recog 2.3.0 → 2.3.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (31) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/version.rb +1 -1
  3. data/spec/lib/fingerprint_self_test_spec.rb +17 -0
  4. data/xml/apache_os.xml +4 -4
  5. data/xml/ftp_banners.xml +37 -46
  6. data/xml/h323_callresp.xml +1 -1
  7. data/xml/http_cookies.xml +26 -58
  8. data/xml/http_servers.xml +65 -95
  9. data/xml/http_wwwauth.xml +6 -6
  10. data/xml/imap_banners.xml +12 -5
  11. data/xml/ldap_searchresult.xml +2 -2
  12. data/xml/mysql_banners.xml +3 -3
  13. data/xml/mysql_error.xml +0 -1
  14. data/xml/ntp_banners.xml +2 -2
  15. data/xml/operating_system.xml +0 -1
  16. data/xml/pop_banners.xml +5 -6
  17. data/xml/smb_native_os.xml +4 -4
  18. data/xml/smtp_banners.xml +13 -19
  19. data/xml/smtp_debug.xml +5 -13
  20. data/xml/smtp_ehlo.xml +2 -7
  21. data/xml/smtp_expn.xml +12 -24
  22. data/xml/smtp_help.xml +22 -62
  23. data/xml/smtp_noop.xml +5 -9
  24. data/xml/smtp_quit.xml +3 -7
  25. data/xml/smtp_rcptto.xml +3 -7
  26. data/xml/smtp_vrfy.xml +16 -35
  27. data/xml/snmp_sysdescr.xml +258 -278
  28. data/xml/snmp_sysobjid.xml +3 -3
  29. data/xml/ssh_banners.xml +8 -11
  30. data/xml/x509_subjects.xml +14 -17
  31. metadata +3 -3
data/xml/snmp_sysobjid.xml CHANGED
@@ -31,7 +31,7 @@
31
31
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
32
32
  </fingerprint>
33
33
  <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows 2000 Version 5\.0.*$">
34
- <description>Windows 2000 on x86</description>
34
+ <description>Windows 2000 Datacenter on x86</description>
35
35
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 4 Stepping 8 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor Free)</example>
36
36
  <param pos="0" name="os.vendor" value="Microsoft"/>
37
37
  <param pos="0" name="os.family" value="Windows"/>
@@ -49,7 +49,7 @@
49
49
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
50
50
  </fingerprint>
51
51
  <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: x86.*Software: Windows Version 5\.2.*$">
52
- <description>Windows Server 2003 on x86</description>
52
+ <description>Windows Server 2003 Datacenter on x86</description>
53
53
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: x86 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
54
54
  <param pos="0" name="os.vendor" value="Microsoft"/>
55
55
  <param pos="0" name="os.family" value="Windows"/>
@@ -68,7 +68,7 @@
68
68
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
69
69
  </fingerprint>
70
70
  <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: \S+64.*Software: Windows Version 5\.2.*$">
71
- <description>Windows Server 2003 on x86_64</description>
71
+ <description>Windows Server 2003 Datacenter on x86_64</description>
72
72
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 15 Model 4 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
73
73
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 6 Model 15 Stepping 6 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)</example>
74
74
  <param pos="0" name="os.vendor" value="Microsoft"/>
data/xml/ssh_banners.xml CHANGED
@@ -38,15 +38,15 @@
38
38
  </fingerprint>
39
39
  <fingerprint pattern="^Serv-U_([\d\.]+)$">
40
40
  <description>Serv-U SSH</description>
41
- <example>Serv-U_7.4.0.1</example>
41
+ <example service.version="7.4.0.1">Serv-U_7.4.0.1</example>
42
42
  <param pos="0" name="service.vendor" value="Rhino Software"/>
43
43
  <param pos="0" name="service.product" value="Serv-U"/>
44
44
  <param pos="1" name="service.version"/>
45
45
  </fingerprint>
46
46
  <fingerprint pattern="WS_FTP-SSH_([\d\.]+)$">
47
47
  <description>WS_FTP Server with SSH</description>
48
- <example>WS_FTP-SSH_6.1.1</example>
49
- <example>WS_FTP-SSH_7.0</example>
48
+ <example service.version="6.1.1">WS_FTP-SSH_6.1.1</example>
49
+ <example service.version="7.0">WS_FTP-SSH_7.0</example>
50
50
  <param pos="0" name="service.vendor" value="Ipswitch"/>
51
51
  <param pos="0" name="service.product" value="WS_FTP"/>
52
52
  <param pos="1" name="service.version"/>
@@ -705,8 +705,7 @@
705
705
  </fingerprint>-->
706
706
  <!-- TODO: Handle "vpn3" banners for Cisco 3000 VPN Concentrators (need example banners first) -->
707
707
  <fingerprint pattern="^Cisco-(.*)$">
708
- <description>Cisco SSH banner (could be IOS or PIX).
709
- The version always seems to be 1.25</description>
708
+ <description>Cisco SSH banner (could be IOS or PIX), The version always seems to be 1.25</description>
710
709
  <example service.version="1.25">Cisco-1.25</example>
711
710
  <param pos="1" name="service.version"/>
712
711
  <param pos="0" name="service.vendor" value="Cisco"/>
@@ -924,7 +923,7 @@
924
923
  <param pos="0" name="hw.vendor" value="Ruijie"/>
925
924
  </fingerprint>
926
925
  <fingerprint pattern="^VShell_(?:Special_Edition_)?(\d+)_(\d+)_(\d+)_(\d+) VShell$">
927
- <description>VanDyke VShell</description>
926
+ <description>VanDyke VShell - detailed variant</description>
928
927
  <example service.version="3" service.version.version="6" service.version.version.version="2" service.version.version.version.version="446">VShell_3_6_2_446 VShell</example>
929
928
  <example service.version="2" service.version.version="5" service.version.version.version="0" service.version.version.version.version="204">VShell_Special_Edition_2_5_0_204 VShell</example>
930
929
  <param pos="1" name="service.version"/>
@@ -945,8 +944,7 @@
945
944
  <param pos="0" name="service.cpe23" value="cpe:/a:vandyke:vshell:{service.version}"/>
946
945
  </fingerprint>
947
946
  <fingerprint pattern="^WRQReflection(?i:F)orSecureIT_(.*)$">
948
- <description>Attachmate Reflection (formerly WRQ Reflection for Secure IT)
949
- </description>
947
+ <description>Attachmate Reflection (formerly WRQ Reflection for Secure IT)</description>
950
948
  <example service.version="6.1 Build 21">WRQReflectionForSecureIT_6.1 Build 21</example>
951
949
  <example service.version="8.2 Build 117">WRQReflectionforSecureIT_8.2 Build 117</example>
952
950
  <param pos="1" name="service.version"/>
@@ -955,8 +953,7 @@
955
953
  <param pos="0" name="service.product" value="Reflection"/>
956
954
  </fingerprint>
957
955
  <fingerprint pattern="^([^\s]*)\s*F-Secure SSH\s*(?:.*)$">
958
- <description>Attachmate Reflection (formerly F-Secure SSH)
959
- </description>
956
+ <description>Attachmate Reflection (formerly F-Secure SSH)</description>
960
957
  <example service.version="3.2.3">3.2.3 F-Secure SSH Windows NT Server</example>
961
958
  <param pos="1" name="service.version"/>
962
959
  <param pos="0" name="service.vendor" value="Attachmate"/>
@@ -964,7 +961,7 @@
964
961
  <param pos="0" name="service.product" value="Reflection"/>
965
962
  </fingerprint>
966
963
  <fingerprint pattern="^([^\s]*)\s*SSH Tectia Server$">
967
- <description>SSH Communications Security Tectia Server</description>
964
+ <description>SSH Communications Security Tectia Server - branded</description>
968
965
  <example service.version="6.4.12.353">6.4.12.353 SSH Tectia Server</example>
969
966
  <param pos="1" name="service.version"/>
970
967
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
data/xml/x509_subjects.xml CHANGED
@@ -72,7 +72,7 @@
72
72
  <param pos="1" name="host.mac"/>
73
73
  </fingerprint>
74
74
  <fingerprint pattern="^SERIALNUMBER=PID:([^ ]+) SN:([^,]+),CN=(?:[a-zA-Z0-9\-]+)-SEP([a-fA-F0-9]{12}),OU=CTG,O=Cisco Systems Inc\.$">
75
- <description>Cisco / Linksys Router</description>
75
+ <description>Cisco / Linksys Router with serial number</description>
76
76
  <example host.mac="B07D47D33A1C" hw.product="CP-8851" cisco.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
77
77
  <param pos="0" name="hw.device" value="IP Phone"/>
78
78
  <param pos="0" name="hw.vendor" value="Cisco"/>
@@ -136,10 +136,7 @@
136
136
  <example>CN=idrac-SVCTAG,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
137
137
  <example>CN=idrac-prosit-laks,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
138
138
  <example>CN=idrac-,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
139
- <example>CN=idrac-SVCTAG,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
140
139
  <example>CN=idrac,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
141
- <example>CN=idrac,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
142
- <example>CN=idrac-SVCTAG,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US</example>
143
140
  <param pos="0" name="hw.device" value="Lights Out Management"/>
144
141
  <param pos="0" name="hw.vendor" value="Dell"/>
145
142
  <param pos="0" name="hw.product" value="iDRAC"/>
@@ -193,7 +190,7 @@
193
190
  <param pos="1" name="host.name"/>
194
191
  </fingerprint>
195
192
  <fingerprint pattern="^CN=HP Service Processor,OU=UDU Service Tools,O=Hewlett-Packard Development Company\\, L\.P\.\\ ,L=Fremont,ST=California,C=US$">
196
- <description>HP iLO</description>
193
+ <description>HP iLO - HP Service Processor</description>
197
194
  <example>CN=HP Service Processor,OU=UDU Service Tools,O=Hewlett-Packard Development Company\, L.P.\ ,L=Fremont,ST=California,C=US</example>
198
195
  <param pos="0" name="hw.device" value="Lights Out Management"/>
199
196
  <param pos="0" name="hw.vendor" value="HP"/>
@@ -221,7 +218,7 @@
221
218
  <param pos="1" name="host.mac"/>
222
219
  </fingerprint>
223
220
  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=Hewlett Packard Enterprise Network Management Software \(SMH\),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US$">
224
- <description>HP iLO</description>
221
+ <description>HP iLO - Enterprise Mgmt variant</description>
225
222
  <example>CN=bigsrv99,OU=Hewlett Packard Enterprise Network Management Software (SMH),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
226
223
  <param pos="0" name="hw.device" value="Lights Out Management"/>
227
224
  <param pos="0" name="hw.vendor" value="HP"/>
@@ -267,7 +264,7 @@
267
264
  <param pos="0" name="os.vendor" value="Avocent"/>
268
265
  </fingerprint>
269
266
  <fingerprint pattern="^CN=Avocent Mergepoint Unity,O=Avocent Mergepoint Unity,L=Huntsville,ST=Alabama,C=US$">
270
- <description>Avocent KVM</description>
267
+ <description>Avocent Mergepoint KVM</description>
271
268
  <example>CN=Avocent Mergepoint Unity,O=Avocent Mergepoint Unity,L=Huntsville,ST=Alabama,C=US</example>
272
269
  <param pos="0" name="hw.device" value="KVM"/>
273
270
  <param pos="0" name="hw.vendor" value="Avocent"/>
@@ -277,9 +274,9 @@
277
274
  <param pos="0" name="os.product" value="Mergepoint"/>
278
275
  </fingerprint>
279
276
  <fingerprint pattern="^CN=HP Jetdirect [a-zA-Z0-9]+,OU=([a-fA-F0-9]{12})\+OU=([a-zA-Z0-9]+),O=Hewlett-Packard Co\.$">
280
- <description>HP Jet Direct</description>
281
- <example>CN=HP Jetdirect 38831831,OU=2C413883186A+OU=J8028E,O=Hewlett-Packard Co.</example>
282
- <example>CN=HP Jetdirect FBFA31E7,OU=8851FBE33ABB+OU=J8016E,O=Hewlett-Packard Co.</example>
277
+ <description>HP Jet Direct - with host MAC and product</description>
278
+ <example host.mac="2C413883186A" hw.product="J8028E">CN=HP Jetdirect 38831831,OU=2C413883186A+OU=J8028E,O=Hewlett-Packard Co.</example>
279
+ <example os.product="J8016E">CN=HP Jetdirect FBFA31E7,OU=8851FBE33ABB+OU=J8016E,O=Hewlett-Packard Co.</example>
283
280
  <param pos="0" name="hw.device" value="Printer"/>
284
281
  <param pos="0" name="hw.vendor" value="HP"/>
285
282
  <param pos="0" name="hw.family" value="JetDirect"/>
@@ -451,7 +448,7 @@
451
448
  <param pos="0" name="hw.product" value="APIC"/>
452
449
  </fingerprint>
453
450
  <fingerprint pattern="^CN=APIC$">
454
- <description>Cisco APIC</description>
451
+ <description>Cisco APIC - bare CN</description>
455
452
  <example>CN=APIC</example>
456
453
  <param pos="0" name="hw.vendor" value="Cisco"/>
457
454
  <param pos="0" name="hw.product" value="APIC"/>
@@ -555,7 +552,7 @@
555
552
  <param pos="0" name="os.device" value="Appliance"/>
556
553
  </fingerprint>
557
554
  <fingerprint pattern="^CN=.*,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
558
- <description>Fortinet FortiMail Appliance</description>
555
+ <description>Fortinet FortiManager Appliance</description>
559
556
  <example>CN=FMG-VM0000000000,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
560
557
  <param pos="0" name="hw.vendor" value="Fortinet"/>
561
558
  <param pos="0" name="hw.device" value="Appliance"/>
@@ -587,7 +584,7 @@
587
584
  <param pos="1" name="host.mac"/>
588
585
  </fingerprint>
589
586
  <fingerprint pattern="^CN=unifi$">
590
- <description>Ubiquiti Controller</description>
587
+ <description>Ubiquiti Controller - unifi bare</description>
591
588
  <example>CN=unifi</example>
592
589
  <param pos="0" name="hw.vendor" value="Ubiquiti"/>
593
590
  <param pos="0" name="hw.device" value="Wireless Controller"/>
@@ -596,7 +593,7 @@
596
593
  <param pos="0" name="os.device" value="Wireless Controller"/>
597
594
  </fingerprint>
598
595
  <fingerprint pattern="^CN=UniFi,OU=UniFi,O=ubnt\.com,L=San Jose,ST=CA,C=US$">
599
- <description>Ubiquiti Controller</description>
596
+ <description>Ubiquiti Controller - unifi</description>
600
597
  <example>CN=UniFi,OU=UniFi,O=ubnt.com,L=San Jose,ST=CA,C=US</example>
601
598
  <param pos="0" name="hw.vendor" value="Ubiquiti"/>
602
599
  <param pos="0" name="hw.device" value="Wireless Controller"/>
@@ -755,7 +752,7 @@
755
752
  <param pos="0" name="os.family" value="Linux"/>
756
753
  </fingerprint>
757
754
  <fingerprint pattern="^CN=Canon (iR-[a-zA-Z0-9\.\-\_]+)$">
758
- <description>Canon iR-ADV Printer</description>
755
+ <description>Canon iR-ADV Printer with product info</description>
759
756
  <example os.product="iR-ADV">CN=Canon iR-ADV</example>
760
757
  <param pos="0" name="hw.device" value="Printer"/>
761
758
  <param pos="0" name="hw.vendor" value="Canon"/>
@@ -814,7 +811,7 @@
814
811
  <param pos="1" name="hw.product"/>
815
812
  </fingerprint>
816
813
  <fingerprint pattern="^CN=([a-fA-F0-9]{12}),O=Polycom Inc\.$">
817
- <description>NEC DT Series IP Phone</description>
814
+ <description>Polycom SoundPoint IP Phone</description>
818
815
  <example host.mac="64167F169981">CN=64167F169981,O=Polycom Inc.</example>
819
816
  <param pos="0" name="os.vendor" value="Polycom"/>
820
817
  <param pos="0" name="os.device" value="IP Phone"/>
@@ -878,7 +875,7 @@
878
875
  <param pos="0" name="os.device" value="WAP"/>
879
876
  </fingerprint>
880
877
  <fingerprint pattern="^CN=axis-([a-fA-F0-9]{12}),O=Axis Communications AB$">
881
- <description>OpenWRT WAP</description>
878
+ <description>Axis Communications Web Cam</description>
882
879
  <example host.mac="accc8ea31abf">CN=axis-accc8ea31abf,O=Axis Communications AB</example>
883
880
  <param pos="0" name="hw.vendor" value="AXIS"/>
884
881
  <param pos="0" name="hw.device" value="Web Cam"/>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.3.0
4
+ version: 2.3.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2019-04-10 00:00:00.000000000 Z
11
+ date: 2019-05-01 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec
@@ -250,7 +250,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
250
250
  version: '0'
251
251
  requirements: []
252
252
  rubyforge_project:
253
- rubygems_version: 2.6.11
253
+ rubygems_version: 2.6.6
254
254
  signing_key:
255
255
  specification_version: 4
256
256
  summary: Network service fingerprint database, classes, and utilities