recog 2.3.18 → 2.3.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/dependabot.yml +8 -0
- data/.github/workflows/ci.yml +26 -0
- data/.github/workflows/verify.yml +89 -0
- data/CONTRIBUTING.md +6 -0
- data/README.md +17 -0
- data/bin/recog_standardize +33 -12
- data/bin/recog_verify +1 -2
- data/cpe-remap.yaml +355 -200
- data/features/verify.feature +14 -14
- data/identifiers/README.md +24 -10
- data/identifiers/fields.txt +105 -0
- data/identifiers/hw_device.txt +8 -0
- data/identifiers/hw_family.txt +19 -0
- data/identifiers/hw_product.txt +122 -0
- data/identifiers/os_device.txt +2 -1
- data/identifiers/os_family.txt +3 -0
- data/identifiers/os_product.txt +46 -8
- data/identifiers/service_family.txt +10 -1
- data/identifiers/service_product.txt +90 -2
- data/identifiers/vendor.txt +104 -0
- data/lib/recog/db.rb +2 -1
- data/lib/recog/fingerprint.rb +18 -5
- data/lib/recog/nizer.rb +1 -82
- data/lib/recog/verifier.rb +5 -5
- data/lib/recog/verifier_factory.rb +3 -3
- data/lib/recog/verify_reporter.rb +14 -4
- data/lib/recog/version.rb +1 -1
- data/requirements.txt +1 -1
- data/spec/lib/fingerprint_self_test_spec.rb +1 -0
- data/spec/lib/recog/verify_reporter_spec.rb +69 -0
- data/tools/dev/hooks/pre-commit +21 -0
- data/update_cpes.py +19 -6
- data/xml/apache_modules.xml +60 -0
- data/xml/apache_os.xml +38 -38
- data/xml/dhcp_vendor_class.xml +206 -0
- data/xml/dns_versionbind.xml +11 -1
- data/xml/favicons.xml +270 -45
- data/xml/ftp_banners.xml +89 -64
- data/xml/h323_callresp.xml +99 -99
- data/xml/hp_pjl_id.xml +3 -3
- data/xml/html_title.xml +1051 -62
- data/xml/http_cookies.xml +294 -85
- data/xml/http_servers.xml +551 -122
- data/xml/http_wwwauth.xml +139 -43
- data/xml/imap_banners.xml +8 -8
- data/xml/ldap_searchresult.xml +1 -0
- data/xml/mdns_device-info_txt.xml +720 -27
- data/xml/mysql_banners.xml +3 -2
- data/xml/nntp_banners.xml +4 -4
- data/xml/ntp_banners.xml +79 -65
- data/xml/operating_system.xml +6 -6
- data/xml/pop_banners.xml +11 -11
- data/xml/rsh_resp.xml +3 -3
- data/xml/rtsp_servers.xml +7 -0
- data/xml/sip_banners.xml +374 -9
- data/xml/sip_user_agents.xml +377 -5
- data/xml/smb_native_lm.xml +32 -1
- data/xml/smb_native_os.xml +160 -33
- data/xml/smtp_banners.xml +168 -129
- data/xml/smtp_ehlo.xml +1 -1
- data/xml/smtp_expn.xml +1 -0
- data/xml/smtp_help.xml +10 -10
- data/xml/smtp_noop.xml +2 -2
- data/xml/smtp_vrfy.xml +1 -0
- data/xml/snmp_sysdescr.xml +508 -214
- data/xml/snmp_sysobjid.xml +25 -25
- data/xml/ssh_banners.xml +145 -29
- data/xml/telnet_banners.xml +240 -61
- data/xml/tls_jarm.xml +162 -0
- data/xml/x509_issuers.xml +237 -2
- data/xml/x509_subjects.xml +369 -49
- metadata +10 -3
data/xml/tls_jarm.xml
ADDED
|
@@ -0,0 +1,162 @@
|
|
|
1
|
+
<?xml version='1.0' encoding='UTF-8'?>
|
|
2
|
+
<fingerprints matches="tls.jarm" protocol="tls" database_type="service">
|
|
3
|
+
<!--
|
|
4
|
+
Fingerprint based on https://github.com/salesforce/jarm
|
|
5
|
+
-->
|
|
6
|
+
|
|
7
|
+
<fingerprint pattern="^2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa|2ad2ad16d2ad2ad22c2ad2ad2ad2adce2e4c8c53174ecbf5529ce7584d5518$|2ad2ad16d2ad2ad22c42d42d000000d342d5966a57139eeaff9f8bc4841b25$">
|
|
8
|
+
<description>Tor relay</description>
|
|
9
|
+
<example>2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa</example>
|
|
10
|
+
<example>2ad2ad16d2ad2ad22c2ad2ad2ad2adce2e4c8c53174ecbf5529ce7584d5518</example>
|
|
11
|
+
<example>2ad2ad16d2ad2ad22c42d42d000000d342d5966a57139eeaff9f8bc4841b25</example>
|
|
12
|
+
<param pos="0" name="service.product" value="Tor"/>
|
|
13
|
+
<param pos="0" name="service.vendor" value="Tor Project"/>
|
|
14
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:torproject:tor:-"/>
|
|
15
|
+
</fingerprint>
|
|
16
|
+
|
|
17
|
+
<fingerprint pattern="^2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d|29d29d15d29d29d21c29d29d29d29d10d7a07cb776562eccb97246005feba5|2ad2ad0002ad2ad0002ad2ad2ad2ad5bf44aec534289dfa8e33148b66cd6c3|29d29d15d29d29d21c29d29d29d29de857600fcd9f89735d87c3704c4e141b$">
|
|
18
|
+
<description>Synology NAS DSM 6</description>
|
|
19
|
+
<example>29d29d15d29d29d21c29d29d29d29d10d7a07cb776562eccb97246005feba5</example>
|
|
20
|
+
<example>29d29d15d29d29d21c29d29d29d29de857600fcd9f89735d87c3704c4e141b</example>
|
|
21
|
+
<example>2ad2ad0002ad2ad0002ad2ad2ad2ad5bf44aec534289dfa8e33148b66cd6c3</example>
|
|
22
|
+
<example>2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d</example>
|
|
23
|
+
<param pos="0" name="os.device" value="NAS"/>
|
|
24
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
25
|
+
<param pos="0" name="os.product" value="DSM"/>
|
|
26
|
+
<param pos="0" name="os.vendor" value="Synology"/>
|
|
27
|
+
<param pos="0" name="os.version" value="6"/>
|
|
28
|
+
<param pos="0" name="hw.vendor" value="Synology"/>
|
|
29
|
+
<param pos="0" name="hw.device" value="NAS"/>
|
|
30
|
+
</fingerprint>
|
|
31
|
+
|
|
32
|
+
<fingerprint pattern="^00000000000000000042d42d0000009535d5979f591ae8e547c5e5743e5b64|29d29d15d29d29d00042d42d00000068f5dc63852f94da932cd6b61b1cd9e3|29d29d15d29d29d21c42d42d000000bf85d79ff39d9f5079675604a74fc04b|29d29d15d29d29d00042d42d000000038eaaf490bec8dc33757f165ce01762|29d29d15d29d29d21c42d42d000000790cb01ea78cc2a73fe8428d61afc0c8$">
|
|
33
|
+
<description>Synology NAS DSM 7</description>
|
|
34
|
+
<example>00000000000000000042d42d0000009535d5979f591ae8e547c5e5743e5b64</example>
|
|
35
|
+
<example>29d29d15d29d29d00042d42d000000038eaaf490bec8dc33757f165ce01762</example>
|
|
36
|
+
<example>29d29d15d29d29d00042d42d00000068f5dc63852f94da932cd6b61b1cd9e3</example>
|
|
37
|
+
<example>29d29d15d29d29d21c42d42d000000790cb01ea78cc2a73fe8428d61afc0c8</example>
|
|
38
|
+
<example>29d29d15d29d29d21c42d42d000000bf85d79ff39d9f5079675604a74fc04b</example>
|
|
39
|
+
<param pos="0" name="os.device" value="NAS"/>
|
|
40
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
41
|
+
<param pos="0" name="os.product" value="DSM"/>
|
|
42
|
+
<param pos="0" name="os.vendor" value="Synology"/>
|
|
43
|
+
<param pos="0" name="os.version" value="7"/>
|
|
44
|
+
<param pos="0" name="hw.vendor" value="Synology"/>
|
|
45
|
+
<param pos="0" name="hw.device" value="NAS"/>
|
|
46
|
+
</fingerprint>
|
|
47
|
+
|
|
48
|
+
<fingerprint pattern="^2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef$">
|
|
49
|
+
<description>Ubiquiti EdgeRouter</description>
|
|
50
|
+
<example>2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef</example>
|
|
51
|
+
<param pos="0" name="hw.vendor" value="Ubiquiti"/>
|
|
52
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
53
|
+
<param pos="0" name="hw.product" value="EdgeRouter X"/>
|
|
54
|
+
<param pos="0" name="os.vendor" value="Ubiquiti"/>
|
|
55
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
56
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
57
|
+
</fingerprint>
|
|
58
|
+
|
|
59
|
+
<fingerprint pattern="^07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d$">
|
|
60
|
+
<description>Metasploit listener</description>
|
|
61
|
+
<example>07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d</example>
|
|
62
|
+
<param pos="0" name="service.vendor" value="Rapid7"/>
|
|
63
|
+
<param pos="0" name="service.product" value="Metasploit"/>
|
|
64
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:rapid7:metasploit:-"/>
|
|
65
|
+
</fingerprint>
|
|
66
|
+
|
|
67
|
+
<!-- This fingerprint matches Java's TLS stack,
|
|
68
|
+
see https://blog.cobaltstrike.com/2020/12/08/a-red-teamer-plays-with-jarm/ for details -->
|
|
69
|
+
|
|
70
|
+
<fingerprint pattern="^07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1$">
|
|
71
|
+
<description>Cobalt Strike listener</description>
|
|
72
|
+
<example>07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1</example>
|
|
73
|
+
<param pos="0" name="service.vendor" value="Strategic Cyber LLC"/>
|
|
74
|
+
<param pos="0" name="service.product" value="Cobalt Strike Listener"/>
|
|
75
|
+
<param pos="0" name="service.certainty" value="0.3"/>
|
|
76
|
+
</fingerprint>
|
|
77
|
+
|
|
78
|
+
<fingerprint pattern="^04b02b00004b04b04b04b02b04b04b9674c6b4e623ae36cc2d998e99e2262e$">
|
|
79
|
+
<description>Ligowave WiFi access point</description>
|
|
80
|
+
<example>04b02b00004b04b04b04b02b04b04b9674c6b4e623ae36cc2d998e99e2262e</example>
|
|
81
|
+
<param pos="0" name="hw.vendor" value="Ligowave"/>
|
|
82
|
+
<param pos="0" name="hw.product" value="Infinity Controler"/>
|
|
83
|
+
</fingerprint>
|
|
84
|
+
|
|
85
|
+
<fingerprint pattern="^06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d$">
|
|
86
|
+
<description>D-Link DCS-825L WiFi baby camera</description>
|
|
87
|
+
<example>06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d</example>
|
|
88
|
+
<param pos="0" name="hw.vendor" value="D-Link"/>
|
|
89
|
+
<param pos="0" name="hw.product" value="DCS-825L"/>
|
|
90
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:d-link:dcs-825l:-"/>
|
|
91
|
+
</fingerprint>
|
|
92
|
+
|
|
93
|
+
<fingerprint pattern="^0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d$">
|
|
94
|
+
<description>LANCOM Systems - 883 VoIP</description>
|
|
95
|
+
<example>0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d</example>
|
|
96
|
+
<param pos="0" name="hw.vendor" value="LANCOM Systems"/>
|
|
97
|
+
<param pos="0" name="hw.product" value="883 VoIP"/>
|
|
98
|
+
</fingerprint>
|
|
99
|
+
|
|
100
|
+
<fingerprint pattern="^21d14d00021d21d21c42d43d00041d320c989d4ed06a7e9d3133ba36bb2752$">
|
|
101
|
+
<description>Apple CUPS - web interface</description>
|
|
102
|
+
<example>21d14d00021d21d21c42d43d00041d320c989d4ed06a7e9d3133ba36bb2752</example>
|
|
103
|
+
<param pos="0" name="service.vendor" value="Apple"/>
|
|
104
|
+
<param pos="0" name="service.product" value="CUPS"/>
|
|
105
|
+
<param pos="0" name="service.family" value="CUPS"/>
|
|
106
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:apple:cups:-"/>
|
|
107
|
+
</fingerprint>
|
|
108
|
+
|
|
109
|
+
<fingerprint pattern="^0bd14d0000bd0bd0000bd14d0bd0bd6b64279c20472e17718ddea38ab610fa$">
|
|
110
|
+
<description>Netgear R Series</description>
|
|
111
|
+
<example>0bd14d0000bd0bd0000bd14d0bd0bd6b64279c20472e17718ddea38ab610fa</example>
|
|
112
|
+
<param pos="0" name="hw.vendor" value="Netgear"/>
|
|
113
|
+
<param pos="0" name="hw.product" value="R Series"/>
|
|
114
|
+
</fingerprint>
|
|
115
|
+
|
|
116
|
+
<fingerprint pattern="^2ad2ad16d2ad2ad07c2ad2ad2ad2ad4271ee10d978b0aecbc22f1de60ab611$">
|
|
117
|
+
<description>Netgear Orbi-micro</description>
|
|
118
|
+
<example>2ad2ad16d2ad2ad07c2ad2ad2ad2ad4271ee10d978b0aecbc22f1de60ab611</example>
|
|
119
|
+
<param pos="0" name="hw.vendor" value="Netgear"/>
|
|
120
|
+
<param pos="0" name="hw.product" value="Orbi micro"/>
|
|
121
|
+
<param pos="0" name="hw.device" value="WAP"/>
|
|
122
|
+
<param pos="0" name="hw.family" value="Orbi"/>
|
|
123
|
+
</fingerprint>
|
|
124
|
+
|
|
125
|
+
<fingerprint pattern="^04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e$">
|
|
126
|
+
<description>Netgear D Series</description>
|
|
127
|
+
<example>04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e</example>
|
|
128
|
+
<param pos="0" name="hw.vendor" value="Netgear"/>
|
|
129
|
+
<param pos="0" name="hw.product" value="D Series"/>
|
|
130
|
+
</fingerprint>
|
|
131
|
+
|
|
132
|
+
<fingerprint pattern="^21d3fd00021d21d21c21d3fd21d21d89188428dae58757cf803176e9701156$">
|
|
133
|
+
<description>Chromecast</description>
|
|
134
|
+
<example>21d3fd00021d21d21c21d3fd21d21d89188428dae58757cf803176e9701156</example>
|
|
135
|
+
<param pos="0" name="os.vendor" value="Google"/>
|
|
136
|
+
<param pos="0" name="os.product" value="Chrome OS"/>
|
|
137
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
|
|
138
|
+
<param pos="0" name="hw.device" value="Media Server"/>
|
|
139
|
+
<param pos="0" name="hw.vendor" value="Google"/>
|
|
140
|
+
<param pos="0" name="hw.product" value="Chromecast"/>
|
|
141
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
|
|
142
|
+
</fingerprint>
|
|
143
|
+
|
|
144
|
+
<fingerprint pattern="^21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601|2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d$">
|
|
145
|
+
<description>VMware ESXi</description>
|
|
146
|
+
<example>21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601</example>
|
|
147
|
+
<example>2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d</example>
|
|
148
|
+
<param pos="0" name="os.vendor" value="VMware"/>
|
|
149
|
+
<param pos="0" name="os.family" value="VMware ESX/ESXi"/>
|
|
150
|
+
<param pos="0" name="os.product" value="VMware ESXi Server"/>
|
|
151
|
+
<param pos="0" name="os.device" value="Hypervisor"/>
|
|
152
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
|
|
153
|
+
<param pos="0" name="hw.device" value="Hypervisor"/>
|
|
154
|
+
</fingerprint>
|
|
155
|
+
|
|
156
|
+
<fingerprint pattern="^29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38$">
|
|
157
|
+
<description>Merlin C2</description>
|
|
158
|
+
<example>29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38</example>
|
|
159
|
+
<param pos="0" name="service.product" value="Merlin"/>
|
|
160
|
+
</fingerprint>
|
|
161
|
+
|
|
162
|
+
</fingerprints>
|
data/xml/x509_issuers.xml
CHANGED
|
@@ -8,6 +8,91 @@
|
|
|
8
8
|
a specific order. Please see the comments in x509_subjects.xml for details.
|
|
9
9
|
-->
|
|
10
10
|
|
|
11
|
+
<!-- The following group has been included for performance reasons -->
|
|
12
|
+
|
|
13
|
+
<fingerprint pattern="^CN=R3,O=Let's Encrypt,C=US$">
|
|
14
|
+
<description>Lets Encrypt R3 - generic -- assert nothing.</description>
|
|
15
|
+
<example>CN=R3,O=Let's Encrypt,C=US</example>
|
|
16
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
17
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
18
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
19
|
+
</fingerprint>
|
|
20
|
+
|
|
21
|
+
<fingerprint pattern="^CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US$">
|
|
22
|
+
<description>Lets Encrypt X3 - generic -- assert nothing.</description>
|
|
23
|
+
<example>CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US</example>
|
|
24
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
25
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
26
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
27
|
+
</fingerprint>
|
|
28
|
+
|
|
29
|
+
<fingerprint pattern="^CN=Amazon,OU=Server CA 1B,O=Amazon,C=US$">
|
|
30
|
+
<description>Amazon AWS Server CA 1B - generic -- assert nothing.</description>
|
|
31
|
+
<example>CN=Amazon,OU=Server CA 1B,O=Amazon,C=US</example>
|
|
32
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
33
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
34
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
35
|
+
</fingerprint>
|
|
36
|
+
|
|
37
|
+
<fingerprint pattern="^CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US$">
|
|
38
|
+
<description>DigiCert SHA2 - generic -- assert nothing.</description>
|
|
39
|
+
<example>CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US</example>
|
|
40
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
41
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
42
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
43
|
+
</fingerprint>
|
|
44
|
+
|
|
45
|
+
<fingerprint pattern="^CN=DigiCert TLS (?:RSA SHA256|Hybrid ECC SHA384) 2020 CA1,O=DigiCert Inc,C=US$">
|
|
46
|
+
<description>DigiCert SHA256 2020 CA1 - generic -- assert nothing.</description>
|
|
47
|
+
<example>CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US</example>
|
|
48
|
+
<example>CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US</example>
|
|
49
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
50
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
51
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
52
|
+
</fingerprint>
|
|
53
|
+
|
|
54
|
+
<fingerprint pattern="^CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US$">
|
|
55
|
+
<description>DigiCert ECC CA-1 - generic -- assert nothing.</description>
|
|
56
|
+
<example>CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
57
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
58
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
59
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
60
|
+
</fingerprint>
|
|
61
|
+
|
|
62
|
+
<fingerprint pattern="^CN=DigiCert SHA2 (?:Extended Validation|High Assurance) Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US$">
|
|
63
|
+
<description>DigiCert SHA2 EV - generic -- assert nothing.</description>
|
|
64
|
+
<example>CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
65
|
+
<example>CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
66
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
67
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
68
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
69
|
+
</fingerprint>
|
|
70
|
+
|
|
71
|
+
<fingerprint pattern="^CN=Sectigo RSA (?:Domain|Organization) Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB$">
|
|
72
|
+
<description>Sectigo RSA - generic -- assert nothing.</description>
|
|
73
|
+
<example>CN=Sectigo RSA Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
|
|
74
|
+
<example>CN=Sectigo RSA Organization Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
|
|
75
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
76
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
77
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
78
|
+
</fingerprint>
|
|
79
|
+
|
|
80
|
+
<fingerprint pattern="^CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US$">
|
|
81
|
+
<description>GeoTrust RSA CA 2018 - generic -- assert nothing.</description>
|
|
82
|
+
<example>CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
|
|
83
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
84
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
85
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
86
|
+
</fingerprint>
|
|
87
|
+
|
|
88
|
+
<fingerprint pattern="^CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs\.godaddy\.com/repository/,O=GoDaddy.com\\, Inc\.,L=Scottsdale,ST=Arizona,C=US$">
|
|
89
|
+
<description>Go Daddy G2 - generic -- assert nothing.</description>
|
|
90
|
+
<example>CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US</example>
|
|
91
|
+
<param pos="0" name="hw.certainty" value="0.0"/>
|
|
92
|
+
<param pos="0" name="os.certainty" value="0.0"/>
|
|
93
|
+
<param pos="0" name="service.certainty" value="0.0"/>
|
|
94
|
+
</fingerprint>
|
|
95
|
+
|
|
11
96
|
<!-- Chromecast and various devices that support the Cast protocol -->
|
|
12
97
|
|
|
13
98
|
<fingerprint pattern="^CN=Eureka Gen1 ICA,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US$">
|
|
@@ -15,10 +100,13 @@
|
|
|
15
100
|
<example>CN=Eureka Gen1 ICA,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
16
101
|
<param pos="0" name="os.vendor" value="Google"/>
|
|
17
102
|
<param pos="0" name="os.product" value="Chrome OS"/>
|
|
103
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
18
104
|
<param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
|
|
19
105
|
<param pos="0" name="hw.device" value="Media Server"/>
|
|
20
106
|
<param pos="0" name="hw.vendor" value="Google"/>
|
|
21
107
|
<param pos="0" name="hw.product" value="Chromecast"/>
|
|
108
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
109
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
|
|
22
110
|
<param pos="0" name="chromecast.generation" value="1"/>
|
|
23
111
|
</fingerprint>
|
|
24
112
|
|
|
@@ -34,10 +122,13 @@
|
|
|
34
122
|
<example chromecast.generation="12">CN=Chromecast ICA 12,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
|
|
35
123
|
<param pos="0" name="os.vendor" value="Google"/>
|
|
36
124
|
<param pos="0" name="os.product" value="Chrome OS"/>
|
|
125
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
37
126
|
<param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
|
|
38
127
|
<param pos="0" name="hw.device" value="Media Server"/>
|
|
39
128
|
<param pos="0" name="hw.vendor" value="Google"/>
|
|
40
129
|
<param pos="0" name="hw.product" value="Chromecast"/>
|
|
130
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
131
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
|
|
41
132
|
<param pos="1" name="chromecast.generation"/>
|
|
42
133
|
<param pos="2" name="chromecast.capabilities"/>
|
|
43
134
|
</fingerprint>
|
|
@@ -119,6 +210,20 @@
|
|
|
119
210
|
<param pos="0" name="hw.vendor" value="APC"/>
|
|
120
211
|
</fingerprint>
|
|
121
212
|
|
|
213
|
+
<fingerprint pattern="^CN=ASA Temporary Self Signed Certificate$">
|
|
214
|
+
<description>Cisco ASA Temp Cert</description>
|
|
215
|
+
<example>CN=ASA Temporary Self Signed Certificate</example>
|
|
216
|
+
<param pos="0" name="os.vendor" value="Cisco"/>
|
|
217
|
+
<param pos="0" name="os.family" value="Adaptive Security Appliance"/>
|
|
218
|
+
<param pos="0" name="os.product" value="Adaptive Security Appliance"/>
|
|
219
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
|
|
220
|
+
<param pos="0" name="hw.vendor" value="Cisco"/>
|
|
221
|
+
<param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
|
|
222
|
+
<param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
|
|
223
|
+
<param pos="0" name="hw.device" value="Firewall"/>
|
|
224
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
|
|
225
|
+
</fingerprint>
|
|
226
|
+
|
|
122
227
|
<fingerprint pattern="^CN=Temporary CA [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12},OU=Temporary CA">
|
|
123
228
|
<description>Cisco Video Communication Server</description>
|
|
124
229
|
<example>CN=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,OU=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,O=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74</example>
|
|
@@ -131,9 +236,11 @@
|
|
|
131
236
|
<description>VMware ESXi w/Installer</description>
|
|
132
237
|
<example>O=VMware Installer</example>
|
|
133
238
|
<param pos="0" name="os.vendor" value="VMware"/>
|
|
134
|
-
<param pos="0" name="os.
|
|
239
|
+
<param pos="0" name="os.family" value="VMware ESX/ESXi"/>
|
|
240
|
+
<param pos="0" name="os.product" value="VMware ESXi Server"/>
|
|
135
241
|
<param pos="0" name="os.device" value="Hypervisor"/>
|
|
136
242
|
<param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
|
|
243
|
+
<param pos="0" name="hw.device" value="Hypervisor"/>
|
|
137
244
|
</fingerprint>
|
|
138
245
|
|
|
139
246
|
<fingerprint pattern="^CN=CA,OU=VMware Engineering,O=vCenter,ST=California,C=US$">
|
|
@@ -151,11 +258,139 @@
|
|
|
151
258
|
<param pos="0" name="hw.vendor" value="HP"/>
|
|
152
259
|
<param pos="0" name="hw.family" value="iLO"/>
|
|
153
260
|
<param pos="0" name="hw.product" value="iLO"/>
|
|
154
|
-
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:
|
|
261
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
|
|
155
262
|
<param pos="0" name="os.device" value="Lights Out Management"/>
|
|
156
263
|
<param pos="0" name="os.vendor" value="HP"/>
|
|
157
264
|
<param pos="0" name="os.family" value="iLO"/>
|
|
158
265
|
<param pos="0" name="os.product" value="iLO"/>
|
|
266
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
|
|
267
|
+
</fingerprint>
|
|
268
|
+
|
|
269
|
+
<fingerprint pattern="^CN=synology.com,O=Synology Inc.,L=Taipei,C=TW$">
|
|
270
|
+
<description>Synology</description>
|
|
271
|
+
<example>CN=synology.com,O=Synology Inc.,L=Taipei,C=TW</example>
|
|
272
|
+
<param pos="0" name="os.device" value="NAS"/>
|
|
273
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
274
|
+
<param pos="0" name="os.product" value="DSM"/>
|
|
275
|
+
<param pos="0" name="os.vendor" value="Synology"/>
|
|
276
|
+
<param pos="0" name="hw.vendor" value="Synology"/>
|
|
277
|
+
<param pos="0" name="hw.device" value="NAS"/>
|
|
278
|
+
</fingerprint>
|
|
279
|
+
|
|
280
|
+
<fingerprint pattern="^CN=default(?: [A-Z]+)?,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US$">
|
|
281
|
+
<description>Citrix Netscaler (later renamed to Citrix ADC)</description>
|
|
282
|
+
<example>CN=default,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
|
|
283
|
+
<example>CN=default UYENMB,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
|
|
284
|
+
<param pos="0" name="service.vendor" value="Citrix"/>
|
|
285
|
+
<param pos="0" name="service.family" value="Netscaler"/>
|
|
286
|
+
<param pos="0" name="service.product" value="Netscaler"/>
|
|
287
|
+
<param pos="0" name="service.device" value="Network Management Device"/>
|
|
288
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:citrix:netscaler:-"/>
|
|
289
|
+
<param pos="0" name="os.vendor" value="Citrix"/>
|
|
290
|
+
<param pos="0" name="os.family" value="Netscaler"/>
|
|
291
|
+
<param pos="0" name="os.product" value="Netscaler Gateway Firmware"/>
|
|
292
|
+
<param pos="0" name="os.device" value="Network Management Device"/>
|
|
293
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_gateway_firmware:-"/>
|
|
294
|
+
<param pos="0" name="hw.vendor" value="Citrix"/>
|
|
295
|
+
<param pos="0" name="hw.family" value="Netscaler"/>
|
|
296
|
+
<param pos="0" name="hw.product" value="Netscaler Gateway"/>
|
|
297
|
+
<param pos="0" name="hw.device" value="Network Management Device"/>
|
|
298
|
+
<param pos="0" name="hw.cpe23" value="cpe:/h:citrix:netscaler_gateway:-"/>
|
|
299
|
+
</fingerprint>
|
|
300
|
+
|
|
301
|
+
<fingerprint pattern="^O=Technicolor,L=Edegem,ST=Antwerp,C=BE$">
|
|
302
|
+
<description>Technicolor Router - without model or version</description>
|
|
303
|
+
<example>O=Technicolor,L=Edegem,ST=Antwerp,C=BE</example>
|
|
304
|
+
<param pos="0" name="os.vendor" value="Technicolor"/>
|
|
305
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
306
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
307
|
+
<param pos="0" name="hw.vendor" value="Technicolor"/>
|
|
308
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
309
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
310
|
+
</fingerprint>
|
|
311
|
+
|
|
312
|
+
<fingerprint pattern="^CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW$">
|
|
313
|
+
<description>DrayTek Vigor Router - without model or version</description>
|
|
314
|
+
<example>CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW</example>
|
|
315
|
+
<param pos="0" name="os.vendor" value="DrayTek"/>
|
|
316
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
317
|
+
<param pos="0" name="os.certainty" value="0.5"/>
|
|
318
|
+
<param pos="0" name="hw.vendor" value="DrayTek"/>
|
|
319
|
+
<param pos="0" name="hw.family" value="Vigor"/>
|
|
320
|
+
<param pos="0" name="hw.device" value="Router"/>
|
|
321
|
+
<param pos="0" name="hw.certainty" value="0.5"/>
|
|
322
|
+
</fingerprint>
|
|
323
|
+
|
|
324
|
+
<fingerprint pattern="^CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co$">
|
|
325
|
+
<description>Kubernetes NGINX Ingress Controller with default cert</description>
|
|
326
|
+
<example>CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co</example>
|
|
327
|
+
<param pos="0" name="service.vendor" value="Kubernetes"/>
|
|
328
|
+
<param pos="0" name="service.family" value="Kubernetes"/>
|
|
329
|
+
<param pos="0" name="service.product" value="NGINX Ingress Controller"/>
|
|
330
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:nginx_ingress_controller:-"/>
|
|
331
|
+
</fingerprint>
|
|
332
|
+
|
|
333
|
+
<fingerprint pattern="^CN=TRAEFIK DEFAULT CERT$">
|
|
334
|
+
<description>Traefik Proxy default certificate</description>
|
|
335
|
+
<example>CN=TRAEFIK DEFAULT CERT</example>
|
|
336
|
+
<param pos="0" name="service.vendor" value="Traefik Labs"/>
|
|
337
|
+
<param pos="0" name="service.family" value="Traefik"/>
|
|
338
|
+
<param pos="0" name="service.product" value="Traefik Proxy"/>
|
|
339
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:traefik:traefik:-"/>
|
|
340
|
+
</fingerprint>
|
|
341
|
+
|
|
342
|
+
<fingerprint pattern="(?i)^CN=Fireware web CA,OU=Fireware,O=WatchGuard(?: CA)?$">
|
|
343
|
+
<description>WatchGuard Fireware</description>
|
|
344
|
+
<example>CN=Fireware web ca,OU=Fireware,O=WatchGuard</example>
|
|
345
|
+
<example>CN=Fireware web CA,OU=Fireware,O=Watchguard CA</example>
|
|
346
|
+
<param pos="0" name="service.vendor" value="WatchGuard"/>
|
|
347
|
+
<param pos="0" name="service.product" value="Fireware XTM"/>
|
|
348
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:watchguard:fireware_xtm:-"/>
|
|
349
|
+
<param pos="0" name="os.vendor" value="WatchGuard"/>
|
|
350
|
+
<param pos="0" name="os.product" value="Fireware"/>
|
|
351
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:watchguard:fireware:-"/>
|
|
352
|
+
</fingerprint>
|
|
353
|
+
|
|
354
|
+
<fingerprint pattern="^O=Caddy Self-Signed$">
|
|
355
|
+
<description>CaddyServer Caddy - golang based httpd</description>
|
|
356
|
+
<example>O=Caddy Self-Signed</example>
|
|
357
|
+
<param pos="0" name="service.vendor" value="CaddyServer"/>
|
|
358
|
+
<param pos="0" name="service.product" value="Caddy"/>
|
|
359
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
|
|
360
|
+
</fingerprint>
|
|
361
|
+
|
|
362
|
+
<fingerprint pattern="^CN=Avaya cu360 (\S+)$">
|
|
363
|
+
<description>Avaya Video Conferencing Device - CU360</description>
|
|
364
|
+
<example hw.serial_number="11YT11111111">CN=Avaya cu360 11YT11111111</example>
|
|
365
|
+
<param pos="0" name="hw.vendor" value="Avaya"/>
|
|
366
|
+
<param pos="0" name="hw.device" value="Video Conference"/>
|
|
367
|
+
<param pos="0" name="hw.product" value="CU360"/>
|
|
368
|
+
<param pos="1" name="hw.serial_number"/>
|
|
369
|
+
</fingerprint>
|
|
370
|
+
|
|
371
|
+
<fingerprint pattern="^CN=Roomba CA,OU=\S+,O=iRobot,L=Bedford,ST=MA,C=US$">
|
|
372
|
+
<description>Roomba Device</description>
|
|
373
|
+
<example hw.product="Roomba" hw.vendor="iRobot">CN=Roomba CA,OU=HBU,O=iRobot,L=Bedford,ST=MA,C=US</example>
|
|
374
|
+
<param pos="0" name="hw.vendor" value="iRobot"/>
|
|
375
|
+
<param pos="0" name="hw.device" value="Device"/>
|
|
376
|
+
<param pos="0" name="hw.product" value="Roomba"/>
|
|
377
|
+
</fingerprint>
|
|
378
|
+
|
|
379
|
+
<fingerprint pattern="(?i)^CN=\S+,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US(?:.*)$">
|
|
380
|
+
<description>FreshTomato Router Fireware</description>
|
|
381
|
+
<example>CN=192.168.1.1,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US</example>
|
|
382
|
+
<param pos="0" name="os.vendor" value="FreshTomato"/>
|
|
383
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
384
|
+
<param pos="0" name="os.device" value="Router"/>
|
|
385
|
+
</fingerprint>
|
|
386
|
+
|
|
387
|
+
<fingerprint pattern="(?i)^SERIALNUMBER=(\d+),CN=(\S+),OU=ST-VS,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,C=DE">
|
|
388
|
+
<description>Bosch Device</description>
|
|
389
|
+
<example hw.serial_number="111111111111111111" host.mac="00-07-5f-11-11-11">SERIALNUMBER=111111111111111111,CN=00-07-5f-11-11-11,OU=ST-VS,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,C=DE</example>
|
|
390
|
+
<param pos="0" name="os.vendor" value="Bosch"/>
|
|
391
|
+
<param pos="0" name="hw.vendor" value="Bosch"/>
|
|
392
|
+
<param pos="1" name="hw.serial_number"/>
|
|
393
|
+
<param pos="2" name="host.mac"/>
|
|
159
394
|
</fingerprint>
|
|
160
395
|
|
|
161
396
|
</fingerprints>
|