recog 2.3.18 → 2.3.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/ci.yml +26 -0
  4. data/.github/workflows/verify.yml +89 -0
  5. data/CONTRIBUTING.md +6 -0
  6. data/README.md +17 -0
  7. data/bin/recog_standardize +33 -12
  8. data/bin/recog_verify +1 -2
  9. data/cpe-remap.yaml +355 -200
  10. data/features/verify.feature +14 -14
  11. data/identifiers/README.md +24 -10
  12. data/identifiers/fields.txt +105 -0
  13. data/identifiers/hw_device.txt +8 -0
  14. data/identifiers/hw_family.txt +19 -0
  15. data/identifiers/hw_product.txt +122 -0
  16. data/identifiers/os_device.txt +2 -1
  17. data/identifiers/os_family.txt +3 -0
  18. data/identifiers/os_product.txt +46 -8
  19. data/identifiers/service_family.txt +10 -1
  20. data/identifiers/service_product.txt +90 -2
  21. data/identifiers/vendor.txt +104 -0
  22. data/lib/recog/db.rb +2 -1
  23. data/lib/recog/fingerprint.rb +18 -5
  24. data/lib/recog/nizer.rb +1 -82
  25. data/lib/recog/verifier.rb +5 -5
  26. data/lib/recog/verifier_factory.rb +3 -3
  27. data/lib/recog/verify_reporter.rb +14 -4
  28. data/lib/recog/version.rb +1 -1
  29. data/requirements.txt +1 -1
  30. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  31. data/spec/lib/recog/verify_reporter_spec.rb +69 -0
  32. data/tools/dev/hooks/pre-commit +21 -0
  33. data/update_cpes.py +19 -6
  34. data/xml/apache_modules.xml +60 -0
  35. data/xml/apache_os.xml +38 -38
  36. data/xml/dhcp_vendor_class.xml +206 -0
  37. data/xml/dns_versionbind.xml +11 -1
  38. data/xml/favicons.xml +270 -45
  39. data/xml/ftp_banners.xml +89 -64
  40. data/xml/h323_callresp.xml +99 -99
  41. data/xml/hp_pjl_id.xml +3 -3
  42. data/xml/html_title.xml +1051 -62
  43. data/xml/http_cookies.xml +294 -85
  44. data/xml/http_servers.xml +551 -122
  45. data/xml/http_wwwauth.xml +139 -43
  46. data/xml/imap_banners.xml +8 -8
  47. data/xml/ldap_searchresult.xml +1 -0
  48. data/xml/mdns_device-info_txt.xml +720 -27
  49. data/xml/mysql_banners.xml +3 -2
  50. data/xml/nntp_banners.xml +4 -4
  51. data/xml/ntp_banners.xml +79 -65
  52. data/xml/operating_system.xml +6 -6
  53. data/xml/pop_banners.xml +11 -11
  54. data/xml/rsh_resp.xml +3 -3
  55. data/xml/rtsp_servers.xml +7 -0
  56. data/xml/sip_banners.xml +374 -9
  57. data/xml/sip_user_agents.xml +377 -5
  58. data/xml/smb_native_lm.xml +32 -1
  59. data/xml/smb_native_os.xml +160 -33
  60. data/xml/smtp_banners.xml +168 -129
  61. data/xml/smtp_ehlo.xml +1 -1
  62. data/xml/smtp_expn.xml +1 -0
  63. data/xml/smtp_help.xml +10 -10
  64. data/xml/smtp_noop.xml +2 -2
  65. data/xml/smtp_vrfy.xml +1 -0
  66. data/xml/snmp_sysdescr.xml +508 -214
  67. data/xml/snmp_sysobjid.xml +25 -25
  68. data/xml/ssh_banners.xml +145 -29
  69. data/xml/telnet_banners.xml +240 -61
  70. data/xml/tls_jarm.xml +162 -0
  71. data/xml/x509_issuers.xml +237 -2
  72. data/xml/x509_subjects.xml +369 -49
  73. metadata +10 -3
data/xml/dhcp_vendor_class.xml ADDED
@@ -0,0 +1,206 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <fingerprints matches="dhcp_vendor_class" protocol="dhcp" database_type="service">
3
+ <!--
4
+ Fingerprint definitions that are matched against the string values in the
5
+ dhcp message vi_vendor_class field
6
+ This field is Option 60 as defined in RFC 2132 section 9.13.
7
+ The vi_vendor_class field can be found in client discover (1), request (3)
8
+ and inform (8) messages.
9
+ -->
10
+
11
+ <fingerprint pattern="^Mfg=(?:Fuji)?(?i:Xerox);Typ=(?:MFP|printer);Mod=(?:Xerox )?(\S+) ([a-zA-Z0-9]+).*;Ser=([A-Z0-9]{9})(?:;Loc=.*)?$">
12
+ <description>Xerox Multifunction Printer</description>
13
+ <example hw.family="VersaLink" hw.model="C405" hw.serial_number="ABC123456">Mfg=Xerox;Typ=MFP;Mod=VersaLink C405;Ser=ABC123456;Loc=Print Room</example>
14
+ <example hw.family="AltaLink" hw.model="C8055" hw.serial_number="1AB234567">Mfg=Xerox;Typ=MFP;Mod=Xerox AltaLink C8055 Multifunction Printer;Ser=1AB234567;Loc=Print Room2</example>
15
+ <example hw.family="WorkCentre" hw.model="3345" hw.serial_number="1AB234567">Mfg=XEROX;Typ=MFP;Mod=WorkCentre 3345;Ser=1AB234567;Loc=</example>
16
+ <example hw.family="WorkCentre" hw.model="7845" hw.serial_number="AB1234567">Mfg=Xerox;Typ=MFP;Mod=Xerox WorkCentre 7845 v1 Multifunction System;Ser=AB1234567;Loc=</example>
17
+ <example hw.family="Phaser" hw.model="6500DN" hw.serial_number="ABC123456">Mfg=FujiXerox;Typ=printer;Mod=Phaser 6500DN;Ser=ABC123456</example>
18
+ <param pos="0" name="hw.device" value="Printer"/>
19
+ <param pos="0" name="hw.vendor" value="Xerox"/>
20
+ <param pos="1" name="hw.family"/>
21
+ <param pos="2" name="hw.model"/>
22
+ <param pos="3" name="hw.serial_number"/>
23
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
24
+ <param pos="0" name="os.vendor" value="Xerox"/>
25
+ <param pos="0" name="os.device" value="Printer"/>
26
+ </fingerprint>
27
+
28
+ <fingerprint pattern="^Mfg=Hewlett Packard;Typ=Printer;Mod=HP (LaserJet 200|LaserJet 400) (?:color |colorMFP |MFP )?(M\d+\S+);Ser=([A-Z0-9]{10});$">
29
+ <description>HP Multifunction Printer</description>
30
+ <example hw.family="LaserJet 200" hw.model="M276nw" hw.serial_number="ABC1DE2F3G">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 200 colorMFP M276nw;Ser=ABC1DE2F3G;</example>
31
+ <example hw.family="LaserJet 400" hw.model="M401dne" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401dne;Ser=ABCDE12345;</example>
32
+ <example hw.family="LaserJet 400" hw.model="M401dw" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401dw;Ser=ABCDE12345;</example>
33
+ <example hw.family="LaserJet 400" hw.model="M401n" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401n;Ser=ABCDE12345;</example>
34
+ <example hw.family="LaserJet 400" hw.model="M425dn" hw.serial_number="ABC1D23E4E">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 MFP M425dn;Ser=ABC1D23E4E;</example>
35
+ <param pos="0" name="hw.device" value="Printer"/>
36
+ <param pos="0" name="hw.vendor" value="HP"/>
37
+ <param pos="1" name="hw.family"/>
38
+ <param pos="2" name="hw.model"/>
39
+ <param pos="3" name="hw.serial_number"/>
40
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
41
+ <param pos="0" name="os.vendor" value="HP"/>
42
+ <param pos="0" name="os.device" value="Printer"/>
43
+ </fingerprint>
44
+
45
+ <fingerprint pattern="^(?:Hewlett-Packard|HP) (OfficeJet|LaserJet|Printer|JetDirect)$">
46
+ <description>HP Printer</description>
47
+ <example hw.family="LaserJet">Hewlett-Packard LaserJet</example>
48
+ <example hw.family="OfficeJet">Hewlett-Packard OfficeJet</example>
49
+ <example hw.family="LaserJet">HP LaserJet</example>
50
+ <example hw.family="Printer">HP Printer</example>
51
+ <example>Hewlett-Packard JetDirect</example>
52
+ <param pos="0" name="hw.device" value="Printer"/>
53
+ <param pos="0" name="hw.vendor" value="HP"/>
54
+ <param pos="1" name="hw.family"/>
55
+ <param pos="0" name="os.vendor" value="HP"/>
56
+ <param pos="0" name="os.device" value="Printer"/>
57
+ </fingerprint>
58
+
59
+ <fingerprint pattern="^Mfg=LEXMARK;Typ=(?:MFP|Printer);Mod=Lexmark (\S+);Ser=([A-Z0-9]{13});$">
60
+ <description>Lexmark Printer</description>
61
+ <example hw.model="MX410de" hw.serial_number="12345ABC6D7EF">Mfg=LEXMARK;Typ=MFP;Mod=Lexmark MX410de;Ser=12345ABC6D7EF;</example>
62
+ <example hw.model="MS310dn" hw.serial_number="123456AB7C8DE">Mfg=LEXMARK;Typ=Printer;Mod=Lexmark MS310dn;Ser=123456AB7C8DE;</example>
63
+ <param pos="0" name="hw.device" value="Printer"/>
64
+ <param pos="0" name="hw.vendor" value="Lexmark"/>
65
+ <param pos="1" name="hw.model"/>
66
+ <param pos="2" name="hw.serial_number"/>
67
+ <param pos="0" name="os.vendor" value="Lexmark"/>
68
+ <param pos="0" name="os.device" value="Printer"/>
69
+ </fingerprint>
70
+
71
+ <fingerprint pattern="^Canon iR-ADV (C?\d+ ?\S*)$">
72
+ <description>Canon imageRunner Printer</description>
73
+ <example hw.model="C5535 III">Canon iR-ADV C5535 III</example>
74
+ <example hw.model="C350">Canon iR-ADV C350</example>
75
+ <example hw.model="4545 III">Canon iR-ADV 4545 III</example>
76
+ <example hw.model="525">Canon iR-ADV 525</example>
77
+ <param pos="0" name="hw.device" value="Printer"/>
78
+ <param pos="0" name="hw.vendor" value="Canon"/>
79
+ <param pos="0" name="hw.family" value="imageRunner"/>
80
+ <param pos="1" name="hw.model"/>
81
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
82
+ <param pos="0" name="os.vendor" value="Canon"/>
83
+ <param pos="0" name="os.device" value="Printer"/>
84
+ </fingerprint>
85
+
86
+ <fingerprint pattern="^Canon (D\d+) Series$">
87
+ <description>Canon imageClass Printer</description>
88
+ <example hw.model="D1600">Canon D1600 Series</example>
89
+ <param pos="0" name="hw.device" value="Printer"/>
90
+ <param pos="0" name="hw.vendor" value="Canon"/>
91
+ <param pos="0" name="hw.family" value="imageClass"/>
92
+ <param pos="1" name="hw.model"/>
93
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
94
+ <param pos="0" name="os.vendor" value="Canon"/>
95
+ <param pos="0" name="os.device" value="Printer"/>
96
+ </fingerprint>
97
+
98
+ <fingerprint pattern="^Polycom-(VVX\d{3})$">
99
+ <description>Polycom IP Phone</description>
100
+ <example hw.product="VVX410" hw.model="VVX410">Polycom-VVX410</example>
101
+ <param pos="0" name="hw.device" value="VoIP"/>
102
+ <param pos="0" name="hw.vendor" value="Polycom"/>
103
+ <param pos="0" name="hw.family" value="VVX"/>
104
+ <param pos="1" name="hw.model"/>
105
+ <param pos="0" name="hw.product" value="{hw.model}"/>
106
+ <param pos="0" name="os.vendor" value="Polycom"/>
107
+ </fingerprint>
108
+
109
+ <fingerprint pattern="^Aruba\s(JL\d+A)\s(\d+[A-Z]?)\S+\sSwitch(?:\sdslforum.org)?$">
110
+ <description>HP Aruba Network Switch</description>
111
+ <example hw.product="JL075A" hw.family="3810M">Aruba JL075A 3810M-16SFP+-2-slot Switch</example>
112
+ <example hw.product="JL253A" hw.family="2930F">Aruba JL253A 2930F-24G-4SFP+ Switch dslforum.org</example>
113
+ <example hw.product="JL256A" hw.family="2930F">Aruba JL256A 2930F-48G-PoE+-4SFP+ Switch</example>
114
+ <example hw.product="JL258A" hw.family="2930F">Aruba JL258A 2930F-8G-PoE+-2SFP+ Switch</example>
115
+ <example hw.product="JL357A" hw.family="2540">Aruba JL357A 2540-48G-PoE+-4SFP+ Switch</example>
116
+ <param pos="0" name="hw.device" value="Switch"/>
117
+ <param pos="0" name="hw.vendor" value="Aruba Networks"/>
118
+ <param pos="1" name="hw.product"/>
119
+ <param pos="2" name="hw.family"/>
120
+ <param pos="0" name="os.vendor" value="Aruba Networks"/>
121
+ </fingerprint>
122
+
123
+ <fingerprint pattern="^AXIS,(?:PTZ Dome )?Network Camera,(.*),([\d\.]+)$">
124
+ <description>Axis Network Camera</description>
125
+ <example hw.model="P3343" os.version="5.20.3">AXIS,Network Camera,P3343,5.20.3</example>
126
+ <example hw.model="M5014" os.version="5.50.3.7">AXIS,PTZ Dome Network Camera,M5014,5.50.3.7</example>
127
+ <example hw.model="P3225-LV Mk II" os.version="9.70.1.5">AXIS,Network Camera,P3225-LV Mk II,9.70.1.5</example>
128
+ <param pos="0" name="hw.device" value="IP Camera"/>
129
+ <param pos="0" name="hw.vendor" value="AXIS"/>
130
+ <param pos="1" name="hw.model"/>
131
+ <param pos="0" name="os.vendor" value="AXIS"/>
132
+ <param pos="2" name="os.version"/>
133
+ </fingerprint>
134
+
135
+ <fingerprint pattern="^AXIS,(?:Network Video Encoder|Video Server),(\S+),([\d\.]+)$">
136
+ <description>Axis Video Encoder</description>
137
+ <example hw.model="M7011" os.version="5.90.1">AXIS,Network Video Encoder,M7011,5.90.1</example>
138
+ <param pos="0" name="hw.device" value="Video Encoder"/>
139
+ <param pos="0" name="hw.vendor" value="AXIS"/>
140
+ <param pos="1" name="hw.model"/>
141
+ <param pos="0" name="os.vendor" value="AXIS"/>
142
+ <param pos="2" name="os.version"/>
143
+ </fingerprint>
144
+
145
+ <fingerprint pattern="^AXIS,Network IO Audio Module,(\S+),([\d\.]+)$">
146
+ <description>Axis IO Audio Module</description>
147
+ <example hw.model="P8221" os.version="5.10.2">AXIS,Network IO Audio Module,P8221,5.10.2</example>
148
+ <param pos="0" name="hw.device" value="Audio Encoder"/>
149
+ <param pos="0" name="hw.vendor" value="AXIS"/>
150
+ <param pos="1" name="hw.model"/>
151
+ <param pos="0" name="os.vendor" value="AXIS"/>
152
+ <param pos="2" name="os.version"/>
153
+ </fingerprint>
154
+
155
+ <fingerprint pattern="^PCoIP Endpoint$">
156
+ <description>PCoIP Endpoint Device</description>
157
+ <example>PCoIP Endpoint</example>
158
+ <param pos="0" name="hw.device" value="Thin Client"/>
159
+ <param pos="0" name="hw.product" value="PCoIP Endpoint Device"/>
160
+ <param pos="0" name="os.vendor" value="Teradici"/>
161
+ <param pos="0" name="os.family" value="Teradici"/>
162
+ </fingerprint>
163
+
164
+ <fingerprint pattern="^android-dhcp-([\d\.]*)$">
165
+ <description>Android Device</description>
166
+ <example os.version="7.1.1">android-dhcp-7.1.1</example>
167
+ <param pos="0" name="os.vendor" value="Google"/>
168
+ <param pos="0" name="os.family" value="Linux"/>
169
+ <param pos="0" name="os.product" value="Android"/>
170
+ <param pos="1" name="os.version"/>
171
+ <param pos="0" name="os.cpe23" value="cpe:/o:google:android:{os.version}"/>
172
+ </fingerprint>
173
+
174
+ <fingerprint pattern="^dhcpcd-(?:[\d\.]+):Linux-([\d\.]+).*:(\S*):">
175
+ <description>Linux</description>
176
+ <example os.version="4.14.78" os.arch="armv7l">dhcpcd-6.11.5:Linux-4.14.78:armv7l:Freescale</example>
177
+ <example os.version="4.19.155" os.arch="x86_64">dhcpcd-6.8.2:Linux-4.19.155-10581-g8bdb5ed8e80c:x86_64:GenuineIntel</example>
178
+ <param pos="0" name="os.family" value="Linux"/>
179
+ <param pos="0" name="os.product" value="Linux"/>
180
+ <param pos="1" name="os.version"/>
181
+ <param pos="2" name="os.arch"/>
182
+ </fingerprint>
183
+
184
+ <fingerprint pattern="^SAMSUNG Network Printer$">
185
+ <description>Samsung Network Printer</description>
186
+ <example>SAMSUNG Network Printer</example>
187
+ <param pos="0" name="hw.device" value="Printer"/>
188
+ <param pos="0" name="hw.vendor" value="Samsung"/>
189
+ <param pos="0" name="os.vendor" value="Samsung"/>
190
+ </fingerprint>
191
+
192
+ <fingerprint pattern="^MERAKI$">
193
+ <description>MERAKI Device</description>
194
+ <example>MERAKI</example>
195
+ <param pos="0" name="hw.vendor" value="Meraki"/>
196
+ <param pos="0" name="os.vendor" value="Meraki"/>
197
+ </fingerprint>
198
+
199
+ <fingerprint pattern="^MSFT 5.0$">
200
+ <description>Microsoft Windows Device</description>
201
+ <example>MSFT 5.0</example>
202
+ <param pos="0" name="os.vendor" value="Microsoft"/>
203
+ <param pos="0" name="os.family" value="Windows"/>
204
+ </fingerprint>
205
+
206
+ </fingerprints>
data/xml/dns_versionbind.xml CHANGED
@@ -17,30 +17,40 @@
17
17
  <fingerprint pattern="^$">
18
18
  <description>empty string -- assert nothing.</description>
19
19
  <example/>
20
+ <param pos="0" name="hw.certainty" value="0.0"/>
21
+ <param pos="0" name="os.certainty" value="0.0"/>
20
22
  <param pos="0" name="service.certainty" value="0.0"/>
21
23
  </fingerprint>
22
24
 
23
25
  <fingerprint pattern="^none$">
24
26
  <description>bare 'none' -- assert nothing.</description>
25
27
  <example>none</example>
28
+ <param pos="0" name="hw.certainty" value="0.0"/>
29
+ <param pos="0" name="os.certainty" value="0.0"/>
26
30
  <param pos="0" name="service.certainty" value="0.0"/>
27
31
  </fingerprint>
28
32
 
29
33
  <fingerprint pattern="^null$">
30
34
  <description>bare 'null' -- assert nothing.</description>
31
35
  <example>null</example>
36
+ <param pos="0" name="hw.certainty" value="0.0"/>
37
+ <param pos="0" name="os.certainty" value="0.0"/>
32
38
  <param pos="0" name="service.certainty" value="0.0"/>
33
39
  </fingerprint>
34
40
 
35
41
  <fingerprint pattern="(?i)^unknown$">
36
42
  <description>bare 'unknown' -- assert nothing.</description>
37
43
  <example>unknown</example>
44
+ <param pos="0" name="hw.certainty" value="0.0"/>
45
+ <param pos="0" name="os.certainty" value="0.0"/>
38
46
  <param pos="0" name="service.certainty" value="0.0"/>
39
47
  </fingerprint>
40
48
 
41
49
  <fingerprint pattern="^no version$">
42
50
  <description>bare 'no version' -- assert nothing.</description>
43
51
  <example>no version</example>
52
+ <param pos="0" name="hw.certainty" value="0.0"/>
53
+ <param pos="0" name="os.certainty" value="0.0"/>
44
54
  <param pos="0" name="service.certainty" value="0.0"/>
45
55
  </fingerprint>
46
56
 
@@ -427,7 +437,7 @@
427
437
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:authoritative_server:{service.version}"/>
428
438
  </fingerprint>
429
439
 
430
- <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?[^ ]*) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
440
+ <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?[^ ]*) \(built [\w\s:]+ by [\w]+\@[\w.:-]*\)$">
431
441
  <description>PowerDNS Authoritative Server: format 2</description>
432
442
  <example service.version="4.0.4">PowerDNS Authoritative Server 4.0.4 (built Jul 26 2017 15:04:27 by root@FreeBSD:11:amd64-default-job-03)</example>
433
443
  <example service.version="4.0.0-rc2">PowerDNS Authoritative Server 4.0.0-rc2 (built Jul 4 2016 15:44:39 by root@foo-bar.baz)</example>