recog 2.0.9 → 2.0.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7d1785649ccc5bd00c514b2963c659413584e803
-  data.tar.gz: 7f48e11585c4af802e79a1dedb68b504d54f6142
+  metadata.gz: 3afb2c6d348dfbe16dec6f3acf82455e48b15d23
+  data.tar.gz: 152196328e6d0ed66ced47488e2f89b5a7992694
 SHA512:
-  metadata.gz: 4a6b6a0648b32bc35a1c56c581c0f906ab0fef35e53e44d139aa1e3eaa8b0e04e3b4e26bc84df356937cce15bfd50d18c9dab59e7badc750f38de968de0a9eed
-  data.tar.gz: 9228765a199a1f24b1d001177cf77192de63bd03bb6989864f354b4be9bdddf4eda1af0240a4b4e498847ef0cad17b82ede5ab44ac44783363a3f876e80119ea
+  metadata.gz: 61ecb9f64e183652812e3722a65b0317f9f8cf89fbf58cb1a0d4db0bb65016f861b334b8a6531b26c25f76f9067a0255ebe16428814077393e616e13cf49938a
+  data.tar.gz: 1d28d10d0cf12f77261669ffbd78a0f956fadb2558cf8fc346977f2407374140ac7a67e3e9700415eb1045738fc69a30f4f3ff3e45bc19bc90e2a7aec4b4d89b

data/lib/recog/version.rb

@@ -1,3 +1,3 @@
 module Recog
-  VERSION = '2.0.9'
+  VERSION = '2.0.10'
 end

data/xml/smtp_banners.xml

@@ -1222,11 +1222,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
       <param pos="5" name="system.time"/>
    </fingerprint>
 
-   <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/([^/]+)/([^;]+); (.+) \(.+\)$">
+   <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/([^/]+)/([^;]+); (.+)(?: \(.+\))?$">
      <description>
        sendmail on AIX
       </description>
-      <example>foo.bar.com ESMTP Sendmail AIX4.2/8.7/8.7; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
+      <example host.name="example.com" os.version="4.2" service.version="8.7" sendmail.config.version="8.8">example.com ESMTP Sendmail AIX4.2/8.7/8.8; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
+      <example host.name="example.com" os.version="5.1" service.version="8.11.6p2" sendmail.config.version="8.11.0">example.com ESMTP Sendmail AIX5.1/8.11.6p2/8.11.0; Fri, 28 Aug 1970 19:42:05 -0800</example>
       <param pos="0" name="service.family" value="Sendmail"/>
       <param pos="0" name="service.product" value="Sendmail"/>
       <param pos="0" name="os.vendor" value="IBM"/>
@@ -1421,12 +1422,14 @@ The system or service fingerprint with the highest certainty overwrites the othe
       <param pos="4" name="system.time"/>
    </fingerprint>
 
-   <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^ ]+) */ *([^ ]+); *(.+) \(.+\)$">
+   <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *(.+)(?: \(.+\))?$">
       <description>
-        sendmail where neither daemon nor config file are patched (with timezone)
+        sendmail where neither daemon nor config file are patched, with and without timezone
       </description>
-      <example>mail.foo.bar ESMTP Sendmail 8.8.8/8.8.8; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
-      <example>mail.foo.bar ESMTP blah Sendmail 8.8.8/8.8.8; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
+      <example host.name="example.com" service.version="8.8.8" sendmail.config.version="8.8.9">example.com ESMTP Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
+      <example host.name="example.com" service.version="8.8.8" sendmail.config.version="8.8.9">example.com ESMTP blah Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
+      <example host.name="example.com" service.version="8.10.2" sendmail.config.version="8.10.3">example.com ESMTP Sendmail 8.10.2/8.10.3; Mon, 10 Sep 2001 08:37:14 -0400</example>
+      <example host.name="example.com" service.version="8.13.8" sendmail.config.version="8.13.9">example.com ESMTP foo-MTA Sendmail 8.13.8/8.13.9; Mon, 18 Apr 2011 08:52:38 -0700</example>
       <param pos="0" name="service.family" value="Sendmail"/>
       <param pos="0" name="service.product" value="Sendmail"/>
       <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
@@ -1436,22 +1439,6 @@ The system or service fingerprint with the highest certainty overwrites the othe
       <param pos="4" name="system.time"/>
    </fingerprint>
 
-   <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^ ]+) */ *([^ ]+) *; *(.+) *$">
-      <description>
-         sendmail where neither daemon nor config file are patched (without timezone)
-      </description>
-      <example>mail.foo.bar ESMTP Sendmail 8.10.2/8.10.2; Mon, 10 Sep 2001 08:37:14 -0400</example>
-      <example>mail.foo.bar ESMTP Sendmail 8.8.7/8.8.7; Mon, 2 Jul 2001 14:19:18 -0700</example>
-      <example>foo.example.com ESMTP foo-MTA Sendmail 8.13.8/8.13.8; Mon, 18 Apr 2011 08:52:38 -0700</example>
-      <param pos="0" name="service.family" value="Sendmail"/>
-      <param pos="0" name="service.product" value="Sendmail"/>
-      <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
-      <param pos="1" name="host.name"/>
-      <param pos="2" name="service.version"/>
-      <param pos="3" name="sendmail.config.version"/>
-      <param pos="4" name="system.time"/>
-    </fingerprint>
-
    <fingerprint pattern="^([^ ]+) +Sendmail ready\. *$">
       <description>
          some old version of sendmail - TODO: figure out which versions this could be
@@ -1588,11 +1575,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
       <param pos="1" name="host.name"/>
    </fingerprint>
 
-   <fingerprint pattern="^(\S+) ESMTP Sendmail (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+)$">
+   <fingerprint pattern="^(\S+) ESMTP Sendmail (\S{3}, \d{1,2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+)$">
       <description>
          catch all for other versions of sendmail, with a date/time
       </description>
       <example host.name="example.com">example.com ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
+      <example host.name="example.com">example.com ESMTP Sendmail Wed, 5 Aug 2015 17:40:38 -0400</example>
       <param pos="0" name="service.family" value="Sendmail"/>
       <param pos="0" name="service.product" value="Sendmail"/>
       <param pos="1" name="host.name"/>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: recog
 version: !ruby/object:Gem::Version
-  version: 2.0.9
+  version: 2.0.10
 platform: ruby
 authors:
 - Rapid7 Research
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-24 00:00:00.000000000 Z
+date: 2015-08-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec