recog 2.3.17 → 2.3.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +26 -0
  3. data/bin/recog_standardize +6 -0
  4. data/cpe-remap.yaml +342 -200
  5. data/identifiers/README.md +24 -10
  6. data/identifiers/fields.txt +104 -0
  7. data/identifiers/hw_device.txt +2 -0
  8. data/identifiers/hw_family.txt +11 -0
  9. data/identifiers/hw_product.txt +71 -0
  10. data/identifiers/os_device.txt +2 -1
  11. data/identifiers/os_family.txt +2 -0
  12. data/identifiers/os_product.txt +36 -8
  13. data/identifiers/service_family.txt +10 -1
  14. data/identifiers/service_product.txt +78 -2
  15. data/identifiers/vendor.txt +55 -0
  16. data/lib/recog/nizer.rb +1 -82
  17. data/lib/recog/version.rb +1 -1
  18. data/requirements.txt +1 -1
  19. data/update_cpes.py +18 -5
  20. data/xml/apache_modules.xml +60 -0
  21. data/xml/apache_os.xml +1 -1
  22. data/xml/dns_versionbind.xml +11 -1
  23. data/xml/favicons.xml +122 -3
  24. data/xml/ftp_banners.xml +62 -51
  25. data/xml/html_title.xml +553 -41
  26. data/xml/http_cookies.xml +262 -61
  27. data/xml/http_servers.xml +478 -108
  28. data/xml/http_wwwauth.xml +36 -9
  29. data/xml/imap_banners.xml +5 -5
  30. data/xml/ldap_searchresult.xml +1 -0
  31. data/xml/mdns_device-info_txt.xml +340 -10
  32. data/xml/mysql_banners.xml +2 -1
  33. data/xml/nntp_banners.xml +1 -1
  34. data/xml/ntp_banners.xml +16 -2
  35. data/xml/operating_system.xml +4 -4
  36. data/xml/pop_banners.xml +4 -4
  37. data/xml/rtsp_servers.xml +7 -0
  38. data/xml/sip_banners.xml +347 -9
  39. data/xml/sip_user_agents.xml +323 -4
  40. data/xml/smb_native_lm.xml +32 -1
  41. data/xml/smb_native_os.xml +160 -33
  42. data/xml/smtp_banners.xml +167 -128
  43. data/xml/smtp_expn.xml +1 -0
  44. data/xml/smtp_vrfy.xml +1 -0
  45. data/xml/snmp_sysdescr.xml +205 -36
  46. data/xml/ssh_banners.xml +139 -25
  47. data/xml/telnet_banners.xml +92 -48
  48. data/xml/tls_jarm.xml +140 -0
  49. data/xml/x509_issuers.xml +201 -2
  50. data/xml/x509_subjects.xml +251 -32
  51. metadata +5 -2
data/identifiers/README.md CHANGED
@@ -1,16 +1,27 @@
1
1
  # Recog: Identifiers
2
2
 
3
- This directory contains lists of standard identifiers for mapping Recog matches. The goal is define a standard set of constants to represent known software, hardware, vendors, and categories.
3
+ This directory contains lists of standard identifiers for mapping Recog matches.
4
+ The goal is define a standard set of constants to represent known software,
5
+ hardware, vendors, and categories.
4
6
 
5
- This is currently incomplete and will be updated as standardization work moves forward.
7
+ This is currently incomplete and will be updated as standardization work moves
8
+ forward.
6
9
 
7
- Fingerprints should use these identifiers whenever possible; if a different name or syntax for a given identifier is preferred, this should be implemented in the application through a mapping function.
10
+ Fingerprints should use these identifiers whenever possible; if a different name
11
+ or syntax for a given identifier is preferred, this should be implemented in the
12
+ application through a mapping function.
8
13
 
9
14
  ## Lists
10
15
 
16
+ ### Fields
17
+
18
+ `fields.txt` defines the various fields (`os.vendor`, etc.) used to assert
19
+ information about a match.
20
+
11
21
  ### Vendors
12
22
 
13
- `vendor.txt` defines known vendor names, covering services, operating systems, and hardware.
23
+ `vendor.txt` defines known vendor names, covering services, operating systems,
24
+ and hardware.
14
25
 
15
26
  ### Operating Systems
16
27
 
@@ -22,14 +33,14 @@ Fingerprints should use these identifiers whenever possible; if a different name
22
33
 
23
34
  `os_device.txt` defines known types of devices by function or purpose.
24
35
 
25
-
26
36
  ### Hardware
27
37
 
28
38
  `hw_product.txt` defines known hardware product names.
29
39
 
30
40
  `hw_family.txt` defines known hardware product families.
31
41
 
32
- `hw_device.txt` defines known types of devices by function or purpose (overlaps with `os_device.txt`).
42
+ `hw_device.txt` defines known types of devices by function or purpose (overlaps
43
+ with `os_device.txt`).
33
44
 
34
45
  ### Services
35
46
 
@@ -47,10 +58,13 @@ Fingerprints should use these identifiers whenever possible; if a different name
47
58
 
48
59
  ## Pending Work
49
60
 
50
- * All existing fingerprints should be correlated against these lists to identify mismatches and updated accordingly.
61
+ * All existing fingerprints should be correlated against these lists to
62
+ identify mismatches and updated accordingly.
51
63
 
52
- * All net new identifiers from the existing fingerprints should be merged into these lists.
64
+ * All net new identifiers from the existing fingerprints should be merged into
65
+ these lists.
53
66
 
54
- * All fingerprint assertions should be enumerated, documented, and standardized where possible (`host.mac`, etc).
67
+ * All fingerprint assertions should be enumerated, documented, and standardized
68
+ where possible (`host.mac`, etc).
55
69
 
56
- * Hardware identifiers should be enumerated, consolidated, and standardized.
70
+ * Hardware identifiers should be enumerated, consolidated, and standardized.
data/identifiers/fields.txt ADDED
@@ -0,0 +1,104 @@
1
+ agilent.serial
2
+ apache.info
3
+ apache.variant
4
+ apache.variant.version
5
+ chromecast.capabilities
6
+ chromecast.generation
7
+ chromecast.serial_number
8
+ cisco.imc_model
9
+ cisco.serial_number
10
+ cookie
11
+ dell.service_tag
12
+ extron.model
13
+ fortinet.serial_number
14
+ host.domain
15
+ host.ip
16
+ host.mac
17
+ host.mac_eui64
18
+ host.mac_local
19
+ host.name
20
+ host.time
21
+ hw.certainty
22
+ hw.cpe23
23
+ hw.device
24
+ hw.family
25
+ hw.model
26
+ hw.product
27
+ hw.serial_number
28
+ hw.series
29
+ hw.vendor
30
+ hw.version
31
+ imail.eval
32
+ jetty.info
33
+ junction.cookie
34
+ junction.name
35
+ lenovo.machine_model
36
+ lenovo.machine_type
37
+ linux.kernel.version
38
+ loadbalancer.poolname
39
+ mdaemon.unregistered
40
+ mercur.os.info
41
+ metainfo.version
42
+ metainfo.version.version
43
+ ms.nttp.version
44
+ notes.build.version
45
+ ntmail.id
46
+ openssh.comment
47
+ openssh.cvepatch
48
+ os.arch
49
+ os.build
50
+ os.certainty
51
+ os.cpe23
52
+ os.device
53
+ os.edition
54
+ os.family
55
+ os.model
56
+ os.product
57
+ os.rev
58
+ os.vendor
59
+ os.version
60
+ os.version.version
61
+ os.version.version.version
62
+ postfix.os.info
63
+ postoffice.build
64
+ postoffice.id
65
+ procurve.model
66
+ proftpd.server.name
67
+ pureftpd.config
68
+ python.version
69
+ qpopper.version
70
+ ruckus.serial_number
71
+ securetransport.build
72
+ sendmail.config.version
73
+ sendmail.hpux.phne.version
74
+ sendmail.vendor.version
75
+ service.certainty
76
+ service.component.cpe23
77
+ service.component.family
78
+ service.component.product
79
+ service.component.vendor
80
+ service.component.version
81
+ service.cpe23
82
+ service.device
83
+ service.edition
84
+ service.family
85
+ service.node
86
+ service.product
87
+ service.protocol
88
+ service.vendor
89
+ service.version
90
+ service.version.version
91
+ service.version.version.version
92
+ service.version.version.version.version
93
+ siemens.model
94
+ snmp.fpmib.oid.1
95
+ snmp.fpmib.oid.2
96
+ system.time
97
+ system.time.format
98
+ system.time.micros
99
+ system.time.millis
100
+ tandberg.model
101
+ thttpd.mx-patch
102
+ tomcat.info
103
+ wd2go.device_id
104
+ zmailer.ident
data/identifiers/hw_device.txt CHANGED
@@ -22,6 +22,7 @@ Ethernet Adapter
22
22
  Firewall
23
23
  HMI Controller
24
24
  Handheld Scanner
25
+ Hypervisor
25
26
  IP Camera
26
27
  IPS
27
28
  Industrial Control
@@ -45,6 +46,7 @@ Power Relay
45
46
  Powerline
46
47
  Print Server
47
48
  Printer
49
+ Relay Controller
48
50
  Router
49
51
  SD-WAN Appliance
50
52
  SIP Device
data/identifiers/hw_family.txt CHANGED
@@ -5,17 +5,20 @@ AirPort
5
5
  Apple TV
6
6
  Communication Manager
7
7
  DVR
8
+ Data ONTAP
8
9
  DiskStation
9
10
  Document Centre
10
11
  EDR
11
12
  Extended Systems ExtendNet
12
13
  FRITZ!Box
14
+ FRITZ!Fon
13
15
  FRITZ!Powerline
14
16
  FRITZ!WLAN Repeater
15
17
  FS
16
18
  Firewall-1
17
19
  Forms Printer
18
20
  FortiGate
21
+ FortiVoice
19
22
  GW25
20
23
  GXV
21
24
  GXW
@@ -42,8 +45,11 @@ Multifunction
42
45
  My Book
43
46
  NE
44
47
  NPort
48
+ NetScaler
45
49
  NetVanta
50
+ Netscaler
46
51
  Network Audio
52
+ Network Security Appliance
47
53
  Network Video Door Station
48
54
  Optra
49
55
  Orbi
@@ -59,6 +65,7 @@ Router
59
65
  S500 Range
60
66
  SIP Device
61
67
  SIP Gateway
68
+ SL2100
62
69
  Service Access Switch
63
70
  Service Router
64
71
  Simatic HMI
@@ -79,9 +86,12 @@ TelePresence
79
86
  Time Capsule
80
87
  TippingPoint
81
88
  Turbo Station
89
+ UNIVERGE
82
90
  UniFi
83
91
  Unified Security Gateway
92
+ VDX
84
93
  VSX
94
+ Vigor
85
95
  VoIP
86
96
  WD2GO
87
97
  WiMax
@@ -93,6 +103,7 @@ Xserve
93
103
  ZXDSL
94
104
  ZXHN
95
105
  ZXV
106
+ airMAX
96
107
  iLO
97
108
  iMac
98
109
  iPad
data/identifiers/hw_product.txt CHANGED
@@ -3,6 +3,7 @@
3
3
  34972A Data Logger
4
4
  3PAR
5
5
  53230A Frequency Counter
6
+ 883 VoIP
6
7
  ADB-4820CD
7
8
  APIC
8
9
  AV Receiver
@@ -19,6 +20,7 @@ Apple TV (2nd generation)
19
20
  Apple TV (3rd generation)
20
21
  Apple TV (4th generation)
21
22
  Apple TV 4K
23
+ Apple TV 4K (2nd generation)
22
24
  Appliance
23
25
  ArchiveTeam Warrior
24
26
  Asset Management
@@ -35,15 +37,19 @@ Catalyst
35
37
  Catalyst 1900
36
38
  Celerra
37
39
  Chromecast
40
+ ClearPass Policy Manager
38
41
  ClickShare
39
42
  CloudKey
40
43
  CommandPost
41
44
  ConnectUPS Web Card
42
45
  Crosswork SON Appliance
46
+ D Series
47
+ DCS-825L
43
48
  DCS-932
44
49
  DD OS
45
50
  DNA Center
46
51
  DSL Router
52
+ Data ONTAP
47
53
  Digital Signage Player
48
54
  Discover
49
55
  Discovery
@@ -57,9 +63,12 @@ EP-series
57
63
  EXA Signal Analyzer
58
64
  Eagle Eye Director II
59
65
  EchoLife Home Gateway
66
+ EdgeRouter X
60
67
  EdgeSwitch
61
68
  Elevation
69
+ Email Security Gateway
62
70
  EqualLogic
71
+ Ethernet Relay Controller
63
72
  Ethernet Relay Module
64
73
  Excella
65
74
  Fastmark M5
@@ -70,9 +79,20 @@ Firewall-1
70
79
  FlexiPacket Hub
71
80
  FortiMail
72
81
  FortiManager
82
+ GXP1610
83
+ GXP1615
84
+ GXP1625
85
+ GXP1628
86
+ GXP2200
73
87
  GigaVUE
74
88
  HDHomeRun
75
89
  HDIPCam
90
+ HT801
91
+ HT802
92
+ HT812
93
+ HT813
94
+ HT814
95
+ HT818
76
96
  HiPer Access Router Card
77
97
  Home Controller
78
98
  Home Gateway
@@ -89,6 +109,7 @@ IP Link Control Processor
89
109
  IP2IR
90
110
  IPMI
91
111
  IVR
112
+ Infinity Controler
92
113
  IntelliSlot Web Card
93
114
  Internet Payment Gateway
94
115
  Internet Phone Adapter
@@ -100,6 +121,7 @@ JetDirect
100
121
  K1000
101
122
  KWS-1043N
102
123
  Key Management
124
+ Key Management Server
103
125
  Lantick Ethernet Relay Controller
104
126
  Lencore Sound Manager 2
105
127
  MDS 9000
@@ -115,6 +137,7 @@ Mac mini (Late 2009)
115
137
  Mac mini (Late 2012)
116
138
  Mac mini (Late 2014)
117
139
  Mac mini (Late 2018)
140
+ Mac mini (M1, 2020)
118
141
  Mac mini (Mid 2007)
119
142
  Mac mini (Mid 2010)
120
143
  Mac mini (Mid 2011)
@@ -132,16 +155,20 @@ MacBook Air (13-inch, Early 2014)
132
155
  MacBook Air (13-inch, Late 2010)
133
156
  MacBook Air (13-inch, Mid 2011)
134
157
  MacBook Air (13-inch, Mid 2012)
158
+ MacBook Air (M1, 2020)
135
159
  MacBook Air (Mid 2009)
136
160
  MacBook Air (Retina, 13-inch, 2018)
137
161
  MacBook Air (Retina, 13-inch, 2019)
162
+ MacBook Air (Retina, 13-inch, 2020)
138
163
  MacBook Pro (13-inch, 2016, Four Thunderbolt 3 ports)
139
164
  MacBook Pro (13-inch, 2016, Two Thunderbolt 3 ports)
140
165
  MacBook Pro (13-inch, 2017, Four Thunderbolt 3 ports)
141
166
  MacBook Pro (13-inch, 2017, Two Thunderbolt 3 ports)
142
167
  MacBook Pro (13-inch, 2018, Four Thunderbolt 3 ports)
143
168
  MacBook Pro (13-inch, 2019, Two Thunderbolt 3 ports)
169
+ MacBook Pro (13-inch, 2020)
144
170
  MacBook Pro (13-inch, Late 2011)
171
+ MacBook Pro (13-inch, M1, 2020)
145
172
  MacBook Pro (13-inch, Mid 2009)
146
173
  MacBook Pro (13-inch, Mid 2010)
147
174
  MacBook Pro (13-inch, Mid 2012)
@@ -153,6 +180,8 @@ MacBook Pro (15-inch, Late 2008)
153
180
  MacBook Pro (15-inch, Late 2011)
154
181
  MacBook Pro (15-inch, Mid 2009)
155
182
  MacBook Pro (15-inch, Mid 2010)
183
+ MacBook Pro (15-inch, Mid 2012)
184
+ MacBook Pro (16-inch, 2019)
156
185
  MacBook Pro (17-inch, Early 2008)
157
186
  MacBook Pro (17-inch, Late 2011)
158
187
  MacBook Pro (17-inch, Mid 2009)
@@ -164,24 +193,32 @@ MacBook Pro (Retina, 15-inch, Early 2013)
164
193
  MacBook Pro (Retina, 15-inch, Late 2013)
165
194
  MacBook Pro (Retina, 15-inch, Mid 2015)
166
195
  Makito X Decoder
196
+ Media Gateway
167
197
  MediaLink Controller
168
198
  MediaSense
169
199
  Meeting Management
170
200
  Meeting Server
171
201
  MegaRAC
202
+ Meraki Device
172
203
  Mercury
173
204
  Mergepoint
174
205
  Miniserver
175
206
  My Book Live
176
207
  N5172B Signal Generator
208
+ NAM
177
209
  NAS4Free
178
210
  NFVIS
179
211
  NPort
212
+ NetScaler Gateway
213
+ NetScaler SDX Gateway
180
214
  NetScreen
181
215
  NetVR
182
216
  Netbox
217
+ Netscaler Gateway
218
+ Network Camera
183
219
  Network Gateway
184
220
  Network Node
221
+ Network Security Appliance
185
222
  Nexus 1000V
186
223
  Nexus Player
187
224
  OfficeConnect Switch
@@ -189,8 +226,10 @@ OnHub
189
226
  OpenManage
190
227
  OpenManage Switch
191
228
  OpenNAC
229
+ Orbi micro
192
230
  Orbit IP Camera
193
231
  PDR M800
232
+ PIAF Virtual Appliance
194
233
  PLAY
195
234
  PLC-5
196
235
  Paragon-100G
@@ -201,6 +240,8 @@ Prime Collaboration Manager
201
240
  Primergy
202
241
  Printer
203
242
  Prosafe Plus
243
+ R Series
244
+ RT31P2
204
245
  RTU
205
246
  Rack PDU Card
206
247
  Raspberry Pi
@@ -210,12 +251,18 @@ ReeCam
210
251
  Roku
211
252
  Room Alert
212
253
  S7 DALI Gateway
254
+ SD-WAN
213
255
  SHIELD
214
256
  SIP Gateway
215
257
  SIParator Firewall
258
+ SL2100
216
259
  SLS
217
260
  SPA
261
+ SPA112
262
+ SPA122
218
263
  SRP
264
+ SV8100
265
+ SV9100
219
266
  ScanFront
220
267
  Scrutinizer
221
268
  Sensor
@@ -230,6 +277,7 @@ SolsticePod
230
277
  SoundPoint
231
278
  Spot
232
279
  Stealthwatch
280
+ Steelhead
233
281
  Storage Appliance
234
282
  Sub
235
283
  Sunny WebBox
@@ -238,6 +286,7 @@ SuperStack 3 Firewall
238
286
  SuperStack II
239
287
  Symmetry EN-2DBC
240
288
  System Management
289
+ TG789vac
241
290
  TelePresence
242
291
  TelePresence MCU
243
292
  Tenable Appliance
@@ -245,13 +294,20 @@ Tenable Core
245
294
  Tetration
246
295
  Time Capsule
247
296
  TouchLink Control Panel
297
+ UCM6202
298
+ UCM6204
299
+ UCM6208
248
300
  UCS Manager
301
+ USG20-VPN
302
+ USG40
303
+ USG60
249
304
  UniFi Cloud Key
250
305
  UniFi NVR
251
306
  UniFi Security Gateway
252
307
  Univerge
253
308
  Universal Media Gateway
254
309
  VBrick Rev
310
+ VPN Gateway
255
311
  Verizon FiOS Router
256
312
  Video Controller
257
313
  Vigor
@@ -259,6 +315,7 @@ Virtual Connect Manager
259
315
  Virtual Traffic Manager
260
316
  Vood
261
317
  WLAN AP
318
+ WNR2000
262
319
  WebBox
263
320
  Whiteboard
264
321
  Wireless Dock
@@ -279,6 +336,8 @@ iCOM Control Panel
279
336
  iDRAC
280
337
  iLO
281
338
  iLO 3
339
+ iLO 4
340
+ iMac (20/24-inch, Early 2008)
282
341
  iMac (21.5-inch, 2017)
283
342
  iMac (21.5-inch, Late 2012)
284
343
  iMac (21.5-inch, Late 2013)
@@ -297,6 +356,7 @@ iMac (Retina 4K, 21.5-inch, 2019)
297
356
  iMac (Retina 4K, 21.5-inch, Late 2015)
298
357
  iMac (Retina 5K, 27-inch, 2017)
299
358
  iMac (Retina 5K, 27-inch, 2019)
359
+ iMac (Retina 5K, 27-inch, 2020)
300
360
  iMac (Retina 5K, 27-inch, Late 2015)
301
361
  iMac (Retina 5K, 27-inch, Mid 2015)
302
362
  iMac Pro (Retina 5K, Late 2017)
@@ -308,7 +368,11 @@ iPad Air (3rd generation)
308
368
  iPad Air 2
309
369
  iPad Pro (10.5-inch)
310
370
  iPad Pro (11-inch)
371
+ iPad Pro (11-inch, 2nd generation)
311
372
  iPad Pro (12.9-inch)
373
+ iPad Pro (12.9-inch, 2nd generation)
374
+ iPad Pro (12.9-inch, 3rd generation)
375
+ iPad Pro (12.9-inch, 4th generation)
312
376
  iPad Pro (9.7-inch)
313
377
  iPad mini
314
378
  iPad mini (5th generation)
@@ -316,6 +380,12 @@ iPad mini 2
316
380
  iPad mini 3
317
381
  iPad mini 4
318
382
  iPhone
383
+ iPhone 11 Pro
384
+ iPhone 11 Pro Max
385
+ iPhone 12 5G
386
+ iPhone 12 Mini 5G
387
+ iPhone 12 Pro 5G
388
+ iPhone 12 Pro Max 5G
319
389
  iPhone 3G
320
390
  iPhone 3GS
321
391
  iPhone 4
@@ -332,6 +402,7 @@ iPhone 7 Plus
332
402
  iPhone 8
333
403
  iPhone 8 Plus
334
404
  iPhone SE
405
+ iPhone SE (2020)
335
406
  iPhone X
336
407
  iPhone XR
337
408
  iPhone XS