recog 2.3.19 → 2.3.20

Sign up to get free protection for your applications and to get access to all the features.
Files changed (38) hide show
  1. checksums.yaml +4 -4
  2. data/bin/recog_standardize +6 -0
  3. data/cpe-remap.yaml +314 -211
  4. data/identifiers/README.md +24 -10
  5. data/identifiers/fields.txt +104 -0
  6. data/identifiers/hw_family.txt +5 -0
  7. data/identifiers/hw_product.txt +11 -0
  8. data/identifiers/os_device.txt +0 -1
  9. data/identifiers/os_family.txt +1 -0
  10. data/identifiers/os_product.txt +12 -8
  11. data/identifiers/service_family.txt +7 -1
  12. data/identifiers/service_product.txt +52 -3
  13. data/identifiers/vendor.txt +23 -1
  14. data/lib/recog/version.rb +1 -1
  15. data/requirements.txt +1 -1
  16. data/update_cpes.py +15 -2
  17. data/xml/apache_modules.xml +60 -0
  18. data/xml/dns_versionbind.xml +1 -1
  19. data/xml/favicons.xml +13 -3
  20. data/xml/ftp_banners.xml +4 -6
  21. data/xml/html_title.xml +362 -29
  22. data/xml/http_cookies.xml +179 -62
  23. data/xml/http_servers.xml +331 -81
  24. data/xml/http_wwwauth.xml +25 -6
  25. data/xml/ldap_searchresult.xml +1 -0
  26. data/xml/ntp_banners.xml +7 -1
  27. data/xml/sip_banners.xml +2 -0
  28. data/xml/sip_user_agents.xml +1 -0
  29. data/xml/smtp_banners.xml +41 -5
  30. data/xml/smtp_expn.xml +1 -0
  31. data/xml/smtp_vrfy.xml +1 -0
  32. data/xml/snmp_sysdescr.xml +52 -11
  33. data/xml/ssh_banners.xml +9 -3
  34. data/xml/telnet_banners.xml +10 -5
  35. data/xml/tls_jarm.xml +3 -2
  36. data/xml/x509_issuers.xml +155 -2
  37. data/xml/x509_subjects.xml +157 -20
  38. metadata +3 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 1730f78c5d43d5e0bf074820df10e11d051112e1f35a768807942cef830c8752
4
- data.tar.gz: f4bbfb15e03793f02bed6da87e76ff6750a737b08957f216a41377ad5dd4e77f
3
+ metadata.gz: cb4df95cbe1561c384b06be8c36fcea1e51df3c6cdb86a2a944715213d119ae8
4
+ data.tar.gz: 751fa73b20c6fb9f1c372be5503c07302101b77d729cdce3befee2981651f1ca
5
5
  SHA512:
6
- metadata.gz: 0ddc88f9553b8ac65157032c8d082b315dfee065fd9994bd9c4f04fb1f23738ce4b15d7e958ef85cd4d548422bbab6db7343126560242b2aacf66a0bea05794a
7
- data.tar.gz: 18a1df88375afa271379547779eaeb2379f431164ac116316005ff60d2035b89608c4aec64e2a66ac9f7d27af13e58e703ead9a2f3532f8d9b1074439ad05458
6
+ metadata.gz: 6612cf0d0c5f19cd1a913123fe3c4fce9772ac82b7a07f78ace94f51b1681210a8dfacde3624b2b54c7d66f2f1530771d9a592c3d5bda8bde897d4f9713c2ef9
7
+ data.tar.gz: 7b935f573b7b4050b2b06e2b8965af9201bb385e2695f9859e6ecf233f93aadb9331d648b18a506528efbd97e2821d0b9816970bfd5df978262b05ec8aeb9f8e
data/bin/recog_standardize CHANGED
@@ -50,6 +50,7 @@ end
50
50
 
51
51
  # Load the unique identifiers
52
52
  vendors = load_identifiers(File.join(bdir, "vendor.txt"))
53
+ fields = load_identifiers(File.join(bdir, "fields.txt"))
53
54
  os_arch = load_identifiers(File.join(bdir, "os_architecture.txt"))
54
55
  os_prod = load_identifiers(File.join(bdir, "os_product.txt"))
55
56
  os_family = load_identifiers(File.join(bdir, "os_family.txt"))
@@ -67,6 +68,10 @@ ARGV.each do |arg|
67
68
  ndb.fingerprints.each do |f|
68
69
  f.params.each do |k,v|
69
70
  paramIndex, val = v
71
+ if ! fields[k]
72
+ puts "FIELD MISSING: #{k}"
73
+ fields[k] = true
74
+ end
70
75
  next if paramIndex != 0
71
76
  next if val.index("{") != nil
72
77
  next if val.strip == ""
@@ -131,6 +136,7 @@ exit if ! options.write
131
136
 
132
137
  # Write back the unique identifiers
133
138
  write_identifiers(vendors, File.join(bdir, "vendor.txt"))
139
+ write_identifiers(fields, File.join(bdir, "fields.txt"))
134
140
  write_identifiers(os_arch, File.join(bdir, "os_architecture.txt"))
135
141
  write_identifiers(os_prod, File.join(bdir, "os_product.txt"))
136
142
  write_identifiers(os_family, File.join(bdir, "os_family.txt"))
data/cpe-remap.yaml CHANGED
@@ -1,212 +1,315 @@
1
1
  mappings:
2
- alpine:
3
- vendor: alpinelinux
4
- products:
5
- linux: alpine_linux
6
- apache:
7
- products:
8
- httpd: http_server
9
- apple:
10
- products:
11
- ios: iphone_os
12
- aprelium_technologies:
13
- vendor: aprelium
14
- alt-n:
15
- vendor: altn
16
- aruba_networks:
17
- vendor: arubanetworks
18
- bea:
19
- products:
20
- weblogic: weblogic_server
21
- blue_coat:
22
- vendor: bluecoat
23
- carnegie_mellon_university:
24
- vendor: cmu
25
- products:
26
- cyrus_imap: cyrus_imap_server
27
- centos:
28
- products:
29
- linux: centos
30
- centos_webpanel:
31
- vendor: centos-webpanel
32
- check_point:
33
- vendor: checkpoint
34
- cherokee_project:
35
- vendor: cherokee-project
36
- cisco:
37
- vendor: cisco
38
- products:
39
- adaptive_security_appliance: adaptive_security_appliance_software
40
- apic: application_policy_infrastructure_controller
41
- pix: pix_firewall_software
42
- telepresence: telepresence_video_communication_server_software
43
- crushftp:
44
- products:
45
- crushftp_web_interface: crushftp
46
- cumulus:
47
- vendor: cumulusnetworks
48
- data_domain:
49
- vendor: dell
50
- products:
51
- dd_os: emc_data_domain_os
52
- debian:
53
- products:
54
- linux: debian_linux
55
- drupal:
56
- products:
57
- cms: drupal
58
- embedthis:
59
- products:
60
- goahead_webserver: goahead
61
- emc:
62
- products:
63
- celerra: celerra_network_attached_storage
64
- f5:
65
- products:
66
- big-ip: big-ip_local_traffic_manager
67
- big-ip_ltm: big-ip_local_traffic_manager
68
- fedora_project:
69
- vendor: fedoraproject
70
- hp:
71
- products:
72
- ilo: integrated_lights_out
73
- tru64_unix: tru64
74
- ibm:
75
- products:
76
- lotus_domino: lotus_domino_server
77
- ibm_domino: lotus_domino
78
- os/400: os_400
79
- i5/os: i5os
80
- ignite_realtime:
81
- vendor: igniterealtime
82
- intel:
83
- products:
84
- intel(r)_active_management_technology: active_management_technology
85
- intel(r)_standard_manageability: standard_manageability
86
- jamf:
87
- products:
88
- jamf_pro: jamf
89
- juniper:
90
- products:
91
- junos_os: junos
92
- kibana:
93
- vendor: elasticsearch
94
- kodi:
95
- products:
96
- media_server: kodi
97
- cz.nic:
98
- vendor: knot-dns
99
- litespeed_technologies:
100
- vendor: litespeedtech
101
- linux:
102
- products:
103
- linux: linux_kernel
104
- lynx_technology:
105
- vendor: lynxtechnology
106
- products:
107
- twonky_media_server: twonky_server
108
- mailenable:
109
- products:
110
- mail_server: mailenable
111
- microsoft:
112
- products:
113
- active_directory_controller: active_directory
114
- exchange_server_5.5: exchange_server
115
- exchange_2000_server: exchange_server
116
- exchange_2003_server: exchange_server
117
- exchange_2007_server: exchange_server
118
- lightweight_directory_server: active_directory_lightweight_directory_service
119
- windows_server_2003_datacenter_edition: windows_server_2003
120
- windows_server_2003_r2: windows_server_2003
121
- windows_2008_r2: windows_server_2008
122
- windows_server_2008_datacenter_edition: windows_server_2008
123
- windows_server_2008_r2: windows_server_2008
124
- windows_server_2008_r2_datacenter_edition: windows_server_2008
125
- windows_server_2012_r2: windows_server_2012
126
- nt: windows_nt
127
- windows_nt_desktop: windows_nt
128
- windows_nt_server: windows_nt
129
- windows_server_2000: windows_2000
130
- windows_2000_server: windows_2000
131
- windows_2000_datacenter_server: windows_2000
132
- pws: personal_web_server
133
- mod_ssl:
134
- vendor: modssl
135
- mod_wsgi:
136
- vendor: modwsgi
137
- mort_bay:
138
- vendor: mortbay
139
- munin:
140
- vendor: munin-monitoring
141
- nlnet_labs:
142
- vendor: nlnetlabs
143
- products:
144
- dnsd: name_server_daemon
145
- net-snmp:
146
- products:
147
- snmp_agent: net-snmp
148
- owncloud:
149
- products:
150
- owncloud_server: owncloud
151
- palo_alto_networks:
152
- vendor: paloaltonetworks
153
- products:
154
- pa_firewall: pan-os
155
- parallels:
156
- products:
157
- plesk: parallels_plesk_panel
158
- plesk:
159
- vendor: parallels
160
- proftpd_project:
161
- vendor: proftpd
162
- progress:
163
- products:
164
- openedge_explorer: openedge
165
- pulse_secure:
166
- vendor: pulsesecure
167
- realvnc_ltd.:
168
- vendor: realvnc
169
- red_hat:
170
- vendor: redhat
171
- products:
172
- cygwin_x_server_project: cygwin
173
- fedora_core_linux: fedora_core
174
- jboss_as: jboss_wildfly_application_server
175
- jboss_eap: jboss_enterprise_application_platform
176
- jbossweb: jboss_web_framework_kit
177
- red_hat_directory_server: directory_server
178
- squid_cache:
179
- vendor: squid-cache
180
- sun:
181
- vendor: sun
182
- products:
183
- solaris: sunos
184
- swagger:
185
- vendor: smartbear
186
- tandberg:
187
- vendor: cisco
188
- tightvnc:
189
- products:
190
- desktop: tightvnc
191
- tor_project:
192
- vendor: torproject
193
- ubiquiti:
194
- vendor: ui
195
- ubuntu:
196
- vendor: canonical
197
- products:
198
- linux: ubuntu_linux
199
- vandyke_software:
200
- vendor: vandyke
201
- vmware:
202
- products:
203
- photon_linux: photon_os
204
- zimbra: zimbra_desktop
205
- vcenter: vcenter_server
206
- vmware_esx_server: esx
207
- vmware_esxi_server: esxi
208
- wind_river:
209
- vendor: windriver
210
- x.org:
211
- products:
212
- x.org_x11: x11
2
+ # The following section contains CPE application or 'a' remappings. These will
3
+ # ONLY be used for mapping Recog 'service' attributes.
4
+ a:
5
+ akamai:
6
+ products:
7
+ ghost: akamaighost
8
+ amazon:
9
+ products:
10
+ s3: amazon_simple_storage_service
11
+ cloudfront_load_balancer: amazon_cloudfront
12
+ apache:
13
+ products:
14
+ httpd: http_server
15
+ aprelium_technologies:
16
+ vendor: aprelium
17
+ alt-n:
18
+ vendor: altn
19
+ aruba_networks:
20
+ vendor: arubanetworks
21
+ bea:
22
+ products:
23
+ weblogic: weblogic_server
24
+ blue_coat:
25
+ vendor: bluecoat
26
+ carnegie_mellon_university:
27
+ vendor: cmu
28
+ products:
29
+ cyrus_imap: cyrus_imap_server
30
+ centos_webpanel:
31
+ vendor: centos-webpanel
32
+ check_point:
33
+ vendor: checkpoint
34
+ cherokee_project:
35
+ vendor: cherokee-project
36
+ cisco:
37
+ products:
38
+ apic: application_policy_infrastructure_controller
39
+ cloudflare:
40
+ products:
41
+ cloudflare_load_balancer: load_balancing
42
+ cpanel:
43
+ products:
44
+ cpanel_service_daemon: cpanel
45
+ crushftp:
46
+ products:
47
+ crushftp_web_interface: crushftp
48
+ cz.nic:
49
+ vendor: knot-dns
50
+ drupal:
51
+ products:
52
+ cms: drupal
53
+ embedthis:
54
+ products:
55
+ goahead_webserver: goahead
56
+ envoy_proxy:
57
+ vendor: envoyproxy
58
+ f5:
59
+ products:
60
+ big-ip: big-ip_local_traffic_manager
61
+ big-ip_ltm: big-ip_local_traffic_manager
62
+ fedora_project:
63
+ vendor: fedoraproject
64
+ google:
65
+ products:
66
+ google_web_services: web_server
67
+ ibm:
68
+ products:
69
+ lotus_domino: lotus_domino_server
70
+ ibm_domino: lotus_domino
71
+ ignite_realtime:
72
+ vendor: igniterealtime
73
+ intel:
74
+ products:
75
+ intel(r)_active_management_technology: active_management_technology
76
+ intel(r)_standard_manageability: standard_manageability
77
+ jamf:
78
+ products:
79
+ jamf_pro: jamf
80
+ kibana:
81
+ vendor: elasticsearch
82
+ kubernetes:
83
+ products:
84
+ nginx_ingress_controller: ingress-nginx
85
+ kodi:
86
+ products:
87
+ media_server: kodi
88
+ kong:
89
+ vendor: konghq
90
+ products:
91
+ gateway: kong_gateway
92
+ litespeed_technologies:
93
+ vendor: litespeedtech
94
+ lotus:
95
+ vendor: ibm
96
+ lynx_technology:
97
+ vendor: lynxtechnology
98
+ products:
99
+ twonky_media_server: twonky_server
100
+ mailenable:
101
+ products:
102
+ mail_server: mailenable
103
+ manageengine:
104
+ vendor: zohocorp
105
+ products:
106
+ adaudit_plus: manageengine_adaudit_plus
107
+ desktop_central: manageengine_desktop_central
108
+ opmanager: manageengine_opmanager
109
+ microsoft:
110
+ products:
111
+ active_directory_controller: active_directory
112
+ exchange_server_5.5: exchange_server
113
+ exchange_2000_server: exchange_server
114
+ exchange_2003_server: exchange_server
115
+ exchange_2007_server: exchange_server
116
+ lightweight_directory_server: active_directory_lightweight_directory_service
117
+ pws: personal_web_server
118
+ mod_ssl:
119
+ vendor: modssl
120
+ mod_wsgi:
121
+ vendor: modwsgi
122
+ # NIST took the vendor name from the website but apparently missed the `.in`
123
+ # in moinmo.in was part of the name
124
+ moinmoin:
125
+ vendor: moinmo
126
+ mort_bay:
127
+ vendor: mortbay
128
+ munin:
129
+ vendor: munin-monitoring
130
+ nlnet_labs:
131
+ vendor: nlnetlabs
132
+ products:
133
+ dnsd: name_server_daemon
134
+ net-snmp:
135
+ products:
136
+ snmp_agent: net-snmp
137
+ owncloud:
138
+ products:
139
+ owncloud_server: owncloud
140
+ parallels:
141
+ products:
142
+ plesk: parallels_plesk_panel
143
+ plesk:
144
+ vendor: parallels
145
+ proftpd_project:
146
+ vendor: proftpd
147
+ progress:
148
+ products:
149
+ openedge_explorer: openedge
150
+ pulse_secure:
151
+ vendor: pulsesecure
152
+ realvnc_ltd.:
153
+ vendor: realvnc
154
+ red_hat:
155
+ vendor: redhat
156
+ products:
157
+ cygwin_x_server_project: cygwin
158
+ jboss_as: jboss_wildfly_application_server
159
+ jboss_eap: jboss_enterprise_application_platform
160
+ jbossweb: jboss_web_framework_kit
161
+ red_hat_directory_server: directory_server
162
+ serv-u:
163
+ vendor: solarwinds
164
+ squid_cache:
165
+ vendor: squid-cache
166
+ ssh_communications_security:
167
+ vendor: ssh
168
+ products:
169
+ ssh_tectia_server: tectia_server
170
+ standard_networks:
171
+ vendor: ipswitch
172
+ swagger:
173
+ vendor: smartbear
174
+ synology:
175
+ products:
176
+ dsm: diskstation_manager
177
+ tightvnc:
178
+ products:
179
+ desktop: tightvnc
180
+ tor_project:
181
+ vendor: torproject
182
+ traefik_labs:
183
+ vendor: containous
184
+ products:
185
+ traefik_proxy: traefik
186
+ twistedmatrix:
187
+ products:
188
+ twisted_web: twistedweb
189
+ ubiquiti:
190
+ vendor: ui
191
+ vandyke_software:
192
+ vendor: vandyke
193
+ vmware:
194
+ products:
195
+ zimbra: zimbra_desktop
196
+ vcenter: vcenter_server
197
+ x.org:
198
+ products:
199
+ x.org_x11: x11
200
+
201
+ # The following section contains CPE operating system or 'o' remappings. These will
202
+ # ONLY be used for mapping Recog 'os' attributes.
203
+ o:
204
+ alpine:
205
+ vendor: alpinelinux
206
+ products:
207
+ linux: alpine_linux
208
+ apple:
209
+ products:
210
+ ios: iphone_os
211
+ centos:
212
+ products:
213
+ linux: centos
214
+ check_point:
215
+ vendor: checkpoint
216
+ cisco:
217
+ products:
218
+ adaptive_security_appliance: adaptive_security_appliance_software
219
+ nam: network_analysis_module_software
220
+ pix: pix_firewall_software
221
+ telepresence: telepresence_video_communication_server_software
222
+ vpn_3000_concentrator: vpn_3000_concentrator_series_software
223
+ wireless_lan_controller: wireless_lan_controller_software
224
+ citrix:
225
+ products:
226
+ netscaler: netscaler_firmware
227
+ netscaler_gateway: netscaler_gateway_firmware
228
+ cumulus:
229
+ vendor: cumulusnetworks
230
+ data_domain:
231
+ vendor: dell
232
+ products:
233
+ dd_os: emc_data_domain_os
234
+ debian:
235
+ products:
236
+ linux: debian_linux
237
+ hp:
238
+ products:
239
+ ilo: integrated_lights-out_firmware
240
+ ilo_firmware: integrated_lights-out_firmware
241
+ ilo_2: integrated_lights-out_2_firmware
242
+ ilo_3: integrated_lights-out_3_firmware
243
+ ilo_4: integrated_lights-out_4_firmware
244
+ ilo_5: integrated_lights-out_5_firmware
245
+ tru64_unix: tru64
246
+ ibm:
247
+ products:
248
+ os/400: os_400
249
+ i5/os: i5os
250
+ juniper:
251
+ products:
252
+ junos_os: junos
253
+ linux:
254
+ products:
255
+ linux: linux_kernel
256
+ microsoft:
257
+ products:
258
+ windows_server_2003_datacenter_edition: windows_server_2003
259
+ windows_server_2003_r2: windows_server_2003
260
+ windows_2008_r2: windows_server_2008
261
+ windows_server_2008_datacenter_edition: windows_server_2008
262
+ windows_server_2008_r2: windows_server_2008
263
+ windows_server_2008_r2_datacenter_edition: windows_server_2008
264
+ windows_server_2012_r2: windows_server_2012
265
+ nt: windows_nt
266
+ windows_nt_desktop: windows_nt
267
+ windows_nt_server: windows_nt
268
+ windows_server_2000: windows_2000
269
+ windows_2000_server: windows_2000
270
+ windows_2000_datacenter_server: windows_2000
271
+ oracle:
272
+ products:
273
+ ilom: integrated_lights_out_manager_firmware
274
+ palo_alto_networks:
275
+ vendor: paloaltonetworks
276
+ red_hat:
277
+ vendor: redhat
278
+ products:
279
+ fedora_core_linux: fedora_core
280
+ sun:
281
+ products:
282
+ solaris: sunos
283
+ ubiquiti:
284
+ vendor: ui
285
+ ubuntu:
286
+ vendor: canonical
287
+ products:
288
+ linux: ubuntu_linux
289
+ vmware:
290
+ products:
291
+ photon_linux: photon_os
292
+ vmware_esx_server: esx
293
+ vmware_esxi_server: esxi
294
+ wind_river:
295
+ vendor: windriver
296
+
297
+ # The following section contains CPE hardware or 'h' remappings. These will
298
+ # ONLY be used for mapping Recog 'hw' attributes.
299
+ h:
300
+ cisco:
301
+ products:
302
+ nam: network_analysis_module
303
+ citrix:
304
+ products:
305
+ netscaler_sdx_gateway: netscaler_sdx
306
+ emc:
307
+ products:
308
+ celerra: celerra_network_attached_storage
309
+ hp:
310
+ products:
311
+ ilo: integrated_lights-out
312
+ tandberg:
313
+ vendor: cisco
314
+ ubiquiti:
315
+ vendor: ui