recog 2.3.17 → 2.3.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +26 -0
  3. data/bin/recog_standardize +6 -0
  4. data/cpe-remap.yaml +342 -200
  5. data/identifiers/README.md +24 -10
  6. data/identifiers/fields.txt +104 -0
  7. data/identifiers/hw_device.txt +2 -0
  8. data/identifiers/hw_family.txt +11 -0
  9. data/identifiers/hw_product.txt +71 -0
  10. data/identifiers/os_device.txt +2 -1
  11. data/identifiers/os_family.txt +2 -0
  12. data/identifiers/os_product.txt +36 -8
  13. data/identifiers/service_family.txt +10 -1
  14. data/identifiers/service_product.txt +78 -2
  15. data/identifiers/vendor.txt +55 -0
  16. data/lib/recog/nizer.rb +1 -82
  17. data/lib/recog/version.rb +1 -1
  18. data/requirements.txt +1 -1
  19. data/update_cpes.py +18 -5
  20. data/xml/apache_modules.xml +60 -0
  21. data/xml/apache_os.xml +1 -1
  22. data/xml/dns_versionbind.xml +11 -1
  23. data/xml/favicons.xml +122 -3
  24. data/xml/ftp_banners.xml +62 -51
  25. data/xml/html_title.xml +553 -41
  26. data/xml/http_cookies.xml +262 -61
  27. data/xml/http_servers.xml +478 -108
  28. data/xml/http_wwwauth.xml +36 -9
  29. data/xml/imap_banners.xml +5 -5
  30. data/xml/ldap_searchresult.xml +1 -0
  31. data/xml/mdns_device-info_txt.xml +340 -10
  32. data/xml/mysql_banners.xml +2 -1
  33. data/xml/nntp_banners.xml +1 -1
  34. data/xml/ntp_banners.xml +16 -2
  35. data/xml/operating_system.xml +4 -4
  36. data/xml/pop_banners.xml +4 -4
  37. data/xml/rtsp_servers.xml +7 -0
  38. data/xml/sip_banners.xml +347 -9
  39. data/xml/sip_user_agents.xml +323 -4
  40. data/xml/smb_native_lm.xml +32 -1
  41. data/xml/smb_native_os.xml +160 -33
  42. data/xml/smtp_banners.xml +167 -128
  43. data/xml/smtp_expn.xml +1 -0
  44. data/xml/smtp_vrfy.xml +1 -0
  45. data/xml/snmp_sysdescr.xml +205 -36
  46. data/xml/ssh_banners.xml +139 -25
  47. data/xml/telnet_banners.xml +92 -48
  48. data/xml/tls_jarm.xml +140 -0
  49. data/xml/x509_issuers.xml +201 -2
  50. data/xml/x509_subjects.xml +251 -32
  51. metadata +5 -2
data/xml/http_cookies.xml CHANGED
@@ -5,8 +5,71 @@
5
5
  servers.
6
6
  -->
7
7
 
8
+ <fingerprint pattern="^__cfd?uid=">
9
+ <description>CloudFlare web load balancer endpoint</description>
10
+ <example>__cfuid=1337</example>
11
+ <example>__cfduid=dd450f2431e1e611a61a15f68974de9a41618794671; expires=Wed, 19-May-21 01:11:11 GMT; path=/; domain=.foo.bar; HttpOnly; SameSite=Lax</example>
12
+ <param pos="0" name="service.vendor" value="CloudFlare"/>
13
+ <param pos="0" name="service.product" value="CloudFlare Load Balancer"/>
14
+ <param pos="0" name="service.family" value="CloudFlare"/>
15
+ <param pos="0" name="service.cpe23" value="cpe:/a:cloudflare:load_balancing:-"/>
16
+ </fingerprint>
17
+
18
+ <fingerprint pattern="^(AWSALB(?:TG)?(?:CORS)?)=.*$">
19
+ <description>Amazon Application Load Balancer</description>
20
+ <example cookie="AWSALB">AWSALB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
21
+ <example cookie="AWSALBCORS">AWSALBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
22
+ <example cookie="AWSALBTGCORS">AWSALBTGCORS=E0+uuQyz1jbU2P5jrIIWTuoK0aAbjfgsuA814N0xT5w9Vu4N61/CZTKT+yxwCfUqIUx/IgZfsDyA24+eSXKFO60aqEbtGPw2Mm4bGNDMVpcZ/yKHzifDPjT7mNQvNVq7xCAed5VgTpMH/nD3D2pLn9+ooJcShVgv+z97rSYAV5C98tecx6Q=; Expires=Mon, 10 May 2021 01:21:27 GMT; Path=/; SameSite=None; Secure</example>
23
+ <param pos="1" name="cookie"/>
24
+ <param pos="0" name="service.vendor" value="Amazon"/>
25
+ <param pos="0" name="service.family" value="Web Services"/>
26
+ <param pos="0" name="service.product" value="Application Load Balancer"/>
27
+ </fingerprint>
28
+
29
+ <fingerprint pattern="^(AWSELB(?:CORS)?)=.*$">
30
+ <description>Amazon Elastic Load Balancer</description>
31
+ <example cookie="AWSELB">AWSELB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
32
+ <example cookie="AWSELBCORS">AWSELBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
33
+ <param pos="1" name="cookie"/>
34
+ <param pos="0" name="service.vendor" value="Amazon"/>
35
+ <param pos="0" name="service.family" value="Web Services"/>
36
+ <param pos="0" name="service.product" value="Elastic Load Balancer"/>
37
+ </fingerprint>
38
+
39
+ <fingerprint pattern="^(PHPSESSI(?:D|ON))=.*">
40
+ <description>PHP - http://www.php.net/ref.session</description>
41
+ <example cookie="PHPSESSID">PHPSESSID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
42
+ <example cookie="PHPSESSION">PHPSESSION=vt2ag6n7t6ngvlg8adk4860h46; path=/</example>
43
+ <param pos="1" name="cookie"/>
44
+ <param pos="0" name="service.vendor" value="PHP"/>
45
+ <param pos="0" name="service.family" value="PHP"/>
46
+ <param pos="0" name="service.product" value="PHP"/>
47
+ <param pos="0" name="service.cpe23" value="cpe:/a:php:php:-"/>
48
+ </fingerprint>
49
+
50
+ <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=.*">
51
+ <description>Microsoft IIS (ASP.NET)
52
+ http://msdn2.microsoft.com/en-us/library/ms953828.aspx
53
+ http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
54
+ </description>
55
+ <example cookie="ASPSESSIONIDQSBRRTTB">ASPSESSIONIDQSBRRTTB=BECILMBCPMGHJGAHKCHNGENF; path=/</example>
56
+ <example cookie="ASP.NET_SessionId">ASP.NET_SessionId=00nxm4qqh2tdjl0p52m10edv</example>
57
+ <example cookie=".ASPXANONYMOUS">.ASPXANONYMOUS=5ts5UmJr1wEkAAAAMmY0Y2EwNTUtZGZhYi00YTFlLTlmNzAtYmEwNjdiYTgxZDA40; expires=Sun, 27-Jun-2021 14:40:06 GMT; path=/; HttpOnly</example>
58
+ <param pos="1" name="cookie"/>
59
+ <param pos="0" name="service.vendor" value="Microsoft"/>
60
+ <param pos="0" name="service.family" value="IIS"/>
61
+ <param pos="0" name="service.product" value="IIS"/>
62
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:-"/>
63
+ <param pos="0" name="service.component.vendor" value="Microsoft"/>
64
+ <param pos="0" name="service.component.family" value="ASP.NET"/>
65
+ <param pos="0" name="service.component.product" value="ASP.NET"/>
66
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:microsoft:asp.net:-"/>
67
+ </fingerprint>
68
+
8
69
  <fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=.*">
9
70
  <description>Adobe (Macromedia) ColdFusion uses various cookies</description>
71
+ <example cookie="CFTOKEN">CFTOKEN=f3863673461e83d7-8B854468-1866-DAAC-99FBB842C6018037;expires=Mon, 01-Aug-2050 01:05:45 GMT;path=/;HttpOnly;</example>
72
+ <example cookie="CFCLIENT_FOO_CORP">CFCLIENT_FOO_CORP=preflanguage%3DEN%23; Expires=Wed, 12-Apr-2051 01:11:37 GMT; Path=/</example>
10
73
  <param pos="1" name="cookie"/>
11
74
  <param pos="0" name="service.vendor" value="Adobe"/>
12
75
  <param pos="0" name="service.family" value="ColdFusion"/>
@@ -33,9 +96,10 @@
33
96
  <param pos="0" name="service.cpe23" value="cpe:/a:apache:http_server:-"/>
34
97
  </fingerprint>
35
98
 
36
- <fingerprint pattern="^(JServSessionIdroot)=.*">
99
+ <fingerprint pattern="^JServSessionIdroot=.*">
37
100
  <description>Apache JServ</description>
38
- <param pos="1" name="cookie"/>
101
+ <example>JServSessionIdroot=tphxjy73e1.JS1; path=/</example>
102
+ <param pos="0" name="cookie" value="JServSessionIdroot"/>
39
103
  <param pos="0" name="service.vendor" value="Apache"/>
40
104
  <param pos="0" name="service.family" value="JServ"/>
41
105
  <param pos="0" name="service.product" value="JServ"/>
@@ -43,12 +107,22 @@
43
107
 
44
108
  <fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=.*">
45
109
  <description>ATG Dynamo</description>
110
+ <example cookie="ATG_SESSION_ID">ATG_SESSION_ID=yuAUs8xnkzLaF8P3Zk1v5hR28XB4dKsOKZ4jCkVO; path=/</example>
46
111
  <param pos="1" name="cookie"/>
47
112
  <param pos="0" name="service.vendor" value="ATG"/>
48
113
  <param pos="0" name="service.family" value="Dynamo"/>
49
114
  <param pos="0" name="service.product" value="Dynamo"/>
50
115
  </fingerprint>
51
116
 
117
+ <fingerprint pattern="^Bugzilla_login_request_cookie=.*">
118
+ <description>Bugzilla</description>
119
+ <example>Bugzilla_login_request_cookie=ylMVo9ZDtd; path=/; secure</example>
120
+ <param pos="0" name="cookie" value="Bugzilla_login_request_cookie"/>
121
+ <param pos="0" name="service.vendor" value="Mozilla"/>
122
+ <param pos="0" name="service.product" value="Bugzilla"/>
123
+ <param pos="0" name="service.cpe23" value="cpe:/a:mozilla:bugzilla:-"/>
124
+ </fingerprint>
125
+
52
126
  <fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);.*">
53
127
  <description>BEA WebLogic (with timestamp)</description>
54
128
  <param pos="1" name="cookie"/>
@@ -76,9 +150,10 @@
76
150
  <param pos="0" name="service.product" value="Proxy"/>
77
151
  </fingerprint>
78
152
 
79
- <fingerprint pattern="^(CAKEPHP)=.*">
153
+ <fingerprint pattern="^CAKEPHP=.*">
80
154
  <description>CakePHP - http://www.cakephp.org/</description>
81
- <param pos="1" name="cookie"/>
155
+ <example>CAKEPHP=03bgv7jqfurftnm5crn3lc0ob1; expires=Mon, 19-Apr-2021 08:56:06 GMT; Max-Age=14400; path=/; HttpOnly</example>
156
+ <param pos="0" name="cookie" value="CAKEPHP"/>
82
157
  <param pos="0" name="service.family" value="PHP"/>
83
158
  <param pos="0" name="service.product" value="CakePHP"/>
84
159
  </fingerprint>
@@ -88,22 +163,23 @@
88
163
  The cookie value breaks down to [box-id][service-id][timeout-value]
89
164
  unfortunately, there's no separator so it's hard to tell what the
90
165
  actual break is between the pieces of data.
91
- http://www.cisco.com/warp/public/117/AP_cookies.html
92
166
  -->
93
167
 
94
- <fingerprint pattern="^(ARPT)=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+.*">
168
+ <fingerprint pattern="^ARPT=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+.*">
95
169
  <description>Cisco 11000 Series Content Service Switch (CSS)</description>
96
- <param pos="1" name="cookie"/>
97
- <param pos="2" name="host.id"/>
98
- <param pos="3" name="host.ip"/>
170
+ <example host.name="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
171
+ <param pos="0" name="cookie" value="ARPT"/>
172
+ <param pos="1" name="host.name"/>
173
+ <param pos="2" name="host.ip"/>
99
174
  <param pos="0" name="service.vendor" value="Cisco"/>
100
175
  <param pos="0" name="service.family" value="Content Service Switch"/>
101
176
  <param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
102
177
  </fingerprint>
103
178
 
104
- <fingerprint pattern="^(ARPT)=.*">
179
+ <fingerprint pattern="^ARPT=.*">
105
180
  <description>Cisco 11000 Series Content Service Switch (CSS) - catch all variant</description>
106
- <param pos="1" name="cookie"/>
181
+ <example>ARPT=388766892.51247.0000; path=/; Httponly/</example>
182
+ <param pos="0" name="cookie" value="ARPT"/>
107
183
  <param pos="0" name="service.vendor" value="Cisco"/>
108
184
  <param pos="0" name="service.family" value="Content Service Switch"/>
109
185
  <param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
@@ -122,7 +198,7 @@
122
198
  <param pos="0" name="os.vendor" value="Cisco"/>
123
199
  <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
124
200
  <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
125
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance:-"/>
201
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
126
202
  <param pos="0" name="hw.vendor" value="Cisco"/>
127
203
  <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
128
204
  <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
@@ -130,9 +206,9 @@
130
206
  <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
131
207
  </fingerprint>
132
208
 
133
- <fingerprint pattern="^(st8id)=.*">
209
+ <fingerprint pattern="^st8id=.*">
134
210
  <description>Citrix Application Protection System, Enterprise - http://support.citrix.com/article/CTX109330</description>
135
- <param pos="1" name="cookie"/>
211
+ <param pos="0" name="cookie" value="st8id"/>
136
212
  <param pos="0" name="service.vendor" value="Citrix"/>
137
213
  <param pos="0" name="service.family" value="Application Protection System"/>
138
214
  <param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
@@ -146,6 +222,7 @@
146
222
  <param pos="0" name="os.family" value="NetScaler"/>
147
223
  <param pos="0" name="os.device" value="Network Management Device"/>
148
224
  <param pos="0" name="os.product" value="NetScaler"/>
225
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_firmware:-"/>
149
226
  <param pos="0" name="service.vendor" value="Citrix"/>
150
227
  <param pos="0" name="service.family" value="NetScaler"/>
151
228
  <param pos="0" name="service.device" value="Network Management Device"/>
@@ -165,14 +242,33 @@
165
242
  <param pos="0" name="os.product" value="Pulse Connect Secure"/>
166
243
  </fingerprint>
167
244
 
245
+ <fingerprint pattern="^DokuWiki=.*">
246
+ <description>Dokuwiki</description>
247
+ <example>DokuWiki=t8l1aev7703vbtejovp165pv01; path=/; secure</example>
248
+ <param pos="0" name="cookie" value="DokuWiki"/>
249
+ <param pos="0" name="service.vendor" value="Dokuwiki"/>
250
+ <param pos="0" name="service.product" value="Dokuwiki"/>
251
+ <param pos="0" name="service.cpe23" value="cpe:/a:dokuwiki:dokuwiki:-"/>
252
+ </fingerprint>
253
+
168
254
  <fingerprint pattern="^(EktGUID|ecm)=.*">
169
255
  <description>Ektron CMS400.net</description>
256
+ <example cookie="EktGUID">EktGUID=382107cc-a38d-4d25-8182-3748834e21c8; expires=Tue, 19-Apr-2022 03:12:15 GMT; path=/</example>
170
257
  <param pos="1" name="cookie"/>
171
258
  <param pos="0" name="service.vendor" value="Ektron"/>
172
259
  <param pos="0" name="service.family" value="CMS400.NET"/>
173
260
  <param pos="0" name="service.product" value="CMS400.NET"/>
174
261
  </fingerprint>
175
262
 
263
+ <fingerprint pattern="^FESESSIONID=">
264
+ <description>Atlanssian's Fisheye</description>
265
+ <example>FESESSIONID=133713381337</example>
266
+ <param pos="0" name="cookie" value="FESESSIONID"/>
267
+ <param pos="0" name="service.vendor" value="Atlassian"/>
268
+ <param pos="0" name="service.product" value="Fisheye"/>
269
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:fisheye:-"/>
270
+ </fingerprint>
271
+
176
272
  <fingerprint pattern="(?i)^(BIGipServer([^=]+))=.*">
177
273
  <description>F5 BIG-IP LTM - Server variant</description>
178
274
  <example loadbalancer.poolname="CustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
@@ -184,8 +280,19 @@
184
280
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
185
281
  </fingerprint>
186
282
 
187
- <fingerprint pattern="^(BigIPCookie)=.*">
283
+ <fingerprint pattern="^i_like_gogits=.*">
284
+ <description>Gogs</description>
285
+ <example>i_like_gogits=fc3914645f1d5c76; Path=/; HttpOnly</example>
286
+ <param pos="0" name="cookie" value="i_like_gogits"/>
287
+ <param pos="0" name="service.vendor" value="Gogs"/>
288
+ <param pos="0" name="service.product" value="Gogs"/>
289
+ <param pos="0" name="service.cpe23" value="cpe:/a:gogs:gogs:-"/>
290
+ </fingerprint>
291
+
292
+ <fingerprint pattern="^(BigIPCookie[^=]*)=.*">
188
293
  <description>F5 BIG-IP LTM</description>
294
+ <example cookie="BigIPCookie">BigIPCookie=855248779.20480.0000; path=/; Httponly</example>
295
+ <example cookie="BigIPCookie_foo_corp_prod">BigIPCookie_foo_corp_prod=!tJHKH9zIwsUuJYJ38CCV0XSqmJXsZVQaOjj/m/SBSTQTg21/S+s2gmbsoGwwKXr5Tj9e0ijWZWItfA==; path=/; Httponly</example>
189
296
  <param pos="1" name="cookie"/>
190
297
  <param pos="0" name="service.vendor" value="F5"/>
191
298
  <param pos="0" name="service.family" value="BIG-IP"/>
@@ -193,10 +300,40 @@
193
300
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
194
301
  </fingerprint>
195
302
 
196
- <fingerprint pattern="^(SERVERID)=([A-Za-z0-9\-_]+)">
303
+ <fingerprint pattern="^flyspray_project=">
304
+ <description>Flyspray</description>
305
+ <example>flyspray_project=133713381234; Path=/; HttpOnly</example>
306
+ <param pos="0" name="cookie" value="flyspray_project"/>
307
+ <param pos="0" name="service.vendor" value="Flyspray"/>
308
+ <param pos="0" name="service.product" value="Flyspray"/>
309
+ <param pos="0" name="service.cpe23" value="cpe:/a:flyspray:flyspray:-"/>
310
+ </fingerprint>
311
+
312
+ <fingerprint pattern="^i_like_gitea=.*">
313
+ <description>Gitea</description>
314
+ <example>i_like_gitea=fc39d4645b1d5c7c; Path=/</example>
315
+ <param pos="0" name="cookie" value="i_like_gitea"/>
316
+ <param pos="0" name="service.vendor" value="Gitea"/>
317
+ <param pos="0" name="service.product" value="Gitea"/>
318
+ <param pos="0" name="service.certainty" value="0.5"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:gitea:gitea:-"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^_gitlab_session=.*">
323
+ <description>GitLab</description>
324
+ <example>_gitlab_session=032d024e9c2445b595e68255da9e6835; path=/; expires=Mon, 26 Apr 2021 03:09:57 -0000; HttpOnly</example>
325
+ <param pos="0" name="cookie" value="_gitlab_session"/>
326
+ <param pos="0" name="service.vendor" value="GitLab"/>
327
+ <param pos="0" name="service.product" value="GitLab"/>
328
+ <param pos="0" name="service.certainty" value="0.5"/>
329
+ <param pos="0" name="service.cpe23" value="cpe:/a:gitlab:gitlab:-"/>
330
+ </fingerprint>
331
+
332
+ <fingerprint pattern="^SERVERID=([A-Za-z0-9\-_]+)">
197
333
  <description>HAProxy - http://haproxy.1wt.eu/download/1.2/doc/architecture.txt</description>
198
- <param pos="1" name="cookie"/>
199
- <param pos="2" name="host.name"/>
334
+ <example host.name="foo1">SERVERID=foo1; path=/</example>
335
+ <param pos="0" name="cookie" value="SERVERID"/>
336
+ <param pos="1" name="host.name"/>
200
337
  <param pos="0" name="service.family" value="HAProxy"/>
201
338
  <param pos="0" name="service.product" value="HAProxy"/>
202
339
  </fingerprint>
@@ -205,6 +342,7 @@
205
342
  <description>IBM Tivoli Access Manager for e-business WebSEAL
206
343
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin180.htm
207
344
  </description>
345
+ <example cookie="AMWEBJCT!%2F4plportal!JSESSIONID" junction.name="%2F4plportal" junction.cookie="JSESSIONID">AMWEBJCT!%2F4plportal!JSESSIONID=fQDCzpljFPMhMVaDUOD+uOBe.undefined; Path=/</example>
208
346
  <param pos="1" name="cookie"/>
209
347
  <param pos="2" name="junction.name"/>
210
348
  <param pos="3" name="junction.cookie"/>
@@ -217,15 +355,17 @@
217
355
  <description>IBM Tivoli Access Manager for e-business WebSeal
218
356
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin117.htm
219
357
  </description>
358
+ <example cookie="PD-S-SESSION-ID">PD-S-SESSION-ID=1_2_0_xRzIc55lBOTYkrYfW+qWHWGgdqlVKeEgwrhtKt+KRfq8R3lW; Path=/; Secure; HttpOnly</example>
359
+ <example cookie="PD_STATEFUL_db45742c-3e5b-11e9-91da-00505682181c">PD_STATEFUL_db45742c-3e5b-11e9-91da-00505682181c=%2F; Path=/</example>
220
360
  <param pos="1" name="cookie"/>
221
361
  <param pos="0" name="service.vendor" value="IBM"/>
222
362
  <param pos="0" name="service.family" value="Tivoli"/>
223
363
  <param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
224
364
  </fingerprint>
225
365
 
226
- <fingerprint pattern="^(IBMCBR)=.*">
366
+ <fingerprint pattern="^IBMCBR=.*">
227
367
  <description>IBM WebSphere Load Balancer</description>
228
- <param pos="1" name="cookie"/>
368
+ <param pos="0" name="cookie" value="IBMCBR"/>
229
369
  <param pos="0" name="service.vendor" value="IBM"/>
230
370
  <param pos="0" name="service.family" value="WebSphere"/>
231
371
  <param pos="0" name="service.product" value="WebSphere Load Balancer"/>
@@ -233,11 +373,19 @@
233
373
 
234
374
  <fingerprint pattern="^(mbfcookie(?:\[lang\])?)=.*">
235
375
  <description>Joom!Fish http://www.joomfish.net/</description>
376
+ <example cookie="mbfcookie">mbfcookie=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
377
+ <example cookie="mbfcookie[lang]">mbfcookie[lang]=pt_BR; expires=Tue, 20-Apr-2021 03:30:47 GMT; path=/</example>
236
378
  <param pos="1" name="cookie"/>
237
379
  <param pos="0" name="service.family" value="Joom!Fish"/>
238
380
  <param pos="0" name="service.product" value="Joom!Fish"/>
239
381
  </fingerprint>
240
382
 
383
+ <fingerprint pattern="^_mastodon_session=">
384
+ <description>Mastodon</description>
385
+ <param pos="0" name="cookie" value="_mastodon_session"/>
386
+ <param pos="0" name="service.product" value="Mastodon"/>
387
+ </fingerprint>
388
+
241
389
  <fingerprint pattern="^(MSCSAuth|MSCSProfile)=.*">
242
390
  <description>Microsoft Commerce Server - http://msdn2.microsoft.com/en-us/library/ms953828.aspx</description>
243
391
  <param pos="1" name="cookie"/>
@@ -247,30 +395,35 @@
247
395
  <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:commerce_server:-"/>
248
396
  </fingerprint>
249
397
 
250
- <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=.*">
251
- <description>Microsoft IIS (ASP.NET)
252
- http://msdn2.microsoft.com/en-us/library/ms953828.aspx
253
- http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
254
- </description>
398
+ <fingerprint pattern="^(nc_sameSiteCookiestrict|nc_sameSiteCookielax|oc_sessionPassphrase)=.*">
399
+ <description>Nextcloud</description>
400
+ <example cookie="nc_sameSiteCookiestrict">nc_sameSiteCookiestrict=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict</example>
401
+ <example cookie="nc_sameSiteCookielax">nc_sameSiteCookielax=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax</example>
402
+ <example>oc_sessionPassphrase=Y%2BZjBn8Gn%2B8jIJPVx468Tlt8qDNm%2B5IVXLxgtwlY%2BQU2T7edVmDS4091nQrT; path=/nextcloud; secure; HttpOnly</example>
255
403
  <param pos="1" name="cookie"/>
256
- <param pos="0" name="service.vendor" value="Microsoft"/>
257
- <param pos="0" name="service.family" value="IIS"/>
258
- <param pos="0" name="service.product" value="IIS"/>
259
- <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:-"/>
260
- <param pos="0" name="service.component.vendor" value="Microsoft"/>
261
- <param pos="0" name="service.component.family" value="ASP.NET"/>
262
- <param pos="0" name="service.component.product" value="ASP.NET"/>
263
- <param pos="0" name="service.component.cpe23" value="cpe:/a:microsoft:asp.net:-"/>
404
+ <param pos="0" name="service.vendor" value="Nextcloud"/>
405
+ <param pos="0" name="service.product" value="Nextcloud Server"/>
406
+ <param pos="0" name="service.cpe23" value="cpe:/a:nextcloud:nextcloud_server:-"/>
264
407
  </fingerprint>
265
408
 
266
- <fingerprint pattern="^(AlteonP)=.*">
409
+ <fingerprint pattern="^AlteonP=.*">
267
410
  <description>Nortel Alteon Web Switch</description>
268
- <param pos="1" name="cookie"/>
411
+ <example>AlteonP=c46736793e45929dbaeebabb; path=</example>
412
+ <param pos="0" name="cookie" value="AlteonP"/>
269
413
  <param pos="0" name="service.vendor" value="Nortel"/>
270
414
  <param pos="0" name="service.family" value="Alteon"/>
271
415
  <param pos="0" name="service.product" value="Alteon Web Switch"/>
272
416
  </fingerprint>
273
417
 
418
+ <fingerprint pattern="^OBSID=.*">
419
+ <description>Observium</description>
420
+ <example>OBSID=gud74jg1slhskdo7idqgklkamm6g3908; expires=Tue, 20-Apr-2021 01:31:27 GMT; Max-Age=86400; path=/; HttpOnly</example>
421
+ <param pos="0" name="cookie" value="OBSID"/>
422
+ <param pos="0" name="service.vendor" value="Observium"/>
423
+ <param pos="0" name="service.product" value="Observium"/>
424
+ <param pos="0" name="service.cpe23" value="cpe:/a:observium:observium:-"/>
425
+ </fingerprint>
426
+
274
427
  <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=.*">
275
428
  <description>OpenMarket/FatWire Content Server (www.fatwire.com)</description>
276
429
  <param pos="1" name="cookie"/>
@@ -279,42 +432,46 @@
279
432
  <param pos="0" name="service.product" value="Content Server"/>
280
433
  </fingerprint>
281
434
 
282
- <fingerprint pattern="^(parkinglot)=.*">
435
+ <fingerprint pattern="^parkinglot=.*">
283
436
  <description>Oversee Webserver</description>
284
- <param pos="1" name="cookie"/>
437
+ <param pos="0" name="cookie" value="parkinglot"/>
285
438
  <param pos="0" name="service.vendor" value="Oversee"/>
286
439
  <param pos="0" name="service.family" value="Webserver"/>
287
440
  <param pos="0" name="service.product" value="Webserver"/>
288
441
  </fingerprint>
289
442
 
290
- <fingerprint pattern="^(PHPSESSID|PHPSESSION)=.*">
291
- <description>PHP - http://www.php.net/ref.session</description>
292
- <param pos="1" name="cookie"/>
293
- <param pos="0" name="service.vendor" value="PHP"/>
294
- <param pos="0" name="service.family" value="PHP"/>
295
- <param pos="0" name="service.product" value="PHP"/>
296
- <param pos="0" name="service.cpe23" value="cpe:/a:php:php:-"/>
443
+ <fingerprint pattern="^phsid=.*">
444
+ <description>Phabricator</description>
445
+ <example>phsid=A%2Fxesybc4bypb74dlgojdgw2edct6osflno25h2fw7</example>
446
+ <param pos="0" name="cookie" value="phsid"/>
447
+ <param pos="0" name="service.vendor" value="Phacility"/>
448
+ <param pos="0" name="service.family" value="Phabricator"/>
449
+ <param pos="0" name="service.product" value="Phabricator"/>
450
+ <param pos="0" name="service.cpe23" value="cpe:/a:phacility:phabricator:-"/>
297
451
  </fingerprint>
298
452
 
299
- <fingerprint pattern="^(RMID)=.*">
453
+ <fingerprint pattern="^RMID=.*">
300
454
  <description>RealMedia OpenAdStream</description>
301
- <param pos="1" name="cookie"/>
455
+ <example>RMID=36c12633607cf7a0; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.foo.bar</example>
456
+ <param pos="0" name="cookie" value="RMID"/>
302
457
  <param pos="0" name="service.vendor" value="RealMedia"/>
303
458
  <param pos="0" name="service.family" value="OpenAdStream"/>
304
459
  <param pos="0" name="service.product" value="OpenAdStream"/>
305
460
  </fingerprint>
306
461
 
307
- <fingerprint pattern="^(RoxenUserID)=.*">
462
+ <fingerprint pattern="^RoxenUserID=.*">
308
463
  <description>Roxen WebServer</description>
309
- <param pos="1" name="cookie"/>
464
+ <example>RoxenUserID=c70fd536bc9e1342ce2a608b10547f88; expires=Wed, 19 Apr 2023 02:44:41 GMT; path=/</example>
465
+ <param pos="0" name="cookie" value="RoxenUserID"/>
310
466
  <param pos="0" name="service.vendor" value="Roxen"/>
311
467
  <param pos="0" name="service.family" value="WebServer"/>
312
468
  <param pos="0" name="service.product" value="WebServer"/>
313
469
  </fingerprint>
314
470
 
315
- <fingerprint pattern="^(_sn)=.*">
471
+ <fingerprint pattern="^_sn=.*">
316
472
  <description>Siebel CRM</description>
317
- <param pos="1" name="cookie"/>
473
+ <example>_sn=e7139835ca75f921e25c364d4a8fef48; path=/; expires=Mon, 19 Apr 2021 06:06:58 GMT; HttpOnly</example>
474
+ <param pos="0" name="cookie" value="_sn"/>
318
475
  <param pos="0" name="service.vendor" value="Siebel"/>
319
476
  <param pos="0" name="service.family" value="CRM"/>
320
477
  <param pos="0" name="service.product" value="CRM"/>
@@ -332,9 +489,9 @@
332
489
 
333
490
  -->
334
491
 
335
- <fingerprint pattern="^(NSES40Session)=.*">
492
+ <fingerprint pattern="^NSES40Session=.*">
336
493
  <description>Netscape Enterprise Server (subsequently iPlanet Web Server, Sun ONE Web Server, presently Sun Java System Web Server)</description>
337
- <param pos="1" name="cookie"/>
494
+ <param pos="0" name="cookie" value="NSES40Session"/>
338
495
  <param pos="0" name="service.vendor" value="Sun"/>
339
496
  <param pos="0" name="service.family" value="Java System Web Server"/>
340
497
  <param pos="0" name="service.product" value="Java System Web Server"/>
@@ -342,6 +499,24 @@
342
499
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_web_server:4.0"/>
343
500
  </fingerprint>
344
501
 
502
+ <fingerprint pattern="^_redmine_session=.*">
503
+ <description>Redmine</description>
504
+ <example>_redmine_session=BAh7B0kiD3Nlc3Npb25faWQGOgZFRkkiJWY2MGY5MTJiZjg0NGU1ZmQxZWI2OTViNzAxYjU4NTRiBjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMW1kV3Z5NDl6eVkwWDl4bFQvMUxSSmxmbjhhaDR1WWxERWUrMFQ4dVcvS0k9BjsARg%3D%3D--ce5f52d49b68e30a7ec34b75bf456d6c79d234d2; path=/; HttpOnly</example>
505
+ <param pos="0" name="cookie" value="_redmine_session"/>
506
+ <param pos="0" name="service.vendor" value="Redmine"/>
507
+ <param pos="0" name="service.product" value="Redmine"/>
508
+ <param pos="0" name="service.cpe23" value="cpe:/a:redmine:redmine:-"/>
509
+ </fingerprint>
510
+
511
+ <fingerprint pattern="^(syracuse\.sid\.\d+)=">
512
+ <description>Sage X3 Syracuse Web Server</description>
513
+ <example cookie="syracuse.sid.8124">syracuse.sid.8124=8b102bf7-327c-4962-9279-550e72afcaa9; path=/; HttpOnly</example>
514
+ <param pos="1" name="cookie"/>
515
+ <param pos="0" name="service.vendor" value="Sage"/>
516
+ <param pos="0" name="service.family" value="Sage X3 Syracuse Web Server"/>
517
+ <param pos="0" name="service.product" value="Sage X3 Syracuse Web Server"/>
518
+ </fingerprint>
519
+
345
520
  <fingerprint pattern="^(gx_session_id|JROUTE)=.*">
346
521
  <description>Sun Java System Application Server (formerly iPlanet Application Server, Sun ONE Application Server)</description>
347
522
  <param pos="1" name="cookie"/>
@@ -351,17 +526,19 @@
351
526
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_application_server:-"/>
352
527
  </fingerprint>
353
528
 
354
- <fingerprint pattern="^(fe_typo_user)=.*">
529
+ <fingerprint pattern="^fe_typo_user=.*">
355
530
  <description>TYPO3 CMS - http://typo3.com/</description>
356
- <param pos="1" name="cookie"/>
531
+ <example>fe_typo_user=aae725f7dcb8cb5215e64f66d4584cc92; path=/</example>
532
+ <param pos="0" name="cookie" value="fe_typo_user"/>
357
533
  <param pos="0" name="service.vendor" value="TYPO3"/>
358
534
  <param pos="0" name="service.family" value="CMS"/>
359
535
  <param pos="0" name="service.product" value="CMS"/>
360
536
  </fingerprint>
361
537
 
362
- <fingerprint pattern="^(SaneID)=.*">
538
+ <fingerprint pattern="^SaneID=.*">
363
539
  <description>Unica NetTracker - http://netinsight.unica.com/Products/NetTracker.cfm</description>
364
- <param pos="1" name="cookie"/>
540
+ <example>SaneID=10.1.1.223.1618798365976948; path=/; domain=.foo.bar</example>
541
+ <param pos="0" name="cookie" value="SaneID"/>
365
542
  <param pos="0" name="service.vendor" value="Unica"/>
366
543
  <param pos="0" name="service.family" value="NetTracker"/>
367
544
  <param pos="0" name="service.product" value="NetTracker"/>
@@ -369,12 +546,23 @@
369
546
 
370
547
  <fingerprint pattern="^(__utm[a-z])=.*">
371
548
  <description>Urchin Tracking Module - http://www.google.com/support/urchin45/bin/answer.py?answer=28307&amp;topic=7425</description>
549
+ <example cookie="__utmp">__utmp=2071164266.582676006.3393543082; path=/; domain=.foo.bar</example>
372
550
  <param pos="1" name="cookie"/>
373
551
  <param pos="0" name="service.vendor" value="Google"/>
374
552
  <param pos="0" name="service.family" value="Urchin"/>
375
553
  <param pos="0" name="service.product" value="Urchin Tracking Module"/>
376
554
  </fingerprint>
377
555
 
556
+ <fingerprint pattern="vxoaSessionID=">
557
+ <description>Silver Peak Appliance</description>
558
+ <example>vxoaSessionID=s%3A2650cfe1df092fc617d229d6d6b5dbfc.70yKRpb371czAWFkZWXdNfCSNexQvtiVr%2B3Z51YXbIw; Path=/; HttpOnly; Secure</example>
559
+ <example>vxoaSessionID=s%3A65e39ce7ae15193cb4bb0f812d20105b.qgHrgV4MtPKWeKwBrfynmxZmn5iaegh%2FRP0nV5ntaE8; Path=/; HttpOnly; Secure</example>
560
+ <example>vxoaSessionID=s%3A7e17300953b68c4713990a01bd00aa2b.5mg3edagZCkddCmWqMXbp4AOEzTVby6K2z2jfhal7Uw; Path=/; HttpOnly; Secure</example>
561
+ <param pos="0" name="hw.vendor" value="Silver Peak"/>
562
+ <param pos="0" name="hw.device" value="Network Appliance"/>
563
+ <param pos="0" name="hw.product" value="SD-WAN"/>
564
+ </fingerprint>
565
+
378
566
  <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=.*">
379
567
  <description>Vignette</description>
380
568
  <param pos="1" name="cookie"/>
@@ -383,25 +571,38 @@
383
571
  <param pos="0" name="service.product" value="Vignette"/>
384
572
  </fingerprint>
385
573
 
386
- <fingerprint pattern="^(wgSession)=.*">
574
+ <fingerprint pattern="^wgSession=.*">
387
575
  <description>Plain Black WebGUI - http://www.plainblack.com/webgui</description>
388
- <param pos="1" name="cookie"/>
576
+ <example>wgSession=xngFQdcbCap87x6d8qc1YA; path=/; expires=Thu, 17-Apr-2031 02:29:05 GMT</example>
577
+ <param pos="0" name="cookie" value="wgSession"/>
389
578
  <param pos="0" name="service.vendor" value="Plain Black"/>
390
579
  <param pos="0" name="service.family" value="WebGUI"/>
391
580
  <param pos="0" name="service.product" value="WebGUI"/>
392
581
  </fingerprint>
393
582
 
394
- <fingerprint pattern="^(WEBTRENDSID|WEBTRENDS_ID)=.*">
583
+ <fingerprint pattern="^(WEBTRENDS_?ID)=.*">
395
584
  <description>WebTrends</description>
585
+ <example cookie="WEBTRENDS_ID">WEBTRENDS_ID=10.247.9.69.1618795409656141; path=/; expires=Tue, 19-Apr-22 01:23:29 GMT; domain=.foo.bar</example>
396
586
  <param pos="1" name="cookie"/>
397
587
  <param pos="0" name="service.vendor" value="WebTrends"/>
398
588
  <param pos="0" name="service.family" value="WebTrends"/>
399
589
  <param pos="0" name="service.product" value="WebTrends"/>
400
590
  </fingerprint>
401
591
 
402
- <fingerprint pattern="^(_ZopeId)=.*">
403
- <description>Zope</description>
592
+ <fingerprint pattern="^(ZM_TEST|ZM_LOGIN_CSRF)=.*">
593
+ <description>Zimbra</description>
594
+ <example cookie="ZM_TEST">ZM_TEST=true;Secure</example>
595
+ <example cookie="ZM_LOGIN_CSRF">ZM_LOGIN_CSRF=38ef0bea-a4c3-4f41-9ac3-73d7622f3131;Secure;HttpOnly</example>
404
596
  <param pos="1" name="cookie"/>
597
+ <param pos="0" name="service.vendor" value="Synacor"/>
598
+ <param pos="0" name="service.product" value="Zimbra Collaboration Suite"/>
599
+ <param pos="0" name="service.cpe23" value="cpe:/a:synacor:zimbra_collaboration_suite:-"/>
600
+ </fingerprint>
601
+
602
+ <fingerprint pattern="^_ZopeId=.*">
603
+ <description>Zope</description>
604
+ <example>_ZopeId="91304233A995SVLz3SI"; Path=/</example>
605
+ <param pos="0" name="cookie" value="_ZopeId"/>
405
606
  <param pos="0" name="service.family" value="Zope"/>
406
607
  <param pos="0" name="service.product" value="Zope"/>
407
608
  </fingerprint>