recog 2.3.17 → 2.3.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/ci.yml +26 -0
- data/bin/recog_standardize +6 -0
- data/cpe-remap.yaml +342 -200
- data/identifiers/README.md +24 -10
- data/identifiers/fields.txt +104 -0
- data/identifiers/hw_device.txt +2 -0
- data/identifiers/hw_family.txt +11 -0
- data/identifiers/hw_product.txt +71 -0
- data/identifiers/os_device.txt +2 -1
- data/identifiers/os_family.txt +2 -0
- data/identifiers/os_product.txt +36 -8
- data/identifiers/service_family.txt +10 -1
- data/identifiers/service_product.txt +78 -2
- data/identifiers/vendor.txt +55 -0
- data/lib/recog/nizer.rb +1 -82
- data/lib/recog/version.rb +1 -1
- data/requirements.txt +1 -1
- data/update_cpes.py +18 -5
- data/xml/apache_modules.xml +60 -0
- data/xml/apache_os.xml +1 -1
- data/xml/dns_versionbind.xml +11 -1
- data/xml/favicons.xml +122 -3
- data/xml/ftp_banners.xml +62 -51
- data/xml/html_title.xml +553 -41
- data/xml/http_cookies.xml +262 -61
- data/xml/http_servers.xml +478 -108
- data/xml/http_wwwauth.xml +36 -9
- data/xml/imap_banners.xml +5 -5
- data/xml/ldap_searchresult.xml +1 -0
- data/xml/mdns_device-info_txt.xml +340 -10
- data/xml/mysql_banners.xml +2 -1
- data/xml/nntp_banners.xml +1 -1
- data/xml/ntp_banners.xml +16 -2
- data/xml/operating_system.xml +4 -4
- data/xml/pop_banners.xml +4 -4
- data/xml/rtsp_servers.xml +7 -0
- data/xml/sip_banners.xml +347 -9
- data/xml/sip_user_agents.xml +323 -4
- data/xml/smb_native_lm.xml +32 -1
- data/xml/smb_native_os.xml +160 -33
- data/xml/smtp_banners.xml +167 -128
- data/xml/smtp_expn.xml +1 -0
- data/xml/smtp_vrfy.xml +1 -0
- data/xml/snmp_sysdescr.xml +205 -36
- data/xml/ssh_banners.xml +139 -25
- data/xml/telnet_banners.xml +92 -48
- data/xml/tls_jarm.xml +140 -0
- data/xml/x509_issuers.xml +201 -2
- data/xml/x509_subjects.xml +251 -32
- metadata +5 -2
data/xml/tls_jarm.xml
ADDED
|
@@ -0,0 +1,140 @@
|
|
|
1
|
+
<?xml version='1.0' encoding='UTF-8'?>
|
|
2
|
+
<fingerprints matches="tls.jarm" protocol="tls" database_type="service">
|
|
3
|
+
<!--
|
|
4
|
+
Fingerprint based on https://github.com/salesforce/jarm
|
|
5
|
+
-->
|
|
6
|
+
|
|
7
|
+
<fingerprint pattern="^2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa|2ad2ad16d2ad2ad22c2ad2ad2ad2adce2e4c8c53174ecbf5529ce7584d5518$|2ad2ad16d2ad2ad22c42d42d000000d342d5966a57139eeaff9f8bc4841b25$">
|
|
8
|
+
<description>Tor relay</description>
|
|
9
|
+
<example>2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa</example>
|
|
10
|
+
<example>2ad2ad16d2ad2ad22c2ad2ad2ad2adce2e4c8c53174ecbf5529ce7584d5518</example>
|
|
11
|
+
<example>2ad2ad16d2ad2ad22c42d42d000000d342d5966a57139eeaff9f8bc4841b25</example>
|
|
12
|
+
<param pos="0" name="service.product" value="Tor"/>
|
|
13
|
+
<param pos="0" name="service.vendor" value="Tor Project"/>
|
|
14
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:torproject:tor:-"/>
|
|
15
|
+
</fingerprint>
|
|
16
|
+
|
|
17
|
+
<fingerprint pattern="^2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d$">
|
|
18
|
+
<description>Synology NAS</description>
|
|
19
|
+
<example>2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d</example>
|
|
20
|
+
<param pos="0" name="os.device" value="NAS"/>
|
|
21
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
22
|
+
<param pos="0" name="os.product" value="DSM"/>
|
|
23
|
+
<param pos="0" name="os.vendor" value="Synology"/>
|
|
24
|
+
<param pos="0" name="hw.vendor" value="Synology"/>
|
|
25
|
+
<param pos="0" name="hw.device" value="NAS"/>
|
|
26
|
+
</fingerprint>
|
|
27
|
+
|
|
28
|
+
<fingerprint pattern="^2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef$">
|
|
29
|
+
<description>Ubiquiti EdgeRouter</description>
|
|
30
|
+
<example>2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef</example>
|
|
31
|
+
<param pos="0" name="hw.vendor" value="Ubiquiti"/>
|
|
32
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
33
|
+
<param pos="0" name="hw.product" value="EdgeRouter X"/>
|
|
34
|
+
<param pos="0" name="os.vendor" value="Ubiquiti"/>
|
|
35
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
36
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
37
|
+
</fingerprint>
|
|
38
|
+
|
|
39
|
+
<fingerprint pattern="^07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d$">
|
|
40
|
+
<description>Metasploit listener</description>
|
|
41
|
+
<example>07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d</example>
|
|
42
|
+
<param pos="0" name="service.vendor" value="Rapid7"/>
|
|
43
|
+
<param pos="0" name="service.product" value="Metasploit"/>
|
|
44
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:rapid7:metasploit:-"/>
|
|
45
|
+
</fingerprint>
|
|
46
|
+
|
|
47
|
+
<!-- This fingerprint matches Java's TLS stack,
|
|
48
|
+
see https://blog.cobaltstrike.com/2020/12/08/a-red-teamer-plays-with-jarm/ for details -->
|
|
49
|
+
|
|
50
|
+
<fingerprint pattern="^07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1$">
|
|
51
|
+
<description>Cobalt Strike listener</description>
|
|
52
|
+
<example>07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1</example>
|
|
53
|
+
<param pos="0" name="service.vendor" value="Strategic Cyber LLC"/>
|
|
54
|
+
<param pos="0" name="service.product" value="Cobalt Strike Listener"/>
|
|
55
|
+
<param pos="0" name="service.certainty" value="0.3"/>
|
|
56
|
+
</fingerprint>
|
|
57
|
+
|
|
58
|
+
<fingerprint pattern="^04b02b00004b04b04b04b02b04b04b9674c6b4e623ae36cc2d998e99e2262e$">
|
|
59
|
+
<description>Ligowave WiFi access point</description>
|
|
60
|
+
<example>04b02b00004b04b04b04b02b04b04b9674c6b4e623ae36cc2d998e99e2262e</example>
|
|
61
|
+
<param pos="0" name="hw.vendor" value="Ligowave"/>
|
|
62
|
+
<param pos="0" name="hw.product" value="Infinity Controler"/>
|
|
63
|
+
</fingerprint>
|
|
64
|
+
|
|
65
|
+
<fingerprint pattern="^06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d$">
|
|
66
|
+
<description>D-Link DCS-825L WiFi baby camera</description>
|
|
67
|
+
<example>06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d</example>
|
|
68
|
+
<param pos="0" name="hw.vendor" value="D-Link"/>
|
|
69
|
+
<param pos="0" name="hw.product" value="DCS-825L"/>
|
|
70
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:d-link:dcs-825l:-"/>
|
|
71
|
+
</fingerprint>
|
|
72
|
+
|
|
73
|
+
<fingerprint pattern="^0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d$">
|
|
74
|
+
<description>LANCOM Systems - 883 VoIP</description>
|
|
75
|
+
<example>0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d</example>
|
|
76
|
+
<param pos="0" name="hw.vendor" value="LANCOM Systems"/>
|
|
77
|
+
<param pos="0" name="hw.product" value="883 VoIP"/>
|
|
78
|
+
</fingerprint>
|
|
79
|
+
|
|
80
|
+
<fingerprint pattern="^21d14d00021d21d21c42d43d00041d320c989d4ed06a7e9d3133ba36bb2752$">
|
|
81
|
+
<description>Apple CUPS - web interface</description>
|
|
82
|
+
<example>21d14d00021d21d21c42d43d00041d320c989d4ed06a7e9d3133ba36bb2752</example>
|
|
83
|
+
<param pos="0" name="service.vendor" value="Apple"/>
|
|
84
|
+
<param pos="0" name="service.product" value="CUPS"/>
|
|
85
|
+
<param pos="0" name="service.family" value="CUPS"/>
|
|
86
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:apple:cups:-"/>
|
|
87
|
+
</fingerprint>
|
|
88
|
+
|
|
89
|
+
<fingerprint pattern="^0bd14d0000bd0bd0000bd14d0bd0bd6b64279c20472e17718ddea38ab610fa$">
|
|
90
|
+
<description>Netgear R Series</description>
|
|
91
|
+
<example>0bd14d0000bd0bd0000bd14d0bd0bd6b64279c20472e17718ddea38ab610fa</example>
|
|
92
|
+
<param pos="0" name="hw.vendor" value="Netgear"/>
|
|
93
|
+
<param pos="0" name="hw.product" value="R Series"/>
|
|
94
|
+
</fingerprint>
|
|
95
|
+
|
|
96
|
+
<fingerprint pattern="^2ad2ad16d2ad2ad07c2ad2ad2ad2ad4271ee10d978b0aecbc22f1de60ab611$">
|
|
97
|
+
<description>Netgear Orbi-micro</description>
|
|
98
|
+
<example>2ad2ad16d2ad2ad07c2ad2ad2ad2ad4271ee10d978b0aecbc22f1de60ab611</example>
|
|
99
|
+
<param pos="0" name="hw.vendor" value="Netgear"/>
|
|
100
|
+
<param pos="0" name="hw.product" value="Orbi micro"/>
|
|
101
|
+
<param pos="0" name="hw.device" value="WAP"/>
|
|
102
|
+
<param pos="0" name="hw.family" value="Orbi"/>
|
|
103
|
+
</fingerprint>
|
|
104
|
+
|
|
105
|
+
<fingerprint pattern="^04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e$">
|
|
106
|
+
<description>Netgear D Series</description>
|
|
107
|
+
<example>04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e</example>
|
|
108
|
+
<param pos="0" name="hw.vendor" value="Netgear"/>
|
|
109
|
+
<param pos="0" name="hw.product" value="D Series"/>
|
|
110
|
+
</fingerprint>
|
|
111
|
+
|
|
112
|
+
<fingerprint pattern="^21d3fd00021d21d21c21d3fd21d21d89188428dae58757cf803176e9701156$">
|
|
113
|
+
<description>Chromecast</description>
|
|
114
|
+
<example>21d3fd00021d21d21c21d3fd21d21d89188428dae58757cf803176e9701156</example>
|
|
115
|
+
<param pos="0" name="os.vendor" value="Google"/>
|
|
116
|
+
<param pos="0" name="os.product" value="Chrome OS"/>
|
|
117
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
|
|
118
|
+
<param pos="0" name="hw.device" value="Media Server"/>
|
|
119
|
+
<param pos="0" name="hw.vendor" value="Google"/>
|
|
120
|
+
<param pos="0" name="hw.product" value="Chromecast"/>
|
|
121
|
+
</fingerprint>
|
|
122
|
+
|
|
123
|
+
<fingerprint pattern="^21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601$">
|
|
124
|
+
<description>VMWare ESXi</description>
|
|
125
|
+
<example>21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601</example>
|
|
126
|
+
<param pos="0" name="os.vendor" value="VMware"/>
|
|
127
|
+
<param pos="0" name="os.family" value="VMware ESX/ESXi"/>
|
|
128
|
+
<param pos="0" name="os.product" value="VMware ESXi Server"/>
|
|
129
|
+
<param pos="0" name="os.device" value="Hypervisor"/>
|
|
130
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
|
|
131
|
+
<param pos="0" name="hw.device" value="Hypervisor"/>
|
|
132
|
+
</fingerprint>
|
|
133
|
+
|
|
134
|
+
<fingerprint pattern="^29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38$">
|
|
135
|
+
<description>Merlin C2</description>
|
|
136
|
+
<example>29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38</example>
|
|
137
|
+
<param pos="0" name="service.product" value="Merlin"/>
|
|
138
|
+
</fingerprint>
|
|
139
|
+
|
|
140
|
+
</fingerprints>
|
data/xml/x509_issuers.xml
CHANGED
|
@@ -8,6 +8,91 @@
|
|
|
8
8
|
a specific order. Please see the comments in x509_subjects.xml for details.
|
|
9
9
|
-->
|
|
10
10
|
|
|
11
|
+
<!-- The following group has been included for performance reasons -->
|
|
12
|
+
|
|
13
|
+
<fingerprint pattern="^CN=R3,O=Let's Encrypt,C=US$">
|
|
14
|
+
<description>Lets Encrypt R3 - generic -- assert nothing.</description>
|
|
15
|
+
<example>CN=R3,O=Let's Encrypt,C=US</example>
|
|
16
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
17
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
18
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
19
|
+
</fingerprint>
|
|
20
|
+
|
|
21
|
+
<fingerprint pattern="^CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US$">
|
|
22
|
+
<description>Lets Encrypt X3 - generic -- assert nothing.</description>
|
|
23
|
+
<example>CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US</example>
|
|
24
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
25
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
26
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
27
|
+
</fingerprint>
|
|
28
|
+
|
|
29
|
+
<fingerprint pattern="^CN=Amazon,OU=Server CA 1B,O=Amazon,C=US$">
|
|
30
|
+
<description>Amazon AWS Server CA 1B - generic -- assert nothing.</description>
|
|
31
|
+
<example>CN=Amazon,OU=Server CA 1B,O=Amazon,C=US</example>
|
|
32
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
33
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
34
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
35
|
+
</fingerprint>
|
|
36
|
+
|
|
37
|
+
<fingerprint pattern="^CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US$">
|
|
38
|
+
<description>DigiCert SHA2 - generic -- assert nothing.</description>
|
|
39
|
+
<example>CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US</example>
|
|
40
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
41
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
42
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
43
|
+
</fingerprint>
|
|
44
|
+
|
|
45
|
+
<fingerprint pattern="^CN=DigiCert TLS (?:RSA SHA256|Hybrid ECC SHA384) 2020 CA1,O=DigiCert Inc,C=US$">
|
|
46
|
+
<description>DigiCert SHA256 2020 CA1 - generic -- assert nothing.</description>
|
|
47
|
+
<example>CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US</example>
|
|
48
|
+
<example>CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US</example>
|
|
49
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
50
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
51
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
52
|
+
</fingerprint>
|
|
53
|
+
|
|
54
|
+
<fingerprint pattern="^CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US$">
|
|
55
|
+
<description>DigiCert ECC CA-1 - generic -- assert nothing.</description>
|
|
56
|
+
<example>CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
57
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
58
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
59
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
60
|
+
</fingerprint>
|
|
61
|
+
|
|
62
|
+
<fingerprint pattern="^CN=DigiCert SHA2 (?:Extended Validation|High Assurance) Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US$">
|
|
63
|
+
<description>DigiCert SHA2 EV - generic -- assert nothing.</description>
|
|
64
|
+
<example>CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
65
|
+
<example>CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
66
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
67
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
68
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
69
|
+
</fingerprint>
|
|
70
|
+
|
|
71
|
+
<fingerprint pattern="^CN=Sectigo RSA (?:Domain|Organization) Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB$">
|
|
72
|
+
<description>Sectigo RSA - generic -- assert nothing.</description>
|
|
73
|
+
<example>CN=Sectigo RSA Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
|
|
74
|
+
<example>CN=Sectigo RSA Organization Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
|
|
75
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
76
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
77
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
78
|
+
</fingerprint>
|
|
79
|
+
|
|
80
|
+
<fingerprint pattern="^CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US$">
|
|
81
|
+
<description>GeoTrust RSA CA 2018 - generic -- assert nothing.</description>
|
|
82
|
+
<example>CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
83
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
84
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
85
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
86
|
+
</fingerprint>
|
|
87
|
+
|
|
88
|
+
<fingerprint pattern="^CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs\.godaddy\.com/repository/,O=GoDaddy.com\\, Inc\.,L=Scottsdale,ST=Arizona,C=US$">
|
|
89
|
+
<description>Go Daddy G2 - generic -- assert nothing.</description>
|
|
90
|
+
<example>CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US</example>
|
|
91
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
92
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
93
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
94
|
+
</fingerprint>
|
|
95
|
+
|
|
11
96
|
<!-- Chromecast and various devices that support the Cast protocol -->
|
|
12
97
|
|
|
13
98
|
<fingerprint pattern="^CN=Eureka Gen1 ICA,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US$">
|
|
@@ -15,10 +100,12 @@
|
|
|
15
100
|
<example>CN=Eureka Gen1 ICA,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
16
101
|
<param pos="0" name="os.vendor" value="Google"/>
|
|
17
102
|
<param pos="0" name="os.product" value="Chrome OS"/>
|
|
103
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
18
104
|
<param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
|
|
19
105
|
<param pos="0" name="hw.device" value="Media Server"/>
|
|
20
106
|
<param pos="0" name="hw.vendor" value="Google"/>
|
|
21
107
|
<param pos="0" name="hw.product" value="Chromecast"/>
|
|
108
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
22
109
|
<param pos="0" name="chromecast.generation" value="1"/>
|
|
23
110
|
</fingerprint>
|
|
24
111
|
|
|
@@ -34,10 +121,12 @@
|
|
|
34
121
|
<example chromecast.generation="12">CN=Chromecast ICA 12,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
35
122
|
<param pos="0" name="os.vendor" value="Google"/>
|
|
36
123
|
<param pos="0" name="os.product" value="Chrome OS"/>
|
|
124
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
37
125
|
<param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
|
|
38
126
|
<param pos="0" name="hw.device" value="Media Server"/>
|
|
39
127
|
<param pos="0" name="hw.vendor" value="Google"/>
|
|
40
128
|
<param pos="0" name="hw.product" value="Chromecast"/>
|
|
129
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
41
130
|
<param pos="1" name="chromecast.generation"/>
|
|
42
131
|
<param pos="2" name="chromecast.capabilities"/>
|
|
43
132
|
</fingerprint>
|
|
@@ -119,6 +208,20 @@
|
|
|
119
208
|
<param pos="0" name="hw.vendor" value="APC"/>
|
|
120
209
|
</fingerprint>
|
|
121
210
|
|
|
211
|
+
<fingerprint pattern="^CN=ASA Temporary Self Signed Certificate$">
|
|
212
|
+
<description>Cisco ASA Temp Cert</description>
|
|
213
|
+
<example>CN=ASA Temporary Self Signed Certificate</example>
|
|
214
|
+
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
215
|
+
<param pos="0" name="os.family" value="Adaptive Security Appliance"/>
|
|
216
|
+
<param pos="0" name="os.product" value="Adaptive Security Appliance"/>
|
|
217
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
|
|
218
|
+
<param pos="0" name="hw.vendor" value="Cisco"/>
|
|
219
|
+
<param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
|
|
220
|
+
<param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
|
|
221
|
+
<param pos="0" name="hw.device" value="Firewall"/>
|
|
222
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
|
|
223
|
+
</fingerprint>
|
|
224
|
+
|
|
122
225
|
<fingerprint pattern="^CN=Temporary CA [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12},OU=Temporary CA">
|
|
123
226
|
<description>Cisco Video Communication Server</description>
|
|
124
227
|
<example>CN=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,OU=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,O=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74</example>
|
|
@@ -131,9 +234,11 @@
|
|
|
131
234
|
<description>VMware ESXi w/Installer</description>
|
|
132
235
|
<example>O=VMware Installer</example>
|
|
133
236
|
<param pos="0" name="os.vendor" value="VMware"/>
|
|
134
|
-
<param pos="0" name="os.
|
|
237
|
+
<param pos="0" name="os.family" value="VMware ESX/ESXi"/>
|
|
238
|
+
<param pos="0" name="os.product" value="VMware ESXi Server"/>
|
|
135
239
|
<param pos="0" name="os.device" value="Hypervisor"/>
|
|
136
240
|
<param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
|
|
241
|
+
<param pos="0" name="hw.device" value="Hypervisor"/>
|
|
137
242
|
</fingerprint>
|
|
138
243
|
|
|
139
244
|
<fingerprint pattern="^CN=CA,OU=VMware Engineering,O=vCenter,ST=California,C=US$">
|
|
@@ -151,11 +256,105 @@
|
|
|
151
256
|
<param pos="0" name="hw.vendor" value="HP"/>
|
|
152
257
|
<param pos="0" name="hw.family" value="iLO"/>
|
|
153
258
|
<param pos="0" name="hw.product" value="iLO"/>
|
|
154
|
-
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:
|
|
259
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
|
|
155
260
|
<param pos="0" name="os.device" value="Lights Out Management"/>
|
|
156
261
|
<param pos="0" name="os.vendor" value="HP"/>
|
|
157
262
|
<param pos="0" name="os.family" value="iLO"/>
|
|
158
263
|
<param pos="0" name="os.product" value="iLO"/>
|
|
264
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
|
|
265
|
+
</fingerprint>
|
|
266
|
+
|
|
267
|
+
<fingerprint pattern="^CN=synology.com,O=Synology Inc.,L=Taipei,C=TW$">
|
|
268
|
+
<description>Synology</description>
|
|
269
|
+
<example>CN=synology.com,O=Synology Inc.,L=Taipei,C=TW</example>
|
|
270
|
+
<param pos="0" name="os.device" value="NAS"/>
|
|
271
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
272
|
+
<param pos="0" name="os.product" value="DSM"/>
|
|
273
|
+
<param pos="0" name="os.vendor" value="Synology"/>
|
|
274
|
+
<param pos="0" name="hw.vendor" value="Synology"/>
|
|
275
|
+
<param pos="0" name="hw.device" value="NAS"/>
|
|
276
|
+
</fingerprint>
|
|
277
|
+
|
|
278
|
+
<fingerprint pattern="^CN=default(?: [A-Z]+)?,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US$">
|
|
279
|
+
<description>Citrix Netscaler (later renamed to Citrix ADC)</description>
|
|
280
|
+
<example>CN=default,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
|
|
281
|
+
<example>CN=default UYENMB,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
|
|
282
|
+
<param pos="0" name="service.vendor" value="Citrix"/>
|
|
283
|
+
<param pos="0" name="service.family" value="Netscaler"/>
|
|
284
|
+
<param pos="0" name="service.product" value="Netscaler"/>
|
|
285
|
+
<param pos="0" name="service.device" value="Network Management Device"/>
|
|
286
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:citrix:netscaler:-"/>
|
|
287
|
+
<param pos="0" name="os.vendor" value="Citrix"/>
|
|
288
|
+
<param pos="0" name="os.family" value="Netscaler"/>
|
|
289
|
+
<param pos="0" name="os.product" value="Netscaler Gateway Firmware"/>
|
|
290
|
+
<param pos="0" name="os.device" value="Network Management Device"/>
|
|
291
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_gateway_firmware:-"/>
|
|
292
|
+
<param pos="0" name="hw.vendor" value="Citrix"/>
|
|
293
|
+
<param pos="0" name="hw.family" value="Netscaler"/>
|
|
294
|
+
<param pos="0" name="hw.product" value="Netscaler Gateway"/>
|
|
295
|
+
<param pos="0" name="hw.device" value="Network Management Device"/>
|
|
296
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:citrix:netscaler_gateway:-"/>
|
|
297
|
+
</fingerprint>
|
|
298
|
+
|
|
299
|
+
<fingerprint pattern="^O=Technicolor,L=Edegem,ST=Antwerp,C=BE$">
|
|
300
|
+
<description>Technicolor Router - without model or version</description>
|
|
301
|
+
<example>O=Technicolor,L=Edegem,ST=Antwerp,C=BE</example>
|
|
302
|
+
<param pos="0" name="os.vendor" value="Technicolor"/>
|
|
303
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
304
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
305
|
+
<param pos="0" name="hw.vendor" value="Technicolor"/>
|
|
306
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
307
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
308
|
+
</fingerprint>
|
|
309
|
+
|
|
310
|
+
<fingerprint pattern="^CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW$">
|
|
311
|
+
<description>DrayTek Vigor Router - without model or version</description>
|
|
312
|
+
<example>CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW</example>
|
|
313
|
+
<param pos="0" name="os.vendor" value="DrayTek"/>
|
|
314
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
315
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
316
|
+
<param pos="0" name="hw.vendor" value="DrayTek"/>
|
|
317
|
+
<param pos="0" name="hw.family" value="Vigor"/>
|
|
318
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
319
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
320
|
+
</fingerprint>
|
|
321
|
+
|
|
322
|
+
<fingerprint pattern="^CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co$">
|
|
323
|
+
<description>Kubernetes NGINX Ingress Controller with default cert</description>
|
|
324
|
+
<example>CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co</example>
|
|
325
|
+
<param pos="0" name="service.vendor" value="Kubernetes"/>
|
|
326
|
+
<param pos="0" name="service.family" value="Kubernetes"/>
|
|
327
|
+
<param pos="0" name="service.product" value="NGINX Ingress Controller"/>
|
|
328
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:nginx_ingress_controller:-"/>
|
|
329
|
+
</fingerprint>
|
|
330
|
+
|
|
331
|
+
<fingerprint pattern="^CN=TRAEFIK DEFAULT CERT$">
|
|
332
|
+
<description>Traefik Proxy default certificate</description>
|
|
333
|
+
<example>CN=TRAEFIK DEFAULT CERT</example>
|
|
334
|
+
<param pos="0" name="service.vendor" value="Traefik Labs"/>
|
|
335
|
+
<param pos="0" name="service.family" value="Traefik"/>
|
|
336
|
+
<param pos="0" name="service.product" value="Traefik Proxy"/>
|
|
337
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:traefik:traefik:-"/>
|
|
338
|
+
</fingerprint>
|
|
339
|
+
|
|
340
|
+
<fingerprint pattern="(?i)^CN=Fireware web CA,OU=Fireware,O=WatchGuard(?: CA)?$">
|
|
341
|
+
<description>WatchGuard Fireware</description>
|
|
342
|
+
<example>CN=Fireware web ca,OU=Fireware,O=WatchGuard</example>
|
|
343
|
+
<example>CN=Fireware web CA,OU=Fireware,O=Watchguard CA</example>
|
|
344
|
+
<param pos="0" name="service.vendor" value="WatchGuard"/>
|
|
345
|
+
<param pos="0" name="service.product" value="Fireware XTM"/>
|
|
346
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:watchguard:fireware_xtm:-"/>
|
|
347
|
+
<param pos="0" name="os.vendor" value="WatchGuard"/>
|
|
348
|
+
<param pos="0" name="os.product" value="Fireware"/>
|
|
349
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:watchguard:fireware:-"/>
|
|
350
|
+
</fingerprint>
|
|
351
|
+
|
|
352
|
+
<fingerprint pattern="^O=Caddy Self-Signed$">
|
|
353
|
+
<description>CaddyServer Caddy - golang based httpd</description>
|
|
354
|
+
<example>O=Caddy Self-Signed</example>
|
|
355
|
+
<param pos="0" name="service.vendor" value="CaddyServer"/>
|
|
356
|
+
<param pos="0" name="service.product" value="Caddy"/>
|
|
357
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
|
|
159
358
|
</fingerprint>
|
|
160
359
|
|
|
161
360
|
</fingerprints>
|
data/xml/x509_subjects.xml
CHANGED
|
@@ -69,11 +69,12 @@
|
|
|
69
69
|
|
|
70
70
|
<fingerprint pattern="^SERIALNUMBER=PID:([^ ]+) SN:([^,]+),CN=(?:[a-zA-Z0-9\-]+)-SEP([a-fA-F0-9]{12}),OU=[CV]TG,O=Cisco Systems Inc\.$">
|
|
71
71
|
<description>Cisco IP phone with serial number</description>
|
|
72
|
-
<example host.mac="B07D47D33A1C" hw.product="CP-8851" cisco.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
|
|
73
|
-
<example host.mac="64D989000000" hw.product="CP-9951" cisco.serial_number="FCH15200000">SERIALNUMBER=PID:CP-9951 SN:FCH15200000,CN=CP-9951-SEP64D989000000,OU=VTG,O=Cisco Systems Inc.</example>
|
|
72
|
+
<example host.mac="B07D47D33A1C" hw.product="CP-8851" cisco.serial_number="FCH1924AHCA" hw.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
|
|
73
|
+
<example host.mac="64D989000000" hw.product="CP-9951" cisco.serial_number="FCH15200000" hw.serial_number="FCH15200000">SERIALNUMBER=PID:CP-9951 SN:FCH15200000,CN=CP-9951-SEP64D989000000,OU=VTG,O=Cisco Systems Inc.</example>
|
|
74
74
|
<param pos="0" name="hw.device" value="VoIP"/>
|
|
75
75
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
|
76
76
|
<param pos="1" name="hw.product"/>
|
|
77
|
+
<param pos="2" name="hw.serial_number"/>
|
|
77
78
|
<param pos="2" name="cisco.serial_number"/>
|
|
78
79
|
<param pos="3" name="host.mac"/>
|
|
79
80
|
</fingerprint>
|
|
@@ -103,6 +104,29 @@
|
|
|
103
104
|
<param pos="1" name="hw.product"/>
|
|
104
105
|
</fingerprint>
|
|
105
106
|
|
|
107
|
+
<fingerprint pattern="^O=Technicolor,L=Edegem,ST=Antwerp,C=BE$">
|
|
108
|
+
<description>Technicolor Router - without model or version</description>
|
|
109
|
+
<example>O=Technicolor,L=Edegem,ST=Antwerp,C=BE</example>
|
|
110
|
+
<param pos="0" name="os.vendor" value="Technicolor"/>
|
|
111
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
112
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
113
|
+
<param pos="0" name="hw.vendor" value="Technicolor"/>
|
|
114
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
115
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
116
|
+
</fingerprint>
|
|
117
|
+
|
|
118
|
+
<fingerprint pattern="^CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW$">
|
|
119
|
+
<description>DrayTek Vigor Router - without model or version</description>
|
|
120
|
+
<example>CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW</example>
|
|
121
|
+
<param pos="0" name="os.vendor" value="DrayTek"/>
|
|
122
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
123
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
124
|
+
<param pos="0" name="hw.vendor" value="DrayTek"/>
|
|
125
|
+
<param pos="0" name="hw.family" value="Vigor"/>
|
|
126
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
127
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
128
|
+
</fingerprint>
|
|
129
|
+
|
|
106
130
|
<fingerprint pattern="^CN=Nepenthes Development Team,OU=anv,O=dionaea\.carnivore\.it,C=DE$">
|
|
107
131
|
<description>Nepenthes honeypot</description>
|
|
108
132
|
<example>CN=Nepenthes Development Team,OU=anv,O=dionaea.carnivore.it,C=DE</example>
|
|
@@ -198,11 +222,12 @@
|
|
|
198
222
|
<param pos="0" name="hw.vendor" value="HP"/>
|
|
199
223
|
<param pos="0" name="hw.family" value="iLO"/>
|
|
200
224
|
<param pos="0" name="hw.product" value="iLO"/>
|
|
201
|
-
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:
|
|
225
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
|
|
202
226
|
<param pos="0" name="os.device" value="Lights Out Management"/>
|
|
203
227
|
<param pos="0" name="os.vendor" value="HP"/>
|
|
204
228
|
<param pos="0" name="os.family" value="iLO"/>
|
|
205
229
|
<param pos="0" name="os.product" value="iLO"/>
|
|
230
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
|
|
206
231
|
<param pos="1" name="host.name"/>
|
|
207
232
|
</fingerprint>
|
|
208
233
|
|
|
@@ -213,11 +238,12 @@
|
|
|
213
238
|
<param pos="0" name="hw.vendor" value="HP"/>
|
|
214
239
|
<param pos="0" name="hw.family" value="iLO"/>
|
|
215
240
|
<param pos="0" name="hw.product" value="iLO"/>
|
|
216
|
-
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:
|
|
241
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
|
|
217
242
|
<param pos="0" name="os.device" value="Lights Out Management"/>
|
|
218
243
|
<param pos="0" name="os.vendor" value="HP"/>
|
|
219
244
|
<param pos="0" name="os.family" value="iLO"/>
|
|
220
245
|
<param pos="0" name="os.product" value="iLO"/>
|
|
246
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
|
|
221
247
|
</fingerprint>
|
|
222
248
|
|
|
223
249
|
<fingerprint pattern="^CN=OA\-([a-fA-F0-9]+),OU=Onboard Administrator,">
|
|
@@ -228,11 +254,12 @@
|
|
|
228
254
|
<param pos="0" name="hw.vendor" value="HP"/>
|
|
229
255
|
<param pos="0" name="hw.family" value="iLO"/>
|
|
230
256
|
<param pos="0" name="hw.product" value="iLO"/>
|
|
231
|
-
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:
|
|
257
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
|
|
232
258
|
<param pos="0" name="os.device" value="Lights Out Management"/>
|
|
233
259
|
<param pos="0" name="os.vendor" value="HP"/>
|
|
234
260
|
<param pos="0" name="os.family" value="iLO"/>
|
|
235
261
|
<param pos="0" name="os.product" value="iLO"/>
|
|
262
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
|
|
236
263
|
<param pos="1" name="host.mac"/>
|
|
237
264
|
</fingerprint>
|
|
238
265
|
|
|
@@ -243,11 +270,12 @@
|
|
|
243
270
|
<param pos="0" name="hw.vendor" value="HP"/>
|
|
244
271
|
<param pos="0" name="hw.family" value="iLO"/>
|
|
245
272
|
<param pos="0" name="hw.product" value="iLO"/>
|
|
246
|
-
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:
|
|
273
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
|
|
247
274
|
<param pos="0" name="os.device" value="Lights Out Management"/>
|
|
248
275
|
<param pos="0" name="os.vendor" value="HP"/>
|
|
249
276
|
<param pos="0" name="os.family" value="iLO"/>
|
|
250
277
|
<param pos="0" name="os.product" value="iLO"/>
|
|
278
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
|
|
251
279
|
<param pos="1" name="host.name"/>
|
|
252
280
|
</fingerprint>
|
|
253
281
|
|
|
@@ -262,6 +290,7 @@
|
|
|
262
290
|
<param pos="0" name="os.vendor" value="Oracle"/>
|
|
263
291
|
<param pos="0" name="os.family" value="ILOM"/>
|
|
264
292
|
<param pos="0" name="os.product" value="ILOM"/>
|
|
293
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:oracle:integrated_lights_out_manager_firmware:-"/>
|
|
265
294
|
</fingerprint>
|
|
266
295
|
|
|
267
296
|
<fingerprint pattern="^CN=AMI,OU=Service Processors,O=American Megatrends Inc">
|
|
@@ -280,10 +309,11 @@
|
|
|
280
309
|
|
|
281
310
|
<fingerprint pattern="^CN=C-series CIMC,OU=PID:([^ ]+) SERIAL:([^,]+),O=Cisco">
|
|
282
311
|
<description>Cisco Integrated Management Controller</description>
|
|
283
|
-
<example cisco.serial_number="FCH18999AAA" cisco.imc_model="UCSC-C220-M3S">CN=C-series CIMC,OU=PID:UCSC-C220-M3S SERIAL:FCH18999AAA,O=Cisco Self Signed,L=San Jose,ST=California,C=US</example>
|
|
312
|
+
<example cisco.serial_number="FCH18999AAA" hw.serial_number="FCH18999AAA" cisco.imc_model="UCSC-C220-M3S">CN=C-series CIMC,OU=PID:UCSC-C220-M3S SERIAL:FCH18999AAA,O=Cisco Self Signed,L=San Jose,ST=California,C=US</example>
|
|
284
313
|
<param pos="0" name="hw.device" value="Lights Out Management"/>
|
|
285
314
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
|
286
315
|
<param pos="0" name="hw.product" value="IMC"/>
|
|
316
|
+
<param pos="2" name="hw.serial_number"/>
|
|
287
317
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
288
318
|
<param pos="0" name="os.family" value="Linux"/>
|
|
289
319
|
<param pos="0" name="os.product" value="IMC"/>
|
|
@@ -293,10 +323,11 @@
|
|
|
293
323
|
|
|
294
324
|
<fingerprint pattern="^CN=C220-(FCH[^,]+),OU=null,O=Cisco Systems Inc">
|
|
295
325
|
<description>Cisco Integrated Management Controller C220</description>
|
|
296
|
-
<example cisco.serial_number="FCH17999AAA">CN=C220-FCH17999AAA,OU=null,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US</example>
|
|
326
|
+
<example cisco.serial_number="FCH17999AAA" hw.serial_number="FCH17999AAA">CN=C220-FCH17999AAA,OU=null,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US</example>
|
|
297
327
|
<param pos="0" name="hw.device" value="Lights Out Management"/>
|
|
298
328
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
|
299
329
|
<param pos="0" name="hw.product" value="IMC"/>
|
|
330
|
+
<param pos="1" name="hw.serial_number"/>
|
|
300
331
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
301
332
|
<param pos="0" name="os.family" value="Linux"/>
|
|
302
333
|
<param pos="0" name="os.product" value="IMC"/>
|
|
@@ -370,7 +401,7 @@
|
|
|
370
401
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
371
402
|
<param pos="0" name="os.family" value="Adaptive Security Appliance"/>
|
|
372
403
|
<param pos="0" name="os.product" value="Adaptive Security Appliance"/>
|
|
373
|
-
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:
|
|
404
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
|
|
374
405
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
|
375
406
|
<param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
|
|
376
407
|
<param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
|
|
@@ -380,12 +411,13 @@
|
|
|
380
411
|
|
|
381
412
|
<fingerprint pattern="^SERIALNUMBER=([a-zA-Z0-9]+),CN=DEVICE-vWLC,O=Cisco Virtual WLC$">
|
|
382
413
|
<description>Cisco vWLC</description>
|
|
383
|
-
<example cisco.serial_number="9C89M2088D1">SERIALNUMBER=9C89M2088D1,CN=DEVICE-vWLC,O=Cisco Virtual WLC</example>
|
|
414
|
+
<example cisco.serial_number="9C89M2088D1" hw.serial_number="9C89M2088D1">SERIALNUMBER=9C89M2088D1,CN=DEVICE-vWLC,O=Cisco Virtual WLC</example>
|
|
384
415
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
385
416
|
<param pos="0" name="os.device" value="Wireless Controller"/>
|
|
386
417
|
<param pos="0" name="os.product" value="Wireless LAN Controller"/>
|
|
387
|
-
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:
|
|
418
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
|
|
388
419
|
<param pos="1" name="cisco.serial_number"/>
|
|
420
|
+
<param pos="1" name="hw.serial_number"/>
|
|
389
421
|
</fingerprint>
|
|
390
422
|
|
|
391
423
|
<fingerprint pattern="^CN=[a-zA-Z0-9\.\-\_]+,OU=DeviceSSL \(WebAdmin\),O=Cisco Systems Inc\.,C=US$">
|
|
@@ -394,7 +426,7 @@
|
|
|
394
426
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
395
427
|
<param pos="0" name="os.device" value="Wireless Controller"/>
|
|
396
428
|
<param pos="0" name="os.product" value="Wireless LAN Controller"/>
|
|
397
|
-
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:
|
|
429
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
|
|
398
430
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
|
399
431
|
<param pos="0" name="hw.device" value="Wireless Controller"/>
|
|
400
432
|
<param pos="0" name="hw.product" value="Wireless LAN Controller"/>
|
|
@@ -477,11 +509,14 @@
|
|
|
477
509
|
<fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=VMware ESX Server Default Certificate,O=VMware\\, Inc,L=Palo Alto,ST=California,C=US$">
|
|
478
510
|
<description>VMware ESX</description>
|
|
479
511
|
<example>CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
|
|
512
|
+
<param pos="0" name="service.vendor" value="VMware"/>
|
|
480
513
|
<param pos="0" name="os.vendor" value="VMware"/>
|
|
481
|
-
<param pos="0" name="os.
|
|
514
|
+
<param pos="0" name="os.family" value="VMware ESX/ESXi"/>
|
|
515
|
+
<param pos="0" name="os.product" value="VMware ESX Server"/>
|
|
482
516
|
<param pos="0" name="os.device" value="Hypervisor"/>
|
|
483
517
|
<param pos="0" name="os.cpe23" value="cpe:/o:vmware:esx:-"/>
|
|
484
518
|
<param pos="1" name="host.name"/>
|
|
519
|
+
<param pos="0" name="hw.device" value="Hypervisor"/>
|
|
485
520
|
</fingerprint>
|
|
486
521
|
|
|
487
522
|
<fingerprint pattern="^CN.*,OU=SRM,O=VMware\\, Inc\.,L=Palo Alto,ST=California,C=US$">
|
|
@@ -496,6 +531,24 @@
|
|
|
496
531
|
<param pos="0" name="service.product" value="Site Recovery Manager"/>
|
|
497
532
|
</fingerprint>
|
|
498
533
|
|
|
534
|
+
<fingerprint pattern="^CN=([^,=]{1,256}),OU=VMware Horizon View default certificate,O=VMware\\, Inc.$">
|
|
535
|
+
<description>VMware Horizon (formerly View)</description>
|
|
536
|
+
<example host.name="horizon.foo.bar">CN=horizon.foo.bar,OU=VMware Horizon View default certificate,O=VMware\, Inc.</example>
|
|
537
|
+
<param pos="0" name="service.vendor" value="VMware"/>
|
|
538
|
+
<param pos="0" name="service.product" value="Horizon"/>
|
|
539
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:vmware:horizon:-"/>
|
|
540
|
+
<param pos="1" name="host.name"/>
|
|
541
|
+
</fingerprint>
|
|
542
|
+
|
|
543
|
+
<fingerprint pattern="^CN=([^,=]{1,256}),OU=VMware View default certificate,O=VMware\\, Inc.$">
|
|
544
|
+
<description>VMware View</description>
|
|
545
|
+
<example host.name="horizon.foo.bar">CN=horizon.foo.bar,OU=VMware View default certificate,O=VMware\, Inc.</example>
|
|
546
|
+
<param pos="0" name="service.vendor" value="VMware"/>
|
|
547
|
+
<param pos="0" name="service.product" value="View"/>
|
|
548
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:vmware:view:-"/>
|
|
549
|
+
<param pos="1" name="host.name"/>
|
|
550
|
+
</fingerprint>
|
|
551
|
+
|
|
499
552
|
<fingerprint pattern="^CN=IOS-Self-Signed-Certificate-">
|
|
500
553
|
<description>Cisco IOS Default Certificate</description>
|
|
501
554
|
<example>CN=IOS-Self-Signed-Certificate-4163115936</example>
|
|
@@ -507,16 +560,76 @@
|
|
|
507
560
|
<param pos="0" name="hw.device" value="Router"/>
|
|
508
561
|
</fingerprint>
|
|
509
562
|
|
|
563
|
+
<fingerprint pattern="^CN=kube-apiserver$">
|
|
564
|
+
<description>Kubernetes api-server default certificate</description>
|
|
565
|
+
<example>CN=kube-apiserver</example>
|
|
566
|
+
<param pos="0" name="service.vendor" value="Kubernetes"/>
|
|
567
|
+
<param pos="0" name="service.family" value="Kubernetes"/>
|
|
568
|
+
<param pos="0" name="service.product" value="Kubernetes"/>
|
|
569
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
|
|
570
|
+
</fingerprint>
|
|
571
|
+
|
|
572
|
+
<fingerprint pattern="^CN=kubernetes-master$">
|
|
573
|
+
<description>Kubernetes Control Plane (formerly master) default certificate</description>
|
|
574
|
+
<example>CN=kubernetes-master</example>
|
|
575
|
+
<param pos="0" name="service.vendor" value="Kubernetes"/>
|
|
576
|
+
<param pos="0" name="service.family" value="Kubernetes"/>
|
|
577
|
+
<param pos="0" name="service.product" value="Kubernetes"/>
|
|
578
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
|
|
579
|
+
</fingerprint>
|
|
580
|
+
|
|
581
|
+
<fingerprint pattern="^CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co$">
|
|
582
|
+
<description>Kubernetes NGINX Ingress Controller with default cert</description>
|
|
583
|
+
<example>CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co</example>
|
|
584
|
+
<param pos="0" name="service.vendor" value="Kubernetes"/>
|
|
585
|
+
<param pos="0" name="service.family" value="Kubernetes"/>
|
|
586
|
+
<param pos="0" name="service.product" value="NGINX Ingress Controller"/>
|
|
587
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:nginx_ingress_controller:-"/>
|
|
588
|
+
</fingerprint>
|
|
589
|
+
|
|
590
|
+
<fingerprint pattern="^CN=TRAEFIK DEFAULT CERT$">
|
|
591
|
+
<description>Traefik Proxy default certificate</description>
|
|
592
|
+
<example>CN=TRAEFIK DEFAULT CERT</example>
|
|
593
|
+
<param pos="0" name="service.vendor" value="Traefik Labs"/>
|
|
594
|
+
<param pos="0" name="service.family" value="Traefik"/>
|
|
595
|
+
<param pos="0" name="service.product" value="Traefik Proxy"/>
|
|
596
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:traefik:traefik:-"/>
|
|
597
|
+
</fingerprint>
|
|
598
|
+
|
|
599
|
+
<fingerprint pattern="^CN=default(?: [A-Z]+)?,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US$">
|
|
600
|
+
<description>Citrix Netscaler (later renamed to Citrix ADC)</description>
|
|
601
|
+
<example>CN=default,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
|
|
602
|
+
<example>CN=default UYENMB,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
|
|
603
|
+
<param pos="0" name="service.vendor" value="Citrix"/>
|
|
604
|
+
<param pos="0" name="service.family" value="Netscaler"/>
|
|
605
|
+
<param pos="0" name="service.product" value="Netscaler"/>
|
|
606
|
+
<param pos="0" name="service.device" value="Network Management Device"/>
|
|
607
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:citrix:netscaler:-"/>
|
|
608
|
+
<param pos="0" name="os.vendor" value="Citrix"/>
|
|
609
|
+
<param pos="0" name="os.family" value="Netscaler"/>
|
|
610
|
+
<param pos="0" name="os.product" value="Netscaler Gateway Firmware"/>
|
|
611
|
+
<param pos="0" name="os.device" value="Network Management Device"/>
|
|
612
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_gateway_firmware:-"/>
|
|
613
|
+
<param pos="0" name="hw.vendor" value="Citrix"/>
|
|
614
|
+
<param pos="0" name="hw.family" value="Netscaler"/>
|
|
615
|
+
<param pos="0" name="hw.product" value="Netscaler Gateway"/>
|
|
616
|
+
<param pos="0" name="hw.device" value="Network Management Device"/>
|
|
617
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:citrix:netscaler_gateway:-"/>
|
|
618
|
+
</fingerprint>
|
|
619
|
+
|
|
510
620
|
<fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=(?:Cast|Google TV),O=Google Inc,L=Mountain View,ST=California,C=US$">
|
|
511
621
|
<description>Google Chromecast</description>
|
|
512
|
-
<example chromecast.serial_number="LVDZG5" host.mac_local="FA8FCA67413D">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
513
|
-
<example chromecast.serial_number="YRBLE" host.mac_local="FA8FCA7DE87D">CN=YRBLE FA8FCA7DE87D,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
622
|
+
<example chromecast.serial_number="LVDZG5" host.mac_local="FA8FCA67413D" hw.serial_number="LVDZG5">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
623
|
+
<example chromecast.serial_number="YRBLE" host.mac_local="FA8FCA7DE87D" hw.serial_number="YRBLE">CN=YRBLE FA8FCA7DE87D,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
514
624
|
<param pos="0" name="os.vendor" value="Google"/>
|
|
515
625
|
<param pos="0" name="os.product" value="Chrome OS"/>
|
|
626
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
516
627
|
<param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
|
|
517
628
|
<param pos="0" name="hw.device" value="Media Server"/>
|
|
518
629
|
<param pos="0" name="hw.vendor" value="Google"/>
|
|
519
630
|
<param pos="0" name="hw.product" value="Chromecast"/>
|
|
631
|
+
<param pos="1" name="hw.serial_number"/>
|
|
632
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
520
633
|
<param pos="1" name="chromecast.serial_number"/>
|
|
521
634
|
<!-- This is the hotspot-mode MAC address (clear bit 2) -->
|
|
522
635
|
|
|
@@ -525,13 +638,14 @@
|
|
|
525
638
|
|
|
526
639
|
<fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=Cast TV \(Vizio\),O=Google Inc,L=Mountain View,ST=California,C=US$">
|
|
527
640
|
<description>Vizio SmartTV (Android) with Google Cast</description>
|
|
528
|
-
<example chromecast.serial_number="9V039WC9" host.mac_local="FA8FCA697898">CN=9V039WC9 FA8FCA697898,OU=Cast TV (Vizio),O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
641
|
+
<example chromecast.serial_number="9V039WC9" hw.serial_number="9V039WC9" host.mac_local="FA8FCA697898">CN=9V039WC9 FA8FCA697898,OU=Cast TV (Vizio),O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
529
642
|
<param pos="0" name="os.vendor" value="Google"/>
|
|
530
643
|
<param pos="0" name="os.family" value="Linux"/>
|
|
531
644
|
<param pos="0" name="os.product" value="Android"/>
|
|
532
645
|
<param pos="0" name="os.cpe23" value="cpe:/o:google:android:-"/>
|
|
533
646
|
<param pos="0" name="hw.device" value="Smart TV"/>
|
|
534
647
|
<param pos="0" name="hw.vendor" value="Vizio"/>
|
|
648
|
+
<param pos="1" name="hw.serial_number"/>
|
|
535
649
|
<param pos="1" name="chromecast.serial_number"/>
|
|
536
650
|
<!-- This is the hotspot-mode MAC address (clear bit 2) -->
|
|
537
651
|
|
|
@@ -562,6 +676,30 @@
|
|
|
562
676
|
<param pos="0" name="os.device" value="Video Conferencing"/>
|
|
563
677
|
</fingerprint>
|
|
564
678
|
|
|
679
|
+
<fingerprint pattern="^CN=a_lifesize_system,OU=lifesize,O=lifesize,L=Austin,ST=Texas,C=US$">
|
|
680
|
+
<description>Lifesize TelePresence (a_lifesize variant 1)</description>
|
|
681
|
+
<example>CN=a_lifesize_system,OU=lifesize,O=lifesize,L=Austin,ST=Texas,C=US</example>
|
|
682
|
+
<param pos="0" name="hw.vendor" value="Lifesize"/>
|
|
683
|
+
<param pos="0" name="hw.device" value="Video Conferencing"/>
|
|
684
|
+
<param pos="0" name="hw.product" value="TelePresence"/>
|
|
685
|
+
<param pos="0" name="os.vendor" value="Lifesize"/>
|
|
686
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
687
|
+
<param pos="0" name="os.product" value="TelePresence"/>
|
|
688
|
+
<param pos="0" name="os.device" value="Video Conferencing"/>
|
|
689
|
+
</fingerprint>
|
|
690
|
+
|
|
691
|
+
<fingerprint pattern="^CN=A_LifeSize_System,OU=IT,O=LifeSize Communications\\, Inc\.,ST=Texas,C=US$">
|
|
692
|
+
<description>Lifesize TelePresence (a_lifesize variant 2)</description>
|
|
693
|
+
<example>CN=A_LifeSize_System,OU=IT,O=LifeSize Communications\, Inc.,ST=Texas,C=US</example>
|
|
694
|
+
<param pos="0" name="hw.vendor" value="Lifesize"/>
|
|
695
|
+
<param pos="0" name="hw.device" value="Video Conferencing"/>
|
|
696
|
+
<param pos="0" name="hw.product" value="TelePresence"/>
|
|
697
|
+
<param pos="0" name="os.vendor" value="Lifesize"/>
|
|
698
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
699
|
+
<param pos="0" name="os.product" value="TelePresence"/>
|
|
700
|
+
<param pos="0" name="os.device" value="Video Conferencing"/>
|
|
701
|
+
</fingerprint>
|
|
702
|
+
|
|
565
703
|
<fingerprint pattern="^CN=MERCURY-([a-fA-F0-9]{12}),OU=Engineering,O=Crestron">
|
|
566
704
|
<description>Crestron Mercury</description>
|
|
567
705
|
<example host.mac="00107F1ABAA0">CN=MERCURY-00107F1ABAA0,OU=Engineering,O=Crestron Electronics\, Inc.,L=Rockleigh,ST=NJ,C=US</example>
|
|
@@ -747,10 +885,11 @@
|
|
|
747
885
|
|
|
748
886
|
<fingerprint pattern="^CN=([A-Za-z0-9]+),OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
|
|
749
887
|
<description>Fortinet Gateway</description>
|
|
750
|
-
<example fortinet.serial_number="FG100ETK1800118">CN=FG100ETK1800118,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
|
|
751
|
-
<example fortinet.serial_number="FGT30D3X15038375">CN=FGT30D3X15038375,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
|
|
888
|
+
<example fortinet.serial_number="FG100ETK1800118" hw.serial_number="FG100ETK1800118">CN=FG100ETK1800118,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
|
|
889
|
+
<example fortinet.serial_number="FGT30D3X15038375" hw.serial_number="FGT30D3X15038375">CN=FGT30D3X15038375,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
|
|
752
890
|
<param pos="0" name="hw.vendor" value="Fortinet"/>
|
|
753
891
|
<param pos="0" name="hw.device" value="Firewall"/>
|
|
892
|
+
<param pos="1" name="hw.serial_number"/>
|
|
754
893
|
<param pos="0" name="os.vendor" value="Fortinet"/>
|
|
755
894
|
<param pos="0" name="os.family" value="Linux"/>
|
|
756
895
|
<param pos="0" name="os.device" value="Firewall"/>
|
|
@@ -761,9 +900,10 @@
|
|
|
761
900
|
|
|
762
901
|
<fingerprint pattern="^CN=([A-Za-z0-9]+),O=Fortinet Ltd\.$">
|
|
763
902
|
<description>Fortinet Gateway (Older)</description>
|
|
764
|
-
<example fortinet.serial_number="FG100D3G13803999">CN=FG100D3G13803999,O=Fortinet Ltd.</example>
|
|
903
|
+
<example fortinet.serial_number="FG100D3G13803999" hw.serial_number="FG100D3G13803999">CN=FG100D3G13803999,O=Fortinet Ltd.</example>
|
|
765
904
|
<param pos="0" name="hw.vendor" value="Fortinet"/>
|
|
766
905
|
<param pos="0" name="hw.device" value="Firewall"/>
|
|
906
|
+
<param pos="1" name="hw.serial_number"/>
|
|
767
907
|
<param pos="0" name="os.vendor" value="Fortinet"/>
|
|
768
908
|
<param pos="0" name="os.family" value="Linux"/>
|
|
769
909
|
<param pos="0" name="os.device" value="Firewall"/>
|
|
@@ -893,6 +1033,16 @@
|
|
|
893
1033
|
<param pos="0" name="os.device" value="Router"/>
|
|
894
1034
|
</fingerprint>
|
|
895
1035
|
|
|
1036
|
+
<fingerprint pattern="^CN=UbiquitiRouterUI,O=Ubiquiti Inc.,L=New York,ST=New York,C=US">
|
|
1037
|
+
<description>Ubiquiti Router UI</description>
|
|
1038
|
+
<example>CN=UbiquitiRouterUI,O=Ubiquiti Inc.,L=New York,ST=New York,C=US</example>
|
|
1039
|
+
<param pos="0" name="hw.vendor" value="Ubiquiti"/>
|
|
1040
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
1041
|
+
<param pos="0" name="os.vendor" value="Ubiquiti"/>
|
|
1042
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1043
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
1044
|
+
</fingerprint>
|
|
1045
|
+
|
|
896
1046
|
<fingerprint pattern="^CN=UniFi-Video Controller,OU=R&D,O=Ubiquiti Networks,L=New York,ST=NY,C=US$">
|
|
897
1047
|
<description>Ubiquiti Video Controller</description>
|
|
898
1048
|
<example>CN=UniFi-Video Controller,OU=R&D,O=Ubiquiti Networks,L=New York,ST=NY,C=US</example>
|
|
@@ -1027,13 +1177,30 @@
|
|
|
1027
1177
|
</fingerprint>
|
|
1028
1178
|
|
|
1029
1179
|
<fingerprint pattern="^CN=[0-9\.]+,OU=SSL-VPN,O=SonicWALL\\, Inc\.,L=Sunnyvale,ST=CA,C=US$">
|
|
1030
|
-
<description>SonicWALL
|
|
1180
|
+
<description>SonicWALL SSL-VPN</description>
|
|
1031
1181
|
<example>CN=192.168.200.1,OU=SSL-VPN,O=SonicWALL\, Inc.,L=Sunnyvale,ST=CA,C=US</example>
|
|
1182
|
+
<param pos="0" name="service.vendor" value="SonicWall"/>
|
|
1183
|
+
<param pos="0" name="service.family" value="SSL-VPN"/>
|
|
1032
1184
|
<param pos="0" name="hw.vendor" value="SonicWall"/>
|
|
1033
1185
|
<param pos="0" name="hw.device" value="VPN"/>
|
|
1034
1186
|
<param pos="0" name="os.vendor" value="SonicWall"/>
|
|
1035
|
-
<param pos="0" name="os.
|
|
1036
|
-
<param pos="0" name="os.
|
|
1187
|
+
<param pos="0" name="os.family" value="SonicOS"/>
|
|
1188
|
+
<param pos="0" name="os.product" value="SonicOS"/>
|
|
1189
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
|
|
1190
|
+
</fingerprint>
|
|
1191
|
+
|
|
1192
|
+
<fingerprint pattern="^CN=[0-9\.]+,OU=HTTPS Management Certificate for SonicWALL \(self-signed\),O=HTTPS Management Certificate for SonicWALL \(self-signed\),L=Sunnyvale,ST=California,C=US$">
|
|
1193
|
+
<description>SonicWALL Network Security Appliance firewall</description>
|
|
1194
|
+
<example>CN=192.168.168.168,OU=HTTPS Management Certificate for SonicWALL (self-signed),O=HTTPS Management Certificate for SonicWALL (self-signed),L=Sunnyvale,ST=California,C=US</example>
|
|
1195
|
+
<param pos="0" name="hw.vendor" value="SonicWall"/>
|
|
1196
|
+
<param pos="0" name="hw.product" value="Network Security Appliance"/>
|
|
1197
|
+
<param pos="0" name="hw.family" value="Network Security Appliance"/>
|
|
1198
|
+
<param pos="0" name="hw.device" value="Firewall"/>
|
|
1199
|
+
<param pos="0" name="os.vendor" value="SonicWall"/>
|
|
1200
|
+
<param pos="0" name="os.family" value="SonicOS"/>
|
|
1201
|
+
<param pos="0" name="os.product" value="SonicOS"/>
|
|
1202
|
+
<param pos="0" name="os.device" value="Firewall"/>
|
|
1203
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
|
|
1037
1204
|
</fingerprint>
|
|
1038
1205
|
|
|
1039
1206
|
<fingerprint pattern="^CN=.*\.akamai\.net,O=Akamai Technologies\\, Inc\.,L=Cambridge,ST=Massachusetts,C=US$">
|
|
@@ -1041,10 +1208,19 @@
|
|
|
1041
1208
|
<example>CN=a248.e.akamai.net,O=Akamai Technologies\, Inc.,L=Cambridge,ST=Massachusetts,C=US</example>
|
|
1042
1209
|
<param pos="0" name="service.vendor" value="Akamai"/>
|
|
1043
1210
|
<param pos="0" name="service.product" value="GHost"/>
|
|
1211
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:akamai:akamaighost:-"/>
|
|
1044
1212
|
<param pos="0" name="os.vendor" value="Akamai"/>
|
|
1045
1213
|
<param pos="0" name="os.device" value="Web Proxy"/>
|
|
1046
1214
|
</fingerprint>
|
|
1047
1215
|
|
|
1216
|
+
<fingerprint pattern="^O=Caddy Self-Signed$">
|
|
1217
|
+
<description>CaddyServer Caddy - golang based httpd</description>
|
|
1218
|
+
<example>O=Caddy Self-Signed</example>
|
|
1219
|
+
<param pos="0" name="service.vendor" value="CaddyServer"/>
|
|
1220
|
+
<param pos="0" name="service.product" value="Caddy"/>
|
|
1221
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
|
|
1222
|
+
</fingerprint>
|
|
1223
|
+
|
|
1048
1224
|
<fingerprint pattern="^CN=HP_3PAR_">
|
|
1049
1225
|
<description>HP 3PAR</description>
|
|
1050
1226
|
<example>CN=HP_3PAR_1626615</example>
|
|
@@ -1131,10 +1307,11 @@
|
|
|
1131
1307
|
|
|
1132
1308
|
<fingerprint pattern="^CN=Ruckus Wireless ZoneDirector SN-(\d+),O=Ruckus Wireless\\, Inc\.,ST=CA,C=US$">
|
|
1133
1309
|
<description>Ruckus Zone Director</description>
|
|
1134
|
-
<example ruckus.serial_number="221301007591">CN=Ruckus Wireless ZoneDirector SN-221301007591,O=Ruckus Wireless\, Inc.,ST=CA,C=US</example>
|
|
1310
|
+
<example ruckus.serial_number="221301007591" hw.serial_number="221301007591">CN=Ruckus Wireless ZoneDirector SN-221301007591,O=Ruckus Wireless\, Inc.,ST=CA,C=US</example>
|
|
1135
1311
|
<param pos="0" name="hw.device" value="Wireless Controller"/>
|
|
1136
1312
|
<param pos="0" name="hw.vendor" value="Ruckus"/>
|
|
1137
1313
|
<param pos="0" name="hw.product" value="Zone Director"/>
|
|
1314
|
+
<param pos="1" name="hw.serial_number"/>
|
|
1138
1315
|
<param pos="0" name="os.device" value="Wireless Controller"/>
|
|
1139
1316
|
<param pos="0" name="os.vendor" value="Ruckus"/>
|
|
1140
1317
|
<param pos="0" name="os.product" value="Zone Director"/>
|
|
@@ -1197,16 +1374,12 @@
|
|
|
1197
1374
|
<param pos="0" name="hw.vendor" value="Palo Alto Networks"/>
|
|
1198
1375
|
<param pos="0" name="hw.device" value="Firewall"/>
|
|
1199
1376
|
<param pos="0" name="os.vendor" value="Palo Alto Networks"/>
|
|
1200
|
-
<param pos="0" name="os.product" value="
|
|
1377
|
+
<param pos="0" name="os.product" value="PAN-OS"/>
|
|
1378
|
+
<param pos="0" name="os.family" value="PAN-OS"/>
|
|
1201
1379
|
<param pos="0" name="os.device" value="Firewall"/>
|
|
1202
|
-
|
|
1203
|
-
|
|
1204
|
-
|
|
1205
|
-
<description>VMware vCenter</description>
|
|
1206
|
-
<example>CN=VMware default certificate,OU=vCenterServer_2013.09.26_220623,O=VMware\, Inc.</example>
|
|
1207
|
-
<param pos="0" name="service.vendor" value="VMware"/>
|
|
1208
|
-
<param pos="0" name="service.product" value="vCenter"/>
|
|
1209
|
-
<param pos="0" name="service.cpe23" value="cpe:/a:vmware:vcenter_server:-"/>
|
|
1380
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:paloaltonetworks:pan-os:-"/>
|
|
1381
|
+
<param pos="0" name="service.vendor" value="Palo Alto Networks"/>
|
|
1382
|
+
<param pos="0" name="service.device" value="Firewall"/>
|
|
1210
1383
|
</fingerprint>
|
|
1211
1384
|
|
|
1212
1385
|
<fingerprint pattern="^CN=selfappliance,OU=Engineering,O=Symplified,L=Boulder,ST=Colorado,C=US$">
|
|
@@ -1324,6 +1497,7 @@
|
|
|
1324
1497
|
<param pos="0" name="hw.vendor" value="Philips"/>
|
|
1325
1498
|
<param pos="0" name="hw.product" value="Hue"/>
|
|
1326
1499
|
<param pos="0" name="hw.device" value="Light Bulb"/>
|
|
1500
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:philips:hue:-"/>
|
|
1327
1501
|
<param pos="1" name="host.mac_eui64"/>
|
|
1328
1502
|
</fingerprint>
|
|
1329
1503
|
|
|
@@ -1435,4 +1609,49 @@
|
|
|
1435
1609
|
<param pos="0" name="os.product" value="Linux"/>
|
|
1436
1610
|
</fingerprint>
|
|
1437
1611
|
|
|
1612
|
+
<fingerprint pattern="^CN=(RFS\d+)-([0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2})$">
|
|
1613
|
+
<description>Motorola RFS Wireless Controllers</description>
|
|
1614
|
+
<example host.mac="B1-C1-11-11-11-11" hw.product="RFS6000">CN=RFS6000-B1-C1-11-11-11-11</example>
|
|
1615
|
+
<param pos="0" name="hw.device" value="Wireless Controller"/>
|
|
1616
|
+
<param pos="0" name="hw.vendor" value="Motorola"/>
|
|
1617
|
+
<param pos="1" name="hw.product"/>
|
|
1618
|
+
<param pos="2" name="host.mac"/>
|
|
1619
|
+
</fingerprint>
|
|
1620
|
+
|
|
1621
|
+
<fingerprint pattern="^CN=(AP\d+)-([0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2}-[0-9a-fA-F]{2})$">
|
|
1622
|
+
<description>Motorola Wireless Access Points</description>
|
|
1623
|
+
<example host.mac="F1-11-11-11-11-11" hw.product="AP6532">CN=AP6532-F1-11-11-11-11-11</example>
|
|
1624
|
+
<param pos="0" name="hw.device" value="WAP"/>
|
|
1625
|
+
<param pos="0" name="hw.vendor" value="Motorola"/>
|
|
1626
|
+
<param pos="1" name="hw.product"/>
|
|
1627
|
+
<param pos="2" name="host.mac"/>
|
|
1628
|
+
</fingerprint>
|
|
1629
|
+
|
|
1630
|
+
<fingerprint pattern="^CN=attvpngateway\.att\.com,O=AT&T,L=Tampa,ST=FL,C=US$">
|
|
1631
|
+
<description>ATT VPN Gateway</description>
|
|
1632
|
+
<example>CN=attvpngateway.att.com,O=AT&T,L=Tampa,ST=FL,C=US</example>
|
|
1633
|
+
<param pos="0" name="hw.vendor" value="ATT"/>
|
|
1634
|
+
<param pos="0" name="hw.device" value="VPN"/>
|
|
1635
|
+
<param pos="0" name="hw.product" value="VPN Gateway"/>
|
|
1636
|
+
</fingerprint>
|
|
1637
|
+
|
|
1638
|
+
<fingerprint pattern="^CN=silver-peak,OU=Networking Appliance">
|
|
1639
|
+
<description>Silver Peak Appliance</description>
|
|
1640
|
+
<example>CN=silver-peak,OU=Networking Appliance,O=Silver Peak Systems Inc,L=Mountain View,ST=California,C=--</example>
|
|
1641
|
+
<param pos="0" name="hw.vendor" value="Silver Peak"/>
|
|
1642
|
+
<param pos="0" name="hw.device" value="Network Appliance"/>
|
|
1643
|
+
<param pos="0" name="hw.product" value="SD-WAN"/>
|
|
1644
|
+
</fingerprint>
|
|
1645
|
+
|
|
1646
|
+
<fingerprint pattern="^CN=Windows Media Player Network Sharing Service \(([A-Z-]{1,15})\)$">
|
|
1647
|
+
<description>Windows Media Player Network Sharing Service</description>
|
|
1648
|
+
<example host.name="LIVING-ROOM">CN=Windows Media Player Network Sharing Service (LIVING-ROOM)</example>
|
|
1649
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
1650
|
+
<param pos="0" name="service.product" value="Windows Media Player"/>
|
|
1651
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:microsoft:windows_media_player:-"/>
|
|
1652
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
1653
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
1654
|
+
<param pos="1" name="host.name"/>
|
|
1655
|
+
</fingerprint>
|
|
1656
|
+
|
|
1438
1657
|
</fingerprints>
|