recog 2.3.19 → 2.3.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. checksums.yaml +4 -4
  2. data/bin/recog_standardize +6 -0
  3. data/cpe-remap.yaml +314 -211
  4. data/identifiers/README.md +24 -10
  5. data/identifiers/fields.txt +104 -0
  6. data/identifiers/hw_family.txt +5 -0
  7. data/identifiers/hw_product.txt +11 -0
  8. data/identifiers/os_device.txt +0 -1
  9. data/identifiers/os_family.txt +1 -0
  10. data/identifiers/os_product.txt +12 -8
  11. data/identifiers/service_family.txt +7 -1
  12. data/identifiers/service_product.txt +52 -3
  13. data/identifiers/vendor.txt +23 -1
  14. data/lib/recog/version.rb +1 -1
  15. data/requirements.txt +1 -1
  16. data/update_cpes.py +15 -2
  17. data/xml/apache_modules.xml +60 -0
  18. data/xml/dns_versionbind.xml +1 -1
  19. data/xml/favicons.xml +13 -3
  20. data/xml/ftp_banners.xml +4 -6
  21. data/xml/html_title.xml +362 -29
  22. data/xml/http_cookies.xml +179 -62
  23. data/xml/http_servers.xml +331 -81
  24. data/xml/http_wwwauth.xml +25 -6
  25. data/xml/ldap_searchresult.xml +1 -0
  26. data/xml/ntp_banners.xml +7 -1
  27. data/xml/sip_banners.xml +2 -0
  28. data/xml/sip_user_agents.xml +1 -0
  29. data/xml/smtp_banners.xml +41 -5
  30. data/xml/smtp_expn.xml +1 -0
  31. data/xml/smtp_vrfy.xml +1 -0
  32. data/xml/snmp_sysdescr.xml +52 -11
  33. data/xml/ssh_banners.xml +9 -3
  34. data/xml/telnet_banners.xml +10 -5
  35. data/xml/tls_jarm.xml +3 -2
  36. data/xml/x509_issuers.xml +155 -2
  37. data/xml/x509_subjects.xml +157 -20
  38. metadata +3 -2
data/xml/telnet_banners.xml CHANGED
@@ -1018,7 +1018,7 @@
1018
1018
  <param pos="5" name="os.version.version"/>
1019
1019
  </fingerprint>
1020
1020
 
1021
- <fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:-_\&amp;]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
1021
+ <fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:\&amp;-]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
1022
1022
  <description>Moxa MiiNePort Series Embedded device server</description>
1023
1023
  <!-- Model name : MiiNePort E2\r\nSerial No. : 9999\r\nDevice name : MiiNePort_E2_4064\r\nFirmware version : 1.3.36 Build 15031615\r\nEthernet MAC address: 00:90:E8:5A:92:FF\r\n\r\nPlease keyin your password: -->
1024
1024
 
@@ -1232,6 +1232,9 @@
1232
1232
  <param pos="0" name="os.vendor" value="Arescom"/>
1233
1233
  <param pos="0" name="os.device" value="WAP"/>
1234
1234
  <param pos="1" name="os.model"/>
1235
+ <param pos="0" name="hw.vendor" value="Arescom"/>
1236
+ <param pos="0" name="hw.device" value="WAP"/>
1237
+ <param pos="1" name="hw.model"/>
1235
1238
  </fingerprint>
1236
1239
 
1237
1240
  <fingerprint pattern="^Welcome to ViewStation">
@@ -1803,7 +1806,7 @@
1803
1806
  \n \nServer Name: PS-B04E8E\nServer Model: LPV 2 - TX 1\nF / W Version: 2.00 J \nMAC Address: AE 32 EA 21 BB E3\n
1804
1807
  Uptime: 0 days, 00: 00: 12\n \nPlease Enter Password:"-->
1805
1808
 
1806
- <example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" os.model="LPV" os.address="AE 32 EA 21 BB E3">
1809
+ <example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" hw.model="LPV" host.mac="AE 32 EA 21 BB E3">
1807
1810
  KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiogV2VsY29tZSB0byBNRUxDTyBQc
1808
1811
  mludCBTZXJ2ZXIgKlxuKiBUZWxuZXQgQ29uc29sZSAqXG4qKioqKioqKioqKioqKioqKioqKioqKi
1809
1812
  oqKioqKioqKioqKlxuIFxuU2VydmVyIE5hbWU6IFBTLUIwNEU4RVxuU2VydmVyIE1vZGVsOiBMUFY
@@ -1813,11 +1816,13 @@
1813
1816
  </example>
1814
1817
  <param pos="0" name="os.vendor" value="Buffalo"/>
1815
1818
  <param pos="0" name="os.family" value="PrintServer"/>
1816
- <param pos="0" name="os.device" value="Printer"/>
1819
+ <param pos="0" name="os.device" value="Print Server"/>
1817
1820
  <param pos="1" name="host.id"/>
1818
- <param pos="2" name="os.model"/>
1821
+ <param pos="0" name="hw.vendor" value="Buffalo"/>
1822
+ <param pos="0" name="hw.device" value="Print Server"/>
1823
+ <param pos="2" name="hw.model"/>
1819
1824
  <param pos="3" name="os.version"/>
1820
- <param pos="4" name="os.address"/>
1825
+ <param pos="4" name="host.mac"/>
1821
1826
  </fingerprint>
1822
1827
 
1823
1828
  <fingerprint pattern="^(?m)AIX Version\W(\d).*">
data/xml/tls_jarm.xml CHANGED
@@ -30,7 +30,7 @@
30
30
  <example>2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef</example>
31
31
  <param pos="0" name="hw.vendor" value="Ubiquiti"/>
32
32
  <param pos="0" name="hw.device" value="Router"/>
33
- <param pos="0" name="hw.Product" value="EdgeRouter X"/>
33
+ <param pos="0" name="hw.product" value="EdgeRouter X"/>
34
34
  <param pos="0" name="os.vendor" value="Ubiquiti"/>
35
35
  <param pos="0" name="os.family" value="Linux"/>
36
36
  <param pos="0" name="os.device" value="Router"/>
@@ -67,6 +67,7 @@
67
67
  <example>06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d</example>
68
68
  <param pos="0" name="hw.vendor" value="D-Link"/>
69
69
  <param pos="0" name="hw.product" value="DCS-825L"/>
70
+ <param pos="0" name="hw.cpe23" value="cpe:/h:d-link:dcs-825l:-"/>
70
71
  </fingerprint>
71
72
 
72
73
  <fingerprint pattern="^0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d$">
@@ -124,7 +125,7 @@
124
125
  <example>21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601</example>
125
126
  <param pos="0" name="os.vendor" value="VMware"/>
126
127
  <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
127
- <param pos="0" name="os.product" value="ESXi"/>
128
+ <param pos="0" name="os.product" value="VMware ESXi Server"/>
128
129
  <param pos="0" name="os.device" value="Hypervisor"/>
129
130
  <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
130
131
  <param pos="0" name="hw.device" value="Hypervisor"/>
data/xml/x509_issuers.xml CHANGED
@@ -8,6 +8,61 @@
8
8
  a specific order. Please see the comments in x509_subjects.xml for details.
9
9
  -->
10
10
 
11
+ <!-- The following group has been included for performance reasons -->
12
+
13
+ <fingerprint pattern="^CN=R3,O=Let's Encrypt,C=US$">
14
+ <description>Lets Encrypt R3 - generic -- assert nothing.</description>
15
+ <example>CN=R3,O=Let's Encrypt,C=US</example>
16
+ </fingerprint>
17
+
18
+ <fingerprint pattern="^CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US$">
19
+ <description>Lets Encrypt X3 - generic -- assert nothing.</description>
20
+ <example>CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US</example>
21
+ </fingerprint>
22
+
23
+ <fingerprint pattern="^CN=Amazon,OU=Server CA 1B,O=Amazon,C=US$">
24
+ <description>Amazon AWS Server CA 1B - generic -- assert nothing.</description>
25
+ <example>CN=Amazon,OU=Server CA 1B,O=Amazon,C=US</example>
26
+ </fingerprint>
27
+
28
+ <fingerprint pattern="^CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US$">
29
+ <description>DigiCert SHA2 - generic -- assert nothing.</description>
30
+ <example>CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US</example>
31
+ </fingerprint>
32
+
33
+ <fingerprint pattern="^CN=DigiCert TLS (?:RSA SHA256|Hybrid ECC SHA384) 2020 CA1,O=DigiCert Inc,C=US$">
34
+ <description>DigiCert SHA256 2020 CA1 - generic -- assert nothing.</description>
35
+ <example>CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US</example>
36
+ <example>CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US</example>
37
+ </fingerprint>
38
+
39
+ <fingerprint pattern="^CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US$">
40
+ <description>DigiCert ECC CA-1 - generic -- assert nothing.</description>
41
+ <example>CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
42
+ </fingerprint>
43
+
44
+ <fingerprint pattern="^CN=DigiCert SHA2 (?:Extended Validation|High Assurance) Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US$">
45
+ <description>DigiCert SHA2 EV - generic -- assert nothing.</description>
46
+ <example>CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
47
+ <example>CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
48
+ </fingerprint>
49
+
50
+ <fingerprint pattern="^CN=Sectigo RSA (?:Domain|Organization) Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB$">
51
+ <description>Sectigo RSA - generic -- assert nothing.</description>
52
+ <example>CN=Sectigo RSA Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
53
+ <example>CN=Sectigo RSA Organization Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
54
+ </fingerprint>
55
+
56
+ <fingerprint pattern="^CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US$">
57
+ <description>GeoTrust RSA CA 2018 - generic -- assert nothing.</description>
58
+ <example>CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
59
+ </fingerprint>
60
+
61
+ <fingerprint pattern="^CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs\.godaddy\.com/repository/,O=GoDaddy.com\\, Inc\.,L=Scottsdale,ST=Arizona,C=US$">
62
+ <description>Go Daddy G2 - generic -- assert nothing.</description>
63
+ <example>CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US</example>
64
+ </fingerprint>
65
+
11
66
  <!-- Chromecast and various devices that support the Cast protocol -->
12
67
 
13
68
  <fingerprint pattern="^CN=Eureka Gen1 ICA,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US$">
@@ -123,6 +178,20 @@
123
178
  <param pos="0" name="hw.vendor" value="APC"/>
124
179
  </fingerprint>
125
180
 
181
+ <fingerprint pattern="^CN=ASA Temporary Self Signed Certificate$">
182
+ <description>Cisco ASA Temp Cert</description>
183
+ <example>CN=ASA Temporary Self Signed Certificate</example>
184
+ <param pos="0" name="os.vendor" value="Cisco"/>
185
+ <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
186
+ <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
187
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
188
+ <param pos="0" name="hw.vendor" value="Cisco"/>
189
+ <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
190
+ <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
191
+ <param pos="0" name="hw.device" value="Firewall"/>
192
+ <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
193
+ </fingerprint>
194
+
126
195
  <fingerprint pattern="^CN=Temporary CA [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12},OU=Temporary CA">
127
196
  <description>Cisco Video Communication Server</description>
128
197
  <example>CN=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,OU=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,O=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74</example>
@@ -135,7 +204,8 @@
135
204
  <description>VMware ESXi w/Installer</description>
136
205
  <example>O=VMware Installer</example>
137
206
  <param pos="0" name="os.vendor" value="VMware"/>
138
- <param pos="0" name="os.product" value="ESXi"/>
207
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
208
+ <param pos="0" name="os.product" value="VMware ESXi Server"/>
139
209
  <param pos="0" name="os.device" value="Hypervisor"/>
140
210
  <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
141
211
  <param pos="0" name="hw.device" value="Hypervisor"/>
@@ -156,11 +226,12 @@
156
226
  <param pos="0" name="hw.vendor" value="HP"/>
157
227
  <param pos="0" name="hw.family" value="iLO"/>
158
228
  <param pos="0" name="hw.product" value="iLO"/>
159
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
229
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
160
230
  <param pos="0" name="os.device" value="Lights Out Management"/>
161
231
  <param pos="0" name="os.vendor" value="HP"/>
162
232
  <param pos="0" name="os.family" value="iLO"/>
163
233
  <param pos="0" name="os.product" value="iLO"/>
234
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
164
235
  </fingerprint>
165
236
 
166
237
  <fingerprint pattern="^CN=synology.com,O=Synology Inc.,L=Taipei,C=TW$">
@@ -174,4 +245,86 @@
174
245
  <param pos="0" name="hw.device" value="NAS"/>
175
246
  </fingerprint>
176
247
 
248
+ <fingerprint pattern="^CN=default(?: [A-Z]+)?,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US$">
249
+ <description>Citrix Netscaler (later renamed to Citrix ADC)</description>
250
+ <example>CN=default,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
251
+ <example>CN=default UYENMB,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
252
+ <param pos="0" name="service.vendor" value="Citrix"/>
253
+ <param pos="0" name="service.family" value="Netscaler"/>
254
+ <param pos="0" name="service.product" value="Netscaler"/>
255
+ <param pos="0" name="service.device" value="Network Management Device"/>
256
+ <param pos="0" name="service.cpe23" value="cpe:/a:citrix:netscaler:-"/>
257
+ <param pos="0" name="os.vendor" value="Citrix"/>
258
+ <param pos="0" name="os.family" value="Netscaler"/>
259
+ <param pos="0" name="os.product" value="Netscaler Gateway Firmware"/>
260
+ <param pos="0" name="os.device" value="Network Management Device"/>
261
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_gateway_firmware:-"/>
262
+ <param pos="0" name="hw.vendor" value="Citrix"/>
263
+ <param pos="0" name="hw.family" value="Netscaler"/>
264
+ <param pos="0" name="hw.product" value="Netscaler Gateway"/>
265
+ <param pos="0" name="hw.device" value="Network Management Device"/>
266
+ <param pos="0" name="hw.cpe23" value="cpe:/h:citrix:netscaler_gateway:-"/>
267
+ </fingerprint>
268
+
269
+ <fingerprint pattern="^O=Technicolor,L=Edegem,ST=Antwerp,C=BE$">
270
+ <description>Technicolor Router - without model or version</description>
271
+ <example>O=Technicolor,L=Edegem,ST=Antwerp,C=BE</example>
272
+ <param pos="0" name="os.vendor" value="Technicolor"/>
273
+ <param pos="0" name="os.device" value="Router"/>
274
+ <param pos="0" name="os.certainty" value="0.5"/>
275
+ <param pos="0" name="hw.vendor" value="Technicolor"/>
276
+ <param pos="0" name="hw.device" value="Router"/>
277
+ <param pos="0" name="hw.certainty" value="0.5"/>
278
+ </fingerprint>
279
+
280
+ <fingerprint pattern="^CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW$">
281
+ <description>DrayTek Vigor Router - without model or version</description>
282
+ <example>CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW</example>
283
+ <param pos="0" name="os.vendor" value="DrayTek"/>
284
+ <param pos="0" name="os.device" value="Router"/>
285
+ <param pos="0" name="os.certainty" value="0.5"/>
286
+ <param pos="0" name="hw.vendor" value="DrayTek"/>
287
+ <param pos="0" name="hw.family" value="Vigor"/>
288
+ <param pos="0" name="hw.device" value="Router"/>
289
+ <param pos="0" name="hw.certainty" value="0.5"/>
290
+ </fingerprint>
291
+
292
+ <fingerprint pattern="^CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co$">
293
+ <description>Kubernetes NGINX Ingress Controller with default cert</description>
294
+ <example>CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co</example>
295
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
296
+ <param pos="0" name="service.family" value="Kubernetes"/>
297
+ <param pos="0" name="service.product" value="NGINX Ingress Controller"/>
298
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:nginx_ingress_controller:-"/>
299
+ </fingerprint>
300
+
301
+ <fingerprint pattern="^CN=TRAEFIK DEFAULT CERT$">
302
+ <description>Traefik Proxy default certificate</description>
303
+ <example>CN=TRAEFIK DEFAULT CERT</example>
304
+ <param pos="0" name="service.vendor" value="Traefik Labs"/>
305
+ <param pos="0" name="service.family" value="Traefik"/>
306
+ <param pos="0" name="service.product" value="Traefik Proxy"/>
307
+ <param pos="0" name="service.cpe23" value="cpe:/a:containous:traefik:-"/>
308
+ </fingerprint>
309
+
310
+ <fingerprint pattern="^(?i)CN=Fireware web CA,OU=Fireware,O=WatchGuard(?: CA)?$">
311
+ <description>WatchGuard Fireware</description>
312
+ <example>CN=Fireware web ca,OU=Fireware,O=WatchGuard</example>
313
+ <example>CN=Fireware web CA,OU=Fireware,O=Watchguard CA</example>
314
+ <param pos="0" name="service.vendor" value="WatchGuard"/>
315
+ <param pos="0" name="service.product" value="Fireware XTM"/>
316
+ <param pos="0" name="service.cpe23" value="cpe:/a:watchguard:fireware_xtm:-"/>
317
+ <param pos="0" name="os.vendor" value="WatchGuard"/>
318
+ <param pos="0" name="os.product" value="Fireware"/>
319
+ <param pos="0" name="os.cpe23" value="cpe:/o:watchguard:fireware:-"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^O=Caddy Self-Signed$">
323
+ <description>CaddyServer Caddy - golang based httpd</description>
324
+ <example>O=Caddy Self-Signed</example>
325
+ <param pos="0" name="service.vendor" value="CaddyServer"/>
326
+ <param pos="0" name="service.product" value="Caddy"/>
327
+ <param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
328
+ </fingerprint>
329
+
177
330
  </fingerprints>
data/xml/x509_subjects.xml CHANGED
@@ -103,6 +103,29 @@
103
103
  <param pos="1" name="hw.product"/>
104
104
  </fingerprint>
105
105
 
106
+ <fingerprint pattern="^O=Technicolor,L=Edegem,ST=Antwerp,C=BE$">
107
+ <description>Technicolor Router - without model or version</description>
108
+ <example>O=Technicolor,L=Edegem,ST=Antwerp,C=BE</example>
109
+ <param pos="0" name="os.vendor" value="Technicolor"/>
110
+ <param pos="0" name="os.device" value="Router"/>
111
+ <param pos="0" name="os.certainty" value="0.5"/>
112
+ <param pos="0" name="hw.vendor" value="Technicolor"/>
113
+ <param pos="0" name="hw.device" value="Router"/>
114
+ <param pos="0" name="hw.certainty" value="0.5"/>
115
+ </fingerprint>
116
+
117
+ <fingerprint pattern="^CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW$">
118
+ <description>DrayTek Vigor Router - without model or version</description>
119
+ <example>CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW</example>
120
+ <param pos="0" name="os.vendor" value="DrayTek"/>
121
+ <param pos="0" name="os.device" value="Router"/>
122
+ <param pos="0" name="os.certainty" value="0.5"/>
123
+ <param pos="0" name="hw.vendor" value="DrayTek"/>
124
+ <param pos="0" name="hw.family" value="Vigor"/>
125
+ <param pos="0" name="hw.device" value="Router"/>
126
+ <param pos="0" name="hw.certainty" value="0.5"/>
127
+ </fingerprint>
128
+
106
129
  <fingerprint pattern="^CN=Nepenthes Development Team,OU=anv,O=dionaea\.carnivore\.it,C=DE$">
107
130
  <description>Nepenthes honeypot</description>
108
131
  <example>CN=Nepenthes Development Team,OU=anv,O=dionaea.carnivore.it,C=DE</example>
@@ -198,11 +221,12 @@
198
221
  <param pos="0" name="hw.vendor" value="HP"/>
199
222
  <param pos="0" name="hw.family" value="iLO"/>
200
223
  <param pos="0" name="hw.product" value="iLO"/>
201
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
224
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
202
225
  <param pos="0" name="os.device" value="Lights Out Management"/>
203
226
  <param pos="0" name="os.vendor" value="HP"/>
204
227
  <param pos="0" name="os.family" value="iLO"/>
205
228
  <param pos="0" name="os.product" value="iLO"/>
229
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
206
230
  <param pos="1" name="host.name"/>
207
231
  </fingerprint>
208
232
 
@@ -213,11 +237,12 @@
213
237
  <param pos="0" name="hw.vendor" value="HP"/>
214
238
  <param pos="0" name="hw.family" value="iLO"/>
215
239
  <param pos="0" name="hw.product" value="iLO"/>
216
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
240
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
217
241
  <param pos="0" name="os.device" value="Lights Out Management"/>
218
242
  <param pos="0" name="os.vendor" value="HP"/>
219
243
  <param pos="0" name="os.family" value="iLO"/>
220
244
  <param pos="0" name="os.product" value="iLO"/>
245
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
221
246
  </fingerprint>
222
247
 
223
248
  <fingerprint pattern="^CN=OA\-([a-fA-F0-9]+),OU=Onboard Administrator,">
@@ -228,11 +253,12 @@
228
253
  <param pos="0" name="hw.vendor" value="HP"/>
229
254
  <param pos="0" name="hw.family" value="iLO"/>
230
255
  <param pos="0" name="hw.product" value="iLO"/>
231
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
256
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
232
257
  <param pos="0" name="os.device" value="Lights Out Management"/>
233
258
  <param pos="0" name="os.vendor" value="HP"/>
234
259
  <param pos="0" name="os.family" value="iLO"/>
235
260
  <param pos="0" name="os.product" value="iLO"/>
261
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
236
262
  <param pos="1" name="host.mac"/>
237
263
  </fingerprint>
238
264
 
@@ -243,11 +269,12 @@
243
269
  <param pos="0" name="hw.vendor" value="HP"/>
244
270
  <param pos="0" name="hw.family" value="iLO"/>
245
271
  <param pos="0" name="hw.product" value="iLO"/>
246
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
272
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
247
273
  <param pos="0" name="os.device" value="Lights Out Management"/>
248
274
  <param pos="0" name="os.vendor" value="HP"/>
249
275
  <param pos="0" name="os.family" value="iLO"/>
250
276
  <param pos="0" name="os.product" value="iLO"/>
277
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
251
278
  <param pos="1" name="host.name"/>
252
279
  </fingerprint>
253
280
 
@@ -370,7 +397,7 @@
370
397
  <param pos="0" name="os.vendor" value="Cisco"/>
371
398
  <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
372
399
  <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
373
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance:-"/>
400
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
374
401
  <param pos="0" name="hw.vendor" value="Cisco"/>
375
402
  <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
376
403
  <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
@@ -384,7 +411,7 @@
384
411
  <param pos="0" name="os.vendor" value="Cisco"/>
385
412
  <param pos="0" name="os.device" value="Wireless Controller"/>
386
413
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
387
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
414
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
388
415
  <param pos="1" name="cisco.serial_number"/>
389
416
  </fingerprint>
390
417
 
@@ -394,7 +421,7 @@
394
421
  <param pos="0" name="os.vendor" value="Cisco"/>
395
422
  <param pos="0" name="os.device" value="Wireless Controller"/>
396
423
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
397
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
424
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
398
425
  <param pos="0" name="hw.vendor" value="Cisco"/>
399
426
  <param pos="0" name="hw.device" value="Wireless Controller"/>
400
427
  <param pos="0" name="hw.product" value="Wireless LAN Controller"/>
@@ -477,8 +504,10 @@
477
504
  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=VMware ESX Server Default Certificate,O=VMware\\, Inc,L=Palo Alto,ST=California,C=US$">
478
505
  <description>VMware ESX</description>
479
506
  <example>CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
507
+ <param pos="0" name="service.vendor" value="VMware"/>
480
508
  <param pos="0" name="os.vendor" value="VMware"/>
481
- <param pos="0" name="os.product" value="ESX"/>
509
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
510
+ <param pos="0" name="os.product" value="VMware ESX Server"/>
482
511
  <param pos="0" name="os.device" value="Hypervisor"/>
483
512
  <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esx:-"/>
484
513
  <param pos="1" name="host.name"/>
@@ -497,6 +526,24 @@
497
526
  <param pos="0" name="service.product" value="Site Recovery Manager"/>
498
527
  </fingerprint>
499
528
 
529
+ <fingerprint pattern="^CN=([^,=]{1,256}),OU=VMware Horizon View default certificate,O=VMware\\, Inc.$">
530
+ <description>VMware Horizon (formerly View)</description>
531
+ <example host.name="horizon.foo.bar">CN=horizon.foo.bar,OU=VMware Horizon View default certificate,O=VMware\, Inc.</example>
532
+ <param pos="0" name="service.vendor" value="VMware"/>
533
+ <param pos="0" name="service.product" value="Horizon"/>
534
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:horizon:-"/>
535
+ <param pos="1" name="host.name"/>
536
+ </fingerprint>
537
+
538
+ <fingerprint pattern="^CN=([^,=]{1,256}),OU=VMware View default certificate,O=VMware\\, Inc.$">
539
+ <description>VMware View</description>
540
+ <example host.name="horizon.foo.bar">CN=horizon.foo.bar,OU=VMware View default certificate,O=VMware\, Inc.</example>
541
+ <param pos="0" name="service.vendor" value="VMware"/>
542
+ <param pos="0" name="service.product" value="View"/>
543
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:view:-"/>
544
+ <param pos="1" name="host.name"/>
545
+ </fingerprint>
546
+
500
547
  <fingerprint pattern="^CN=IOS-Self-Signed-Certificate-">
501
548
  <description>Cisco IOS Default Certificate</description>
502
549
  <example>CN=IOS-Self-Signed-Certificate-4163115936</example>
@@ -508,6 +555,63 @@
508
555
  <param pos="0" name="hw.device" value="Router"/>
509
556
  </fingerprint>
510
557
 
558
+ <fingerprint pattern="^CN=kube-apiserver$">
559
+ <description>Kubernetes api-server default certificate</description>
560
+ <example>CN=kube-apiserver</example>
561
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
562
+ <param pos="0" name="service.family" value="Kubernetes"/>
563
+ <param pos="0" name="service.product" value="Kubernetes"/>
564
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
565
+ </fingerprint>
566
+
567
+ <fingerprint pattern="^CN=kubernetes-master$">
568
+ <description>Kubernetes Control Plane (formerly master) default certificate</description>
569
+ <example>CN=kubernetes-master</example>
570
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
571
+ <param pos="0" name="service.family" value="Kubernetes"/>
572
+ <param pos="0" name="service.product" value="Kubernetes"/>
573
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
574
+ </fingerprint>
575
+
576
+ <fingerprint pattern="^CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co$">
577
+ <description>Kubernetes NGINX Ingress Controller with default cert</description>
578
+ <example>CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co</example>
579
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
580
+ <param pos="0" name="service.family" value="Kubernetes"/>
581
+ <param pos="0" name="service.product" value="NGINX Ingress Controller"/>
582
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:nginx_ingress_controller:-"/>
583
+ </fingerprint>
584
+
585
+ <fingerprint pattern="^CN=TRAEFIK DEFAULT CERT$">
586
+ <description>Traefik Proxy default certificate</description>
587
+ <example>CN=TRAEFIK DEFAULT CERT</example>
588
+ <param pos="0" name="service.vendor" value="Traefik Labs"/>
589
+ <param pos="0" name="service.family" value="Traefik"/>
590
+ <param pos="0" name="service.product" value="Traefik Proxy"/>
591
+ <param pos="0" name="service.cpe23" value="cpe:/a:containous:traefik:-"/>
592
+ </fingerprint>
593
+
594
+ <fingerprint pattern="^CN=default(?: [A-Z]+)?,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US$">
595
+ <description>Citrix Netscaler (later renamed to Citrix ADC)</description>
596
+ <example>CN=default,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
597
+ <example>CN=default UYENMB,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
598
+ <param pos="0" name="service.vendor" value="Citrix"/>
599
+ <param pos="0" name="service.family" value="Netscaler"/>
600
+ <param pos="0" name="service.product" value="Netscaler"/>
601
+ <param pos="0" name="service.device" value="Network Management Device"/>
602
+ <param pos="0" name="service.cpe23" value="cpe:/a:citrix:netscaler:-"/>
603
+ <param pos="0" name="os.vendor" value="Citrix"/>
604
+ <param pos="0" name="os.family" value="Netscaler"/>
605
+ <param pos="0" name="os.product" value="Netscaler Gateway Firmware"/>
606
+ <param pos="0" name="os.device" value="Network Management Device"/>
607
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_gateway_firmware:-"/>
608
+ <param pos="0" name="hw.vendor" value="Citrix"/>
609
+ <param pos="0" name="hw.family" value="Netscaler"/>
610
+ <param pos="0" name="hw.product" value="Netscaler Gateway"/>
611
+ <param pos="0" name="hw.device" value="Network Management Device"/>
612
+ <param pos="0" name="hw.cpe23" value="cpe:/h:citrix:netscaler_gateway:-"/>
613
+ </fingerprint>
614
+
511
615
  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=(?:Cast|Google TV),O=Google Inc,L=Mountain View,ST=California,C=US$">
512
616
  <description>Google Chromecast</description>
513
617
  <example chromecast.serial_number="LVDZG5" host.mac_local="FA8FCA67413D">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
@@ -1064,13 +1168,30 @@
1064
1168
  </fingerprint>
1065
1169
 
1066
1170
  <fingerprint pattern="^CN=[0-9\.]+,OU=SSL-VPN,O=SonicWALL\\, Inc\.,L=Sunnyvale,ST=CA,C=US$">
1067
- <description>SonicWALL Firewall</description>
1171
+ <description>SonicWALL SSL-VPN</description>
1068
1172
  <example>CN=192.168.200.1,OU=SSL-VPN,O=SonicWALL\, Inc.,L=Sunnyvale,ST=CA,C=US</example>
1173
+ <param pos="0" name="service.vendor" value="SonicWall"/>
1174
+ <param pos="0" name="service.family" value="SSL-VPN"/>
1069
1175
  <param pos="0" name="hw.vendor" value="SonicWall"/>
1070
1176
  <param pos="0" name="hw.device" value="VPN"/>
1071
1177
  <param pos="0" name="os.vendor" value="SonicWall"/>
1072
- <param pos="0" name="os.product" value="VPN"/>
1073
- <param pos="0" name="os.family" value="VPN"/>
1178
+ <param pos="0" name="os.family" value="SonicOS"/>
1179
+ <param pos="0" name="os.product" value="SonicOS"/>
1180
+ <param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
1181
+ </fingerprint>
1182
+
1183
+ <fingerprint pattern="^CN=[0-9\.]+,OU=HTTPS Management Certificate for SonicWALL \(self-signed\),O=HTTPS Management Certificate for SonicWALL \(self-signed\),L=Sunnyvale,ST=California,C=US$">
1184
+ <description>SonicWALL Network Security Appliance firewall</description>
1185
+ <example>CN=192.168.168.168,OU=HTTPS Management Certificate for SonicWALL (self-signed),O=HTTPS Management Certificate for SonicWALL (self-signed),L=Sunnyvale,ST=California,C=US</example>
1186
+ <param pos="0" name="hw.vendor" value="SonicWall"/>
1187
+ <param pos="0" name="hw.product" value="Network Security Appliance"/>
1188
+ <param pos="0" name="hw.family" value="Network Security Appliance"/>
1189
+ <param pos="0" name="hw.device" value="Firewall"/>
1190
+ <param pos="0" name="os.vendor" value="SonicWall"/>
1191
+ <param pos="0" name="os.family" value="SonicOS"/>
1192
+ <param pos="0" name="os.product" value="SonicOS"/>
1193
+ <param pos="0" name="os.device" value="Firewall"/>
1194
+ <param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
1074
1195
  </fingerprint>
1075
1196
 
1076
1197
  <fingerprint pattern="^CN=.*\.akamai\.net,O=Akamai Technologies\\, Inc\.,L=Cambridge,ST=Massachusetts,C=US$">
@@ -1078,10 +1199,19 @@
1078
1199
  <example>CN=a248.e.akamai.net,O=Akamai Technologies\, Inc.,L=Cambridge,ST=Massachusetts,C=US</example>
1079
1200
  <param pos="0" name="service.vendor" value="Akamai"/>
1080
1201
  <param pos="0" name="service.product" value="GHost"/>
1202
+ <param pos="0" name="service.cpe23" value="cpe:/a:akamai:akamaighost:-"/>
1081
1203
  <param pos="0" name="os.vendor" value="Akamai"/>
1082
1204
  <param pos="0" name="os.device" value="Web Proxy"/>
1083
1205
  </fingerprint>
1084
1206
 
1207
+ <fingerprint pattern="^O=Caddy Self-Signed$">
1208
+ <description>CaddyServer Caddy - golang based httpd</description>
1209
+ <example>O=Caddy Self-Signed</example>
1210
+ <param pos="0" name="service.vendor" value="CaddyServer"/>
1211
+ <param pos="0" name="service.product" value="Caddy"/>
1212
+ <param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
1213
+ </fingerprint>
1214
+
1085
1215
  <fingerprint pattern="^CN=HP_3PAR_">
1086
1216
  <description>HP 3PAR</description>
1087
1217
  <example>CN=HP_3PAR_1626615</example>
@@ -1234,16 +1364,12 @@
1234
1364
  <param pos="0" name="hw.vendor" value="Palo Alto Networks"/>
1235
1365
  <param pos="0" name="hw.device" value="Firewall"/>
1236
1366
  <param pos="0" name="os.vendor" value="Palo Alto Networks"/>
1237
- <param pos="0" name="os.product" value="PANOS"/>
1367
+ <param pos="0" name="os.product" value="PAN-OS"/>
1368
+ <param pos="0" name="os.family" value="PAN-OS"/>
1238
1369
  <param pos="0" name="os.device" value="Firewall"/>
1239
- </fingerprint>
1240
-
1241
- <fingerprint pattern="^CN=VMware default certificate,OU=vCenterServer.*,O=VMware\\, Inc\.$">
1242
- <description>VMware vCenter</description>
1243
- <example>CN=VMware default certificate,OU=vCenterServer_2013.09.26_220623,O=VMware\, Inc.</example>
1244
- <param pos="0" name="service.vendor" value="VMware"/>
1245
- <param pos="0" name="service.product" value="vCenter"/>
1246
- <param pos="0" name="service.cpe23" value="cpe:/a:vmware:vcenter_server:-"/>
1370
+ <param pos="0" name="os.cpe23" value="cpe:/o:paloaltonetworks:pan-os:-"/>
1371
+ <param pos="0" name="service.vendor" value="Palo Alto Networks"/>
1372
+ <param pos="0" name="service.device" value="Firewall"/>
1247
1373
  </fingerprint>
1248
1374
 
1249
1375
  <fingerprint pattern="^CN=selfappliance,OU=Engineering,O=Symplified,L=Boulder,ST=Colorado,C=US$">
@@ -1507,4 +1633,15 @@
1507
1633
  <param pos="0" name="hw.product" value="SD-WAN"/>
1508
1634
  </fingerprint>
1509
1635
 
1636
+ <fingerprint pattern="^CN=Windows Media Player Network Sharing Service \(([A-Z-]{1,15})\)$">
1637
+ <description>Windows Media Player Network Sharing Service</description>
1638
+ <example host.name="LIVING-ROOM">CN=Windows Media Player Network Sharing Service (LIVING-ROOM)</example>
1639
+ <param pos="0" name="service.vendor" value="Microsoft"/>
1640
+ <param pos="0" name="service.product" value="Windows Media Player"/>
1641
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:windows_media_player:-"/>
1642
+ <param pos="0" name="os.vendor" value="Microsoft"/>
1643
+ <param pos="0" name="os.family" value="Windows"/>
1644
+ <param pos="1" name="host.name"/>
1645
+ </fingerprint>
1646
+
1510
1647
  </fingerprints>