recog 2.3.10 → 2.3.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 882d241ba5d8115e818c1f3a9373171d502cc4cd1b0d9069a41bd9383aabf90a
4
- data.tar.gz: d90114dc975f4ae473af3958ba30cfe1d14953299a9585726a6b1d834e6c2091
3
+ metadata.gz: 97d63040d77ee814dfef18425b59f861c5502b6e929826c27b3f6ec81423edfe
4
+ data.tar.gz: 27f184ce296b50e0c061e67c0fb5cff846eca187ee72750684904aea66061bc7
5
5
  SHA512:
6
- metadata.gz: c98f1e8fc087478c4ac5cc2a6512059976ff8bb99bd83c5f7098856888e31af4f9e8a3643a18a091fa4676df9da83314aee24ef01b0367a381ebee7077aa2fdd
7
- data.tar.gz: 01034d8c3ca39855af88582e1027ce6f2bd2f60b312d06e9a11f81b8e3ed896801d0e40e09a18a37e57df1adb58dfb0125bcca74bea26443e9b068fd6b60f7d7
6
+ metadata.gz: fec43f32715f27d49b9c0258cd46b2b647c11d9649d30601ac7220b4f37459a9664686c25f84304c307e74690815de91e3883ba018d4b9d1546aea4867cebe42
7
+ data.tar.gz: e8612ca2e848fe0c8f8ccd32646309614fca7cdbc3101f01554c4e770ea738fead20ea24c003b70f0241a412186cbaa819b5d805b2e71d834dd77a327bdfc7e6
File without changes
@@ -48,7 +48,6 @@ mappings:
48
48
  products:
49
49
  lotus_domino: lotus_domino_server
50
50
  os/400: os_400
51
- z/os: z\/os
52
51
  jamf:
53
52
  products:
54
53
  jamf_pro: jamf
@@ -93,4 +93,4 @@ iPad
93
93
  iPad Air
94
94
  iPad Pro
95
95
  iPad mini
96
- iPhone
96
+ iPhone
@@ -325,4 +325,4 @@ iPhone X
325
325
  iPhone XR
326
326
  iPhone XS
327
327
  iPhone XS Max
328
- vManage
328
+ vManage
@@ -554,3 +554,4 @@ vsFTPd
554
554
  vsFTPd Extended
555
555
  z/OS FTP Server
556
556
  zFTPServer
557
+ TCP/IP
@@ -782,6 +782,7 @@ Tomato
782
782
  TornadoWeb
783
783
  Toshiba
784
784
  Trancell
785
+ Treck
785
786
  Trend Micro
786
787
  Tridium
787
788
  Troy
@@ -1,3 +1,3 @@
1
1
  module Recog
2
- VERSION = '2.3.10'
2
+ VERSION = '2.3.11'
3
3
  end
@@ -24,6 +24,7 @@ def parse_cpe_vp_map(file):
24
24
  vp_map[cpe_type] = {}
25
25
  if not vendor in vp_map[cpe_type]:
26
26
  vp_map[cpe_type][vendor] = set()
27
+ product = product.replace('%2f', '/')
27
28
  vp_map[cpe_type][vendor].add(product)
28
29
  else:
29
30
  logging.error("Unexpected CPE %s", cpe_name)
@@ -160,6 +161,8 @@ def update_cpes(xml_file, cpe_vp_map, r7_vp_map):
160
161
  continue
161
162
 
162
163
  # building the CPE string
164
+ # Last minute escaping of '/'
165
+ product = product.replace('/', '\/')
163
166
  cpe_value = 'cpe:/{}:{}:{}'.format(cpe_type, vendor, product)
164
167
 
165
168
  if version:
@@ -8,6 +8,42 @@
8
8
  dnsmasq-2.76-1-ubnt2
9
9
  -->
10
10
 
11
+ <!--
12
+ The following 'assert nothing' block is intended to handle banners so simple
13
+ that they cannot be attributed to a product or vendor. They are at the
14
+ beginning of the file as a performance tweak given how frequenty they occur.
15
+ -->
16
+
17
+ <fingerprint pattern="^$">
18
+ <description>empty string -- assert nothing.</description>
19
+ <example/>
20
+ <param pos="0" name="service.certainty" value="0.0"/>
21
+ </fingerprint>
22
+
23
+ <fingerprint pattern="^none$">
24
+ <description>bare 'none' -- assert nothing.</description>
25
+ <example>none</example>
26
+ <param pos="0" name="service.certainty" value="0.0"/>
27
+ </fingerprint>
28
+
29
+ <fingerprint pattern="^null$">
30
+ <description>bare 'null' -- assert nothing.</description>
31
+ <example>null</example>
32
+ <param pos="0" name="service.certainty" value="0.0"/>
33
+ </fingerprint>
34
+
35
+ <fingerprint pattern="(?i)^unknown$">
36
+ <description>bare 'unknown' -- assert nothing.</description>
37
+ <example>unknown</example>
38
+ <param pos="0" name="service.certainty" value="0.0"/>
39
+ </fingerprint>
40
+
41
+ <fingerprint pattern="^no version$">
42
+ <description>bare 'no version' -- assert nothing.</description>
43
+ <example>no version</example>
44
+ <param pos="0" name="service.certainty" value="0.0"/>
45
+ </fingerprint>
46
+
11
47
  <!-- Red Hat package naming:
12
48
  https://fedoraproject.org/wiki/Packaging:DistTag
13
49
  https://fedoraproject.org/wiki/Packaging:Versioning
@@ -161,6 +197,21 @@
161
197
  <param pos="0" name="os.product" value="Zentyal"/>
162
198
  </fingerprint>
163
199
 
200
+ <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)(?:-[\d\.]+)?\+deb10[\w~\.]+-Debian$">
201
+ <description>ISC BIND: Debian 10.0 (buster)</description>
202
+ <example service.version="9.11.5-P4">9.11.5-P4-5.1+deb10u1-Debian</example>
203
+ <param pos="0" name="service.vendor" value="ISC"/>
204
+ <param pos="0" name="service.family" value="BIND"/>
205
+ <param pos="0" name="service.product" value="BIND"/>
206
+ <param pos="1" name="service.version"/>
207
+ <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
208
+ <param pos="0" name="os.vendor" value="Debian"/>
209
+ <param pos="0" name="os.family" value="Linux"/>
210
+ <param pos="0" name="os.product" value="Linux"/>
211
+ <param pos="0" name="os.version" value="10.0"/>
212
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.0"/>
213
+ </fingerprint>
214
+
164
215
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-9\+deb8u[\w~\.]+-Debian$">
165
216
  <description>ISC BIND: Debian 8.0 (jessie)</description>
166
217
  <example service.version="9.9.5">9.9.5-9+deb8u11-Debian</example>
@@ -376,13 +427,14 @@
376
427
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:authoritative_server:{service.version}"/>
377
428
  </fingerprint>
378
429
 
379
- <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
430
+ <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?[^ ]*) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
380
431
  <description>PowerDNS Authoritative Server: format 2</description>
381
432
  <example service.version="4.0.4">PowerDNS Authoritative Server 4.0.4 (built Jul 26 2017 15:04:27 by root@FreeBSD:11:amd64-default-job-03)</example>
382
433
  <example service.version="4.0.0-rc2">PowerDNS Authoritative Server 4.0.0-rc2 (built Jul 4 2016 15:44:39 by root@foo-bar.baz)</example>
383
434
  <example service.version="4.0.0-alpha2">PowerDNS Authoritative Server 4.0.0-alpha2 (built Feb 01 2016 00:12:05 by buildbot@baz)</example>
384
435
  <example service.version="4.0.0-beta1">PowerDNS Authoritative Server 4.0.0-beta1 (built Feb 01 2016 00:00:00 by buildbot@baz)</example>
385
436
  <example service.version="0.0.g56d692a">PowerDNS Authoritative Server 0.0.g56d692a (built Feb 25 2017 13:10:19 by root@foo-bar.baz)</example>
437
+ <example service.version="4.2.0-rc2.995.master.g8cc411dc4">PowerDNS Authoritative Server 4.2.0-rc2.995.master.g8cc411dc4 (built Nov 6 2019 11:48:12 by root@foo-bar.baz)</example>
386
438
  <param pos="0" name="service.vendor" value="PowerDNS"/>
387
439
  <param pos="0" name="service.family" value="PowerDNS"/>
388
440
  <param pos="0" name="service.product" value="Authoritative Server"/>
@@ -483,6 +535,20 @@
483
535
  <param pos="0" name="service.product" value="unbound"/>
484
536
  </fingerprint>
485
537
 
538
+ <fingerprint pattern="^(?:BIND )?(9.[^-]+(?:-[SP]\d)?)(?:-[\d\.]+)?\+deb10u\d+-Raspbian$">
539
+ <description>ISC BIND: Raspbian based on Debian Buster</description>
540
+ <example service.version="9.11.5-P4">9.11.5-P4-5.1+deb10u1-Raspbian</example>
541
+ <param pos="0" name="service.vendor" value="ISC"/>
542
+ <param pos="0" name="service.family" value="BIND"/>
543
+ <param pos="0" name="service.product" value="BIND"/>
544
+ <param pos="1" name="service.version"/>
545
+ <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
546
+ <param pos="0" name="os.vendor" value="Raspbian"/>
547
+ <param pos="0" name="os.family" value="Linux"/>
548
+ <param pos="0" name="os.product" value="Linux"/>
549
+ <param pos="0" name="os.version" value="10.0"/>
550
+ </fingerprint>
551
+
486
552
  <fingerprint pattern="^(?:BIND )?(9.[^-]+(?:-[SP]\d)?)-9\+deb8u\d+-Raspbian$">
487
553
  <description>ISC BIND: Raspbian based on Debian Jessie</description>
488
554
  <example service.version="9.9.5">9.9.5-9+deb8u7-Raspbian</example>
@@ -625,6 +691,34 @@
625
691
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
626
692
  </fingerprint>
627
693
 
694
+ <!-- This value is a spoofed value. There isn't a publicly available version
695
+ of Windows with build 6.0.6100 and this explicit string is used in an
696
+ example of how to change your version on BIND. We tested servers reporting
697
+ this string and NONE of them were Windows DNS.
698
+ This fingerprint serves to prevent someone who doesn't know from creating
699
+ one and stops further pattern matching efforts.
700
+ -->
701
+
702
+ <fingerprint pattern="^Microsoft DNS 6.0.6100 \(2AEF76E\)$">
703
+ <description>SPOOFED - Microsoft DNS on Windows 2008 SP something</description>
704
+ <example>Microsoft DNS 6.0.6100 (2AEF76E)</example>
705
+ </fingerprint>
706
+
707
+ <fingerprint pattern="^Microsoft DNS 6.0.6003(?: \(\w+\))?$">
708
+ <description>Microsoft DNS on Windows 2008 Service Pack 2 - Preview Rollup KB4489887 and later</description>
709
+ <example>Microsoft DNS 6.0.6003 (1773501D)</example>
710
+ <param pos="0" name="service.vendor" value="Microsoft"/>
711
+ <param pos="0" name="service.family" value="DNS"/>
712
+ <param pos="0" name="service.product" value="DNS"/>
713
+ <param pos="0" name="service.version" value="6.0.6003"/>
714
+ <param pos="0" name="os.vendor" value="Microsoft"/>
715
+ <param pos="0" name="os.family" value="Windows"/>
716
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
717
+ <param pos="0" name="os.version" value="Service Pack 2"/>
718
+ <param pos="0" name="os.build" value="6.0.6003"/>
719
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:Service Pack 2"/>
720
+ </fingerprint>
721
+
628
722
  <fingerprint pattern="^Microsoft DNS 6.0.6002(?: \(\w+\))?$">
629
723
  <description>Microsoft DNS on Windows 2008 Service Pack 2</description>
630
724
  <example>Microsoft DNS 6.0.6002 (17724D35)</example>
@@ -788,8 +882,8 @@
788
882
 
789
883
  <fingerprint pattern="^CleanBrowsing v([^ ]+) - (.*)">
790
884
  <description>CleanBrowsing DNS Server</description>
791
- <example service.vendor="CleanBrowsing" service.family="CleanBrowsing" service.version="1.5a" service.node="dns-edge-usa-west-sunnyvale-p">CleanBrowsing v1.5a - dns-edge-usa-west-sunnyvale-p</example>
792
- <example service.vendor="CleanBrowsing" service.family="CleanBrowsing" service.version="1.4a" service.node="dns-edge-usa-west-sunnyvale.cleanbrowsing.org">CleanBrowsing v1.4a - dns-edge-usa-west-sunnyvale.cleanbrowsing.org</example>
885
+ <example service.version="1.5a" service.node="dns-edge-usa-west-sunnyvale-p">CleanBrowsing v1.5a - dns-edge-usa-west-sunnyvale-p</example>
886
+ <example service.version="1.4a" service.node="dns-edge-usa-west-sunnyvale.cleanbrowsing.org">CleanBrowsing v1.4a - dns-edge-usa-west-sunnyvale.cleanbrowsing.org</example>
793
887
  <param pos="0" name="service.vendor" value="CleanBrowsing"/>
794
888
  <param pos="0" name="service.family" value="CleanBrowsing"/>
795
889
  <param pos="0" name="service.product" value="DNS"/>
@@ -809,7 +903,7 @@
809
903
 
810
904
  <fingerprint pattern="^Q9-[^\-]-(.*)$">
811
905
  <description>Quad9 Resolver</description>
812
- <example service.vendor="IBM" service.family="Quad9" service.product="DNS" service.version="6.0">Q9-P-6.0</example>
906
+ <example service.version="6.0">Q9-P-6.0</example>
813
907
  <param pos="0" name="service.vendor" value="IBM"/>
814
908
  <param pos="0" name="service.family" value="Quad9"/>
815
909
  <param pos="0" name="service.product" value="DNS"/>
@@ -818,10 +912,18 @@
818
912
 
819
913
  <fingerprint pattern="^keweonDNS v\.(.*)$">
820
914
  <description>Keweon DNS</description>
821
- <example service.vendor="Keweon" service.product="DNS" service.version="9.63.7201">keweonDNS v.9.63.7201</example>
915
+ <example service.version="9.63.7201">keweonDNS v.9.63.7201</example>
822
916
  <param pos="0" name="service.vendor" value="Keweon"/>
823
917
  <param pos="0" name="service.product" value="DNS"/>
824
918
  <param pos="1" name="service.version"/>
825
919
  </fingerprint>
826
920
 
921
+ <fingerprint pattern="^Version: recursive-main/(\d+)$">
922
+ <description>Akamai AnswerX DNS server</description>
923
+ <example service.version="22386077">Version: recursive-main/22386077</example>
924
+ <param pos="0" name="service.vendor" value="Akamai"/>
925
+ <param pos="0" name="service.product" value="AnswerX"/>
926
+ <param pos="1" name="service.version"/>
927
+ </fingerprint>
928
+
827
929
  </fingerprints>
@@ -362,11 +362,12 @@
362
362
  <param pos="0" name="service.cpe23" value="cpe:/a:jetbrains:teamcity:-"/>
363
363
  </fingerprint>
364
364
 
365
- <fingerprint pattern="^e48c482f8f5a8e5a6249b21a39f911e7$"><description>Cockroach DB Console</description>
365
+ <fingerprint pattern="^e48c482f8f5a8e5a6249b21a39f911e7$">
366
+ <description>Cockroach DB Console</description>
366
367
  <example>e48c482f8f5a8e5a6249b21a39f911e7</example>
367
368
  <param pos="0" name="service.vendor" value="Cockroach Labs"/>
368
369
  <param pos="0" name="service.product" value="CockroachDB"/>
369
- <param pos="0" name="service.certainty" value="0.5"/>
370
+ <param pos="0" name="service.certainty" value="0.5"/>
370
371
  </fingerprint>
371
372
 
372
373
  <fingerprint pattern="^(?:4f21edb50ae95a99bbd4aa0a956a179e|1531801cb9e3047e72034ed34da9d104)$">
@@ -574,6 +574,7 @@ more text
574
574
  <param pos="0" name="os.family" value="z/OS"/>
575
575
  <param pos="0" name="os.device" value="Mainframe"/>
576
576
  <param pos="1" name="os.version"/>
577
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:z\/os:{os.version}"/>
577
578
  <param pos="2" name="host.name"/>
578
579
  </fingerprint>
579
580
 
@@ -1656,6 +1656,24 @@
1656
1656
  <param pos="0" name="service.component.cpe23" value="cpe:/a:sap:netweaver_application_server:-"/>
1657
1657
  </fingerprint>
1658
1658
 
1659
+ <fingerprint pattern="^SAP Internet Graphics Server$">
1660
+ <description>SAP Internet Graphics Server</description>
1661
+ <example>SAP Internet Graphics Server</example>
1662
+ <param pos="0" name="service.vendor" value="SAP"/>
1663
+ <param pos="0" name="service.product" value="Internet Graphics Server"/>
1664
+ <param pos="0" name="service.component.vendor" value="SAP"/>
1665
+ <param pos="0" name="service.component.product" value="NetWeaver Application Server"/>
1666
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:sap:netweaver_application_server:-"/>
1667
+ </fingerprint>
1668
+
1669
+ <fingerprint pattern="^SAP Message Server, release ([\d.]+) \(LNK\)$">
1670
+ <description>SAP Message Server</description>
1671
+ <example service.version="753">SAP Message Server, release 753 (LNK)</example>
1672
+ <param pos="0" name="service.vendor" value="SAP"/>
1673
+ <param pos="0" name="service.product" value="SAP Message Server"/>
1674
+ <param pos="1" name="service.version"/>
1675
+ </fingerprint>
1676
+
1659
1677
  <fingerprint pattern="^SQLAnywhere/([\d.]+)$">
1660
1678
  <description>SAP SQLAnywhere</description>
1661
1679
  <example service.version="16.0.0.2207">SQLAnywhere/16.0.0.2207</example>
@@ -2542,12 +2560,16 @@
2542
2560
  variety of products including printers, PDUs, etc.
2543
2561
  -->
2544
2562
 
2545
- <fingerprint pattern="^\$ProjectRevision: 4.0.2.38 \$$">
2546
- <description>This banner is seen on some HP LaserJet printers.</description>
2563
+ <fingerprint pattern="^\$ProjectRevision:[\s\w:]* ([\d\.]+) \$$">
2564
+ <description>This banner is used to see if devices have Treck TCP/IP</description>
2547
2565
  <example>$ProjectRevision: 4.0.2.38 $</example>
2548
- <param pos="0" name="os.vendor" value="HP"/>
2549
- <param pos="0" name="os.device" value="Printer"/>
2550
- <param pos="0" name="os.family" value="LaserJet"/>
2566
+ <example>$ProjectRevision: 4.2 $</example>
2567
+ <example>$ProjectRevision: 6.0.1.5 $</example>
2568
+ <example>$ProjectRevision: Last Checkpoint: 4.2.2.13 $</example>
2569
+ <param pos="0" name="service.vendor" value="Treck"/>
2570
+ <param pos="0" name="service.product" value="TCP/IP"/>
2571
+ <param pos="1" name="service.version"/>
2572
+ <param pos="0" name="service.cpe23" value="cpe:/a:treck:tcp\/ip:{service.version}"/>
2551
2573
  </fingerprint>
2552
2574
 
2553
2575
  <fingerprint pattern="^WEBrick/([\d\.]+) .*$">
@@ -515,9 +515,9 @@
515
515
 
516
516
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
517
517
  <description>Netgear Orbi</description>
518
- <example hw.product="Orbi">Basic realm=&quot;NETGEAR Orbi&quot;</example>
519
- <example hw.product="Orbi-micro">Basic realm=&quot;NETGEAR Orbi-micro&quot;</example>
520
- <example hw.product="Orbi-mini">Basic realm=&quot;NETGEAR Orbi-mini&quot;</example>
518
+ <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
519
+ <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
520
+ <example hw.product="Orbi-mini">Basic realm="NETGEAR Orbi-mini"</example>
521
521
  <param pos="0" name="hw.vendor" value="Netgear"/>
522
522
  <param pos="0" name="hw.device" value="WAP"/>
523
523
  <param pos="0" name="hw.family" value="Orbi"/>
@@ -526,9 +526,9 @@
526
526
 
527
527
  <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;.*$">
528
528
  <description>Netgear Routers</description>
529
- <example hw.product="DG834">Basic realm=&quot;NETGEAR DG834 &quot;</example>
530
- <example hw.product="C7000v2">Basic realm=&quot;NETGEAR C7000v2&quot;</example>
531
- <example hw.product="R7000P">Basic realm=&quot;NETGEAR R7000P&quot;</example>
529
+ <example hw.product="DG834">Basic realm="NETGEAR DG834 "</example>
530
+ <example hw.product="C7000v2">Basic realm="NETGEAR C7000v2"</example>
531
+ <example hw.product="R7000P">Basic realm="NETGEAR R7000P"</example>
532
532
  <param pos="0" name="hw.vendor" value="Netgear"/>
533
533
  <param pos="0" name="hw.device" value="Router"/>
534
534
  <param pos="1" name="hw.product"/>
@@ -538,7 +538,7 @@
538
538
 
539
539
  <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;.*$">
540
540
  <description>Netgear Unspecified Router</description>
541
- <example>Basic realm=&quot;Netgear&quot;</example>
541
+ <example>Basic realm="Netgear"</example>
542
542
  <param pos="0" name="hw.vendor" value="Netgear"/>
543
543
  <param pos="0" name="hw.device" value="Router"/>
544
544
  </fingerprint>
@@ -3353,6 +3353,7 @@ Copyright (c) 1995-2005 by Cisco Systems
3353
3353
  <param pos="0" name="os.vendor" value="IBM"/>
3354
3354
  <param pos="0" name="os.family" value="z/OS"/>
3355
3355
  <param pos="0" name="os.product" value="z/OS"/>
3356
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:z\/os:-"/>
3356
3357
  </fingerprint>
3357
3358
 
3358
3359
  <fingerprint pattern="^BladeCenter Management Module$">
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.3.10
4
+ version: 2.3.11
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2020-07-14 00:00:00.000000000 Z
11
+ date: 2020-07-16 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec