recog 2.1.20 → 2.1.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/recog/version.rb +1 -1
- data/remap.json +131 -0
- data/spec/lib/fingerprint_self_test_spec.rb +16 -1
- data/update_cpes.py +202 -0
- data/xml/apache_os.xml +29 -5
- data/xml/architecture.xml +3 -3
- data/xml/dns_versionbind.xml +56 -10
- data/xml/ftp_banners.xml +56 -12
- data/xml/h323_callresp.xml +4 -4
- data/xml/hp_pjl_id.xml +8 -8
- data/xml/http_cookies.xml +20 -8
- data/xml/http_servers.xml +122 -8
- data/xml/http_wwwauth.xml +13 -3
- data/xml/imap_banners.xml +19 -1
- data/xml/ldap_searchresult.xml +44 -68
- data/xml/mdns_device-info_txt.xml +18 -7
- data/xml/mdns_workstation_txt.xml +7 -7
- data/xml/mysql_banners.xml +159 -13
- data/xml/mysql_error.xml +124 -21
- data/xml/nntp_banners.xml +10 -4
- data/xml/ntp_banners.xml +144 -84
- data/xml/operating_system.xml +39 -10
- data/xml/pop_banners.xml +32 -12
- data/xml/rsh_resp.xml +8 -3
- data/xml/sip_banners.xml +4 -3
- data/xml/sip_user_agents.xml +4 -3
- data/xml/smb_native_lm.xml +9 -4
- data/xml/smb_native_os.xml +50 -25
- data/xml/smtp_banners.xml +108 -33
- data/xml/smtp_debug.xml +11 -8
- data/xml/smtp_ehlo.xml +14 -11
- data/xml/smtp_expn.xml +17 -11
- data/xml/smtp_help.xml +17 -11
- data/xml/smtp_mailfrom.xml +4 -3
- data/xml/smtp_noop.xml +13 -8
- data/xml/smtp_quit.xml +10 -8
- data/xml/smtp_rcptto.xml +1 -3
- data/xml/smtp_rset.xml +10 -8
- data/xml/smtp_turn.xml +10 -8
- data/xml/smtp_vrfy.xml +18 -11
- data/xml/snmp_sysdescr.xml +157 -451
- data/xml/snmp_sysobjid.xml +57 -4
- data/xml/ssh_banners.xml +104 -5
- data/xml/upnp_banners.xml +16 -1
- data/xml/x11_banners.xml +34 -9
- metadata +4 -2
data/xml/smtp_debug.xml
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.14">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the DEBUG command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference="0.14">
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^500 No way!$">
|
|
13
13
|
<description>
|
|
14
14
|
Exim
|
|
@@ -17,6 +17,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
17
17
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
18
18
|
<param pos="0" name="service.family" value="exim"/>
|
|
19
19
|
<param pos="0" name="service.product" value="exim"/>
|
|
20
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
20
21
|
</fingerprint>
|
|
21
22
|
<fingerprint pattern="^250[ -] *Debug set -NOT!$">
|
|
22
23
|
<description>
|
|
@@ -36,10 +37,12 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
36
37
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
37
38
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
38
39
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
40
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
39
41
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
40
42
|
<param pos="0" name="os.family" value="Windows"/>
|
|
41
43
|
<param pos="0" name="os.device" value="General"/>
|
|
42
44
|
<param pos="0" name="os.product" value="Windows"/>
|
|
43
45
|
<param pos="0" name="os.arch" value="x86"/>
|
|
46
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
44
47
|
</fingerprint>
|
|
45
48
|
</fingerprints>
|
data/xml/smtp_ehlo.xml
CHANGED
|
@@ -1,22 +1,23 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.19">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the EHLO command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference='0.19'>
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^500[ -]Syntax error, command "XXXX" unrecognized$">
|
|
13
13
|
<description>
|
|
14
14
|
Cisco PIX changes the command letters to 'X' before passing
|
|
15
15
|
them to the real SMTP server.
|
|
16
16
|
</description>
|
|
17
|
-
<param pos="0" name="
|
|
18
|
-
<param pos="0" name="
|
|
19
|
-
<param pos="0" name="
|
|
17
|
+
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
18
|
+
<param pos="0" name="os.family" value="PIX"/>
|
|
19
|
+
<param pos="0" name="os.product" value="PIX"/>
|
|
20
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
|
|
20
21
|
</fingerprint>
|
|
21
22
|
<!--
|
|
22
23
|
Don't try to infer a fingerprint from XEXCH50, because if we do, it might overwrite
|
|
@@ -44,10 +45,12 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
44
45
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
45
46
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
46
47
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
48
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
47
49
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
48
50
|
<param pos="0" name="os.family" value="Windows"/>
|
|
49
51
|
<param pos="0" name="os.device" value="General"/>
|
|
50
52
|
<param pos="0" name="os.product" value="Windows"/>
|
|
51
53
|
<param pos="0" name="os.arch" value="x86"/>
|
|
54
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
52
55
|
</fingerprint>
|
|
53
56
|
</fingerprints>
|
data/xml/smtp_expn.xml
CHANGED
|
@@ -1,22 +1,23 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.16">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the EXPN command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference="0.16">
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^500[ -]Syntax error, command "XXXX.*" unrecognized$">
|
|
13
13
|
<description>
|
|
14
14
|
Cisco PIX changes the command letters to 'X' before passing
|
|
15
15
|
them to the real SMTP server.
|
|
16
16
|
</description>
|
|
17
|
-
<param pos="0" name="
|
|
18
|
-
<param pos="0" name="
|
|
19
|
-
<param pos="0" name="
|
|
17
|
+
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
18
|
+
<param pos="0" name="os.family" value="PIX"/>
|
|
19
|
+
<param pos="0" name="os.product" value="PIX"/>
|
|
20
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
|
|
20
21
|
</fingerprint>
|
|
21
22
|
<fingerprint pattern="^550[ -]EXPN not available to \(.+\) \[.+\] *$">
|
|
22
23
|
<description>
|
|
@@ -26,6 +27,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
26
27
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
27
28
|
<param pos="0" name="service.family" value="exim"/>
|
|
28
29
|
<param pos="0" name="service.product" value="exim"/>
|
|
30
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
29
31
|
</fingerprint>
|
|
30
32
|
<fingerprint pattern="^550[ -]EXPN not available to [^ ]+ \(.+\) \[.+\] *$">
|
|
31
33
|
<description>
|
|
@@ -35,6 +37,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
35
37
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
36
38
|
<param pos="0" name="service.family" value="exim"/>
|
|
37
39
|
<param pos="0" name="service.product" value="exim"/>
|
|
40
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
38
41
|
</fingerprint>
|
|
39
42
|
<fingerprint pattern="^500[ -]Don't you wish! *$">
|
|
40
43
|
<description>GNAT box SMTP</description>
|
|
@@ -56,6 +59,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
56
59
|
<param pos="0" name="service.vendor" value="Ipswitch"/>
|
|
57
60
|
<param pos="0" name="service.family" value="IMail Server"/>
|
|
58
61
|
<param pos="0" name="service.product" value="IMail Server"/>
|
|
62
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:-"/>
|
|
59
63
|
</fingerprint>
|
|
60
64
|
<fingerprint pattern="^502[ -]command is not active$">
|
|
61
65
|
<description>
|
|
@@ -64,11 +68,13 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
64
68
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
65
69
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
66
70
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
71
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
67
72
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
68
73
|
<param pos="0" name="os.family" value="Windows"/>
|
|
69
74
|
<param pos="0" name="os.device" value="General"/>
|
|
70
75
|
<param pos="0" name="os.product" value="Windows"/>
|
|
71
76
|
<param pos="0" name="os.arch" value="x86"/>
|
|
77
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
72
78
|
</fingerprint>
|
|
73
79
|
<fingerprint pattern="^252 Unable to EXPN ".*", but will accept message and attempt delivery *$">
|
|
74
80
|
<description>
|
data/xml/smtp_help.xml
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.18">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the HELP command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference="0.18">
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^214[ -]This is ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
|
|
13
13
|
<description>
|
|
14
14
|
ArgoSoft mail server HELP response
|
|
@@ -33,9 +33,10 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
33
33
|
Cisco PIX changes the command letters to 'X' before passing
|
|
34
34
|
them to the real SMTP server.
|
|
35
35
|
</description>
|
|
36
|
-
<param pos="0" name="
|
|
37
|
-
<param pos="0" name="
|
|
38
|
-
<param pos="0" name="
|
|
36
|
+
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
37
|
+
<param pos="0" name="os.family" value="PIX"/>
|
|
38
|
+
<param pos="0" name="os.product" value="PIX"/>
|
|
39
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
|
|
39
40
|
</fingerprint>
|
|
40
41
|
<fingerprint pattern="^500[ -]5.5.1 unrecognised command HELP$">
|
|
41
42
|
<description>
|
|
@@ -48,6 +49,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
48
49
|
<param pos="0" name="os.family" value="Mac OS"/>
|
|
49
50
|
<param pos="0" name="os.device" value="General"/>
|
|
50
51
|
<param pos="0" name="os.product" value="Mac OS"/>
|
|
52
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
|
|
51
53
|
</fingerprint>
|
|
52
54
|
<fingerprint pattern="^214[ -]([^ ]+) is running the IBM VM operating system$">
|
|
53
55
|
<description>IBM VM</description>
|
|
@@ -67,10 +69,12 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
67
69
|
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
68
70
|
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
69
71
|
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
72
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
|
|
70
73
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
71
74
|
<param pos="0" name="os.family" value="Windows"/>
|
|
72
75
|
<param pos="0" name="os.device" value="General"/>
|
|
73
76
|
<param pos="0" name="os.product" value="Windows"/>
|
|
77
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
74
78
|
</fingerprint>
|
|
75
79
|
<fingerprint pattern="^214[ -]Help system currently inactive\.$">
|
|
76
80
|
<description>
|
|
@@ -79,11 +83,13 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
79
83
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
80
84
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
81
85
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
86
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
82
87
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
83
88
|
<param pos="0" name="os.family" value="Windows"/>
|
|
84
89
|
<param pos="0" name="os.device" value="General"/>
|
|
85
90
|
<param pos="0" name="os.product" value="Windows"/>
|
|
86
91
|
<param pos="0" name="os.arch" value="x86"/>
|
|
92
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
87
93
|
</fingerprint>
|
|
88
94
|
<fingerprint pattern="^214[ -].*This is MERAK ([^ ]+\.[^ ]+\.[^ ]+).*$">
|
|
89
95
|
<description>
|
data/xml/smtp_mailfrom.xml
CHANGED
|
@@ -1,14 +1,15 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
<!--
|
|
3
|
-
This file is currently unused.
|
|
4
|
-
-->
|
|
5
2
|
<fingerprints protocol="smtp" database_type="service">
|
|
3
|
+
<!--
|
|
4
|
+
This file is currently unused.
|
|
5
|
+
-->
|
|
6
6
|
<fingerprint pattern="250 .* is syntactically correct *">
|
|
7
7
|
<description>exim</description>
|
|
8
8
|
<example>250 <nosuchuser@rapid7.com> is syntactically correct</example>
|
|
9
9
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
10
10
|
<param pos="0" name="service.family" value="exim"/>
|
|
11
11
|
<param pos="0" name="service.product" value="exim"/>
|
|
12
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
12
13
|
</fingerprint>
|
|
13
14
|
<fingerprint pattern="501[ -]System error\. *">
|
|
14
15
|
<description>GNAT Box SMTP</description>
|
data/xml/smtp_noop.xml
CHANGED
|
@@ -1,14 +1,15 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.17">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the NOOP command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
|
|
12
|
+
-->
|
|
12
13
|
<fingerprint pattern="^220 OK.*$">
|
|
13
14
|
<description>
|
|
14
15
|
CheckPoint FireWall-1 returns code 220 for NOOP command (instead of 250)
|
|
@@ -16,6 +17,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
16
17
|
<param pos="0" name="service.vendor" value="Check Point"/>
|
|
17
18
|
<param pos="0" name="service.family" value="Check Point"/>
|
|
18
19
|
<param pos="0" name="service.product" value="Firewall-1"/>
|
|
20
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
|
|
19
21
|
</fingerprint>
|
|
20
22
|
<fingerprint pattern="^250[ -]2.0.0 doing nothing$">
|
|
21
23
|
<description>
|
|
@@ -28,6 +30,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
28
30
|
<param pos="0" name="os.family" value="Mac OS"/>
|
|
29
31
|
<param pos="0" name="os.device" value="General"/>
|
|
30
32
|
<param pos="0" name="os.product" value="Mac OS"/>
|
|
33
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
|
|
31
34
|
</fingerprint>
|
|
32
35
|
<fingerprint pattern="^250[ -]Why is there an NOOP instruction\?$">
|
|
33
36
|
<description>
|
|
@@ -36,10 +39,12 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
36
39
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
37
40
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
38
41
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
42
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
39
43
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
40
44
|
<param pos="0" name="os.family" value="Windows"/>
|
|
41
45
|
<param pos="0" name="os.device" value="General"/>
|
|
42
46
|
<param pos="0" name="os.product" value="Windows"/>
|
|
43
47
|
<param pos="0" name="os.arch" value="x86"/>
|
|
48
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
44
49
|
</fingerprint>
|
|
45
50
|
</fingerprints>
|
data/xml/smtp_quit.xml
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.11">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the QUIT command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference="0.11">
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^221[ -]See ya in cyberspace$">
|
|
13
13
|
<description>
|
|
14
14
|
221 See ya in cyberspace
|
|
@@ -16,11 +16,13 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
16
16
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
17
17
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
18
18
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
19
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
19
20
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
20
21
|
<param pos="0" name="os.family" value="Windows"/>
|
|
21
22
|
<param pos="0" name="os.device" value="General"/>
|
|
22
23
|
<param pos="0" name="os.product" value="Windows"/>
|
|
23
24
|
<param pos="0" name="os.arch" value="x86"/>
|
|
25
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
24
26
|
</fingerprint>
|
|
25
27
|
<fingerprint pattern="^503[ -]5\.5\.0 Not accepting any command except QUIT$">
|
|
26
28
|
<description>
|
data/xml/smtp_rcptto.xml
CHANGED
|
@@ -1,7 +1,4 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
<!--
|
|
3
|
-
This file is currently unused.
|
|
4
|
-
-->
|
|
5
2
|
<fingerprints protocol="smtp" database_type="service">
|
|
6
3
|
<!--
|
|
7
4
|
<fingerprint pattern="501[ -]Invalid domain *">
|
|
@@ -27,5 +24,6 @@ This file is currently unused.
|
|
|
27
24
|
<param pos="0" name="service.vendor" value="Ipswitch"/>
|
|
28
25
|
<param pos="0" name="service.family" value="IMail Server"/>
|
|
29
26
|
<param pos="0" name="service.product" value="IMail Server"/>
|
|
27
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:-"/>
|
|
30
28
|
</fingerprint>
|
|
31
29
|
</fingerprints>
|
data/xml/smtp_rset.xml
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.12">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the RSET command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference="0.12">
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^250[ -]RSET\? Well, OK\.$">
|
|
13
13
|
<description>
|
|
14
14
|
500 What? I don't understand that.
|
|
@@ -16,10 +16,12 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
16
16
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
17
17
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
18
18
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
19
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
19
20
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
20
21
|
<param pos="0" name="os.family" value="Windows"/>
|
|
21
22
|
<param pos="0" name="os.device" value="General"/>
|
|
22
23
|
<param pos="0" name="os.product" value="Windows"/>
|
|
23
24
|
<param pos="0" name="os.arch" value="x86"/>
|
|
25
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
24
26
|
</fingerprint>
|
|
25
27
|
</fingerprints>
|
data/xml/smtp_turn.xml
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.13">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the TURN command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference="0.13">
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^502[ -]Hey! I don't let remote systems TURN on me\.$">
|
|
13
13
|
<description>
|
|
14
14
|
502 Hey! I don't let remote systems TURN on me.
|
|
@@ -16,10 +16,12 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
16
16
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
17
17
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
18
18
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
19
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
19
20
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
20
21
|
<param pos="0" name="os.family" value="Windows"/>
|
|
21
22
|
<param pos="0" name="os.device" value="General"/>
|
|
22
23
|
<param pos="0" name="os.product" value="Windows"/>
|
|
23
24
|
<param pos="0" name="os.arch" value="x86"/>
|
|
25
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
24
26
|
</fingerprint>
|
|
25
27
|
</fingerprints>
|
data/xml/smtp_vrfy.xml
CHANGED
|
@@ -1,22 +1,23 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
<fingerprints protocol="smtp" database_type="service" preference="0.15">
|
|
3
|
+
<!--
|
|
4
|
+
SMTP response lines to the VRFY command are matched against these patterns
|
|
5
|
+
(1 line at a time) to fingerprint SMTP servers.
|
|
5
6
|
|
|
6
|
-
See comment at the top of smtp_banners.xml for additional info.
|
|
7
|
+
See comment at the top of smtp_banners.xml for additional info.
|
|
7
8
|
|
|
8
|
-
'preference' note: This value has been set so as to implement the ordering
|
|
9
|
-
|
|
10
|
-
-->
|
|
11
|
-
<fingerprints protocol="smtp" database_type="service" preference="0.15">
|
|
9
|
+
'preference' note: This value has been set so as to implement the ordering
|
|
10
|
+
of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
|
|
11
|
+
-->
|
|
12
12
|
<fingerprint pattern="^500[ -]Syntax error, command "XXXX.*" unrecognized$">
|
|
13
13
|
<description>
|
|
14
14
|
Cisco PIX changes the command letters to 'X' before passing
|
|
15
15
|
them to the real SMTP server.
|
|
16
16
|
</description>
|
|
17
|
-
<param pos="0" name="
|
|
18
|
-
<param pos="0" name="
|
|
19
|
-
<param pos="0" name="
|
|
17
|
+
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
18
|
+
<param pos="0" name="os.family" value="PIX"/>
|
|
19
|
+
<param pos="0" name="os.product" value="PIX"/>
|
|
20
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
|
|
20
21
|
</fingerprint>
|
|
21
22
|
<!-- XXX: Why is EXPN mentionned here ? Is this a mistake ? -->
|
|
22
23
|
<fingerprint pattern="^550[ -]EXPN not available *$">
|
|
@@ -27,6 +28,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
27
28
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
28
29
|
<param pos="0" name="service.family" value="exim"/>
|
|
29
30
|
<param pos="0" name="service.product" value="exim"/>
|
|
31
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
30
32
|
</fingerprint>
|
|
31
33
|
<fingerprint pattern="^252[ -]VRFY not available *$">
|
|
32
34
|
<description>
|
|
@@ -36,6 +38,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
36
38
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
37
39
|
<param pos="0" name="service.family" value="exim"/>
|
|
38
40
|
<param pos="0" name="service.product" value="exim"/>
|
|
41
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
39
42
|
</fingerprint>
|
|
40
43
|
<fingerprint pattern="^250[ -]<.+> is deliverable *$">
|
|
41
44
|
<description>
|
|
@@ -45,6 +48,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
45
48
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
46
49
|
<param pos="0" name="service.family" value="exim"/>
|
|
47
50
|
<param pos="0" name="service.product" value="exim"/>
|
|
51
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
48
52
|
</fingerprint>
|
|
49
53
|
<fingerprint pattern="^550[ -]<.+> is not deliverable *$">
|
|
50
54
|
<description>
|
|
@@ -54,6 +58,7 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
54
58
|
<param pos="0" name="service.vendor" value="exim"/>
|
|
55
59
|
<param pos="0" name="service.family" value="exim"/>
|
|
56
60
|
<param pos="0" name="service.product" value="exim"/>
|
|
61
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
|
|
57
62
|
</fingerprint>
|
|
58
63
|
<fingerprint pattern="^502[ -]command is not active$">
|
|
59
64
|
<description>
|
|
@@ -62,11 +67,13 @@ See comment at the top of smtp_banners.xml for additional info.
|
|
|
62
67
|
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
63
68
|
<param pos="0" name="service.family" value="MDaemon"/>
|
|
64
69
|
<param pos="0" name="service.product" value="MDaemon"/>
|
|
70
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
|
|
65
71
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
66
72
|
<param pos="0" name="os.family" value="Windows"/>
|
|
67
73
|
<param pos="0" name="os.device" value="General"/>
|
|
68
74
|
<param pos="0" name="os.product" value="Windows"/>
|
|
69
75
|
<param pos="0" name="os.arch" value="x86"/>
|
|
76
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
|
70
77
|
</fingerprint>
|
|
71
78
|
<fingerprint pattern="^557[ -]5\.5\.2 String does not match anything\. *$">
|
|
72
79
|
<description>
|