recog 2.0.2 → 2.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/fingerprint.rb +1 -0
  3. data/lib/recog/version.rb +1 -1
  4. data/xml/ftp_banners.xml +41 -4
  5. data/xml/http_servers.xml +54 -16
  6. data/xml/ntp_banners.xml +54 -0
  7. data/xml/smtp_banners.xml +123 -8
  8. data/xml/snmp_sysdescr.xml +97 -36
  9. data/xml/ssh_banners.xml +23 -5
  10. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 4d0880aa5a5cd1e10fa8183009a690fc68714576
4
- data.tar.gz: 55226bd9acf2c7c225a3124d668cf3e2e45e5a98
3
+ metadata.gz: 6658b1a0db868ef63c21649455ae64a7278dfe98
4
+ data.tar.gz: aa65f71001901ef71867cdef929463436d0f2876
5
5
  SHA512:
6
- metadata.gz: fc0bdb44da83731fd6f89d980e190452ec608214d3bbfa01215019a410596e9f8f8c781c5fe5ed5bf525651dea476839ddce98ba7f1ead3c09b29d14b6d1d11c
7
- data.tar.gz: 60f9022a1720e422a5d4558e98960c4c9efe4fe5ee4cee04064eb05b4b757a5b0d75fa40c5e80cd2cbe1a1a6b4da0a1950ba36ff27196da1727699a5f37b3b72
6
+ metadata.gz: c76a54a3b53c0ad113e47ed41e0890bf2a93a9f496b644d7f42a70ce414b4add1eb9a0f50f519fa8c18bc592fdcfd93f9ad362633872e22514b208d9a7eb4ece
7
+ data.tar.gz: 0ce9bb4c5333affcfc63cc9cf1f03f770b5caa122799d16b4e60da653a1cd92b2a054cb2fffa4496d75f9ccc01b1d581c3b01456314ea723cc861ac27e1f8761
data/lib/recog/fingerprint.rb CHANGED
@@ -42,6 +42,7 @@ class Fingerprint
42
42
  # @param match_string [String]
43
43
  # @return [Hash,nil] Keys will be host, service, and os attributes
44
44
  def match(match_string)
45
+ # match_string.force_encoding('BINARY') if match_string
45
46
  match_data = @regex.match(match_string)
46
47
  return if match_data.nil?
47
48
 
data/lib/recog/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Recog
2
- VERSION = '2.0.2'
2
+ VERSION = '2.0.4'
3
3
  end
data/xml/ftp_banners.xml CHANGED
@@ -93,11 +93,12 @@ against these patterns to fingerprint FTP servers.
93
93
  <param pos="1" name="host.name"/>
94
94
  <param pos="2" name="service.version"/>
95
95
  </fingerprint>
96
- <fingerprint pattern="^(\S+)(?: \S+)? FTP Server \(Version wu(?:ftpd)?-([\d\.]+).*\) ready.?$" flags="REG_ICASE">
96
+ <fingerprint pattern="^(\S+)(?: \S+)? FTP Server \((?:Revision [\d\.]+ )?Version wu(?:ftpd)?-([\d\.]+).*\) ready.?$" flags="REG_ICASE">
97
97
  <description>WU-FTPD on various OS</description>
98
- <example>example.com FTP server (Version wu-2.6.2(1) Sat Jul 19 16:21:30 UTC 2008) ready.</example>
99
- <example>example.com 192.168.0.1 FTP server (Version wu-2.6.2(1) Wed Sep 21 11:16:21 MEST 2005) ready.</example>
100
- <example>example.com FTP server (Version wu-2.6.2-11.73.1) ready.</example>
98
+ <example host.name="example.com" service.version="2.6.2">example.com FTP server (Version wu-2.6.2(1) Sat Jul 19 16:21:30 UTC 2008) ready.</example>
99
+ <example host.name="example.com" service.version="2.6.2">example.com 192.168.0.1 FTP server (Version wu-2.6.2(1) Wed Sep 21 11:16:21 MEST 2005) ready.</example>
100
+ <example host.name="example.com" service.version="2.6.2">example.com FTP server (Version wu-2.6.2-11.73.1) ready.</example>
101
+ <example host.name="example.com" service.version="2.6.1">example.com FTP server (Revision 5.0 Version wuftpd-2.6.1 Thu Apr 29 06:48:40 GMT 2010) ready.</example>
101
102
  <param pos="0" name="service.vendor" value="Washington University"/>
102
103
  <param pos="0" name="service.product" value="WU-FTPD"/>
103
104
  <param pos="1" name="host.name"/>
@@ -817,4 +818,40 @@ against these patterns to fingerprint FTP servers.
817
818
  <param pos="2" name="hw.series"/>
818
819
  <param pos="3" name="os.version"/>
819
820
  </fingerprint>
821
+
822
+ <fingerprint pattern="^(\S+) FTP server \((?:HP|Compaq) Tru64 UNIX Version (\S+)\) ready\.?$">
823
+ <description>Digital/Compaq/HP Tru64 Unix</description>
824
+ <example host.name="example.com" os.version="5.60">example.com FTP server (Compaq Tru64 UNIX Version 5.60) ready.</example>
825
+ <param pos="0" name="os.vendor" value="HP"/>
826
+ <param pos="0" name="os.family" value="Unix"/>
827
+ <param pos="0" name="os.product" value="Tru64 Unix"/>
828
+ <param pos="0" name="os.device" value="General"/>
829
+ <param pos="1" name="host.name"/>
830
+ <param pos="2" name="os.version"/>
831
+ </fingerprint>
832
+
833
+ <fingerprint pattern="^(\S+) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
834
+ <description>Digital/Compaq/HP Tru64 Unix</description>
835
+ <example host.name="example.com" os.version="5.60">example.com FTP server (Digital UNIX Version 5.60) ready.</example>
836
+ <param pos="0" name="os.vendor" value="HP"/>
837
+ <param pos="0" name="os.family" value="Unix"/>
838
+ <param pos="0" name="os.product" value="Digital Unix"/>
839
+ <param pos="0" name="os.device" value="General"/>
840
+ <param pos="1" name="host.name"/>
841
+ <param pos="2" name="os.version"/>
842
+ </fingerprint>
843
+
844
+ <fingerprint pattern="^(\S+) FTP server ready.?$" flags="REG_ICASE">
845
+ <description>Generic FTP fingerprint with a hostname</description>
846
+ <example host.name="example.com">example.com FTP server ready.</example>
847
+ <param pos="1" name="host.name"/>
848
+ </fingerprint>
849
+
850
+ <fingerprint pattern="^FTP (?:server|service)?(?: is)? ready\.?$" flags="REG_ICASE">
851
+ <description>Generic FTP fingerprint without a hostname</description>
852
+ <example>FTP server is ready.</example>
853
+ <example>FTP Server ready.</example>
854
+ <example>FTP Server Ready</example>
855
+ <example>FTP service ready.</example>
856
+ </fingerprint>
820
857
  </fingerprints>
data/xml/http_servers.xml CHANGED
@@ -1874,7 +1874,15 @@
1874
1874
  <param pos="0" name="service.product" value="HTTP"/>
1875
1875
  <param pos="0" name="service.family" value="Compaq HTTP Server"/>
1876
1876
  <param pos="1" name="service.version"/>
1877
- </fingerprint>
1877
+ </fingerprint>
1878
+
1879
+ <fingerprint pattern="^HPSMH$">
1880
+ <description>HP System Management Homepage (SMH)</description>
1881
+ <example>HPSMH</example>
1882
+ <param pos="0" name="service.vendor" value="HP"/>
1883
+ <param pos="0" name="service.family" value="SMH"/>
1884
+ <param pos="0" name="service.product" value="SMH"/>
1885
+ </fingerprint>
1878
1886
 
1879
1887
  <fingerprint pattern="^eHTTP[/ ]v?(\d+\.\d+)" flags="REG_ICASE">
1880
1888
  <example service.version="1.1">EHTTP/1.1</example>
@@ -1896,6 +1904,7 @@
1896
1904
  <example service.component.version="0.0.1">BBC 2.6.0.7; com.hp.openview.Coda 0.0.1</example>
1897
1905
  <param pos="0" name="service.vendor" value="HP"/>
1898
1906
  <param pos="0" name="service.family" value="OpenView"/>
1907
+ <param pos="0" name="service.product" value="OpenView"/>
1899
1908
  <param pos="0" name="service.component.vendor" value="HP"/>
1900
1909
  <param pos="0" name="service.component.family" value="OpenView"/>
1901
1910
  <param pos="0" name="service.component.product" value="CODA"/>
@@ -1907,6 +1916,7 @@
1907
1916
  <example service.component.version="11.00.044">BBC 11.00.044; ovbbcrcp 11.00.044</example>
1908
1917
  <param pos="0" name="service.vendor" value="HP"/>
1909
1918
  <param pos="0" name="service.family" value="OpenView"/>
1919
+ <param pos="0" name="service.product" value="OpenView"/>
1910
1920
  <param pos="0" name="service.component.vendor" value="HP"/>
1911
1921
  <param pos="0" name="service.component.family" value="OpenView"/>
1912
1922
  <param pos="0" name="service.component.product" value="Reverse Channel Proxy"/>
@@ -1919,6 +1929,7 @@
1919
1929
  <example service.component.version="2.6.0.7">BBC 2.6.0.7; com.hp.openview.bbc.LLBServer 2.6.0.7</example>
1920
1930
  <param pos="0" name="service.vendor" value="HP"/>
1921
1931
  <param pos="0" name="service.family" value="OpenView"/>
1932
+ <param pos="0" name="service.product" value="OpenView"/>
1922
1933
  <param pos="0" name="service.component.vendor" value="HP"/>
1923
1934
  <param pos="0" name="service.component.family" value="OpenView"/>
1924
1935
  <param pos="0" name="service.component.product" value="LLBServer"/>
@@ -1931,6 +1942,7 @@
1931
1942
  <example service.component.version="11.10.035">BBC 11.10.035; ovbbccb 11.10.035</example>
1932
1943
  <param pos="0" name="service.vendor" value="HP"/>
1933
1944
  <param pos="0" name="service.family" value="OpenView"/>
1945
+ <param pos="0" name="service.product" value="OpenView"/>
1934
1946
  <param pos="0" name="service.component.vendor" value="HP"/>
1935
1947
  <param pos="0" name="service.component.family" value="OpenView"/>
1936
1948
  <param pos="0" name="service.component.product" value="Communication Broker"/>
@@ -1942,6 +1954,7 @@
1942
1954
  <example>BBC 11.13.007; ovbbccb unknown version</example>
1943
1955
  <param pos="0" name="service.vendor" value="HP"/>
1944
1956
  <param pos="0" name="service.family" value="OpenView"/>
1957
+ <param pos="0" name="service.product" value="OpenView"/>
1945
1958
  <param pos="0" name="service.component.vendor" value="HP"/>
1946
1959
  <param pos="0" name="service.component.family" value="OpenView"/>
1947
1960
  <param pos="0" name="service.component.product" value="Communication Broker"/>
@@ -2680,10 +2693,11 @@
2680
2693
  <param pos="0" name="os.product" value="JetDirect"/>
2681
2694
  </fingerprint>
2682
2695
 
2683
- <fingerprint pattern="^HP HTTP Server; HP ((\S+) \S+)">
2696
+ <fingerprint pattern="^HP HTTP Server; (?:Hewlett-Packard )?HP ((\S+) \S+)">
2684
2697
  <description>HP Printer</description>
2685
- <example>HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
2686
- <example>HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2698
+ <example os.product="Photosmart C309a" os.family="Photosmart">HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
2699
+ <example os.product="Officejet 6500" os.family="Officejet">HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2700
+ <example os.product="Designjet T520" os.family="Designjet">HP HTTP Server; Hewlett-Packard HP Designjet T520 36in - ABC123; Serial Number: 0123456789; Built:Tue Sep 09, 2014 08:32:54AM {012345678901}</example>
2687
2701
  <param pos="0" name="service.vendor" value="HP"/>
2688
2702
  <param pos="0" name="service.product" value="JetDirect"/>
2689
2703
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -2708,13 +2722,7 @@
2708
2722
  <param pos="0" name="os.product" value="JetDirect"/>
2709
2723
  </fingerprint>
2710
2724
 
2711
- <!-- This is not the normal form (with a space before version).
2712
- Since this version is vulnerable to a DoS attack, I suspect
2713
- it is actually a bogus banner generated by a honeypot.
2714
-
2715
- Allegro-Software-RomPager/ 2.10
2716
- -->
2717
- <fingerprint pattern="^(?:Allegro-Software-)?RomPager/(\S+)">
2725
+ <fingerprint pattern="^(?:Allegro-Software-)?RomPager/\s*(\S+)">
2718
2726
  <description>Embedded HTTP server used by many vendors and device
2719
2727
  types, including APC, 3Com, Andover Controls, Cisco VoIP, D-Link,
2720
2728
  Extreme Networks, Foundry Networks, Konica Minolta, Kronos
@@ -2723,6 +2731,7 @@
2723
2731
  <example service.version="4.01">Allegro-Software-RomPager/4.01</example>
2724
2732
  <example service.version="4.07">RomPager/4.07 UPnP/1.0</example>
2725
2733
  <example service.version="4.30b3">Allegro-Software-RomPager/4.30b3</example>
2734
+ <example service.version="2.10">Allegro-Software-RomPager/ 2.10</example>
2726
2735
  <param pos="0" name="service.vendor" value="Allegro Software"/>
2727
2736
  <param pos="0" name="service.product" value="RomPager"/>
2728
2737
  <param pos="1" name="service.version"/>
@@ -3093,6 +3102,15 @@
3093
3102
  <param pos="0" name="apache.variant" value="HP Web Jetadmin"/>
3094
3103
  <param pos="1" name="service.version"/>
3095
3104
  <param pos="2" name="apache.info"/>
3105
+ </fingerprint>
3106
+
3107
+ <fingerprint pattern="^HP Web Jetadmin ([\d\.]+)(?: \([^\)]+\))?$">
3108
+ <description>HP printers, perhaps Apache, but we can't say for sure</description>
3109
+ <example service.version="10.3.85669">HP Web Jetadmin 10.3.85669</example>
3110
+ <example service.version="10.3.91358">HP Web Jetadmin 10.3.91358 (10.3 SR5)</example>
3111
+ <param pos="0" name="service.vendor" value="HP"/>
3112
+ <param pos="0" name="service.product" value="Web Jetadmin"/>
3113
+ <param pos="1" name="service.version"/>
3096
3114
  </fingerprint>
3097
3115
 
3098
3116
  <fingerprint pattern="^Citrix Web PN Server$">
@@ -3134,6 +3152,14 @@
3134
3152
  <param pos="1" name="service.version"/>
3135
3153
  </fingerprint>
3136
3154
 
3155
+ <fingerprint pattern="^Embedthis-http$">
3156
+ <example>Embedthis-http</example>
3157
+ <description>An embedded web server for hosting dynamic web applications.</description>
3158
+ <param pos="0" name="service.vendor" value="Embedthis"/>
3159
+ <param pos="0" name="service.product" value="Appweb"/>
3160
+ <param pos="0" name="service.family" value="Appweb"/>
3161
+ </fingerprint>
3162
+
3137
3163
  <fingerprint pattern="^Avaya CMBE/((?:\d+\.)*\d+)$">
3138
3164
  <example>Avaya CMBE/2.0.0</example>
3139
3165
  <example>Avaya CMBE/2</example>
@@ -3146,16 +3172,23 @@
3146
3172
 
3147
3173
 
3148
3174
  <fingerprint pattern="^Rapid Logic/((?:\d+\.)*\d+)$">
3149
- <example>Rapid Logic/1.1</example>
3150
- <example>Rapid Logic/1</example>
3175
+ <example service.version="1.1">Rapid Logic/1.1</example>
3176
+ <example service.version="1">Rapid Logic/1</example>
3151
3177
  <description>Embedded web server by Rapid Logic, which was acquired by Wind River.</description>
3152
3178
  <!-- From Googling, it sounds like this is just referred to as the
3153
3179
  Rapid Logic web server. -->
3154
3180
  <param pos="0" name="service.vendor" value="Wind River"/>
3155
3181
  <param pos="0" name="service.product" value="Rapid Logic"/>
3156
3182
  <param pos="1" name="service.version"/>
3157
- </fingerprint>
3183
+ </fingerprint>
3158
3184
 
3185
+ <fingerprint pattern="^WindRiver-WebServer/((?:\d+\.)*\d+)$">
3186
+ <example service.version="4.4">WindRiver-WebServer/4.4</example>
3187
+ <description>Wind River HTTP server</description>
3188
+ <param pos="0" name="service.vendor" value="Wind River"/>
3189
+ <param pos="0" name="service.product" value="WebServer"/>
3190
+ <param pos="1" name="service.version"/>
3191
+ </fingerprint>
3159
3192
 
3160
3193
  <fingerprint pattern="^Sophos Email Appliance$">
3161
3194
  <example>Sophos Email Appliance</example>
@@ -3453,7 +3486,12 @@
3453
3486
  <param pos="0" name="service.vendor" value="CloudFlare"/>
3454
3487
  <param pos="0" name="service.product" value="CloudFlare Load Balancer"/>
3455
3488
  <param pos="0" name="service.family" value="CloudFlare"/>
3456
- </fingerprint>
3489
+ </fingerprint>
3457
3490
 
3491
+ <fingerprint pattern="^gSOAP/([\d\.]+)$">
3492
+ <example service.version="2.7">gSOAP/2.7</example>
3493
+ <description>gSOAP</description>
3494
+ <param pos="0" name="service.product" value="gSOAP"/>
3495
+ <param pos="1" name="service.version"/>
3496
+ </fingerprint>
3458
3497
  </fingerprints>
3459
-
data/xml/ntp_banners.xml CHANGED
@@ -258,6 +258,60 @@ NTP "banners", taken from a readvar response
258
258
  <param pos="3" name="os.version.version"/>
259
259
  <param pos="0" name="os.certainty" value="0.9"/>
260
260
  </fingerprint>
261
+ <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?12\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
262
+ <description>ntpd running on Mac OSX 10.8/Mountain Lion</description>
263
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="1.0">
264
+ version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
265
+ processor="x86_64", system="Darwin/12.1.0", leap=3, stratum=16,
266
+ </example>
267
+ <param pos="0" name="service.family" value="NTP"/>
268
+ <param pos="0" name="service.product" value="NTP"/>
269
+ <param pos="1" name="service.version"/>
270
+ <param pos="0" name="os.vendor" value="Apple"/>
271
+ <param pos="0" name="os.family" value="Mac OS X"/>
272
+ <param pos="0" name="os.product" value="Mac OS X"/>
273
+ <param pos="0" name="os.device" value="General"/>
274
+ <param pos="2" name="os.arch"/>
275
+ <param pos="0" name="os.version" value="10.8"/>
276
+ <param pos="3" name="os.version.version"/>
277
+ <param pos="0" name="os.certainty" value="0.9"/>
278
+ </fingerprint>
279
+ <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?13\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
280
+ <description>ntpd running on Mac OSX 10.9/Mavericks</description>
281
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="4.0">
282
+ version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
283
+ processor="x86_64", system="Darwin/13.4.0", leap=3, stratum=16,
284
+ </example>
285
+ <param pos="0" name="service.family" value="NTP"/>
286
+ <param pos="0" name="service.product" value="NTP"/>
287
+ <param pos="1" name="service.version"/>
288
+ <param pos="0" name="os.vendor" value="Apple"/>
289
+ <param pos="0" name="os.family" value="Mac OS X"/>
290
+ <param pos="0" name="os.product" value="Mac OS X"/>
291
+ <param pos="0" name="os.device" value="General"/>
292
+ <param pos="2" name="os.arch"/>
293
+ <param pos="0" name="os.version" value="10.9"/>
294
+ <param pos="3" name="os.version.version"/>
295
+ <param pos="0" name="os.certainty" value="0.9"/>
296
+ </fingerprint>
297
+ <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?14\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
298
+ <description>ntpd running on Mac OSX 10.10/Yosemite</description>
299
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="3.0">
300
+ version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
301
+ processor="x86_64", system="Darwin/14.3.0", leap=00, stratum=2,
302
+ </example>
303
+ <param pos="0" name="service.family" value="NTP"/>
304
+ <param pos="0" name="service.product" value="NTP"/>
305
+ <param pos="1" name="service.version"/>
306
+ <param pos="0" name="os.vendor" value="Apple"/>
307
+ <param pos="0" name="os.family" value="Mac OS X"/>
308
+ <param pos="0" name="os.product" value="Mac OS X"/>
309
+ <param pos="0" name="os.device" value="General"/>
310
+ <param pos="2" name="os.arch"/>
311
+ <param pos="0" name="os.version" value="10.10"/>
312
+ <param pos="3" name="os.version.version"/>
313
+ <param pos="0" name="os.certainty" value="0.9"/>
314
+ </fingerprint>
261
315
  <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;FreeBSD/?(?:[^ ]+-NETSCALER-([^ ]+))&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
262
316
  <description>ntpd running on Citrix Netscaler, which is based on FreeBSD</description>
263
317
  <example>
data/xml/smtp_banners.xml CHANGED
@@ -73,6 +73,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
73
73
  <param pos="0" name="service.family" value="Mail Server"/>
74
74
  <param pos="0" name="service.product" value="Mail Server"/>
75
75
  <param pos="1" name="service.version"/>
76
+ </fingerprint>
77
+
78
+ <fingerprint pattern="^(\S+) ArGoSoft Mail Server Freeware, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
79
+ <description>ArGoSoft Mail, freeware version</description>
80
+ <example host.name="example.com" service.version="1.8.8.8">example.com ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
81
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
82
+ <param pos="0" name="service.family" value="Mail Server"/>
83
+ <param pos="0" name="service.product" value="Mail Server"/>
84
+ <param pos="2" name="service.version"/>
85
+ <param pos="1" name="host.name"/>
76
86
  </fingerprint>
77
87
 
78
88
  <fingerprint pattern="^ArGoSoft Mail Server Pro for WinNT/2000, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
@@ -124,7 +134,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
124
134
  <param pos="0" name="service.family" value="PIX"/>
125
135
  <param pos="0" name="service.product" value="PIX"/>
126
136
  <param pos="0" name="service.version" value="4"/>
127
- </fingerprint>
137
+ </fingerprint>
138
+
139
+ <fingerprint pattern="CCProxy (\S+) SMTP Service Ready(?:\(Unregistered\))?$">
140
+ <description>Youngzsoft CCProxy SMTP</description>
141
+ <example service.version="7.3">CCProxy 7.3 SMTP Service Ready(Unregistered)</example>
142
+ <param pos="0" name="service.vendor" value="Youngzsoft"/>
143
+ <param pos="0" name="service.family" value="CCProxy"/>
144
+ <param pos="0" name="service.product" value="CCProxy"/>
145
+ <param pos="1" name="service.version"/>
146
+ </fingerprint>
128
147
 
129
148
  <fingerprint pattern="^[\*20 ]+$">
130
149
  <description>
@@ -426,6 +445,17 @@ The system or service fingerprint with the highest certainty overwrites the othe
426
445
  <param pos="0" name="service.family" value="IntraStore"/>
427
446
  <param pos="0" name="service.product" value="IntraStore"/>
428
447
  <param pos="1" name="host.name"/>
448
+ </fingerprint>
449
+
450
+ <fingerprint pattern="^(\S+) E?SMTP Server \(JAMES E?SMTP Server ([\d\.]+)\) ready (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+) \(\S+\)$">
451
+ <description>JAMES SMTP Server</description>
452
+ <example host.name="example.com" service.version="2.3.2">example.com SMTP Server (JAMES SMTP Server 2.3.2) ready Tue, 19 May 2015 00:36:13 +0200 (CEST)</example>
453
+ <param pos="0" name="service.vendor" value="Apache"/>
454
+ <param pos="0" name="service.product" value="James"/>
455
+ <param pos="2" name="service.version"/>
456
+ <param pos="1" name="host.name"/>
457
+ <param pos="3" name="system.time"/>
458
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
429
459
  </fingerprint>
430
460
 
431
461
  <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+\.\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
@@ -440,6 +470,18 @@ The system or service fingerprint with the highest certainty overwrites the othe
440
470
  <param pos="1" name="host.name"/>
441
471
  <param pos="2" name="service.version"/>
442
472
  <param pos="3" name="system.time"/>
473
+ </fingerprint>
474
+
475
+ <fingerprint pattern="^(\S+) E?SMTP MailEnable Service, Version: ([\d\.]+)-- ready at (\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})$">
476
+ <description>Simple MailEnable</description>
477
+ <example host.name="example.com">example.com ESMTP MailEnable Service, Version: 1.8-- ready at 05/20/15 08:50:22</example>
478
+ <param pos="0" name="service.vendor" value="MailEnable"/>
479
+ <param pos="0" name="service.family" value="MailEnable"/>
480
+ <param pos="0" name="service.product" value="MailEnable"/>
481
+ <param pos="0" name="system.time.format" value="MM/dd/yy HH:mm:ss"/>
482
+ <param pos="1" name="host.name"/>
483
+ <param pos="2" name="service.version"/>
484
+ <param pos="3" name="system.time"/>
443
485
  </fingerprint>
444
486
 
445
487
  <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
@@ -913,6 +955,32 @@ The system or service fingerprint with the highest certainty overwrites the othe
913
955
  <param pos="4" name="system.time"/>
914
956
  </fingerprint>
915
957
 
958
+ <fingerprint pattern="^(\S+)(?: UCX)? V\S+, OpenVMS V(\S+) (\S+) ready at .*$">
959
+ <description>Some unknown mail server on OpenVMS</description>
960
+ <example host.name="example.com" os.arch="IA64" os.version="8.4">example.com V5.7-ECO4, OpenVMS V8.4 IA64 ready at Wed, 20 May 2015 01:22:32 +0100 (BST)</example>
961
+ <example host.name="example.com" os.arch="Alpha" os.version="7.3-2">example.com V5.4-15E, OpenVMS V7.3-2 Alpha ready at Wed, 20 May 2015 01:22:18 +0100 (BST)</example>
962
+ <example host.name="example.com" os.arch="VAX" os.version="6.2">example.com UCX V4.2-21I, OpenVMS V6.2 VAX ready at Wed, 20 May 2015 01:15:16 GMT</example>
963
+ <example host.name="example.com" os.arch="Alpha" os.version="6.2-1H3">example.com UCX V4.2-21I, OpenVMS V6.2-1H3 Alpha ready at Wed, 20 May 2015 00:55:37 GMT</example>
964
+ <param pos="1" name="host.name"/>
965
+ <param pos="0" name="os.vendor" value="HP"/>
966
+ <param pos="0" name="os.family" value="OpenVMS"/>
967
+ <param pos="0" name="os.product" value="OpenVMS"/>
968
+ <param pos="0" name="os.device" value="General"/>
969
+ <param pos="2" name="os.version"/>
970
+ <param pos="3" name="os.arch"/>
971
+ </fingerprint>
972
+
973
+ <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\]) ([\d\.]+); (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2})$">
974
+ <description>A.K.I PMail</description>
975
+ <example host.name="example.com" service.version="1.91">example.com ESMTP PMailServer [Free Edition] 1.91; Fri, 22 May 2015 02:04:56</example>
976
+ <param pos="0" name="service.vendor" value="A.K.I Software"/>
977
+ <param pos="0" name="service.product" value="PMail Server"/>
978
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss"/>
979
+ <param pos="1" name="host.name"/>
980
+ <param pos="2" name="service.version"/>
981
+ <param pos="3" name="system.time"/>
982
+ </fingerprint>
983
+
916
984
  <fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)-([^ ]+)\) \(([^ ]+)\) *$">
917
985
  <!--
918
986
  220 foo.bar.com ESMTP Postfix (Postfix-19991231-pl08) (Linux-Mandrake)
@@ -1051,6 +1119,15 @@ The system or service fingerprint with the highest certainty overwrites the othe
1051
1119
  </description>
1052
1120
  <param pos="0" name="service.product" value="raptor"/>
1053
1121
  <param pos="1" name="host.name"/>
1122
+ </fingerprint>
1123
+
1124
+ <fingerprint pattern="^(\S+) SAP (\S+) E?SMTP service ready$">
1125
+ <description>SAP SMTP Server</description>
1126
+ <example host.name="example.com" service.version="8.04(53)">example.com SAP 8.04(53) ESMTP service ready</example>
1127
+ <param pos="0" name="service.vendor" value="SAP"/>
1128
+ <param pos="0" name="service.product" value="SMTP"/>
1129
+ <param pos="2" name="service.version"/>
1130
+ <param pos="1" name="host.name"/>
1054
1131
  </fingerprint>
1055
1132
 
1056
1133
  <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+) \(PHNE_([^ ]+)\) */ *(.+); *(.+) \(.+\)$">
@@ -1070,6 +1147,24 @@ The system or service fingerprint with the highest certainty overwrites the othe
1070
1147
  <param pos="3" name="sendmail.hpux.phne.version"/>
1071
1148
  <param pos="4" name="sendmail.config.version"/>
1072
1149
  <param pos="5" name="system.time"/>
1150
+ </fingerprint>
1151
+
1152
+ <fingerprint pattern="^(\S+) ESMTP Sendmail \S+ version ([\d\.]+) - Revision \S+ HP-UX([\d\.]+).*(\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S{3})$">
1153
+ <description>
1154
+ sendmail on HPUX
1155
+ </description>
1156
+ <example host.name="example.com" os.version="11.31" service.version="8.13.3">example.com ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT</example>
1157
+ <param pos="0" name="service.family" value="Sendmail"/>
1158
+ <param pos="0" name="service.product" value="Sendmail"/>
1159
+ <param pos="0" name="os.vendor" value="HP"/>
1160
+ <param pos="0" name="os.family" value="HP-UX"/>
1161
+ <param pos="0" name="os.device" value="General"/>
1162
+ <param pos="0" name="os.product" value="HP-UX"/>
1163
+ <param pos="3" name="os.version"/>
1164
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1165
+ <param pos="1" name="host.name"/>
1166
+ <param pos="2" name="service.version"/>
1167
+ <param pos="4" name="system.time"/>
1073
1168
  </fingerprint>
1074
1169
 
1075
1170
  <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+)/UW([^ ]+) ready at *(.+) \(.+\) *$">
@@ -1493,6 +1588,18 @@ The system or service fingerprint with the highest certainty overwrites the othe
1493
1588
  <param pos="1" name="host.name"/>
1494
1589
  </fingerprint>
1495
1590
 
1591
+ <fingerprint pattern="^(\S+) ESMTP Sendmail (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+)$">
1592
+ <description>
1593
+ catch all for other versions of sendmail, with a date/time
1594
+ </description>
1595
+ <example host.name="example.com">example.com ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
1596
+ <param pos="0" name="service.family" value="Sendmail"/>
1597
+ <param pos="0" name="service.product" value="Sendmail"/>
1598
+ <param pos="1" name="host.name"/>
1599
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1600
+ <param pos="2" name="system.time"/>
1601
+ </fingerprint>
1602
+
1496
1603
  <!-- Sun Internet Mail Server -->
1497
1604
  <!-- Sun Internet Mail Server sims\.([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+) -->
1498
1605
 
@@ -1713,13 +1820,21 @@ The system or service fingerprint with the highest certainty overwrites the othe
1713
1820
  <param pos="4" name="system.time"/>
1714
1821
  </fingerprint>
1715
1822
 
1716
- <fingerprint pattern="^([^ ]+) E?SMTP(?: Ready\.?)?$">
1717
- <description>
1718
- catch all for daemons that have no distinguishing fingerprint whatsoever
1719
- </description>
1720
- <example>foo.example.com ESMTP</example>
1721
- <example>foo.example.com ESMTP Ready</example>
1722
- <example>foo.example.com SMTP</example>
1823
+ <fingerprint pattern="^(\S+) E?SMTP Perl" flags="REG_ICASE">
1824
+ <description>Some simple PERL SMTP server</description>
1825
+ <example host.name="example.com">example.com ESMTP Perl</example>
1826
+ <param pos="0" name="service.product" value="Perl"/>
1827
+ <param pos="1" name="host.name"/>
1828
+ </fingerprint>
1829
+
1830
+ <fingerprint pattern="^([^ ]+) E?SMTP(?: (?:Service )?Ready\.?)?$" flags="REG_ICASE">
1831
+ <description>
1832
+ catch all for daemons that have no distinguishing fingerprint whatsoever
1833
+ </description>
1834
+ <example host.name="example.com">example.com ESMTP</example>
1835
+ <example host.name="example.com">example.com ESMTP Ready</example>
1836
+ <example host.name="example.com">example.com SMTP</example>
1837
+ <example host.name="example.com">example.com ESMTP Service ready</example>
1723
1838
  <param pos="0" name="service.product" value="Unknown"/>
1724
1839
  <param pos="1" name="host.name"/>
1725
1840
  </fingerprint>
data/xml/snmp_sysdescr.xml CHANGED
@@ -1031,9 +1031,10 @@
1031
1031
  BROCADE
1032
1032
  =======================================================================-->
1033
1033
 
1034
- <fingerprint pattern="^Fibre Channel Switch\.$">
1034
+ <fingerprint pattern="^Fibre Channel Switch\.?$">
1035
1035
  <description>Brocade FabricOS switch</description>
1036
1036
  <example>Fibre Channel Switch.</example>
1037
+ <example>Fibre Channel Switch</example>
1037
1038
  <param pos="0" name="os.vendor" value="Brocade"/>
1038
1039
  <param pos="0" name="os.product" value="Fabric OS"/>
1039
1040
  <param pos="0" name="os.device" value="Switch"/>
@@ -2631,22 +2632,10 @@ Copyright (c) 1995-2005 by Cisco Systems
2631
2632
  <param pos="4" name="os.version.version"/>
2632
2633
  </fingerprint>
2633
2634
 
2634
- <fingerprint pattern="^(\S+) (.*?) Digital UNIX V(\S+) \(Rev\. ([^\)]+)\).*TCP/IP$">
2635
+ <fingerprint pattern="^(\S+) (.*?) Digital UNIX V(\S+)\s+\(Rev\. ([^\)]+)\).*TCP/IP$">
2635
2636
  <description>Digital/Compaq/HP Tru64 Unix</description>
2636
- <example>clima.igpsdfpe COMPAQ AlphaServer DS20E 500 MHz Digital UNIX V4.0F (Rev. 1229); Mon Apr 12 13:30:41 EDT 1999 TCP/IP</example>
2637
- <example>dino.snusdfr COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Thu Oct 21 13:13:28 KST 1999 TCP/IP</example>
2638
- <example>george1.sdftw COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Fri Apr 21 14:49:53 CST 2000 TCP/IP</example>
2639
- <example>hsdfdf.it COMPAQ AlphaServer DS20E 666 MHz Digital UNIX V4.0F (Rev. 1229); Fri Apr 27 12:22:53 MET DST 2001 TCP/IP</example>
2640
- <example>hisdfcfdcnr.it COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Thu Jan 20 21:51:21 GMT 2000 TCP/IP</example>
2641
- <example>ingriv.na.infn.it COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Mon Feb 5 12:09:16 MET 2001 TCP/IP</example>
2642
- <example>lib.nthsdfv.tw COMPAQ AlphaServer DS20E 833 MHz Digital UNIX V4.0F (Rev. 1229); Sat Oct 31 14:16:13 CST 2009 TCP/IP</example>
2643
- <example>main.chemisdfna.it COMPAQ AlphaServer DS10 466 MHz Digital UNIX V4.0F (Rev. 1229); Sat Nov 27 14:08:50 GMT+0100 2004 TCP/IP</example>
2644
- <example>moldyn.cscp.sdfr.it COMPAQ Professional Workstation XP1000 Digital UNIX V5.0 (Rev. 910); Fri Nov 17 15:54:45 MET 2000 TCP/IP</example>
2645
- <example>nambukdb COMPAQ AlphaServer DS20E 666 MHz Digital UNIX V4.0F (Rev. 1229); Mon Aug 13 22:11:20 KST 2007 TCP/IP</example>
2646
- <example>nctsphys1.phsdfthu.edu.tw COMPAQ Professional Workstation XP1000 Digital UNIX V4.0E (Rev. 1091); Wed Jul 14 15:57:17 CST 1999 TCP/IP</example>
2647
- <example>oya.gesdfcsb.edu COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Fri Sep 13 13:44:20 PDT 2002 TCP/IP</example>
2648
- <example>quarsdfctecsdfr.th COMPAQ AlphaServer DS10 466 MHz Digital UNIX V4.0G (Rev. 1530); Fri Jun 20 14:03:00 GMT+0700 2003 TCP/IP</example>
2649
- <example>tunisdf.nhisdfdu.tw COMPAQ AlphaServer DS10 617 MHz Digital UNIX V4.0F (Rev. 1229); Wed May 22 13:55:58 CST 2002 TCP/IP</example>
2637
+ <example host.name="example.com" hw.product="COMPAQ AlphaServer DS10 617 MHz" os.version="4.0F" os.version.version="1229">example.com COMPAQ AlphaServer DS10 617 MHz Digital UNIX V4.0F (Rev. 1229); Wed May 22 13:55:58 CST 2002 TCP/IP</example>
2638
+ <example host.name="example.com" hw.product="COMPAQ Professional Workstation XP1000" os.version="4.0F" os.version.version="1229">example.com COMPAQ Professional Workstation XP1000 Digital UNIX V4.0F (Rev. 1229); Wed Jun 30 14:32:53 MET DST 2004 . TCP/IP</example>
2650
2639
  <param pos="0" name="os.vendor" value="HP"/>
2651
2640
  <param pos="0" name="os.family" value="Unix"/>
2652
2641
  <param pos="0" name="os.product" value="Digital Unix"/>
@@ -3363,13 +3352,22 @@ Copyright (c) 1995-2005 by Cisco Systems
3363
3352
  </fingerprint>
3364
3353
 
3365
3354
  <fingerprint pattern="^Integrated Lights-Out (\d) \d+\.\d+ [A-Za-z]{3} \d{1,2} \d{4}$">
3366
- <description>HP Integrated Lights-Out (iLO)</description>
3355
+ <description>HP Integrated Lights-Out (iLO) with firmware version</description>
3367
3356
  <example os.version="4">Integrated Lights-Out 4 2.02 Aug 18 2014</example>
3368
3357
  <!--2.02 is firmware version-->
3369
3358
  <param pos="0" name="os.vendor" value="HP"/>
3370
3359
  <param pos="0" name="os.family" value="iLO"/>
3371
3360
  <param pos="0" name="os.device" value="iLO"/>
3372
3361
  <param pos="1" name="os.version"/>
3362
+ </fingerprint>
3363
+
3364
+ <fingerprint pattern="^Integrated Lights-Out (\d) \(iLO \d\) for Integrity$">
3365
+ <description>HP Integrated Lights-Out (iLO) without firmware version</description>
3366
+ <example os.version="2">Integrated Lights-Out 2 (iLO 2) for Integrity</example>
3367
+ <param pos="0" name="os.vendor" value="HP"/>
3368
+ <param pos="0" name="os.family" value="iLO"/>
3369
+ <param pos="0" name="os.device" value="iLO"/>
3370
+ <param pos="1" name="os.version"/>
3373
3371
  </fingerprint>
3374
3372
 
3375
3373
  <!--======================================================================
@@ -4803,6 +4801,23 @@ Copyright (c) 1995-2005 by Cisco Systems
4803
4801
  <param pos="0" name="os.device" value="Printer"/>
4804
4802
  </fingerprint>
4805
4803
 
4804
+ <!--======================================================================
4805
+ Lenel
4806
+ =======================================================================-->
4807
+
4808
+ <fingerprint pattern="^(LNL-\d+) (.*) Firmware Version ([\d\.]+) Build \d+$">
4809
+ <description>Various Lenel hardware, typically door controllers, etc</description>
4810
+ <example hw.product="LNL-2210" os.device="Intelligent Single Door Controller" os.version="1.17.6">LNL-2210 Intelligent Single Door Controller Firmware Version 1.17.6 Build 359</example>
4811
+ <example hw.product="LNL-2220" os.device="Intelligent Dual Reader Controller" os.version="1.17.3">LNL-2220 Intelligent Dual Reader Controller Firmware Version 1.17.3 Build 351</example>
4812
+ <example hw.product="LNL-3300" os.device="Intelligent System Controller" os.version="1.17.6">LNL-3300 Intelligent System Controller Firmware Version 1.17.6 Build 359</example>
4813
+ <param pos="0" name="os.vendor" value="Lenel"/>
4814
+ <!-- it isn't clear what the OS is... -->
4815
+ <param pos="1" name="hw.product"/>
4816
+ <param pos="2" name="os.device"/>
4817
+ <param pos="3" name="os.version"/>
4818
+ </fingerprint>
4819
+
4820
+
4806
4821
  <!--======================================================================
4807
4822
  LINUX
4808
4823
 
@@ -5197,6 +5212,28 @@ Copyright (c) 1995-2005 by Cisco Systems
5197
5212
  <param pos="0" name="os.product" value="Windows Server 2003"/>
5198
5213
  <param pos="0" name="os.device" value="General"/>
5199
5214
  <param pos="0" name="os.arch" value="x86_64"/>
5215
+ </fingerprint>
5216
+
5217
+ <fingerprint pattern="^Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel \S+64.*$">
5218
+ <description>Rare Windows 2003 SP2 sysDescr, x64</description>
5219
+ <example>Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel EM64T Family 6 Model 23 Stepping 6</example>
5220
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5221
+ <param pos="0" name="os.family" value="Windows"/>
5222
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
5223
+ <param pos="0" name="os.device" value="General"/>
5224
+ <param pos="0" name="os.arch" value="x86_64"/>
5225
+ <param pos="0" name="os.version" value="SP1"/>
5226
+ </fingerprint>
5227
+
5228
+ <fingerprint pattern="^Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel x86.*$">
5229
+ <description>Rare Windows 2003 SP2 sysDescr, x86</description>
5230
+ <example>Windows_NT Microsoft Windows Server 2003 5.2 3790 Service Pack 2, GenuineIntel x86 Family 6 Model 23 Stepping 6</example>
5231
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5232
+ <param pos="0" name="os.family" value="Windows"/>
5233
+ <param pos="0" name="os.product" value="Windows Server 2003"/>
5234
+ <param pos="0" name="os.device" value="General"/>
5235
+ <param pos="0" name="os.arch" value="x86"/>
5236
+ <param pos="0" name="os.version" value="SP1"/>
5200
5237
  </fingerprint>
5201
5238
 
5202
5239
  <fingerprint pattern="^Microsoft Windows CE Version ([\d.]+).*$">
@@ -5338,6 +5375,26 @@ Copyright (c) 1995-2005 by Cisco Systems
5338
5375
  <param pos="0" name="os.product" value="Windows 8"/>
5339
5376
  <param pos="0" name="os.device" value="General"/>
5340
5377
  <param pos="0" name="os.arch" value="x86"/>
5378
+ </fingerprint>
5379
+
5380
+ <fingerprint pattern="^Hardware: \S+64.*Software: Windows Version 6.3 \(Build 9600">
5381
+ <description>Windows 8 on x86_64</description>
5382
+ <example>Hardware: AMD64 Family 21 Model 0 Stepping 2 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 9600 Multiprocessor Free)</example>
5383
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5384
+ <param pos="0" name="os.family" value="Windows"/>
5385
+ <param pos="0" name="os.product" value="Windows 8.1"/>
5386
+ <param pos="0" name="os.device" value="General"/>
5387
+ <param pos="0" name="os.arch" value="x86_64"/>
5388
+ </fingerprint>
5389
+
5390
+ <fingerprint pattern="^Hardware: x86.*Software: Windows Version 6.3 \(Build 9600">
5391
+ <description>Windows 8 on x86</description>
5392
+ <example>Hardware: x86 Family 21 Model 0 Stepping 2 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 9600 Multiprocessor Free)</example>
5393
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5394
+ <param pos="0" name="os.family" value="Windows"/>
5395
+ <param pos="0" name="os.product" value="Windows 8.1"/>
5396
+ <param pos="0" name="os.device" value="General"/>
5397
+ <param pos="0" name="os.arch" value="x86"/>
5341
5398
  </fingerprint>
5342
5399
 
5343
5400
  <fingerprint pattern="Windows\s\S+\s(6\.2\.\d+)\s+Server\s[\d\.]+\s(\w+).*">
@@ -7943,6 +8000,29 @@ Copyright (c) 1995-2005 by Cisco Systems
7943
8000
  <param pos="0" name="os.product" value="VxWorks"/>
7944
8001
  </fingerprint>
7945
8002
 
8003
+ <!--======================================================================
8004
+ VMware
8005
+ =======================================================================-->
8006
+
8007
+ <fingerprint pattern="^(VMware ESXi?) (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$">
8008
+ <description>VMware ESX/ESXi</description>
8009
+ <example os.product="VMware ESXi" os.version="5.1.0" os.arch="x86_64">VMware ESXi 5.1.0 build-1157734 VMware, Inc. x86_64</example>
8010
+ <example os.product="VMware ESX" os.version="5.0.0" os.arch="x86_64">VMware ESX 5.0.0 build-623860 VMware, Inc. x86_64</example>
8011
+ <param pos="0" name="os.vendor" value="VMware"/>
8012
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
8013
+ <param pos="1" name="os.product"/>
8014
+ <param pos="2" name="os.version"/>
8015
+ <param pos="3" name="os.arch"/>
8016
+ </fingerprint>
8017
+
8018
+ <fingerprint pattern="^&quot;vSphere Management Assistant ([\d\.]+)&quot;$">
8019
+ <description>VMware vSphere Management assistant, which is a virtual machine (https://www.vmware.com/support/developer/vima/)</description>
8020
+ <example os.version="4.1.0">"vSphere Management Assistant 4.1.0"</example>
8021
+ <param pos="0" name="os.vendor" value="VMware"/>
8022
+ <param pos="0" name="os.product" value="vSphere Management Assistant"/>
8023
+ <param pos="1" name="os.version"/>
8024
+ </fingerprint>
8025
+
7946
8026
 
7947
8027
  <!--======================================================================
7948
8028
  XEROX
@@ -8198,23 +8278,4 @@ Copyright (c) 1995-2005 by Cisco Systems
8198
8278
  <param pos="0" name="os.product" value="Prestige 650R-T3"/>
8199
8279
  <param pos="0" name="os.device" value="Broadband Router"/>
8200
8280
  </fingerprint>
8201
-
8202
- <fingerprint pattern="^(VMware ESXi?) (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$">
8203
- <description>VMware ESX/ESXi</description>
8204
- <example os.product="VMware ESXi" os.version="5.1.0" os.arch="x86_64">VMware ESXi 5.1.0 build-1157734 VMware, Inc. x86_64</example>
8205
- <example os.product="VMware ESX" os.version="5.0.0" os.arch="x86_64">VMware ESX 5.0.0 build-623860 VMware, Inc. x86_64</example>
8206
- <param pos="0" name="os.vendor" value="VMware"/>
8207
- <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
8208
- <param pos="1" name="os.product"/>
8209
- <param pos="2" name="os.version"/>
8210
- <param pos="3" name="os.arch"/>
8211
- </fingerprint>
8212
-
8213
- <fingerprint pattern="^&quot;vSphere Management Assistant ([\d\.]+)&quot;$">
8214
- <description>VMware vSphere Management assistant, which is a virtual machine (https://www.vmware.com/support/developer/vima/)</description>
8215
- <example os.version="4.1.0">"vSphere Management Assistant 4.1.0"</example>
8216
- <param pos="0" name="os.vendor" value="VMware"/>
8217
- <param pos="0" name="os.product" value="vSphere Management Assistant"/>
8218
- <param pos="1" name="os.version"/>
8219
- </fingerprint>
8220
8281
  </fingerprints>
data/xml/ssh_banners.xml CHANGED
@@ -590,10 +590,11 @@ fingerprint SSH servers.
590
590
  <param pos="0" name="os.product" value="Windows"/>
591
591
  </fingerprint>
592
592
 
593
- <fingerprint pattern="^([^\s]+) FlowSsh: WinSSHD ([^ ]+):?.*$">
593
+ <fingerprint pattern="^([^\s]+) FlowSsh: (?:Bitvise SSH Server \(WinSSHD\)|WinSSHD) ([\d\.]+):?.*$">
594
594
  <description>Bitvise WinSSHD (which uses Bitvise flowssh)</description>
595
- <example>1.03 FlowSsh: WinSSHD 5.09</example>
596
- <example>1.07 FlowSsh: WinSSHD 5.20: free only for personal non-commercial use</example>
595
+ <example service.version="5.09" service.component.version="1.03">1.03 FlowSsh: WinSSHD 5.09</example>
596
+ <example service.version="5.20" service.component.version="1.07">1.07 FlowSsh: WinSSHD 5.20: free only for personal non-commercial use</example>
597
+ <example service.version="6.03" service.component.version="5.21">5.21 FlowSsh: Bitvise SSH Server (WinSSHD) 6.03: free only for personal non-commercial use</example>
597
598
  <param pos="1" name="service.component.version"/>
598
599
  <param pos="2" name="service.version"/>
599
600
  <param pos="0" name="service.component.vendor" value="Bitvise"/>
@@ -633,9 +634,10 @@ fingerprint SSH servers.
633
634
  <param pos="0" name="os.product" value="Windows"/>
634
635
  </fingerprint>
635
636
 
636
- <fingerprint pattern="^VShell_(\d+)_(\d+)_(\d+)_(\d+) VShell$">
637
+ <fingerprint pattern="^VShell_(?:Special_Edition_)?(\d+)_(\d+)_(\d+)_(\d+) VShell$">
637
638
  <description>VanDyke VShell</description>
638
- <example>VShell_3_6_2_446 VShell</example>
639
+ <example service.version="3" service.version.version="6" service.version.version.version="2" service.version.version.version.version="446">VShell_3_6_2_446 VShell</example>
640
+ <example service.version="2" service.version.version="5" service.version.version.version="0" service.version.version.version.version="204">VShell_Special_Edition_2_5_0_204 VShell</example>
639
641
  <param pos="1" name="service.version"/>
640
642
  <param pos="2" name="service.version.version"/>
641
643
  <param pos="3" name="service.version.version.version"/>
@@ -788,6 +790,14 @@ fingerprint SSH servers.
788
790
  <param pos="0" name="os.device" value="Network"/>
789
791
  <param pos="0" name="os.family" value="Comware"/>
790
792
  <param pos="1" name="os.version"/>
793
+ </fingerprint>
794
+
795
+ <fingerprint pattern="^Data ONTAP SSH [\d\.]+$">
796
+ <description>SSH NetApp appliances</description>
797
+ <example>Data ONTAP SSH 1.0</example>
798
+ <param pos="0" name="os.vendor" value="NetApp"/>
799
+ <param pos="0" name="os.family" value="Data ONTAP"/>
800
+ <param pos="0" name="os.product" value="Data ONTAP"/>
791
801
  </fingerprint>
792
802
 
793
803
  <fingerprint pattern="^(\d\.\d+\.\d+) SSH Secure Shell OpenVMS V\d\.\d$">
@@ -826,6 +836,14 @@ fingerprint SSH servers.
826
836
  <param pos="0" name="os.certainty" value="0.75"/>
827
837
  </fingerprint>
828
838
 
839
+ <fingerprint pattern="^\S+ SSH Secure Shell Tru64 UNIX$">
840
+ <description>Digital/Compaq/HP Tru64 Unix</description>
841
+ <example>3.2.0 SSH Secure Shell Tru64 UNIX</example>
842
+ <param pos="0" name="os.vendor" value="HP"/>
843
+ <param pos="0" name="os.family" value="Unix"/>
844
+ <param pos="0" name="os.product" value="Tru64 Unix"/>
845
+ <param pos="0" name="os.device" value="General"/>
846
+ </fingerprint>
829
847
  <!--
830
848
  1.2.22j4rad
831
849
  2.40
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.0.2
4
+ version: 2.0.4
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2015-05-20 00:00:00.000000000 Z
11
+ date: 2015-05-29 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec