recog 2.3.18 → 2.3.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/ci.yml +26 -0
  4. data/.github/workflows/verify.yml +89 -0
  5. data/CONTRIBUTING.md +6 -0
  6. data/README.md +17 -0
  7. data/bin/recog_standardize +33 -12
  8. data/bin/recog_verify +1 -2
  9. data/cpe-remap.yaml +355 -200
  10. data/features/verify.feature +14 -14
  11. data/identifiers/README.md +24 -10
  12. data/identifiers/fields.txt +105 -0
  13. data/identifiers/hw_device.txt +8 -0
  14. data/identifiers/hw_family.txt +19 -0
  15. data/identifiers/hw_product.txt +122 -0
  16. data/identifiers/os_device.txt +2 -1
  17. data/identifiers/os_family.txt +3 -0
  18. data/identifiers/os_product.txt +46 -8
  19. data/identifiers/service_family.txt +10 -1
  20. data/identifiers/service_product.txt +90 -2
  21. data/identifiers/vendor.txt +104 -0
  22. data/lib/recog/db.rb +2 -1
  23. data/lib/recog/fingerprint.rb +18 -5
  24. data/lib/recog/nizer.rb +1 -82
  25. data/lib/recog/verifier.rb +5 -5
  26. data/lib/recog/verifier_factory.rb +3 -3
  27. data/lib/recog/verify_reporter.rb +14 -4
  28. data/lib/recog/version.rb +1 -1
  29. data/requirements.txt +1 -1
  30. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  31. data/spec/lib/recog/verify_reporter_spec.rb +69 -0
  32. data/tools/dev/hooks/pre-commit +21 -0
  33. data/update_cpes.py +19 -6
  34. data/xml/apache_modules.xml +60 -0
  35. data/xml/apache_os.xml +38 -38
  36. data/xml/dhcp_vendor_class.xml +206 -0
  37. data/xml/dns_versionbind.xml +11 -1
  38. data/xml/favicons.xml +270 -45
  39. data/xml/ftp_banners.xml +89 -64
  40. data/xml/h323_callresp.xml +99 -99
  41. data/xml/hp_pjl_id.xml +3 -3
  42. data/xml/html_title.xml +1051 -62
  43. data/xml/http_cookies.xml +294 -85
  44. data/xml/http_servers.xml +551 -122
  45. data/xml/http_wwwauth.xml +139 -43
  46. data/xml/imap_banners.xml +8 -8
  47. data/xml/ldap_searchresult.xml +1 -0
  48. data/xml/mdns_device-info_txt.xml +720 -27
  49. data/xml/mysql_banners.xml +3 -2
  50. data/xml/nntp_banners.xml +4 -4
  51. data/xml/ntp_banners.xml +79 -65
  52. data/xml/operating_system.xml +6 -6
  53. data/xml/pop_banners.xml +11 -11
  54. data/xml/rsh_resp.xml +3 -3
  55. data/xml/rtsp_servers.xml +7 -0
  56. data/xml/sip_banners.xml +374 -9
  57. data/xml/sip_user_agents.xml +377 -5
  58. data/xml/smb_native_lm.xml +32 -1
  59. data/xml/smb_native_os.xml +160 -33
  60. data/xml/smtp_banners.xml +168 -129
  61. data/xml/smtp_ehlo.xml +1 -1
  62. data/xml/smtp_expn.xml +1 -0
  63. data/xml/smtp_help.xml +10 -10
  64. data/xml/smtp_noop.xml +2 -2
  65. data/xml/smtp_vrfy.xml +1 -0
  66. data/xml/snmp_sysdescr.xml +508 -214
  67. data/xml/snmp_sysobjid.xml +25 -25
  68. data/xml/ssh_banners.xml +145 -29
  69. data/xml/telnet_banners.xml +240 -61
  70. data/xml/tls_jarm.xml +162 -0
  71. data/xml/x509_issuers.xml +237 -2
  72. data/xml/x509_subjects.xml +369 -49
  73. metadata +10 -3
data/xml/http_cookies.xml CHANGED
@@ -5,8 +5,71 @@
5
5
  servers.
6
6
  -->
7
7
 
8
- <fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=.*">
8
+ <fingerprint pattern="^__cfd?uid=">
9
+ <description>CloudFlare web load balancer endpoint</description>
10
+ <example>__cfuid=1337</example>
11
+ <example>__cfduid=dd450f2431e1e611a61a15f68974de9a41618794671; expires=Wed, 19-May-21 01:11:11 GMT; path=/; domain=.foo.bar; HttpOnly; SameSite=Lax</example>
12
+ <param pos="0" name="service.vendor" value="CloudFlare"/>
13
+ <param pos="0" name="service.product" value="CloudFlare Load Balancer"/>
14
+ <param pos="0" name="service.family" value="CloudFlare"/>
15
+ <param pos="0" name="service.cpe23" value="cpe:/a:cloudflare:load_balancing:-"/>
16
+ </fingerprint>
17
+
18
+ <fingerprint pattern="^(AWSALB(?:TG)?(?:CORS)?)=">
19
+ <description>Amazon Application Load Balancer</description>
20
+ <example cookie="AWSALB">AWSALB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
21
+ <example cookie="AWSALBCORS">AWSALBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
22
+ <example cookie="AWSALBTGCORS">AWSALBTGCORS=E0+uuQyz1jbU2P5jrIIWTuoK0aAbjfgsuA814N0xT5w9Vu4N61/CZTKT+yxwCfUqIUx/IgZfsDyA24+eSXKFO60aqEbtGPw2Mm4bGNDMVpcZ/yKHzifDPjT7mNQvNVq7xCAed5VgTpMH/nD3D2pLn9+ooJcShVgv+z97rSYAV5C98tecx6Q=; Expires=Mon, 10 May 2021 01:21:27 GMT; Path=/; SameSite=None; Secure</example>
23
+ <param pos="1" name="cookie"/>
24
+ <param pos="0" name="service.vendor" value="Amazon"/>
25
+ <param pos="0" name="service.family" value="Web Services"/>
26
+ <param pos="0" name="service.product" value="Application Load Balancer"/>
27
+ </fingerprint>
28
+
29
+ <fingerprint pattern="^(AWSELB(?:CORS)?)=">
30
+ <description>Amazon Elastic Load Balancer</description>
31
+ <example cookie="AWSELB">AWSELB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
32
+ <example cookie="AWSELBCORS">AWSELBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
33
+ <param pos="1" name="cookie"/>
34
+ <param pos="0" name="service.vendor" value="Amazon"/>
35
+ <param pos="0" name="service.family" value="Web Services"/>
36
+ <param pos="0" name="service.product" value="Elastic Load Balancer"/>
37
+ </fingerprint>
38
+
39
+ <fingerprint pattern="^(PHPSESSI(?:D|ON))=">
40
+ <description>PHP - http://www.php.net/ref.session</description>
41
+ <example cookie="PHPSESSID">PHPSESSID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
42
+ <example cookie="PHPSESSION">PHPSESSION=vt2ag6n7t6ngvlg8adk4860h46; path=/</example>
43
+ <param pos="1" name="cookie"/>
44
+ <param pos="0" name="service.vendor" value="PHP"/>
45
+ <param pos="0" name="service.family" value="PHP"/>
46
+ <param pos="0" name="service.product" value="PHP"/>
47
+ <param pos="0" name="service.cpe23" value="cpe:/a:php:php:-"/>
48
+ </fingerprint>
49
+
50
+ <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=">
51
+ <description>Microsoft IIS (ASP.NET)
52
+ http://msdn2.microsoft.com/en-us/library/ms953828.aspx
53
+ http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
54
+ </description>
55
+ <example cookie="ASPSESSIONIDQSBRRTTB">ASPSESSIONIDQSBRRTTB=BECILMBCPMGHJGAHKCHNGENF; path=/</example>
56
+ <example cookie="ASP.NET_SessionId">ASP.NET_SessionId=00nxm4qqh2tdjl0p52m10edv</example>
57
+ <example cookie=".ASPXANONYMOUS">.ASPXANONYMOUS=5ts5UmJr1wEkAAAAMmY0Y2EwNTUtZGZhYi00YTFlLTlmNzAtYmEwNjdiYTgxZDA40; expires=Sun, 27-Jun-2021 14:40:06 GMT; path=/; HttpOnly</example>
58
+ <param pos="1" name="cookie"/>
59
+ <param pos="0" name="service.vendor" value="Microsoft"/>
60
+ <param pos="0" name="service.family" value="IIS"/>
61
+ <param pos="0" name="service.product" value="IIS"/>
62
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:-"/>
63
+ <param pos="0" name="service.component.vendor" value="Microsoft"/>
64
+ <param pos="0" name="service.component.family" value="ASP.NET"/>
65
+ <param pos="0" name="service.component.product" value="ASP.NET"/>
66
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:microsoft:asp.net:-"/>
67
+ </fingerprint>
68
+
69
+ <fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=">
9
70
  <description>Adobe (Macromedia) ColdFusion uses various cookies</description>
71
+ <example cookie="CFTOKEN">CFTOKEN=f3863673461e83d7-8B854468-1866-DAAC-99FBB842C6018037;expires=Mon, 01-Aug-2050 01:05:45 GMT;path=/;HttpOnly;</example>
72
+ <example cookie="CFCLIENT_FOO_CORP">CFCLIENT_FOO_CORP=preflanguage%3DEN%23; Expires=Wed, 12-Apr-2051 01:11:37 GMT; Path=/</example>
10
73
  <param pos="1" name="cookie"/>
11
74
  <param pos="0" name="service.vendor" value="Adobe"/>
12
75
  <param pos="0" name="service.family" value="ColdFusion"/>
@@ -14,7 +77,7 @@
14
77
  <param pos="0" name="service.cpe23" value="cpe:/a:adobe:coldfusion:-"/>
15
78
  </fingerprint>
16
79
 
17
- <fingerprint pattern="^ANsession\d+=(\S+);.*">
80
+ <fingerprint pattern="^ANsession\d+=(\S+);">
18
81
  <description>Array Networks Secure Access Gateway / SSL VPN</description>
19
82
  <example>ANsession0002262072457555=IPMI; path=/;secure</example>
20
83
  <param pos="1" name="cookie"/>
@@ -23,7 +86,7 @@
23
86
  <param pos="0" name="hw.device" value="VPN"/>
24
87
  </fingerprint>
25
88
 
26
- <fingerprint pattern="^(Apache)=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]+);.*">
89
+ <fingerprint pattern="^(Apache)=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]+);">
27
90
  <description>Apache</description>
28
91
  <param pos="1" name="cookie"/>
29
92
  <param pos="2" name="system.time.micros"/>
@@ -33,23 +96,34 @@
33
96
  <param pos="0" name="service.cpe23" value="cpe:/a:apache:http_server:-"/>
34
97
  </fingerprint>
35
98
 
36
- <fingerprint pattern="^(JServSessionIdroot)=.*">
99
+ <fingerprint pattern="^JServSessionIdroot=">
37
100
  <description>Apache JServ</description>
38
- <param pos="1" name="cookie"/>
101
+ <example>JServSessionIdroot=tphxjy73e1.JS1; path=/</example>
102
+ <param pos="0" name="cookie" value="JServSessionIdroot"/>
39
103
  <param pos="0" name="service.vendor" value="Apache"/>
40
104
  <param pos="0" name="service.family" value="JServ"/>
41
105
  <param pos="0" name="service.product" value="JServ"/>
42
106
  </fingerprint>
43
107
 
44
- <fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=.*">
108
+ <fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=">
45
109
  <description>ATG Dynamo</description>
110
+ <example cookie="ATG_SESSION_ID">ATG_SESSION_ID=yuAUs8xnkzLaF8P3Zk1v5hR28XB4dKsOKZ4jCkVO; path=/</example>
46
111
  <param pos="1" name="cookie"/>
47
112
  <param pos="0" name="service.vendor" value="ATG"/>
48
113
  <param pos="0" name="service.family" value="Dynamo"/>
49
114
  <param pos="0" name="service.product" value="Dynamo"/>
50
115
  </fingerprint>
51
116
 
52
- <fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);.*">
117
+ <fingerprint pattern="^Bugzilla_login_request_cookie=">
118
+ <description>Bugzilla</description>
119
+ <example>Bugzilla_login_request_cookie=ylMVo9ZDtd; path=/; secure</example>
120
+ <param pos="0" name="cookie" value="Bugzilla_login_request_cookie"/>
121
+ <param pos="0" name="service.vendor" value="Mozilla"/>
122
+ <param pos="0" name="service.product" value="Bugzilla"/>
123
+ <param pos="0" name="service.cpe23" value="cpe:/a:mozilla:bugzilla:-"/>
124
+ </fingerprint>
125
+
126
+ <fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);">
53
127
  <description>BEA WebLogic (with timestamp)</description>
54
128
  <param pos="1" name="cookie"/>
55
129
  <param pos="2" name="system.time.millis"/>
@@ -59,7 +133,7 @@
59
133
  <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
60
134
  </fingerprint>
61
135
 
62
- <fingerprint pattern="^(WebLogicSession)=.*">
136
+ <fingerprint pattern="^(WebLogicSession)=">
63
137
  <description>BEA WebLogic (no timestamp)</description>
64
138
  <param pos="1" name="cookie"/>
65
139
  <param pos="0" name="service.vendor" value="BEA"/>
@@ -68,7 +142,7 @@
68
142
  <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
69
143
  </fingerprint>
70
144
 
71
- <fingerprint pattern="^(BCSI-CSC[0-9A-Za-z]+)=.*">
145
+ <fingerprint pattern="^(BCSI-CSC[0-9A-Za-z]+)=">
72
146
  <description>BlueCoat Proxy</description>
73
147
  <param pos="1" name="cookie"/>
74
148
  <param pos="0" name="service.vendor" value="Blue Coat"/>
@@ -76,9 +150,10 @@
76
150
  <param pos="0" name="service.product" value="Proxy"/>
77
151
  </fingerprint>
78
152
 
79
- <fingerprint pattern="^(CAKEPHP)=.*">
153
+ <fingerprint pattern="^CAKEPHP=">
80
154
  <description>CakePHP - http://www.cakephp.org/</description>
81
- <param pos="1" name="cookie"/>
155
+ <example>CAKEPHP=03bgv7jqfurftnm5crn3lc0ob1; expires=Mon, 19-Apr-2021 08:56:06 GMT; Max-Age=14400; path=/; HttpOnly</example>
156
+ <param pos="0" name="cookie" value="CAKEPHP"/>
82
157
  <param pos="0" name="service.family" value="PHP"/>
83
158
  <param pos="0" name="service.product" value="CakePHP"/>
84
159
  </fingerprint>
@@ -88,22 +163,23 @@
88
163
  The cookie value breaks down to [box-id][service-id][timeout-value]
89
164
  unfortunately, there's no separator so it's hard to tell what the
90
165
  actual break is between the pieces of data.
91
- http://www.cisco.com/warp/public/117/AP_cookies.html
92
166
  -->
93
167
 
94
- <fingerprint pattern="^(ARPT)=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+.*">
168
+ <fingerprint pattern="^ARPT=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+">
95
169
  <description>Cisco 11000 Series Content Service Switch (CSS)</description>
96
- <param pos="1" name="cookie"/>
97
- <param pos="2" name="host.id"/>
98
- <param pos="3" name="host.ip"/>
170
+ <example host.name="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
171
+ <param pos="0" name="cookie" value="ARPT"/>
172
+ <param pos="1" name="host.name"/>
173
+ <param pos="2" name="host.ip"/>
99
174
  <param pos="0" name="service.vendor" value="Cisco"/>
100
175
  <param pos="0" name="service.family" value="Content Service Switch"/>
101
176
  <param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
102
177
  </fingerprint>
103
178
 
104
- <fingerprint pattern="^(ARPT)=.*">
179
+ <fingerprint pattern="^ARPT=">
105
180
  <description>Cisco 11000 Series Content Service Switch (CSS) - catch all variant</description>
106
- <param pos="1" name="cookie"/>
181
+ <example>ARPT=388766892.51247.0000; path=/; Httponly/</example>
182
+ <param pos="0" name="cookie" value="ARPT"/>
107
183
  <param pos="0" name="service.vendor" value="Cisco"/>
108
184
  <param pos="0" name="service.family" value="Content Service Switch"/>
109
185
  <param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
@@ -122,7 +198,7 @@
122
198
  <param pos="0" name="os.vendor" value="Cisco"/>
123
199
  <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
124
200
  <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
125
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance:-"/>
201
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
126
202
  <param pos="0" name="hw.vendor" value="Cisco"/>
127
203
  <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
128
204
  <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
@@ -130,15 +206,15 @@
130
206
  <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
131
207
  </fingerprint>
132
208
 
133
- <fingerprint pattern="^(st8id)=.*">
209
+ <fingerprint pattern="^st8id=">
134
210
  <description>Citrix Application Protection System, Enterprise - http://support.citrix.com/article/CTX109330</description>
135
- <param pos="1" name="cookie"/>
211
+ <param pos="0" name="cookie" value="st8id"/>
136
212
  <param pos="0" name="service.vendor" value="Citrix"/>
137
213
  <param pos="0" name="service.family" value="Application Protection System"/>
138
214
  <param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
139
215
  </fingerprint>
140
216
 
141
- <fingerprint pattern="^NSC_(?:AAAC|BASEURL|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS|USER)=.*">
217
+ <fingerprint pattern="^NSC_(?:AAAC|BASEURL|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS|USER)=">
142
218
  <description>Citrix NetScaler</description>
143
219
  <example>NSC_AAAC=xyz;</example>
144
220
  <example>NSC_TEMP=xyz;</example>
@@ -146,6 +222,7 @@
146
222
  <param pos="0" name="os.family" value="NetScaler"/>
147
223
  <param pos="0" name="os.device" value="Network Management Device"/>
148
224
  <param pos="0" name="os.product" value="NetScaler"/>
225
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_firmware:-"/>
149
226
  <param pos="0" name="service.vendor" value="Citrix"/>
150
227
  <param pos="0" name="service.family" value="NetScaler"/>
151
228
  <param pos="0" name="service.device" value="Network Management Device"/>
@@ -165,15 +242,34 @@
165
242
  <param pos="0" name="os.product" value="Pulse Connect Secure"/>
166
243
  </fingerprint>
167
244
 
168
- <fingerprint pattern="^(EktGUID|ecm)=.*">
245
+ <fingerprint pattern="^DokuWiki=">
246
+ <description>Dokuwiki</description>
247
+ <example>DokuWiki=t8l1aev7703vbtejovp165pv01; path=/; secure</example>
248
+ <param pos="0" name="cookie" value="DokuWiki"/>
249
+ <param pos="0" name="service.vendor" value="Dokuwiki"/>
250
+ <param pos="0" name="service.product" value="Dokuwiki"/>
251
+ <param pos="0" name="service.cpe23" value="cpe:/a:dokuwiki:dokuwiki:-"/>
252
+ </fingerprint>
253
+
254
+ <fingerprint pattern="^(EktGUID|ecm)=">
169
255
  <description>Ektron CMS400.net</description>
256
+ <example cookie="EktGUID">EktGUID=382107cc-a38d-4d25-8182-3748834e21c8; expires=Tue, 19-Apr-2022 03:12:15 GMT; path=/</example>
170
257
  <param pos="1" name="cookie"/>
171
258
  <param pos="0" name="service.vendor" value="Ektron"/>
172
259
  <param pos="0" name="service.family" value="CMS400.NET"/>
173
260
  <param pos="0" name="service.product" value="CMS400.NET"/>
174
261
  </fingerprint>
175
262
 
176
- <fingerprint pattern="(?i)^(BIGipServer([^=]+))=.*">
263
+ <fingerprint pattern="^FESESSIONID=">
264
+ <description>Atlanssian's Fisheye</description>
265
+ <example>FESESSIONID=133713381337</example>
266
+ <param pos="0" name="cookie" value="FESESSIONID"/>
267
+ <param pos="0" name="service.vendor" value="Atlassian"/>
268
+ <param pos="0" name="service.product" value="Fisheye"/>
269
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:fisheye:-"/>
270
+ </fingerprint>
271
+
272
+ <fingerprint pattern="(?i)^(BIGipServer([^=]+))=">
177
273
  <description>F5 BIG-IP LTM - Server variant</description>
178
274
  <example loadbalancer.poolname="CustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
179
275
  <param pos="1" name="cookie"/>
@@ -184,8 +280,19 @@
184
280
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
185
281
  </fingerprint>
186
282
 
187
- <fingerprint pattern="^(BigIPCookie)=.*">
283
+ <fingerprint pattern="^i_like_gogits=">
284
+ <description>Gogs</description>
285
+ <example>i_like_gogits=fc3914645f1d5c76; Path=/; HttpOnly</example>
286
+ <param pos="0" name="cookie" value="i_like_gogits"/>
287
+ <param pos="0" name="service.vendor" value="Gogs"/>
288
+ <param pos="0" name="service.product" value="Gogs"/>
289
+ <param pos="0" name="service.cpe23" value="cpe:/a:gogs:gogs:-"/>
290
+ </fingerprint>
291
+
292
+ <fingerprint pattern="^(BigIPCookie[^=]*)=">
188
293
  <description>F5 BIG-IP LTM</description>
294
+ <example cookie="BigIPCookie">BigIPCookie=855248779.20480.0000; path=/; Httponly</example>
295
+ <example cookie="BigIPCookie_foo_corp_prod">BigIPCookie_foo_corp_prod=!tJHKH9zIwsUuJYJ38CCV0XSqmJXsZVQaOjj/m/SBSTQTg21/S+s2gmbsoGwwKXr5Tj9e0ijWZWItfA==; path=/; Httponly</example>
189
296
  <param pos="1" name="cookie"/>
190
297
  <param pos="0" name="service.vendor" value="F5"/>
191
298
  <param pos="0" name="service.family" value="BIG-IP"/>
@@ -193,18 +300,49 @@
193
300
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
194
301
  </fingerprint>
195
302
 
196
- <fingerprint pattern="^(SERVERID)=([A-Za-z0-9\-_]+)">
303
+ <fingerprint pattern="^flyspray_project=">
304
+ <description>Flyspray</description>
305
+ <example>flyspray_project=133713381234; Path=/; HttpOnly</example>
306
+ <param pos="0" name="cookie" value="flyspray_project"/>
307
+ <param pos="0" name="service.vendor" value="Flyspray"/>
308
+ <param pos="0" name="service.product" value="Flyspray"/>
309
+ <param pos="0" name="service.cpe23" value="cpe:/a:flyspray:flyspray:-"/>
310
+ </fingerprint>
311
+
312
+ <fingerprint pattern="^i_like_gitea=">
313
+ <description>Gitea</description>
314
+ <example>i_like_gitea=fc39d4645b1d5c7c; Path=/</example>
315
+ <param pos="0" name="cookie" value="i_like_gitea"/>
316
+ <param pos="0" name="service.vendor" value="Gitea"/>
317
+ <param pos="0" name="service.product" value="Gitea"/>
318
+ <param pos="0" name="service.certainty" value="0.5"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:gitea:gitea:-"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^_gitlab_session=">
323
+ <description>GitLab</description>
324
+ <example>_gitlab_session=032d024e9c2445b595e68255da9e6835; path=/; expires=Mon, 26 Apr 2021 03:09:57 -0000; HttpOnly</example>
325
+ <param pos="0" name="cookie" value="_gitlab_session"/>
326
+ <param pos="0" name="service.vendor" value="GitLab"/>
327
+ <param pos="0" name="service.product" value="GitLab"/>
328
+ <param pos="0" name="service.certainty" value="0.5"/>
329
+ <param pos="0" name="service.cpe23" value="cpe:/a:gitlab:gitlab:-"/>
330
+ </fingerprint>
331
+
332
+ <fingerprint pattern="^SERVERID=([A-Za-z0-9\-_]+)">
197
333
  <description>HAProxy - http://haproxy.1wt.eu/download/1.2/doc/architecture.txt</description>
198
- <param pos="1" name="cookie"/>
199
- <param pos="2" name="host.name"/>
334
+ <example host.name="foo1">SERVERID=foo1; path=/</example>
335
+ <param pos="0" name="cookie" value="SERVERID"/>
336
+ <param pos="1" name="host.name"/>
200
337
  <param pos="0" name="service.family" value="HAProxy"/>
201
338
  <param pos="0" name="service.product" value="HAProxy"/>
202
339
  </fingerprint>
203
340
 
204
- <fingerprint pattern="^(AMWEBJCT!([^!]+)!([^=]+))=.*">
341
+ <fingerprint pattern="^(AMWEBJCT!([^!]+)!([^=]+))=">
205
342
  <description>IBM Tivoli Access Manager for e-business WebSEAL
206
343
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin180.htm
207
344
  </description>
345
+ <example cookie="AMWEBJCT!%2F4plportal!JSESSIONID" junction.name="%2F4plportal" junction.cookie="JSESSIONID">AMWEBJCT!%2F4plportal!JSESSIONID=fQDCzpljFPMhMVaDUOD+uOBe.undefined; Path=/</example>
208
346
  <param pos="1" name="cookie"/>
209
347
  <param pos="2" name="junction.name"/>
210
348
  <param pos="3" name="junction.cookie"/>
@@ -213,32 +351,42 @@
213
351
  <param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
214
352
  </fingerprint>
215
353
 
216
- <fingerprint pattern="^(PD-S-SESSION-ID|PD-H-SESSION-ID|PD_STATEFUL_[^=]+)=.*">
354
+ <fingerprint pattern="^(PD-S-SESSION-ID|PD-H-SESSION-ID|PD_STATEFUL_[^=]+)=">
217
355
  <description>IBM Tivoli Access Manager for e-business WebSeal
218
356
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin117.htm
219
357
  </description>
358
+ <example cookie="PD-S-SESSION-ID">PD-S-SESSION-ID=1_2_0_xRzIc55lBOTYkrYfW+qWHWGgdqlVKeEgwrhtKt+KRfq8R3lW; Path=/; Secure; HttpOnly</example>
359
+ <example cookie="PD_STATEFUL_db45742c-3e5b-11e9-91da-00505682181c">PD_STATEFUL_db45742c-3e5b-11e9-91da-00505682181c=%2F; Path=/</example>
220
360
  <param pos="1" name="cookie"/>
221
361
  <param pos="0" name="service.vendor" value="IBM"/>
222
362
  <param pos="0" name="service.family" value="Tivoli"/>
223
363
  <param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
224
364
  </fingerprint>
225
365
 
226
- <fingerprint pattern="^(IBMCBR)=.*">
366
+ <fingerprint pattern="^IBMCBR=">
227
367
  <description>IBM WebSphere Load Balancer</description>
228
- <param pos="1" name="cookie"/>
368
+ <param pos="0" name="cookie" value="IBMCBR"/>
229
369
  <param pos="0" name="service.vendor" value="IBM"/>
230
370
  <param pos="0" name="service.family" value="WebSphere"/>
231
371
  <param pos="0" name="service.product" value="WebSphere Load Balancer"/>
232
372
  </fingerprint>
233
373
 
234
- <fingerprint pattern="^(mbfcookie(?:\[lang\])?)=.*">
374
+ <fingerprint pattern="^(mbfcookie(?:\[lang\])?)=">
235
375
  <description>Joom!Fish http://www.joomfish.net/</description>
376
+ <example cookie="mbfcookie">mbfcookie=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
377
+ <example cookie="mbfcookie[lang]">mbfcookie[lang]=pt_BR; expires=Tue, 20-Apr-2021 03:30:47 GMT; path=/</example>
236
378
  <param pos="1" name="cookie"/>
237
379
  <param pos="0" name="service.family" value="Joom!Fish"/>
238
380
  <param pos="0" name="service.product" value="Joom!Fish"/>
239
381
  </fingerprint>
240
382
 
241
- <fingerprint pattern="^(MSCSAuth|MSCSProfile)=.*">
383
+ <fingerprint pattern="^_mastodon_session=">
384
+ <description>Mastodon</description>
385
+ <param pos="0" name="cookie" value="_mastodon_session"/>
386
+ <param pos="0" name="service.product" value="Mastodon"/>
387
+ </fingerprint>
388
+
389
+ <fingerprint pattern="^(MSCSAuth|MSCSProfile)=">
242
390
  <description>Microsoft Commerce Server - http://msdn2.microsoft.com/en-us/library/ms953828.aspx</description>
243
391
  <param pos="1" name="cookie"/>
244
392
  <param pos="0" name="service.vendor" value="Microsoft"/>
@@ -247,31 +395,36 @@
247
395
  <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:commerce_server:-"/>
248
396
  </fingerprint>
249
397
 
250
- <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=.*">
251
- <description>Microsoft IIS (ASP.NET)
252
- http://msdn2.microsoft.com/en-us/library/ms953828.aspx
253
- http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
254
- </description>
398
+ <fingerprint pattern="^(nc_sameSiteCookiestrict|nc_sameSiteCookielax|oc_sessionPassphrase)=">
399
+ <description>Nextcloud</description>
400
+ <example cookie="nc_sameSiteCookiestrict">nc_sameSiteCookiestrict=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict</example>
401
+ <example cookie="nc_sameSiteCookielax">nc_sameSiteCookielax=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax</example>
402
+ <example>oc_sessionPassphrase=Y%2BZjBn8Gn%2B8jIJPVx468Tlt8qDNm%2B5IVXLxgtwlY%2BQU2T7edVmDS4091nQrT; path=/nextcloud; secure; HttpOnly</example>
255
403
  <param pos="1" name="cookie"/>
256
- <param pos="0" name="service.vendor" value="Microsoft"/>
257
- <param pos="0" name="service.family" value="IIS"/>
258
- <param pos="0" name="service.product" value="IIS"/>
259
- <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:-"/>
260
- <param pos="0" name="service.component.vendor" value="Microsoft"/>
261
- <param pos="0" name="service.component.family" value="ASP.NET"/>
262
- <param pos="0" name="service.component.product" value="ASP.NET"/>
263
- <param pos="0" name="service.component.cpe23" value="cpe:/a:microsoft:asp.net:-"/>
404
+ <param pos="0" name="service.vendor" value="Nextcloud"/>
405
+ <param pos="0" name="service.product" value="Nextcloud Server"/>
406
+ <param pos="0" name="service.cpe23" value="cpe:/a:nextcloud:nextcloud_server:-"/>
264
407
  </fingerprint>
265
408
 
266
- <fingerprint pattern="^(AlteonP)=.*">
409
+ <fingerprint pattern="^AlteonP=">
267
410
  <description>Nortel Alteon Web Switch</description>
268
- <param pos="1" name="cookie"/>
411
+ <example>AlteonP=c46736793e45929dbaeebabb; path=</example>
412
+ <param pos="0" name="cookie" value="AlteonP"/>
269
413
  <param pos="0" name="service.vendor" value="Nortel"/>
270
414
  <param pos="0" name="service.family" value="Alteon"/>
271
415
  <param pos="0" name="service.product" value="Alteon Web Switch"/>
272
416
  </fingerprint>
273
417
 
274
- <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=.*">
418
+ <fingerprint pattern="^OBSID=">
419
+ <description>Observium</description>
420
+ <example>OBSID=gud74jg1slhskdo7idqgklkamm6g3908; expires=Tue, 20-Apr-2021 01:31:27 GMT; Max-Age=86400; path=/; HttpOnly</example>
421
+ <param pos="0" name="cookie" value="OBSID"/>
422
+ <param pos="0" name="service.vendor" value="Observium"/>
423
+ <param pos="0" name="service.product" value="Observium"/>
424
+ <param pos="0" name="service.cpe23" value="cpe:/a:observium:observium:-"/>
425
+ </fingerprint>
426
+
427
+ <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=">
275
428
  <description>OpenMarket/FatWire Content Server (www.fatwire.com)</description>
276
429
  <param pos="1" name="cookie"/>
277
430
  <param pos="0" name="service.vendor" value="FatWire"/>
@@ -279,42 +432,46 @@
279
432
  <param pos="0" name="service.product" value="Content Server"/>
280
433
  </fingerprint>
281
434
 
282
- <fingerprint pattern="^(parkinglot)=.*">
435
+ <fingerprint pattern="^parkinglot=">
283
436
  <description>Oversee Webserver</description>
284
- <param pos="1" name="cookie"/>
437
+ <param pos="0" name="cookie" value="parkinglot"/>
285
438
  <param pos="0" name="service.vendor" value="Oversee"/>
286
439
  <param pos="0" name="service.family" value="Webserver"/>
287
440
  <param pos="0" name="service.product" value="Webserver"/>
288
441
  </fingerprint>
289
442
 
290
- <fingerprint pattern="^(PHPSESSID|PHPSESSION)=.*">
291
- <description>PHP - http://www.php.net/ref.session</description>
292
- <param pos="1" name="cookie"/>
293
- <param pos="0" name="service.vendor" value="PHP"/>
294
- <param pos="0" name="service.family" value="PHP"/>
295
- <param pos="0" name="service.product" value="PHP"/>
296
- <param pos="0" name="service.cpe23" value="cpe:/a:php:php:-"/>
443
+ <fingerprint pattern="^phsid=">
444
+ <description>Phabricator</description>
445
+ <example>phsid=A%2Fxesybc4bypb74dlgojdgw2edct6osflno25h2fw7</example>
446
+ <param pos="0" name="cookie" value="phsid"/>
447
+ <param pos="0" name="service.vendor" value="Phacility"/>
448
+ <param pos="0" name="service.family" value="Phabricator"/>
449
+ <param pos="0" name="service.product" value="Phabricator"/>
450
+ <param pos="0" name="service.cpe23" value="cpe:/a:phacility:phabricator:-"/>
297
451
  </fingerprint>
298
452
 
299
- <fingerprint pattern="^(RMID)=.*">
453
+ <fingerprint pattern="^RMID=">
300
454
  <description>RealMedia OpenAdStream</description>
301
- <param pos="1" name="cookie"/>
455
+ <example>RMID=36c12633607cf7a0; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.foo.bar</example>
456
+ <param pos="0" name="cookie" value="RMID"/>
302
457
  <param pos="0" name="service.vendor" value="RealMedia"/>
303
458
  <param pos="0" name="service.family" value="OpenAdStream"/>
304
459
  <param pos="0" name="service.product" value="OpenAdStream"/>
305
460
  </fingerprint>
306
461
 
307
- <fingerprint pattern="^(RoxenUserID)=.*">
462
+ <fingerprint pattern="^RoxenUserID=">
308
463
  <description>Roxen WebServer</description>
309
- <param pos="1" name="cookie"/>
464
+ <example>RoxenUserID=c70fd536bc9e1342ce2a608b10547f88; expires=Wed, 19 Apr 2023 02:44:41 GMT; path=/</example>
465
+ <param pos="0" name="cookie" value="RoxenUserID"/>
310
466
  <param pos="0" name="service.vendor" value="Roxen"/>
311
467
  <param pos="0" name="service.family" value="WebServer"/>
312
468
  <param pos="0" name="service.product" value="WebServer"/>
313
469
  </fingerprint>
314
470
 
315
- <fingerprint pattern="^(_sn)=.*">
471
+ <fingerprint pattern="^_sn=">
316
472
  <description>Siebel CRM</description>
317
- <param pos="1" name="cookie"/>
473
+ <example>_sn=e7139835ca75f921e25c364d4a8fef48; path=/; expires=Mon, 19 Apr 2021 06:06:58 GMT; HttpOnly</example>
474
+ <param pos="0" name="cookie" value="_sn"/>
318
475
  <param pos="0" name="service.vendor" value="Siebel"/>
319
476
  <param pos="0" name="service.family" value="CRM"/>
320
477
  <param pos="0" name="service.product" value="CRM"/>
@@ -322,7 +479,7 @@
322
479
 
323
480
  <!-- This fingerprint is not specific enough. Multiple products are sold under
324
481
  the brand iPlanet/Sun ONE/Sun Java.
325
- <fingerprint pattern="^(iPlanetUserId)=.*">
482
+ <fingerprint pattern="^(iPlanetUserId)=">
326
483
  <description>Sun iPlanet</description>
327
484
  <param pos="1" name="cookie"/>
328
485
  <param pos="0" name="service.vendor" value="Sun"/>
@@ -332,9 +489,9 @@
332
489
 
333
490
  -->
334
491
 
335
- <fingerprint pattern="^(NSES40Session)=.*">
492
+ <fingerprint pattern="^NSES40Session=">
336
493
  <description>Netscape Enterprise Server (subsequently iPlanet Web Server, Sun ONE Web Server, presently Sun Java System Web Server)</description>
337
- <param pos="1" name="cookie"/>
494
+ <param pos="0" name="cookie" value="NSES40Session"/>
338
495
  <param pos="0" name="service.vendor" value="Sun"/>
339
496
  <param pos="0" name="service.family" value="Java System Web Server"/>
340
497
  <param pos="0" name="service.product" value="Java System Web Server"/>
@@ -342,7 +499,25 @@
342
499
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_web_server:4.0"/>
343
500
  </fingerprint>
344
501
 
345
- <fingerprint pattern="^(gx_session_id|JROUTE)=.*">
502
+ <fingerprint pattern="^_redmine_session=">
503
+ <description>Redmine</description>
504
+ <example>_redmine_session=BAh7B0kiD3Nlc3Npb25faWQGOgZFRkkiJWY2MGY5MTJiZjg0NGU1ZmQxZWI2OTViNzAxYjU4NTRiBjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMW1kV3Z5NDl6eVkwWDl4bFQvMUxSSmxmbjhhaDR1WWxERWUrMFQ4dVcvS0k9BjsARg%3D%3D--ce5f52d49b68e30a7ec34b75bf456d6c79d234d2; path=/; HttpOnly</example>
505
+ <param pos="0" name="cookie" value="_redmine_session"/>
506
+ <param pos="0" name="service.vendor" value="Redmine"/>
507
+ <param pos="0" name="service.product" value="Redmine"/>
508
+ <param pos="0" name="service.cpe23" value="cpe:/a:redmine:redmine:-"/>
509
+ </fingerprint>
510
+
511
+ <fingerprint pattern="^(syracuse\.sid\.\d+)=">
512
+ <description>Sage X3 Syracuse Web Server</description>
513
+ <example cookie="syracuse.sid.8124">syracuse.sid.8124=8b102bf7-327c-4962-9279-550e72afcaa9; path=/; HttpOnly</example>
514
+ <param pos="1" name="cookie"/>
515
+ <param pos="0" name="service.vendor" value="Sage"/>
516
+ <param pos="0" name="service.family" value="Sage X3 Syracuse Web Server"/>
517
+ <param pos="0" name="service.product" value="Sage X3 Syracuse Web Server"/>
518
+ </fingerprint>
519
+
520
+ <fingerprint pattern="^(gx_session_id|JROUTE)=">
346
521
  <description>Sun Java System Application Server (formerly iPlanet Application Server, Sun ONE Application Server)</description>
347
522
  <param pos="1" name="cookie"/>
348
523
  <param pos="0" name="service.vendor" value="Sun"/>
@@ -351,31 +526,44 @@
351
526
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_application_server:-"/>
352
527
  </fingerprint>
353
528
 
354
- <fingerprint pattern="^(fe_typo_user)=.*">
529
+ <fingerprint pattern="^fe_typo_user=">
355
530
  <description>TYPO3 CMS - http://typo3.com/</description>
356
- <param pos="1" name="cookie"/>
531
+ <example>fe_typo_user=aae725f7dcb8cb5215e64f66d4584cc92; path=/</example>
532
+ <param pos="0" name="cookie" value="fe_typo_user"/>
357
533
  <param pos="0" name="service.vendor" value="TYPO3"/>
358
534
  <param pos="0" name="service.family" value="CMS"/>
359
535
  <param pos="0" name="service.product" value="CMS"/>
360
536
  </fingerprint>
361
537
 
362
- <fingerprint pattern="^(SaneID)=.*">
538
+ <fingerprint pattern="^SaneID=">
363
539
  <description>Unica NetTracker - http://netinsight.unica.com/Products/NetTracker.cfm</description>
364
- <param pos="1" name="cookie"/>
540
+ <example>SaneID=10.1.1.223.1618798365976948; path=/; domain=.foo.bar</example>
541
+ <param pos="0" name="cookie" value="SaneID"/>
365
542
  <param pos="0" name="service.vendor" value="Unica"/>
366
543
  <param pos="0" name="service.family" value="NetTracker"/>
367
544
  <param pos="0" name="service.product" value="NetTracker"/>
368
545
  </fingerprint>
369
546
 
370
- <fingerprint pattern="^(__utm[a-z])=.*">
547
+ <fingerprint pattern="^(__utm[a-z])=">
371
548
  <description>Urchin Tracking Module - http://www.google.com/support/urchin45/bin/answer.py?answer=28307&amp;topic=7425</description>
549
+ <example cookie="__utmp">__utmp=2071164266.582676006.3393543082; path=/; domain=.foo.bar</example>
372
550
  <param pos="1" name="cookie"/>
373
551
  <param pos="0" name="service.vendor" value="Google"/>
374
552
  <param pos="0" name="service.family" value="Urchin"/>
375
553
  <param pos="0" name="service.product" value="Urchin Tracking Module"/>
376
554
  </fingerprint>
377
555
 
378
- <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=.*">
556
+ <fingerprint pattern="vxoaSessionID=">
557
+ <description>Silver Peak Appliance</description>
558
+ <example>vxoaSessionID=s%3A2650cfe1df092fc617d229d6d6b5dbfc.70yKRpb371czAWFkZWXdNfCSNexQvtiVr%2B3Z51YXbIw; Path=/; HttpOnly; Secure</example>
559
+ <example>vxoaSessionID=s%3A65e39ce7ae15193cb4bb0f812d20105b.qgHrgV4MtPKWeKwBrfynmxZmn5iaegh%2FRP0nV5ntaE8; Path=/; HttpOnly; Secure</example>
560
+ <example>vxoaSessionID=s%3A7e17300953b68c4713990a01bd00aa2b.5mg3edagZCkddCmWqMXbp4AOEzTVby6K2z2jfhal7Uw; Path=/; HttpOnly; Secure</example>
561
+ <param pos="0" name="hw.vendor" value="Silver Peak"/>
562
+ <param pos="0" name="hw.device" value="Network Appliance"/>
563
+ <param pos="0" name="hw.product" value="SD-WAN"/>
564
+ </fingerprint>
565
+
566
+ <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=">
379
567
  <description>Vignette</description>
380
568
  <param pos="1" name="cookie"/>
381
569
  <param pos="0" name="service.vendor" value="Vignette"/>
@@ -383,30 +571,43 @@
383
571
  <param pos="0" name="service.product" value="Vignette"/>
384
572
  </fingerprint>
385
573
 
386
- <fingerprint pattern="^(wgSession)=.*">
574
+ <fingerprint pattern="^wgSession=">
387
575
  <description>Plain Black WebGUI - http://www.plainblack.com/webgui</description>
388
- <param pos="1" name="cookie"/>
576
+ <example>wgSession=xngFQdcbCap87x6d8qc1YA; path=/; expires=Thu, 17-Apr-2031 02:29:05 GMT</example>
577
+ <param pos="0" name="cookie" value="wgSession"/>
389
578
  <param pos="0" name="service.vendor" value="Plain Black"/>
390
579
  <param pos="0" name="service.family" value="WebGUI"/>
391
580
  <param pos="0" name="service.product" value="WebGUI"/>
392
581
  </fingerprint>
393
582
 
394
- <fingerprint pattern="^(WEBTRENDSID|WEBTRENDS_ID)=.*">
583
+ <fingerprint pattern="^(WEBTRENDS_?ID)=">
395
584
  <description>WebTrends</description>
585
+ <example cookie="WEBTRENDS_ID">WEBTRENDS_ID=10.247.9.69.1618795409656141; path=/; expires=Tue, 19-Apr-22 01:23:29 GMT; domain=.foo.bar</example>
396
586
  <param pos="1" name="cookie"/>
397
587
  <param pos="0" name="service.vendor" value="WebTrends"/>
398
588
  <param pos="0" name="service.family" value="WebTrends"/>
399
589
  <param pos="0" name="service.product" value="WebTrends"/>
400
590
  </fingerprint>
401
591
 
402
- <fingerprint pattern="^(_ZopeId)=.*">
403
- <description>Zope</description>
592
+ <fingerprint pattern="^(ZM_TEST|ZM_LOGIN_CSRF)=">
593
+ <description>Zimbra</description>
594
+ <example cookie="ZM_TEST">ZM_TEST=true;Secure</example>
595
+ <example cookie="ZM_LOGIN_CSRF">ZM_LOGIN_CSRF=38ef0bea-a4c3-4f41-9ac3-73d7622f3131;Secure;HttpOnly</example>
404
596
  <param pos="1" name="cookie"/>
597
+ <param pos="0" name="service.vendor" value="Synacor"/>
598
+ <param pos="0" name="service.product" value="Zimbra Collaboration Suite"/>
599
+ <param pos="0" name="service.cpe23" value="cpe:/a:synacor:zimbra_collaboration_suite:-"/>
600
+ </fingerprint>
601
+
602
+ <fingerprint pattern="^_ZopeId=">
603
+ <description>Zope</description>
604
+ <example>_ZopeId="91304233A995SVLz3SI"; Path=/</example>
605
+ <param pos="0" name="cookie" value="_ZopeId"/>
405
606
  <param pos="0" name="service.family" value="Zope"/>
406
607
  <param pos="0" name="service.product" value="Zope"/>
407
608
  </fingerprint>
408
609
 
409
- <fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+).*">
610
+ <fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+)">
410
611
  <description>OracleAS Portal default cookie name - http://download.oracle.com/docs/cd/B14099_19/portal.1014/b19305/cg_app_f.htm</description>
411
612
  <param pos="1" name="cookie"/>
412
613
  <param pos="2" name="service.version"/>
@@ -416,7 +617,7 @@
416
617
  <param pos="0" name="service.cpe23" value="cpe:/a:oracle:application_server_portal:{service.version}"/>
417
618
  </fingerprint>
418
619
 
419
- <fingerprint pattern="^Compaq-HMMD=[^;]+;.*$">
620
+ <fingerprint pattern="^Compaq-HMMD=[^;]+;">
420
621
  <description>HP System Management Homepage (SMH)</description>
421
622
  <example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/</example>
422
623
  <example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/; Secure</example>
@@ -441,6 +642,14 @@
441
642
  <param pos="0" name="service.product" value="Arachni"/>
442
643
  </fingerprint>
443
644
 
645
+ <fingerprint pattern="^unraid_">
646
+ <description>Unraid</description>
647
+ <example>unraid_2e9e9f79999999999999999999r9b999=c5599999999999999999999999999e38; path=/; HttpOnly; SameSite=Lax</example>
648
+ <param pos="0" name="service.vendor" value="Lime Technologies"/>
649
+ <param pos="0" name="service.product" value="Unraid"/>
650
+ <param pos="0" name="service.certainty" value="0.5"/>
651
+ </fingerprint>
652
+
444
653
  <!--
445
654
  Ignore various cookies that are very generic cookies for session IDs
446
655
  that are not necessarily indicative of any particular
@@ -449,14 +658,14 @@
449
658
  these and this is enforced by rspec.
450
659
  -->
451
660
 
452
- <fingerprint pattern="(?i)^JSESSIONID(?:\.[^=]+)?=[^;]+;.*$">
661
+ <fingerprint pattern="(?i)^JSESSIONID(?:\.[^=]+)?=[^;]+;">
453
662
  <description>Ignore simple JSESSIONID and related cookies</description>
454
663
  <example>JSESSIONID=6ooov35i4l3n36qtaf8csvg0;Path=/</example>
455
664
  <example>jsessionid=6nkp66iogcdc92720%2Dc6e4%2D4989%2Db7b2%2D5021624cfdff;Path=/;secure</example>
456
665
  <example>JSESSIONID.c00a9623=v216643eijh19p9duve5srgf;Path=/;HttpOnly</example>
457
666
  </fingerprint>
458
667
 
459
- <fingerprint pattern="(?i)^_?SESSION_?ID\s*=\s*[^;]+;.*$">
668
+ <fingerprint pattern="(?i)^_?SESSION_?ID\s*=\s*[^;]+;">
460
669
  <description>Ignore simple SESSIONID and related cookies</description>
461
670
  <example>sessionId=7dba3249cfcd4b59854055311099a294; path=/;</example>
462
671
  <example>_session_id=7fe933db0fea13e9c872103ba2d142db; path=/; HttpOnly</example>
@@ -464,7 +673,7 @@
464
673
  <example>_session_id=18b3e173aa11db0533fd01752e81f583; path=/; HttpOnly</example>
465
674
  </fingerprint>
466
675
 
467
- <fingerprint pattern="(?i)^sid=[^;]+;.*$">
676
+ <fingerprint pattern="(?i)^sid=[^;]+;">
468
677
  <description>Ignore simple SID and related cookies</description>
469
678
  <example>sid=sfd10bf73-654458f687aa3c68b3874915f651e0ca;path=/;"</example>
470
679
  </fingerprint>