recog 2.1.20 → 2.1.21

Sign up to get free protection for your applications and to get access to all the features.
Files changed (47) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/version.rb +1 -1
  3. data/remap.json +131 -0
  4. data/spec/lib/fingerprint_self_test_spec.rb +16 -1
  5. data/update_cpes.py +202 -0
  6. data/xml/apache_os.xml +29 -5
  7. data/xml/architecture.xml +3 -3
  8. data/xml/dns_versionbind.xml +56 -10
  9. data/xml/ftp_banners.xml +56 -12
  10. data/xml/h323_callresp.xml +4 -4
  11. data/xml/hp_pjl_id.xml +8 -8
  12. data/xml/http_cookies.xml +20 -8
  13. data/xml/http_servers.xml +122 -8
  14. data/xml/http_wwwauth.xml +13 -3
  15. data/xml/imap_banners.xml +19 -1
  16. data/xml/ldap_searchresult.xml +44 -68
  17. data/xml/mdns_device-info_txt.xml +18 -7
  18. data/xml/mdns_workstation_txt.xml +7 -7
  19. data/xml/mysql_banners.xml +159 -13
  20. data/xml/mysql_error.xml +124 -21
  21. data/xml/nntp_banners.xml +10 -4
  22. data/xml/ntp_banners.xml +144 -84
  23. data/xml/operating_system.xml +39 -10
  24. data/xml/pop_banners.xml +32 -12
  25. data/xml/rsh_resp.xml +8 -3
  26. data/xml/sip_banners.xml +4 -3
  27. data/xml/sip_user_agents.xml +4 -3
  28. data/xml/smb_native_lm.xml +9 -4
  29. data/xml/smb_native_os.xml +50 -25
  30. data/xml/smtp_banners.xml +108 -33
  31. data/xml/smtp_debug.xml +11 -8
  32. data/xml/smtp_ehlo.xml +14 -11
  33. data/xml/smtp_expn.xml +17 -11
  34. data/xml/smtp_help.xml +17 -11
  35. data/xml/smtp_mailfrom.xml +4 -3
  36. data/xml/smtp_noop.xml +13 -8
  37. data/xml/smtp_quit.xml +10 -8
  38. data/xml/smtp_rcptto.xml +1 -3
  39. data/xml/smtp_rset.xml +10 -8
  40. data/xml/smtp_turn.xml +10 -8
  41. data/xml/smtp_vrfy.xml +18 -11
  42. data/xml/snmp_sysdescr.xml +157 -451
  43. data/xml/snmp_sysobjid.xml +57 -4
  44. data/xml/ssh_banners.xml +104 -5
  45. data/xml/upnp_banners.xml +16 -1
  46. data/xml/x11_banners.xml +34 -9
  47. metadata +4 -2
data/xml/smtp_banners.xml CHANGED
@@ -1,28 +1,28 @@
1
1
  <?xml version="1.0" encoding="UTF-8"?>
2
- <!--
3
- SMTP greeting lines (part of the banner after the response code) are matched
4
- against these patterns (1 line at a time) to fingerprint SMTP servers.
2
+ <fingerprints matches="smtp.banner" protocol="smtp" database_type="service" preference="0.20">
3
+ <!--
4
+ SMTP greeting lines (part of the banner after the response code) are matched
5
+ against these patterns (1 line at a time) to fingerprint SMTP servers.
5
6
 
6
- This is always done in addition to the patterns in other smtp_*.xml files.
7
- These XML files are used in this order:
8
- smtp_banners.xml
9
- smtp_ehlo.xml
10
- smtp_help.xml
11
- smtp_noop.xml
12
- smtp_expn.xml
13
- smtp_vrfy.xml
14
- smtp_debug.xml
15
- smtp_turn.xml
16
- smtp_rset.xml
17
- smtp_quit.xml
7
+ This is always done in addition to the patterns in other smtp_*.xml files.
8
+ These XML files are used in this order:
9
+ smtp_banners.xml
10
+ smtp_ehlo.xml
11
+ smtp_help.xml
12
+ smtp_noop.xml
13
+ smtp_expn.xml
14
+ smtp_vrfy.xml
15
+ smtp_debug.xml
16
+ smtp_turn.xml
17
+ smtp_rset.xml
18
+ smtp_quit.xml
18
19
 
19
- The system or service fingerprint with the highest certainty overwrites the others.
20
+ The system or service fingerprint with the highest certainty overwrites the others.
20
21
 
21
- 'preference' notes: This value has been impacted by the poor quality of the 'Cisco PIX' match.
22
- Additionally, the 'preference' value for the other databases mentioned above has been set so
23
- as to implement their preference as described.
24
- -->
25
- <fingerprints matches="smtp.banner" protocol="smtp" database_type="service" preference="0.20">
22
+ 'preference' notes: This value has been impacted by the poor quality of the 'Cisco PIX' match.
23
+ Additionally, the 'preference' value for the other databases mentioned above has been set so
24
+ as to implement their preference as described.
25
+ -->
26
26
  <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) EVAL \d+-\d+\)$">
27
27
  <description>IMail - EVAL version</description>
28
28
  <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 EVAL 11347-1)</example>
@@ -30,6 +30,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
30
30
  <param pos="0" name="service.family" value="IMail Server"/>
31
31
  <param pos="0" name="service.product" value="IMail Server"/>
32
32
  <param pos="2" name="service.version"/>
33
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
33
34
  <param pos="1" name="host.name"/>
34
35
  <param pos="0" name="imail.eval" value="yes"/>
35
36
  </fingerprint>
@@ -40,6 +41,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
40
41
  <param pos="0" name="service.family" value="IMail Server"/>
41
42
  <param pos="0" name="service.product" value="IMail Server"/>
42
43
  <param pos="2" name="service.version"/>
44
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
43
45
  <param pos="1" name="host.name"/>
44
46
  </fingerprint>
45
47
  <fingerprint pattern="^([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\) NT-ESMTP Server X1$">
@@ -49,6 +51,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
49
51
  <param pos="0" name="service.family" value="IMail Server"/>
50
52
  <param pos="0" name="service.product" value="IMail Server"/>
51
53
  <param pos="2" name="service.version"/>
54
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
52
55
  <param pos="1" name="host.name"/>
53
56
  </fingerprint>
54
57
  <fingerprint pattern="^([^ ]+) SMTP AnalogX Proxy ([^ ]+\.[^ ]+) \(Release\) ready *$">
@@ -58,6 +61,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
58
61
  <param pos="0" name="service.family" value="Proxy"/>
59
62
  <param pos="0" name="service.product" value="Proxy"/>
60
63
  <param pos="2" name="service.version"/>
64
+ <param pos="0" name="service.cpe23" value="cpe:/a:analogx:proxy:{service.version}"/>
61
65
  <param pos="1" name="host.name"/>
62
66
  </fingerprint>
63
67
  <fingerprint pattern="^ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
@@ -66,6 +70,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
66
70
  <param pos="0" name="os.vendor" value="Microsoft"/>
67
71
  <param pos="0" name="os.family" value="Windows"/>
68
72
  <param pos="0" name="os.product" value="Windows"/>
73
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
69
74
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
70
75
  <param pos="0" name="service.family" value="Mail Server"/>
71
76
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -78,6 +83,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
78
83
  <param pos="0" name="os.vendor" value="Microsoft"/>
79
84
  <param pos="0" name="os.family" value="Windows"/>
80
85
  <param pos="0" name="os.product" value="Windows"/>
86
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
81
87
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
82
88
  <param pos="0" name="service.family" value="Mail Server"/>
83
89
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -92,6 +98,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
92
98
  <param pos="0" name="os.vendor" value="Microsoft"/>
93
99
  <param pos="0" name="os.family" value="Windows"/>
94
100
  <param pos="0" name="os.product" value="Windows"/>
101
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
95
102
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
96
103
  <param pos="0" name="service.family" value="Mail Server"/>
97
104
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -115,14 +122,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
115
122
  <param pos="0" name="service.vendor" value="Check Point"/>
116
123
  <param pos="0" name="service.family" value="Check Point"/>
117
124
  <param pos="0" name="service.product" value="Firewall-1"/>
125
+ <param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
118
126
  </fingerprint>
119
127
  <fingerprint pattern="^SMTP/cmap ready_+$">
120
128
  <description>Cisco Pix v4.x</description>
121
129
  <example>SMTP/cmap ready________________________________________________________________________</example>
122
- <param pos="0" name="service.vendor" value="Cisco"/>
123
- <param pos="0" name="service.family" value="PIX"/>
124
- <param pos="0" name="service.product" value="PIX"/>
125
- <param pos="0" name="service.version" value="4"/>
130
+ <param pos="0" name="os.vendor" value="Cisco"/>
131
+ <param pos="0" name="os.family" value="PIX"/>
132
+ <param pos="0" name="os.product" value="PIX"/>
133
+ <param pos="0" name="os.version" value="4"/>
134
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:4"/>
126
135
  </fingerprint>
127
136
  <fingerprint pattern="CCProxy (\S+) SMTP Service Ready(?:\(Unregistered\))?$">
128
137
  <description>Youngzsoft CCProxy SMTP</description>
@@ -143,10 +152,11 @@ The system or service fingerprint with the highest certainty overwrites the othe
143
152
 
144
153
  Search Cisco's documentation for "fixup protocol SMTP" for more information.
145
154
  </description>
146
- <example service.product="PIX">***************************</example>
147
- <param pos="0" name="service.vendor" value="Cisco"/>
148
- <param pos="0" name="service.family" value="PIX"/>
149
- <param pos="0" name="service.product" value="PIX"/>
155
+ <example os.product="PIX">***************************</example>
156
+ <param pos="0" name="os.vendor" value="Cisco"/>
157
+ <param pos="0" name="os.family" value="PIX"/>
158
+ <param pos="0" name="os.product" value="PIX"/>
159
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
150
160
  </fingerprint>
151
161
  <fingerprint pattern="^([^ ]+) +ESMTP CPMTA-([^ ]+)_([^ ]+)_([^ ]+)_([^ ]+) - NO UCE *$">
152
162
  <description>Critical Path (aka InScribe) Messaging Server
@@ -190,6 +200,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
190
200
  <param pos="0" name="os.family" value="Mac OS"/>
191
201
  <param pos="0" name="os.device" value="General"/>
192
202
  <param pos="0" name="os.product" value="Mac OS"/>
203
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
193
204
  <param pos="1" name="host.name"/>
194
205
  <param pos="2" name="service.version"/>
195
206
  </fingerprint>
@@ -200,11 +211,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
200
211
  <param pos="0" name="service.family" value="Exchange Server"/>
201
212
  <param pos="0" name="service.product" value="Exchange Server"/>
202
213
  <param pos="2" name="service.version"/>
214
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
203
215
  <param pos="1" name="host.name"/>
204
216
  <param pos="0" name="os.vendor" value="Microsoft"/>
205
217
  <param pos="0" name="os.family" value="Windows"/>
206
218
  <param pos="0" name="os.device" value="General"/>
207
219
  <param pos="0" name="os.product" value="Windows"/>
220
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
208
221
  </fingerprint>
209
222
  <fingerprint pattern="^([^ ]+) Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+) ready *$">
210
223
  <description>Microsoft Exchange Server 5.0 (for sure, can't be confused with the IIS builtin SMTP service)</description>
@@ -213,11 +226,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
213
226
  <param pos="0" name="service.family" value="Exchange Server"/>
214
227
  <param pos="0" name="service.product" value="Exchange Server"/>
215
228
  <param pos="2" name="service.version"/>
229
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
216
230
  <param pos="1" name="host.name"/>
217
231
  <param pos="0" name="os.vendor" value="Microsoft"/>
218
232
  <param pos="0" name="os.family" value="Windows"/>
219
233
  <param pos="0" name="os.device" value="General"/>
220
234
  <param pos="0" name="os.product" value="Windows"/>
235
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
221
236
  </fingerprint>
222
237
  <fingerprint pattern="^([^ ]+) Microsoft ESMTP MAIL Service ready at .*$">
223
238
  <description>Microsoft Exchange 2007/2010 (for sure, can't be confused with the IIS builtin SMTP service)</description>
@@ -225,11 +240,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
225
240
  <param pos="0" name="service.vendor" value="Microsoft"/>
226
241
  <param pos="0" name="service.family" value="Exchange Server"/>
227
242
  <param pos="0" name="service.product" value="Exchange Server"/>
243
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
228
244
  <param pos="1" name="host.name"/>
229
245
  <param pos="0" name="os.vendor" value="Microsoft"/>
230
246
  <param pos="0" name="os.family" value="Windows"/>
231
247
  <param pos="0" name="os.device" value="General"/>
232
248
  <param pos="0" name="os.product" value="Windows"/>
249
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
233
250
  </fingerprint>
234
251
  <fingerprint pattern="^([^ ]+) Microsoft SMTP MAIL ready at (.+) Version: +(\d+\.\d+\.\d+\.\d+\.\d+) *$">
235
252
  <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 1</description>
@@ -238,6 +255,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
238
255
  <param pos="0" name="service.family" value="IIS"/>
239
256
  <param pos="0" name="service.product" value="IIS"/>
240
257
  <param pos="3" name="service.version"/>
258
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
241
259
  <param pos="1" name="host.name"/>
242
260
  <param pos="2" name="system.time"/>
243
261
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
@@ -245,6 +263,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
245
263
  <param pos="0" name="os.family" value="Windows"/>
246
264
  <param pos="0" name="os.device" value="General"/>
247
265
  <param pos="0" name="os.product" value="Windows"/>
266
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
248
267
  </fingerprint>
249
268
  <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(\d+\.\d+\.\d+\.\d+) +ready +(?:at +)?(.+)$">
250
269
  <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 2 </description>
@@ -255,6 +274,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
255
274
  <param pos="0" name="service.family" value="IIS"/>
256
275
  <param pos="0" name="service.product" value="IIS"/>
257
276
  <param pos="2" name="service.version"/>
277
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
258
278
  <param pos="1" name="host.name"/>
259
279
  <param pos="3" name="system.time"/>
260
280
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
@@ -262,6 +282,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
262
282
  <param pos="0" name="os.family" value="Windows"/>
263
283
  <param pos="0" name="os.device" value="General"/>
264
284
  <param pos="0" name="os.product" value="Windows"/>
285
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
265
286
  </fingerprint>
266
287
  <fingerprint pattern="^ESMTP Exim$">
267
288
  <description>Exim - without version string or hostname</description>
@@ -269,6 +290,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
269
290
  <param pos="0" name="service.vendor" value="exim"/>
270
291
  <param pos="0" name="service.family" value="exim"/>
271
292
  <param pos="0" name="service.product" value="exim"/>
293
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
272
294
  </fingerprint>
273
295
  <fingerprint pattern="^ ?([^, ]+)(?:,)? ESMTP \(?(?i:Exim) +(\d+\.[\d_.bRC-]+)\)?(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
274
296
  <description>Exim - with version string and optional timestamp</description>
@@ -288,6 +310,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
288
310
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
289
311
  <param pos="1" name="host.name"/>
290
312
  <param pos="2" name="service.version"/>
313
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
291
314
  <param pos="3" name="system.time"/>
292
315
  </fingerprint>
293
316
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+) ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
@@ -299,6 +322,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
299
322
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
300
323
  <param pos="1" name="host.name"/>
301
324
  <param pos="2" name="service.version"/>
325
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
302
326
  <param pos="3" name="system.time"/>
303
327
  </fingerprint>
304
328
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+\.[\d_.]+)(?: +#\d)? Ubuntu ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
@@ -307,12 +331,14 @@ The system or service fingerprint with the highest certainty overwrites the othe
307
331
  <param pos="0" name="os.vendor" value="Ubuntu"/>
308
332
  <param pos="0" name="os.family" value="Linux"/>
309
333
  <param pos="0" name="os.product" value="Linux"/>
334
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
310
335
  <param pos="0" name="service.vendor" value="exim"/>
311
336
  <param pos="0" name="service.family" value="exim"/>
312
337
  <param pos="0" name="service.product" value="exim"/>
313
338
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
314
339
  <param pos="1" name="host.name"/>
315
340
  <param pos="2" name="service.version"/>
341
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
316
342
  <param pos="3" name="system.time"/>
317
343
  </fingerprint>
318
344
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim)(?: +#\d)? *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
@@ -323,11 +349,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
323
349
  <param pos="0" name="service.vendor" value="exim"/>
324
350
  <param pos="0" name="service.family" value="exim"/>
325
351
  <param pos="0" name="service.product" value="exim"/>
352
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
326
353
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
327
354
  <param pos="1" name="host.name"/>
328
355
  <param pos="2" name="system.time"/>
329
356
  </fingerprint>
330
- <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
357
+ <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
331
358
  <description>Exim - without hostname</description>
332
359
  <example service.version="4.82" system.time="Thu, 16 Nov 2017 12:19:22 +0300">ESMTP Exim 4.82 Thu, 16 Nov 2017 12:19:22 +0300 </example>
333
360
  <example service.version="4.82"> ESMTP Exim 4.82 Thu, 16 Nov 2017 11:41:41 +0300 </example>
@@ -337,6 +364,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
337
364
  <param pos="0" name="service.product" value="exim"/>
338
365
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
339
366
  <param pos="1" name="service.version"/>
367
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
340
368
  <param pos="2" name="system.time"/>
341
369
  </fingerprint>
342
370
  <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
@@ -367,6 +395,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
367
395
  <param pos="0" name="service.product" value="GroupWise"/>
368
396
  <param pos="1" name="host.name"/>
369
397
  <param pos="2" name="service.version"/>
398
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
370
399
  </fingerprint>
371
400
  <fingerprint pattern="^([^ ]+) GroupWise Internet Agent (\d+\.[\d.]+) Copyright .*\d{4}-\d{4} Novell, Inc..* All rights reserved. Ready *$">
372
401
  <description>Novell GroupWise Internet Agent - versions 5 and higher, second variant</description>
@@ -377,6 +406,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
377
406
  <param pos="0" name="service.product" value="GroupWise"/>
378
407
  <param pos="1" name="host.name"/>
379
408
  <param pos="2" name="service.version"/>
409
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
380
410
  </fingerprint>
381
411
  <fingerprint pattern="^([^ ]+) GroupWise SMTP/MIME Daemon ([^ ]+\.[^ ]+) v([^ ]+) Ready \(C\).* Novell, Inc\. *$">
382
412
  <description>Novell GroupWise - versions below 5</description>
@@ -387,6 +417,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
387
417
  <param pos="1" name="host.name"/>
388
418
  <param pos="2" name="service.version"/>
389
419
  <param pos="3" name="service.version.version"/>
420
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
390
421
  </fingerprint>
391
422
  <fingerprint pattern="^([^ ]+) (?:ESMTP )?running IBM VM SMTP (.+)(?:; | on )(.+) *$">
392
423
  <description>IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.</description>
@@ -419,6 +450,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
419
450
  <param pos="0" name="service.vendor" value="Apache"/>
420
451
  <param pos="0" name="service.product" value="James"/>
421
452
  <param pos="2" name="service.version"/>
453
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:james:{service.version}"/>
422
454
  <param pos="1" name="host.name"/>
423
455
  <param pos="3" name="system.time"/>
424
456
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
@@ -429,6 +461,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
429
461
  <param pos="0" name="os.vendor" value="Microsoft"/>
430
462
  <param pos="0" name="os.family" value="Windows"/>
431
463
  <param pos="0" name="os.product" value="Windows"/>
464
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
432
465
  <param pos="0" name="service.vendor" value="MailEnable"/>
433
466
  <param pos="0" name="service.family" value="Mail Server"/>
434
467
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -445,6 +478,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
445
478
  <param pos="0" name="os.vendor" value="Microsoft"/>
446
479
  <param pos="0" name="os.family" value="Windows"/>
447
480
  <param pos="0" name="os.product" value="Windows"/>
481
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
448
482
  <param pos="0" name="service.vendor" value="MailEnable"/>
449
483
  <param pos="0" name="service.family" value="Mail Server"/>
450
484
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -513,8 +547,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
513
547
  <param pos="0" name="os.device" value="General"/>
514
548
  <param pos="0" name="os.product" value="Windows"/>
515
549
  <param pos="0" name="os.arch" value="x86"/>
550
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
516
551
  <param pos="1" name="host.name"/>
517
552
  <param pos="2" name="service.version"/>
553
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
518
554
  <param pos="3" name="system.time"/>
519
555
  </fingerprint>
520
556
  <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
@@ -529,8 +565,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
529
565
  <param pos="0" name="os.device" value="General"/>
530
566
  <param pos="0" name="os.product" value="Windows"/>
531
567
  <param pos="0" name="os.arch" value="x86"/>
568
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
532
569
  <param pos="1" name="host.name"/>
533
570
  <param pos="2" name="service.version"/>
571
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
534
572
  <param pos="3" name="system.time"/>
535
573
  </fingerprint>
536
574
  <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) ready *$">
@@ -544,8 +582,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
544
582
  <param pos="0" name="os.device" value="General"/>
545
583
  <param pos="0" name="os.product" value="Windows"/>
546
584
  <param pos="0" name="os.arch" value="x86"/>
585
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
547
586
  <param pos="1" name="host.name"/>
548
587
  <param pos="2" name="service.version"/>
588
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
549
589
  </fingerprint>
550
590
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:using )?MDaemon v(\d+\.[\d.]+) ([^ ]+) *$">
551
591
  <description>MDaemon mail server - with version revision</description>
@@ -560,9 +600,11 @@ The system or service fingerprint with the highest certainty overwrites the othe
560
600
  <param pos="0" name="os.device" value="General"/>
561
601
  <param pos="0" name="os.product" value="Windows"/>
562
602
  <param pos="0" name="os.arch" value="x86"/>
603
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
563
604
  <param pos="1" name="host.name"/>
564
605
  <param pos="2" name="service.version"/>
565
606
  <param pos="3" name="service.version.version"/>
607
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
566
608
  </fingerprint>
567
609
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:\()?MDaemon v([\d.]+) ([^ ]+) ([^ )]+)(?:\))? *$">
568
610
  <description>MDaemon mail server - with service pack</description>
@@ -576,10 +618,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
576
618
  <param pos="0" name="os.device" value="General"/>
577
619
  <param pos="0" name="os.product" value="Windows"/>
578
620
  <param pos="0" name="os.arch" value="x86"/>
621
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
579
622
  <param pos="1" name="host.name"/>
580
623
  <param pos="2" name="service.version"/>
581
624
  <param pos="3" name="service.version.version"/>
582
625
  <param pos="4" name="service.version.version.version"/>
626
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
583
627
  </fingerprint>
584
628
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) ([^ ]+)\) *$">
585
629
  <description>MDaemon mail server</description>
@@ -592,11 +636,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
592
636
  <param pos="0" name="os.device" value="General"/>
593
637
  <param pos="0" name="os.product" value="Windows"/>
594
638
  <param pos="0" name="os.arch" value="x86"/>
639
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
595
640
  <param pos="1" name="host.name"/>
596
641
  <param pos="2" name="service.version"/>
597
642
  <param pos="3" name="service.version.version"/>
598
643
  <param pos="4" name="service.version.version.version"/>
599
644
  <param pos="5" name="service.version.version.version.version"/>
645
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
600
646
  </fingerprint>
601
647
  <!-- example: 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700 -->
602
648
  <fingerprint pattern="^([^ ]+) +E?SMTP (?i:MERAK) ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
@@ -634,6 +680,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
634
680
  <param pos="0" name="os.family" value="NetWare"/>
635
681
  <param pos="0" name="os.device" value="General"/>
636
682
  <param pos="0" name="os.product" value="NetWare"/>
683
+ <param pos="0" name="os.cpe23" value="cpe:/o:novell:netware:-"/>
637
684
  <param pos="1" name="host.name"/>
638
685
  <param pos="2" name="service.version"/>
639
686
  </fingerprint>
@@ -647,6 +694,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
647
694
  <param pos="0" name="os.family" value="Windows"/>
648
695
  <param pos="0" name="os.device" value="General"/>
649
696
  <param pos="0" name="os.product" value="Windows"/>
697
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
650
698
  <param pos="1" name="host.name"/>
651
699
  <param pos="2" name="service.version"/>
652
700
  </fingerprint>
@@ -670,6 +718,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
670
718
  <param pos="1" name="host.name"/>
671
719
  <param pos="2" name="service.version"/>
672
720
  <param pos="3" name="service.version.version"/>
721
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
673
722
  </fingerprint>
674
723
  <fingerprint pattern="^([^ ]+) ESMTP server \(Netscape Messaging Server - Version ([\d.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
675
724
  <description>Netscape Messaging Server - w/o patch number</description>
@@ -680,6 +729,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
680
729
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
681
730
  <param pos="1" name="host.name"/>
682
731
  <param pos="2" name="service.version"/>
732
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
683
733
  <param pos="3" name="system.time"/>
684
734
  </fingerprint>
685
735
  <fingerprint pattern="^([^ ]+) Lotus SMTP MTA Service Ready *$">
@@ -712,6 +762,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
712
762
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
713
763
  <param pos="1" name="host.name"/>
714
764
  <param pos="2" name="service.version"/>
765
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
715
766
  <param pos="3" name="system.time"/>
716
767
  </fingerprint>
717
768
  <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(IBM Domino Release (\d+\.[\w.]+(?: HF\d+)?)\) ready at (.+) *$">
@@ -783,6 +834,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
783
834
  <param pos="0" name="os.device" value="General"/>
784
835
  <param pos="2" name="os.version"/>
785
836
  <param pos="3" name="os.arch"/>
837
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:openvms:{os.version}"/>
786
838
  </fingerprint>
787
839
  <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\])? ([\d\.]+); (\w\w\w, +\d+ \w\w\w \d\d\d\d [\d:]+)$">
788
840
  <description>A.K.I PMail</description>
@@ -832,6 +884,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
832
884
  <param pos="0" name="os.device" value="General"/>
833
885
  <param pos="0" name="os.family" value="Linux"/>
834
886
  <param pos="0" name="os.product" value="Linux"/>
887
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
835
888
  </fingerprint>
836
889
  <fingerprint pattern="^([^ ]+)(?: ESMTP)? Hi, I'm a Mail-in-a-Box \(Ubuntu/Postfix; see https://mailinabox.email/\)$">
837
890
  <description>Postfix - Ubuntu, Mail-in-a-Box package</description>
@@ -844,6 +897,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
844
897
  <param pos="0" name="os.device" value="General"/>
845
898
  <param pos="0" name="os.family" value="Linux"/>
846
899
  <param pos="0" name="os.product" value="Linux"/>
900
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
847
901
  </fingerprint>
848
902
  <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Debian/GNU\)$">
849
903
  <description>Postfix - Debian</description>
@@ -855,6 +909,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
855
909
  <param pos="0" name="os.device" value="General"/>
856
910
  <param pos="0" name="os.family" value="Linux"/>
857
911
  <param pos="0" name="os.product" value="Linux"/>
912
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
858
913
  </fingerprint>
859
914
  <fingerprint pattern="^([^ ]+) ESMTP.* Postfix *\(.+\) *$">
860
915
  <description>Postfix - generic banner with amusing comments in parentheses</description>
@@ -926,6 +981,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
926
981
  <param pos="0" name="os.family" value="HP-UX"/>
927
982
  <param pos="0" name="os.device" value="General"/>
928
983
  <param pos="0" name="os.product" value="HP-UX"/>
984
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
929
985
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
930
986
  <param pos="1" name="host.name"/>
931
987
  <param pos="2" name="service.version"/>
@@ -943,6 +999,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
943
999
  <param pos="0" name="os.device" value="General"/>
944
1000
  <param pos="0" name="os.product" value="HP-UX"/>
945
1001
  <param pos="3" name="os.version"/>
1002
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:{os.version}"/>
946
1003
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
947
1004
  <param pos="1" name="host.name"/>
948
1005
  <param pos="2" name="service.version"/>
@@ -975,6 +1032,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
975
1032
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
976
1033
  <param pos="1" name="host.name"/>
977
1034
  <param pos="2" name="os.version"/>
1035
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
978
1036
  <param pos="3" name="service.version"/>
979
1037
  <param pos="4" name="system.time"/>
980
1038
  </fingerprint>
@@ -990,6 +1048,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
990
1048
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
991
1049
  <param pos="1" name="host.name"/>
992
1050
  <param pos="2" name="os.version"/>
1051
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
993
1052
  <param pos="3" name="service.version"/>
994
1053
  <param pos="4" name="sendmail.config.version"/>
995
1054
  <param pos="5" name="system.time"/>
@@ -1007,6 +1066,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1007
1066
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1008
1067
  <param pos="1" name="host.name"/>
1009
1068
  <param pos="2" name="os.version"/>
1069
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1010
1070
  <param pos="3" name="service.version"/>
1011
1071
  <param pos="4" name="sendmail.config.version"/>
1012
1072
  <param pos="5" name="system.time"/>
@@ -1020,6 +1080,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1020
1080
  <param pos="0" name="os.family" value="Linux"/>
1021
1081
  <param pos="0" name="os.device" value="General"/>
1022
1082
  <param pos="0" name="os.product" value="Linux"/>
1083
+ <param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:-"/>
1023
1084
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1024
1085
  <param pos="1" name="host.name"/>
1025
1086
  <param pos="2" name="service.version"/>
@@ -1036,6 +1097,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1036
1097
  <param pos="0" name="os.family" value="Solaris"/>
1037
1098
  <param pos="0" name="os.device" value="General"/>
1038
1099
  <param pos="0" name="os.product" value="Solaris"/>
1100
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1039
1101
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1040
1102
  <param pos="1" name="host.name"/>
1041
1103
  <param pos="2" name="service.version"/>
@@ -1051,6 +1113,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1051
1113
  <param pos="0" name="os.family" value="Solaris"/>
1052
1114
  <param pos="0" name="os.device" value="General"/>
1053
1115
  <param pos="0" name="os.product" value="Solaris"/>
1116
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1054
1117
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1055
1118
  <param pos="1" name="host.name"/>
1056
1119
  <param pos="2" name="service.version"/>
@@ -1067,6 +1130,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1067
1130
  <param pos="0" name="os.family" value="Linux"/>
1068
1131
  <param pos="0" name="os.device" value="General"/>
1069
1132
  <param pos="0" name="os.product" value="Linux"/>
1133
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1070
1134
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1071
1135
  <param pos="1" name="host.name"/>
1072
1136
  <param pos="2" name="service.version"/>
@@ -1084,6 +1148,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1084
1148
  <param pos="0" name="os.family" value="Linux"/>
1085
1149
  <param pos="0" name="os.product" value="Linux"/>
1086
1150
  <param pos="0" name="os.version" value="7.0"/>
1151
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
1087
1152
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1088
1153
  <param pos="1" name="host.name"/>
1089
1154
  <param pos="2" name="service.version"/>
@@ -1099,6 +1164,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1099
1164
  <param pos="0" name="os.family" value="Linux"/>
1100
1165
  <param pos="0" name="os.product" value="Linux"/>
1101
1166
  <param pos="0" name="os.version" value="8.0"/>
1167
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
1102
1168
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1103
1169
  <param pos="1" name="host.name"/>
1104
1170
  <param pos="2" name="service.version"/>
@@ -1114,6 +1180,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1114
1180
  <param pos="0" name="os.family" value="Linux"/>
1115
1181
  <param pos="0" name="os.product" value="Linux"/>
1116
1182
  <param pos="0" name="os.version" value="5.0"/>
1183
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:5.0"/>
1117
1184
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1118
1185
  <param pos="1" name="host.name"/>
1119
1186
  <param pos="2" name="service.version"/>
@@ -1129,6 +1196,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1129
1196
  <param pos="0" name="os.family" value="Linux"/>
1130
1197
  <param pos="0" name="os.product" value="Linux"/>
1131
1198
  <param pos="0" name="os.version" value="4.0"/>
1199
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:4.0"/>
1132
1200
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1133
1201
  <param pos="1" name="host.name"/>
1134
1202
  <param pos="2" name="service.version"/>
@@ -1144,6 +1212,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1144
1212
  <param pos="0" name="os.family" value="Linux"/>
1145
1213
  <param pos="0" name="os.product" value="Linux"/>
1146
1214
  <param pos="0" name="os.version" value="3.1"/>
1215
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:3.1"/>
1147
1216
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1148
1217
  <param pos="1" name="host.name"/>
1149
1218
  <param pos="2" name="service.version"/>
@@ -1160,6 +1229,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1160
1229
  <param pos="0" name="os.vendor" value="Debian"/>
1161
1230
  <param pos="0" name="os.family" value="Linux"/>
1162
1231
  <param pos="0" name="os.product" value="Linux"/>
1232
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1163
1233
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1164
1234
  <param pos="1" name="host.name"/>
1165
1235
  <param pos="2" name="service.version"/>
@@ -1175,6 +1245,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1175
1245
  <param pos="0" name="os.vendor" value="Ubuntu"/>
1176
1246
  <param pos="0" name="os.family" value="Linux"/>
1177
1247
  <param pos="0" name="os.product" value="Linux"/>
1248
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
1178
1249
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1179
1250
  <param pos="1" name="host.name"/>
1180
1251
  <param pos="2" name="service.version"/>
@@ -1189,6 +1260,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1189
1260
  <param pos="0" name="os.family" value="SunOS"/>
1190
1261
  <param pos="0" name="os.device" value="General"/>
1191
1262
  <param pos="0" name="os.product" value="Solaris"/>
1263
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1192
1264
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1193
1265
  <param pos="1" name="host.name"/>
1194
1266
  <param pos="2" name="service.version"/>
@@ -1219,6 +1291,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1219
1291
  <param pos="0" name="os.family" value="Windows"/>
1220
1292
  <param pos="0" name="os.device" value="General"/>
1221
1293
  <param pos="0" name="os.product" value="Windows NT"/>
1294
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_nt:-"/>
1222
1295
  <param pos="0" name="system.time.format" value="EEE, d MMM"/>
1223
1296
  <param pos="1" name="host.name"/>
1224
1297
  <param pos="2" name="metainfo.version"/>
@@ -1294,7 +1367,6 @@ The system or service fingerprint with the highest certainty overwrites the othe
1294
1367
  <example host.name="foo.bar">foo.bar ESMTP Sendmail</example>
1295
1368
  <example host.name="foo.bar">foo.bar Sendmail ready. </example>
1296
1369
  <param pos="0" name="service.family" value="Sendmail"/>
1297
- <param pos="0" name="service.family" value="Sendmail"/>
1298
1370
  <param pos="0" name="service.product" value="Sendmail"/>
1299
1371
  <param pos="1" name="host.name"/>
1300
1372
  <param pos="2" name="system.time"/>
@@ -1348,6 +1420,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1348
1420
  <param pos="0" name="os.family" value="Solaris"/>
1349
1421
  <param pos="0" name="os.device" value="General"/>
1350
1422
  <param pos="0" name="os.product" value="Solaris"/>
1423
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1351
1424
  <param pos="1" name="host.name"/>
1352
1425
  <param pos="2" name="service.version"/>
1353
1426
  </fingerprint>
@@ -1397,7 +1470,6 @@ The system or service fingerprint with the highest certainty overwrites the othe
1397
1470
  <example host.name="foo.bar" service.version="9.0.5.2077">foo.bar ESMTP SonicWALL (9.0.5.2077)</example>
1398
1471
  <example host.name="foo.bar" service.version="9.1.1.3113">foo.bar ESMTP SonicWall (9.1.1.3113)</example>
1399
1472
  <param pos="0" name="service.vendor" value="SonicWall"/>
1400
- <param pos="0" name="service.vendor" value="SonicWall"/>
1401
1473
  <param pos="0" name="service.family" value="Email Security"/>
1402
1474
  <param pos="0" name="service.product" value="Email Security"/>
1403
1475
  <param pos="1" name="host.name"/>
@@ -1442,6 +1514,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1442
1514
  <param pos="1" name="host.name"/>
1443
1515
  <param pos="2" name="service.version"/>
1444
1516
  <param pos="3" name="service.version.version"/>
1517
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1445
1518
  <param pos="4" name="system.time"/>
1446
1519
  </fingerprint>
1447
1520
  <fingerprint pattern="^([^ ]+) McAfee WebShield ASaP v([^ ]+\.[^ ]+\.[^ ]+): (.+) *$">
@@ -1457,6 +1530,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1457
1530
  <param pos="0" name="os.product" value="Linux"/>
1458
1531
  <param pos="1" name="host.name"/>
1459
1532
  <param pos="2" name="service.version"/>
1533
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1460
1534
  <param pos="3" name="system.time"/>
1461
1535
  </fingerprint>
1462
1536
  <fingerprint pattern="^([^ ]+) McAfee VirusScreen ASaP v([^ ]+\.[^ ]+): (.+) *$">
@@ -1472,6 +1546,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1472
1546
  <param pos="0" name="os.product" value="Linux"/>
1473
1547
  <param pos="1" name="host.name"/>
1474
1548
  <param pos="2" name="service.version"/>
1549
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1475
1550
  <param pos="3" name="system.time"/>
1476
1551
  </fingerprint>
1477
1552
  <fingerprint pattern="^([^ ]+) ESMTP Lyris ListManager service ready$">
@@ -1578,7 +1653,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1578
1653
  <param pos="0" name="service.family" value="David"/>
1579
1654
  <param pos="0" name="service.product" value="ESMTP"/>
1580
1655
  <param pos="1" name="host.name"/>
1581
- <param pos="2" name="service.version"/>>
1656
+ <param pos="2" name="service.version"/>
1582
1657
  </fingerprint>
1583
1658
  <fingerprint pattern="^(?i)(\S+) E?SMTP Perl">
1584
1659
  <description>Some simple PERL SMTP server</description>