recog 2.3.0 → 2.3.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (31) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/version.rb +1 -1
  3. data/spec/lib/fingerprint_self_test_spec.rb +17 -0
  4. data/xml/apache_os.xml +4 -4
  5. data/xml/ftp_banners.xml +37 -46
  6. data/xml/h323_callresp.xml +1 -1
  7. data/xml/http_cookies.xml +26 -58
  8. data/xml/http_servers.xml +65 -95
  9. data/xml/http_wwwauth.xml +6 -6
  10. data/xml/imap_banners.xml +12 -5
  11. data/xml/ldap_searchresult.xml +2 -2
  12. data/xml/mysql_banners.xml +3 -3
  13. data/xml/mysql_error.xml +0 -1
  14. data/xml/ntp_banners.xml +2 -2
  15. data/xml/operating_system.xml +0 -1
  16. data/xml/pop_banners.xml +5 -6
  17. data/xml/smb_native_os.xml +4 -4
  18. data/xml/smtp_banners.xml +13 -19
  19. data/xml/smtp_debug.xml +5 -13
  20. data/xml/smtp_ehlo.xml +2 -7
  21. data/xml/smtp_expn.xml +12 -24
  22. data/xml/smtp_help.xml +22 -62
  23. data/xml/smtp_noop.xml +5 -9
  24. data/xml/smtp_quit.xml +3 -7
  25. data/xml/smtp_rcptto.xml +3 -7
  26. data/xml/smtp_vrfy.xml +16 -35
  27. data/xml/snmp_sysdescr.xml +258 -278
  28. data/xml/snmp_sysobjid.xml +3 -3
  29. data/xml/ssh_banners.xml +8 -11
  30. data/xml/x509_subjects.xml +14 -17
  31. metadata +3 -3
data/xml/http_wwwauth.xml CHANGED
@@ -26,7 +26,7 @@
26
26
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:11"/>
27
27
  </fingerprint>
28
28
  <fingerprint pattern="^(?:Basic|Digest) realm=.level[ _]15[ _]or[ _]view[ _]access.$">
29
- <description>Cisco IOS 12.x</description>
29
+ <description>Cisco IOS 12.x - view access variant</description>
30
30
  <param pos="0" name="service.vendor" value="Cisco"/>
31
31
  <param pos="0" name="service.product" value="IOS"/>
32
32
  <param pos="0" name="service.family" value="IOS"/>
@@ -168,7 +168,7 @@
168
168
  <param pos="0" name="hw.vendor" value="Ruijie"/>
169
169
  </fingerprint>
170
170
  <fingerprint pattern="^(?:Basic|Digest) realm=.SpeedTouch \(([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2})\).$">
171
- <description>Thomson SpeedTouch xDSL routers</description>
171
+ <description>Thomson SpeedTouch xDSL router</description>
172
172
  <param pos="0" name="service.vendor" value="Thomson"/>
173
173
  <param pos="0" name="service.product" value="SpeedTouch"/>
174
174
  <param pos="0" name="service.family" value="SpeedTouch"/>
@@ -179,7 +179,7 @@
179
179
  <param pos="1" name="host.mac"/>
180
180
  </fingerprint>
181
181
  <fingerprint pattern="^(?:Basic|Digest) realm=.SpeedTouch., nonce=.[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+., qop=.auth.$">
182
- <description>Thomson SpeedTouch xDSL routers</description>
182
+ <description>Thomson SpeedTouch xDSL router - qop variant</description>
183
183
  <param pos="0" name="service.vendor" value="Thomson"/>
184
184
  <param pos="0" name="service.product" value="SpeedTouch"/>
185
185
  <param pos="0" name="service.family" value="SpeedTouch"/>
@@ -190,7 +190,7 @@
190
190
  <param pos="1" name="host.mac"/>
191
191
  </fingerprint>
192
192
  <fingerprint pattern="^(?:Basic|Digest) realm=.ST (\d+) R 5.x Telecom Italia., nonce=.[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+., qop=.auth.$">
193
- <description>Thomson SpeedTouch xDSL routers</description>
193
+ <description>Thomson SpeedTouch xDSL router - Telecom Italia</description>
194
194
  <param pos="0" name="service.vendor" value="Thomson"/>
195
195
  <param pos="0" name="service.product" value="SpeedTouch"/>
196
196
  <param pos="0" name="service.family" value="SpeedTouch"/>
@@ -240,7 +240,7 @@
240
240
  <param pos="0" name="os.product" value="WRT54G"/>
241
241
  </fingerprint>
242
242
  <fingerprint pattern="^(?:Basic|Digest) realm=.(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+).$">
243
- <description>TP-LINK SoHo Router</description>
243
+ <description>TP-LINK SoHo Router - dash variant</description>
244
244
  <example>Basic realm="TD-W8901G"</example>
245
245
  <example>Basic realm="TD-8840T 2.0"</example>
246
246
  <example>Basic realm="TD-8811"</example>
@@ -259,7 +259,7 @@
259
259
  <param pos="1" name="os.product"/>
260
260
  </fingerprint>
261
261
  <fingerprint pattern="^(?:Basic|Digest) realm=.TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+).*$">
262
- <description>TP-LINK SoHo Router</description>
262
+ <description>TP-LINK SoHo Router - verbose variant</description>
263
263
  <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
264
264
  <example>Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
265
265
  <example>Basic realm="TP-LINK Wireless Range Extender WA850RE"</example>
data/xml/imap_banners.xml CHANGED
@@ -3,6 +3,7 @@
3
3
  <!-- IMAP banners are matched against these patterns to fingerprint IMAP servers. -->
4
4
  <fingerprint pattern="^Microsoft Exchange IMAP4rev1 server version (5\.5\.\d{4}\.\d+) \((.*)\) ready$">
5
5
  <description>Microsoft Exchange Server 5.5</description>
6
+ <example service.version="5.5.2448.8" host.name="foo.bar">Microsoft Exchange IMAP4rev1 server version 5.5.2448.8 (foo.bar) ready</example>
6
7
  <param pos="0" name="service.vendor" value="Microsoft"/>
7
8
  <param pos="0" name="service.family" value="Exchange Server"/>
8
9
  <param pos="0" name="service.product" value="Exchange Server 5.5"/>
@@ -16,6 +17,7 @@
16
17
  </fingerprint>
17
18
  <fingerprint pattern="^Microsoft Exchange 2000 IMAP4rev1 server version (6\.0\.\d{4}\.\d+) \((.*)\) ready\.$">
18
19
  <description>Microsoft Exchange Server 2000</description>
20
+ <example service.version="6.0.6249.0" host.name="foo.bar">Microsoft Exchange 2000 IMAP4rev1 server version 6.0.6249.0 (foo.bar) ready.</example>
19
21
  <param pos="0" name="service.vendor" value="Microsoft"/>
20
22
  <param pos="0" name="service.family" value="Exchange Server"/>
21
23
  <param pos="0" name="service.product" value="Exchange 2000 Server"/>
@@ -29,6 +31,7 @@
29
31
  </fingerprint>
30
32
  <fingerprint pattern="^Microsoft Exchange Server 2003 IMAP4rev1 server version (6\.5\.\d{4}\.\d+) \((.*)\) ready\.$">
31
33
  <description>Microsoft Exchange Server 2003</description>
34
+ <example service.version="6.5.7638.1" host.name="foo.bar">Microsoft Exchange Server 2003 IMAP4rev1 server version 6.5.7638.1 (foo.bar) ready.</example>
32
35
  <param pos="0" name="service.vendor" value="Microsoft"/>
33
36
  <param pos="0" name="service.family" value="Exchange Server"/>
34
37
  <param pos="0" name="service.product" value="Exchange 2003 Server"/>
@@ -42,6 +45,7 @@
42
45
  </fingerprint>
43
46
  <fingerprint pattern="^Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version (6\.5\.\d{4}\.\d+) \((.*)\),.*$">
44
47
  <description>Microsoft Exchange Server 2003, German</description>
48
+ <example service.version="6.5.7638.1" host.name="foo.bar">Der Microsoft Exchange Server 2003 IMAP4rev1-Server, Version 6.5.7638.1 (foo.bar), steht zur Verfgung.</example>
45
49
  <param pos="0" name="service.vendor" value="Microsoft"/>
46
50
  <param pos="0" name="service.family" value="Exchange Server"/>
47
51
  <param pos="0" name="service.product" value="Exchange 2003 Server"/>
@@ -55,6 +59,7 @@
55
59
  </fingerprint>
56
60
  <fingerprint pattern="^Microsoft Exchange Server 2007 IMAP4 service ready$">
57
61
  <description>Microsoft Exchange Server 2007</description>
62
+ <example>Microsoft Exchange Server 2007 IMAP4 service ready</example>
58
63
  <param pos="0" name="service.vendor" value="Microsoft"/>
59
64
  <param pos="0" name="service.family" value="Exchange Server"/>
60
65
  <param pos="0" name="service.product" value="Exchange 2007 Server"/>
@@ -78,6 +83,7 @@
78
83
  </fingerprint>
79
84
  <fingerprint pattern="^Domino IMAP4 Server Release (\d+\.\d+.*) ready (.+)$">
80
85
  <description>IBM Lotus Notes/Domino</description>
86
+ <example service.version="9.0.1FP9" host.time="Thu, 4 Apr 2019 20:19:31 +0200">Domino IMAP4 Server Release 9.0.1FP9 ready Thu, 4 Apr 2019 20:19:31 +0200</example>
81
87
  <param pos="0" name="service.vendor" value="IBM"/>
82
88
  <param pos="0" name="service.family" value="Lotus Domino"/>
83
89
  <param pos="0" name="service.product" value="Lotus Domino"/>
@@ -86,7 +92,7 @@
86
92
  <param pos="2" name="host.time"/>
87
93
  </fingerprint>
88
94
  <fingerprint pattern="^Domino IMAP4 Server V\.?(\d+\.\d+.*) ready (.+)$">
89
- <description>IBM Lotus Notes/Domino</description>
95
+ <description>IBM Lotus Notes/Domino - variant 2</description>
90
96
  <param pos="0" name="service.vendor" value="IBM"/>
91
97
  <param pos="0" name="service.family" value="Lotus Domino"/>
92
98
  <param pos="0" name="service.product" value="Lotus Domino"/>
@@ -96,6 +102,8 @@
96
102
  </fingerprint>
97
103
  <fingerprint pattern="^[dD]ovecot (?:DA )?ready\.$">
98
104
  <description>Dovecot Secure IMAP Server</description>
105
+ <example>Dovecot ready.</example>
106
+ <example>Dovecot DA ready.</example>
99
107
  <param pos="0" name="service.family" value="Dovecot"/>
100
108
  <param pos="0" name="service.product" value="Dovecot"/>
101
109
  </fingerprint>
@@ -118,16 +126,15 @@
118
126
  </fingerprint>
119
127
  <fingerprint pattern="^(\S+) Zimbra IMAP4rev1 server ready\.?$">
120
128
  <description>VMware Zimbra IMAP</description>
121
- <example>catfood.zimbra.com Zimbra IMAP4rev1 server ready</example>
122
- <example>dogfood.zimbra.com Zimbra IMAP4rev1 server ready</example>
129
+ <example host.name="foo.bar">foo.bar Zimbra IMAP4rev1 server ready</example>
123
130
  <param pos="0" name="service.vendor" value="VMware"/>
124
131
  <param pos="0" name="service.product" value="Zimbra"/>
125
132
  <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:-"/>
126
133
  <param pos="1" name="host.name"/>
127
134
  </fingerprint>
128
135
  <fingerprint pattern="^(\S+) Zimbra (\S+) IMAP4rev1 server ready\.?$">
129
- <description>VMware Zimbra IMAP</description>
130
- <example>example.com Zimbra 7.0.0_GA_3079 IMAP4rev1 server ready</example>
136
+ <description>VMware Zimbra IMAP with service version</description>
137
+ <example host.name="foo.bar" service.version="7.0.0_GA_3079">foo.bar Zimbra 7.0.0_GA_3079 IMAP4rev1 server ready</example>
131
138
  <param pos="0" name="service.vendor" value="VMware"/>
132
139
  <param pos="0" name="service.product" value="Zimbra"/>
133
140
  <param pos="2" name="service.version"/>
data/xml/ldap_searchresult.xml CHANGED
@@ -404,7 +404,7 @@
404
404
  <param pos="1" name="service.version"/>
405
405
  </fingerprint>
406
406
  <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Release (\d+\.\d+[\w .]*)0.\x04.dominomajminversion)">
407
- <description>IBM (Lotus) Domino LDAP Server</description>
407
+ <description>IBM (Lotus) Domino LDAP Server - majminversion variant</description>
408
408
  <example service.version="8.5.3" _encoding="base64">
409
409
  SUJNIExvdHVzIFNvZnR3YXJlMCAEDXZlbmRvcnZlcnNpb24xDwQNUmVsZWFzZSA4LjUuMzAeB
410
410
  BNkb21pbm9tYWptaW52ZXJzaW9uMQcE
@@ -428,7 +428,7 @@
428
428
  <param pos="1" name="service.version"/>
429
429
  </fingerprint>
430
430
  <fingerprint pattern="(?im:IBM Lotus Software0.\x04\rvendorversion1.\x04.Build (V[\w .]*)0.\x04.dominomajminversion)">
431
- <description>IBM (Lotus) Domino LDAP Server</description>
431
+ <description>IBM (Lotus) Domino LDAP Server - build variant</description>
432
432
  <example service.version="V902_12302013" _encoding="base64">
433
433
  SUJNIExvdHVzIFNvZnR3YXJlMCYEDXZlbmRvcnZlcnNpb24xFQQTQnVpbGQgVjkwMl8xMjMwM
434
434
  jAxMzAeBBNkb21pbm9tYWptaW52ZXJzaW9uMQcE
data/xml/mysql_banners.xml CHANGED
@@ -144,7 +144,7 @@
144
144
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:{os.version}"/>
145
145
  </fingerprint>
146
146
  <fingerprint pattern="^(\d{1,2}\.\d{1,3}\.\d{1,2})-(?:Debian_)?\dubuntu(\d{1,2}\.\d\d)[.\d]*(?:-log)?$">
147
- <description>Oracle MySQL on Ubuntu</description>
147
+ <description>Oracle MySQL on Ubuntu - Debian string variant</description>
148
148
  <example service.version="5.0.22" os.version="6.06">5.0.22-Debian_0ubuntu6.06.14-log</example>
149
149
  <example service.version="5.1.41" os.version="12.10">5.1.41-3ubuntu12.10</example>
150
150
  <param pos="1" name="service.version"/>
@@ -458,7 +458,7 @@
458
458
  <param pos="0" name="os.family" value="Windows"/>
459
459
  </fingerprint>
460
460
  <fingerprint pattern="^(\d{1,2}\.\d{1,3}\.[a-f\d]{1,3})(?:-rc)?-enterprise" flags="REG_ICASE">
461
- <description>Oracle MySQL Enterprise Edition</description>
461
+ <description>Oracle MySQL Enterprise Edition - variant 1</description>
462
462
  <example service.version="5.1.26">5.1.26-rc-enterprise-gpl-log</example>
463
463
  <example service.version="5.5.27">5.5.27-enterprise-commercial-advanced-log</example>
464
464
  <param pos="1" name="service.version"/>
@@ -469,7 +469,7 @@
469
469
  <param pos="0" name="service.cpe23" value="cpe:/a:oracle:mysql:{service.version}"/>
470
470
  </fingerprint>
471
471
  <fingerprint pattern="^(\d{1,2}\.\d{1,3}\.[a-f\d]{1,3}-ndb-\d\.\d{1,2}\.[a-f\d]{1,3})" flags="REG_ICASE">
472
- <description>Oracle MySQL Cluster Edition</description>
472
+ <description>Oracle MySQL Cluster Edition - nbd variant</description>
473
473
  <example service.version="5.1.30-ndb-6.3.20">5.1.30-ndb-6.3.20-cluster-gpl-log</example>
474
474
  <example service.version="5.5.20-ndb-7.2.5">5.5.20-ndb-7.2.5-gpl</example>
475
475
  <param pos="1" name="service.version"/>
data/xml/mysql_error.xml CHANGED
@@ -52,7 +52,6 @@
52
52
  <fingerprint pattern="^^(?:#HY000)?Host '[^']+' is not allowed to connect to this MySQL server$$">
53
53
  <description>Oracle MySQL error ER_HOST_NOT_PRIVILEGED (eng)</description>
54
54
  <example>Host '10.10.10.10' is not allowed to connect to this MySQL server</example>
55
- <example>Host '10.10.10.10' is not allowed to connect to this MySQL server</example>
56
55
  <example>#HY000Host '10.10.10.10' is not allowed to connect to this MySQL server</example>
57
56
  <param pos="0" name="service.vendor" value="Oracle"/>
58
57
  <param pos="0" name="service.family" value="MySQL"/>
data/xml/ntp_banners.xml CHANGED
@@ -380,7 +380,7 @@
380
380
  <param pos="0" name="os.cpe23" value="cpe:/o:netbsd:netbsd:{os.version}"/>
381
381
  </fingerprint>
382
382
  <fingerprint pattern="^.*processor=&quot;([^ ]+)&quot;,.*system=&quot;NetBSD/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
383
- <description>ntpd running on NetBSD</description>
383
+ <description>ntpd running on NetBSD - variant 2</description>
384
384
  <example os.arch="i386" os.version="1.5.3">
385
385
  processor="i386", system="NetBSD1.5.3"
386
386
  </example>
@@ -1034,7 +1034,7 @@
1034
1034
  <param pos="1" name="os.product"/>
1035
1035
  </fingerprint>
1036
1036
  <fingerprint pattern="^.*processor=&quot;([^&quot;]+)&quot;, system=&quot;SCO_SV([\d\.]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1037
- <description>SCO Unixware NTP</description>
1037
+ <description>SCO Unixware NTP - SCO_SV variant</description>
1038
1038
  <example os.version="3.2" os.arch="i386">
1039
1039
  processor="i386", system="SCO_SV3.2", leap=0, stratum=2, precision=-18
1040
1040
  </example>
data/xml/operating_system.xml CHANGED
@@ -17,7 +17,6 @@
17
17
  <example os.product="Windows Server 2008" os.edition="Enterprise" os.version="Service Pack 2">Windows Server 2008 Enterprise without Hyper-V Service Pack 2</example>
18
18
  <example os.product="Windows Server 2008" os.edition="Enterprise" os.version="SP1">Windows Server 2008 Enterprise with Hyper-V SP1</example>
19
19
  <example os.product="Windows Server 2012 R2" os.edition="Foundation">Windows Server 2012 R2 Foundation Edition</example>
20
- <example os.product="Windows Storage Server 2012 R2">Windows Storage Server 2012 R2</example>
21
20
  <param pos="0" name="os.vendor" value="Microsoft"/>
22
21
  <param pos="0" name="os.family" value="Windows"/>
23
22
  <param pos="1" name="os.product"/>
data/xml/pop_banners.xml CHANGED
@@ -37,8 +37,8 @@
37
37
  <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:-"/>
38
38
  </fingerprint>
39
39
  <fingerprint pattern="^Lotus Notes POP3 server version Release ([^ ]+) ready on .*$">
40
- <description>IBM Lotus Notes/Domino</description>
41
- <example>Lotus Notes POP3 server version Release 8.5.1FP5 ready on foo/US.</example>
40
+ <description>IBM Lotus Notes/Domino - Release variant</description>
41
+ <example service.version="8.5.1FP5">Lotus Notes POP3 server version Release 8.5.1FP5 ready on foo/US.</example>
42
42
  <param pos="0" name="service.vendor" value="IBM"/>
43
43
  <param pos="0" name="service.family" value="Lotus Domino"/>
44
44
  <param pos="0" name="service.product" value="Lotus Domino"/>
@@ -171,16 +171,15 @@
171
171
  </fingerprint>
172
172
  <fingerprint pattern="^(\S+) Zimbra POP3 server ready\.?$">
173
173
  <description>VMware Zimbra POP</description>
174
- <example>catfood.example.com Zimbra POP3 server ready</example>
175
- <example>dogfood.example.com Zimbra POP3 server ready</example>
174
+ <example host.name="foo.bar">foo.bar Zimbra POP3 server ready</example>
176
175
  <param pos="0" name="service.vendor" value="VMware"/>
177
176
  <param pos="0" name="service.product" value="Zimbra"/>
178
177
  <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:-"/>
179
178
  <param pos="1" name="host.name"/>
180
179
  </fingerprint>
181
180
  <fingerprint pattern="^(\S+) Zimbra (\S+) POP3 server ready\.?$">
182
- <description>VMware Zimbra POP</description>
183
- <example>example.com Zimbra 7.0.0_GA_3079 POP3 server ready</example>
181
+ <description>VMware Zimbra POP with version</description>
182
+ <example host.name="foo.bar">foo.bar Zimbra 7.0.0_GA_3079 POP3 server ready</example>
184
183
  <param pos="0" name="service.vendor" value="VMware"/>
185
184
  <param pos="0" name="service.product" value="Zimbra"/>
186
185
  <param pos="2" name="service.version"/>
data/xml/smb_native_os.xml CHANGED
@@ -35,7 +35,7 @@
35
35
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:-"/>
36
36
  </fingerprint>
37
37
  <fingerprint pattern="^Windows XP (\d+) (Service Pack \d+)$">
38
- <description>Windows XP</description>
38
+ <description>Windows XP with Service Pack</description>
39
39
  <example os.build="2600" os.version="Service Pack 1">Windows XP 2600 Service Pack 1</example>
40
40
  <param pos="0" name="os.certainty" value="1.0"/>
41
41
  <param pos="0" name="os.vendor" value="Microsoft"/>
@@ -45,7 +45,7 @@
45
45
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_xp:{os.version}"/>
46
46
  </fingerprint>
47
47
  <fingerprint pattern="^Windows XP (\d+)$">
48
- <description>Windows XP</description>
48
+ <description>Windows XP with build number</description>
49
49
  <example os.build="2600">Windows XP 2600</example>
50
50
  <param pos="0" name="os.certainty" value="1.0"/>
51
51
  <param pos="0" name="os.vendor" value="Microsoft"/>
@@ -205,7 +205,7 @@
205
205
  </fingerprint>
206
206
  <!-- 2008 R2 -->
207
207
  <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+) (Service Pack \d+)(?:, v\.\d+)?$">
208
- <description>Windows Server 2008</description>
208
+ <description>Windows Server 2008 R2</description>
209
209
  <example>Windows Server 2008 R2 Enterprise 7601 Service Pack 1</example>
210
210
  <example>Windows Server 2008 R2 Standard 7601 Service Pack 1</example>
211
211
  <param pos="0" name="os.certainty" value="1.0"/>
@@ -217,7 +217,7 @@
217
217
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:{os.version}"/>
218
218
  </fingerprint>
219
219
  <fingerprint pattern="^Windows Server 2008 R2 (\w+|\w+ \w+|\w+ \w+ \w+) (\d+)$">
220
- <description>Windows Server 2008 R2</description>
220
+ <description>Windows Server 2008 R2 without Service Pack</description>
221
221
  <example os.edition="Enterprise">Windows Server 2008 R2 Enterprise 7600</example>
222
222
  <example os.edition="Standard">Windows Server 2008 R2 Standard 7600</example>
223
223
  <example os.edition="Datacenter">Windows Server 2008 R2 Datacenter 7600</example>
data/xml/smtp_banners.xml CHANGED
@@ -141,17 +141,18 @@
141
141
  <param pos="0" name="service.product" value="CCProxy"/>
142
142
  <param pos="1" name="service.version"/>
143
143
  </fingerprint>
144
- <fingerprint pattern="^[\*20 ]+$">
145
- <description>
146
- Cisco PIX firewall: PIX sits between an internal SMTP server and the rest of the world.
144
+ <!--
145
+ Cisco PIX sits between an internal SMTP server and the rest of the world.
147
146
 
148
- Its MailGuard feature strips all information out of the 220 header except for the ' ' (space), '2' (digit two),
149
- and '0' (digit zero) characters, replacing them with asterisks. While this effectively
150
- hides the back-end SMTP server, it does tell us that they are running Cisco PIX firewall
151
- (at least for SMTP, and possibly other services as well).
147
+ Its MailGuard feature strips all information out of the 220 header except for the ' ' (space), '2' (digit two),
148
+ and '0' (digit zero) characters, replacing them with asterisks. While this effectively
149
+ hides the back-end SMTP server, it does tell us that they are running Cisco PIX firewall
150
+ (at least for SMTP, and possibly other services as well).
152
151
 
153
- Search Cisco's documentation for "fixup protocol SMTP" for more information.
154
- </description>
152
+ Search Cisco's documentation for "fixup protocol SMTP" for more information.
153
+ -->
154
+ <fingerprint pattern="^[\*20 ]+$">
155
+ <description>Cisco PIX firewall MailGuard banner stripping</description>
155
156
  <example os.product="PIX">***************************</example>
156
157
  <param pos="0" name="os.vendor" value="Cisco"/>
157
158
  <param pos="0" name="os.family" value="PIX"/>
@@ -159,10 +160,7 @@
159
160
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
160
161
  </fingerprint>
161
162
  <fingerprint pattern="^([^ ]+) +ESMTP CPMTA-([^ ]+)_([^ ]+)_([^ ]+)_([^ ]+) - NO UCE *$">
162
- <description>Critical Path (aka InScribe) Messaging Server
163
- http://www.cp.net/products/inscr_messagingserv_overview.html
164
- Runs on Windows NT4/2k, Solaris 2.6, 2.7, and 2.8 Sparc/Intel, SGI IRIX 6.5.3 or later, and AIX
165
- </description>
163
+ <description>Critical Path (aka InScribe) Messaging Server on Windows NT4/2k, Solaris 2.6/2.7/2.8 Sparc/Intel, SGI IRIX 6.5.3 or later, or AIX </description>
166
164
  <param pos="0" name="service.vendor" value="Critical Path"/>
167
165
  <param pos="0" name="service.family" value="Messaging Server"/>
168
166
  <param pos="0" name="service.product" value="Messaging Server"/>
@@ -370,11 +368,7 @@
370
368
  <param pos="1" name="host.name"/>
371
369
  </fingerprint>
372
370
  <fingerprint pattern="^([^ ]+) +SMTP/smap Ready\.$">
373
- <description>TIS FWTK and derivatives
374
- http://www.tis.com/research/software/
375
- This fingerprint may be ambiguous because other firewalls (like
376
- Gauntlet) are derived from TIS
377
- </description>
371
+ <description>TIS FWTK and derivatives (other firewalls, like Gauntlet, are derived from TIS)</description>
378
372
  <example host.name="foo.bar">foo.bar SMTP/smap Ready.</example>
379
373
  <param pos="0" name="service.vendor" value="TIS"/>
380
374
  <param pos="0" name="service.family" value="FWTK"/>
@@ -1255,7 +1249,7 @@
1255
1249
  </fingerprint>
1256
1250
  <fingerprint pattern="^([^ ]+) ESMTP MetaInfo Sendmail ([^ ]+) Build ([^ ]+) \(Berkeley ([^ ]+)\)/([^;]+); (.+)$">
1257
1251
  <description>Sendmail - MetaInfo</description>
1258
- <example>foo.bar ESMTP MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4; Mon, 30 Jul</example>
1252
+ <example host.name="foo.bar" service.version="8.8.6">foo.bar ESMTP MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4; Mon, 30 Jul</example>
1259
1253
  <param pos="0" name="service.vendor" value="MetaInfo"/>
1260
1254
  <param pos="0" name="service.family" value="Sendmail"/>
1261
1255
  <param pos="0" name="service.product" value="Sendmail"/>
data/xml/smtp_debug.xml CHANGED
@@ -10,30 +10,22 @@
10
10
  of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
11
  -->
12
12
  <fingerprint pattern="^500 No way!$">
13
- <description>
14
- Exim
15
- example: 500 No way!
16
- </description>
13
+ <description>Exim</description>
14
+ <example>500 No way!</example>
17
15
  <param pos="0" name="service.vendor" value="exim"/>
18
16
  <param pos="0" name="service.family" value="exim"/>
19
17
  <param pos="0" name="service.product" value="exim"/>
20
18
  <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
21
19
  </fingerprint>
22
20
  <fingerprint pattern="^250[ -] *Debug set -NOT!$">
23
- <description>
24
- TIS FWTK and derivatives
25
- http://www.tis.com/research/software/
26
- This fingerprint may be ambiguous because other firewalls (like
27
- Gauntlet) are derived from TIS
28
- </description>
21
+ <description>TIS FWTK and derivatives (other firewalls, like Gauntlet, are derived from TIS)</description>
29
22
  <param pos="0" name="service.vendor" value="TIS"/>
30
23
  <param pos="0" name="service.family" value="FWTK"/>
31
24
  <param pos="0" name="service.product" value="FWTK"/>
32
25
  </fingerprint>
33
26
  <fingerprint pattern="^500[ -]What\? I don't understand that\.$">
34
- <description>
35
- 500 What? I don't understand that.
36
- </description>
27
+ <description>Alt-N MDaemon SMTP</description>
28
+ <example>500 What? I don't understand that.</example>
37
29
  <param pos="0" name="service.vendor" value="Alt-N"/>
38
30
  <param pos="0" name="service.family" value="MDaemon"/>
39
31
  <param pos="0" name="service.product" value="MDaemon"/>
data/xml/smtp_ehlo.xml CHANGED
@@ -10,10 +10,7 @@
10
10
  of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
11
  -->
12
12
  <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX&quot; unrecognized$">
13
- <description>
14
- Cisco PIX changes the command letters to 'X' before passing
15
- them to the real SMTP server.
16
- </description>
13
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server</description>
17
14
  <param pos="0" name="os.vendor" value="Cisco"/>
18
15
  <param pos="0" name="os.family" value="PIX"/>
19
16
  <param pos="0" name="os.product" value="PIX"/>
@@ -38,9 +35,7 @@
38
35
  </fingerprint>
39
36
  -->
40
37
  <fingerprint pattern="^221[ -]See ya in cyberspace$">
41
- <description>
42
- 221 See ya in cyberspace
43
- </description>
38
+ <description>221 See ya in cyberspace</description>
44
39
  <param pos="0" name="service.vendor" value="Alt-N"/>
45
40
  <param pos="0" name="service.family" value="MDaemon"/>
46
41
  <param pos="0" name="service.product" value="MDaemon"/>
data/xml/smtp_expn.xml CHANGED
@@ -10,30 +10,23 @@
10
10
  of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
11
11
  -->
12
12
  <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX.*&quot; unrecognized$">
13
- <description>
14
- Cisco PIX changes the command letters to 'X' before passing
15
- them to the real SMTP server.
16
- </description>
13
+ <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server - expn variant</description>
17
14
  <param pos="0" name="os.vendor" value="Cisco"/>
18
15
  <param pos="0" name="os.family" value="PIX"/>
19
16
  <param pos="0" name="os.product" value="PIX"/>
20
17
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
21
18
  </fingerprint>
22
19
  <fingerprint pattern="^550[ -]EXPN not available to \(.+\) \[.+\] *$">
23
- <description>
24
- Exim
25
- example: 550 EXPN not available to (foo.bar.com) [192.168.0.1]
26
- </description>
20
+ <description>Exim - expn variant 1</description>
21
+ <example>550 EXPN not available to (foo.bar.com) [192.168.0.1]</example>
27
22
  <param pos="0" name="service.vendor" value="exim"/>
28
23
  <param pos="0" name="service.family" value="exim"/>
29
24
  <param pos="0" name="service.product" value="exim"/>
30
25
  <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
31
26
  </fingerprint>
32
27
  <fingerprint pattern="^550[ -]EXPN not available to [^ ]+ \(.+\) \[.+\] *$">
33
- <description>
34
- Exim
35
- example: 550 EXPN not available to evil.com (foo.bar.com) [192.168.0.1]
36
- </description>
28
+ <description>Exim - expn variant 2</description>
29
+ <example>550 EXPN not available to evil.com (foo.bar.com) [192.168.0.1]</example>
37
30
  <param pos="0" name="service.vendor" value="exim"/>
38
31
  <param pos="0" name="service.family" value="exim"/>
39
32
  <param pos="0" name="service.product" value="exim"/>
@@ -53,18 +46,16 @@
53
46
  <param pos="0" name="service.product" value="VM"/>
54
47
  </fingerprint>
55
48
  <fingerprint pattern="^550[ -]lists are confidential *$">
56
- <description>
57
- example: 550 lists are confidential
58
- </description>
49
+ <description>Ipswitch IMail Server - expn variant</description>
50
+ <example>550 lists are confidential</example>
59
51
  <param pos="0" name="service.vendor" value="Ipswitch"/>
60
52
  <param pos="0" name="service.family" value="IMail Server"/>
61
53
  <param pos="0" name="service.product" value="IMail Server"/>
62
54
  <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:-"/>
63
55
  </fingerprint>
64
56
  <fingerprint pattern="^502[ -]command is not active$">
65
- <description>
66
- 502 command is not active
67
- </description>
57
+ <description>Alt-N MDaemon - expn variant</description>
58
+ <example>502 command is not active</example>
68
59
  <param pos="0" name="service.vendor" value="Alt-N"/>
69
60
  <param pos="0" name="service.family" value="MDaemon"/>
70
61
  <param pos="0" name="service.product" value="MDaemon"/>
@@ -76,17 +67,14 @@
76
67
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
77
68
  </fingerprint>
78
69
  <fingerprint pattern="^252 Unable to EXPN &quot;.*&quot;, but will accept message and attempt delivery *$">
79
- <description>
80
- Lotus Domino
81
- </description>
70
+ <description>Lotus Domino</description>
82
71
  <param pos="0" name="service.vendor" value="Lotus"/>
83
72
  <param pos="0" name="service.family" value="Lotus Domino"/>
84
73
  <param pos="0" name="service.product" value="Lotus Domino"/>
85
74
  </fingerprint>
86
75
  <fingerprint pattern="^550[ -]Unable to find list '.*'\.$">
87
- <description>
88
- example: 550 Unable to find list 'list'.
89
- </description>
76
+ <description>Seattle Labs SLMail</description>
77
+ <example>550 Unable to find list 'list'.</example>
90
78
  <param pos="0" name="service.vendor" value="Seattle Labs"/>
91
79
  <param pos="0" name="service.family" value="SLMail"/>
92
80
  <param pos="0" name="service.product" value="SLMail"/>