recog 2.3.19 → 2.3.20

Sign up to get free protection for your applications and to get access to all the features.
Files changed (38) hide show
  1. checksums.yaml +4 -4
  2. data/bin/recog_standardize +6 -0
  3. data/cpe-remap.yaml +314 -211
  4. data/identifiers/README.md +24 -10
  5. data/identifiers/fields.txt +104 -0
  6. data/identifiers/hw_family.txt +5 -0
  7. data/identifiers/hw_product.txt +11 -0
  8. data/identifiers/os_device.txt +0 -1
  9. data/identifiers/os_family.txt +1 -0
  10. data/identifiers/os_product.txt +12 -8
  11. data/identifiers/service_family.txt +7 -1
  12. data/identifiers/service_product.txt +52 -3
  13. data/identifiers/vendor.txt +23 -1
  14. data/lib/recog/version.rb +1 -1
  15. data/requirements.txt +1 -1
  16. data/update_cpes.py +15 -2
  17. data/xml/apache_modules.xml +60 -0
  18. data/xml/dns_versionbind.xml +1 -1
  19. data/xml/favicons.xml +13 -3
  20. data/xml/ftp_banners.xml +4 -6
  21. data/xml/html_title.xml +362 -29
  22. data/xml/http_cookies.xml +179 -62
  23. data/xml/http_servers.xml +331 -81
  24. data/xml/http_wwwauth.xml +25 -6
  25. data/xml/ldap_searchresult.xml +1 -0
  26. data/xml/ntp_banners.xml +7 -1
  27. data/xml/sip_banners.xml +2 -0
  28. data/xml/sip_user_agents.xml +1 -0
  29. data/xml/smtp_banners.xml +41 -5
  30. data/xml/smtp_expn.xml +1 -0
  31. data/xml/smtp_vrfy.xml +1 -0
  32. data/xml/snmp_sysdescr.xml +52 -11
  33. data/xml/ssh_banners.xml +9 -3
  34. data/xml/telnet_banners.xml +10 -5
  35. data/xml/tls_jarm.xml +3 -2
  36. data/xml/x509_issuers.xml +155 -2
  37. data/xml/x509_subjects.xml +157 -20
  38. metadata +3 -2
data/xml/telnet_banners.xml CHANGED
@@ -1018,7 +1018,7 @@
1018
1018
  <param pos="5" name="os.version.version"/>
1019
1019
  </fingerprint>
1020
1020
 
1021
- <fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:-_\&amp;]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
1021
+ <fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:\&amp;-]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
1022
1022
  <description>Moxa MiiNePort Series Embedded device server</description>
1023
1023
  <!-- Model name : MiiNePort E2\r\nSerial No. : 9999\r\nDevice name : MiiNePort_E2_4064\r\nFirmware version : 1.3.36 Build 15031615\r\nEthernet MAC address: 00:90:E8:5A:92:FF\r\n\r\nPlease keyin your password: -->
1024
1024
 
@@ -1232,6 +1232,9 @@
1232
1232
  <param pos="0" name="os.vendor" value="Arescom"/>
1233
1233
  <param pos="0" name="os.device" value="WAP"/>
1234
1234
  <param pos="1" name="os.model"/>
1235
+ <param pos="0" name="hw.vendor" value="Arescom"/>
1236
+ <param pos="0" name="hw.device" value="WAP"/>
1237
+ <param pos="1" name="hw.model"/>
1235
1238
  </fingerprint>
1236
1239
 
1237
1240
  <fingerprint pattern="^Welcome to ViewStation">
@@ -1803,7 +1806,7 @@
1803
1806
  \n \nServer Name: PS-B04E8E\nServer Model: LPV 2 - TX 1\nF / W Version: 2.00 J \nMAC Address: AE 32 EA 21 BB E3\n
1804
1807
  Uptime: 0 days, 00: 00: 12\n \nPlease Enter Password:"-->
1805
1808
 
1806
- <example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" os.model="LPV" os.address="AE 32 EA 21 BB E3">
1809
+ <example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" hw.model="LPV" host.mac="AE 32 EA 21 BB E3">
1807
1810
  KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiogV2VsY29tZSB0byBNRUxDTyBQc
1808
1811
  mludCBTZXJ2ZXIgKlxuKiBUZWxuZXQgQ29uc29sZSAqXG4qKioqKioqKioqKioqKioqKioqKioqKi
1809
1812
  oqKioqKioqKioqKlxuIFxuU2VydmVyIE5hbWU6IFBTLUIwNEU4RVxuU2VydmVyIE1vZGVsOiBMUFY
@@ -1813,11 +1816,13 @@
1813
1816
  </example>
1814
1817
  <param pos="0" name="os.vendor" value="Buffalo"/>
1815
1818
  <param pos="0" name="os.family" value="PrintServer"/>
1816
- <param pos="0" name="os.device" value="Printer"/>
1819
+ <param pos="0" name="os.device" value="Print Server"/>
1817
1820
  <param pos="1" name="host.id"/>
1818
- <param pos="2" name="os.model"/>
1821
+ <param pos="0" name="hw.vendor" value="Buffalo"/>
1822
+ <param pos="0" name="hw.device" value="Print Server"/>
1823
+ <param pos="2" name="hw.model"/>
1819
1824
  <param pos="3" name="os.version"/>
1820
- <param pos="4" name="os.address"/>
1825
+ <param pos="4" name="host.mac"/>
1821
1826
  </fingerprint>
1822
1827
 
1823
1828
  <fingerprint pattern="^(?m)AIX Version\W(\d).*">
data/xml/tls_jarm.xml CHANGED
@@ -30,7 +30,7 @@
30
30
  <example>2ad2ad16d2ad2ad22c2ad2ad2ad2ad7e5e7dc6f569c9c16238278a408347ef</example>
31
31
  <param pos="0" name="hw.vendor" value="Ubiquiti"/>
32
32
  <param pos="0" name="hw.device" value="Router"/>
33
- <param pos="0" name="hw.Product" value="EdgeRouter X"/>
33
+ <param pos="0" name="hw.product" value="EdgeRouter X"/>
34
34
  <param pos="0" name="os.vendor" value="Ubiquiti"/>
35
35
  <param pos="0" name="os.family" value="Linux"/>
36
36
  <param pos="0" name="os.device" value="Router"/>
@@ -67,6 +67,7 @@
67
67
  <example>06d06d07d06d06d06c06d06d06d06d7991b0b1ad2cbf06082e3b1a9dcaaa8d</example>
68
68
  <param pos="0" name="hw.vendor" value="D-Link"/>
69
69
  <param pos="0" name="hw.product" value="DCS-825L"/>
70
+ <param pos="0" name="hw.cpe23" value="cpe:/h:d-link:dcs-825l:-"/>
70
71
  </fingerprint>
71
72
 
72
73
  <fingerprint pattern="^0ed3dd16d25d00000042d43d000000e9435856b7ee99e87c06831602602f2d$">
@@ -124,7 +125,7 @@
124
125
  <example>21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601</example>
125
126
  <param pos="0" name="os.vendor" value="VMware"/>
126
127
  <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
127
- <param pos="0" name="os.product" value="ESXi"/>
128
+ <param pos="0" name="os.product" value="VMware ESXi Server"/>
128
129
  <param pos="0" name="os.device" value="Hypervisor"/>
129
130
  <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
130
131
  <param pos="0" name="hw.device" value="Hypervisor"/>
data/xml/x509_issuers.xml CHANGED
@@ -8,6 +8,61 @@
8
8
  a specific order. Please see the comments in x509_subjects.xml for details.
9
9
  -->
10
10
 
11
+ <!-- The following group has been included for performance reasons -->
12
+
13
+ <fingerprint pattern="^CN=R3,O=Let's Encrypt,C=US$">
14
+ <description>Lets Encrypt R3 - generic -- assert nothing.</description>
15
+ <example>CN=R3,O=Let's Encrypt,C=US</example>
16
+ </fingerprint>
17
+
18
+ <fingerprint pattern="^CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US$">
19
+ <description>Lets Encrypt X3 - generic -- assert nothing.</description>
20
+ <example>CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US</example>
21
+ </fingerprint>
22
+
23
+ <fingerprint pattern="^CN=Amazon,OU=Server CA 1B,O=Amazon,C=US$">
24
+ <description>Amazon AWS Server CA 1B - generic -- assert nothing.</description>
25
+ <example>CN=Amazon,OU=Server CA 1B,O=Amazon,C=US</example>
26
+ </fingerprint>
27
+
28
+ <fingerprint pattern="^CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US$">
29
+ <description>DigiCert SHA2 - generic -- assert nothing.</description>
30
+ <example>CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US</example>
31
+ </fingerprint>
32
+
33
+ <fingerprint pattern="^CN=DigiCert TLS (?:RSA SHA256|Hybrid ECC SHA384) 2020 CA1,O=DigiCert Inc,C=US$">
34
+ <description>DigiCert SHA256 2020 CA1 - generic -- assert nothing.</description>
35
+ <example>CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US</example>
36
+ <example>CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US</example>
37
+ </fingerprint>
38
+
39
+ <fingerprint pattern="^CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US$">
40
+ <description>DigiCert ECC CA-1 - generic -- assert nothing.</description>
41
+ <example>CN=DigiCert Secure Site ECC CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
42
+ </fingerprint>
43
+
44
+ <fingerprint pattern="^CN=DigiCert SHA2 (?:Extended Validation|High Assurance) Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US$">
45
+ <description>DigiCert SHA2 EV - generic -- assert nothing.</description>
46
+ <example>CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
47
+ <example>CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
48
+ </fingerprint>
49
+
50
+ <fingerprint pattern="^CN=Sectigo RSA (?:Domain|Organization) Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB$">
51
+ <description>Sectigo RSA - generic -- assert nothing.</description>
52
+ <example>CN=Sectigo RSA Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
53
+ <example>CN=Sectigo RSA Organization Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB</example>
54
+ </fingerprint>
55
+
56
+ <fingerprint pattern="^CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US$">
57
+ <description>GeoTrust RSA CA 2018 - generic -- assert nothing.</description>
58
+ <example>CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US</example>
59
+ </fingerprint>
60
+
61
+ <fingerprint pattern="^CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs\.godaddy\.com/repository/,O=GoDaddy.com\\, Inc\.,L=Scottsdale,ST=Arizona,C=US$">
62
+ <description>Go Daddy G2 - generic -- assert nothing.</description>
63
+ <example>CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US</example>
64
+ </fingerprint>
65
+
11
66
  <!-- Chromecast and various devices that support the Cast protocol -->
12
67
 
13
68
  <fingerprint pattern="^CN=Eureka Gen1 ICA,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US$">
@@ -123,6 +178,20 @@
123
178
  <param pos="0" name="hw.vendor" value="APC"/>
124
179
  </fingerprint>
125
180
 
181
+ <fingerprint pattern="^CN=ASA Temporary Self Signed Certificate$">
182
+ <description>Cisco ASA Temp Cert</description>
183
+ <example>CN=ASA Temporary Self Signed Certificate</example>
184
+ <param pos="0" name="os.vendor" value="Cisco"/>
185
+ <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
186
+ <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
187
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
188
+ <param pos="0" name="hw.vendor" value="Cisco"/>
189
+ <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
190
+ <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
191
+ <param pos="0" name="hw.device" value="Firewall"/>
192
+ <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
193
+ </fingerprint>
194
+
126
195
  <fingerprint pattern="^CN=Temporary CA [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12},OU=Temporary CA">
127
196
  <description>Cisco Video Communication Server</description>
128
197
  <example>CN=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,OU=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74,O=Temporary CA 218131fe-8af4-11e7-aa6e-9950d6bbaf74</example>
@@ -135,7 +204,8 @@
135
204
  <description>VMware ESXi w/Installer</description>
136
205
  <example>O=VMware Installer</example>
137
206
  <param pos="0" name="os.vendor" value="VMware"/>
138
- <param pos="0" name="os.product" value="ESXi"/>
207
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
208
+ <param pos="0" name="os.product" value="VMware ESXi Server"/>
139
209
  <param pos="0" name="os.device" value="Hypervisor"/>
140
210
  <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esxi:-"/>
141
211
  <param pos="0" name="hw.device" value="Hypervisor"/>
@@ -156,11 +226,12 @@
156
226
  <param pos="0" name="hw.vendor" value="HP"/>
157
227
  <param pos="0" name="hw.family" value="iLO"/>
158
228
  <param pos="0" name="hw.product" value="iLO"/>
159
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
229
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
160
230
  <param pos="0" name="os.device" value="Lights Out Management"/>
161
231
  <param pos="0" name="os.vendor" value="HP"/>
162
232
  <param pos="0" name="os.family" value="iLO"/>
163
233
  <param pos="0" name="os.product" value="iLO"/>
234
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
164
235
  </fingerprint>
165
236
 
166
237
  <fingerprint pattern="^CN=synology.com,O=Synology Inc.,L=Taipei,C=TW$">
@@ -174,4 +245,86 @@
174
245
  <param pos="0" name="hw.device" value="NAS"/>
175
246
  </fingerprint>
176
247
 
248
+ <fingerprint pattern="^CN=default(?: [A-Z]+)?,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US$">
249
+ <description>Citrix Netscaler (later renamed to Citrix ADC)</description>
250
+ <example>CN=default,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
251
+ <example>CN=default UYENMB,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
252
+ <param pos="0" name="service.vendor" value="Citrix"/>
253
+ <param pos="0" name="service.family" value="Netscaler"/>
254
+ <param pos="0" name="service.product" value="Netscaler"/>
255
+ <param pos="0" name="service.device" value="Network Management Device"/>
256
+ <param pos="0" name="service.cpe23" value="cpe:/a:citrix:netscaler:-"/>
257
+ <param pos="0" name="os.vendor" value="Citrix"/>
258
+ <param pos="0" name="os.family" value="Netscaler"/>
259
+ <param pos="0" name="os.product" value="Netscaler Gateway Firmware"/>
260
+ <param pos="0" name="os.device" value="Network Management Device"/>
261
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_gateway_firmware:-"/>
262
+ <param pos="0" name="hw.vendor" value="Citrix"/>
263
+ <param pos="0" name="hw.family" value="Netscaler"/>
264
+ <param pos="0" name="hw.product" value="Netscaler Gateway"/>
265
+ <param pos="0" name="hw.device" value="Network Management Device"/>
266
+ <param pos="0" name="hw.cpe23" value="cpe:/h:citrix:netscaler_gateway:-"/>
267
+ </fingerprint>
268
+
269
+ <fingerprint pattern="^O=Technicolor,L=Edegem,ST=Antwerp,C=BE$">
270
+ <description>Technicolor Router - without model or version</description>
271
+ <example>O=Technicolor,L=Edegem,ST=Antwerp,C=BE</example>
272
+ <param pos="0" name="os.vendor" value="Technicolor"/>
273
+ <param pos="0" name="os.device" value="Router"/>
274
+ <param pos="0" name="os.certainty" value="0.5"/>
275
+ <param pos="0" name="hw.vendor" value="Technicolor"/>
276
+ <param pos="0" name="hw.device" value="Router"/>
277
+ <param pos="0" name="hw.certainty" value="0.5"/>
278
+ </fingerprint>
279
+
280
+ <fingerprint pattern="^CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW$">
281
+ <description>DrayTek Vigor Router - without model or version</description>
282
+ <example>CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW</example>
283
+ <param pos="0" name="os.vendor" value="DrayTek"/>
284
+ <param pos="0" name="os.device" value="Router"/>
285
+ <param pos="0" name="os.certainty" value="0.5"/>
286
+ <param pos="0" name="hw.vendor" value="DrayTek"/>
287
+ <param pos="0" name="hw.family" value="Vigor"/>
288
+ <param pos="0" name="hw.device" value="Router"/>
289
+ <param pos="0" name="hw.certainty" value="0.5"/>
290
+ </fingerprint>
291
+
292
+ <fingerprint pattern="^CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co$">
293
+ <description>Kubernetes NGINX Ingress Controller with default cert</description>
294
+ <example>CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co</example>
295
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
296
+ <param pos="0" name="service.family" value="Kubernetes"/>
297
+ <param pos="0" name="service.product" value="NGINX Ingress Controller"/>
298
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:nginx_ingress_controller:-"/>
299
+ </fingerprint>
300
+
301
+ <fingerprint pattern="^CN=TRAEFIK DEFAULT CERT$">
302
+ <description>Traefik Proxy default certificate</description>
303
+ <example>CN=TRAEFIK DEFAULT CERT</example>
304
+ <param pos="0" name="service.vendor" value="Traefik Labs"/>
305
+ <param pos="0" name="service.family" value="Traefik"/>
306
+ <param pos="0" name="service.product" value="Traefik Proxy"/>
307
+ <param pos="0" name="service.cpe23" value="cpe:/a:containous:traefik:-"/>
308
+ </fingerprint>
309
+
310
+ <fingerprint pattern="^(?i)CN=Fireware web CA,OU=Fireware,O=WatchGuard(?: CA)?$">
311
+ <description>WatchGuard Fireware</description>
312
+ <example>CN=Fireware web ca,OU=Fireware,O=WatchGuard</example>
313
+ <example>CN=Fireware web CA,OU=Fireware,O=Watchguard CA</example>
314
+ <param pos="0" name="service.vendor" value="WatchGuard"/>
315
+ <param pos="0" name="service.product" value="Fireware XTM"/>
316
+ <param pos="0" name="service.cpe23" value="cpe:/a:watchguard:fireware_xtm:-"/>
317
+ <param pos="0" name="os.vendor" value="WatchGuard"/>
318
+ <param pos="0" name="os.product" value="Fireware"/>
319
+ <param pos="0" name="os.cpe23" value="cpe:/o:watchguard:fireware:-"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^O=Caddy Self-Signed$">
323
+ <description>CaddyServer Caddy - golang based httpd</description>
324
+ <example>O=Caddy Self-Signed</example>
325
+ <param pos="0" name="service.vendor" value="CaddyServer"/>
326
+ <param pos="0" name="service.product" value="Caddy"/>
327
+ <param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
328
+ </fingerprint>
329
+
177
330
  </fingerprints>
data/xml/x509_subjects.xml CHANGED
@@ -103,6 +103,29 @@
103
103
  <param pos="1" name="hw.product"/>
104
104
  </fingerprint>
105
105
 
106
+ <fingerprint pattern="^O=Technicolor,L=Edegem,ST=Antwerp,C=BE$">
107
+ <description>Technicolor Router - without model or version</description>
108
+ <example>O=Technicolor,L=Edegem,ST=Antwerp,C=BE</example>
109
+ <param pos="0" name="os.vendor" value="Technicolor"/>
110
+ <param pos="0" name="os.device" value="Router"/>
111
+ <param pos="0" name="os.certainty" value="0.5"/>
112
+ <param pos="0" name="hw.vendor" value="Technicolor"/>
113
+ <param pos="0" name="hw.device" value="Router"/>
114
+ <param pos="0" name="hw.certainty" value="0.5"/>
115
+ </fingerprint>
116
+
117
+ <fingerprint pattern="^CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW$">
118
+ <description>DrayTek Vigor Router - without model or version</description>
119
+ <example>CN=Vigor Router,OU=DrayTek Support,O=DrayTek Corp.,L=HuKou,ST=HsinChu,C=TW</example>
120
+ <param pos="0" name="os.vendor" value="DrayTek"/>
121
+ <param pos="0" name="os.device" value="Router"/>
122
+ <param pos="0" name="os.certainty" value="0.5"/>
123
+ <param pos="0" name="hw.vendor" value="DrayTek"/>
124
+ <param pos="0" name="hw.family" value="Vigor"/>
125
+ <param pos="0" name="hw.device" value="Router"/>
126
+ <param pos="0" name="hw.certainty" value="0.5"/>
127
+ </fingerprint>
128
+
106
129
  <fingerprint pattern="^CN=Nepenthes Development Team,OU=anv,O=dionaea\.carnivore\.it,C=DE$">
107
130
  <description>Nepenthes honeypot</description>
108
131
  <example>CN=Nepenthes Development Team,OU=anv,O=dionaea.carnivore.it,C=DE</example>
@@ -198,11 +221,12 @@
198
221
  <param pos="0" name="hw.vendor" value="HP"/>
199
222
  <param pos="0" name="hw.family" value="iLO"/>
200
223
  <param pos="0" name="hw.product" value="iLO"/>
201
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
224
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
202
225
  <param pos="0" name="os.device" value="Lights Out Management"/>
203
226
  <param pos="0" name="os.vendor" value="HP"/>
204
227
  <param pos="0" name="os.family" value="iLO"/>
205
228
  <param pos="0" name="os.product" value="iLO"/>
229
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
206
230
  <param pos="1" name="host.name"/>
207
231
  </fingerprint>
208
232
 
@@ -213,11 +237,12 @@
213
237
  <param pos="0" name="hw.vendor" value="HP"/>
214
238
  <param pos="0" name="hw.family" value="iLO"/>
215
239
  <param pos="0" name="hw.product" value="iLO"/>
216
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
240
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
217
241
  <param pos="0" name="os.device" value="Lights Out Management"/>
218
242
  <param pos="0" name="os.vendor" value="HP"/>
219
243
  <param pos="0" name="os.family" value="iLO"/>
220
244
  <param pos="0" name="os.product" value="iLO"/>
245
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
221
246
  </fingerprint>
222
247
 
223
248
  <fingerprint pattern="^CN=OA\-([a-fA-F0-9]+),OU=Onboard Administrator,">
@@ -228,11 +253,12 @@
228
253
  <param pos="0" name="hw.vendor" value="HP"/>
229
254
  <param pos="0" name="hw.family" value="iLO"/>
230
255
  <param pos="0" name="hw.product" value="iLO"/>
231
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
256
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
232
257
  <param pos="0" name="os.device" value="Lights Out Management"/>
233
258
  <param pos="0" name="os.vendor" value="HP"/>
234
259
  <param pos="0" name="os.family" value="iLO"/>
235
260
  <param pos="0" name="os.product" value="iLO"/>
261
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
236
262
  <param pos="1" name="host.mac"/>
237
263
  </fingerprint>
238
264
 
@@ -243,11 +269,12 @@
243
269
  <param pos="0" name="hw.vendor" value="HP"/>
244
270
  <param pos="0" name="hw.family" value="iLO"/>
245
271
  <param pos="0" name="hw.product" value="iLO"/>
246
- <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights_out:-"/>
272
+ <param pos="0" name="hw.cpe23" value="cpe:/h:hp:integrated_lights-out:-"/>
247
273
  <param pos="0" name="os.device" value="Lights Out Management"/>
248
274
  <param pos="0" name="os.vendor" value="HP"/>
249
275
  <param pos="0" name="os.family" value="iLO"/>
250
276
  <param pos="0" name="os.product" value="iLO"/>
277
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:integrated_lights-out_firmware:-"/>
251
278
  <param pos="1" name="host.name"/>
252
279
  </fingerprint>
253
280
 
@@ -370,7 +397,7 @@
370
397
  <param pos="0" name="os.vendor" value="Cisco"/>
371
398
  <param pos="0" name="os.family" value="Adaptive Security Appliance"/>
372
399
  <param pos="0" name="os.product" value="Adaptive Security Appliance"/>
373
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance:-"/>
400
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:adaptive_security_appliance_software:-"/>
374
401
  <param pos="0" name="hw.vendor" value="Cisco"/>
375
402
  <param pos="0" name="hw.family" value="Adaptive Security Appliance"/>
376
403
  <param pos="0" name="hw.product" value="Adaptive Security Appliance"/>
@@ -384,7 +411,7 @@
384
411
  <param pos="0" name="os.vendor" value="Cisco"/>
385
412
  <param pos="0" name="os.device" value="Wireless Controller"/>
386
413
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
387
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
414
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
388
415
  <param pos="1" name="cisco.serial_number"/>
389
416
  </fingerprint>
390
417
 
@@ -394,7 +421,7 @@
394
421
  <param pos="0" name="os.vendor" value="Cisco"/>
395
422
  <param pos="0" name="os.device" value="Wireless Controller"/>
396
423
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
397
- <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller:-"/>
424
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
398
425
  <param pos="0" name="hw.vendor" value="Cisco"/>
399
426
  <param pos="0" name="hw.device" value="Wireless Controller"/>
400
427
  <param pos="0" name="hw.product" value="Wireless LAN Controller"/>
@@ -477,8 +504,10 @@
477
504
  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=VMware ESX Server Default Certificate,O=VMware\\, Inc,L=Palo Alto,ST=California,C=US$">
478
505
  <description>VMware ESX</description>
479
506
  <example>CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
507
+ <param pos="0" name="service.vendor" value="VMware"/>
480
508
  <param pos="0" name="os.vendor" value="VMware"/>
481
- <param pos="0" name="os.product" value="ESX"/>
509
+ <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
510
+ <param pos="0" name="os.product" value="VMware ESX Server"/>
482
511
  <param pos="0" name="os.device" value="Hypervisor"/>
483
512
  <param pos="0" name="os.cpe23" value="cpe:/o:vmware:esx:-"/>
484
513
  <param pos="1" name="host.name"/>
@@ -497,6 +526,24 @@
497
526
  <param pos="0" name="service.product" value="Site Recovery Manager"/>
498
527
  </fingerprint>
499
528
 
529
+ <fingerprint pattern="^CN=([^,=]{1,256}),OU=VMware Horizon View default certificate,O=VMware\\, Inc.$">
530
+ <description>VMware Horizon (formerly View)</description>
531
+ <example host.name="horizon.foo.bar">CN=horizon.foo.bar,OU=VMware Horizon View default certificate,O=VMware\, Inc.</example>
532
+ <param pos="0" name="service.vendor" value="VMware"/>
533
+ <param pos="0" name="service.product" value="Horizon"/>
534
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:horizon:-"/>
535
+ <param pos="1" name="host.name"/>
536
+ </fingerprint>
537
+
538
+ <fingerprint pattern="^CN=([^,=]{1,256}),OU=VMware View default certificate,O=VMware\\, Inc.$">
539
+ <description>VMware View</description>
540
+ <example host.name="horizon.foo.bar">CN=horizon.foo.bar,OU=VMware View default certificate,O=VMware\, Inc.</example>
541
+ <param pos="0" name="service.vendor" value="VMware"/>
542
+ <param pos="0" name="service.product" value="View"/>
543
+ <param pos="0" name="service.cpe23" value="cpe:/a:vmware:view:-"/>
544
+ <param pos="1" name="host.name"/>
545
+ </fingerprint>
546
+
500
547
  <fingerprint pattern="^CN=IOS-Self-Signed-Certificate-">
501
548
  <description>Cisco IOS Default Certificate</description>
502
549
  <example>CN=IOS-Self-Signed-Certificate-4163115936</example>
@@ -508,6 +555,63 @@
508
555
  <param pos="0" name="hw.device" value="Router"/>
509
556
  </fingerprint>
510
557
 
558
+ <fingerprint pattern="^CN=kube-apiserver$">
559
+ <description>Kubernetes api-server default certificate</description>
560
+ <example>CN=kube-apiserver</example>
561
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
562
+ <param pos="0" name="service.family" value="Kubernetes"/>
563
+ <param pos="0" name="service.product" value="Kubernetes"/>
564
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
565
+ </fingerprint>
566
+
567
+ <fingerprint pattern="^CN=kubernetes-master$">
568
+ <description>Kubernetes Control Plane (formerly master) default certificate</description>
569
+ <example>CN=kubernetes-master</example>
570
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
571
+ <param pos="0" name="service.family" value="Kubernetes"/>
572
+ <param pos="0" name="service.product" value="Kubernetes"/>
573
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
574
+ </fingerprint>
575
+
576
+ <fingerprint pattern="^CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co$">
577
+ <description>Kubernetes NGINX Ingress Controller with default cert</description>
578
+ <example>CN=Kubernetes Ingress Controller Fake Certificate,O=Acme Co</example>
579
+ <param pos="0" name="service.vendor" value="Kubernetes"/>
580
+ <param pos="0" name="service.family" value="Kubernetes"/>
581
+ <param pos="0" name="service.product" value="NGINX Ingress Controller"/>
582
+ <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:nginx_ingress_controller:-"/>
583
+ </fingerprint>
584
+
585
+ <fingerprint pattern="^CN=TRAEFIK DEFAULT CERT$">
586
+ <description>Traefik Proxy default certificate</description>
587
+ <example>CN=TRAEFIK DEFAULT CERT</example>
588
+ <param pos="0" name="service.vendor" value="Traefik Labs"/>
589
+ <param pos="0" name="service.family" value="Traefik"/>
590
+ <param pos="0" name="service.product" value="Traefik Proxy"/>
591
+ <param pos="0" name="service.cpe23" value="cpe:/a:containous:traefik:-"/>
592
+ </fingerprint>
593
+
594
+ <fingerprint pattern="^CN=default(?: [A-Z]+)?,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US$">
595
+ <description>Citrix Netscaler (later renamed to Citrix ADC)</description>
596
+ <example>CN=default,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
597
+ <example>CN=default UYENMB,OU=NS Internal,O=Citrix ANG,L=San Jose,ST=California,C=US</example>
598
+ <param pos="0" name="service.vendor" value="Citrix"/>
599
+ <param pos="0" name="service.family" value="Netscaler"/>
600
+ <param pos="0" name="service.product" value="Netscaler"/>
601
+ <param pos="0" name="service.device" value="Network Management Device"/>
602
+ <param pos="0" name="service.cpe23" value="cpe:/a:citrix:netscaler:-"/>
603
+ <param pos="0" name="os.vendor" value="Citrix"/>
604
+ <param pos="0" name="os.family" value="Netscaler"/>
605
+ <param pos="0" name="os.product" value="Netscaler Gateway Firmware"/>
606
+ <param pos="0" name="os.device" value="Network Management Device"/>
607
+ <param pos="0" name="os.cpe23" value="cpe:/o:citrix:netscaler_gateway_firmware:-"/>
608
+ <param pos="0" name="hw.vendor" value="Citrix"/>
609
+ <param pos="0" name="hw.family" value="Netscaler"/>
610
+ <param pos="0" name="hw.product" value="Netscaler Gateway"/>
611
+ <param pos="0" name="hw.device" value="Network Management Device"/>
612
+ <param pos="0" name="hw.cpe23" value="cpe:/h:citrix:netscaler_gateway:-"/>
613
+ </fingerprint>
614
+
511
615
  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=(?:Cast|Google TV),O=Google Inc,L=Mountain View,ST=California,C=US$">
512
616
  <description>Google Chromecast</description>
513
617
  <example chromecast.serial_number="LVDZG5" host.mac_local="FA8FCA67413D">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
@@ -1064,13 +1168,30 @@
1064
1168
  </fingerprint>
1065
1169
 
1066
1170
  <fingerprint pattern="^CN=[0-9\.]+,OU=SSL-VPN,O=SonicWALL\\, Inc\.,L=Sunnyvale,ST=CA,C=US$">
1067
- <description>SonicWALL Firewall</description>
1171
+ <description>SonicWALL SSL-VPN</description>
1068
1172
  <example>CN=192.168.200.1,OU=SSL-VPN,O=SonicWALL\, Inc.,L=Sunnyvale,ST=CA,C=US</example>
1173
+ <param pos="0" name="service.vendor" value="SonicWall"/>
1174
+ <param pos="0" name="service.family" value="SSL-VPN"/>
1069
1175
  <param pos="0" name="hw.vendor" value="SonicWall"/>
1070
1176
  <param pos="0" name="hw.device" value="VPN"/>
1071
1177
  <param pos="0" name="os.vendor" value="SonicWall"/>
1072
- <param pos="0" name="os.product" value="VPN"/>
1073
- <param pos="0" name="os.family" value="VPN"/>
1178
+ <param pos="0" name="os.family" value="SonicOS"/>
1179
+ <param pos="0" name="os.product" value="SonicOS"/>
1180
+ <param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
1181
+ </fingerprint>
1182
+
1183
+ <fingerprint pattern="^CN=[0-9\.]+,OU=HTTPS Management Certificate for SonicWALL \(self-signed\),O=HTTPS Management Certificate for SonicWALL \(self-signed\),L=Sunnyvale,ST=California,C=US$">
1184
+ <description>SonicWALL Network Security Appliance firewall</description>
1185
+ <example>CN=192.168.168.168,OU=HTTPS Management Certificate for SonicWALL (self-signed),O=HTTPS Management Certificate for SonicWALL (self-signed),L=Sunnyvale,ST=California,C=US</example>
1186
+ <param pos="0" name="hw.vendor" value="SonicWall"/>
1187
+ <param pos="0" name="hw.product" value="Network Security Appliance"/>
1188
+ <param pos="0" name="hw.family" value="Network Security Appliance"/>
1189
+ <param pos="0" name="hw.device" value="Firewall"/>
1190
+ <param pos="0" name="os.vendor" value="SonicWall"/>
1191
+ <param pos="0" name="os.family" value="SonicOS"/>
1192
+ <param pos="0" name="os.product" value="SonicOS"/>
1193
+ <param pos="0" name="os.device" value="Firewall"/>
1194
+ <param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
1074
1195
  </fingerprint>
1075
1196
 
1076
1197
  <fingerprint pattern="^CN=.*\.akamai\.net,O=Akamai Technologies\\, Inc\.,L=Cambridge,ST=Massachusetts,C=US$">
@@ -1078,10 +1199,19 @@
1078
1199
  <example>CN=a248.e.akamai.net,O=Akamai Technologies\, Inc.,L=Cambridge,ST=Massachusetts,C=US</example>
1079
1200
  <param pos="0" name="service.vendor" value="Akamai"/>
1080
1201
  <param pos="0" name="service.product" value="GHost"/>
1202
+ <param pos="0" name="service.cpe23" value="cpe:/a:akamai:akamaighost:-"/>
1081
1203
  <param pos="0" name="os.vendor" value="Akamai"/>
1082
1204
  <param pos="0" name="os.device" value="Web Proxy"/>
1083
1205
  </fingerprint>
1084
1206
 
1207
+ <fingerprint pattern="^O=Caddy Self-Signed$">
1208
+ <description>CaddyServer Caddy - golang based httpd</description>
1209
+ <example>O=Caddy Self-Signed</example>
1210
+ <param pos="0" name="service.vendor" value="CaddyServer"/>
1211
+ <param pos="0" name="service.product" value="Caddy"/>
1212
+ <param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
1213
+ </fingerprint>
1214
+
1085
1215
  <fingerprint pattern="^CN=HP_3PAR_">
1086
1216
  <description>HP 3PAR</description>
1087
1217
  <example>CN=HP_3PAR_1626615</example>
@@ -1234,16 +1364,12 @@
1234
1364
  <param pos="0" name="hw.vendor" value="Palo Alto Networks"/>
1235
1365
  <param pos="0" name="hw.device" value="Firewall"/>
1236
1366
  <param pos="0" name="os.vendor" value="Palo Alto Networks"/>
1237
- <param pos="0" name="os.product" value="PANOS"/>
1367
+ <param pos="0" name="os.product" value="PAN-OS"/>
1368
+ <param pos="0" name="os.family" value="PAN-OS"/>
1238
1369
  <param pos="0" name="os.device" value="Firewall"/>
1239
- </fingerprint>
1240
-
1241
- <fingerprint pattern="^CN=VMware default certificate,OU=vCenterServer.*,O=VMware\\, Inc\.$">
1242
- <description>VMware vCenter</description>
1243
- <example>CN=VMware default certificate,OU=vCenterServer_2013.09.26_220623,O=VMware\, Inc.</example>
1244
- <param pos="0" name="service.vendor" value="VMware"/>
1245
- <param pos="0" name="service.product" value="vCenter"/>
1246
- <param pos="0" name="service.cpe23" value="cpe:/a:vmware:vcenter_server:-"/>
1370
+ <param pos="0" name="os.cpe23" value="cpe:/o:paloaltonetworks:pan-os:-"/>
1371
+ <param pos="0" name="service.vendor" value="Palo Alto Networks"/>
1372
+ <param pos="0" name="service.device" value="Firewall"/>
1247
1373
  </fingerprint>
1248
1374
 
1249
1375
  <fingerprint pattern="^CN=selfappliance,OU=Engineering,O=Symplified,L=Boulder,ST=Colorado,C=US$">
@@ -1507,4 +1633,15 @@
1507
1633
  <param pos="0" name="hw.product" value="SD-WAN"/>
1508
1634
  </fingerprint>
1509
1635
 
1636
+ <fingerprint pattern="^CN=Windows Media Player Network Sharing Service \(([A-Z-]{1,15})\)$">
1637
+ <description>Windows Media Player Network Sharing Service</description>
1638
+ <example host.name="LIVING-ROOM">CN=Windows Media Player Network Sharing Service (LIVING-ROOM)</example>
1639
+ <param pos="0" name="service.vendor" value="Microsoft"/>
1640
+ <param pos="0" name="service.product" value="Windows Media Player"/>
1641
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:windows_media_player:-"/>
1642
+ <param pos="0" name="os.vendor" value="Microsoft"/>
1643
+ <param pos="0" name="os.family" value="Windows"/>
1644
+ <param pos="1" name="host.name"/>
1645
+ </fingerprint>
1646
+
1510
1647
  </fingerprints>