="os.product" value="Mac OS X"/>
273
+ <param pos="0" name="os.device" value="General"/>
274
+ <param pos="2" name="os.arch"/>
275
+ <param pos="0" name="os.version" value="10.8"/>
276
+ <param pos="3" name="os.version.version"/>
277
+ <param pos="0" name="os.certainty" value="0.9"/>
278
+ </fingerprint>
279
+ <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?13\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
280
+ <description>ntpd running on Mac OSX 10.9/Mavericks</description>
281
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="4.0">
282
+ version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
283
+ processor="x86_64", system="Darwin/13.4.0", leap=3, stratum=16,
284
+ </example>
285
+ <param pos="0" name="service.family" value="NTP"/>
286
+ <param pos="0" name="service.product" value="NTP"/>
287
+ <param pos="1" name="service.version"/>
288
+ <param pos="0" name="os.vendor" value="Apple"/>
289
+ <param pos="0" name="os.family" value="Mac OS X"/>
290
+ <param pos="0" name="os.product" value="Mac OS X"/>
291
+ <param pos="0" name="os.device" value="General"/>
292
+ <param pos="2" name="os.arch"/>
293
+ <param pos="0" name="os.version" value="10.9"/>
294
+ <param pos="3" name="os.version.version"/>
295
+ <param pos="0" name="os.certainty" value="0.9"/>
296
+ </fingerprint>
297
+ <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?14\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
298
+ <description>ntpd running on Mac OSX 10.10/Yosemite</description>
299
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="3.0">
300
+ version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
301
+ processor="x86_64", system="Darwin/14.3.0", leap=00, stratum=2,
302
+ </example>
303
+ <param pos="0" name="service.family" value="NTP"/>
304
+ <param pos="0" name="service.product" value="NTP"/>
305
+ <param pos="1" name="service.version"/>
306
+ <param pos="0" name="os.vendor" value="Apple"/>
307
+ <param pos="0" name="os.family" value="Mac OS X"/>
308
+ <param pos="0" name="os.product" value="Mac OS X"/>
309
+ <param pos="0" name="os.device" value="General"/>
310
+ <param pos="2" name="os.arch"/>
311
+ <param pos="0" name="os.version" value="10.10"/>
312
+ <param pos="3" name="os.version.version"/>
313
+ <param pos="0" name="os.certainty" value="0.9"/>
314
+ </fingerprint>
261
315
  <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;FreeBSD/?(?:[^ ]+-NETSCALER-([^ ]+))&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
262
316
  <description>ntpd running on Citrix Netscaler, which is based on FreeBSD</description>
263
317
  <example>
data/xml/smtp_banners.xml CHANGED
@@ -73,6 +73,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
73
73
  <param pos="0" name="service.family" value="Mail Server"/>
74
74
  <param pos="0" name="service.product" value="Mail Server"/>
75
75
  <param pos="1" name="service.version"/>
76
+ </fingerprint>
77
+
78
+ <fingerprint pattern="^(\S+) ArGoSoft Mail Server Freeware, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
79
+ <description>ArGoSoft Mail, freeware version</description>
80
+ <example host.name="example.com" service.version="1.8.8.8">example.com ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
81
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
82
+ <param pos="0" name="service.family" value="Mail Server"/>
83
+ <param pos="0" name="service.product" value="Mail Server"/>
84
+ <param pos="2" name="service.version"/>
85
+ <param pos="1" name="host.name"/>
76
86
  </fingerprint>
77
87
 
78
88
  <fingerprint pattern="^ArGoSoft Mail Server Pro for WinNT/2000, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
@@ -124,7 +134,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
124
134
  <param pos="0" name="service.family" value="PIX"/>
125
135
  <param pos="0" name="service.product" value="PIX"/>
126
136
  <param pos="0" name="service.version" value="4"/>
127
- </fingerprint>
137
+ </fingerprint>
138
+
139
+ <fingerprint pattern="CCProxy (\S+) SMTP Service Ready(?:\(Unregistered\))?$">
140
+ <description>Youngzsoft CCProxy SMTP</description>
141
+ <example service.version="7.3">CCProxy 7.3 SMTP Service Ready(Unregistered)</example>
142
+ <param pos="0" name="service.vendor" value="Youngzsoft"/>
143
+ <param pos="0" name="service.family" value="CCProxy"/>
144
+ <param pos="0" name="service.product" value="CCProxy"/>
145
+ <param pos="1" name="service.version"/>
146
+ </fingerprint>
128
147
 
129
148
  <fingerprint pattern="^[\*20 ]+$">
130
149
  <description>
@@ -426,6 +445,17 @@ The system or service fingerprint with the highest certainty overwrites the othe
426
445
  <param pos="0" name="service.family" value="IntraStore"/>
427
446
  <param pos="0" name="service.product" value="IntraStore"/>
428
447
  <param pos="1" name="host.name"/>
448
+ </fingerprint>
449
+
450
+ <fingerprint pattern="^(\S+) E?SMTP Server \(JAMES E?SMTP Server ([\d\.]+)\) ready (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+) \(\S+\)$">
451
+ <description>JAMES SMTP Server</description>
452
+ <example host.name="example.com" service.version="2.3.2">example.com SMTP Server (JAMES SMTP Server 2.3.2) ready Tue, 19 May 2015 00:36:13 +0200 (CEST)</example>
453
+ <param pos="0" name="service.vendor" value="Apache"/>
454
+ <param pos="0" name="service.product" value="James"/>
455
+ <param pos="2" name="service.version"/>
456
+ <param pos="1" name="host.name"/>
457
+ <param pos="3" name="system.time"/>
458
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
429
459
  </fingerprint>
430
460
 
431
461
  <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+\.\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
@@ -440,6 +470,18 @@ The system or service fingerprint with the highest certainty overwrites the othe
440
470
  <param pos="1" name="host.name"/>
441
471
  <param pos="2" name="service.version"/>
442
472
  <param pos="3" name="system.time"/>
473
+ </fingerprint>
474
+
475
+ <fingerprint pattern="^(\S+) E?SMTP MailEnable Service, Version: ([\d\.]+)-- ready at (\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})$">
476
+ <description>Simple MailEnable</description>
477
+ <example host.name="example.com">example.com ESMTP MailEnable Service, Version: 1.8-- ready at 05/20/15 08:50:22</example>
478
+ <param pos="0" name="service.vendor" value="MailEnable"/>
479
+ <param pos="0" name="service.family" value="MailEnable"/>
480
+ <param pos="0" name="service.product" value="MailEnable"/>
481
+ <param pos="0" name="system.time.format" value="MM/dd/yy HH:mm:ss"/>
482
+ <param pos="1" name="host.name"/>
483
+ <param pos="2" name="service.version"/>
484
+ <param pos="3" name="system.time"/>
443
485
  </fingerprint>
444
486
 
445
487
  <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
@@ -913,6 +955,32 @@ The system or service fingerprint with the highest certainty overwrites the othe
913
955
  <param pos="4" name="system.time"/>
914
956
  </fingerprint>
915
957
 
958
+ <fingerprint pattern="^(\S+)(?: UCX)? V\S+, OpenVMS V(\S+) (\S+) ready at .*$">
959
+ <description>Some unknown mail server on OpenVMS</description>
960
+ <example host.name="example.com" os.arch="IA64" os.version="8.4">example.com V5.7-ECO4, OpenVMS V8.4 IA64 ready at Wed, 20 May 2015 01:22:32 +0100 (BST)</example>
961
+ <example host.name="example.com" os.arch="Alpha" os.version="7.3-2">example.com V5.4-15E, OpenVMS V7.3-2 Alpha ready at Wed, 20 May 2015 01:22:18 +0100 (BST)</example>
962
+ <example host.name="example.com" os.arch="VAX" os.version="6.2">example.com UCX V4.2-21I, OpenVMS V6.2 VAX ready at Wed, 20 May 2015 01:15:16 GMT</example>
963
+ <example host.name="example.com" os.arch="Alpha" os.version="6.2-1H3">example.com UCX V4.2-21I, OpenVMS V6.2-1H3 Alpha ready at Wed, 20 May 2015 00:55:37 GMT</example>
964
+ <param pos="1" name="host.name"/>
965
+ <param pos="0" name="os.vendor" value="HP"/>
966
+ <param pos="0" name="os.family" value="OpenVMS"/>
967
+ <param pos="0" name="os.product" value="OpenVMS"/>
968
+ <param pos="0" name="os.device" value="General"/>
969
+ <param pos="2" name="os.version"/>
970
+ <param pos="3" name="os.arch"/>
971
+ </fingerprint>
972
+
973
+ <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\]) ([\d\.]+); (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2})$">
974
+ <description>A.K.I PMail</description>
975
+ <example host.name="example.com" service.version="1.91">example.com ESMTP PMailServer [Free Edition] 1.91; Fri, 22 May 2015 02:04:56</example>
976
+ <param pos="0" name="service.vendor" value="A.K.I Software"/>
977
+ <param pos="0" name="service.product" value="PMail Server"/>
978
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss"/>
979
+ <param pos="1" name="host.name"/>
980
+ <param pos="2" name="service.version"/>
981
+ <param pos="3" name="system.time"/>
982
+ </fingerprint>
983
+
916
984
  <fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)-([^ ]+)\) \(([^ ]+)\) *$">
917
985
  <!--
918
986
  220 foo.bar.com ESMTP Postfix (Postfix-19991231-pl08) (Linux-Mandrake)
@@ -1051,6 +1119,15 @@ The system or service fingerprint with the highest certainty overwrites the othe
1051
1119
  </description>
1052
1120
  <param pos="0" name="service.product" value="raptor"/>
1053
1121
  <param pos="1" name="host.name"/>
1122
+ </fingerprint>
1123
+
1124
+ <fingerprint pattern="^(\S+) SAP (\S+) E?SMTP service ready$">
1125
+ <description>SAP SMTP Server</description>
1126
+ <example host.name="example.com" service.version="8.04(53)">example.com SAP 8.04(53) ESMTP service ready</example>
1127
+ <param pos="0" name="service.vendor" value="SAP"/>
1128
+ <param pos="0" name="service.product" value="SMTP"/>
1129
+ <param pos="2" name="service.version"/>
1130
+ <param pos="1" name="host.name"/>
1054
1131
  </fingerprint>
1055
1132
 
1056
1133
  <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+) \(PHNE_([^ ]+)\) */ *(.+); *(.+) \(.+\)$">
@@ -1070,6 +1147,24 @@ The system or service fingerprint with the highest certainty overwrites the othe
1070
1147
  <param pos="3" name="sendmail.hpux.phne.version"/>
1071
1148
  <param pos="4" name="sendmail.config.version"/>
1072
1149
  <param pos="5" name="system.time"/>
1150
+ </fingerprint>
1151
+
1152
+ <fingerprint pattern="^(\S+) ESMTP Sendmail \S+ version ([\d\.]+) - Revision \S+ HP-UX([\d\.]+).*(\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S{3})$">
1153
+ <description>
1154
+ sendmail on HPUX
1155
+ </description>
1156
+ <example host.name="example.com" os.version="11.31" service.version="8.13.3">example.com ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT</example>
1157
+ <param pos="0" name="service.family" value="Sendmail"/>
1158
+ <param pos="0" name="service.product" value="Sendmail"/>
1159
+ <param pos="0" name="os.vendor" value="HP"/>
1160
+ <param pos="0" name="os.family" value="HP-UX"/>
1161
+ <param pos="0" name="os.device" value="General"/>
1162
+ <param pos="0" name="os.product" value="HP-UX"/>
1163
+ <param pos="3" name="os.version"/>
1164
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1165
+ <param pos="1" name="host.name"/>
1166
+ <param pos="2" name="service.version"/>
1167
+ <param pos="4" name="system.time"/>
1073
1168
  </fingerprint>
1074
1169
 
1075
1170
  <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+)/UW([^ ]+) ready at *(.+) \(.+\) *$">
@@ -1493,6 +1588,18 @@ The system or service fingerprint with the highest certainty overwrites the othe
1493
1588
  <param pos="1" name="host.name"/>
1494
1589
  </fingerprint>
1495
1590
 
1591
+ <fingerprint pattern="^(\S+) ESMTP Sendmail (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+)$">
1592
+ <description>
1593
+ catch all for other versions of sendmail, with a date/time
1594
+ </description>
1595
+ <example host.name="example.com">example.com ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
1596
+ <param pos="0" name="service.family" value="Sendmail"/>
1597
+ <param pos="0" name="service.product" value="Sendmail"/>
1598
+ <param pos="1" name="host.name"/>
1599
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1600
+ <param pos="2" name="system.time"/>
1601
+ </fingerprint>
1602
+
1496
1603
  <!-- Sun Internet Mail Server -->
1497
1604
  <!-- Sun Internet Mail Server sims\.([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+) -->
1498
1605
 
@@ -1713,13 +1820,21 @@ The system or service fingerprint with the highest certainty overwrites the othe
1713
1820
  <param pos="4" name="system.time"/>
1714
1821
  </fingerprint>
1715
1822
 
1716
- <fingerprint pattern="^([^ ]+) E?SMTP(?: Ready\.?)?$">
1717
- <description>
1718
- catch all for daemons that have no distinguishing fingerprint whatsoever
1719
- </description>
1720
- <example>foo.example.com ESMTP</example>
1721
- <example>foo.example.com ESMTP Ready</example>
1722
- <example>foo.example.com SMTP</example>
1823
+ <fingerprint pattern="^(\S+) E?SMTP Perl" flags="REG_ICASE">
1824
+ <description>Some simple PERL SMTP server</description>
1825
+ <example host.name="example.com">example.com ESMTP Perl</example>
1826
+ <param pos="0" name="service.product" value="Perl"/>
1827
+ <param pos="1" name="host.name"/>
1828
+ </fingerprint>
1829
+
1830
+ <fingerprint pattern="^([^ ]+) E?SMTP(?: (?:Service )?Ready\.?)?$" flags="REG_ICASE">
1831
+ <description>
1832
+ catch all for daemons that have no distinguishing fingerprint whatsoever
1833
+ </description>
1834
+ <example host.name="example.com">example.com ESMTP</example>
1835
+ <example host.name="example.com">example.com ESMTP Ready</example>
1836
+ <example host.name="example.com">example.com SMTP</example>
1837
+ <example host.name="example.com">example.com ESMTP Service ready</example>
1723
1838
  <param pos="0" name="service.product" value="Unknown"/>
1724
1839
  <param pos="1" name="host.name"/>
1725
1840
  </fingerprint>
data/xml/snmp_sysdescr.xml CHANGED
@@ -1031,9 +1031,10 @@
1031
1031
  BROCADE
1032
1032
  =======================================================================-->
1033
1033
 
1034
- <fingerprint pattern="^Fibre Channel Switch\.$">
1034
+ <fingerprint pattern="^Fibre Channel Switch\.?$">
1035
1035
  <description>Brocade FabricOS switch</description>
1036
1036
  <example>Fibre Channel Switch.</example>
1037
+ <example>Fibre Channel Switch</example>
1037
1038
  <param pos="0" name="os.vendor" value="Brocade"/>
1038
1039
  <param pos="0" name="os.product" value="Fabric OS"/>
1039
1040
  <param pos="0" name="os.device" value="Switch"/>
@@ -2631,22 +2632,10 @@ Copyright (c) 1995-2005 by Cisco Systems
2631
2632
  <param pos="4" name="os.version.version"/>
2632
2633
  </fingerprint>
2633
2634
 
2634
- <fingerprint pattern="^(\S+) (.*?) Digital UNIX V(\S+) \(Rev\. ([^\)]+)\).*TCP/IP$">
2635
+ <fingerprint pattern="^(\S+) (.*?) Digital UNIX V(\S+)\s+\(Rev\. ([^\)]+)\).*TCP/IP$">
2635
2636
  <description>Digital/Compaq/HP Tru64 Unix</description>
2636
- <example>clima.igpsdfpe COMPAQ AlphaServer DS20E 500 MHz Digital UNIX V4.0F (Rev. 1229); Mon Apr 12 13:30:41 EDT 1999 TCP/IP</example>
2637
- <example>dino.snusdfr COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Thu Oct 21 13:13:28 KST 1999 TCP/IP</example>
2638
- <example>george1.sdftw COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Fri Apr 21 14:49:53 CST 2000 TCP/IP</example>
2639
- <example>hsdfdf.it COMPAQ AlphaServer DS20E 666 MHz Digital UNIX V4.0F (Rev. 1229); Fri Apr 27 12:22:53 MET DST 2001 TCP/IP</example>
2640
- <example>hisdfcfdcnr.it COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Thu Jan 20 21:51:21 GMT 2000 TCP/IP</example>
2641
- <example>ingriv.na.infn.it COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Mon Feb 5 12:09:16 MET 2001 TCP/IP</example>
2642
- <example>lib.nthsdfv.tw COMPAQ AlphaServer DS20E 833 MHz Digital UNIX V4.0F (Rev. 1229); Sat Oct 31 14:16:13 CST 2009 TCP/IP</example>
2643
- <example>main.chemisdfna.it COMPAQ AlphaServer DS10 466 MHz Digital UNIX V4.0F (Rev. 1229); Sat Nov 27 14:08:50 GMT+0100 2004 TCP/IP</example>
2644
- <example>moldyn.cscp.sdfr.it COMPAQ Professional Workstation XP1000 Digital UNIX V5.0 (Rev. 910); Fri Nov 17 15:54:45 MET 2000 TCP/IP</example>
2645
- <example>nambukdb COMPAQ AlphaServer DS20E 666 MHz Digital UNIX V4.0F (Rev. 1229); Mon Aug 13 22:11:20 KST 2007 TCP/IP</example>
2646
- <example>nctsphys1.phsdfthu.edu.tw COMPAQ Professional Workstation XP1000 Digital UNIX V4.0E (Rev. 1091); Wed Jul 14 15:57:17 CST 1999 TCP/IP</example>
2647
- <example>oya.gesdfcsb.edu COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Fri Sep 13 13:44:20 PDT 2002 TCP/IP</example>
2648
- <example>quarsdfctecsdfr.th COMPAQ AlphaServer DS10 466 MHz Digital UNIX V4.0G (Rev. 1530); Fri Jun 20 14:03:00 GMT+0700 2003 TCP/IP</example>
2649
- <example>tunisdf.nhisdfdu.tw COMPAQ AlphaServer DS10 617 MHz Digital UNIX V4.0F (Rev. 1229); Wed May 22 13:55:58 CST 2002 TCP/IP</example>
2637
+ <example host.name="example.com" hw.product="COMPAQ AlphaServer DS10 617 MHz" os.version="4.0F" os.version.version="1229">example.com COMPAQ AlphaServer DS10 617 MHz Digital UNIX V4.0F (Rev. 1229); Wed May 22 13:55:58 CST 2002 TCP/IP</example>
2638
+ <example host.name="example.com" hw.product="COMPAQ Professional Workstation XP1000" os.version="4.0F" os.version.version="1229">example.com COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Wed Jun 30 14:32:53 MET DST 2004 . TCP/IP</example>
2650
2639
  <param pos="0" name="os.vendor" value="HP"/>
2651
2640
  <param pos="0" name="os.family" value="Unix"/>
2652
2641
  <param pos="0" name="os.product" value="Digital Unix"/>
@@ -3363,13 +3352,22 @@ Copyright (c) 1995-2005 by Cisco Systems
3363
3352
  </fingerprint>
3364
3353
 
3365
3354
  <fingerprint pattern="^Integrated Lights-Out (\d) \d+\.\d+ [A-Za-z]{3} \d{1,2} \d{4}$">
3366
- <description>HP Integrated Lights-Out (iLO)</description>
3355
+ <description>HP Integrated Lights-Out (iLO) with firmware version</description>
3367
3356
  <example os.version="4">Integrated Lights-Out 4 2.02 Aug 18 2014</example>
3368
3357
  <!--2.02 is firmware version-->
3369
3358
  <param pos="0" name="os.vendor" value="HP"/>
3370
3359
  <param pos="0" name="os.family" value="iLO"/>
3371
3360
  <param pos="0" name="os.device" value="iLO"/>
3372
3361
  <param pos="1" name="os.version"/>
3362
+ </fingerprint>
3363
+
3364
+ <fingerprint pattern="^Integrated Lights-Out (\d) \(iLO \d\) for Integrity$">
3365
+ <description>HP Integrated Lights-Out (iLO) without firmware version</description>
3366
+ <example os.version="2">Integrated Lights-Out 2 (iLO 2) for Integrity</example>
3367
+ <param pos="0" name="os.vendor" value="HP"/>
3368
+ <param pos="0" name="os.family" value="iLO"/>
3369
+ <param pos="0" name="os.device" value="iLO"/>
3370
+ <param pos="1" name="os.version"/>
3373
3371
  </fingerprint>
3374
3372
 
3375
3373
  <!--======================================================================
@@ -4803,6 +4801,23 @@ Copyright (c) 1995-2005 by Cisco Systems
4803
4801
  <param pos="0" name="os.device" value="Printer"/>
4804
4802
  </fingerprint>
4805
4803
 
4804
+ <!--======================================================================
4805
+ Lenel
4806
+ =======================================================================-->
4807
+
4808
+ <fingerprint pattern="^(LNL-\d+) (.*) Firmware Version ([\d\.]+) Build \d+$">
4809
+ <description>Various Lenel hardware, typically door controllers, etc</description>
4810
+ <example hw.product="LNL-2210" os.device="Intelligent Single Door Controller" os.version="1.17.6">LNL-2210 Intelligent Single Door Controller Firmware Version 1.17.6 Build 359</example>
4811
+ <example hw.product="LNL-2220" os.device="Intelligent Dual Reader Controller" os.version="1.17.3">LNL-2220 Intelligent Dual Reader Controller Firmware Version 1.17.3 Build 351</example>
4812
+ <example hw.product="LNL-3300" os.device="Intelligent System Controller" os.version="1.17.6">LNL-3300 Intelligent System Controller Firmware Version 1.17.6 Build 359</example>
4813
+ <param pos="0" name="os.vendor" value="Lenel"/>
4814
+ <!-- it isn't clear what the OS is... -->
4815
+ <param pos="1" name="hw.product"/>
4816
+ <param pos="2" name="os.device"/>
4817
+ <param pos="3" name="os.version"/>
4818
+ </fingerprint>
4819
+
4820
+
4806
4821
  <!--======================================================================
4807
4822
  LINUX
4808
4823
 
@@ -5197,6 +5212,28 @@ Copyright (c) 1995-2005 by Cisco Systems
5197
5212
  <param pos="0" name="os.product" value="Windows Server 2003"/>
5198
5213
  <param pos="0" name="os.device" value="General"/>
5199
5214
  <param pos="0" name="os.arch" value="x86_64"/>
5215
+ </fingerprint>
5216
+
5217
+ <fingerprint pattern="^Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel \S+64.*$">
5218
+ <description>Rare Windows 2003 SP2 sysDescr, x64</description>
5219
+ <example>Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel EM64T Family 6 Model 23 Stepping 6</example>
5220
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5221
+ <param pos="0" name="os.family" value="Windows"/>
5222
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
5223
+ <param pos="0" name="os.device" value="General"/>
5224
+ <param pos="0" name="os.arch" value="x86_64"/>
5225
+ <param pos="0" name="os.version" value="SP1"/>
5226
+ </fingerprint>
5227
+
5228
+ <fingerprint pattern="^Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel x86.*$">
5229
+ <description>Rare Windows 2003 SP2 sysDescr, x86</description>
5230
+ <example>Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel x86 Family 6 Model 23 Stepping 6</example>
5231
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5232
+ <param pos="0" name="os.family" value="Windows"/>
5233
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
5234
+ <param pos="0" name="os.device" value="General"/>
5235
+ <param pos="0" name="os.arch" value="x86"/>
5236
+ <param pos="0" name="os.version" value="SP1"/>
5200
5237
  </fingerprint>
5201
5238
 
5202
5239
  <fingerprint pattern="^Microsoft Windows CE Version ([\d.]+).*$">
@@ -5338,6 +5375,26 @@ Copyright (c) 1995-2005 by Cisco Systems
5338
5375
  <param pos="0" name="os.product" value="Windows 8"/>
5339
5376
  <param pos="0" name="os.device" value="General"/>
5340
5377
  <param pos="0" name="os.arch" value="x86"/>
5378
+ </fingerprint>
5379
+
5380
+ <fingerprint pattern="^Hardware: \S+64.*Software: Windows Version 6.3 \(Build 9600">
5381
+ <description>Windows 8 on x86_64</description>
5382
+ <example>Hardware: AMD64 Family 21 Model 0 Stepping 2 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 9600 Multiprocessor Free)</example>
5383
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5384
+ <param pos="0" name="os.family" value="Windows"/>
5385
+ <param pos="0" name="os.product" value="Windows 8.1"/>
5386
+ <param pos="0" name="os.device" value="General"/>
5387
+ <param pos="0" name="os.arch" value="x86_64"/>
5388
+ </fingerprint>
5389
+
5390
+ <fingerprint pattern="^Hardware: x86.*Software: Windows Version 6.3 \(Build 9600">
5391
+ <description>Windows 8 on x86</description>
5392
+ <example>Hardware: x86 Family 21 Model 0 Stepping 2 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 9600 Multiprocessor Free)</example>
5393
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5394
+ <param pos="0" name="os.family" value="Windows"/>
5395
+ <param pos="0" name="os.product" value="Windows 8.1"/>
5396
+ <param pos="0" name="os.device" value="General"/>
5397
+ <param pos="0" name="os.arch" value="x86"/>
5341
5398
  </fingerprint>
5342
5399
 
5343
5400
  <fingerprint pattern="Windows\s\S+\s(6\.2\.\d+)\s+Server\s[\d\.]+\s(\w+).*">
@@ -7943,6 +8000,29 @@ Copyright (c) 1995-2005 by Cisco Systems
7943
8000
  <param pos="0" name="os.product" value="VxWorks"/>
7944
8001
  </fingerprint>
7945
8002
 
8003
+ <!--======================================================================
8004
+ VMware
8005
+ =======================================================================-->
8006
+
8007
+ <fingerprint pattern="^(VMware ESXi?) (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$">
8008
+ <description>VMware ESX/ESXi</description>
8009
+ <example os.product="VMware ESXi" os.version="5.1.0" os.arch="x86_64">VMware ESXi 5.1.0 build-1157734 VMware, Inc. x86_64</example>
8010
+ <example os.product="VMware ESX" os.version="5.0.0" os.arch="x86_64">VMware ESX 5.0.0 build-623860 VMware, Inc. x86_64</example>
8011
+ <param pos="0" name="os.vendor" value="VMware"/>
8012
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
8013
+ <param pos="1" name="os.product"/>
8014
+ <param pos="2" name="os.version"/>
8015
+ <param pos="3" name="os.arch"/>
8016
+ </fingerprint>
8017
+
8018
+ <fingerprint pattern="^&quot;vSphere Management Assistant ([\d\.]+)&quot;$">
8019
+ <description>VMware vSphere Management assistant, which is a virtual machine (https://www.vmware.com/support/developer/vima/)</description>
8020
+ <example os.version="4.1.0">"vSphere Management Assistant 4.1.0"</example>
8021
+ <param pos="0" name="os.vendor" value="VMware"/>
8022
+ <param pos="0" name="os.product" value="vSphere Management Assistant"/>
8023
+ <param pos="1" name="os.version"/>
8024
+ </fingerprint>
8025
+
7946
8026
 
7947
8027
  <!--======================================================================
7948
8028
  XEROX
@@ -8198,23 +8278,4 @@ Copyright (c) 1995-2005 by Cisco Systems
8198
8278
  <param pos="0" name="os.product" value="Prestige 650R-T3"/>
8199
8279
  <param pos="0" name="os.device" value="Broadband Router"/>
8200
8280
  </fingerprint>
8201
-
8202
- <fingerprint pattern="^(VMware ESXi?) (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$">
8203
- <description>VMware ESX/ESXi</description>
8204
- <example os.product="VMware ESXi" os.version="5.1.0" os.arch="x86_64">VMware ESXi 5.1.0 build-1157734 VMware, Inc. x86_64</example>
8205
- <example os.product="VMware ESX" os.version="5.0.0" os.arch="x86_64">VMware ESX 5.0.0 build-623860 VMware, Inc. x86_64</example>
8206
- <param pos="0" name="os.vendor" value="VMware"/>
8207
- <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
8208
- <param pos="1" name="os.product"/>
8209
- <param pos="2" name="os.version"/>
8210
- <param pos="3" name="os.arch"/>
8211
- </fingerprint>
8212
-
8213
- <fingerprint pattern="^&quot;vSphere Management Assistant ([\d\.]+)&quot;$">
8214
- <description>VMware vSphere Management assistant, which is a virtual machine (https://www.vmware.com/support/developer/vima/)</description>
8215
- <example os.version="4.1.0">"vSphere Management Assistant 4.1.0"</example>
8216
- <param pos="0" name="os.vendor" value="VMware"/>
8217
- <param pos="0" name="os.product" value="vSphere Management Assistant"/>
8218
- <param pos="1" name="os.version"/>
8219
- </fingerprint>
8220
8281
  </fingerprints>
data/xml/ssh_banners.xml CHANGED
@@ -590,10 +590,11 @@ fingerprint SSH servers.
590
590
  <param pos="0" name="os.product" value="Windows"/>
591
591
  </fingerprint>
592
592
 
593
- <fingerprint pattern="^([^\s]+) FlowSsh: WinSSHD ([^ ]+):?.*$">
593
+ <fingerprint pattern="^([^\s]+) FlowSsh: (?:Bitvise SSH Server \(WinSSHD\)|WinSSHD) ([\d\.]+):?.*$">
594
594
  <description>Bitvise WinSSHD (which uses Bitvise flowssh)</description>
595
- <example>1.03 FlowSsh: WinSSHD 5.09</example>
596
- <example>1.07 FlowSsh: WinSSHD 5.20: free only for personal non-commercial use</example>
595
+ <example service.version="5.09" service.component.version="1.03">1.03 FlowSsh: WinSSHD 5.09</example>
596
+ <example service.version="5.20" service.component.version="1.07">1.07 FlowSsh: WinSSHD 5.20: free only for personal non-commercial use</example>
597
+ <example service.version="6.03" service.component.version="5.21">5.21 FlowSsh: Bitvise SSH Server (WinSSHD) 6.03: free only for personal non-commercial use</example>
597
598
  <param pos="1" name="service.component.version"/>
598
599
  <param pos="2" name="service.version"/>
599
600
  <param pos="0" name="service.component.vendor" value="Bitvise"/>
@@ -633,9 +634,10 @@ fingerprint SSH servers.
633
634
  <param pos="0" name="os.product" value="Windows"/>
634
635
  </fingerprint>
635
636
 
636
- <fingerprint pattern="^VShell_(\d+)_(\d+)_(\d+)_(\d+) VShell$">
637
+ <fingerprint pattern="^VShell_(?:Special_Edition_)?(\d+)_(\d+)_(\d+)_(\d+) VShell$">
637
638
  <description>VanDyke VShell</description>
638
- <example>VShell_3_6_2_446 VShell</example>
639
+ <example service.version="3" service.version.version="6" service.version.version.version="2" service.version.version.version.version="446">VShell_3_6_2_446 VShell</example>
640
+ <example service.version="2" service.version.version="5" service.version.version.version="0" service.version.version.version.version="204">VShell_Special_Edition_2_5_0_204 VShell</example>
639
641
  <param pos="1" name="service.version"/>
640
642
  <param pos="2" name="service.version.version"/>
641
643
  <param pos="3" name="service.version.version.version"/>
@@ -788,6 +790,14 @@ fingerprint SSH servers.
788
790
  <param pos="0" name="os.device" value="Network"/>
789
791
  <param pos="0" name="os.family" value="Comware"/>
790
792
  <param pos="1" name="os.version"/>
793
+ </fingerprint>
794
+
795
+ <fingerprint pattern="^Data ONTAP SSH [\d\.]+$">
796
+ <description>SSH NetApp appliances</description>
797
+ <example>Data ONTAP SSH 1.0</example>
798
+ <param pos="0" name="os.vendor" value="NetApp"/>
799
+ <param pos="0" name="os.family" value="Data ONTAP"/>
800
+ <param pos="0" name="os.product" value="Data ONTAP"/>
791
801
  </fingerprint>
792
802
 
793
803
  <fingerprint pattern="^(\d\.\d+\.\d+) SSH Secure Shell OpenVMS V\d\.\d$">
@@ -826,6 +836,14 @@ fingerprint SSH servers.
826
836
  <param pos="0" name="os.certainty" value="0.75"/>
827
837
  </fingerprint>
828
838
 
839
+ <fingerprint pattern="^\S+ SSH Secure Shell Tru64 UNIX$">
840
+ <description>Digital/Compaq/HP Tru64 Unix</description>
841
+ <example>3.2.0 SSH Secure Shell Tru64 UNIX</example>
842
+ <param pos="0" name="os.vendor" value="HP"/>
843
+ <param pos="0" name="os.family" value="Unix"/>
844
+ <param pos="0" name="os.product" value="Tru64 Unix"/>
845
+ <param pos="0" name="os.device" value="General"/>
846
+ </fingerprint>
829
847
  <!--
830
848
  1.2.22j4rad
831
849
  2.40
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.0.2
4
+ version: 2.0.4
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2015-05-20 00:00:00.000000000 Z
11
+ date: 2015-05-29 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec