recog 2.3.19 → 2.3.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. checksums.yaml +4 -4
  2. data/bin/recog_standardize +6 -0
  3. data/cpe-remap.yaml +314 -211
  4. data/identifiers/README.md +24 -10
  5. data/identifiers/fields.txt +104 -0
  6. data/identifiers/hw_family.txt +5 -0
  7. data/identifiers/hw_product.txt +11 -0
  8. data/identifiers/os_device.txt +0 -1
  9. data/identifiers/os_family.txt +1 -0
  10. data/identifiers/os_product.txt +12 -8
  11. data/identifiers/service_family.txt +7 -1
  12. data/identifiers/service_product.txt +52 -3
  13. data/identifiers/vendor.txt +23 -1
  14. data/lib/recog/version.rb +1 -1
  15. data/requirements.txt +1 -1
  16. data/update_cpes.py +15 -2
  17. data/xml/apache_modules.xml +60 -0
  18. data/xml/dns_versionbind.xml +1 -1
  19. data/xml/favicons.xml +13 -3
  20. data/xml/ftp_banners.xml +4 -6
  21. data/xml/html_title.xml +362 -29
  22. data/xml/http_cookies.xml +179 -62
  23. data/xml/http_servers.xml +331 -81
  24. data/xml/http_wwwauth.xml +25 -6
  25. data/xml/ldap_searchresult.xml +1 -0
  26. data/xml/ntp_banners.xml +7 -1
  27. data/xml/sip_banners.xml +2 -0
  28. data/xml/sip_user_agents.xml +1 -0
  29. data/xml/smtp_banners.xml +41 -5
  30. data/xml/smtp_expn.xml +1 -0
  31. data/xml/smtp_vrfy.xml +1 -0
  32. data/xml/snmp_sysdescr.xml +52 -11
  33. data/xml/ssh_banners.xml +9 -3
  34. data/xml/telnet_banners.xml +10 -5
  35. data/xml/tls_jarm.xml +3 -2
  36. data/xml/x509_issuers.xml +155 -2
  37. data/xml/x509_subjects.xml +157 -20
  38. metadata +3 -2
data/xml/http_wwwauth.xml CHANGED
@@ -192,10 +192,20 @@
192
192
  <param pos="0" name="service.family" value="GoAhead Webserver"/>
193
193
  </fingerprint>
194
194
 
195
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Logitech Media Server&quot;.*$">
196
+ <description>Logitech Media server</description>
197
+ <example>Basic realm="Logitech Media Server"</example>
198
+ <param pos="0" name="service.vendor" value="Logitech"/>
199
+ <param pos="0" name="service.product" value="Squeezebox"/>
200
+ </fingerprint>
201
+
195
202
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
196
203
  <description>Kubernetes master nodes</description>
197
204
  <example>Basic realm="kubernetes-master"</example>
198
205
  <param pos="0" name="service.vendor" value="Kubernetes"/>
206
+ <param pos="0" name="service.family" value="Kubernetes"/>
207
+ <param pos="0" name="service.product" value="Kubernetes"/>
208
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
199
209
  </fingerprint>
200
210
 
201
211
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
@@ -326,29 +336,35 @@
326
336
 
327
337
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
328
338
  <description>TP-LINK SoHo Router - dash variant</description>
329
- <example>Basic realm="TD-W8901G"</example>
339
+ <example os.product="TD-W8901G">Basic realm="TD-W8901G"</example>
330
340
  <example>Basic realm="TD-8840T 2.0"</example>
331
- <example>Basic realm="TD-8811"</example>
341
+ <example hw.product="TD-8811">Basic realm="TD-8811"</example>
332
342
  <param pos="0" name="os.vendor" value="TP-LINK"/>
333
343
  <param pos="0" name="os.device" value="Router"/>
334
344
  <param pos="1" name="os.product"/>
345
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
346
+ <param pos="0" name="hw.device" value="Router"/>
347
+ <param pos="1" name="hw.product"/>
335
348
  </fingerprint>
336
349
 
337
350
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
338
351
  <description>TP-LINK SoHo Router</description>
339
- <example>Basic realm="TD854W"</example>
340
- <example>Basic realm="TD811"</example>
352
+ <example os.product="TD854W">Basic realm="TD854W"</example>
353
+ <example hw.product="TD811">Basic realm="TD811"</example>
341
354
  <example>Basic realm="TD821"</example>
342
355
  <example>Basic realm="TD841"</example>
343
356
  <param pos="0" name="os.vendor" value="TP-LINK"/>
344
357
  <param pos="0" name="os.device" value="Router"/>
345
358
  <param pos="1" name="os.product"/>
359
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
360
+ <param pos="0" name="hw.device" value="Router"/>
361
+ <param pos="1" name="hw.product"/>
346
362
  </fingerprint>
347
363
 
348
364
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
349
365
  <description>TP-LINK SoHo Router - verbose variant</description>
350
- <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
351
- <example>Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
366
+ <example os.product="WA801N">Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
367
+ <example hw.product="WA830RE">Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
352
368
  <example>Basic realm="TP-LINK Wireless Range Extender WA850RE"</example>
353
369
  <example>Basic realm="TP-LINK Wireless AP WA501G"</example>
354
370
  <example>Basic realm="TP-LINK Wireless N Access Point WA701ND"</example>
@@ -366,6 +382,9 @@
366
382
  <param pos="0" name="os.vendor" value="TP-LINK"/>
367
383
  <param pos="0" name="os.device" value="WAP"/>
368
384
  <param pos="1" name="os.product"/>
385
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
386
+ <param pos="0" name="hw.device" value="WAP"/>
387
+ <param pos="1" name="hw.product"/>
369
388
  </fingerprint>
370
389
 
371
390
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
data/xml/ldap_searchresult.xml CHANGED
@@ -365,6 +365,7 @@
365
365
  </example>
366
366
  <param pos="0" name="service.vendor" value="Kerio"/>
367
367
  <param pos="0" name="service.product" value="Connect"/>
368
+ <param pos="0" name="service.cpe23" value="cpe:/a:kerio:connect:-"/>
368
369
  </fingerprint>
369
370
 
370
371
  <fingerprint pattern="(?im:vmwPlatformServicesControllerVersion1.\x04.(\d\.\d\.\d)0.)">
data/xml/ntp_banners.xml CHANGED
@@ -362,6 +362,7 @@
362
362
  <param pos="0" name="os.product" value="NetScaler"/>
363
363
  <param pos="3" name="os.arch"/>
364
364
  <param pos="4" name="os.version"/>
365
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_firmware:{os.version}"/>
365
366
  </fingerprint>
366
367
 
367
368
  <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;FreeBSD/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
@@ -927,6 +928,11 @@
927
928
  <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:{os.version}"/>
928
929
  </fingerprint>
929
930
 
931
+ <!--
932
+ This may need to be split into ESX and ESXi. ESXi started w/ version 4.1 and
933
+ all versions 5.x were ESXi only.
934
+ -->
935
+
930
936
  <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;VMkernel/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
931
937
  <description>ntpd running on VMware ESXi</description>
932
938
  <example>
@@ -1032,7 +1038,7 @@
1032
1038
  <param pos="0" name="os.family" value="Data ONTAP"/>
1033
1039
  <param pos="0" name="os.product" value="Data ONTAP"/>
1034
1040
  <param pos="1" name="os.version"/>
1035
- <param pos="0" name="ow.device" value="NAS"/>
1041
+ <param pos="0" name="os.device" value="NAS"/>
1036
1042
  <param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:{os.version}"/>
1037
1043
  <param pos="0" name="hw.vendor" value="NetApp"/>
1038
1044
  <param pos="0" name="hw.device" value="NAS"/>
data/xml/sip_banners.xml CHANGED
@@ -103,6 +103,7 @@
103
103
  <param pos="0" name="hw.vendor" value="Cisco"/>
104
104
  <param pos="0" name="hw.product" value="SPA112"/>
105
105
  <param pos="0" name="hw.device" value="VoIP"/>
106
+ <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:spa112:-"/>
106
107
  </fingerprint>
107
108
 
108
109
  <fingerprint pattern="(?:Cisco|Linksys)/(SPA\d+[DG]?\d?)-([\d\.a-zA-Z]+)">
@@ -291,6 +292,7 @@
291
292
  <param pos="0" name="hw.product" value="UCM6204"/>
292
293
  <param pos="1" name="hw.version"/>
293
294
  <param pos="0" name="hw.device" value="SIP Gateway"/>
295
+ <param pos="0" name="hw.cpe23" value="cpe:/h:grandstream:ucm6204:{hw.version}"/>
294
296
  </fingerprint>
295
297
 
296
298
  <fingerprint pattern="^Grandstream UCM6202V(\d\.\d\w) ([\d.]+)$">
data/xml/sip_user_agents.xml CHANGED
@@ -408,6 +408,7 @@
408
408
  <param pos="0" name="hw.vendor" value="Grandstream"/>
409
409
  <param pos="0" name="hw.product" value="HT802"/>
410
410
  <param pos="0" name="hw.device" value="SIP Gateway"/>
411
+ <param pos="0" name="hw.cpe23" value="cpe:/h:grandstream:ht802:-"/>
411
412
  </fingerprint>
412
413
 
413
414
  <fingerprint pattern="^Grandstream HT801 ([\d.]+)$">
data/xml/smtp_banners.xml CHANGED
@@ -333,17 +333,20 @@
333
333
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
334
334
  </fingerprint>
335
335
 
336
- <fingerprint pattern="^ESMTP Exim$">
337
- <description>Exim - without version string or hostname</description>
336
+ <fingerprint pattern="^ESMTP Exim ?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d{3,4})?)$">
337
+ <description>Exim - without version string or hostname - timestamp optional</description>
338
338
  <example>ESMTP Exim</example>
339
+ <example system.time="Thu, 29 Apr 2021 06:46:16 +0200">ESMTP Exim Thu, 29 Apr 2021 06:46:16 +0200</example>
339
340
  <param pos="0" name="service.vendor" value="exim"/>
340
341
  <param pos="0" name="service.family" value="exim"/>
341
342
  <param pos="0" name="service.product" value="exim"/>
342
343
  <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
344
+ <param pos="1" name="system.time"/>
343
345
  </fingerprint>
344
346
 
345
- <fingerprint pattern="^ ?([^, ]+)(?:,)? ESMTP \(?(?i:Exim) +(\d+\.[\d_.bRC-]+)\)?(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
347
+ <fingerprint pattern="^ ?([^, ]+)(?:,)? +ESMTP \(?(?i:Exim) +(\d+\.[\d_.bdRC-]+)\)?(?: +#\d+)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d{3,4})?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
346
348
  <description>Exim - with version string and optional timestamp</description>
349
+ <example service.version="4.91" host.name="foo.bar">foo.bar ESMTP Exim 4.91 Thu, 29 Apr 2021 05:41:36 +400</example>
347
350
  <example service.version="4.89" host.name="foo.bar">foo.bar ESMTP Exim 4.89 "</example>
348
351
  <example service.version="4.83" host.name="foo.bar">foo.bar, ESMTP EXIM 4.83</example>
349
352
  <example service.version="4.84_2" host.name="foo.bar">foo.bar ESMTP Exim 4.84_2 </example>
@@ -352,7 +355,7 @@
352
355
  <example service.version="4.89-122312">foo.bar ESMTP Exim 4.89-122312 Thu, 16 Nov 2017 10:33:38 +0200 </example>
353
356
  <example service.version="4.87">foo.bar ESMTP (Exim 4.87) Thu, 30 Nov 2017 03:25:58 -0800 </example>
354
357
  <example service.version="4.80" system.time="Thu, 16 Nov 2017 01:04:30 -0800">foo.bar ESMTP Exim 4.80 Thu, 16 Nov 2017 01:04:30 -0800 </example>
355
- <example service.version="3.12" system.time="Wed, 31 Jan 2001 15:47:23 +1100">foo.bar ESMTP Exim 3.12 #1 Wed, 31 Jan 2001 15:47:23 +1100 </example>
358
+ <example service.version="4.92.2" system.time="Thu, 29 Apr 2021 07:43:39 +0200">foo.bar ESMTP Exim 4.92.2 #89 Thu, 29 Apr 2021 07:43:39 +0200 </example>
356
359
  <example service.version="4.89" host.name="foo.bar"> foo.bar ESMTP Exim 4.89 #1 Thu, 16 Nov 2017 04:55:31 -0500 We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.</example>
357
360
  <param pos="0" name="service.vendor" value="exim"/>
358
361
  <param pos="0" name="service.family" value="exim"/>
@@ -432,6 +435,16 @@
432
435
  <param pos="1" name="host.name"/>
433
436
  </fingerprint>
434
437
 
438
+ <fingerprint pattern="^([\w.-]+) ESMTP \([a-z0-9]{32}\)$">
439
+ <description>Barracuda Email Security Gateway - physical or virtual appliance</description>
440
+ <example host.name="barracuda.foo.bar">barracuda.foo.bar ESMTP (0a8d40ef45300cc1bd0f16ced5c9e6f1)</example>
441
+ <param pos="0" name="service.vendor" value="Barracuda"/>
442
+ <param pos="0" name="service.product" value="Email Security Gateway"/>
443
+ <param pos="0" name="hw.vendor" value="Barracuda"/>
444
+ <param pos="0" name="hw.product" value="Email Security Gateway"/>
445
+ <param pos="1" name="host.name"/>
446
+ </fingerprint>
447
+
435
448
  <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
436
449
  <description>FTGate mail server, runs on Windows 9x/NT/2k (http://www.ftgate.com)</description>
437
450
  <example host.name="foo.bar">foo.bar FTGate server ready -attitude [C.o.r.E]</example>
@@ -824,6 +837,7 @@
824
837
  <param pos="0" name="service.family" value="Lotus Domino"/>
825
838
  <param pos="0" name="service.product" value="Lotus Domino"/>
826
839
  <param pos="0" name="service.version" value="4"/>
840
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:4"/>
827
841
  <param pos="1" name="host.name"/>
828
842
  </fingerprint>
829
843
 
@@ -875,6 +889,7 @@
875
889
  <param pos="0" name="service.vendor" value="Lotus"/>
876
890
  <param pos="0" name="service.family" value="Lotus Domino"/>
877
891
  <param pos="0" name="service.product" value="Lotus Domino"/>
892
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:-"/>
878
893
  <param pos="1" name="host.name"/>
879
894
  <param pos="2" name="notes.build.version"/>
880
895
  <param pos="3" name="system.time"/>
@@ -886,6 +901,7 @@
886
901
  <param pos="0" name="service.vendor" value="Lotus"/>
887
902
  <param pos="0" name="service.family" value="Lotus Domino"/>
888
903
  <param pos="0" name="service.product" value="Lotus Domino"/>
904
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:-"/>
889
905
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
890
906
  <param pos="1" name="host.name"/>
891
907
  <param pos="2" name="system.time"/>
@@ -1325,6 +1341,25 @@
1325
1341
  <param pos="4" name="system.time"/>
1326
1342
  </fingerprint>
1327
1343
 
1344
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+deb9u1; (.+); .*$">
1345
+ <description>Sendmail - Debian 9.1 (stretch)</description>
1346
+ <example service.version="8.15.2">foo.bar ESMTP Sendmail 8.15.2/8.15.2/Debian-8+deb9u1; Thu, 29 Apr 2021 06:45:02 +0200; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1347
+ <param pos="0" name="service.vendor" value="Sendmail"/>
1348
+ <param pos="0" name="service.family" value="Sendmail"/>
1349
+ <param pos="0" name="service.product" value="Sendmail"/>
1350
+ <param pos="0" name="os.vendor" value="Debian"/>
1351
+ <param pos="0" name="os.family" value="Linux"/>
1352
+ <param pos="0" name="os.product" value="Linux"/>
1353
+ <param pos="0" name="os.version" value="9.1"/>
1354
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:9.1"/>
1355
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1356
+ <param pos="1" name="host.name"/>
1357
+ <param pos="2" name="service.version"/>
1358
+ <param pos="0" name="service.cpe23" value="cpe:/a:sendmail:sendmail:{service.version}"/>
1359
+ <param pos="3" name="sendmail.config.version"/>
1360
+ <param pos="4" name="system.time"/>
1361
+ </fingerprint>
1362
+
1328
1363
  <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+lenny\d; (.+); .*$">
1329
1364
  <description>Sendmail - Debian 5.x (lenny)</description>
1330
1365
  <example service.version="8.14.3">foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-5+lenny1; Thu, 30 Nov 2017 12:29:40 +0300; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
@@ -1563,9 +1598,10 @@
1563
1598
  <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1564
1599
  </fingerprint>
1565
1600
 
1566
- <fingerprint pattern="^ESMTP Sendmail +([^/ ]+) */ *([^/ ]+); (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)$">
1601
+ <fingerprint pattern="^\s?ESMTP Sendmail +([^/ ]+) */ *([^/ ]+); (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)$">
1567
1602
  <description>Sendmail - with version and date, w/o hostname or platform (semicolon variant)</description>
1568
1603
  <example service.version="8.13.1" sendmail.config.version="8.13.1" system.time="Thu, 30 Nov 2017 01:58:22 -0700">ESMTP Sendmail 8.13.1/8.13.1; Thu, 30 Nov 2017 01:58:22 -0700</example>
1604
+ <example service.version="8.14.7" sendmail.config.version="8.14.7" system.time="Thu, 29 Apr 2021 14:07:54 +0900"> ESMTP Sendmail 8.14.7/8.14.7; Thu, 29 Apr 2021 14:07:54 +0900</example>
1569
1605
  <param pos="0" name="service.vendor" value="Sendmail"/>
1570
1606
  <param pos="0" name="service.family" value="Sendmail"/>
1571
1607
  <param pos="0" name="service.product" value="Sendmail"/>
data/xml/smtp_expn.xml CHANGED
@@ -78,6 +78,7 @@
78
78
  <param pos="0" name="service.vendor" value="Lotus"/>
79
79
  <param pos="0" name="service.family" value="Lotus Domino"/>
80
80
  <param pos="0" name="service.product" value="Lotus Domino"/>
81
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:-"/>
81
82
  </fingerprint>
82
83
 
83
84
  <fingerprint pattern="^550[ -]Unable to find list '.*'\.$">
data/xml/smtp_vrfy.xml CHANGED
@@ -95,6 +95,7 @@
95
95
  <param pos="0" name="service.vendor" value="Lotus"/>
96
96
  <param pos="0" name="service.family" value="Lotus Domino"/>
97
97
  <param pos="0" name="service.product" value="Lotus Domino"/>
98
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:-"/>
98
99
  </fingerprint>
99
100
 
100
101
  </fingerprints>
data/xml/snmp_sysdescr.xml CHANGED
@@ -1583,7 +1583,7 @@
1583
1583
  <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
1584
1584
  <param pos="0" name="os.device" value="Firewall"/>
1585
1585
  <param pos="1" name="os.version"/>
1586
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance:{os.version}"/>
1586
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:{os.version}"/>
1587
1587
  <param pos="0" name="hw.vendor" value="Cisco"/>
1588
1588
  <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
1589
1589
  <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
@@ -1612,7 +1612,7 @@
1612
1612
  <param pos="0" name="os.product" value="VPN 3000 Concentrator"/>
1613
1613
  <param pos="0" name="os.device" value="VPN"/>
1614
1614
  <param pos="1" name="os.version"/>
1615
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:vpn_3000_concentrator:{os.version}"/>
1615
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:vpn_3000_concentrator_series_software:{os.version}"/>
1616
1616
  </fingerprint>
1617
1617
 
1618
1618
  <fingerprint pattern="^(?:Cisco )?Network Analysis Module \(WS-[^\)]+\), Version ([^, ]+)[,\s]?">
@@ -1631,6 +1631,11 @@ Copyright (c) 1999-2004 by cisco Systems, Inc.</example>
1631
1631
  <param pos="0" name="os.product" value="NAM"/>
1632
1632
  <param pos="0" name="os.device" value="Network Management Device"/>
1633
1633
  <param pos="1" name="os.version"/>
1634
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:network_analysis_module_software:{os.version}"/>
1635
+ <param pos="0" name="hw.vendor" value="Cisco"/>
1636
+ <param pos="0" name="hw.product" value="NAM"/>
1637
+ <param pos="0" name="hw.device" value="Network Management Device"/>
1638
+ <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:network_analysis_module:-"/>
1634
1639
  </fingerprint>
1635
1640
 
1636
1641
  <fingerprint pattern="^(?:Cisco )?Network Analysis Module \(WS-([^\-]+)-NAM\)$">
@@ -1640,6 +1645,9 @@ Copyright (c) 1999-2004 by cisco Systems, Inc.</example>
1640
1645
  <param pos="0" name="os.vendor" value="Cisco"/>
1641
1646
  <param pos="0" name="os.product" value="NAM"/>
1642
1647
  <param pos="0" name="os.device" value="Network Management Device"/>
1648
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:network_analysis_module_software:-"/>
1649
+ <param pos="0" name="hw.vendor" value="Cisco"/>
1650
+ <param pos="0" name="hw.device" value="Network Management Device"/>
1643
1651
  <param pos="1" name="hw.product"/>
1644
1652
  </fingerprint>
1645
1653
 
@@ -3074,6 +3082,7 @@ Copyright (c) 1995-2005 by Cisco Systems
3074
3082
  <param pos="0" name="os.product" value="iLO"/>
3075
3083
  <param pos="0" name="os.device" value="Lights Out Management"/>
3076
3084
  <param pos="1" name="os.version"/>
3085
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:{os.version}"/>
3077
3086
  </fingerprint>
3078
3087
 
3079
3088
  <fingerprint pattern="^Integrated Lights-Out (\d) \(iLO \d\) for Integrity$">
@@ -3084,6 +3093,7 @@ Copyright (c) 1995-2005 by Cisco Systems
3084
3093
  <param pos="0" name="os.product" value="iLO"/>
3085
3094
  <param pos="0" name="os.device" value="Lights Out Management"/>
3086
3095
  <param pos="1" name="os.version"/>
3096
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:{os.version}"/>
3087
3097
  </fingerprint>
3088
3098
 
3089
3099
  <!--======================================================================
@@ -4912,6 +4922,7 @@ Copyright (c) 1995-2005 by Cisco Systems
4912
4922
  <param pos="0" name="os.product" value="NetScaler"/>
4913
4923
  <param pos="1" name="os.version"/>
4914
4924
  <param pos="2" name="os.version.version"/>
4925
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_firmware:{os.version}"/>
4915
4926
  </fingerprint>
4916
4927
 
4917
4928
  <!--======================================================================
@@ -5555,14 +5566,28 @@ Copyright (c) 1995-2005 by Cisco Systems
5555
5566
  <example>Palo Alto Networks PA-4000 series firewall</example>
5556
5567
  <param pos="0" name="os.vendor" value="Palo Alto Networks"/>
5557
5568
  <param pos="0" name="os.device" value="Firewall"/>
5558
- <param pos="1" name="os.product"/>
5569
+ <param pos="0" name="os.product" value="PAN-OS"/>
5570
+ <param pos="0" name="os.family" value="PAN-OS"/>
5571
+ <param pos="0" name="os.cpe23" value="cpe:/o:paloaltonetworks:pan-os:-"/>
5572
+ <param pos="0" name="service.vendor" value="Palo Alto Networks"/>
5573
+ <param pos="0" name="service.device" value="Firewall"/>
5574
+ <param pos="0" name="hw.vendor" value="Palo Alto Networks"/>
5575
+ <param pos="0" name="hw.device" value="Firewall"/>
5576
+ <param pos="1" name="hw.product"/>
5559
5577
  </fingerprint>
5560
5578
 
5561
5579
  <fingerprint pattern="^Palo Alto Networks Panorama server$">
5562
5580
  <description>Palo Alto Panorama</description>
5563
5581
  <example>Palo Alto Networks Panorama server</example>
5564
5582
  <param pos="0" name="os.vendor" value="Palo Alto Networks"/>
5565
- <param pos="0" name="os.product" value="Panorama Server"/>
5583
+ <param pos="0" name="os.product" value="PAN-OS"/>
5584
+ <param pos="0" name="os.family" value="PAN-OS"/>
5585
+ <param pos="0" name="os.device" value="Firewall"/>
5586
+ <param pos="0" name="os.cpe23" value="cpe:/o:paloaltonetworks:pan-os:-"/>
5587
+ <param pos="0" name="service.vendor" value="Palo Alto Networks"/>
5588
+ <param pos="0" name="service.product" value="Panorama Server"/>
5589
+ <param pos="0" name="service.device" value="Firewall"/>
5590
+ <param pos="0" name="hw.vendor" value="Palo Alto Networks"/>
5566
5591
  </fingerprint>
5567
5592
 
5568
5593
  <!--======================================================================
@@ -6153,6 +6178,7 @@ Copyright (c) 1995-2005 by Cisco Systems
6153
6178
  <param pos="0" name="os.vendor" value="SonicWall"/>
6154
6179
  <param pos="0" name="os.device" value="Firewall"/>
6155
6180
  <param pos="0" name="os.product" value="SonicOS"/>
6181
+ <param pos="0" name="hw.vendor" value="SonicWall"/>
6156
6182
  <param pos="1" name="hw.product"/>
6157
6183
  <param pos="2" name="hw.model"/>
6158
6184
  <param pos="3" name="os.version"/>
@@ -6166,6 +6192,7 @@ Copyright (c) 1995-2005 by Cisco Systems
6166
6192
  <param pos="0" name="os.vendor" value="SonicWall"/>
6167
6193
  <param pos="0" name="os.device" value="Firewall"/>
6168
6194
  <param pos="0" name="os.product" value="SonicOS"/>
6195
+ <param pos="0" name="hw.vendor" value="SonicWall"/>
6169
6196
  <param pos="1" name="hw.product"/>
6170
6197
  <param pos="2" name="os.version"/>
6171
6198
  <param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:{os.version}"/>
@@ -6185,6 +6212,7 @@ Copyright (c) 1995-2005 by Cisco Systems
6185
6212
  <param pos="0" name="os.device" value="Firewall"/>
6186
6213
  <param pos="0" name="os.product" value="SonicOS"/>
6187
6214
  <param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
6215
+ <param pos="0" name="hw.vendor" value="SonicWall"/>
6188
6216
  <param pos="1" name="hw.family"/>
6189
6217
  <param pos="2" name="hw.product"/>
6190
6218
  </fingerprint>
@@ -7074,16 +7102,29 @@ Copyright (c) 1995-2005 by Cisco Systems
7074
7102
  VMware
7075
7103
  =======================================================================-->
7076
7104
 
7077
- <fingerprint pattern="^(VMware ESXi?) (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$">
7078
- <description>VMware ESX/ESXi</description>
7079
- <example os.product="VMware ESXi" os.version="5.1.0" os.arch="x86_64">VMware ESXi 5.1.0 build-1157734 VMware, Inc. x86_64</example>
7080
- <example os.product="VMware ESX" os.version="5.0.0" os.arch="x86_64">VMware ESX 5.0.0 build-623860 VMware, Inc. x86_64</example>
7105
+ <fingerprint pattern="^VMware ESXi (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$">
7106
+ <description>VMware ESXi</description>
7107
+ <example os.version="5.1.0" os.arch="x86_64">VMware ESXi 5.1.0 build-1157734 VMware, Inc. x86_64</example>
7081
7108
  <param pos="0" name="os.vendor" value="VMware"/>
7082
7109
  <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
7083
- <param pos="1" name="os.product"/>
7084
- <param pos="2" name="os.version"/>
7085
- <param pos="3" name="os.arch"/>
7110
+ <param pos="0" name="os.product" value="VMware ESXi Server"/>
7111
+ <param pos="1" name="os.version"/>
7112
+ <param pos="2" name="os.arch"/>
7113
+ <param pos="0" name="os.device" value="Hypervisor"/>
7114
+ <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:{os.version}"/>
7115
+ <param pos="0" name="hw.device" value="Hypervisor"/>
7116
+ </fingerprint>
7117
+
7118
+ <fingerprint pattern="^VMware ESX (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$">
7119
+ <description>VMware ESX</description>
7120
+ <example os.version="5.0.0" os.arch="x86_64">VMware ESX 5.0.0 build-623860 VMware, Inc. x86_64</example>
7121
+ <param pos="0" name="os.vendor" value="VMware"/>
7122
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
7123
+ <param pos="0" name="os.product" value="VMware ESX Server"/>
7124
+ <param pos="1" name="os.version"/>
7125
+ <param pos="2" name="os.arch"/>
7086
7126
  <param pos="0" name="os.device" value="Hypervisor"/>
7127
+ <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esx:{os.version}"/>
7087
7128
  <param pos="0" name="hw.device" value="Hypervisor"/>
7088
7129
  </fingerprint>
7089
7130
 
data/xml/ssh_banners.xml CHANGED
@@ -33,12 +33,12 @@
33
33
  <param pos="0" name="service.product" value="iLO"/>
34
34
  <param pos="0" name="service.family" value="iLO"/>
35
35
  <param pos="1" name="service.version"/>
36
- <param pos="0" name="service.cpe23" value="cpe:/a:hp:integrated_lights_out:{service.version}"/>
37
36
  <param pos="0" name="hw.vendor" value="HP"/>
38
37
  <param pos="0" name="os.vendor" value="HP"/>
39
38
  <param pos="0" name="os.product" value="iLO"/>
40
39
  <param pos="0" name="os.family" value="iLO"/>
41
40
  <param pos="0" name="os.device" value="Lights Out Management"/>
41
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
42
42
  </fingerprint>
43
43
 
44
44
  <fingerprint pattern="^Serv-U_([\d\.]+)$">
@@ -1704,7 +1704,7 @@
1704
1704
  <param pos="0" name="service.product" value="SSH"/>
1705
1705
  <param pos="0" name="os.vendor" value="Cisco"/>
1706
1706
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
1707
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
1707
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
1708
1708
  </fingerprint>
1709
1709
 
1710
1710
  <fingerprint pattern="(?i)^Cleo (\S+)/(\S+) SSH FTP server$">
@@ -1865,6 +1865,7 @@
1865
1865
  <param pos="0" name="service.vendor" value="Standard Networks"/>
1866
1866
  <param pos="0" name="service.family" value="MOVEit DMZ"/>
1867
1867
  <param pos="0" name="service.product" value="MOVEit DMZ"/>
1868
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:moveit_dmz:{service.version}"/>
1868
1869
  <param pos="0" name="os.vendor" value="Microsoft"/>
1869
1870
  <param pos="0" name="os.family" value="Windows"/>
1870
1871
  <param pos="0" name="os.product" value="Windows"/>
@@ -1953,7 +1954,8 @@
1953
1954
  <param pos="1" name="service.version"/>
1954
1955
  <param pos="0" name="service.vendor" value="Attachmate"/>
1955
1956
  <param pos="0" name="service.family" value="Reflection"/>
1956
- <param pos="0" name="service.product" value="Reflection"/>
1957
+ <param pos="0" name="service.product" value="Reflection for Secure IT"/>
1958
+ <param pos="0" name="service.cpe23" value="cpe:/a:attachmate:reflection_for_secure_it:{service.version}"/>
1957
1959
  </fingerprint>
1958
1960
 
1959
1961
  <fingerprint pattern="^([^\s]*)\s*F-Secure SSH\s*(?:.*)$">
@@ -1972,6 +1974,7 @@
1972
1974
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
1973
1975
  <param pos="0" name="service.family" value="SSH Tectia Server"/>
1974
1976
  <param pos="0" name="service.product" value="SSH Tectia Server"/>
1977
+ <param pos="0" name="service.cpe23" value="cpe:/a:ssh:tectia_server:{service.version}"/>
1975
1978
  </fingerprint>
1976
1979
 
1977
1980
  <fingerprint pattern="^([0-9\.]+) SSH Secure Shell(?: \(non-commercial\))?$">
@@ -1983,6 +1986,7 @@
1983
1986
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
1984
1987
  <param pos="0" name="service.family" value="SSH Tectia Server"/>
1985
1988
  <param pos="0" name="service.product" value="SSH Tectia Server"/>
1989
+ <param pos="0" name="service.cpe23" value="cpe:/a:ssh:tectia_server:{service.version}"/>
1986
1990
  </fingerprint>
1987
1991
 
1988
1992
  <fingerprint pattern="^([0-9\.]+) SSH Secure Shell Windows NT Server$">
@@ -1996,6 +2000,7 @@
1996
2000
  <param pos="0" name="service.vendor" value="SSH Communications Security"/>
1997
2001
  <param pos="0" name="service.family" value="SSH Tectia Server"/>
1998
2002
  <param pos="0" name="service.product" value="SSH Tectia Server"/>
2003
+ <param pos="0" name="service.cpe23" value="cpe:/a:ssh:tectia_server:{service.version}"/>
1999
2004
  </fingerprint>
2000
2005
 
2001
2006
  <fingerprint pattern="^ARRIS_(.*)$">
@@ -2083,6 +2088,7 @@
2083
2088
  <param pos="0" name="service.vendor" value="Standard Networks"/>
2084
2089
  <param pos="0" name="service.family" value="MOVEit DMZ"/>
2085
2090
  <param pos="0" name="service.product" value="MOVEit DMZ"/>
2091
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:moveit_dmz:-"/>
2086
2092
  <param pos="0" name="os.vendor" value="Microsoft"/>
2087
2093
  <param pos="0" name="os.family" value="Windows"/>
2088
2094
  <param pos="0" name="os.product" value="Windows"/>