recog 2.1.20 → 2.1.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/version.rb +1 -1
  3. data/remap.json +131 -0
  4. data/spec/lib/fingerprint_self_test_spec.rb +16 -1
  5. data/update_cpes.py +202 -0
  6. data/xml/apache_os.xml +29 -5
  7. data/xml/architecture.xml +3 -3
  8. data/xml/dns_versionbind.xml +56 -10
  9. data/xml/ftp_banners.xml +56 -12
  10. data/xml/h323_callresp.xml +4 -4
  11. data/xml/hp_pjl_id.xml +8 -8
  12. data/xml/http_cookies.xml +20 -8
  13. data/xml/http_servers.xml +122 -8
  14. data/xml/http_wwwauth.xml +13 -3
  15. data/xml/imap_banners.xml +19 -1
  16. data/xml/ldap_searchresult.xml +44 -68
  17. data/xml/mdns_device-info_txt.xml +18 -7
  18. data/xml/mdns_workstation_txt.xml +7 -7
  19. data/xml/mysql_banners.xml +159 -13
  20. data/xml/mysql_error.xml +124 -21
  21. data/xml/nntp_banners.xml +10 -4
  22. data/xml/ntp_banners.xml +144 -84
  23. data/xml/operating_system.xml +39 -10
  24. data/xml/pop_banners.xml +32 -12
  25. data/xml/rsh_resp.xml +8 -3
  26. data/xml/sip_banners.xml +4 -3
  27. data/xml/sip_user_agents.xml +4 -3
  28. data/xml/smb_native_lm.xml +9 -4
  29. data/xml/smb_native_os.xml +50 -25
  30. data/xml/smtp_banners.xml +108 -33
  31. data/xml/smtp_debug.xml +11 -8
  32. data/xml/smtp_ehlo.xml +14 -11
  33. data/xml/smtp_expn.xml +17 -11
  34. data/xml/smtp_help.xml +17 -11
  35. data/xml/smtp_mailfrom.xml +4 -3
  36. data/xml/smtp_noop.xml +13 -8
  37. data/xml/smtp_quit.xml +10 -8
  38. data/xml/smtp_rcptto.xml +1 -3
  39. data/xml/smtp_rset.xml +10 -8
  40. data/xml/smtp_turn.xml +10 -8
  41. data/xml/smtp_vrfy.xml +18 -11
  42. data/xml/snmp_sysdescr.xml +157 -451
  43. data/xml/snmp_sysobjid.xml +57 -4
  44. data/xml/ssh_banners.xml +104 -5
  45. data/xml/upnp_banners.xml +16 -1
  46. data/xml/x11_banners.xml +34 -9
  47. metadata +4 -2
data/xml/smtp_banners.xml CHANGED
@@ -1,28 +1,28 @@
1
1
  <?xml version="1.0" encoding="UTF-8"?>
2
- <!--
3
- SMTP greeting lines (part of the banner after the response code) are matched
4
- against these patterns (1 line at a time) to fingerprint SMTP servers.
2
+ <fingerprints matches="smtp.banner" protocol="smtp" database_type="service" preference="0.20">
3
+ <!--
4
+ SMTP greeting lines (part of the banner after the response code) are matched
5
+ against these patterns (1 line at a time) to fingerprint SMTP servers.
5
6
 
6
- This is always done in addition to the patterns in other smtp_*.xml files.
7
- These XML files are used in this order:
8
- smtp_banners.xml
9
- smtp_ehlo.xml
10
- smtp_help.xml
11
- smtp_noop.xml
12
- smtp_expn.xml
13
- smtp_vrfy.xml
14
- smtp_debug.xml
15
- smtp_turn.xml
16
- smtp_rset.xml
17
- smtp_quit.xml
7
+ This is always done in addition to the patterns in other smtp_*.xml files.
8
+ These XML files are used in this order:
9
+ smtp_banners.xml
10
+ smtp_ehlo.xml
11
+ smtp_help.xml
12
+ smtp_noop.xml
13
+ smtp_expn.xml
14
+ smtp_vrfy.xml
15
+ smtp_debug.xml
16
+ smtp_turn.xml
17
+ smtp_rset.xml
18
+ smtp_quit.xml
18
19
 
19
- The system or service fingerprint with the highest certainty overwrites the others.
20
+ The system or service fingerprint with the highest certainty overwrites the others.
20
21
 
21
- 'preference' notes: This value has been impacted by the poor quality of the 'Cisco PIX' match.
22
- Additionally, the 'preference' value for the other databases mentioned above has been set so
23
- as to implement their preference as described.
24
- -->
25
- <fingerprints matches="smtp.banner" protocol="smtp" database_type="service" preference="0.20">
22
+ 'preference' notes: This value has been impacted by the poor quality of the 'Cisco PIX' match.
23
+ Additionally, the 'preference' value for the other databases mentioned above has been set so
24
+ as to implement their preference as described.
25
+ -->
26
26
  <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) EVAL \d+-\d+\)$">
27
27
  <description>IMail - EVAL version</description>
28
28
  <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 EVAL 11347-1)</example>
@@ -30,6 +30,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
30
30
  <param pos="0" name="service.family" value="IMail Server"/>
31
31
  <param pos="0" name="service.product" value="IMail Server"/>
32
32
  <param pos="2" name="service.version"/>
33
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
33
34
  <param pos="1" name="host.name"/>
34
35
  <param pos="0" name="imail.eval" value="yes"/>
35
36
  </fingerprint>
@@ -40,6 +41,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
40
41
  <param pos="0" name="service.family" value="IMail Server"/>
41
42
  <param pos="0" name="service.product" value="IMail Server"/>
42
43
  <param pos="2" name="service.version"/>
44
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
43
45
  <param pos="1" name="host.name"/>
44
46
  </fingerprint>
45
47
  <fingerprint pattern="^([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\) NT-ESMTP Server X1$">
@@ -49,6 +51,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
49
51
  <param pos="0" name="service.family" value="IMail Server"/>
50
52
  <param pos="0" name="service.product" value="IMail Server"/>
51
53
  <param pos="2" name="service.version"/>
54
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
52
55
  <param pos="1" name="host.name"/>
53
56
  </fingerprint>
54
57
  <fingerprint pattern="^([^ ]+) SMTP AnalogX Proxy ([^ ]+\.[^ ]+) \(Release\) ready *$">
@@ -58,6 +61,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
58
61
  <param pos="0" name="service.family" value="Proxy"/>
59
62
  <param pos="0" name="service.product" value="Proxy"/>
60
63
  <param pos="2" name="service.version"/>
64
+ <param pos="0" name="service.cpe23" value="cpe:/a:analogx:proxy:{service.version}"/>
61
65
  <param pos="1" name="host.name"/>
62
66
  </fingerprint>
63
67
  <fingerprint pattern="^ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
@@ -66,6 +70,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
66
70
  <param pos="0" name="os.vendor" value="Microsoft"/>
67
71
  <param pos="0" name="os.family" value="Windows"/>
68
72
  <param pos="0" name="os.product" value="Windows"/>
73
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
69
74
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
70
75
  <param pos="0" name="service.family" value="Mail Server"/>
71
76
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -78,6 +83,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
78
83
  <param pos="0" name="os.vendor" value="Microsoft"/>
79
84
  <param pos="0" name="os.family" value="Windows"/>
80
85
  <param pos="0" name="os.product" value="Windows"/>
86
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
81
87
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
82
88
  <param pos="0" name="service.family" value="Mail Server"/>
83
89
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -92,6 +98,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
92
98
  <param pos="0" name="os.vendor" value="Microsoft"/>
93
99
  <param pos="0" name="os.family" value="Windows"/>
94
100
  <param pos="0" name="os.product" value="Windows"/>
101
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
95
102
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
96
103
  <param pos="0" name="service.family" value="Mail Server"/>
97
104
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -115,14 +122,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
115
122
  <param pos="0" name="service.vendor" value="Check Point"/>
116
123
  <param pos="0" name="service.family" value="Check Point"/>
117
124
  <param pos="0" name="service.product" value="Firewall-1"/>
125
+ <param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
118
126
  </fingerprint>
119
127
  <fingerprint pattern="^SMTP/cmap ready_+$">
120
128
  <description>Cisco Pix v4.x</description>
121
129
  <example>SMTP/cmap ready________________________________________________________________________</example>
122
- <param pos="0" name="service.vendor" value="Cisco"/>
123
- <param pos="0" name="service.family" value="PIX"/>
124
- <param pos="0" name="service.product" value="PIX"/>
125
- <param pos="0" name="service.version" value="4"/>
130
+ <param pos="0" name="os.vendor" value="Cisco"/>
131
+ <param pos="0" name="os.family" value="PIX"/>
132
+ <param pos="0" name="os.product" value="PIX"/>
133
+ <param pos="0" name="os.version" value="4"/>
134
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:4"/>
126
135
  </fingerprint>
127
136
  <fingerprint pattern="CCProxy (\S+) SMTP Service Ready(?:\(Unregistered\))?$">
128
137
  <description>Youngzsoft CCProxy SMTP</description>
@@ -143,10 +152,11 @@ The system or service fingerprint with the highest certainty overwrites the othe
143
152
 
144
153
  Search Cisco's documentation for "fixup protocol SMTP" for more information.
145
154
  </description>
146
- <example service.product="PIX">***************************</example>
147
- <param pos="0" name="service.vendor" value="Cisco"/>
148
- <param pos="0" name="service.family" value="PIX"/>
149
- <param pos="0" name="service.product" value="PIX"/>
155
+ <example os.product="PIX">***************************</example>
156
+ <param pos="0" name="os.vendor" value="Cisco"/>
157
+ <param pos="0" name="os.family" value="PIX"/>
158
+ <param pos="0" name="os.product" value="PIX"/>
159
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
150
160
  </fingerprint>
151
161
  <fingerprint pattern="^([^ ]+) +ESMTP CPMTA-([^ ]+)_([^ ]+)_([^ ]+)_([^ ]+) - NO UCE *$">
152
162
  <description>Critical Path (aka InScribe) Messaging Server
@@ -190,6 +200,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
190
200
  <param pos="0" name="os.family" value="Mac OS"/>
191
201
  <param pos="0" name="os.device" value="General"/>
192
202
  <param pos="0" name="os.product" value="Mac OS"/>
203
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
193
204
  <param pos="1" name="host.name"/>
194
205
  <param pos="2" name="service.version"/>
195
206
  </fingerprint>
@@ -200,11 +211,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
200
211
  <param pos="0" name="service.family" value="Exchange Server"/>
201
212
  <param pos="0" name="service.product" value="Exchange Server"/>
202
213
  <param pos="2" name="service.version"/>
214
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
203
215
  <param pos="1" name="host.name"/>
204
216
  <param pos="0" name="os.vendor" value="Microsoft"/>
205
217
  <param pos="0" name="os.family" value="Windows"/>
206
218
  <param pos="0" name="os.device" value="General"/>
207
219
  <param pos="0" name="os.product" value="Windows"/>
220
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
208
221
  </fingerprint>
209
222
  <fingerprint pattern="^([^ ]+) Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+) ready *$">
210
223
  <description>Microsoft Exchange Server 5.0 (for sure, can't be confused with the IIS builtin SMTP service)</description>
@@ -213,11 +226,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
213
226
  <param pos="0" name="service.family" value="Exchange Server"/>
214
227
  <param pos="0" name="service.product" value="Exchange Server"/>
215
228
  <param pos="2" name="service.version"/>
229
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
216
230
  <param pos="1" name="host.name"/>
217
231
  <param pos="0" name="os.vendor" value="Microsoft"/>
218
232
  <param pos="0" name="os.family" value="Windows"/>
219
233
  <param pos="0" name="os.device" value="General"/>
220
234
  <param pos="0" name="os.product" value="Windows"/>
235
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
221
236
  </fingerprint>
222
237
  <fingerprint pattern="^([^ ]+) Microsoft ESMTP MAIL Service ready at .*$">
223
238
  <description>Microsoft Exchange 2007/2010 (for sure, can't be confused with the IIS builtin SMTP service)</description>
@@ -225,11 +240,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
225
240
  <param pos="0" name="service.vendor" value="Microsoft"/>
226
241
  <param pos="0" name="service.family" value="Exchange Server"/>
227
242
  <param pos="0" name="service.product" value="Exchange Server"/>
243
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
228
244
  <param pos="1" name="host.name"/>
229
245
  <param pos="0" name="os.vendor" value="Microsoft"/>
230
246
  <param pos="0" name="os.family" value="Windows"/>
231
247
  <param pos="0" name="os.device" value="General"/>
232
248
  <param pos="0" name="os.product" value="Windows"/>
249
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
233
250
  </fingerprint>
234
251
  <fingerprint pattern="^([^ ]+) Microsoft SMTP MAIL ready at (.+) Version: +(\d+\.\d+\.\d+\.\d+\.\d+) *$">
235
252
  <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 1</description>
@@ -238,6 +255,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
238
255
  <param pos="0" name="service.family" value="IIS"/>
239
256
  <param pos="0" name="service.product" value="IIS"/>
240
257
  <param pos="3" name="service.version"/>
258
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
241
259
  <param pos="1" name="host.name"/>
242
260
  <param pos="2" name="system.time"/>
243
261
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
@@ -245,6 +263,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
245
263
  <param pos="0" name="os.family" value="Windows"/>
246
264
  <param pos="0" name="os.device" value="General"/>
247
265
  <param pos="0" name="os.product" value="Windows"/>
266
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
248
267
  </fingerprint>
249
268
  <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(\d+\.\d+\.\d+\.\d+) +ready +(?:at +)?(.+)$">
250
269
  <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 2 </description>
@@ -255,6 +274,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
255
274
  <param pos="0" name="service.family" value="IIS"/>
256
275
  <param pos="0" name="service.product" value="IIS"/>
257
276
  <param pos="2" name="service.version"/>
277
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
258
278
  <param pos="1" name="host.name"/>
259
279
  <param pos="3" name="system.time"/>
260
280
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
@@ -262,6 +282,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
262
282
  <param pos="0" name="os.family" value="Windows"/>
263
283
  <param pos="0" name="os.device" value="General"/>
264
284
  <param pos="0" name="os.product" value="Windows"/>
285
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
265
286
  </fingerprint>
266
287
  <fingerprint pattern="^ESMTP Exim$">
267
288
  <description>Exim - without version string or hostname</description>
@@ -269,6 +290,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
269
290
  <param pos="0" name="service.vendor" value="exim"/>
270
291
  <param pos="0" name="service.family" value="exim"/>
271
292
  <param pos="0" name="service.product" value="exim"/>
293
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
272
294
  </fingerprint>
273
295
  <fingerprint pattern="^ ?([^, ]+)(?:,)? ESMTP \(?(?i:Exim) +(\d+\.[\d_.bRC-]+)\)?(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
274
296
  <description>Exim - with version string and optional timestamp</description>
@@ -288,6 +310,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
288
310
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
289
311
  <param pos="1" name="host.name"/>
290
312
  <param pos="2" name="service.version"/>
313
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
291
314
  <param pos="3" name="system.time"/>
292
315
  </fingerprint>
293
316
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+) ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
@@ -299,6 +322,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
299
322
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
300
323
  <param pos="1" name="host.name"/>
301
324
  <param pos="2" name="service.version"/>
325
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
302
326
  <param pos="3" name="system.time"/>
303
327
  </fingerprint>
304
328
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+\.[\d_.]+)(?: +#\d)? Ubuntu ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
@@ -307,12 +331,14 @@ The system or service fingerprint with the highest certainty overwrites the othe
307
331
  <param pos="0" name="os.vendor" value="Ubuntu"/>
308
332
  <param pos="0" name="os.family" value="Linux"/>
309
333
  <param pos="0" name="os.product" value="Linux"/>
334
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
310
335
  <param pos="0" name="service.vendor" value="exim"/>
311
336
  <param pos="0" name="service.family" value="exim"/>
312
337
  <param pos="0" name="service.product" value="exim"/>
313
338
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
314
339
  <param pos="1" name="host.name"/>
315
340
  <param pos="2" name="service.version"/>
341
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
316
342
  <param pos="3" name="system.time"/>
317
343
  </fingerprint>
318
344
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim)(?: +#\d)? *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
@@ -323,11 +349,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
323
349
  <param pos="0" name="service.vendor" value="exim"/>
324
350
  <param pos="0" name="service.family" value="exim"/>
325
351
  <param pos="0" name="service.product" value="exim"/>
352
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
326
353
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
327
354
  <param pos="1" name="host.name"/>
328
355
  <param pos="2" name="system.time"/>
329
356
  </fingerprint>
330
- <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
357
+ <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
331
358
  <description>Exim - without hostname</description>
332
359
  <example service.version="4.82" system.time="Thu, 16 Nov 2017 12:19:22 +0300">ESMTP Exim 4.82 Thu, 16 Nov 2017 12:19:22 +0300 </example>
333
360
  <example service.version="4.82"> ESMTP Exim 4.82 Thu, 16 Nov 2017 11:41:41 +0300 </example>
@@ -337,6 +364,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
337
364
  <param pos="0" name="service.product" value="exim"/>
338
365
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
339
366
  <param pos="1" name="service.version"/>
367
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
340
368
  <param pos="2" name="system.time"/>
341
369
  </fingerprint>
342
370
  <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
@@ -367,6 +395,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
367
395
  <param pos="0" name="service.product" value="GroupWise"/>
368
396
  <param pos="1" name="host.name"/>
369
397
  <param pos="2" name="service.version"/>
398
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
370
399
  </fingerprint>
371
400
  <fingerprint pattern="^([^ ]+) GroupWise Internet Agent (\d+\.[\d.]+) Copyright .*\d{4}-\d{4} Novell, Inc..* All rights reserved. Ready *$">
372
401
  <description>Novell GroupWise Internet Agent - versions 5 and higher, second variant</description>
@@ -377,6 +406,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
377
406
  <param pos="0" name="service.product" value="GroupWise"/>
378
407
  <param pos="1" name="host.name"/>
379
408
  <param pos="2" name="service.version"/>
409
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
380
410
  </fingerprint>
381
411
  <fingerprint pattern="^([^ ]+) GroupWise SMTP/MIME Daemon ([^ ]+\.[^ ]+) v([^ ]+) Ready \(C\).* Novell, Inc\. *$">
382
412
  <description>Novell GroupWise - versions below 5</description>
@@ -387,6 +417,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
387
417
  <param pos="1" name="host.name"/>
388
418
  <param pos="2" name="service.version"/>
389
419
  <param pos="3" name="service.version.version"/>
420
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
390
421
  </fingerprint>
391
422
  <fingerprint pattern="^([^ ]+) (?:ESMTP )?running IBM VM SMTP (.+)(?:; | on )(.+) *$">
392
423
  <description>IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.</description>
@@ -419,6 +450,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
419
450
  <param pos="0" name="service.vendor" value="Apache"/>
420
451
  <param pos="0" name="service.product" value="James"/>
421
452
  <param pos="2" name="service.version"/>
453
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:james:{service.version}"/>
422
454
  <param pos="1" name="host.name"/>
423
455
  <param pos="3" name="system.time"/>
424
456
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
@@ -429,6 +461,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
429
461
  <param pos="0" name="os.vendor" value="Microsoft"/>
430
462
  <param pos="0" name="os.family" value="Windows"/>
431
463
  <param pos="0" name="os.product" value="Windows"/>
464
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
432
465
  <param pos="0" name="service.vendor" value="MailEnable"/>
433
466
  <param pos="0" name="service.family" value="Mail Server"/>
434
467
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -445,6 +478,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
445
478
  <param pos="0" name="os.vendor" value="Microsoft"/>
446
479
  <param pos="0" name="os.family" value="Windows"/>
447
480
  <param pos="0" name="os.product" value="Windows"/>
481
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
448
482
  <param pos="0" name="service.vendor" value="MailEnable"/>
449
483
  <param pos="0" name="service.family" value="Mail Server"/>
450
484
  <param pos="0" name="service.product" value="Mail Server"/>
@@ -513,8 +547,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
513
547
  <param pos="0" name="os.device" value="General"/>
514
548
  <param pos="0" name="os.product" value="Windows"/>
515
549
  <param pos="0" name="os.arch" value="x86"/>
550
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
516
551
  <param pos="1" name="host.name"/>
517
552
  <param pos="2" name="service.version"/>
553
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
518
554
  <param pos="3" name="system.time"/>
519
555
  </fingerprint>
520
556
  <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
@@ -529,8 +565,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
529
565
  <param pos="0" name="os.device" value="General"/>
530
566
  <param pos="0" name="os.product" value="Windows"/>
531
567
  <param pos="0" name="os.arch" value="x86"/>
568
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
532
569
  <param pos="1" name="host.name"/>
533
570
  <param pos="2" name="service.version"/>
571
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
534
572
  <param pos="3" name="system.time"/>
535
573
  </fingerprint>
536
574
  <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) ready *$">
@@ -544,8 +582,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
544
582
  <param pos="0" name="os.device" value="General"/>
545
583
  <param pos="0" name="os.product" value="Windows"/>
546
584
  <param pos="0" name="os.arch" value="x86"/>
585
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
547
586
  <param pos="1" name="host.name"/>
548
587
  <param pos="2" name="service.version"/>
588
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
549
589
  </fingerprint>
550
590
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:using )?MDaemon v(\d+\.[\d.]+) ([^ ]+) *$">
551
591
  <description>MDaemon mail server - with version revision</description>
@@ -560,9 +600,11 @@ The system or service fingerprint with the highest certainty overwrites the othe
560
600
  <param pos="0" name="os.device" value="General"/>
561
601
  <param pos="0" name="os.product" value="Windows"/>
562
602
  <param pos="0" name="os.arch" value="x86"/>
603
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
563
604
  <param pos="1" name="host.name"/>
564
605
  <param pos="2" name="service.version"/>
565
606
  <param pos="3" name="service.version.version"/>
607
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
566
608
  </fingerprint>
567
609
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:\()?MDaemon v([\d.]+) ([^ ]+) ([^ )]+)(?:\))? *$">
568
610
  <description>MDaemon mail server - with service pack</description>
@@ -576,10 +618,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
576
618
  <param pos="0" name="os.device" value="General"/>
577
619
  <param pos="0" name="os.product" value="Windows"/>
578
620
  <param pos="0" name="os.arch" value="x86"/>
621
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
579
622
  <param pos="1" name="host.name"/>
580
623
  <param pos="2" name="service.version"/>
581
624
  <param pos="3" name="service.version.version"/>
582
625
  <param pos="4" name="service.version.version.version"/>
626
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
583
627
  </fingerprint>
584
628
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) ([^ ]+)\) *$">
585
629
  <description>MDaemon mail server</description>
@@ -592,11 +636,13 @@ The system or service fingerprint with the highest certainty overwrites the othe
592
636
  <param pos="0" name="os.device" value="General"/>
593
637
  <param pos="0" name="os.product" value="Windows"/>
594
638
  <param pos="0" name="os.arch" value="x86"/>
639
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
595
640
  <param pos="1" name="host.name"/>
596
641
  <param pos="2" name="service.version"/>
597
642
  <param pos="3" name="service.version.version"/>
598
643
  <param pos="4" name="service.version.version.version"/>
599
644
  <param pos="5" name="service.version.version.version.version"/>
645
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
600
646
  </fingerprint>
601
647
  <!-- example: 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700 -->
602
648
  <fingerprint pattern="^([^ ]+) +E?SMTP (?i:MERAK) ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
@@ -634,6 +680,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
634
680
  <param pos="0" name="os.family" value="NetWare"/>
635
681
  <param pos="0" name="os.device" value="General"/>
636
682
  <param pos="0" name="os.product" value="NetWare"/>
683
+ <param pos="0" name="os.cpe23" value="cpe:/o:novell:netware:-"/>
637
684
  <param pos="1" name="host.name"/>
638
685
  <param pos="2" name="service.version"/>
639
686
  </fingerprint>
@@ -647,6 +694,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
647
694
  <param pos="0" name="os.family" value="Windows"/>
648
695
  <param pos="0" name="os.device" value="General"/>
649
696
  <param pos="0" name="os.product" value="Windows"/>
697
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
650
698
  <param pos="1" name="host.name"/>
651
699
  <param pos="2" name="service.version"/>
652
700
  </fingerprint>
@@ -670,6 +718,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
670
718
  <param pos="1" name="host.name"/>
671
719
  <param pos="2" name="service.version"/>
672
720
  <param pos="3" name="service.version.version"/>
721
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
673
722
  </fingerprint>
674
723
  <fingerprint pattern="^([^ ]+) ESMTP server \(Netscape Messaging Server - Version ([\d.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
675
724
  <description>Netscape Messaging Server - w/o patch number</description>
@@ -680,6 +729,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
680
729
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
681
730
  <param pos="1" name="host.name"/>
682
731
  <param pos="2" name="service.version"/>
732
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
683
733
  <param pos="3" name="system.time"/>
684
734
  </fingerprint>
685
735
  <fingerprint pattern="^([^ ]+) Lotus SMTP MTA Service Ready *$">
@@ -712,6 +762,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
712
762
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
713
763
  <param pos="1" name="host.name"/>
714
764
  <param pos="2" name="service.version"/>
765
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
715
766
  <param pos="3" name="system.time"/>
716
767
  </fingerprint>
717
768
  <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(IBM Domino Release (\d+\.[\w.]+(?: HF\d+)?)\) ready at (.+) *$">
@@ -783,6 +834,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
783
834
  <param pos="0" name="os.device" value="General"/>
784
835
  <param pos="2" name="os.version"/>
785
836
  <param pos="3" name="os.arch"/>
837
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:openvms:{os.version}"/>
786
838
  </fingerprint>
787
839
  <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\])? ([\d\.]+); (\w\w\w, +\d+ \w\w\w \d\d\d\d [\d:]+)$">
788
840
  <description>A.K.I PMail</description>
@@ -832,6 +884,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
832
884
  <param pos="0" name="os.device" value="General"/>
833
885
  <param pos="0" name="os.family" value="Linux"/>
834
886
  <param pos="0" name="os.product" value="Linux"/>
887
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
835
888
  </fingerprint>
836
889
  <fingerprint pattern="^([^ ]+)(?: ESMTP)? Hi, I'm a Mail-in-a-Box \(Ubuntu/Postfix; see https://mailinabox.email/\)$">
837
890
  <description>Postfix - Ubuntu, Mail-in-a-Box package</description>
@@ -844,6 +897,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
844
897
  <param pos="0" name="os.device" value="General"/>
845
898
  <param pos="0" name="os.family" value="Linux"/>
846
899
  <param pos="0" name="os.product" value="Linux"/>
900
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
847
901
  </fingerprint>
848
902
  <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Debian/GNU\)$">
849
903
  <description>Postfix - Debian</description>
@@ -855,6 +909,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
855
909
  <param pos="0" name="os.device" value="General"/>
856
910
  <param pos="0" name="os.family" value="Linux"/>
857
911
  <param pos="0" name="os.product" value="Linux"/>
912
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
858
913
  </fingerprint>
859
914
  <fingerprint pattern="^([^ ]+) ESMTP.* Postfix *\(.+\) *$">
860
915
  <description>Postfix - generic banner with amusing comments in parentheses</description>
@@ -926,6 +981,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
926
981
  <param pos="0" name="os.family" value="HP-UX"/>
927
982
  <param pos="0" name="os.device" value="General"/>
928
983
  <param pos="0" name="os.product" value="HP-UX"/>
984
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
929
985
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
930
986
  <param pos="1" name="host.name"/>
931
987
  <param pos="2" name="service.version"/>
@@ -943,6 +999,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
943
999
  <param pos="0" name="os.device" value="General"/>
944
1000
  <param pos="0" name="os.product" value="HP-UX"/>
945
1001
  <param pos="3" name="os.version"/>
1002
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:{os.version}"/>
946
1003
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
947
1004
  <param pos="1" name="host.name"/>
948
1005
  <param pos="2" name="service.version"/>
@@ -975,6 +1032,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
975
1032
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
976
1033
  <param pos="1" name="host.name"/>
977
1034
  <param pos="2" name="os.version"/>
1035
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
978
1036
  <param pos="3" name="service.version"/>
979
1037
  <param pos="4" name="system.time"/>
980
1038
  </fingerprint>
@@ -990,6 +1048,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
990
1048
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
991
1049
  <param pos="1" name="host.name"/>
992
1050
  <param pos="2" name="os.version"/>
1051
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
993
1052
  <param pos="3" name="service.version"/>
994
1053
  <param pos="4" name="sendmail.config.version"/>
995
1054
  <param pos="5" name="system.time"/>
@@ -1007,6 +1066,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1007
1066
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1008
1067
  <param pos="1" name="host.name"/>
1009
1068
  <param pos="2" name="os.version"/>
1069
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1010
1070
  <param pos="3" name="service.version"/>
1011
1071
  <param pos="4" name="sendmail.config.version"/>
1012
1072
  <param pos="5" name="system.time"/>
@@ -1020,6 +1080,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1020
1080
  <param pos="0" name="os.family" value="Linux"/>
1021
1081
  <param pos="0" name="os.device" value="General"/>
1022
1082
  <param pos="0" name="os.product" value="Linux"/>
1083
+ <param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:-"/>
1023
1084
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1024
1085
  <param pos="1" name="host.name"/>
1025
1086
  <param pos="2" name="service.version"/>
@@ -1036,6 +1097,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1036
1097
  <param pos="0" name="os.family" value="Solaris"/>
1037
1098
  <param pos="0" name="os.device" value="General"/>
1038
1099
  <param pos="0" name="os.product" value="Solaris"/>
1100
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1039
1101
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1040
1102
  <param pos="1" name="host.name"/>
1041
1103
  <param pos="2" name="service.version"/>
@@ -1051,6 +1113,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1051
1113
  <param pos="0" name="os.family" value="Solaris"/>
1052
1114
  <param pos="0" name="os.device" value="General"/>
1053
1115
  <param pos="0" name="os.product" value="Solaris"/>
1116
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1054
1117
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1055
1118
  <param pos="1" name="host.name"/>
1056
1119
  <param pos="2" name="service.version"/>
@@ -1067,6 +1130,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1067
1130
  <param pos="0" name="os.family" value="Linux"/>
1068
1131
  <param pos="0" name="os.device" value="General"/>
1069
1132
  <param pos="0" name="os.product" value="Linux"/>
1133
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1070
1134
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1071
1135
  <param pos="1" name="host.name"/>
1072
1136
  <param pos="2" name="service.version"/>
@@ -1084,6 +1148,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1084
1148
  <param pos="0" name="os.family" value="Linux"/>
1085
1149
  <param pos="0" name="os.product" value="Linux"/>
1086
1150
  <param pos="0" name="os.version" value="7.0"/>
1151
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
1087
1152
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1088
1153
  <param pos="1" name="host.name"/>
1089
1154
  <param pos="2" name="service.version"/>
@@ -1099,6 +1164,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1099
1164
  <param pos="0" name="os.family" value="Linux"/>
1100
1165
  <param pos="0" name="os.product" value="Linux"/>
1101
1166
  <param pos="0" name="os.version" value="8.0"/>
1167
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
1102
1168
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1103
1169
  <param pos="1" name="host.name"/>
1104
1170
  <param pos="2" name="service.version"/>
@@ -1114,6 +1180,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1114
1180
  <param pos="0" name="os.family" value="Linux"/>
1115
1181
  <param pos="0" name="os.product" value="Linux"/>
1116
1182
  <param pos="0" name="os.version" value="5.0"/>
1183
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:5.0"/>
1117
1184
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1118
1185
  <param pos="1" name="host.name"/>
1119
1186
  <param pos="2" name="service.version"/>
@@ -1129,6 +1196,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1129
1196
  <param pos="0" name="os.family" value="Linux"/>
1130
1197
  <param pos="0" name="os.product" value="Linux"/>
1131
1198
  <param pos="0" name="os.version" value="4.0"/>
1199
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:4.0"/>
1132
1200
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1133
1201
  <param pos="1" name="host.name"/>
1134
1202
  <param pos="2" name="service.version"/>
@@ -1144,6 +1212,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1144
1212
  <param pos="0" name="os.family" value="Linux"/>
1145
1213
  <param pos="0" name="os.product" value="Linux"/>
1146
1214
  <param pos="0" name="os.version" value="3.1"/>
1215
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:3.1"/>
1147
1216
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1148
1217
  <param pos="1" name="host.name"/>
1149
1218
  <param pos="2" name="service.version"/>
@@ -1160,6 +1229,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1160
1229
  <param pos="0" name="os.vendor" value="Debian"/>
1161
1230
  <param pos="0" name="os.family" value="Linux"/>
1162
1231
  <param pos="0" name="os.product" value="Linux"/>
1232
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1163
1233
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1164
1234
  <param pos="1" name="host.name"/>
1165
1235
  <param pos="2" name="service.version"/>
@@ -1175,6 +1245,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1175
1245
  <param pos="0" name="os.vendor" value="Ubuntu"/>
1176
1246
  <param pos="0" name="os.family" value="Linux"/>
1177
1247
  <param pos="0" name="os.product" value="Linux"/>
1248
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
1178
1249
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1179
1250
  <param pos="1" name="host.name"/>
1180
1251
  <param pos="2" name="service.version"/>
@@ -1189,6 +1260,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1189
1260
  <param pos="0" name="os.family" value="SunOS"/>
1190
1261
  <param pos="0" name="os.device" value="General"/>
1191
1262
  <param pos="0" name="os.product" value="Solaris"/>
1263
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1192
1264
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1193
1265
  <param pos="1" name="host.name"/>
1194
1266
  <param pos="2" name="service.version"/>
@@ -1219,6 +1291,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1219
1291
  <param pos="0" name="os.family" value="Windows"/>
1220
1292
  <param pos="0" name="os.device" value="General"/>
1221
1293
  <param pos="0" name="os.product" value="Windows NT"/>
1294
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_nt:-"/>
1222
1295
  <param pos="0" name="system.time.format" value="EEE, d MMM"/>
1223
1296
  <param pos="1" name="host.name"/>
1224
1297
  <param pos="2" name="metainfo.version"/>
@@ -1294,7 +1367,6 @@ The system or service fingerprint with the highest certainty overwrites the othe
1294
1367
  <example host.name="foo.bar">foo.bar ESMTP Sendmail</example>
1295
1368
  <example host.name="foo.bar">foo.bar Sendmail ready. </example>
1296
1369
  <param pos="0" name="service.family" value="Sendmail"/>
1297
- <param pos="0" name="service.family" value="Sendmail"/>
1298
1370
  <param pos="0" name="service.product" value="Sendmail"/>
1299
1371
  <param pos="1" name="host.name"/>
1300
1372
  <param pos="2" name="system.time"/>
@@ -1348,6 +1420,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1348
1420
  <param pos="0" name="os.family" value="Solaris"/>
1349
1421
  <param pos="0" name="os.device" value="General"/>
1350
1422
  <param pos="0" name="os.product" value="Solaris"/>
1423
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1351
1424
  <param pos="1" name="host.name"/>
1352
1425
  <param pos="2" name="service.version"/>
1353
1426
  </fingerprint>
@@ -1397,7 +1470,6 @@ The system or service fingerprint with the highest certainty overwrites the othe
1397
1470
  <example host.name="foo.bar" service.version="9.0.5.2077">foo.bar ESMTP SonicWALL (9.0.5.2077)</example>
1398
1471
  <example host.name="foo.bar" service.version="9.1.1.3113">foo.bar ESMTP SonicWall (9.1.1.3113)</example>
1399
1472
  <param pos="0" name="service.vendor" value="SonicWall"/>
1400
- <param pos="0" name="service.vendor" value="SonicWall"/>
1401
1473
  <param pos="0" name="service.family" value="Email Security"/>
1402
1474
  <param pos="0" name="service.product" value="Email Security"/>
1403
1475
  <param pos="1" name="host.name"/>
@@ -1442,6 +1514,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1442
1514
  <param pos="1" name="host.name"/>
1443
1515
  <param pos="2" name="service.version"/>
1444
1516
  <param pos="3" name="service.version.version"/>
1517
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1445
1518
  <param pos="4" name="system.time"/>
1446
1519
  </fingerprint>
1447
1520
  <fingerprint pattern="^([^ ]+) McAfee WebShield ASaP v([^ ]+\.[^ ]+\.[^ ]+): (.+) *$">
@@ -1457,6 +1530,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1457
1530
  <param pos="0" name="os.product" value="Linux"/>
1458
1531
  <param pos="1" name="host.name"/>
1459
1532
  <param pos="2" name="service.version"/>
1533
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1460
1534
  <param pos="3" name="system.time"/>
1461
1535
  </fingerprint>
1462
1536
  <fingerprint pattern="^([^ ]+) McAfee VirusScreen ASaP v([^ ]+\.[^ ]+): (.+) *$">
@@ -1472,6 +1546,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1472
1546
  <param pos="0" name="os.product" value="Linux"/>
1473
1547
  <param pos="1" name="host.name"/>
1474
1548
  <param pos="2" name="service.version"/>
1549
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1475
1550
  <param pos="3" name="system.time"/>
1476
1551
  </fingerprint>
1477
1552
  <fingerprint pattern="^([^ ]+) ESMTP Lyris ListManager service ready$">
@@ -1578,7 +1653,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1578
1653
  <param pos="0" name="service.family" value="David"/>
1579
1654
  <param pos="0" name="service.product" value="ESMTP"/>
1580
1655
  <param pos="1" name="host.name"/>
1581
- <param pos="2" name="service.version"/>>
1656
+ <param pos="2" name="service.version"/>
1582
1657
  </fingerprint>
1583
1658
  <fingerprint pattern="^(?i)(\S+) E?SMTP Perl">
1584
1659
  <description>Some simple PERL SMTP server</description>