recog 2.3.18 → 2.3.22

Sign up to get free protection for your applications and to get access to all the features.
Files changed (73) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/ci.yml +26 -0
  4. data/.github/workflows/verify.yml +89 -0
  5. data/CONTRIBUTING.md +6 -0
  6. data/README.md +17 -0
  7. data/bin/recog_standardize +33 -12
  8. data/bin/recog_verify +1 -2
  9. data/cpe-remap.yaml +355 -200
  10. data/features/verify.feature +14 -14
  11. data/identifiers/README.md +24 -10
  12. data/identifiers/fields.txt +105 -0
  13. data/identifiers/hw_device.txt +8 -0
  14. data/identifiers/hw_family.txt +19 -0
  15. data/identifiers/hw_product.txt +122 -0
  16. data/identifiers/os_device.txt +2 -1
  17. data/identifiers/os_family.txt +3 -0
  18. data/identifiers/os_product.txt +46 -8
  19. data/identifiers/service_family.txt +10 -1
  20. data/identifiers/service_product.txt +90 -2
  21. data/identifiers/vendor.txt +104 -0
  22. data/lib/recog/db.rb +2 -1
  23. data/lib/recog/fingerprint.rb +18 -5
  24. data/lib/recog/nizer.rb +1 -82
  25. data/lib/recog/verifier.rb +5 -5
  26. data/lib/recog/verifier_factory.rb +3 -3
  27. data/lib/recog/verify_reporter.rb +14 -4
  28. data/lib/recog/version.rb +1 -1
  29. data/requirements.txt +1 -1
  30. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  31. data/spec/lib/recog/verify_reporter_spec.rb +69 -0
  32. data/tools/dev/hooks/pre-commit +21 -0
  33. data/update_cpes.py +19 -6
  34. data/xml/apache_modules.xml +60 -0
  35. data/xml/apache_os.xml +38 -38
  36. data/xml/dhcp_vendor_class.xml +206 -0
  37. data/xml/dns_versionbind.xml +11 -1
  38. data/xml/favicons.xml +270 -45
  39. data/xml/ftp_banners.xml +89 -64
  40. data/xml/h323_callresp.xml +99 -99
  41. data/xml/hp_pjl_id.xml +3 -3
  42. data/xml/html_title.xml +1051 -62
  43. data/xml/http_cookies.xml +294 -85
  44. data/xml/http_servers.xml +551 -122
  45. data/xml/http_wwwauth.xml +139 -43
  46. data/xml/imap_banners.xml +8 -8
  47. data/xml/ldap_searchresult.xml +1 -0
  48. data/xml/mdns_device-info_txt.xml +720 -27
  49. data/xml/mysql_banners.xml +3 -2
  50. data/xml/nntp_banners.xml +4 -4
  51. data/xml/ntp_banners.xml +79 -65
  52. data/xml/operating_system.xml +6 -6
  53. data/xml/pop_banners.xml +11 -11
  54. data/xml/rsh_resp.xml +3 -3
  55. data/xml/rtsp_servers.xml +7 -0
  56. data/xml/sip_banners.xml +374 -9
  57. data/xml/sip_user_agents.xml +377 -5
  58. data/xml/smb_native_lm.xml +32 -1
  59. data/xml/smb_native_os.xml +160 -33
  60. data/xml/smtp_banners.xml +168 -129
  61. data/xml/smtp_ehlo.xml +1 -1
  62. data/xml/smtp_expn.xml +1 -0
  63. data/xml/smtp_help.xml +10 -10
  64. data/xml/smtp_noop.xml +2 -2
  65. data/xml/smtp_vrfy.xml +1 -0
  66. data/xml/snmp_sysdescr.xml +508 -214
  67. data/xml/snmp_sysobjid.xml +25 -25
  68. data/xml/ssh_banners.xml +145 -29
  69. data/xml/telnet_banners.xml +240 -61
  70. data/xml/tls_jarm.xml +162 -0
  71. data/xml/x509_issuers.xml +237 -2
  72. data/xml/x509_subjects.xml +369 -49
  73. metadata +10 -3
data/xml/http_cookies.xml CHANGED
@@ -5,8 +5,71 @@
5
5
  servers.
6
6
  -->
7
7
 
8
- <fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=.*">
8
+ <fingerprint pattern="^__cfd?uid=">
9
+ <description>CloudFlare web load balancer endpoint</description>
10
+ <example>__cfuid=1337</example>
11
+ <example>__cfduid=dd450f2431e1e611a61a15f68974de9a41618794671; expires=Wed, 19-May-21 01:11:11 GMT; path=/; domain=.foo.bar; HttpOnly; SameSite=Lax</example>
12
+ <param pos="0" name="service.vendor" value="CloudFlare"/>
13
+ <param pos="0" name="service.product" value="CloudFlare Load Balancer"/>
14
+ <param pos="0" name="service.family" value="CloudFlare"/>
15
+ <param pos="0" name="service.cpe23" value="cpe:/a:cloudflare:load_balancing:-"/>
16
+ </fingerprint>
17
+
18
+ <fingerprint pattern="^(AWSALB(?:TG)?(?:CORS)?)=">
19
+ <description>Amazon Application Load Balancer</description>
20
+ <example cookie="AWSALB">AWSALB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
21
+ <example cookie="AWSALBCORS">AWSALBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
22
+ <example cookie="AWSALBTGCORS">AWSALBTGCORS=E0+uuQyz1jbU2P5jrIIWTuoK0aAbjfgsuA814N0xT5w9Vu4N61/CZTKT+yxwCfUqIUx/IgZfsDyA24+eSXKFO60aqEbtGPw2Mm4bGNDMVpcZ/yKHzifDPjT7mNQvNVq7xCAed5VgTpMH/nD3D2pLn9+ooJcShVgv+z97rSYAV5C98tecx6Q=; Expires=Mon, 10 May 2021 01:21:27 GMT; Path=/; SameSite=None; Secure</example>
23
+ <param pos="1" name="cookie"/>
24
+ <param pos="0" name="service.vendor" value="Amazon"/>
25
+ <param pos="0" name="service.family" value="Web Services"/>
26
+ <param pos="0" name="service.product" value="Application Load Balancer"/>
27
+ </fingerprint>
28
+
29
+ <fingerprint pattern="^(AWSELB(?:CORS)?)=">
30
+ <description>Amazon Elastic Load Balancer</description>
31
+ <example cookie="AWSELB">AWSELB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
32
+ <example cookie="AWSELBCORS">AWSELBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
33
+ <param pos="1" name="cookie"/>
34
+ <param pos="0" name="service.vendor" value="Amazon"/>
35
+ <param pos="0" name="service.family" value="Web Services"/>
36
+ <param pos="0" name="service.product" value="Elastic Load Balancer"/>
37
+ </fingerprint>
38
+
39
+ <fingerprint pattern="^(PHPSESSI(?:D|ON))=">
40
+ <description>PHP - http://www.php.net/ref.session</description>
41
+ <example cookie="PHPSESSID">PHPSESSID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
42
+ <example cookie="PHPSESSION">PHPSESSION=vt2ag6n7t6ngvlg8adk4860h46; path=/</example>
43
+ <param pos="1" name="cookie"/>
44
+ <param pos="0" name="service.vendor" value="PHP"/>
45
+ <param pos="0" name="service.family" value="PHP"/>
46
+ <param pos="0" name="service.product" value="PHP"/>
47
+ <param pos="0" name="service.cpe23" value="cpe:/a:php:php:-"/>
48
+ </fingerprint>
49
+
50
+ <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=">
51
+ <description>Microsoft IIS (ASP.NET)
52
+ http://msdn2.microsoft.com/en-us/library/ms953828.aspx
53
+ http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
54
+ </description>
55
+ <example cookie="ASPSESSIONIDQSBRRTTB">ASPSESSIONIDQSBRRTTB=BECILMBCPMGHJGAHKCHNGENF; path=/</example>
56
+ <example cookie="ASP.NET_SessionId">ASP.NET_SessionId=00nxm4qqh2tdjl0p52m10edv</example>
57
+ <example cookie=".ASPXANONYMOUS">.ASPXANONYMOUS=5ts5UmJr1wEkAAAAMmY0Y2EwNTUtZGZhYi00YTFlLTlmNzAtYmEwNjdiYTgxZDA40; expires=Sun, 27-Jun-2021 14:40:06 GMT; path=/; HttpOnly</example>
58
+ <param pos="1" name="cookie"/>
59
+ <param pos="0" name="service.vendor" value="Microsoft"/>
60
+ <param pos="0" name="service.family" value="IIS"/>
61
+ <param pos="0" name="service.product" value="IIS"/>
62
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:-"/>
63
+ <param pos="0" name="service.component.vendor" value="Microsoft"/>
64
+ <param pos="0" name="service.component.family" value="ASP.NET"/>
65
+ <param pos="0" name="service.component.product" value="ASP.NET"/>
66
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:microsoft:asp.net:-"/>
67
+ </fingerprint>
68
+
69
+ <fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=">
9
70
  <description>Adobe (Macromedia) ColdFusion uses various cookies</description>
71
+ <example cookie="CFTOKEN">CFTOKEN=f3863673461e83d7-8B854468-1866-DAAC-99FBB842C6018037;expires=Mon, 01-Aug-2050 01:05:45 GMT;path=/;HttpOnly;</example>
72
+ <example cookie="CFCLIENT_FOO_CORP">CFCLIENT_FOO_CORP=preflanguage%3DEN%23; Expires=Wed, 12-Apr-2051 01:11:37 GMT; Path=/</example>
10
73
  <param pos="1" name="cookie"/>
11
74
  <param pos="0" name="service.vendor" value="Adobe"/>
12
75
  <param pos="0" name="service.family" value="ColdFusion"/>
@@ -14,7 +77,7 @@
14
77
  <param pos="0" name="service.cpe23" value="cpe:/a:adobe:coldfusion:-"/>
15
78
  </fingerprint>
16
79
 
17
- <fingerprint pattern="^ANsession\d+=(\S+);.*">
80
+ <fingerprint pattern="^ANsession\d+=(\S+);">
18
81
  <description>Array Networks Secure Access Gateway / SSL VPN</description>
19
82
  <example>ANsession0002262072457555=IPMI; path=/;secure</example>
20
83
  <param pos="1" name="cookie"/>
@@ -23,7 +86,7 @@
23
86
  <param pos="0" name="hw.device" value="VPN"/>
24
87
  </fingerprint>
25
88
 
26
- <fingerprint pattern="^(Apache)=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]+);.*">
89
+ <fingerprint pattern="^(Apache)=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]+);">
27
90
  <description>Apache</description>
28
91
  <param pos="1" name="cookie"/>
29
92
  <param pos="2" name="system.time.micros"/>
@@ -33,23 +96,34 @@
33
96
  <param pos="0" name="service.cpe23" value="cpe:/a:apache:http_server:-"/>
34
97
  </fingerprint>
35
98
 
36
- <fingerprint pattern="^(JServSessionIdroot)=.*">
99
+ <fingerprint pattern="^JServSessionIdroot=">
37
100
  <description>Apache JServ</description>
38
- <param pos="1" name="cookie"/>
101
+ <example>JServSessionIdroot=tphxjy73e1.JS1; path=/</example>
102
+ <param pos="0" name="cookie" value="JServSessionIdroot"/>
39
103
  <param pos="0" name="service.vendor" value="Apache"/>
40
104
  <param pos="0" name="service.family" value="JServ"/>
41
105
  <param pos="0" name="service.product" value="JServ"/>
42
106
  </fingerprint>
43
107
 
44
- <fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=.*">
108
+ <fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=">
45
109
  <description>ATG Dynamo</description>
110
+ <example cookie="ATG_SESSION_ID">ATG_SESSION_ID=yuAUs8xnkzLaF8P3Zk1v5hR28XB4dKsOKZ4jCkVO; path=/</example>
46
111
  <param pos="1" name="cookie"/>
47
112
  <param pos="0" name="service.vendor" value="ATG"/>
48
113
  <param pos="0" name="service.family" value="Dynamo"/>
49
114
  <param pos="0" name="service.product" value="Dynamo"/>
50
115
  </fingerprint>
51
116
 
52
- <fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);.*">
117
+ <fingerprint pattern="^Bugzilla_login_request_cookie=">
118
+ <description>Bugzilla</description>
119
+ <example>Bugzilla_login_request_cookie=ylMVo9ZDtd; path=/; secure</example>
120
+ <param pos="0" name="cookie" value="Bugzilla_login_request_cookie"/>
121
+ <param pos="0" name="service.vendor" value="Mozilla"/>
122
+ <param pos="0" name="service.product" value="Bugzilla"/>
123
+ <param pos="0" name="service.cpe23" value="cpe:/a:mozilla:bugzilla:-"/>
124
+ </fingerprint>
125
+
126
+ <fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);">
53
127
  <description>BEA WebLogic (with timestamp)</description>
54
128
  <param pos="1" name="cookie"/>
55
129
  <param pos="2" name="system.time.millis"/>
@@ -59,7 +133,7 @@
59
133
  <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
60
134
  </fingerprint>
61
135
 
62
- <fingerprint pattern="^(WebLogicSession)=.*">
136
+ <fingerprint pattern="^(WebLogicSession)=">
63
137
  <description>BEA WebLogic (no timestamp)</description>
64
138
  <param pos="1" name="cookie"/>
65
139
  <param pos="0" name="service.vendor" value="BEA"/>
@@ -68,7 +142,7 @@
68
142
  <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
69
143
  </fingerprint>
70
144
 
71
- <fingerprint pattern="^(BCSI-CSC[0-9A-Za-z]+)=.*">
145
+ <fingerprint pattern="^(BCSI-CSC[0-9A-Za-z]+)=">
72
146
  <description>BlueCoat Proxy</description>
73
147
  <param pos="1" name="cookie"/>
74
148
  <param pos="0" name="service.vendor" value="Blue Coat"/>
@@ -76,9 +150,10 @@
76
150
  <param pos="0" name="service.product" value="Proxy"/>
77
151
  </fingerprint>
78
152
 
79
- <fingerprint pattern="^(CAKEPHP)=.*">
153
+ <fingerprint pattern="^CAKEPHP=">
80
154
  <description>CakePHP - http://www.cakephp.org/</description>
81
- <param pos="1" name="cookie"/>
155
+ <example>CAKEPHP=03bgv7jqfurftnm5crn3lc0ob1; expires=Mon, 19-Apr-2021 08:56:06 GMT; Max-Age=14400; path=/; HttpOnly</example>
156
+ <param pos="0" name="cookie" value="CAKEPHP"/>
82
157
  <param pos="0" name="service.family" value="PHP"/>
83
158
  <param pos="0" name="service.product" value="CakePHP"/>
84
159
  </fingerprint>
@@ -88,22 +163,23 @@
88
163
  The cookie value breaks down to [box-id][service-id][timeout-value]
89
164
  unfortunately, there's no separator so it's hard to tell what the
90
165
  actual break is between the pieces of data.
91
- http://www.cisco.com/warp/public/117/AP_cookies.html
92
166
  -->
93
167
 
94
- <fingerprint pattern="^(ARPT)=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+.*">
168
+ <fingerprint pattern="^ARPT=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+">
95
169
  <description>Cisco 11000 Series Content Service Switch (CSS)</description>
96
- <param pos="1" name="cookie"/>
97
- <param pos="2" name="host.id"/>
98
- <param pos="3" name="host.ip"/>
170
+ <example host.name="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
171
+ <param pos="0" name="cookie" value="ARPT"/>
172
+ <param pos="1" name="host.name"/>
173
+ <param pos="2" name="host.ip"/>
99
174
  <param pos="0" name="service.vendor" value="Cisco"/>
100
175
  <param pos="0" name="service.family" value="Content Service Switch"/>
101
176
  <param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
102
177
  </fingerprint>
103
178
 
104
- <fingerprint pattern="^(ARPT)=.*">
179
+ <fingerprint pattern="^ARPT=">
105
180
  <description>Cisco 11000 Series Content Service Switch (CSS) - catch all variant</description>
106
- <param pos="1" name="cookie"/>
181
+ <example>ARPT=388766892.51247.0000; path=/; Httponly/</example>
182
+ <param pos="0" name="cookie" value="ARPT"/>
107
183
  <param pos="0" name="service.vendor" value="Cisco"/>
108
184
  <param pos="0" name="service.family" value="Content Service Switch"/>
109
185
  <param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
@@ -122,7 +198,7 @@
122
198
  <param pos="0" name="os.vendor" value="Cisco"/>
123
199
  <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
124
200
  <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
125
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance:-"/>
201
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
126
202
  <param pos="0" name="hw.vendor" value="Cisco"/>
127
203
  <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
128
204
  <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
@@ -130,15 +206,15 @@
130
206
  <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
131
207
  </fingerprint>
132
208
 
133
- <fingerprint pattern="^(st8id)=.*">
209
+ <fingerprint pattern="^st8id=">
134
210
  <description>Citrix Application Protection System, Enterprise - http://support.citrix.com/article/CTX109330</description>
135
- <param pos="1" name="cookie"/>
211
+ <param pos="0" name="cookie" value="st8id"/>
136
212
  <param pos="0" name="service.vendor" value="Citrix"/>
137
213
  <param pos="0" name="service.family" value="Application Protection System"/>
138
214
  <param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
139
215
  </fingerprint>
140
216
 
141
- <fingerprint pattern="^NSC_(?:AAAC|BASEURL|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS|USER)=.*">
217
+ <fingerprint pattern="^NSC_(?:AAAC|BASEURL|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS|USER)=">
142
218
  <description>Citrix NetScaler</description>
143
219
  <example>NSC_AAAC=xyz;</example>
144
220
  <example>NSC_TEMP=xyz;</example>
@@ -146,6 +222,7 @@
146
222
  <param pos="0" name="os.family" value="NetScaler"/>
147
223
  <param pos="0" name="os.device" value="Network Management Device"/>
148
224
  <param pos="0" name="os.product" value="NetScaler"/>
225
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_firmware:-"/>
149
226
  <param pos="0" name="service.vendor" value="Citrix"/>
150
227
  <param pos="0" name="service.family" value="NetScaler"/>
151
228
  <param pos="0" name="service.device" value="Network Management Device"/>
@@ -165,15 +242,34 @@
165
242
  <param pos="0" name="os.product" value="Pulse Connect Secure"/>
166
243
  </fingerprint>
167
244
 
168
- <fingerprint pattern="^(EktGUID|ecm)=.*">
245
+ <fingerprint pattern="^DokuWiki=">
246
+ <description>Dokuwiki</description>
247
+ <example>DokuWiki=t8l1aev7703vbtejovp165pv01; path=/; secure</example>
248
+ <param pos="0" name="cookie" value="DokuWiki"/>
249
+ <param pos="0" name="service.vendor" value="Dokuwiki"/>
250
+ <param pos="0" name="service.product" value="Dokuwiki"/>
251
+ <param pos="0" name="service.cpe23" value="cpe:/a:dokuwiki:dokuwiki:-"/>
252
+ </fingerprint>
253
+
254
+ <fingerprint pattern="^(EktGUID|ecm)=">
169
255
  <description>Ektron CMS400.net</description>
256
+ <example cookie="EktGUID">EktGUID=382107cc-a38d-4d25-8182-3748834e21c8; expires=Tue, 19-Apr-2022 03:12:15 GMT; path=/</example>
170
257
  <param pos="1" name="cookie"/>
171
258
  <param pos="0" name="service.vendor" value="Ektron"/>
172
259
  <param pos="0" name="service.family" value="CMS400.NET"/>
173
260
  <param pos="0" name="service.product" value="CMS400.NET"/>
174
261
  </fingerprint>
175
262
 
176
- <fingerprint pattern="(?i)^(BIGipServer([^=]+))=.*">
263
+ <fingerprint pattern="^FESESSIONID=">
264
+ <description>Atlanssian's Fisheye</description>
265
+ <example>FESESSIONID=133713381337</example>
266
+ <param pos="0" name="cookie" value="FESESSIONID"/>
267
+ <param pos="0" name="service.vendor" value="Atlassian"/>
268
+ <param pos="0" name="service.product" value="Fisheye"/>
269
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:fisheye:-"/>
270
+ </fingerprint>
271
+
272
+ <fingerprint pattern="(?i)^(BIGipServer([^=]+))=">
177
273
  <description>F5 BIG-IP LTM - Server variant</description>
178
274
  <example loadbalancer.poolname="CustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
179
275
  <param pos="1" name="cookie"/>
@@ -184,8 +280,19 @@
184
280
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
185
281
  </fingerprint>
186
282
 
187
- <fingerprint pattern="^(BigIPCookie)=.*">
283
+ <fingerprint pattern="^i_like_gogits=">
284
+ <description>Gogs</description>
285
+ <example>i_like_gogits=fc3914645f1d5c76; Path=/; HttpOnly</example>
286
+ <param pos="0" name="cookie" value="i_like_gogits"/>
287
+ <param pos="0" name="service.vendor" value="Gogs"/>
288
+ <param pos="0" name="service.product" value="Gogs"/>
289
+ <param pos="0" name="service.cpe23" value="cpe:/a:gogs:gogs:-"/>
290
+ </fingerprint>
291
+
292
+ <fingerprint pattern="^(BigIPCookie[^=]*)=">
188
293
  <description>F5 BIG-IP LTM</description>
294
+ <example cookie="BigIPCookie">BigIPCookie=855248779.20480.0000; path=/; Httponly</example>
295
+ <example cookie="BigIPCookie_foo_corp_prod">BigIPCookie_foo_corp_prod=!tJHKH9zIwsUuJYJ38CCV0XSqmJXsZVQaOjj/m/SBSTQTg21/S+s2gmbsoGwwKXr5Tj9e0ijWZWItfA==; path=/; Httponly</example>
189
296
  <param pos="1" name="cookie"/>
190
297
  <param pos="0" name="service.vendor" value="F5"/>
191
298
  <param pos="0" name="service.family" value="BIG-IP"/>
@@ -193,18 +300,49 @@
193
300
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
194
301
  </fingerprint>
195
302
 
196
- <fingerprint pattern="^(SERVERID)=([A-Za-z0-9\-_]+)">
303
+ <fingerprint pattern="^flyspray_project=">
304
+ <description>Flyspray</description>
305
+ <example>flyspray_project=133713381234; Path=/; HttpOnly</example>
306
+ <param pos="0" name="cookie" value="flyspray_project"/>
307
+ <param pos="0" name="service.vendor" value="Flyspray"/>
308
+ <param pos="0" name="service.product" value="Flyspray"/>
309
+ <param pos="0" name="service.cpe23" value="cpe:/a:flyspray:flyspray:-"/>
310
+ </fingerprint>
311
+
312
+ <fingerprint pattern="^i_like_gitea=">
313
+ <description>Gitea</description>
314
+ <example>i_like_gitea=fc39d4645b1d5c7c; Path=/</example>
315
+ <param pos="0" name="cookie" value="i_like_gitea"/>
316
+ <param pos="0" name="service.vendor" value="Gitea"/>
317
+ <param pos="0" name="service.product" value="Gitea"/>
318
+ <param pos="0" name="service.certainty" value="0.5"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:gitea:gitea:-"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^_gitlab_session=">
323
+ <description>GitLab</description>
324
+ <example>_gitlab_session=032d024e9c2445b595e68255da9e6835; path=/; expires=Mon, 26 Apr 2021 03:09:57 -0000; HttpOnly</example>
325
+ <param pos="0" name="cookie" value="_gitlab_session"/>
326
+ <param pos="0" name="service.vendor" value="GitLab"/>
327
+ <param pos="0" name="service.product" value="GitLab"/>
328
+ <param pos="0" name="service.certainty" value="0.5"/>
329
+ <param pos="0" name="service.cpe23" value="cpe:/a:gitlab:gitlab:-"/>
330
+ </fingerprint>
331
+
332
+ <fingerprint pattern="^SERVERID=([A-Za-z0-9\-_]+)">
197
333
  <description>HAProxy - http://haproxy.1wt.eu/download/1.2/doc/architecture.txt</description>
198
- <param pos="1" name="cookie"/>
199
- <param pos="2" name="host.name"/>
334
+ <example host.name="foo1">SERVERID=foo1; path=/</example>
335
+ <param pos="0" name="cookie" value="SERVERID"/>
336
+ <param pos="1" name="host.name"/>
200
337
  <param pos="0" name="service.family" value="HAProxy"/>
201
338
  <param pos="0" name="service.product" value="HAProxy"/>
202
339
  </fingerprint>
203
340
 
204
- <fingerprint pattern="^(AMWEBJCT!([^!]+)!([^=]+))=.*">
341
+ <fingerprint pattern="^(AMWEBJCT!([^!]+)!([^=]+))=">
205
342
  <description>IBM Tivoli Access Manager for e-business WebSEAL
206
343
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin180.htm
207
344
  </description>
345
+ <example cookie="AMWEBJCT!%2F4plportal!JSESSIONID" junction.name="%2F4plportal" junction.cookie="JSESSIONID">AMWEBJCT!%2F4plportal!JSESSIONID=fQDCzpljFPMhMVaDUOD+uOBe.undefined; Path=/</example>
208
346
  <param pos="1" name="cookie"/>
209
347
  <param pos="2" name="junction.name"/>
210
348
  <param pos="3" name="junction.cookie"/>
@@ -213,32 +351,42 @@
213
351
  <param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
214
352
  </fingerprint>
215
353
 
216
- <fingerprint pattern="^(PD-S-SESSION-ID|PD-H-SESSION-ID|PD_STATEFUL_[^=]+)=.*">
354
+ <fingerprint pattern="^(PD-S-SESSION-ID|PD-H-SESSION-ID|PD_STATEFUL_[^=]+)=">
217
355
  <description>IBM Tivoli Access Manager for e-business WebSeal
218
356
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin117.htm
219
357
  </description>
358
+ <example cookie="PD-S-SESSION-ID">PD-S-SESSION-ID=1_2_0_xRzIc55lBOTYkrYfW+qWHWGgdqlVKeEgwrhtKt+KRfq8R3lW; Path=/; Secure; HttpOnly</example>
359
+ <example cookie="PD_STATEFUL_db45742c-3e5b-11e9-91da-00505682181c">PD_STATEFUL_db45742c-3e5b-11e9-91da-00505682181c=%2F; Path=/</example>
220
360
  <param pos="1" name="cookie"/>
221
361
  <param pos="0" name="service.vendor" value="IBM"/>
222
362
  <param pos="0" name="service.family" value="Tivoli"/>
223
363
  <param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
224
364
  </fingerprint>
225
365
 
226
- <fingerprint pattern="^(IBMCBR)=.*">
366
+ <fingerprint pattern="^IBMCBR=">
227
367
  <description>IBM WebSphere Load Balancer</description>
228
- <param pos="1" name="cookie"/>
368
+ <param pos="0" name="cookie" value="IBMCBR"/>
229
369
  <param pos="0" name="service.vendor" value="IBM"/>
230
370
  <param pos="0" name="service.family" value="WebSphere"/>
231
371
  <param pos="0" name="service.product" value="WebSphere Load Balancer"/>
232
372
  </fingerprint>
233
373
 
234
- <fingerprint pattern="^(mbfcookie(?:\[lang\])?)=.*">
374
+ <fingerprint pattern="^(mbfcookie(?:\[lang\])?)=">
235
375
  <description>Joom!Fish http://www.joomfish.net/</description>
376
+ <example cookie="mbfcookie">mbfcookie=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
377
+ <example cookie="mbfcookie[lang]">mbfcookie[lang]=pt_BR; expires=Tue, 20-Apr-2021 03:30:47 GMT; path=/</example>
236
378
  <param pos="1" name="cookie"/>
237
379
  <param pos="0" name="service.family" value="Joom!Fish"/>
238
380
  <param pos="0" name="service.product" value="Joom!Fish"/>
239
381
  </fingerprint>
240
382
 
241
- <fingerprint pattern="^(MSCSAuth|MSCSProfile)=.*">
383
+ <fingerprint pattern="^_mastodon_session=">
384
+ <description>Mastodon</description>
385
+ <param pos="0" name="cookie" value="_mastodon_session"/>
386
+ <param pos="0" name="service.product" value="Mastodon"/>
387
+ </fingerprint>
388
+
389
+ <fingerprint pattern="^(MSCSAuth|MSCSProfile)=">
242
390
  <description>Microsoft Commerce Server - http://msdn2.microsoft.com/en-us/library/ms953828.aspx</description>
243
391
  <param pos="1" name="cookie"/>
244
392
  <param pos="0" name="service.vendor" value="Microsoft"/>
@@ -247,31 +395,36 @@
247
395
  <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:commerce_server:-"/>
248
396
  </fingerprint>
249
397
 
250
- <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=.*">
251
- <description>Microsoft IIS (ASP.NET)
252
- http://msdn2.microsoft.com/en-us/library/ms953828.aspx
253
- http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
254
- </description>
398
+ <fingerprint pattern="^(nc_sameSiteCookiestrict|nc_sameSiteCookielax|oc_sessionPassphrase)=">
399
+ <description>Nextcloud</description>
400
+ <example cookie="nc_sameSiteCookiestrict">nc_sameSiteCookiestrict=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict</example>
401
+ <example cookie="nc_sameSiteCookielax">nc_sameSiteCookielax=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax</example>
402
+ <example>oc_sessionPassphrase=Y%2BZjBn8Gn%2B8jIJPVx468Tlt8qDNm%2B5IVXLxgtwlY%2BQU2T7edVmDS4091nQrT; path=/nextcloud; secure; HttpOnly</example>
255
403
  <param pos="1" name="cookie"/>
256
- <param pos="0" name="service.vendor" value="Microsoft"/>
257
- <param pos="0" name="service.family" value="IIS"/>
258
- <param pos="0" name="service.product" value="IIS"/>
259
- <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:-"/>
260
- <param pos="0" name="service.component.vendor" value="Microsoft"/>
261
- <param pos="0" name="service.component.family" value="ASP.NET"/>
262
- <param pos="0" name="service.component.product" value="ASP.NET"/>
263
- <param pos="0" name="service.component.cpe23" value="cpe:/a:microsoft:asp.net:-"/>
404
+ <param pos="0" name="service.vendor" value="Nextcloud"/>
405
+ <param pos="0" name="service.product" value="Nextcloud Server"/>
406
+ <param pos="0" name="service.cpe23" value="cpe:/a:nextcloud:nextcloud_server:-"/>
264
407
  </fingerprint>
265
408
 
266
- <fingerprint pattern="^(AlteonP)=.*">
409
+ <fingerprint pattern="^AlteonP=">
267
410
  <description>Nortel Alteon Web Switch</description>
268
- <param pos="1" name="cookie"/>
411
+ <example>AlteonP=c46736793e45929dbaeebabb; path=</example>
412
+ <param pos="0" name="cookie" value="AlteonP"/>
269
413
  <param pos="0" name="service.vendor" value="Nortel"/>
270
414
  <param pos="0" name="service.family" value="Alteon"/>
271
415
  <param pos="0" name="service.product" value="Alteon Web Switch"/>
272
416
  </fingerprint>
273
417
 
274
- <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=.*">
418
+ <fingerprint pattern="^OBSID=">
419
+ <description>Observium</description>
420
+ <example>OBSID=gud74jg1slhskdo7idqgklkamm6g3908; expires=Tue, 20-Apr-2021 01:31:27 GMT; Max-Age=86400; path=/; HttpOnly</example>
421
+ <param pos="0" name="cookie" value="OBSID"/>
422
+ <param pos="0" name="service.vendor" value="Observium"/>
423
+ <param pos="0" name="service.product" value="Observium"/>
424
+ <param pos="0" name="service.cpe23" value="cpe:/a:observium:observium:-"/>
425
+ </fingerprint>
426
+
427
+ <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=">
275
428
  <description>OpenMarket/FatWire Content Server (www.fatwire.com)</description>
276
429
  <param pos="1" name="cookie"/>
277
430
  <param pos="0" name="service.vendor" value="FatWire"/>
@@ -279,42 +432,46 @@
279
432
  <param pos="0" name="service.product" value="Content Server"/>
280
433
  </fingerprint>
281
434
 
282
- <fingerprint pattern="^(parkinglot)=.*">
435
+ <fingerprint pattern="^parkinglot=">
283
436
  <description>Oversee Webserver</description>
284
- <param pos="1" name="cookie"/>
437
+ <param pos="0" name="cookie" value="parkinglot"/>
285
438
  <param pos="0" name="service.vendor" value="Oversee"/>
286
439
  <param pos="0" name="service.family" value="Webserver"/>
287
440
  <param pos="0" name="service.product" value="Webserver"/>
288
441
  </fingerprint>
289
442
 
290
- <fingerprint pattern="^(PHPSESSID|PHPSESSION)=.*">
291
- <description>PHP - http://www.php.net/ref.session</description>
292
- <param pos="1" name="cookie"/>
293
- <param pos="0" name="service.vendor" value="PHP"/>
294
- <param pos="0" name="service.family" value="PHP"/>
295
- <param pos="0" name="service.product" value="PHP"/>
296
- <param pos="0" name="service.cpe23" value="cpe:/a:php:php:-"/>
443
+ <fingerprint pattern="^phsid=">
444
+ <description>Phabricator</description>
445
+ <example>phsid=A%2Fxesybc4bypb74dlgojdgw2edct6osflno25h2fw7</example>
446
+ <param pos="0" name="cookie" value="phsid"/>
447
+ <param pos="0" name="service.vendor" value="Phacility"/>
448
+ <param pos="0" name="service.family" value="Phabricator"/>
449
+ <param pos="0" name="service.product" value="Phabricator"/>
450
+ <param pos="0" name="service.cpe23" value="cpe:/a:phacility:phabricator:-"/>
297
451
  </fingerprint>
298
452
 
299
- <fingerprint pattern="^(RMID)=.*">
453
+ <fingerprint pattern="^RMID=">
300
454
  <description>RealMedia OpenAdStream</description>
301
- <param pos="1" name="cookie"/>
455
+ <example>RMID=36c12633607cf7a0; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.foo.bar</example>
456
+ <param pos="0" name="cookie" value="RMID"/>
302
457
  <param pos="0" name="service.vendor" value="RealMedia"/>
303
458
  <param pos="0" name="service.family" value="OpenAdStream"/>
304
459
  <param pos="0" name="service.product" value="OpenAdStream"/>
305
460
  </fingerprint>
306
461
 
307
- <fingerprint pattern="^(RoxenUserID)=.*">
462
+ <fingerprint pattern="^RoxenUserID=">
308
463
  <description>Roxen WebServer</description>
309
- <param pos="1" name="cookie"/>
464
+ <example>RoxenUserID=c70fd536bc9e1342ce2a608b10547f88; expires=Wed, 19 Apr 2023 02:44:41 GMT; path=/</example>
465
+ <param pos="0" name="cookie" value="RoxenUserID"/>
310
466
  <param pos="0" name="service.vendor" value="Roxen"/>
311
467
  <param pos="0" name="service.family" value="WebServer"/>
312
468
  <param pos="0" name="service.product" value="WebServer"/>
313
469
  </fingerprint>
314
470
 
315
- <fingerprint pattern="^(_sn)=.*">
471
+ <fingerprint pattern="^_sn=">
316
472
  <description>Siebel CRM</description>
317
- <param pos="1" name="cookie"/>
473
+ <example>_sn=e7139835ca75f921e25c364d4a8fef48; path=/; expires=Mon, 19 Apr 2021 06:06:58 GMT; HttpOnly</example>
474
+ <param pos="0" name="cookie" value="_sn"/>
318
475
  <param pos="0" name="service.vendor" value="Siebel"/>
319
476
  <param pos="0" name="service.family" value="CRM"/>
320
477
  <param pos="0" name="service.product" value="CRM"/>
@@ -322,7 +479,7 @@
322
479
 
323
480
  <!-- This fingerprint is not specific enough. Multiple products are sold under
324
481
  the brand iPlanet/Sun ONE/Sun Java.
325
- <fingerprint pattern="^(iPlanetUserId)=.*">
482
+ <fingerprint pattern="^(iPlanetUserId)=">
326
483
  <description>Sun iPlanet</description>
327
484
  <param pos="1" name="cookie"/>
328
485
  <param pos="0" name="service.vendor" value="Sun"/>
@@ -332,9 +489,9 @@
332
489
 
333
490
  -->
334
491
 
335
- <fingerprint pattern="^(NSES40Session)=.*">
492
+ <fingerprint pattern="^NSES40Session=">
336
493
  <description>Netscape Enterprise Server (subsequently iPlanet Web Server, Sun ONE Web Server, presently Sun Java System Web Server)</description>
337
- <param pos="1" name="cookie"/>
494
+ <param pos="0" name="cookie" value="NSES40Session"/>
338
495
  <param pos="0" name="service.vendor" value="Sun"/>
339
496
  <param pos="0" name="service.family" value="Java System Web Server"/>
340
497
  <param pos="0" name="service.product" value="Java System Web Server"/>
@@ -342,7 +499,25 @@
342
499
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_web_server:4.0"/>
343
500
  </fingerprint>
344
501
 
345
- <fingerprint pattern="^(gx_session_id|JROUTE)=.*">
502
+ <fingerprint pattern="^_redmine_session=">
503
+ <description>Redmine</description>
504
+ <example>_redmine_session=BAh7B0kiD3Nlc3Npb25faWQGOgZFRkkiJWY2MGY5MTJiZjg0NGU1ZmQxZWI2OTViNzAxYjU4NTRiBjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMW1kV3Z5NDl6eVkwWDl4bFQvMUxSSmxmbjhhaDR1WWxERWUrMFQ4dVcvS0k9BjsARg%3D%3D--ce5f52d49b68e30a7ec34b75bf456d6c79d234d2; path=/; HttpOnly</example>
505
+ <param pos="0" name="cookie" value="_redmine_session"/>
506
+ <param pos="0" name="service.vendor" value="Redmine"/>
507
+ <param pos="0" name="service.product" value="Redmine"/>
508
+ <param pos="0" name="service.cpe23" value="cpe:/a:redmine:redmine:-"/>
509
+ </fingerprint>
510
+
511
+ <fingerprint pattern="^(syracuse\.sid\.\d+)=">
512
+ <description>Sage X3 Syracuse Web Server</description>
513
+ <example cookie="syracuse.sid.8124">syracuse.sid.8124=8b102bf7-327c-4962-9279-550e72afcaa9; path=/; HttpOnly</example>
514
+ <param pos="1" name="cookie"/>
515
+ <param pos="0" name="service.vendor" value="Sage"/>
516
+ <param pos="0" name="service.family" value="Sage X3 Syracuse Web Server"/>
517
+ <param pos="0" name="service.product" value="Sage X3 Syracuse Web Server"/>
518
+ </fingerprint>
519
+
520
+ <fingerprint pattern="^(gx_session_id|JROUTE)=">
346
521
  <description>Sun Java System Application Server (formerly iPlanet Application Server, Sun ONE Application Server)</description>
347
522
  <param pos="1" name="cookie"/>
348
523
  <param pos="0" name="service.vendor" value="Sun"/>
@@ -351,31 +526,44 @@
351
526
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_application_server:-"/>
352
527
  </fingerprint>
353
528
 
354
- <fingerprint pattern="^(fe_typo_user)=.*">
529
+ <fingerprint pattern="^fe_typo_user=">
355
530
  <description>TYPO3 CMS - http://typo3.com/</description>
356
- <param pos="1" name="cookie"/>
531
+ <example>fe_typo_user=aae725f7dcb8cb5215e64f66d4584cc92; path=/</example>
532
+ <param pos="0" name="cookie" value="fe_typo_user"/>
357
533
  <param pos="0" name="service.vendor" value="TYPO3"/>
358
534
  <param pos="0" name="service.family" value="CMS"/>
359
535
  <param pos="0" name="service.product" value="CMS"/>
360
536
  </fingerprint>
361
537
 
362
- <fingerprint pattern="^(SaneID)=.*">
538
+ <fingerprint pattern="^SaneID=">
363
539
  <description>Unica NetTracker - http://netinsight.unica.com/Products/NetTracker.cfm</description>
364
- <param pos="1" name="cookie"/>
540
+ <example>SaneID=10.1.1.223.1618798365976948; path=/; domain=.foo.bar</example>
541
+ <param pos="0" name="cookie" value="SaneID"/>
365
542
  <param pos="0" name="service.vendor" value="Unica"/>
366
543
  <param pos="0" name="service.family" value="NetTracker"/>
367
544
  <param pos="0" name="service.product" value="NetTracker"/>
368
545
  </fingerprint>
369
546
 
370
- <fingerprint pattern="^(__utm[a-z])=.*">
547
+ <fingerprint pattern="^(__utm[a-z])=">
371
548
  <description>Urchin Tracking Module - http://www.google.com/support/urchin45/bin/answer.py?answer=28307&amp;topic=7425</description>
549
+ <example cookie="__utmp">__utmp=2071164266.582676006.3393543082; path=/; domain=.foo.bar</example>
372
550
  <param pos="1" name="cookie"/>
373
551
  <param pos="0" name="service.vendor" value="Google"/>
374
552
  <param pos="0" name="service.family" value="Urchin"/>
375
553
  <param pos="0" name="service.product" value="Urchin Tracking Module"/>
376
554
  </fingerprint>
377
555
 
378
- <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=.*">
556
+ <fingerprint pattern="vxoaSessionID=">
557
+ <description>Silver Peak Appliance</description>
558
+ <example>vxoaSessionID=s%3A2650cfe1df092fc617d229d6d6b5dbfc.70yKRpb371czAWFkZWXdNfCSNexQvtiVr%2B3Z51YXbIw; Path=/; HttpOnly; Secure</example>
559
+ <example>vxoaSessionID=s%3A65e39ce7ae15193cb4bb0f812d20105b.qgHrgV4MtPKWeKwBrfynmxZmn5iaegh%2FRP0nV5ntaE8; Path=/; HttpOnly; Secure</example>
560
+ <example>vxoaSessionID=s%3A7e17300953b68c4713990a01bd00aa2b.5mg3edagZCkddCmWqMXbp4AOEzTVby6K2z2jfhal7Uw; Path=/; HttpOnly; Secure</example>
561
+ <param pos="0" name="hw.vendor" value="Silver Peak"/>
562
+ <param pos="0" name="hw.device" value="Network Appliance"/>
563
+ <param pos="0" name="hw.product" value="SD-WAN"/>
564
+ </fingerprint>
565
+
566
+ <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=">
379
567
  <description>Vignette</description>
380
568
  <param pos="1" name="cookie"/>
381
569
  <param pos="0" name="service.vendor" value="Vignette"/>
@@ -383,30 +571,43 @@
383
571
  <param pos="0" name="service.product" value="Vignette"/>
384
572
  </fingerprint>
385
573
 
386
- <fingerprint pattern="^(wgSession)=.*">
574
+ <fingerprint pattern="^wgSession=">
387
575
  <description>Plain Black WebGUI - http://www.plainblack.com/webgui</description>
388
- <param pos="1" name="cookie"/>
576
+ <example>wgSession=xngFQdcbCap87x6d8qc1YA; path=/; expires=Thu, 17-Apr-2031 02:29:05 GMT</example>
577
+ <param pos="0" name="cookie" value="wgSession"/>
389
578
  <param pos="0" name="service.vendor" value="Plain Black"/>
390
579
  <param pos="0" name="service.family" value="WebGUI"/>
391
580
  <param pos="0" name="service.product" value="WebGUI"/>
392
581
  </fingerprint>
393
582
 
394
- <fingerprint pattern="^(WEBTRENDSID|WEBTRENDS_ID)=.*">
583
+ <fingerprint pattern="^(WEBTRENDS_?ID)=">
395
584
  <description>WebTrends</description>
585
+ <example cookie="WEBTRENDS_ID">WEBTRENDS_ID=10.247.9.69.1618795409656141; path=/; expires=Tue, 19-Apr-22 01:23:29 GMT; domain=.foo.bar</example>
396
586
  <param pos="1" name="cookie"/>
397
587
  <param pos="0" name="service.vendor" value="WebTrends"/>
398
588
  <param pos="0" name="service.family" value="WebTrends"/>
399
589
  <param pos="0" name="service.product" value="WebTrends"/>
400
590
  </fingerprint>
401
591
 
402
- <fingerprint pattern="^(_ZopeId)=.*">
403
- <description>Zope</description>
592
+ <fingerprint pattern="^(ZM_TEST|ZM_LOGIN_CSRF)=">
593
+ <description>Zimbra</description>
594
+ <example cookie="ZM_TEST">ZM_TEST=true;Secure</example>
595
+ <example cookie="ZM_LOGIN_CSRF">ZM_LOGIN_CSRF=38ef0bea-a4c3-4f41-9ac3-73d7622f3131;Secure;HttpOnly</example>
404
596
  <param pos="1" name="cookie"/>
597
+ <param pos="0" name="service.vendor" value="Synacor"/>
598
+ <param pos="0" name="service.product" value="Zimbra Collaboration Suite"/>
599
+ <param pos="0" name="service.cpe23" value="cpe:/a:synacor:zimbra_collaboration_suite:-"/>
600
+ </fingerprint>
601
+
602
+ <fingerprint pattern="^_ZopeId=">
603
+ <description>Zope</description>
604
+ <example>_ZopeId="91304233A995SVLz3SI"; Path=/</example>
605
+ <param pos="0" name="cookie" value="_ZopeId"/>
405
606
  <param pos="0" name="service.family" value="Zope"/>
406
607
  <param pos="0" name="service.product" value="Zope"/>
407
608
  </fingerprint>
408
609
 
409
- <fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+).*">
610
+ <fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+)">
410
611
  <description>OracleAS Portal default cookie name - http://download.oracle.com/docs/cd/B14099_19/portal.1014/b19305/cg_app_f.htm</description>
411
612
  <param pos="1" name="cookie"/>
412
613
  <param pos="2" name="service.version"/>
@@ -416,7 +617,7 @@
416
617
  <param pos="0" name="service.cpe23" value="cpe:/a:oracle:application_server_portal:{service.version}"/>
417
618
  </fingerprint>
418
619
 
419
- <fingerprint pattern="^Compaq-HMMD=[^;]+;.*$">
620
+ <fingerprint pattern="^Compaq-HMMD=[^;]+;">
420
621
  <description>HP System Management Homepage (SMH)</description>
421
622
  <example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/</example>
422
623
  <example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/; Secure</example>
@@ -441,6 +642,14 @@
441
642
  <param pos="0" name="service.product" value="Arachni"/>
442
643
  </fingerprint>
443
644
 
645
+ <fingerprint pattern="^unraid_">
646
+ <description>Unraid</description>
647
+ <example>unraid_2e9e9f79999999999999999999r9b999=c5599999999999999999999999999e38; path=/; HttpOnly; SameSite=Lax</example>
648
+ <param pos="0" name="service.vendor" value="Lime Technologies"/>
649
+ <param pos="0" name="service.product" value="Unraid"/>
650
+ <param pos="0" name="service.certainty" value="0.5"/>
651
+ </fingerprint>
652
+
444
653
  <!--
445
654
  Ignore various cookies that are very generic cookies for session IDs
446
655
  that are not necessarily indicative of any particular
@@ -449,14 +658,14 @@
449
658
  these and this is enforced by rspec.
450
659
  -->
451
660
 
452
- <fingerprint pattern="(?i)^JSESSIONID(?:\.[^=]+)?=[^;]+;.*$">
661
+ <fingerprint pattern="(?i)^JSESSIONID(?:\.[^=]+)?=[^;]+;">
453
662
  <description>Ignore simple JSESSIONID and related cookies</description>
454
663
  <example>JSESSIONID=6ooov35i4l3n36qtaf8csvg0;Path=/</example>
455
664
  <example>jsessionid=6nkp66iogcdc92720%2Dc6e4%2D4989%2Db7b2%2D5021624cfdff;Path=/;secure</example>
456
665
  <example>JSESSIONID.c00a9623=v216643eijh19p9duve5srgf;Path=/;HttpOnly</example>
457
666
  </fingerprint>
458
667
 
459
- <fingerprint pattern="(?i)^_?SESSION_?ID\s*=\s*[^;]+;.*$">
668
+ <fingerprint pattern="(?i)^_?SESSION_?ID\s*=\s*[^;]+;">
460
669
  <description>Ignore simple SESSIONID and related cookies</description>
461
670
  <example>sessionId=7dba3249cfcd4b59854055311099a294; path=/;</example>
462
671
  <example>_session_id=7fe933db0fea13e9c872103ba2d142db; path=/; HttpOnly</example>
@@ -464,7 +673,7 @@
464
673
  <example>_session_id=18b3e173aa11db0533fd01752e81f583; path=/; HttpOnly</example>
465
674
  </fingerprint>
466
675
 
467
- <fingerprint pattern="(?i)^sid=[^;]+;.*$">
676
+ <fingerprint pattern="(?i)^sid=[^;]+;">
468
677
  <description>Ignore simple SID and related cookies</description>
469
678
  <example>sid=sfd10bf73-654458f687aa3c68b3874915f651e0ca;path=/;"</example>
470
679
  </fingerprint>