recog 2.3.18 → 2.3.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +26 -0
  3. data/cpe-remap.yaml +11 -0
  4. data/identifiers/hw_device.txt +2 -0
  5. data/identifiers/hw_family.txt +6 -0
  6. data/identifiers/hw_product.txt +59 -0
  7. data/identifiers/os_device.txt +2 -0
  8. data/identifiers/os_family.txt +1 -0
  9. data/identifiers/os_product.txt +25 -0
  10. data/identifiers/service_family.txt +3 -0
  11. data/identifiers/service_product.txt +27 -0
  12. data/identifiers/vendor.txt +33 -0
  13. data/lib/recog/version.rb +1 -1
  14. data/update_cpes.py +3 -3
  15. data/xml/favicons.xml +108 -0
  16. data/xml/ftp_banners.xml +2 -1
  17. data/xml/html_title.xml +156 -1
  18. data/xml/http_cookies.xml +85 -0
  19. data/xml/http_servers.xml +120 -1
  20. data/xml/http_wwwauth.xml +8 -0
  21. data/xml/mdns_device-info_txt.xml +308 -10
  22. data/xml/ntp_banners.xml +9 -1
  23. data/xml/rtsp_servers.xml +7 -0
  24. data/xml/sip_banners.xml +344 -8
  25. data/xml/sip_user_agents.xml +317 -4
  26. data/xml/smb_native_lm.xml +32 -1
  27. data/xml/smb_native_os.xml +157 -33
  28. data/xml/snmp_sysdescr.xml +129 -1
  29. data/xml/ssh_banners.xml +118 -11
  30. data/xml/telnet_banners.xml +25 -1
  31. data/xml/tls_jarm.xml +139 -0
  32. data/xml/x509_issuers.xml +16 -0
  33. data/xml/x509_subjects.xml +72 -0
  34. metadata +4 -2
data/xml/ssh_banners.xml CHANGED
@@ -552,7 +552,7 @@
552
552
  </fingerprint>
553
553
 
554
554
  <fingerprint pattern="^OpenSSH_(7\.8) (FreeBSD-20180909)$">
555
- <description>OpenSSH running on FreeBSD 12.0</description>
555
+ <description>OpenSSH running on FreeBSD 12.0/12.1</description>
556
556
  <example service.version="7.8" openssh.comment="FreeBSD-20180909">OpenSSH_7.8 FreeBSD-20180909</example>
557
557
  <param pos="1" name="service.version"/>
558
558
  <param pos="2" name="openssh.comment"/>
@@ -888,9 +888,10 @@
888
888
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:13.04"/>
889
889
  </fingerprint>
890
890
 
891
- <fingerprint pattern="^OpenSSH_(6\.2p2) (Ubuntu-6unbuntu\d(?:\.\d)?)$">
891
+ <fingerprint pattern="^OpenSSH_(6\.2p2) (Ubuntu-6\S*)$">
892
892
  <description>OpenSSH running on Ubuntu 13.10</description>
893
893
  <example service.version="6.2p2" openssh.comment="Ubuntu-6unbuntu0.4">OpenSSH_6.2p2 Ubuntu-6unbuntu0.4</example>
894
+ <example service.version="6.2p2" openssh.comment="Ubuntu-6">OpenSSH_6.2p2 Ubuntu-6</example>
894
895
  <param pos="1" name="service.version"/>
895
896
  <param pos="2" name="openssh.comment"/>
896
897
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -917,10 +918,11 @@
917
918
  <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
918
919
  </fingerprint>
919
920
 
920
- <fingerprint pattern="^OpenSSH_(6\.6(?:\.\d)?p1) (Ubuntu-2ubuntu\d+(?:\.\d+)?)$">
921
+ <fingerprint pattern="^OpenSSH_(6\.6(?:\.1)?p1) (Ubuntu-2\S*)$">
921
922
  <description>OpenSSH running on Ubuntu 14.04</description>
922
923
  <example service.version="6.6p1" openssh.comment="Ubuntu-2ubuntu1">OpenSSH_6.6p1 Ubuntu-2ubuntu1</example>
923
924
  <example service.version="6.6.1p1" openssh.comment="Ubuntu-2ubuntu2">OpenSSH_6.6.1p1 Ubuntu-2ubuntu2</example>
925
+ <example service.version="6.6.1p1" openssh.comment="Ubuntu-2ubuntu2.13">OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.13</example>
924
926
  <param pos="1" name="service.version"/>
925
927
  <param pos="2" name="openssh.comment"/>
926
928
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -950,9 +952,10 @@
950
952
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:14.10"/>
951
953
  </fingerprint>
952
954
 
953
- <fingerprint pattern="^OpenSSH_(6\.7p1) (Ubuntu-5ubuntu\d(?:\.\d)?)$">
955
+ <fingerprint pattern="^OpenSSH_(6\.7p1) (Ubuntu-5\S*)$">
954
956
  <description>OpenSSH running on Ubuntu 15.04 (vivid)</description>
955
957
  <example service.version="6.7p1" openssh.comment="Ubuntu-5ubuntu1">OpenSSH_6.7p1 Ubuntu-5ubuntu1</example>
958
+ <example service.version="6.7p1" openssh.comment="Ubuntu-5ubuntu1.4">OpenSSH_6.7p1 Ubuntu-5ubuntu1.4</example>
956
959
  <param pos="1" name="service.version"/>
957
960
  <param pos="2" name="openssh.comment"/>
958
961
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -966,9 +969,10 @@
966
969
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:15.04"/>
967
970
  </fingerprint>
968
971
 
969
- <fingerprint pattern="^OpenSSH_(6\.9p1) (Ubuntu-2)$">
972
+ <fingerprint pattern="^OpenSSH_(6\.9p1) (Ubuntu-2\S*)$">
970
973
  <description>OpenSSH running on Ubuntu 15.10</description>
971
974
  <example service.version="6.9p1" openssh.comment="Ubuntu-2">OpenSSH_6.9p1 Ubuntu-2</example>
975
+ <example service.version="6.9p1" openssh.comment="Ubuntu-2ubuntu0.2">OpenSSH_6.9p1 Ubuntu-2ubuntu0.2</example>
972
976
  <param pos="1" name="service.version"/>
973
977
  <param pos="2" name="openssh.comment"/>
974
978
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -982,9 +986,11 @@
982
986
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:15.10"/>
983
987
  </fingerprint>
984
988
 
985
- <fingerprint pattern="^OpenSSH_(7\.2p2) (Ubuntu-4ubuntu\d(?:\.\d)?)$">
989
+ <fingerprint pattern="^OpenSSH_(7\.2p2) (Ubuntu-4\S*)$">
986
990
  <description>OpenSSH running on Ubuntu 16.04 (vivid)</description>
987
991
  <example service.version="7.2p2" openssh.comment="Ubuntu-4ubuntu2.7">OpenSSH_7.2p2 Ubuntu-4ubuntu2.7</example>
992
+ <example service.version="7.2p2" openssh.comment="Ubuntu-4ubuntu1">OpenSSH_7.2p2 Ubuntu-4ubuntu1</example>
993
+ <example service.version="7.2p2" openssh.comment="Ubuntu-4">OpenSSH_7.2p2 Ubuntu-4</example>
988
994
  <param pos="1" name="service.version"/>
989
995
  <param pos="2" name="openssh.comment"/>
990
996
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1030,9 +1036,10 @@
1030
1036
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:17.04"/>
1031
1037
  </fingerprint>
1032
1038
 
1033
- <fingerprint pattern="^OpenSSH_(7\.5p1) (Ubuntu-10ubuntu\d(?:\.\d)?)$">
1039
+ <fingerprint pattern="^OpenSSH_(7\.5p1) (Ubuntu-10\S*)$">
1034
1040
  <description>OpenSSH running on Ubuntu 17.10</description>
1035
1041
  <example service.version="7.5p1" openssh.comment="Ubuntu-10ubuntu0.1">OpenSSH_7.5p1 Ubuntu-10ubuntu0.1</example>
1042
+ <example service.version="7.5p1" openssh.comment="Ubuntu-10">OpenSSH_7.5p1 Ubuntu-10</example>
1036
1043
  <param pos="1" name="service.version"/>
1037
1044
  <param pos="2" name="openssh.comment"/>
1038
1045
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1046,9 +1053,10 @@
1046
1053
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:17.10"/>
1047
1054
  </fingerprint>
1048
1055
 
1049
- <fingerprint pattern="^OpenSSH_(7\.6p1) (Ubuntu-4ubuntu\d(?:\.\d)?)$">
1056
+ <fingerprint pattern="^OpenSSH_(7\.6p1) (Ubuntu-4\S*)$">
1050
1057
  <description>OpenSSH running on Ubuntu 18.04</description>
1051
1058
  <example service.version="7.6p1" openssh.comment="Ubuntu-4ubuntu0.3">OpenSSH_7.6p1 Ubuntu-4ubuntu0.3</example>
1059
+ <example service.version="7.6p1" openssh.comment="Ubuntu-4">OpenSSH_7.6p1 Ubuntu-4</example>
1052
1060
  <param pos="1" name="service.version"/>
1053
1061
  <param pos="2" name="openssh.comment"/>
1054
1062
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1062,9 +1070,10 @@
1062
1070
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:18.04"/>
1063
1071
  </fingerprint>
1064
1072
 
1065
- <fingerprint pattern="^OpenSSH_(7\.7p1) (Ubuntu-4)$">
1073
+ <fingerprint pattern="^OpenSSH_(7\.7p1) (Ubuntu-4\S*)$">
1066
1074
  <description>OpenSSH running on Ubuntu 18.10</description>
1067
1075
  <example service.version="7.7p1" openssh.comment="Ubuntu-4">OpenSSH_7.7p1 Ubuntu-4</example>
1076
+ <example service.version="7.7p1" openssh.comment="Ubuntu-4ubuntu0.3">OpenSSH_7.7p1 Ubuntu-4ubuntu0.3</example>
1068
1077
  <param pos="1" name="service.version"/>
1069
1078
  <param pos="2" name="openssh.comment"/>
1070
1079
  <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1110,6 +1119,39 @@
1110
1119
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:19.10"/>
1111
1120
  </fingerprint>
1112
1121
 
1122
+ <fingerprint pattern="^OpenSSH_(8\.2p1) (Ubuntu-4\S*)$">
1123
+ <description>OpenSSH running on Ubuntu 20.04</description>
1124
+ <example service.version="8.2p1" openssh.comment="Ubuntu-4ubuntu0.1">OpenSSH_8.2p1 Ubuntu-4ubuntu0.1</example>
1125
+ <example service.version="8.2p1" openssh.comment="Ubuntu-4">OpenSSH_8.2p1 Ubuntu-4</example>
1126
+ <param pos="1" name="service.version"/>
1127
+ <param pos="2" name="openssh.comment"/>
1128
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1129
+ <param pos="0" name="service.family" value="OpenSSH"/>
1130
+ <param pos="0" name="service.product" value="OpenSSH"/>
1131
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1132
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
1133
+ <param pos="0" name="os.family" value="Linux"/>
1134
+ <param pos="0" name="os.product" value="Linux"/>
1135
+ <param pos="0" name="os.version" value="20.04"/>
1136
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:20.04"/>
1137
+ </fingerprint>
1138
+
1139
+ <fingerprint pattern="^OpenSSH_(8\.3p1) (Ubuntu-1\S*)$">
1140
+ <description>OpenSSH running on Ubuntu 20.10</description>
1141
+ <example service.version="8.3p1" openssh.comment="Ubuntu-1">OpenSSH_8.3p1 Ubuntu-1</example>
1142
+ <param pos="1" name="service.version"/>
1143
+ <param pos="2" name="openssh.comment"/>
1144
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1145
+ <param pos="0" name="service.family" value="OpenSSH"/>
1146
+ <param pos="0" name="service.product" value="OpenSSH"/>
1147
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1148
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
1149
+ <param pos="0" name="os.family" value="Linux"/>
1150
+ <param pos="0" name="os.product" value="Linux"/>
1151
+ <param pos="0" name="os.version" value="20.10"/>
1152
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:20.10"/>
1153
+ </fingerprint>
1154
+
1113
1155
  <fingerprint pattern="^OpenSSH_([^\s]+)\s+(Ubuntu-\d\d?)$">
1114
1156
  <description>OpenSSH running on Ubuntu (unknown release)</description>
1115
1157
  <example service.version="7.6p1" openssh.comment="Ubuntu-2">OpenSSH_7.6p1 Ubuntu-2</example>
@@ -1329,9 +1371,56 @@
1329
1371
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:9.0"/>
1330
1372
  </fingerprint>
1331
1373
 
1332
- <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10|Debian-\d\d?\+deb10u\d+)$">
1333
- <description>OpenSSH running on Debian 10.x (buster)</description>
1374
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10)$">
1375
+ <description>OpenSSH running on Debian 10.0 (buster)</description>
1334
1376
  <example service.version="7.9p1" openssh.comment="Debian-10">OpenSSH_7.9p1 Debian-10</example>
1377
+ <param pos="1" name="service.version"/>
1378
+ <param pos="2" name="openssh.comment"/>
1379
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1380
+ <param pos="0" name="service.family" value="OpenSSH"/>
1381
+ <param pos="0" name="service.product" value="OpenSSH"/>
1382
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1383
+ <param pos="0" name="os.vendor" value="Debian"/>
1384
+ <param pos="0" name="os.family" value="Linux"/>
1385
+ <param pos="0" name="os.product" value="Linux"/>
1386
+ <param pos="0" name="os.version" value="10.0"/>
1387
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.0"/>
1388
+ </fingerprint>
1389
+
1390
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10\+deb10u1)$">
1391
+ <description>OpenSSH running on Debian 10.1 (buster)</description>
1392
+ <example service.version="7.9p1" openssh.comment="Debian-10+deb10u1">OpenSSH_7.9p1 Debian-10+deb10u1</example>
1393
+ <param pos="1" name="service.version"/>
1394
+ <param pos="2" name="openssh.comment"/>
1395
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1396
+ <param pos="0" name="service.family" value="OpenSSH"/>
1397
+ <param pos="0" name="service.product" value="OpenSSH"/>
1398
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1399
+ <param pos="0" name="os.vendor" value="Debian"/>
1400
+ <param pos="0" name="os.family" value="Linux"/>
1401
+ <param pos="0" name="os.product" value="Linux"/>
1402
+ <param pos="0" name="os.version" value="10.1"/>
1403
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.1"/>
1404
+ </fingerprint>
1405
+
1406
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10\+deb10u2)$">
1407
+ <description>OpenSSH running on Debian 10.2 (buster)</description>
1408
+ <example service.version="7.9p1" openssh.comment="Debian-10+deb10u2">OpenSSH_7.9p1 Debian-10+deb10u2</example>
1409
+ <param pos="1" name="service.version"/>
1410
+ <param pos="2" name="openssh.comment"/>
1411
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1412
+ <param pos="0" name="service.family" value="OpenSSH"/>
1413
+ <param pos="0" name="service.product" value="OpenSSH"/>
1414
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:openssh:{service.version}"/>
1415
+ <param pos="0" name="os.vendor" value="Debian"/>
1416
+ <param pos="0" name="os.family" value="Linux"/>
1417
+ <param pos="0" name="os.product" value="Linux"/>
1418
+ <param pos="0" name="os.version" value="10.2"/>
1419
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.2"/>
1420
+ </fingerprint>
1421
+
1422
+ <fingerprint pattern="^OpenSSH_(7\.9p1) (Debian-10\S+)$">
1423
+ <description>OpenSSH running on Debian 10.x (buster catchall)</description>
1335
1424
  <example service.version="7.9p1" openssh.comment="Debian-10+deb10u6">OpenSSH_7.9p1 Debian-10+deb10u6</example>
1336
1425
  <param pos="1" name="service.version"/>
1337
1426
  <param pos="2" name="openssh.comment"/>
@@ -2019,7 +2108,12 @@
2019
2108
  <param pos="0" name="os.vendor" value="NetApp"/>
2020
2109
  <param pos="0" name="os.family" value="Data ONTAP"/>
2021
2110
  <param pos="0" name="os.product" value="Data ONTAP"/>
2111
+ <param pos="0" name="os.device" value="NAS"/>
2022
2112
  <param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:-"/>
2113
+ <param pos="0" name="hw.vendor" value="NetApp"/>
2114
+ <param pos="0" name="hw.family" value="Data ONTAP"/>
2115
+ <param pos="0" name="hw.product" value="Data ONTAP"/>
2116
+ <param pos="0" name="hw.device" value="NAS"/>
2023
2117
  </fingerprint>
2024
2118
 
2025
2119
  <fingerprint pattern="^(\d\.\d+\.\d+) SSH Secure Shell OpenVMS V\d+\.\d+$">
@@ -2125,6 +2219,19 @@
2125
2219
  <param pos="0" name="service.product" value="WeOnlyDo SSH Server"/>
2126
2220
  </fingerprint>
2127
2221
 
2222
+ <fingerprint pattern="^Zyxel SSH server$">
2223
+ <description>Zyxel Firewall SSH service</description>
2224
+ <example>Zyxel SSH server</example>
2225
+ <param pos="0" name="service.vendor" value="Zyxel"/>
2226
+ <param pos="0" name="service.family" value="Zywall"/>
2227
+ <param pos="0" name="os.vendor" value="Zyxel"/>
2228
+ <param pos="0" name="os.product" value="ZyNOS firmware"/>
2229
+ <param pos="0" name="os.cpe23" value="cpe:/o:zyxel:zynos_firmware:-"/>
2230
+ <param pos="0" name="hw.vendor" value="Zyxel"/>
2231
+ <param pos="0" name="hw.device" value="Firewall"/>
2232
+ <param pos="0" name="hw.family" value="Unified Security Gateway"/>
2233
+ </fingerprint>
2234
+
2128
2235
  <!--
2129
2236
  1.2.22j4rad
2130
2237
  2.40
data/xml/telnet_banners.xml CHANGED
@@ -1235,7 +1235,7 @@
1235
1235
  </fingerprint>
1236
1236
 
1237
1237
  <fingerprint pattern="^Welcome to ViewStation">
1238
- <description>Polycom ViewStation Video Vonference System</description>
1238
+ <description>Polycom ViewStation Video Conference System</description>
1239
1239
  <!-- Welcome to ViewStation\nPassword: -->
1240
1240
 
1241
1241
  <example _encoding="base64">
@@ -1492,7 +1492,12 @@
1492
1492
  <param pos="0" name="os.vendor" value="NetApp"/>
1493
1493
  <param pos="0" name="os.family" value="Data ONTAP"/>
1494
1494
  <param pos="0" name="os.product" value="Data ONTAP"/>
1495
+ <param pos="0" name="os.device" value="NAS"/>
1495
1496
  <param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:-"/>
1497
+ <param pos="0" name="hw.vendor" value="NetApp"/>
1498
+ <param pos="0" name="hw.family" value="Data ONTAP"/>
1499
+ <param pos="0" name="hw.product" value="Data ONTAP"/>
1500
+ <param pos="0" name="hw.device" value="NAS"/>
1496
1501
  </fingerprint>
1497
1502
 
1498
1503
  <fingerprint pattern="OpenVMS.*Version\sV([^\s]+).*">
@@ -2066,4 +2071,23 @@
2066
2071
  <param pos="0" name="service.component.cpe23" value="cpe:/a:sap:netweaver_application_server:-"/>
2067
2072
  </fingerprint>
2068
2073
 
2074
+ <fingerprint pattern="^(?:\r|\n|\s)*UDP/TCP/IP Stack: ACT Video security">
2075
+ <description>ACT Security IP Cameras</description>
2076
+ <!--
2077
+ UDP/TCP/IP Stack: ACT Video security\r\n
2078
+ V5.8\r\n
2079
+ Welcome connection : 192.168.0.1:61300\r\n
2080
+ \r\n
2081
+ Password:
2082
+ -->
2083
+
2084
+ <example _encoding="base64">
2085
+ VURQL1RDUC9JUCBTdGFjazogQUNUIFZpZGVvIHNlY3VyaXR5DQpWNS44DQpX
2086
+ ZWxjb21lIGNvbm5lY3Rpb24gOiAxOTIuMTY4LjAuMTo2MTMwMA0KDQpQYXNz
2087
+ d29yZDog
2088
+ </example>
2089
+ <param pos="0" name="hw.vendor" value="ACT Security"/>
2090
+ <param pos="0" name="hw.device" value="IP Camera"/>
2091
+ </fingerprint>
2092
+
2069
2093
  </fingerprints>
data/xml/tls_jarm.xml ADDED
@@ -0,0 +1,139 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <fingerprints matches="tls.jarm" protocol="tls" database_type="service">
3
+ <!--
4
+ Fingerprint based on https://github.com/salesforce/jarm
5
+ -->
6
+
7
+ <fingerprint pattern="^2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa|2ad2ad16d2ad2ad22c2ad2ad2ad2adce2e4c8c53174ecbf5529ce7584d5518$|2ad2ad16d2ad2ad22c42d42d000000d342d5966a57139eeaff9f8bc4841b25$">
8
+ <description>Tor relay</description>
9
+ <example>2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa</example>
10
+ <example>2ad2ad16d2ad2ad22c2ad2ad2ad2adce2e4c8c53174ecbf5529ce7584d5518</example>
11
+ <example>2ad2ad16d2ad2ad22c42d42d000000d342d5966a57139eeaff9f8bc4841b25</example>
12
+ <param pos="0" name="service.product" value="Tor"/>
13
+ <param pos="0" name="service.vendor" value="Tor Project"/>
14
+ <param pos="0" name="service.cpe23" value="cpe:/a:torproject:tor:-"/>
15
+ </fingerprint>
16
+
17
+ <fingerprint pattern="^2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d$">
18
+ <description>Synology NAS</description>
19
+ <example>2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d</example>
20
+ <param pos="0" name="os.device" value="NAS"/>
21
+ <param pos="0" name="os.family" value="Linux"/>
22
+ <param pos="0" name="os.product" value="DSM"/>
23
+ <param pos="0" name="os.vendor" value="Synology"/>
24
+ <param pos="0" name="hw.vendor" value="Synology"/>
25
+ <param pos="0" name="hw.device" value="NAS"/>
26
+ </fingerprint>
27
+
28
+ <fingerprint pattern="^2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef$">
29
+ <description>Ubiquiti EdgeRouter</description>
30
+ <example>2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef</example>
31
+ <param pos="0" name="hw.vendor" value="Ubiquiti"/>
32
+ <param pos="0" name="hw.device" value="Router"/>
33
+ <param pos="0" name="hw.Product" value="EdgeRouter X"/>
34
+ <param pos="0" name="os.vendor" value="Ubiquiti"/>
35
+ <param pos="0" name="os.family" value="Linux"/>
36
+ <param pos="0" name="os.device" value="Router"/>
37
+ </fingerprint>
38
+
39
+ <fingerprint pattern="^07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d$">
40
+ <description>Metasploit listener</description>
41
+ <example>07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d</example>
42
+ <param pos="0" name="service.vendor" value="Rapid7"/>
43
+ <param pos="0" name="service.product" value="Metasploit"/>
44
+ <param pos="0" name="service.cpe23" value="cpe:/a:rapid7:metasploit:-"/>
45
+ </fingerprint>
46
+
47
+ <!-- This fingerprint matches Java's TLS stack,
48
+ see https://blog.cobaltstrike.com/2020/12/08/a-red-teamer-plays-with-jarm/ for details -->
49
+
50
+ <fingerprint pattern="^07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1$">
51
+ <description>Cobalt Strike listener</description>
52
+ <example>07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1</example>
53
+ <param pos="0" name="service.vendor" value="Strategic Cyber LLC"/>
54
+ <param pos="0" name="service.product" value="Cobalt Strike Listener"/>
55
+ <param pos="0" name="service.certainty" value="0.3"/>
56
+ </fingerprint>
57
+
58
+ <fingerprint pattern="^04b02b00004b04b04b04b02b04b04b9674c6b4e623ae36cc2d998e99e2262e$">
59
+ <description>Ligowave WiFi access point</description>
60
+ <example>04b02b00004b04b04b04b02b04b04b9674c6b4e623ae36cc2d998e99e2262e</example>
61
+ <param pos="0" name="hw.vendor" value="Ligowave"/>
62
+ <param pos="0" name="hw.product" value="Infinity Controler"/>
63
+ </fingerprint>
64
+
65
+ <fingerprint pattern="^06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d$">
66
+ <description>D-Link DCS-825L WiFi baby camera</description>
67
+ <example>06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d</example>
68
+ <param pos="0" name="hw.vendor" value="D-Link"/>
69
+ <param pos="0" name="hw.product" value="DCS-825L"/>
70
+ </fingerprint>
71
+
72
+ <fingerprint pattern="^0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d$">
73
+ <description>LANCOM Systems - 883 VoIP</description>
74
+ <example>0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d</example>
75
+ <param pos="0" name="hw.vendor" value="LANCOM Systems"/>
76
+ <param pos="0" name="hw.product" value="883 VoIP"/>
77
+ </fingerprint>
78
+
79
+ <fingerprint pattern="^21d14d00021d21d21c42d43d00041d320c989d4ed06a7e9d3133ba36bb2752$">
80
+ <description>Apple CUPS - web interface</description>
81
+ <example>21d14d00021d21d21c42d43d00041d320c989d4ed06a7e9d3133ba36bb2752</example>
82
+ <param pos="0" name="service.vendor" value="Apple"/>
83
+ <param pos="0" name="service.product" value="CUPS"/>
84
+ <param pos="0" name="service.family" value="CUPS"/>
85
+ <param pos="0" name="service.cpe23" value="cpe:/a:apple:cups:-"/>
86
+ </fingerprint>
87
+
88
+ <fingerprint pattern="^0bd14d0000bd0bd0000bd14d0bd0bd6b64279c20472e17718ddea38ab610fa$">
89
+ <description>Netgear R Series</description>
90
+ <example>0bd14d0000bd0bd0000bd14d0bd0bd6b64279c20472e17718ddea38ab610fa</example>
91
+ <param pos="0" name="hw.vendor" value="Netgear"/>
92
+ <param pos="0" name="hw.product" value="R Series"/>
93
+ </fingerprint>
94
+
95
+ <fingerprint pattern="^2ad2ad16d2ad2ad07c2ad2ad2ad2ad4271ee10d978b0aecbc22f1de60ab611$">
96
+ <description>Netgear Orbi-micro</description>
97
+ <example>2ad2ad16d2ad2ad07c2ad2ad2ad2ad4271ee10d978b0aecbc22f1de60ab611</example>
98
+ <param pos="0" name="hw.vendor" value="Netgear"/>
99
+ <param pos="0" name="hw.product" value="Orbi micro"/>
100
+ <param pos="0" name="hw.device" value="WAP"/>
101
+ <param pos="0" name="hw.family" value="Orbi"/>
102
+ </fingerprint>
103
+
104
+ <fingerprint pattern="^04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e$">
105
+ <description>Netgear D Series</description>
106
+ <example>04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e</example>
107
+ <param pos="0" name="hw.vendor" value="Netgear"/>
108
+ <param pos="0" name="hw.product" value="D Series"/>
109
+ </fingerprint>
110
+
111
+ <fingerprint pattern="^21d3fd00021d21d21c21d3fd21d21d89188428dae58757cf803176e9701156$">
112
+ <description>Chromecast</description>
113
+ <example>21d3fd00021d21d21c21d3fd21d21d89188428dae58757cf803176e9701156</example>
114
+ <param pos="0" name="os.vendor" value="Google"/>
115
+ <param pos="0" name="os.product" value="Chrome OS"/>
116
+ <param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
117
+ <param pos="0" name="hw.device" value="Media Server"/>
118
+ <param pos="0" name="hw.vendor" value="Google"/>
119
+ <param pos="0" name="hw.product" value="Chromecast"/>
120
+ </fingerprint>
121
+
122
+ <fingerprint pattern="^21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601$">
123
+ <description>VMWare ESXi</description>
124
+ <example>21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601</example>
125
+ <param pos="0" name="os.vendor" value="VMware"/>
126
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
127
+ <param pos="0" name="os.product" value="ESXi"/>
128
+ <param pos="0" name="os.device" value="Hypervisor"/>
129
+ <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
130
+ <param pos="0" name="hw.device" value="Hypervisor"/>
131
+ </fingerprint>
132
+
133
+ <fingerprint pattern="^29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38$">
134
+ <description>Merlin C2</description>
135
+ <example>29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38</example>
136
+ <param pos="0" name="service.product" value="Merlin"/>
137
+ </fingerprint>
138
+
139
+ </fingerprints>
data/xml/x509_issuers.xml CHANGED
@@ -15,10 +15,12 @@
15
15
  <example>CN=Eureka Gen1 ICA,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
16
16
  <param pos="0" name="os.vendor" value="Google"/>
17
17
  <param pos="0" name="os.product" value="Chrome OS"/>
18
+ <param pos="0" name="os.certainty" value="0.5"/>
18
19
  <param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
19
20
  <param pos="0" name="hw.device" value="Media Server"/>
20
21
  <param pos="0" name="hw.vendor" value="Google"/>
21
22
  <param pos="0" name="hw.product" value="Chromecast"/>
23
+ <param pos="0" name="hw.certainty" value="0.5"/>
22
24
  <param pos="0" name="chromecast.generation" value="1"/>
23
25
  </fingerprint>
24
26
 
@@ -34,10 +36,12 @@
34
36
  <example chromecast.generation="12">CN=Chromecast ICA 12,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
35
37
  <param pos="0" name="os.vendor" value="Google"/>
36
38
  <param pos="0" name="os.product" value="Chrome OS"/>
39
+ <param pos="0" name="os.certainty" value="0.5"/>
37
40
  <param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
38
41
  <param pos="0" name="hw.device" value="Media Server"/>
39
42
  <param pos="0" name="hw.vendor" value="Google"/>
40
43
  <param pos="0" name="hw.product" value="Chromecast"/>
44
+ <param pos="0" name="hw.certainty" value="0.5"/>
41
45
  <param pos="1" name="chromecast.generation"/>
42
46
  <param pos="2" name="chromecast.capabilities"/>
43
47
  </fingerprint>
@@ -134,6 +138,7 @@
134
138
  <param pos="0" name="os.product" value="ESXi"/>
135
139
  <param pos="0" name="os.device" value="Hypervisor"/>
136
140
  <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
141
+ <param pos="0" name="hw.device" value="Hypervisor"/>
137
142
  </fingerprint>
138
143
 
139
144
  <fingerprint pattern="^CN=CA,OU=VMware Engineering,O=vCenter,ST=California,C=US$">
@@ -158,4 +163,15 @@
158
163
  <param pos="0" name="os.product" value="iLO"/>
159
164
  </fingerprint>
160
165
 
166
+ <fingerprint pattern="^CN=synology.com,O=Synology Inc.,L=Taipei,C=TW$">
167
+ <description>Synology</description>
168
+ <example>CN=synology.com,O=Synology Inc.,L=Taipei,C=TW</example>
169
+ <param pos="0" name="os.device" value="NAS"/>
170
+ <param pos="0" name="os.family" value="Linux"/>
171
+ <param pos="0" name="os.product" value="DSM"/>
172
+ <param pos="0" name="os.vendor" value="Synology"/>
173
+ <param pos="0" name="hw.vendor" value="Synology"/>
174
+ <param pos="0" name="hw.device" value="NAS"/>
175
+ </fingerprint>
176
+
161
177
  </fingerprints>