recog 2.3.0 → 2.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/version.rb +1 -1
  3. data/spec/lib/fingerprint_self_test_spec.rb +17 -0
  4. data/xml/apache_os.xml +4 -4
  5. data/xml/ftp_banners.xml +37 -46
  6. data/xml/h323_callresp.xml +1 -1
  7. data/xml/http_cookies.xml +26 -58
  8. data/xml/http_servers.xml +65 -95
  9. data/xml/http_wwwauth.xml +6 -6
  10. data/xml/imap_banners.xml +12 -5
  11. data/xml/ldap_searchresult.xml +2 -2
  12. data/xml/mysql_banners.xml +3 -3
  13. data/xml/mysql_error.xml +0 -1
  14. data/xml/ntp_banners.xml +2 -2
  15. data/xml/operating_system.xml +0 -1
  16. data/xml/pop_banners.xml +5 -6
  17. data/xml/smb_native_os.xml +4 -4
  18. data/xml/smtp_banners.xml +13 -19
  19. data/xml/smtp_debug.xml +5 -13
  20. data/xml/smtp_ehlo.xml +2 -7
  21. data/xml/smtp_expn.xml +12 -24
  22. data/xml/smtp_help.xml +22 -62
  23. data/xml/smtp_noop.xml +5 -9
  24. data/xml/smtp_quit.xml +3 -7
  25. data/xml/smtp_rcptto.xml +3 -7
  26. data/xml/smtp_vrfy.xml +16 -35
  27. data/xml/snmp_sysdescr.xml +258 -278
  28. data/xml/snmp_sysobjid.xml +3 -3
  29. data/xml/ssh_banners.xml +8 -11
  30. data/xml/x509_subjects.xml +14 -17
  31. metadata +3 -3
data/xml/snmp_sysobjid.xml CHANGED
@@ -31,7 +31,7 @@
31
31
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
32
32
  </fingerprint>
33
33
  <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows 2000 Version 5\.0.*$">
34
- <description>Windows 2000 on x86</description>
34
+ <description>Windows 2000 Datacenter on x86</description>
35
35
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 4 Stepping 8 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor Free)</example>
36
36
  <param pos="0" name="os.vendor" value="Microsoft"/>
37
37
  <param pos="0" name="os.family" value="Windows"/>
@@ -49,7 +49,7 @@
49
49
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
50
50
  </fingerprint>
51
51
  <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows Version 5\.2.*$">
52
- <description>Windows Server 2003 on x86</description>
52
+ <description>Windows Server 2003 Datacenter on x86</description>
53
53
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
54
54
  <param pos="0" name="os.vendor" value="Microsoft"/>
55
55
  <param pos="0" name="os.family" value="Windows"/>
@@ -68,7 +68,7 @@
68
68
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
69
69
  </fingerprint>
70
70
  <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: \S+64.*Software: Windows Version 5\.2.*$">
71
- <description>Windows Server 2003 on x86_64</description>
71
+ <description>Windows Server 2003 Datacenter on x86_64</description>
72
72
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
73
73
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 6 Model 15 Stepping 6 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
74
74
  <param pos="0" name="os.vendor" value="Microsoft"/>
data/xml/ssh_banners.xml CHANGED
@@ -38,15 +38,15 @@
38
38
  </fingerprint>
39
39
  <fingerprint pattern="^Serv-U_([\d\.]+)$">
40
40
  <description>Serv-U SSH</description>
41
- <example>Serv-U_7.4.0.1</example>
41
+ <example service.version="7.4.0.1">Serv-U_7.4.0.1</example>
42
42
  <param pos="0" name="service.vendor" value="Rhino Software"/>
43
43
  <param pos="0" name="service.product" value="Serv-U"/>
44
44
  <param pos="1" name="service.version"/>
45
45
  </fingerprint>
46
46
  <fingerprint pattern="WS_FTP-SSH_([\d\.]+)$">
47
47
  <description>WS_FTP Server with SSH</description>
48
- <example>WS_FTP-SSH_6.1.1</example>
49
- <example>WS_FTP-SSH_7.0</example>
48
+ <example service.version="6.1.1">WS_FTP-SSH_6.1.1</example>
49
+ <example service.version="7.0">WS_FTP-SSH_7.0</example>
50
50
  <param pos="0" name="service.vendor" value="Ipswitch"/>
51
51
  <param pos="0" name="service.product" value="WS_FTP"/>
52
52
  <param pos="1" name="service.version"/>
@@ -705,8 +705,7 @@
705
705
  </fingerprint>-->
706
706
  <!-- TODO: Handle "vpn3" banners for Cisco 3000 VPN Concentrators (need example banners first) -->
707
707
  <fingerprint pattern="^Cisco-(.*)$">
708
- <description>Cisco SSH banner (could be IOS or PIX).
709
- The version always seems to be 1.25</description>
708
+ <description>Cisco SSH banner (could be IOS or PIX), The version always seems to be 1.25</description>
710
709
  <example service.version="1.25">Cisco-1.25</example>
711
710
  <param pos="1" name="service.version"/>
712
711
  <param pos="0" name="service.vendor" value="Cisco"/>
@@ -924,7 +923,7 @@
924
923
  <param pos="0" name="hw.vendor" value="Ruijie"/>
925
924
  </fingerprint>
926
925
  <fingerprint pattern="^VShell_(?:Special_Edition_)?(\d+)_(\d+)_(\d+)_(\d+) VShell$">
927
- <description>VanDyke VShell</description>
926
+ <description>VanDyke VShell - detailed variant</description>
928
927
  <example service.version="3" service.version.version="6" service.version.version.version="2" service.version.version.version.version="446">VShell_3_6_2_446 VShell</example>
929
928
  <example service.version="2" service.version.version="5" service.version.version.version="0" service.version.version.version.version="204">VShell_Special_Edition_2_5_0_204 VShell</example>
930
929
  <param pos="1" name="service.version"/>
@@ -945,8 +944,7 @@
945
944
  <param pos="0" name="service.cpe23" value="cpe:/a:vandyke:vshell:{service.version}"/>
946
945
  </fingerprint>
947
946
  <fingerprint pattern="^WRQReflection(?i:F)orSecureIT_(.*)$">
948
- <description>Attachmate Reflection (formerly WRQ Reflection for Secure IT)
949
- </description>
947
+ <description>Attachmate Reflection (formerly WRQ Reflection for Secure IT)</description>
950
948
  <example service.version="6.1 Build 21">WRQReflectionForSecureIT_6.1 Build 21</example>
951
949
  <example service.version="8.2 Build 117">WRQReflectionforSecureIT_8.2 Build 117</example>
952
950
  <param pos="1" name="service.version"/>
@@ -955,8 +953,7 @@
955
953
  <param pos="0" name="service.product" value="Reflection"/>
956
954
  </fingerprint>
957
955
  <fingerprint pattern="^([^\s]*)\s*F-Secure SSH\s*(?:.*)$">
958
- <description>Attachmate Reflection (formerly F-Secure SSH)
959
- </description>
956
+ <description>Attachmate Reflection (formerly F-Secure SSH)</description>
960
957
  <example service.version="3.2.3">3.2.3 F-Secure SSH Windows NT Server</example>
961
958
  <param pos="1" name="service.version"/>
962
959
  <param pos="0" name="service.vendor" value="Attachmate"/>
@@ -964,7 +961,7 @@
964
961
  <param pos="0" name="service.product" value="Reflection"/>
965
962
  </fingerprint>
966
963
  <fingerprint pattern="^([^\s]*)\s*SSH Tectia Server$">
967
- <description>SSH Communications Security Tectia Server</description>
964
+ <description>SSH Communications Security Tectia Server - branded</description>
968
965
  <example service.version="6.4.12.353">6.4.12.353 SSH Tectia Server</example>
969
966
  <param pos="1" name="service.version"/>
970
967
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
data/xml/x509_subjects.xml CHANGED
@@ -72,7 +72,7 @@
72
72
  <param pos="1" name="host.mac"/>
73
73
  </fingerprint>
74
74
  <fingerprint pattern="^SERIALNUMBER=PID:([^ ]+) SN:([^,]+),CN=(?:[a-zA-Z0-9\-]+)-SEP([a-fA-F0-9]{12}),OU=CTG,O=Cisco Systems Inc\.$">
75
- <description>Cisco / Linksys Router</description>
75
+ <description>Cisco / Linksys Router with serial number</description>
76
76
  <example host.mac="B07D47D33A1C" hw.product="CP-8851" cisco.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
77
77
  <param pos="0" name="hw.device" value="IP Phone"/>
78
78
  <param pos="0" name="hw.vendor" value="Cisco"/>
@@ -136,10 +136,7 @@
136
136
  <example>CN=idrac-SVCTAG,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
137
137
  <example>CN=idrac-prosit-laks,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
138
138
  <example>CN=idrac-,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
139
- <example>CN=idrac-SVCTAG,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
140
139
  <example>CN=idrac,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
141
- <example>CN=idrac,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
142
- <example>CN=idrac-SVCTAG,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
143
140
  <param pos="0" name="hw.device" value="Lights Out Management"/>
144
141
  <param pos="0" name="hw.vendor" value="Dell"/>
145
142
  <param pos="0" name="hw.product" value="iDRAC"/>
@@ -193,7 +190,7 @@
193
190
  <param pos="1" name="host.name"/>
194
191
  </fingerprint>
195
192
  <fingerprint pattern="^CN=HP Service Processor,OU=UDU Service Tools,O=Hewlett-Packard Development Company\\, L\.P\.\\ ,L=Fremont,ST=California,C=US$">
196
- <description>HP iLO</description>
193
+ <description>HP iLO - HP Service Processor</description>
197
194
  <example>CN=HP Service Processor,OU=UDU Service Tools,O=Hewlett-Packard Development Company\, L.P.\ ,L=Fremont,ST=California,C=US</example>
198
195
  <param pos="0" name="hw.device" value="Lights Out Management"/>
199
196
  <param pos="0" name="hw.vendor" value="HP"/>
@@ -221,7 +218,7 @@
221
218
  <param pos="1" name="host.mac"/>
222
219
  </fingerprint>
223
220
  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=Hewlett Packard Enterprise Network Management Software \(SMH\),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US$">
224
- <description>HP iLO</description>
221
+ <description>HP iLO - Enterprise Mgmt variant</description>
225
222
  <example>CN=bigsrv99,OU=Hewlett Packard Enterprise Network Management Software (SMH),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
226
223
  <param pos="0" name="hw.device" value="Lights Out Management"/>
227
224
  <param pos="0" name="hw.vendor" value="HP"/>
@@ -267,7 +264,7 @@
267
264
  <param pos="0" name="os.vendor" value="Avocent"/>
268
265
  </fingerprint>
269
266
  <fingerprint pattern="^CN=Avocent Mergepoint Unity,O=Avocent Mergepoint Unity,L=Huntsville,ST=Alabama,C=US$">
270
- <description>Avocent KVM</description>
267
+ <description>Avocent Mergepoint KVM</description>
271
268
  <example>CN=Avocent Mergepoint Unity,O=Avocent Mergepoint Unity,L=Huntsville,ST=Alabama,C=US</example>
272
269
  <param pos="0" name="hw.device" value="KVM"/>
273
270
  <param pos="0" name="hw.vendor" value="Avocent"/>
@@ -277,9 +274,9 @@
277
274
  <param pos="0" name="os.product" value="Mergepoint"/>
278
275
  </fingerprint>
279
276
  <fingerprint pattern="^CN=HP Jetdirect [a-zA-Z0-9]+,OU=([a-fA-F0-9]{12})\+OU=([a-zA-Z0-9]+),O=Hewlett-Packard Co\.$">
280
- <description>HP Jet Direct</description>
281
- <example>CN=HP Jetdirect 38831831,OU=2C413883186A+OU=J8028E,O=Hewlett-Packard Co.</example>
282
- <example>CN=HP Jetdirect FBFA31E7,OU=8851FBE33ABB+OU=J8016E,O=Hewlett-Packard Co.</example>
277
+ <description>HP Jet Direct - with host MAC and product</description>
278
+ <example host.mac="2C413883186A" hw.product="J8028E">CN=HP Jetdirect 38831831,OU=2C413883186A+OU=J8028E,O=Hewlett-Packard Co.</example>
279
+ <example os.product="J8016E">CN=HP Jetdirect FBFA31E7,OU=8851FBE33ABB+OU=J8016E,O=Hewlett-Packard Co.</example>
283
280
  <param pos="0" name="hw.device" value="Printer"/>
284
281
  <param pos="0" name="hw.vendor" value="HP"/>
285
282
  <param pos="0" name="hw.family" value="JetDirect"/>
@@ -451,7 +448,7 @@
451
448
  <param pos="0" name="hw.product" value="APIC"/>
452
449
  </fingerprint>
453
450
  <fingerprint pattern="^CN=APIC$">
454
- <description>Cisco APIC</description>
451
+ <description>Cisco APIC - bare CN</description>
455
452
  <example>CN=APIC</example>
456
453
  <param pos="0" name="hw.vendor" value="Cisco"/>
457
454
  <param pos="0" name="hw.product" value="APIC"/>
@@ -555,7 +552,7 @@
555
552
  <param pos="0" name="os.device" value="Appliance"/>
556
553
  </fingerprint>
557
554
  <fingerprint pattern="^CN=.*,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
558
- <description>Fortinet FortiMail Appliance</description>
555
+ <description>Fortinet FortiManager Appliance</description>
559
556
  <example>CN=FMG-VM0000000000,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
560
557
  <param pos="0" name="hw.vendor" value="Fortinet"/>
561
558
  <param pos="0" name="hw.device" value="Appliance"/>
@@ -587,7 +584,7 @@
587
584
  <param pos="1" name="host.mac"/>
588
585
  </fingerprint>
589
586
  <fingerprint pattern="^CN=unifi$">
590
- <description>Ubiquiti Controller</description>
587
+ <description>Ubiquiti Controller - unifi bare</description>
591
588
  <example>CN=unifi</example>
592
589
  <param pos="0" name="hw.vendor" value="Ubiquiti"/>
593
590
  <param pos="0" name="hw.device" value="Wireless Controller"/>
@@ -596,7 +593,7 @@
596
593
  <param pos="0" name="os.device" value="Wireless Controller"/>
597
594
  </fingerprint>
598
595
  <fingerprint pattern="^CN=UniFi,OU=UniFi,O=ubnt\.com,L=San Jose,ST=CA,C=US$">
599
- <description>Ubiquiti Controller</description>
596
+ <description>Ubiquiti Controller - unifi</description>
600
597
  <example>CN=UniFi,OU=UniFi,O=ubnt.com,L=San Jose,ST=CA,C=US</example>
601
598
  <param pos="0" name="hw.vendor" value="Ubiquiti"/>
602
599
  <param pos="0" name="hw.device" value="Wireless Controller"/>
@@ -755,7 +752,7 @@
755
752
  <param pos="0" name="os.family" value="Linux"/>
756
753
  </fingerprint>
757
754
  <fingerprint pattern="^CN=Canon (iR-[a-zA-Z0-9\.\-\_]+)$">
758
- <description>Canon iR-ADV Printer</description>
755
+ <description>Canon iR-ADV Printer with product info</description>
759
756
  <example os.product="iR-ADV">CN=Canon iR-ADV</example>
760
757
  <param pos="0" name="hw.device" value="Printer"/>
761
758
  <param pos="0" name="hw.vendor" value="Canon"/>
@@ -814,7 +811,7 @@
814
811
  <param pos="1" name="hw.product"/>
815
812
  </fingerprint>
816
813
  <fingerprint pattern="^CN=([a-fA-F0-9]{12}),O=Polycom Inc\.$">
817
- <description>NEC DT Series IP Phone</description>
814
+ <description>Polycom SoundPoint IP Phone</description>
818
815
  <example host.mac="64167F169981">CN=64167F169981,O=Polycom Inc.</example>
819
816
  <param pos="0" name="os.vendor" value="Polycom"/>
820
817
  <param pos="0" name="os.device" value="IP Phone"/>
@@ -878,7 +875,7 @@
878
875
  <param pos="0" name="os.device" value="WAP"/>
879
876
  </fingerprint>
880
877
  <fingerprint pattern="^CN=axis-([a-fA-F0-9]{12}),O=Axis Communications AB$">
881
- <description>OpenWRT WAP</description>
878
+ <description>Axis Communications Web Cam</description>
882
879
  <example host.mac="accc8ea31abf">CN=axis-accc8ea31abf,O=Axis Communications AB</example>
883
880
  <param pos="0" name="hw.vendor" value="AXIS"/>
884
881
  <param pos="0" name="hw.device" value="Web Cam"/>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.3.0
4
+ version: 2.3.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2019-04-10 00:00:00.000000000 Z
11
+ date: 2019-05-01 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec
@@ -250,7 +250,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
250
250
  version: '0'
251
251
  requirements: []
252
252
  rubyforge_project:
253
- rubygems_version: 2.6.11
253
+ rubygems_version: 2.6.6
254
254
  signing_key:
255
255
  specification_version: 4
256
256
  summary: Network service fingerprint database, classes, and utilities