recog 2.3.17 → 2.3.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +26 -0
  3. data/bin/recog_standardize +6 -0
  4. data/cpe-remap.yaml +342 -200
  5. data/identifiers/README.md +24 -10
  6. data/identifiers/fields.txt +104 -0
  7. data/identifiers/hw_device.txt +2 -0
  8. data/identifiers/hw_family.txt +11 -0
  9. data/identifiers/hw_product.txt +71 -0
  10. data/identifiers/os_device.txt +2 -1
  11. data/identifiers/os_family.txt +2 -0
  12. data/identifiers/os_product.txt +36 -8
  13. data/identifiers/service_family.txt +10 -1
  14. data/identifiers/service_product.txt +78 -2
  15. data/identifiers/vendor.txt +55 -0
  16. data/lib/recog/nizer.rb +1 -82
  17. data/lib/recog/version.rb +1 -1
  18. data/requirements.txt +1 -1
  19. data/update_cpes.py +18 -5
  20. data/xml/apache_modules.xml +60 -0
  21. data/xml/apache_os.xml +1 -1
  22. data/xml/dns_versionbind.xml +11 -1
  23. data/xml/favicons.xml +122 -3
  24. data/xml/ftp_banners.xml +62 -51
  25. data/xml/html_title.xml +553 -41
  26. data/xml/http_cookies.xml +262 -61
  27. data/xml/http_servers.xml +478 -108
  28. data/xml/http_wwwauth.xml +36 -9
  29. data/xml/imap_banners.xml +5 -5
  30. data/xml/ldap_searchresult.xml +1 -0
  31. data/xml/mdns_device-info_txt.xml +340 -10
  32. data/xml/mysql_banners.xml +2 -1
  33. data/xml/nntp_banners.xml +1 -1
  34. data/xml/ntp_banners.xml +16 -2
  35. data/xml/operating_system.xml +4 -4
  36. data/xml/pop_banners.xml +4 -4
  37. data/xml/rtsp_servers.xml +7 -0
  38. data/xml/sip_banners.xml +347 -9
  39. data/xml/sip_user_agents.xml +323 -4
  40. data/xml/smb_native_lm.xml +32 -1
  41. data/xml/smb_native_os.xml +160 -33
  42. data/xml/smtp_banners.xml +167 -128
  43. data/xml/smtp_expn.xml +1 -0
  44. data/xml/smtp_vrfy.xml +1 -0
  45. data/xml/snmp_sysdescr.xml +205 -36
  46. data/xml/ssh_banners.xml +139 -25
  47. data/xml/telnet_banners.xml +92 -48
  48. data/xml/tls_jarm.xml +140 -0
  49. data/xml/x509_issuers.xml +201 -2
  50. data/xml/x509_subjects.xml +251 -32
  51. metadata +5 -2
data/xml/ssh_banners.xml CHANGED
@@ -33,12 +33,12 @@
33
33
  <param pos="0" name="service.product" value="iLO"/>
34
34
  <param pos="0" name="service.family" value="iLO"/>
35
35
  <param pos="1" name="service.version"/>
36
- <param pos="0" name="service.cpe23" value="cpe:/a:hp:integrated_lights_out:{service.version}"/>
37
36
  <param pos="0" name="hw.vendor" value="HP"/>
38
37
  <param pos="0" name="os.vendor" value="HP"/>
39
38
  <param pos="0" name="os.product" value="iLO"/>
40
39
  <param pos="0" name="os.family" value="iLO"/>
41
40
  <param pos="0" name="os.device" value="Lights Out Management"/>
41
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
42
42
  </fingerprint>
43
43
 
44
44
  <fingerprint pattern="^Serv-U_([\d\.]+)$">
@@ -552,7 +552,7 @@
552
552
  </fingerprint>
553
553
 
554
554
  <fingerprint pattern="^OpenSSH_(7\.8) (FreeBSD-20180909)$">
555
- <description>OpenSSH running on FreeBSD 12.0</description>
555
+ <description>OpenSSH running on FreeBSD 12.0/12.1</description>
556
556
  <example service.version="7.8" openssh.comment="FreeBSD-20180909">OpenSSH_7.8 FreeBSD-20180909</example>
557
557
  <param pos="1" name="service.version"/>
558
558
  <param pos="2" name="openssh.comment"/>
@@ -888,9 +888,10 @@
888
888
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:13.04"/>
889
889
  </fingerprint>
890
890
 
891
- <fingerprint pattern="^OpenSSH_(6\.2p2) (Ubuntu-6unbuntu\d(?:\.\d)?)$">
891
+ <fingerprint pattern="^OpenSSH_(6\.2p2) (Ubuntu-6\S*)$">
892
892
  <description>OpenSSH running on Ubuntu 13.10</description>
893
893
  <example service.version="6.2p2" openssh.comment="Ubuntu-6unbuntu0.4">OpenSSH_6.2p2 Ubuntu-6unbuntu0.4</example>
894
+ <example service.version="6.2p2" openssh.comment="Ubuntu-6">OpenSSH_6.2p2 Ubuntu-6</example>
894
895
  <param pos="1" name="service.version"/>
895
896
  <param pos="2" name="openssh.comment"/>
896
897
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -917,10 +918,11 @@
917
918
  <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
918
919
  </fingerprint>
919
920
 
920
- <fingerprint pattern="^OpenSSH_(6\.6(?:\.\d)?p1) (Ubuntu-2ubuntu\d+(?:\.\d+)?)$">
921
+ <fingerprint pattern="^OpenSSH_(6\.6(?:\.1)?p1) (Ubuntu-2\S*)$">
921
922
  <description>OpenSSH running on Ubuntu 14.04</description>
922
923
  <example service.version="6.6p1" openssh.comment="Ubuntu-2ubuntu1">OpenSSH_6.6p1 Ubuntu-2ubuntu1</example>
923
924
  <example service.version="6.6.1p1" openssh.comment="Ubuntu-2ubuntu2">OpenSSH_6.6.1p1 Ubuntu-2ubuntu2</example>
925
+ <example service.version="6.6.1p1" openssh.comment="Ubuntu-2ubuntu2.13">OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.13</example>
924
926
  <param pos="1" name="service.version"/>
925
927
  <param pos="2" name="openssh.comment"/>
926
928
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -950,9 +952,10 @@
950
952
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:14.10"/>
951
953
  </fingerprint>
952
954
 
953
- <fingerprint pattern="^OpenSSH_(6\.7p1) (Ubuntu-5ubuntu\d(?:\.\d)?)$">
955
+ <fingerprint pattern="^OpenSSH_(6\.7p1) (Ubuntu-5\S*)$">
954
956
  <description>OpenSSH running on Ubuntu 15.04 (vivid)</description>
955
957
  <example service.version="6.7p1" openssh.comment="Ubuntu-5ubuntu1">OpenSSH_6.7p1 Ubuntu-5ubuntu1</example>
958
+ <example service.version="6.7p1" openssh.comment="Ubuntu-5ubuntu1.4">OpenSSH_6.7p1 Ubuntu-5ubuntu1.4</example>
956
959
  <param pos="1" name="service.version"/>
957
960
  <param pos="2" name="openssh.comment"/>
958
961
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -966,9 +969,10 @@
966
969
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:15.04"/>
967
970
  </fingerprint>
968
971
 
969
- <fingerprint pattern="^OpenSSH_(6\.9p1) (Ubuntu-2)$">
972
+ <fingerprint pattern="^OpenSSH_(6\.9p1) (Ubuntu-2\S*)$">
970
973
  <description>OpenSSH running on Ubuntu 15.10</description>
971
974
  <example service.version="6.9p1" openssh.comment="Ubuntu-2">OpenSSH_6.9p1 Ubuntu-2</example>
975
+ <example service.version="6.9p1" openssh.comment="Ubuntu-2ubuntu0.2">OpenSSH_6.9p1 Ubuntu-2ubuntu0.2</example>
972
976
  <param pos="1" name="service.version"/>
973
977
  <param pos="2" name="openssh.comment"/>
974
978
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -982,9 +986,11 @@
982
986
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:15.10"/>
983
987
  </fingerprint>
984
988
 
985
- <fingerprint pattern="^OpenSSH_(7\.2p2) (Ubuntu-4ubuntu\d(?:\.\d)?)$">
989
+ <fingerprint pattern="^OpenSSH_(7\.2p2) (Ubuntu-4\S*)$">
986
990
  <description>OpenSSH running on Ubuntu 16.04 (vivid)</description>
987
991
  <example service.version="7.2p2" openssh.comment="Ubuntu-4ubuntu2.7">OpenSSH_7.2p2 Ubuntu-4ubuntu2.7</example>
992
+ <example service.version="7.2p2" openssh.comment="Ubuntu-4ubuntu1">OpenSSH_7.2p2 Ubuntu-4ubuntu1</example>
993
+ <example service.version="7.2p2" openssh.comment="Ubuntu-4">OpenSSH_7.2p2 Ubuntu-4</example>
988
994
  <param pos="1" name="service.version"/>
989
995
  <param pos="2" name="openssh.comment"/>
990
996
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1030,9 +1036,10 @@
1030
1036
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:17.04"/>
1031
1037
  </fingerprint>
1032
1038
 
1033
- <fingerprint pattern="^OpenSSH_(7\.5p1) (Ubuntu-10ubuntu\d(?:\.\d)?)$">
1039
+ <fingerprint pattern="^OpenSSH_(7\.5p1) (Ubuntu-10\S*)$">
1034
1040
  <description>OpenSSH running on Ubuntu 17.10</description>
1035
1041
  <example service.version="7.5p1" openssh.comment="Ubuntu-10ubuntu0.1">OpenSSH_7.5p1 Ubuntu-10ubuntu0.1</example>
1042
+ <example service.version="7.5p1" openssh.comment="Ubuntu-10">OpenSSH_7.5p1 Ubuntu-10</example>
1036
1043
  <param pos="1" name="service.version"/>
1037
1044
  <param pos="2" name="openssh.comment"/>
1038
1045
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1046,9 +1053,10 @@
1046
1053
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:17.10"/>
1047
1054
  </fingerprint>
1048
1055
 
1049
- <fingerprint pattern="^OpenSSH_(7\.6p1) (Ubuntu-4ubuntu\d(?:\.\d)?)$">
1056
+ <fingerprint pattern="^OpenSSH_(7\.6p1) (Ubuntu-4\S*)$">
1050
1057
  <description>OpenSSH running on Ubuntu 18.04</description>
1051
1058
  <example service.version="7.6p1" openssh.comment="Ubuntu-4ubuntu0.3">OpenSSH_7.6p1 Ubuntu-4ubuntu0.3</example>
1059
+ <example service.version="7.6p1" openssh.comment="Ubuntu-4">OpenSSH_7.6p1 Ubuntu-4</example>
1052
1060
  <param pos="1" name="service.version"/>
1053
1061
  <param pos="2" name="openssh.comment"/>
1054
1062
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1062,9 +1070,10 @@
1062
1070
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:18.04"/>
1063
1071
  </fingerprint>
1064
1072
 
1065
- <fingerprint pattern="^OpenSSH_(7\.7p1) (Ubuntu-4)$">
1073
+ <fingerprint pattern="^OpenSSH_(7\.7p1) (Ubuntu-4\S*)$">
1066
1074
  <description>OpenSSH running on Ubuntu 18.10</description>
1067
1075
  <example service.version="7.7p1" openssh.comment="Ubuntu-4">OpenSSH_7.7p1 Ubuntu-4</example>
1076
+ <example service.version="7.7p1" openssh.comment="Ubuntu-4ubuntu0.3">OpenSSH_7.7p1 Ubuntu-4ubuntu0.3</example>
1068
1077
  <param pos="1" name="service.version"/>
1069
1078
  <param pos="2" name="openssh.comment"/>
1070
1079
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1110,6 +1119,39 @@
1110
1119
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:19.10"/>
1111
1120
  </fingerprint>
1112
1121
 
1122
+ <fingerprint pattern="^OpenSSH_(8\.2p1) (Ubuntu-4\S*)$">
1123
+ <description>OpenSSH running on Ubuntu 20.04</description>
1124
+ <example service.version="8.2p1" openssh.comment="Ubuntu-4ubuntu0.1">OpenSSH_8.2p1 Ubuntu-4ubuntu0.1</example>
1125
+ <example service.version="8.2p1" openssh.comment="Ubuntu-4">OpenSSH_8.2p1 Ubuntu-4</example>
1126
+ <param pos="1" name="service.version"/>
1127
+ <param pos="2" name="openssh.comment"/>
1128
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1129
+ <param pos="0" name="service.family" value="OpenSSH"/>
1130
+ <param pos="0" name="service.product" value="OpenSSH"/>
1131
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1132
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
1133
+ <param pos="0" name="os.family" value="Linux"/>
1134
+ <param pos="0" name="os.product" value="Linux"/>
1135
+ <param pos="0" name="os.version" value="20.04"/>
1136
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:20.04"/>
1137
+ </fingerprint>
1138
+
1139
+ <fingerprint pattern="^OpenSSH_(8\.3p1) (Ubuntu-1\S*)$">
1140
+ <description>OpenSSH running on Ubuntu 20.10</description>
1141
+ <example service.version="8.3p1" openssh.comment="Ubuntu-1">OpenSSH_8.3p1 Ubuntu-1</example>
1142
+ <param pos="1" name="service.version"/>
1143
+ <param pos="2" name="openssh.comment"/>
1144
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1145
+ <param pos="0" name="service.family" value="OpenSSH"/>
1146
+ <param pos="0" name="service.product" value="OpenSSH"/>
1147
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1148
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
1149
+ <param pos="0" name="os.family" value="Linux"/>
1150
+ <param pos="0" name="os.product" value="Linux"/>
1151
+ <param pos="0" name="os.version" value="20.10"/>
1152
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:20.10"/>
1153
+ </fingerprint>
1154
+
1113
1155
  <fingerprint pattern="^OpenSSH_([^\s]+)\s+(Ubuntu-\d\d?)$">
1114
1156
  <description>OpenSSH running on Ubuntu (unknown release)</description>
1115
1157
  <example service.version="7.6p1" openssh.comment="Ubuntu-2">OpenSSH_7.6p1 Ubuntu-2</example>
@@ -1329,9 +1371,56 @@
1329
1371
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:9.0"/>
1330
1372
  </fingerprint>
1331
1373
 
1332
- <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10|Debian-\d\d?\+deb10u\d+)$">
1333
- <description>OpenSSH running on Debian 10.x (buster)</description>
1374
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10)$">
1375
+ <description>OpenSSH running on Debian 10.0 (buster)</description>
1334
1376
  <example service.version="7.9p1" openssh.comment="Debian-10">OpenSSH_7.9p1 Debian-10</example>
1377
+ <param pos="1" name="service.version"/>
1378
+ <param pos="2" name="openssh.comment"/>
1379
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1380
+ <param pos="0" name="service.family" value="OpenSSH"/>
1381
+ <param pos="0" name="service.product" value="OpenSSH"/>
1382
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1383
+ <param pos="0" name="os.vendor" value="Debian"/>
1384
+ <param pos="0" name="os.family" value="Linux"/>
1385
+ <param pos="0" name="os.product" value="Linux"/>
1386
+ <param pos="0" name="os.version" value="10.0"/>
1387
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.0"/>
1388
+ </fingerprint>
1389
+
1390
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10\+deb10u1)$">
1391
+ <description>OpenSSH running on Debian 10.1 (buster)</description>
1392
+ <example service.version="7.9p1" openssh.comment="Debian-10+deb10u1">OpenSSH_7.9p1 Debian-10+deb10u1</example>
1393
+ <param pos="1" name="service.version"/>
1394
+ <param pos="2" name="openssh.comment"/>
1395
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1396
+ <param pos="0" name="service.family" value="OpenSSH"/>
1397
+ <param pos="0" name="service.product" value="OpenSSH"/>
1398
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1399
+ <param pos="0" name="os.vendor" value="Debian"/>
1400
+ <param pos="0" name="os.family" value="Linux"/>
1401
+ <param pos="0" name="os.product" value="Linux"/>
1402
+ <param pos="0" name="os.version" value="10.1"/>
1403
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.1"/>
1404
+ </fingerprint>
1405
+
1406
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10\+deb10u2)$">
1407
+ <description>OpenSSH running on Debian 10.2 (buster)</description>
1408
+ <example service.version="7.9p1" openssh.comment="Debian-10+deb10u2">OpenSSH_7.9p1 Debian-10+deb10u2</example>
1409
+ <param pos="1" name="service.version"/>
1410
+ <param pos="2" name="openssh.comment"/>
1411
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1412
+ <param pos="0" name="service.family" value="OpenSSH"/>
1413
+ <param pos="0" name="service.product" value="OpenSSH"/>
1414
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1415
+ <param pos="0" name="os.vendor" value="Debian"/>
1416
+ <param pos="0" name="os.family" value="Linux"/>
1417
+ <param pos="0" name="os.product" value="Linux"/>
1418
+ <param pos="0" name="os.version" value="10.2"/>
1419
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.2"/>
1420
+ </fingerprint>
1421
+
1422
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10\S+)$">
1423
+ <description>OpenSSH running on Debian 10.x (buster catchall)</description>
1335
1424
  <example service.version="7.9p1" openssh.comment="Debian-10+deb10u6">OpenSSH_7.9p1 Debian-10+deb10u6</example>
1336
1425
  <param pos="1" name="service.version"/>
1337
1426
  <param pos="2" name="openssh.comment"/>
@@ -1615,7 +1704,7 @@
1615
1704
  <param pos="0" name="service.product" value="SSH"/>
1616
1705
  <param pos="0" name="os.vendor" value="Cisco"/>
1617
1706
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
1618
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
1707
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
1619
1708
  </fingerprint>
1620
1709
 
1621
1710
  <fingerprint pattern="(?i)^Cleo (\S+)/(\S+) SSH FTP server$">
@@ -1695,7 +1784,7 @@
1695
1784
  <param pos="1" name="os.version"/>
1696
1785
  </fingerprint>
1697
1786
 
1698
- <fingerprint pattern="^([\d.]+)[ _]sshlib:? (?i:GlobalScape)$">
1787
+ <fingerprint pattern="^([\d.]{1,8})[ _]sshlib:? (?i:GlobalScape)$">
1699
1788
  <description>GlobalScape SSH (which uses Bitvise sshlib)</description>
1700
1789
  <example service.component.version="1.36">1.36_sshlib GlobalSCAPE</example>
1701
1790
  <example service.component.version="1.82">1.82_sshlib Globalscape</example>
@@ -1713,7 +1802,7 @@
1713
1802
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1714
1803
  </fingerprint>
1715
1804
 
1716
- <fingerprint pattern="^([^\s]+) sshlib: WinSSHD (.*)$">
1805
+ <fingerprint pattern="^([\d.]{1,8}) sshlib: WinSSHD ([\w.-]*)$">
1717
1806
  <description>Bitvise WinSSHD (which uses Bitvise sshlib)</description>
1718
1807
  <example service.component.version="1.78" service.version="4.15a">1.78 sshlib: WinSSHD 4.15a</example>
1719
1808
  <param pos="1" name="service.component.version"/>
@@ -1730,7 +1819,7 @@
1730
1819
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1731
1820
  </fingerprint>
1732
1821
 
1733
- <fingerprint pattern="^([^\s]+) FlowSsh: (?:Bitvise SSH Server \(WinSSHD\)|WinSSHD) ([\d\.]+):?.*$">
1822
+ <fingerprint pattern="^([\d.]{1,8}) FlowSsh: (?:Bitvise SSH Server \(WinSSHD\)|WinSSHD) ([\d\.]+):?.*$">
1734
1823
  <description>Bitvise WinSSHD (which uses Bitvise flowssh) with version</description>
1735
1824
  <example service.version="5.09" service.component.version="1.03">1.03 FlowSsh: WinSSHD 5.09</example>
1736
1825
  <example service.version="5.20" service.component.version="1.07">1.07 FlowSsh: WinSSHD 5.20: free only for personal non-commercial use</example>
@@ -1749,7 +1838,7 @@
1749
1838
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1750
1839
  </fingerprint>
1751
1840
 
1752
- <fingerprint pattern="^([^\s]+) FlowSsh: (?:Bitvise SSH Server \(WinSSHD\)|WinSSHD)(?: :.*)?$">
1841
+ <fingerprint pattern="^([\d.]{1,8}) FlowSsh: (?:Bitvise SSH Server \(WinSSHD\)|WinSSHD)(?: :.*)?$">
1753
1842
  <description>Bitvise WinSSHD (which uses Bitvise flowssh) without version</description>
1754
1843
  <example service.component.version="9.99">9.99 FlowSsh: Bitvise SSH Server (WinSSHD)</example>
1755
1844
  <example service.component.version="9.99">9.99 FlowSsh: Bitvise SSH Server (WinSSHD) : free only for personal non-commercial use</example>
@@ -1766,7 +1855,7 @@
1766
1855
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1767
1856
  </fingerprint>
1768
1857
 
1769
- <fingerprint pattern="^([^\s]+) sshlib: MOVEit DMZ SSH (.*)$">
1858
+ <fingerprint pattern="^([\d.]{1,8}) sshlib: MOVEit DMZ SSH (.*)$">
1770
1859
  <description>MOVEit DMZ (which uses Bitvise sshlib)</description>
1771
1860
  <param pos="1" name="service.component.version"/>
1772
1861
  <param pos="2" name="service.version"/>
@@ -1776,6 +1865,7 @@
1776
1865
  <param pos="0" name="service.vendor" value="Standard Networks"/>
1777
1866
  <param pos="0" name="service.family" value="MOVEit DMZ"/>
1778
1867
  <param pos="0" name="service.product" value="MOVEit DMZ"/>
1868
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:moveit_dmz:{service.version}"/>
1779
1869
  <param pos="0" name="os.vendor" value="Microsoft"/>
1780
1870
  <param pos="0" name="os.family" value="Windows"/>
1781
1871
  <param pos="0" name="os.product" value="Windows"/>
@@ -1848,8 +1938,9 @@
1848
1938
  <param pos="0" name="service.cpe23" value="cpe:/a:vandyke:vshell:{service.version}"/>
1849
1939
  </fingerprint>
1850
1940
 
1851
- <fingerprint pattern="^([\s]*)\s*VShell$">
1941
+ <fingerprint pattern="^([\d.]{0,8})\s{1,8}VShell$">
1852
1942
  <description>VanDyke VShell</description>
1943
+ <example service.version="1.0.2">1.0.2 VShell</example>
1853
1944
  <param pos="1" name="service.version"/>
1854
1945
  <param pos="0" name="service.vendor" value="VanDyke Software"/>
1855
1946
  <param pos="0" name="service.family" value="VShell"/>
@@ -1864,10 +1955,11 @@
1864
1955
  <param pos="1" name="service.version"/>
1865
1956
  <param pos="0" name="service.vendor" value="Attachmate"/>
1866
1957
  <param pos="0" name="service.family" value="Reflection"/>
1867
- <param pos="0" name="service.product" value="Reflection"/>
1958
+ <param pos="0" name="service.product" value="Reflection for Secure IT"/>
1959
+ <param pos="0" name="service.cpe23" value="cpe:/a:attachmate:reflection_for_secure_it:{service.version}"/>
1868
1960
  </fingerprint>
1869
1961
 
1870
- <fingerprint pattern="^([^\s]*)\s*F-Secure SSH\s*(?:.*)$">
1962
+ <fingerprint pattern="^(\S{0,256})\s{0,256}F-Secure SSH ">
1871
1963
  <description>Attachmate Reflection (formerly F-Secure SSH)</description>
1872
1964
  <example service.version="3.2.3">3.2.3 F-Secure SSH Windows NT Server</example>
1873
1965
  <param pos="1" name="service.version"/>
@@ -1876,16 +1968,17 @@
1876
1968
  <param pos="0" name="service.product" value="Reflection"/>
1877
1969
  </fingerprint>
1878
1970
 
1879
- <fingerprint pattern="^([^\s]*)\s*SSH Tectia Server$">
1971
+ <fingerprint pattern="^(\S{0,256})\s{0,256}SSH Tectia Server$">
1880
1972
  <description>SSH Communications Security Tectia Server - branded</description>
1881
1973
  <example service.version="6.4.12.353">6.4.12.353 SSH Tectia Server</example>
1882
1974
  <param pos="1" name="service.version"/>
1883
1975
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
1884
1976
  <param pos="0" name="service.family" value="SSH Tectia Server"/>
1885
1977
  <param pos="0" name="service.product" value="SSH Tectia Server"/>
1978
+ <param pos="0" name="service.cpe23" value="cpe:/a:ssh:tectia_server:{service.version}"/>
1886
1979
  </fingerprint>
1887
1980
 
1888
- <fingerprint pattern="^([0-9\.]+) SSH Secure Shell(?: \(non-commercial\))?$">
1981
+ <fingerprint pattern="^([0-9\.]{1,8}) SSH Secure Shell(?: \(non-commercial\))?$">
1889
1982
  <description>SSH Communications Security Tectia Server</description>
1890
1983
  <example service.version="3.2.9.1">3.2.9.1 SSH Secure Shell (non-commercial)</example>
1891
1984
  <example service.version="4.0.3">4.0.3 SSH Secure Shell</example>
@@ -1894,9 +1987,10 @@
1894
1987
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
1895
1988
  <param pos="0" name="service.family" value="SSH Tectia Server"/>
1896
1989
  <param pos="0" name="service.product" value="SSH Tectia Server"/>
1990
+ <param pos="0" name="service.cpe23" value="cpe:/a:ssh:tectia_server:{service.version}"/>
1897
1991
  </fingerprint>
1898
1992
 
1899
- <fingerprint pattern="^([0-9\.]+) SSH Secure Shell Windows NT Server$">
1993
+ <fingerprint pattern="^([0-9\.]{1,8}) SSH Secure Shell Windows NT Server$">
1900
1994
  <description>Unknown Windows SSH server</description>
1901
1995
  <example service.version="4.0.3">4.0.3 SSH Secure Shell Windows NT Server</example>
1902
1996
  <param pos="0" name="os.vendor" value="Microsoft"/>
@@ -1907,6 +2001,7 @@
1907
2001
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
1908
2002
  <param pos="0" name="service.family" value="SSH Tectia Server"/>
1909
2003
  <param pos="0" name="service.product" value="SSH Tectia Server"/>
2004
+ <param pos="0" name="service.cpe23" value="cpe:/a:ssh:tectia_server:{service.version}"/>
1910
2005
  </fingerprint>
1911
2006
 
1912
2007
  <fingerprint pattern="^ARRIS_(.*)$">
@@ -1994,6 +2089,7 @@
1994
2089
  <param pos="0" name="service.vendor" value="Standard Networks"/>
1995
2090
  <param pos="0" name="service.family" value="MOVEit DMZ"/>
1996
2091
  <param pos="0" name="service.product" value="MOVEit DMZ"/>
2092
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:moveit_dmz:-"/>
1997
2093
  <param pos="0" name="os.vendor" value="Microsoft"/>
1998
2094
  <param pos="0" name="os.family" value="Windows"/>
1999
2095
  <param pos="0" name="os.product" value="Windows"/>
@@ -2019,7 +2115,12 @@
2019
2115
  <param pos="0" name="os.vendor" value="NetApp"/>
2020
2116
  <param pos="0" name="os.family" value="Data ONTAP"/>
2021
2117
  <param pos="0" name="os.product" value="Data ONTAP"/>
2118
+ <param pos="0" name="os.device" value="NAS"/>
2022
2119
  <param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:-"/>
2120
+ <param pos="0" name="hw.vendor" value="NetApp"/>
2121
+ <param pos="0" name="hw.family" value="Data ONTAP"/>
2122
+ <param pos="0" name="hw.product" value="Data ONTAP"/>
2123
+ <param pos="0" name="hw.device" value="NAS"/>
2023
2124
  </fingerprint>
2024
2125
 
2025
2126
  <fingerprint pattern="^(\d\.\d+\.\d+) SSH Secure Shell OpenVMS V\d+\.\d+$">
@@ -2057,7 +2158,7 @@
2057
2158
  <param pos="0" name="os.certainty" value="0.75"/>
2058
2159
  </fingerprint>
2059
2160
 
2060
- <fingerprint pattern="^\S+ SSH Secure Shell Tru64 UNIX$">
2161
+ <fingerprint pattern="^\S{1,16} SSH Secure Shell Tru64 UNIX$">
2061
2162
  <description>Digital/Compaq/HP Tru64 Unix</description>
2062
2163
  <example>3.2.0 SSH Secure Shell Tru64 UNIX</example>
2063
2164
  <param pos="0" name="os.vendor" value="HP"/>
@@ -2125,6 +2226,19 @@
2125
2226
  <param pos="0" name="service.product" value="WeOnlyDo SSH Server"/>
2126
2227
  </fingerprint>
2127
2228
 
2229
+ <fingerprint pattern="^Zyxel SSH server$">
2230
+ <description>Zyxel Firewall SSH service</description>
2231
+ <example>Zyxel SSH server</example>
2232
+ <param pos="0" name="service.vendor" value="Zyxel"/>
2233
+ <param pos="0" name="service.family" value="Zywall"/>
2234
+ <param pos="0" name="os.vendor" value="Zyxel"/>
2235
+ <param pos="0" name="os.product" value="ZyNOS firmware"/>
2236
+ <param pos="0" name="os.cpe23" value="cpe:/o:zyxel:zynos_firmware:-"/>
2237
+ <param pos="0" name="hw.vendor" value="Zyxel"/>
2238
+ <param pos="0" name="hw.device" value="Firewall"/>
2239
+ <param pos="0" name="hw.family" value="Unified Security Gateway"/>
2240
+ </fingerprint>
2241
+
2128
2242
  <!--
2129
2243
  1.2.22j4rad
2130
2244
  2.40
data/xml/telnet_banners.xml CHANGED
@@ -17,30 +17,45 @@
17
17
  Ruby, Python, Java, and Golang.
18
18
  -->
19
19
 
20
- <fingerprint pattern="\A(?i)(?:\r|\n)*login:\s*$">
20
+ <fingerprint pattern="(?i)\A(?:\r|\n)*login:\s*$">
21
21
  <description>bare 'login:' -- assert nothing.</description>
22
22
  <example>login:</example>
23
+ <param pos="0" name="hw.certainty" value="0.0"/>
24
+ <param pos="0" name="os.certainty" value="0.0"/>
25
+ <param pos="0" name="service.certainty" value="0.0"/>
23
26
  </fingerprint>
24
27
 
25
- <fingerprint pattern="\A(?i)(?:\r|\n)*User(?:name)?\s*:\s*$">
28
+ <fingerprint pattern="(?i)\A(?:\r|\n)*User(?:name)?\s*:\s*$">
26
29
  <description>bare 'Username:' -- assert nothing.</description>
27
30
  <example>Username:</example>
28
31
  <example>User:</example>
32
+ <param pos="0" name="hw.certainty" value="0.0"/>
33
+ <param pos="0" name="os.certainty" value="0.0"/>
34
+ <param pos="0" name="service.certainty" value="0.0"/>
29
35
  </fingerprint>
30
36
 
31
- <fingerprint pattern="\A(?i)(?:\r|\n)*Password:\s*$">
37
+ <fingerprint pattern="(?i)\A(?:\r|\n)*Password:\s*$">
32
38
  <description>bare 'Password:' -- assert nothing.</description>
33
39
  <example>Password:</example>
40
+ <param pos="0" name="hw.certainty" value="0.0"/>
41
+ <param pos="0" name="os.certainty" value="0.0"/>
42
+ <param pos="0" name="service.certainty" value="0.0"/>
34
43
  </fingerprint>
35
44
 
36
- <fingerprint pattern="\A(?i)(?:\r|\n)*Account:\s*$">
45
+ <fingerprint pattern="(?i)\A(?:\r|\n)*Account:\s*$">
37
46
  <description>bare 'Account:' -- assert nothing.</description>
38
47
  <example>Account:</example>
48
+ <param pos="0" name="hw.certainty" value="0.0"/>
49
+ <param pos="0" name="os.certainty" value="0.0"/>
50
+ <param pos="0" name="service.certainty" value="0.0"/>
39
51
  </fingerprint>
40
52
 
41
- <fingerprint pattern="\A(?i)Connection refused(?:\r|\n)*$">
53
+ <fingerprint pattern="(?i)\AConnection refused(?:\r|\n)*$">
42
54
  <description>bare 'Connection refused' -- assert nothing.</description>
43
55
  <example>Connection refused</example>
56
+ <param pos="0" name="hw.certainty" value="0.0"/>
57
+ <param pos="0" name="os.certainty" value="0.0"/>
58
+ <param pos="0" name="service.certainty" value="0.0"/>
44
59
  </fingerprint>
45
60
 
46
61
  <!-- end of assert nothing block -->
@@ -424,7 +439,7 @@
424
439
  <param pos="4" name="host.name"/>
425
440
  </fingerprint>
426
441
 
427
- <fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)/([\w]+) ALCATEL (SR [\S]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
442
+ <fingerprint pattern="(?m)^TiMOS-[CB]-([\S]+) (?:both|cpm)/([\w]+) ALCATEL (SR [\S]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
428
443
  <description>ALCATEL Service Router running TiMOS</description>
429
444
  <!-- TiMOS-C-12.0.R12 cpm/hops64 ALCATEL SR 7750 Copyright (c) 2000-2015 Alcatel-Lucent.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
430
445
 
@@ -446,7 +461,7 @@
446
461
 
447
462
  <!-- Nokia purchased Alcatel Lucent, finalized in Nov 2016 -->
448
463
 
449
- <fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia ([\S]+ [SRX]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
464
+ <fingerprint pattern="(?m)^TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia ([\S]+ [SRX]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
450
465
  <description>Nokia Service Router running TiMOS</description>
451
466
  <!-- TiMOS-C-14.0.R5 cpm/hops64 Nokia 7750 SR Copyright (c) 2000-2016 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
452
467
 
@@ -473,7 +488,7 @@
473
488
  <param pos="3" name="hw.product"/>
474
489
  </fingerprint>
475
490
 
476
- <fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia (SAS[+\w\s-]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
491
+ <fingerprint pattern="(?m)^TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia (SAS[+\w\s-]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
477
492
  <description>Nokia Service Access Switch running TiMOS</description>
478
493
  <!-- TiMOS-B-8.0.R12 both/hops Nokia SAS-Mxp 22F2C 4SFP+ 7210 Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
479
494
 
@@ -540,7 +555,7 @@
540
555
  <param pos="1" name="hw.product"/>
541
556
  </fingerprint>
542
557
 
543
- <fingerprint pattern="^(?:\r|\n|\s)*Grandstream (GXV[\w-]+)\s+(?:V\d\.\d\w?\s+)?Shell Command.Copyight \d\d\d\d-\d\d\d\d(?:\r|\n)+Username:\s*$">
558
+ <fingerprint pattern="^(?:\r|\n|\s){0,256}Grandstream (GXV[\w-]+)\s+(?:V\d\.\d\w?\s+)?Shell Command.Copyight \d\d\d\d-\d\d\d\d(?:\r|\n)+Username:\s*$">
544
559
  <description>Grandstream IP Cameras</description>
545
560
  <!-- Grandstream GXV3674_FHD_VF Shell Command.Copyight 2011-2014\r\nUsername: -->
546
561
 
@@ -578,7 +593,7 @@
578
593
  <description>Polycom Video Conferencing - VSX Family</description>
579
594
  <!-- Hi, my name is : Something Pity\r\nHere is what I know about myself:\r\nModel: VSX 6000A\r\nSerial Number: 00070906FC34F6\r\nSoftware Version: Release 9.0.6.2-103 - 04Sep2011 21:27\r\nBuild Information: ecomman -->
580
595
 
581
- <example _encoding="base64" hw.product="6000A" host.id="00070906FC34F6" os.version="9.0.6.2-103">
596
+ <example _encoding="base64" hw.product="6000A" hw.serial_number="00070906FC34F6" os.version="9.0.6.2-103">
582
597
  SGksIG15IG5hbWUgaXMgOiAgICAgU29tZXRoaW5nIFBpdHkNCkhlcmUgaXMgd2hhdCBJIGtub
583
598
  3cgYWJvdXQgbXlzZWxmOg0KTW9kZWw6ICAgICAgICAgICAgICAgVlNYIDYwMDBBDQpTZXJpYW
584
599
  wgTnVtYmVyOiAgICAgICAwMDA3MDkwNkZDMzRGNg0KU29mdHdhcmUgVmVyc2lvbjogICAgUmV
@@ -589,7 +604,7 @@
589
604
  <param pos="0" name="hw.family" value="VSX"/>
590
605
  <param pos="0" name="hw.device" value="Video Conferencing"/>
591
606
  <param pos="1" name="hw.product"/>
592
- <param pos="2" name="host.id"/>
607
+ <param pos="2" name="hw.serial_number"/>
593
608
  <param pos="3" name="os.version"/>
594
609
  </fingerprint>
595
610
 
@@ -721,13 +736,13 @@
721
736
  <param pos="0" name="hw.device" value="Router"/>
722
737
  </fingerprint>
723
738
 
724
- <fingerprint pattern="^(?m)(?:\r|\n)*Catalyst 1900 Management Console(?:\r|\n)+.*Ethernet Address:\s+([\w-]+)(?:\r|\n)+.*Model Number:\s+([\w-]+)(?:\r|\n)+System Serial Number:\s+(\w+)(?:\r|\n)+Power Supply" flags="REG_MULTILINE">
739
+ <fingerprint pattern="(?m)^(?:\r|\n)*Catalyst 1900 Management Console(?:\r|\n)+.*Ethernet Address:\s+([\w-]+)(?:\r|\n)+.*Model Number:\s+([\w-]+)(?:\r|\n)+System Serial Number:\s+(\w+)(?:\r|\n)+Power Supply" flags="REG_MULTILINE">
725
740
  <description>Cisco Catalyst 1900</description>
726
741
  <!-- Catalyst 1900, unlike other Catalyst models, didn't run CatOS or IOS -->
727
742
 
728
743
  <!-- Catalyst 1900 Management Console\r\nCopyright (c) Cisco Systems, Inc. 1993-1998\r\nAll rights reserved.\r\nEnterprise Edition Software\r\nEthernet Address: 00-AA-19-38-AA-00\r\n\r\nPCA Number: 73-31AA-AA\r\nPCA Serial Number: FAB033AAAAA\r\nModel Number: WS-C1924-EN\r\nSystem Serial Number: FAB0341AAAA\r\nPower Supply S/N: -->
729
744
 
730
- <example _encoding="base64" host.mac="00-AA-19-38-AA-00" hw.model="WS-C1924-EN" host.id="FAB0341AAAA">
745
+ <example _encoding="base64" host.mac="00-AA-19-38-AA-00" hw.model="WS-C1924-EN" hw.serial_number="FAB0341AAAA">
731
746
  Q2F0YWx5c3QgMTkwMCBNYW5hZ2VtZW50IENvbnNvbGUNCkNvcHlyaWdodCAoYykgQ2lzY28gU
732
747
  3lzdGVtcywgSW5jLiAgMTk5My0xOTk4DQpBbGwgcmlnaHRzIHJlc2VydmVkLg0KRW50ZXJwcm
733
748
  lzZSBFZGl0aW9uIFNvZnR3YXJlDQpFdGhlcm5ldCBBZGRyZXNzOiAgICAgIDAwLUFBLTE5LTM
@@ -744,7 +759,7 @@
744
759
  <param pos="0" name="hw.device" value="Switch"/>
745
760
  <param pos="1" name="host.mac"/>
746
761
  <param pos="2" name="hw.model"/>
747
- <param pos="3" name="host.id"/>
762
+ <param pos="3" name="hw.serial_number"/>
748
763
  </fingerprint>
749
764
 
750
765
  <fingerprint pattern="^192.0.0.64 login:\s*$">
@@ -855,7 +870,7 @@
855
870
  <param pos="1" name="hw.product"/>
856
871
  </fingerprint>
857
872
 
858
- <fingerprint pattern="^(?m)(BCM\d+) Broadband Router\r\n.*Please input the verification code:$" flags="REG_MULTILINE">
873
+ <fingerprint pattern="(?m)^(BCM\d+) Broadband Router\r\n.*Please input the verification code:$" flags="REG_MULTILINE">
859
874
  <description>OEM'd Broadcom Router - input validation code</description>
860
875
  <!-- BCM96318 Broadband Router\r\n====================================================\r\n * * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * * * * \r\n====================================================\r\nPlease input the verification code: -->
861
876
 
@@ -919,7 +934,7 @@
919
934
  <description>Moxa NPort Device Server - IA Series</description>
920
935
  <!-- Model name : NPort IA-5250\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 281\r\u0000\nFirmware version : 1.6 Build 17060616\r\u0000\nSystem uptime : 31 days, 06h:03m:45s\r\u0000\n\r\u0000\nPlease keyin your password: -->
921
936
 
922
- <example _encoding="base64" hw.product="IA-5250" host.mac="00:90:E8:AA:AA:AA" host.id="281" os.version="1.6" os.version.version="17060616">
937
+ <example _encoding="base64" hw.product="IA-5250" host.mac="00:90:E8:AA:AA:AA" hw.serial_number="281" os.version="1.6" os.version.version="17060616">
923
938
  TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IElBLTUyNTANAApNQUMgYWRkcmVzcyAgICAgIDogM
924
939
  DA6OTA6RTg6QUE6QUE6QUENAApTZXJpYWwgTm8uICAgICAgIDogMjgxDQAKRmlybXdhcmUgdm
925
940
  Vyc2lvbiA6IDEuNiBCdWlsZCAxNzA2MDYxNg0AClN5c3RlbSB1cHRpbWUgICAgOiAzMSBkYXl
@@ -930,7 +945,7 @@
930
945
  <param pos="0" name="hw.device" value="Device Server"/>
931
946
  <param pos="1" name="hw.product"/>
932
947
  <param pos="2" name="host.mac"/>
933
- <param pos="3" name="host.id"/>
948
+ <param pos="3" name="hw.serial_number"/>
934
949
  <param pos="0" name="os.vendor" value="Moxa"/>
935
950
  <param pos="4" name="os.version"/>
936
951
  <param pos="5" name="os.version.version"/>
@@ -942,7 +957,7 @@
942
957
 
943
958
  <!-- Model name : NPort 5610-8-DT\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9522\r\u0000\nFirmware version : 2.2 Build 11090613\r\u0000\nSystem uptime : 8 days, 02h:11m:44s\r\u0000\n\r\u0000\nPlease keyin your password: -->
944
959
 
945
- <example _encoding="base64" hw.product="5610-8-DT" host.mac="00:90:E8:AA:AA:AA" host.id="9522" os.version="2.2" os.version.version="11090613">
960
+ <example _encoding="base64" hw.product="5610-8-DT" host.mac="00:90:E8:AA:AA:AA" hw.serial_number="9522" os.version="2.2" os.version.version="11090613">
946
961
  TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IDU2MTAtOC1EVA0ACk1BQyBhZGRyZXNzICAgICAgO
947
962
  iAwMDo5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NTIyDQAKRmlybXdhcm
948
963
  UgdmVyc2lvbiA6IDIuMiBCdWlsZCAxMTA5MDYxMw0AClN5c3RlbSB1cHRpbWUgICAgOiA4IGR
@@ -953,7 +968,7 @@
953
968
  <param pos="0" name="hw.device" value="Device Server"/>
954
969
  <param pos="1" name="hw.product"/>
955
970
  <param pos="2" name="host.mac"/>
956
- <param pos="3" name="host.id"/>
971
+ <param pos="3" name="hw.serial_number"/>
957
972
  <param pos="0" name="os.vendor" value="Moxa"/>
958
973
  <param pos="4" name="os.version"/>
959
974
  <param pos="5" name="os.version.version"/>
@@ -976,7 +991,7 @@
976
991
  <description>Moxa MGate Modbus Gateway</description>
977
992
  <!-- Model name : MGate MB3180\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9474\r\u0000\nFirmware version : 1.2 Build 09101913\r\u0000\nSystem uptime : 15 days, 16h:37m:48s\r\u0000\n\r\u0000\nPlease keyin your password: -->
978
993
 
979
- <example _encoding="base64" hw.product="MB3180" host.mac="00:90:E8:AA:AA:AA" host.id="9474" os.version="1.2" os.version.version="09101913">
994
+ <example _encoding="base64" hw.product="MB3180" host.mac="00:90:E8:AA:AA:AA" hw.serial_number="9474" os.version="1.2" os.version.version="09101913">
980
995
  TW9kZWwgbmFtZSAgICAgICA6IE1HYXRlIE1CMzE4MA0ACk1BQyBhZGRyZXNzICAgICAgOiAwM
981
996
  Do5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NDc0DQAKRmlybXdhcmUgdm
982
997
  Vyc2lvbiA6IDEuMiBCdWlsZCAwOTEwMTkxMw0AClN5c3RlbSB1cHRpbWUgICAgOiAxNSBkYXl
@@ -987,7 +1002,7 @@
987
1002
  <param pos="0" name="hw.device" value="Industrial Control"/>
988
1003
  <param pos="1" name="hw.product"/>
989
1004
  <param pos="2" name="host.mac"/>
990
- <param pos="3" name="host.id"/>
1005
+ <param pos="3" name="hw.serial_number"/>
991
1006
  <param pos="0" name="os.vendor" value="Moxa"/>
992
1007
  <param pos="4" name="os.version"/>
993
1008
  <param pos="5" name="os.version.version"/>
@@ -997,14 +1012,14 @@
997
1012
  <description>Moxa NE Series Embedded device server</description>
998
1013
  <!-- Model name : NE-4110S\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No : 3616\r\u0000\nFirmware version : 4.1 Build 07061517\r\u0000\n\r\u0000\nPlease keyin your password: -->
999
1014
 
1000
- <example _encoding="base64" hw.product="NE-4110S" host.mac="00:90:E8:AA:AA:AA" host.id="3616" os.version="4.1" os.version.version="07061517">
1015
+ <example _encoding="base64" hw.product="NE-4110S" host.mac="00:90:E8:AA:AA:AA" hw.serial_number="3616" os.version="4.1" os.version.version="07061517">
1001
1016
  TW9kZWwgbmFtZSAgICAgICA6IE5FLTQxMTBTDQAKTUFDIGFkZHJlc3MgICAgICA6IDAwOjkwO
1002
1017
  kU4OkFBOkFBOkFBDQAKU2VyaWFsIE5vICAgICAgICA6IDM2MTYNAApGaXJtd2FyZSB2ZXJzaW
1003
1018
  9uIDogNC4xIEJ1aWxkIDA3MDYxNTE3DQAKDQAKUGxlYXNlIGtleWluIHlvdXIgcGFzc3dvcmQ6
1004
1019
  </example>
1005
1020
  <!-- Model name : NE-4110S\r\nMAC address : 00:90:E8:AA:AA:AA\r\nSerial No : 000\r\nFirmware version : 1.5.2\r\n\r\nPlease keyin your password: -->
1006
1021
 
1007
- <example _encoding="base64" hw.product="NE-4110S" host.mac="00:90:E8:AA:AA:AA" host.id="000" os.version="1.5.2">
1022
+ <example _encoding="base64" hw.product="NE-4110S" host.mac="00:90:E8:AA:AA:AA" hw.serial_number="000" os.version="1.5.2">
1008
1023
  TW9kZWwgbmFtZSAgICAgICA6IE5FLTQxMTBTDQpNQUMgYWRkcmVzcyAgICAgIDogMDA6OTA6RTg6QUE6QUE6QUENClNlcmlhbCBObyAgICAgICAgOiAwMDANCkZpcm13YXJlIHZlcnNpb24gOiAxLjUuMg0KDQpQbGVhc2Uga2V5aW4geW91ciBwYXNzd29yZDoK
1009
1024
  </example>
1010
1025
  <param pos="0" name="hw.vendor" value="Moxa"/>
@@ -1012,17 +1027,17 @@
1012
1027
  <param pos="0" name="hw.device" value="Device Server"/>
1013
1028
  <param pos="1" name="hw.product"/>
1014
1029
  <param pos="2" name="host.mac"/>
1015
- <param pos="3" name="host.id"/>
1030
+ <param pos="3" name="hw.serial_number"/>
1016
1031
  <param pos="0" name="os.vendor" value="Moxa"/>
1017
1032
  <param pos="4" name="os.version"/>
1018
1033
  <param pos="5" name="os.version.version"/>
1019
1034
  </fingerprint>
1020
1035
 
1021
- <fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:-_\&amp;]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
1036
+ <fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:\&amp;-]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
1022
1037
  <description>Moxa MiiNePort Series Embedded device server</description>
1023
1038
  <!-- Model name : MiiNePort E2\r\nSerial No. : 9999\r\nDevice name : MiiNePort_E2_4064\r\nFirmware version : 1.3.36 Build 15031615\r\nEthernet MAC address: 00:90:E8:5A:92:FF\r\n\r\nPlease keyin your password: -->
1024
1039
 
1025
- <example _encoding="base64" hw.product="MiiNePort E2" host.mac="00:90:E8:5A:92:FF" host.id="9999" os.version="1.3.36" os.version.version="15031615">
1040
+ <example _encoding="base64" hw.product="MiiNePort E2" host.mac="00:90:E8:5A:92:FF" hw.serial_number="9999" os.version="1.3.36" os.version.version="15031615">
1026
1041
  TW9kZWwgbmFtZSAgICAgICAgICA6IE1paU5lUG9ydCBFMg0KU2VyaWFsIE5vLiAgICAgICAgI
1027
1042
  CA6IDk5OTkNCkRldmljZSBuYW1lICAgICAgICAgOiBNaWlOZVBvcnRfRTJfNDA2NA0KRmlybX
1028
1043
  dhcmUgdmVyc2lvbiAgICA6IDEuMy4zNiBCdWlsZCAxNTAzMTYxNQ0KRXRoZXJuZXQgTUFDIGF
@@ -1033,7 +1048,7 @@
1033
1048
  <param pos="0" name="hw.family" value="MiiNePort"/>
1034
1049
  <param pos="0" name="hw.device" value="Device Server"/>
1035
1050
  <param pos="1" name="hw.product"/>
1036
- <param pos="2" name="host.id"/>
1051
+ <param pos="2" name="hw.serial_number"/>
1037
1052
  <param pos="0" name="os.vendor" value="Moxa"/>
1038
1053
  <param pos="3" name="os.version"/>
1039
1054
  <param pos="4" name="os.version.version"/>
@@ -1084,7 +1099,7 @@
1084
1099
  <param pos="1" name="os.version"/>
1085
1100
  </fingerprint>
1086
1101
 
1087
- <fingerprint pattern="^(?m)Red Hat Enterprise Linux ES release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
1102
+ <fingerprint pattern="(?m)^Red Hat Enterprise Linux ES release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
1088
1103
  <description>RedHat Enterprise Linux ES</description>
1089
1104
  <!-- Red Hat Enterprise Linux ES release 3 (Taroon Update 9\nKernel 2.4.21-47.EL on an x86_64\nlogin: -->
1090
1105
 
@@ -1101,7 +1116,7 @@
1101
1116
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:{os.version}"/>
1102
1117
  </fingerprint>
1103
1118
 
1104
- <fingerprint pattern="^(?m)Red Hat Enterprise Linux AS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
1119
+ <fingerprint pattern="(?m)^Red Hat Enterprise Linux AS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
1105
1120
  <description>RedHat Enterprise Linux AS</description>
1106
1121
  <!-- Red Hat Enterprise Linux AS release 5.8 (Tikanga)\nKernel 2.6.18-308.11.1.el5 on an x86_64\nlogin: -->
1107
1122
 
@@ -1117,7 +1132,7 @@
1117
1132
  <param pos="3" name="os.arch"/>
1118
1133
  </fingerprint>
1119
1134
 
1120
- <fingerprint pattern="^(?m)Red Hat Enterprise Linux WS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*)" flags="REG_MULTILINE">
1135
+ <fingerprint pattern="(?m)^Red Hat Enterprise Linux WS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*)" flags="REG_MULTILINE">
1121
1136
  <description>RedHat Enterprise Linux WS</description>
1122
1137
  <!--Red Hat Enterprise Linux WS release 2.1 (Tampa) \nKernel 2.4.9-e.40smp on an i686 \nlogin: -->
1123
1138
 
@@ -1133,7 +1148,7 @@
1133
1148
  <param pos="3" name="os.arch"/>
1134
1149
  </fingerprint>
1135
1150
 
1136
- <fingerprint pattern="^(?m)Fedora Core.release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d).*$" flags="REG_MULTILINE">
1151
+ <fingerprint pattern="(?m)^Fedora Core.release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d).*$" flags="REG_MULTILINE">
1137
1152
  <description>Fedora Core Release</description>
1138
1153
  <!-- Fedora Core release 1 (Yarrow)\nKernel 2.4.20-13.9ensim-3.5.0-13 on an i686\nlogin:-->
1139
1154
 
@@ -1149,7 +1164,7 @@
1149
1164
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora:{os.version}"/>
1150
1165
  </fingerprint>
1151
1166
 
1152
- <fingerprint pattern="^(?m)Welcome to SuSE Linux (.*) \(([^\)]+)\) - Kernel (.*) .*">
1167
+ <fingerprint pattern="(?m)^Welcome to SuSE Linux (.*) \(([^\)]+)\) - Kernel (.*) .*">
1153
1168
  <description>SuSE Linux</description>
1154
1169
  <!-- Welcome to SuSE Linux 7.0 (i386) - Kernel 2.2.16-RAID (0). 2VG029037\n\nlogin: -->
1155
1170
 
@@ -1222,7 +1237,7 @@
1222
1237
  <param pos="0" name="os.product" value="Brother Printer"/>
1223
1238
  </fingerprint>
1224
1239
 
1225
- <fingerprint pattern="^(.*) Copyright by ARESCOM">
1240
+ <fingerprint pattern="^\s{0,256}(\S{1,64}) Copyright by ARESCOM">
1226
1241
  <description>Arescom System</description>
1227
1242
  <!--NDS1260HE-TLI Copyright by ARESCOM 2002\n\n\nPassword: -->
1228
1243
 
@@ -1232,10 +1247,13 @@
1232
1247
  <param pos="0" name="os.vendor" value="Arescom"/>
1233
1248
  <param pos="0" name="os.device" value="WAP"/>
1234
1249
  <param pos="1" name="os.model"/>
1250
+ <param pos="0" name="hw.vendor" value="Arescom"/>
1251
+ <param pos="0" name="hw.device" value="WAP"/>
1252
+ <param pos="1" name="hw.model"/>
1235
1253
  </fingerprint>
1236
1254
 
1237
1255
  <fingerprint pattern="^Welcome to ViewStation">
1238
- <description>Polycom ViewStation Video Vonference System</description>
1256
+ <description>Polycom ViewStation Video Conference System</description>
1239
1257
  <!-- Welcome to ViewStation\nPassword: -->
1240
1258
 
1241
1259
  <example _encoding="base64">
@@ -1451,7 +1469,7 @@
1451
1469
  <param pos="1" name="host.name"/>
1452
1470
  </fingerprint>
1453
1471
 
1454
- <fingerprint pattern="^(?m)Compaq Tru64 UNIX V(.*) \(Rev. (.*\d)\) .*">
1472
+ <fingerprint pattern="(?m)^Compaq Tru64 UNIX V(.*) \(Rev. (.*\d)\) .*">
1455
1473
  <description>Compaq Tru64 UNIX V</description>
1456
1474
  <!-- Compaq Tru64 UNIX V5.1B (Rev. 2650) (docalpha) (pts/11)\n\n\n\n\nlogin: -->
1457
1475
 
@@ -1492,7 +1510,12 @@
1492
1510
  <param pos="0" name="os.vendor" value="NetApp"/>
1493
1511
  <param pos="0" name="os.family" value="Data ONTAP"/>
1494
1512
  <param pos="0" name="os.product" value="Data ONTAP"/>
1513
+ <param pos="0" name="os.device" value="NAS"/>
1495
1514
  <param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:-"/>
1515
+ <param pos="0" name="hw.vendor" value="NetApp"/>
1516
+ <param pos="0" name="hw.family" value="Data ONTAP"/>
1517
+ <param pos="0" name="hw.product" value="Data ONTAP"/>
1518
+ <param pos="0" name="hw.device" value="NAS"/>
1496
1519
  </fingerprint>
1497
1520
 
1498
1521
  <fingerprint pattern="OpenVMS.*Version\sV([^\s]+).*">
@@ -1509,7 +1532,7 @@
1509
1532
  <param pos="1" name="os.version"/>
1510
1533
  </fingerprint>
1511
1534
 
1512
- <fingerprint pattern="^(?m)SCO OpenServer\(TM\) Release ([^ ]+).*$">
1535
+ <fingerprint pattern="(?m)^SCO OpenServer\(TM\) Release ([^ ]+).*$">
1513
1536
  <description>SCO OpenServer</description>
1514
1537
  <!-- SCO OpenServer(TM) Release 5 (bomdia.co.za) (ttyp6)\nlogin: -->
1515
1538
 
@@ -1715,7 +1738,7 @@
1715
1738
  <param pos="1" name="os.product"/>
1716
1739
  </fingerprint>
1717
1740
 
1718
- <fingerprint pattern="^(?m).*ConnectUPS">
1741
+ <fingerprint pattern="(?m)^.*ConnectUPS">
1719
1742
  <description>PowerWare ConnectUPS</description>
1720
1743
  <!-- +============================================================================+\n| [ ConnectUPS Web/SNMP
1721
1744
  Card Configuration Utility ] |\n+============================================================================+\n
@@ -1792,13 +1815,13 @@
1792
1815
  <param pos="2" name="os.version"/>
1793
1816
  </fingerprint>
1794
1817
 
1795
- <fingerprint pattern="^(?m).*Welcome to MELCO Print Server.*Server Name *: *([^ ]*)\W.*Server Model *: *([^ ]*).*F \/ W Version *: *([^ ]*).*MAC Address *: *(.. .. .. .. .. ..).*$">
1818
+ <fingerprint pattern="(?m)^.*Welcome to MELCO Print Server.*Server Name *: *([^ ]*)\W.*Server Model *: *([^ ]*).*F \/ W Version *: *([^ ]*).*MAC Address *: *(.. .. .. .. .. ..).*$">
1796
1819
  <description>System is a Buffalo/MELCO Embedded Print Server</description>
1797
1820
  <!-- ***********************************\n* Welcome to MELCO Print Server *\n* Telnet Console *\n***********************************
1798
1821
  \n \nServer Name: PS-B04E8E\nServer Model: LPV 2 - TX 1\nF / W Version: 2.00 J \nMAC Address: AE 32 EA 21 BB E3\n
1799
1822
  Uptime: 0 days, 00: 00: 12\n \nPlease Enter Password:"-->
1800
1823
 
1801
- <example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" os.model="LPV" os.address="AE 32 EA 21 BB E3">
1824
+ <example _encoding="base64" os.version="2.00" host.name="PS-B04E8E" hw.model="LPV" host.mac="AE 32 EA 21 BB E3">
1802
1825
  KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiogV2VsY29tZSB0byBNRUxDTyBQc
1803
1826
  mludCBTZXJ2ZXIgKlxuKiBUZWxuZXQgQ29uc29sZSAqXG4qKioqKioqKioqKioqKioqKioqKioqKi
1804
1827
  oqKioqKioqKioqKlxuIFxuU2VydmVyIE5hbWU6IFBTLUIwNEU4RVxuU2VydmVyIE1vZGVsOiBMUFY
@@ -1808,14 +1831,16 @@
1808
1831
  </example>
1809
1832
  <param pos="0" name="os.vendor" value="Buffalo"/>
1810
1833
  <param pos="0" name="os.family" value="PrintServer"/>
1811
- <param pos="0" name="os.device" value="Printer"/>
1812
- <param pos="1" name="host.id"/>
1813
- <param pos="2" name="os.model"/>
1834
+ <param pos="0" name="os.device" value="Print Server"/>
1835
+ <param pos="1" name="host.name"/>
1836
+ <param pos="0" name="hw.vendor" value="Buffalo"/>
1837
+ <param pos="0" name="hw.device" value="Print Server"/>
1838
+ <param pos="2" name="hw.model"/>
1814
1839
  <param pos="3" name="os.version"/>
1815
- <param pos="4" name="os.address"/>
1840
+ <param pos="4" name="host.mac"/>
1816
1841
  </fingerprint>
1817
1842
 
1818
- <fingerprint pattern="^(?m)AIX Version\W(\d).*">
1843
+ <fingerprint pattern="(?m)^AIX Version\W(\d).*">
1819
1844
  <description>System is IBM AIX v</description>
1820
1845
  <!-- AIX Version 6\nCopyright IBM Corporation, 1982, 2007.\nlogin: -->
1821
1846
 
@@ -1829,7 +1854,7 @@
1829
1854
  <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1830
1855
  </fingerprint>
1831
1856
 
1832
- <fingerprint pattern="^(?m)CIMC Debug Firmware Utility Shell\W([^\s]+).*">
1857
+ <fingerprint pattern="(?m)^CIMC Debug Firmware Utility Shell\W([^\s]+).*">
1833
1858
  <description>System is Cisco UCS Device</description>
1834
1859
  <!-- CIMC Debug Firmware Utility Shell\nfake-ucs-device-3-1-p login: -->
1835
1860
 
@@ -1843,7 +1868,7 @@
1843
1868
  <param pos="1" name="host.name"/>
1844
1869
  </fingerprint>
1845
1870
 
1846
- <fingerprint pattern="^(?m)HP ProLiant.*v(\d+.\d+)">
1871
+ <fingerprint pattern="(?m)^HP ProLiant.*v(\d+.\d+)">
1847
1872
  <description>Sytem is HP ProLiant server</description>
1848
1873
  <!-- HP ProLiant BL e-Class Integrated Administrator v2.00
1849
1874
  Copyright 2005 Hewlett-Packard Development Group, L.P.
@@ -1870,7 +1895,7 @@
1870
1895
  <param pos="1" name="os.version"/>
1871
1896
  </fingerprint>
1872
1897
 
1873
- <fingerprint pattern="^Power Measurement Ltd. Meter ION ([[:alnum:]]+)">
1898
+ <fingerprint pattern="^Power Measurement Ltd. Meter ION ([a-zA-Z0-9]+)">
1874
1899
  <!-- Power Measurement Ltd. Meter ION 7330V271 ETH ETH7330V272
1875
1900
  Serial#: PB-0204A058-11
1876
1901
  login: -->
@@ -1885,7 +1910,7 @@
1885
1910
  <param pos="1" name="hw.version"/>
1886
1911
  </fingerprint>
1887
1912
 
1888
- <fingerprint pattern="^GW25 v([[:digit:]\.]+) - Intelligent Power Meters GPRS Gateway[[:space:]]+Developed by Satelitech">
1913
+ <fingerprint pattern="^GW25 v([\d.]+) - Intelligent Power Meters GPRS Gateway\s+Developed by Satelitech">
1889
1914
  <!-- GW25 v1.2.1 - Intelligent Power Meters GPRS Gateway
1890
1915
  Developed by Satelitech S.A for ESG Dilec
1891
1916
  Enter password: -->
@@ -2066,4 +2091,23 @@
2066
2091
  <param pos="0" name="service.component.cpe23" value="cpe:/a:sap:netweaver_application_server:-"/>
2067
2092
  </fingerprint>
2068
2093
 
2094
+ <fingerprint pattern="^(?:\r|\n|\s){0,256}UDP/TCP/IP Stack: ACT Video security">
2095
+ <description>ACT Security IP Cameras</description>
2096
+ <!--
2097
+ UDP/TCP/IP Stack: ACT Video security\r\n
2098
+ V5.8\r\n
2099
+ Welcome connection : 192.168.0.1:61300\r\n
2100
+ \r\n
2101
+ Password:
2102
+ -->
2103
+
2104
+ <example _encoding="base64">
2105
+ VURQL1RDUC9JUCBTdGFjazogQUNUIFZpZGVvIHNlY3VyaXR5DQpWNS44DQpX
2106
+ ZWxjb21lIGNvbm5lY3Rpb24gOiAxOTIuMTY4LjAuMTo2MTMwMA0KDQpQYXNz
2107
+ d29yZDog
2108
+ </example>
2109
+ <param pos="0" name="hw.vendor" value="ACT Security"/>
2110
+ <param pos="0" name="hw.device" value="IP Camera"/>
2111
+ </fingerprint>
2112
+
2069
2113
  </fingerprints>