recog 2.3.20 → 2.3.21

Sign up to get free protection for your applications and to get access to all the features.
Files changed (32) hide show
  1. checksums.yaml +4 -4
  2. data/cpe-remap.yaml +29 -1
  3. data/identifiers/fields.txt +1 -1
  4. data/identifiers/hw_product.txt +1 -0
  5. data/identifiers/os_product.txt +0 -1
  6. data/lib/recog/nizer.rb +1 -82
  7. data/lib/recog/version.rb +1 -1
  8. data/xml/apache_os.xml +1 -1
  9. data/xml/dns_versionbind.xml +10 -0
  10. data/xml/favicons.xml +1 -0
  11. data/xml/ftp_banners.xml +56 -44
  12. data/xml/html_title.xml +36 -12
  13. data/xml/http_cookies.xml +2 -3
  14. data/xml/http_servers.xml +28 -28
  15. data/xml/http_wwwauth.xml +3 -3
  16. data/xml/imap_banners.xml +5 -5
  17. data/xml/mdns_device-info_txt.xml +32 -0
  18. data/xml/mysql_banners.xml +2 -1
  19. data/xml/nntp_banners.xml +1 -1
  20. data/xml/ntp_banners.xml +1 -1
  21. data/xml/operating_system.xml +4 -4
  22. data/xml/pop_banners.xml +4 -4
  23. data/xml/sip_banners.xml +3 -3
  24. data/xml/sip_user_agents.xml +5 -0
  25. data/xml/smb_native_os.xml +3 -0
  26. data/xml/smtp_banners.xml +130 -127
  27. data/xml/snmp_sysdescr.xml +26 -26
  28. data/xml/ssh_banners.xml +12 -11
  29. data/xml/telnet_banners.xml +59 -44
  30. data/xml/x509_issuers.xml +32 -2
  31. data/xml/x509_subjects.xml +23 -13
  32. metadata +2 -2
data/xml/html_title.xml CHANGED
@@ -1,41 +1,62 @@
1
1
  <?xml version='1.0' encoding='UTF-8'?>
2
- <fingerprints matches="html_title" database_type="service" preference="0.90">
2
+ <fingerprints matches="html_title" protocol="http" database_type="service" preference="0.90">
3
3
  <!-- HTML Title elements found in HTTP response bodies are matched against these patterns to fingerprint HTTP servers. -->
4
4
 
5
5
  <fingerprint pattern="^301 Moved Permanently$">
6
6
  <description>301 Moved Permanently - generic -- assert nothing.</description>
7
7
  <example>301 Moved Permanently</example>
8
+ <param pos="0" name="hw.certainty" value="0.0"/>
9
+ <param pos="0" name="os.certainty" value="0.0"/>
10
+ <param pos="0" name="service.certainty" value="0.0"/>
8
11
  </fingerprint>
9
12
 
10
13
  <fingerprint pattern="^302 Found$">
11
14
  <description>302 Found - generic -- assert nothing.</description>
12
15
  <example>302 Found</example>
16
+ <param pos="0" name="hw.certainty" value="0.0"/>
17
+ <param pos="0" name="os.certainty" value="0.0"/>
18
+ <param pos="0" name="service.certainty" value="0.0"/>
13
19
  </fingerprint>
14
20
 
15
21
  <fingerprint pattern="^400 Bad Request$">
16
22
  <description>400 Bad Request - generic -- assert nothing.</description>
17
23
  <example>400 Bad Request</example>
24
+ <param pos="0" name="hw.certainty" value="0.0"/>
25
+ <param pos="0" name="os.certainty" value="0.0"/>
26
+ <param pos="0" name="service.certainty" value="0.0"/>
18
27
  </fingerprint>
19
28
 
20
29
  <fingerprint pattern="^401 Unauthorized$">
21
30
  <description>401 Unauthorized - generic -- assert nothing.</description>
22
31
  <example>401 Unauthorized</example>
32
+ <param pos="0" name="hw.certainty" value="0.0"/>
33
+ <param pos="0" name="os.certainty" value="0.0"/>
34
+ <param pos="0" name="service.certainty" value="0.0"/>
23
35
  </fingerprint>
24
36
 
25
37
  <fingerprint pattern="^403 Forbidden$">
26
38
  <description>403 Forbidden - generic -- assert nothing.</description>
27
39
  <example>403 Forbidden</example>
40
+ <param pos="0" name="hw.certainty" value="0.0"/>
41
+ <param pos="0" name="os.certainty" value="0.0"/>
42
+ <param pos="0" name="service.certainty" value="0.0"/>
28
43
  </fingerprint>
29
44
 
30
45
  <fingerprint pattern="^(?:404 )?Not Found$">
31
46
  <description>404 Not Found - generic -- assert nothing.</description>
32
47
  <example>404 Not Found</example>
33
48
  <example>Not Found</example>
49
+ <param pos="0" name="hw.certainty" value="0.0"/>
50
+ <param pos="0" name="os.certainty" value="0.0"/>
51
+ <param pos="0" name="service.certainty" value="0.0"/>
34
52
  </fingerprint>
35
53
 
36
54
  <fingerprint pattern="^Invalid URL$">
37
55
  <description>Invalid URL - generic -- assert nothing.</description>
38
56
  <example>Invalid URL</example>
57
+ <param pos="0" name="hw.certainty" value="0.0"/>
58
+ <param pos="0" name="os.certainty" value="0.0"/>
59
+ <param pos="0" name="service.certainty" value="0.0"/>
39
60
  </fingerprint>
40
61
 
41
62
  <fingerprint pattern="^ERROR: The request could not be satisfied$">
@@ -353,7 +374,7 @@
353
374
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
354
375
  </fingerprint>
355
376
 
356
- <fingerprint pattern="^(?i)Default (?:Parallels )?Plesk (?:Panel )?Page$">
377
+ <fingerprint pattern="(?i)^Default (?:Parallels )?Plesk (?:Panel )?Page$">
357
378
  <description>Plesk web hosting platform with no version</description>
358
379
  <example>Default Parallels Plesk Panel Page</example>
359
380
  <example>Default Parallels Plesk Page</example>
@@ -378,7 +399,7 @@
378
399
  <param pos="0" name="hw.device" value="DVR"/>
379
400
  </fingerprint>
380
401
 
381
- <fingerprint pattern="^(?i)(?:Dell )?Sonicwall - Authentication$">
402
+ <fingerprint pattern="(?i)^(?:Dell )?Sonicwall - Authentication$">
382
403
  <description>Sonicwall firewalls</description>
383
404
  <example>SonicWall - Authentication</example>
384
405
  <param pos="0" name="os.vendor" value="SonicWall"/>
@@ -412,7 +433,7 @@
412
433
  <param pos="0" name="os.cpe23" value="cpe:/o:watchguard:fireware:-"/>
413
434
  </fingerprint>
414
435
 
415
- <fingerprint pattern="^(.*).nbsp;-.nbsp;Synology.nbsp;DiskStation$">
436
+ <fingerprint pattern="^(.{0,512}).nbsp;-.nbsp;Synology.nbsp;DiskStation$">
416
437
  <description>Synology DiskStation</description>
417
438
  <example host.name="DiskStation">DiskStation&amp;nbsp;-&amp;nbsp;Synology&amp;nbsp;DiskStation</example>
418
439
  <example host.name="DS218">DS218&amp;nbsp;-&amp;nbsp;Synology&amp;nbsp;DiskStation</example>
@@ -699,7 +720,7 @@
699
720
  <param pos="0" name="hw.product" value="Prosafe Plus"/>
700
721
  </fingerprint>
701
722
 
702
- <fingerprint pattern="^(.*).nbsp;Configuration and Management$">
723
+ <fingerprint pattern="^(.{0,256}).nbsp;Configuration and Management$">
703
724
  <description>Digi Terminal Servers</description>
704
725
  <example hw.product="Digi One SP">Digi One SP&amp;nbsp;Configuration and Management</example>
705
726
  <example hw.product="PortServer TS 4">PortServer TS 4&amp;nbsp;Configuration and Management</example>
@@ -820,7 +841,7 @@
820
841
  <param pos="0" name="hw.product" value="Rack PDU Card"/>
821
842
  </fingerprint>
822
843
 
823
- <fingerprint pattern="^(.*) IntelliSlot Web(?:/\d+)? Card?$">
844
+ <fingerprint pattern="^(.{0,256}) IntelliSlot Web(?:/\d+)? Card?$">
824
845
  <description>Emerson Network Power IntelliSlot Web Card and rebrands</description>
825
846
  <example hw.vendor="Emerson Network Power">Emerson Network Power IntelliSlot Web Card</example>
826
847
  <example hw.vendor="Emerson Network Power">Emerson Network Power IntelliSlot Web/485 Card</example>
@@ -1038,7 +1059,7 @@
1038
1059
  <param pos="0" name="hw.product" value="OpenManage Switch"/>
1039
1060
  </fingerprint>
1040
1061
 
1041
- <fingerprint pattern="^(\S+)\s+-\s+ProCurve Switch (\S+) \((.*)\)$">
1062
+ <fingerprint pattern="^(\S{1,512})\s{1,8}-\s{1,8}ProCurve Switch (\S+) \((.*)\)$">
1042
1063
  <description>HPE ProCurve Switch w/Hostname</description>
1043
1064
  <example host.name="SW1" hw.product="4204vl" procurve.model="J8770A">SW1 - ProCurve Switch 4204vl (J8770A)</example>
1044
1065
  <param pos="0" name="hw.vendor" value="HPE"/>
@@ -1134,20 +1155,22 @@
1134
1155
 
1135
1156
  <fingerprint pattern="^Agilent 33220A \((.*)\)$">
1136
1157
  <description>Agilent 33220A</description>
1137
- <example agilent.serial="MY44041111">Agilent 33220A (MY44041111)</example>
1158
+ <example agilent.serial="MY44041111" hw.serial_number="MY44041111">Agilent 33220A (MY44041111)</example>
1138
1159
  <param pos="0" name="hw.vendor" value="Agilent"/>
1139
1160
  <param pos="0" name="hw.device" value="Test Instrument"/>
1140
1161
  <param pos="0" name="hw.product" value="33220A Waveform Generator"/>
1141
1162
  <param pos="1" name="agilent.serial"/>
1163
+ <param pos="1" name="hw.serial_number"/>
1142
1164
  </fingerprint>
1143
1165
 
1144
1166
  <fingerprint pattern="^Agilent N5172B (?:EXG )?(MY\S+)$">
1145
1167
  <description>Agilent N5172B</description>
1146
- <example agilent.serial="MY44041111">Agilent N5172B EXG MY44041111</example>
1168
+ <example agilent.serial="MY44041111" hw.serial_number="MY44041111">Agilent N5172B EXG MY44041111</example>
1147
1169
  <param pos="0" name="hw.vendor" value="Agilent"/>
1148
1170
  <param pos="0" name="hw.device" value="Test Instrument"/>
1149
1171
  <param pos="0" name="hw.product" value="N5172B Signal Generator"/>
1150
1172
  <param pos="1" name="agilent.serial"/>
1173
+ <param pos="1" name="hw.serial_number"/>
1151
1174
  </fingerprint>
1152
1175
 
1153
1176
  <fingerprint pattern="^Polycom - Configuration Utility$">
@@ -1397,6 +1420,7 @@
1397
1420
  <param pos="0" name="hw.vendor" value="KACE"/>
1398
1421
  <param pos="0" name="hw.device" value="Support Appliance"/>
1399
1422
  <param pos="0" name="hw.product" value="K1000"/>
1423
+ <param pos="0" name="hw.cpe23" value="cpe:/h:dell:kace_k1000_systems_management_appliance:-"/>
1400
1424
  <param pos="0" name="os.vendor" value="KACE"/>
1401
1425
  <param pos="0" name="os.family" value="FreeBSD"/>
1402
1426
  </fingerprint>
@@ -1678,7 +1702,7 @@
1678
1702
  <param pos="0" name="service.cpe23" value="cpe:/a:realvnc:realvnc:-"/>
1679
1703
  </fingerprint>
1680
1704
 
1681
- <fingerprint pattern="^.* \[Jenkins\]$">
1705
+ <fingerprint pattern="^.{0,1024} \[Jenkins\]$">
1682
1706
  <description>Jenkins Customized Dashboard</description>
1683
1707
  <example>Continuous Integrations [Jenkins]</example>
1684
1708
  <example>Dashboard [Jenkins]</example>
@@ -2341,7 +2365,7 @@
2341
2365
  <param pos="0" name="service.product" value="SonarQube"/>
2342
2366
  </fingerprint>
2343
2367
 
2344
- <fingerprint pattern="^(\S+) - Opengear Management Console$">
2368
+ <fingerprint pattern="^(\S{1,512}) - Opengear Management Console$">
2345
2369
  <description>Opengear Management Console</description>
2346
2370
  <example host.name="server01">server01 - Opengear Management Console</example>
2347
2371
  <param pos="0" name="service.vendor" value="Opengear"/>
@@ -2607,7 +2631,7 @@
2607
2631
  <param pos="0" name="service.cpe23" value="cpe:/a:zabbix:zabbix:-"/>
2608
2632
  </fingerprint>
2609
2633
 
2610
- <fingerprint pattern="^(\S+) \(build (\S+)\) - Info$">
2634
+ <fingerprint pattern="^(\S{1,512}) \(build (\S+)\) - Info$">
2611
2635
  <description>DD-WRT</description>
2612
2636
  <example host.name="SubTerraVia-NUC" os.version="36104" os.build="36104">SubTerraVia-NUC (build 36104) - Info</example>
2613
2637
  <example host.name="DD-WRT" os.version="35030M" os.build="35030M">DD-WRT (build 35030M) - Info</example>
data/xml/http_cookies.xml CHANGED
@@ -163,14 +163,13 @@
163
163
  The cookie value breaks down to [box-id][service-id][timeout-value]
164
164
  unfortunately, there's no separator so it's hard to tell what the
165
165
  actual break is between the pieces of data.
166
- http://www.cisco.com/warp/public/117/AP_cookies.html
167
166
  -->
168
167
 
169
168
  <fingerprint pattern="^ARPT=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+.*">
170
169
  <description>Cisco 11000 Series Content Service Switch (CSS)</description>
171
- <example host.id="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
170
+ <example host.name="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
172
171
  <param pos="0" name="cookie" value="ARPT"/>
173
- <param pos="1" name="host.id"/>
172
+ <param pos="1" name="host.name"/>
174
173
  <param pos="2" name="host.ip"/>
175
174
  <param pos="0" name="service.vendor" value="Cisco"/>
176
175
  <param pos="0" name="service.family" value="Content Service Switch"/>
data/xml/http_servers.xml CHANGED
@@ -840,7 +840,7 @@
840
840
  </fingerprint>
841
841
 
842
842
  <fingerprint pattern="^UOS$">
843
- <description>HTTP Server that appears unique to Managment Console on HP TippingPoint IPS Devices</description>
843
+ <description>HTTP Server that appears unique to Management Console on HP TippingPoint IPS Devices</description>
844
844
  <example>UOS</example>
845
845
  <param pos="0" name="service.vendor" value="HP"/>
846
846
  <param pos="0" name="service.product" value="HTTP"/>
@@ -878,10 +878,10 @@
878
878
  <param pos="0" name="service.cpe23" value="cpe:/a:acme:mini_httpd:-"/>
879
879
  </fingerprint>
880
880
 
881
- <fingerprint pattern="^LiteSpeed\/?(:?[\d.]+)?(?: \S+)?">
881
+ <fingerprint pattern="^LiteSpeed\/?([\d.]+)?(?: \S+)?">
882
882
  <description>LiteSpeed</description>
883
883
  <example>LiteSpeed</example>
884
- <example>LiteSpeed/5.2.8 Enterprise</example>
884
+ <example service.version="5.2.8">LiteSpeed/5.2.8 Enterprise</example>
885
885
  <param pos="0" name="service.vendor" value="LiteSpeed Technologies"/>
886
886
  <param pos="0" name="service.product" value="LiteSpeed Web Server"/>
887
887
  <param pos="1" name="service.version"/>
@@ -897,7 +897,7 @@
897
897
  <param pos="1" name="service.version"/>
898
898
  </fingerprint>
899
899
 
900
- <fingerprint pattern="^openresty\/?(:?[\d.]+)?$">
900
+ <fingerprint pattern="^openresty\/?([\d.]+)?$">
901
901
  <description>OpenResty OpenResty</description>
902
902
  <example>openresty</example>
903
903
  <example service.version="1.13.6.2">openresty/1.13.6.2</example>
@@ -945,7 +945,7 @@
945
945
  <param pos="0" name="service.cpe23" value="cpe:/a:wftpserver:wing_ftp_server:-"/>
946
946
  </fingerprint>
947
947
 
948
- <fingerprint pattern="^(?i)Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \((BR\d+)\)$">
948
+ <fingerprint pattern="(?i)^Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \((BR\d+)\)$">
949
949
  <description>Sonos Bridge/ZoneBridge</description>
950
950
  <example hw.model="BR100" hw.version="47.2-59120">Linux UPnP/1.0 Sonos/47.2-59120 (BR100)</example>
951
951
  <param pos="0" name="hw.vendor" value="Sonos"/>
@@ -956,7 +956,7 @@
956
956
  <param pos="0" name="os.product" value="Linux"/>
957
957
  </fingerprint>
958
958
 
959
- <fingerprint pattern="^(?i)Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \(ANVIL\)$">
959
+ <fingerprint pattern="(?i)^Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \(ANVIL\)$">
960
960
  <description>Sonos Subwoofer Speaker</description>
961
961
  <example>Linux UPnP/1.0 Sonos/31.3-22220 (ANVIL)</example>
962
962
  <param pos="0" name="hw.vendor" value="Sonos"/>
@@ -1000,7 +1000,7 @@
1000
1000
  <param pos="0" name="service.cpe23" value="cpe:/a:varnish-cache:varnish:-"/>
1001
1001
  </fingerprint>
1002
1002
 
1003
- <fingerprint pattern="^Tengine\/?(:?[\d.]+)?$">
1003
+ <fingerprint pattern="^Tengine\/?([\d.]+)?$">
1004
1004
  <description>Tengine</description>
1005
1005
  <example>Tengine</example>
1006
1006
  <example service.version="2.0.0">Tengine/2.0.0</example>
@@ -1423,7 +1423,7 @@
1423
1423
  <param pos="0" name="service.cpe23" value="cpe:/a:eclipse:jetty:{service.version}"/>
1424
1424
  </fingerprint>
1425
1425
 
1426
- <fingerprint pattern="^(?i)squid/(\d+\.[\w.\-\+]+)$">
1426
+ <fingerprint pattern="(?i)^squid/(\d+\.[\w.\-\+]+)$">
1427
1427
  <description>Squid Web Proxy with a version</description>
1428
1428
  <example service.version="2.3.STABLE1">Squid/2.3.STABLE1</example>
1429
1429
  <example service.version="4.4">squid/4.4</example>
@@ -1435,7 +1435,7 @@
1435
1435
  <param pos="0" name="service.cpe23" value="cpe:/a:squid-cache:squid:{service.version}"/>
1436
1436
  </fingerprint>
1437
1437
 
1438
- <fingerprint pattern="^(?i)squid$">
1438
+ <fingerprint pattern="(?i)^squid$">
1439
1439
  <description>Squid Web Proxy without a version</description>
1440
1440
  <example>Squid</example>
1441
1441
  <example>squid</example>
@@ -1492,7 +1492,7 @@
1492
1492
  <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
1493
1493
  </fingerprint>
1494
1494
 
1495
- <fingerprint pattern="^nginx\/?(:?[\d.]+)?">
1495
+ <fingerprint pattern="^nginx\/?([\d.]+)?">
1496
1496
  <description>nginx with version info and/or mods</description>
1497
1497
  <example service.version="0.8.53">nginx/0.8.53 + Phusion Passenger 3.0.0 (mod_rails/mod_rack)</example>
1498
1498
  <example>nginx/0.8.53</example>
@@ -1993,11 +1993,11 @@
1993
1993
  this information useful and mappable to CPE
1994
1994
  -->
1995
1995
 
1996
- <fingerprint pattern="^HP HTTP Server; (?:Hewlett-Packard )?HP ((\S+) \S+)">
1996
+ <fingerprint pattern="^HP HTTP Server; (?:Hewlett-Packard )?HP ((\S+) \S+)[^;]+; Serial Number: ([^;]+);">
1997
1997
  <description>HP Printer</description>
1998
- <example os.product="Photosmart C309a" os.family="Photosmart">HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
1999
- <example os.product="Officejet 6500" os.family="Officejet">HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2000
- <example os.product="Designjet T520" os.family="Designjet">HP HTTP Server; Hewlett-Packard HP Designjet T520 36in - ABC123; Serial Number: 0123456789; Built:Tue Sep 09, 2014 08:32:54AM {012345678901}</example>
1998
+ <example os.product="Photosmart C309a" os.family="Photosmart" hw.serial_number="abc123">HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
1999
+ <example os.product="Officejet 6500" os.family="Officejet" hw.serial_number="abc123">HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2000
+ <example os.product="Designjet T520" os.family="Designjet" hw.serial_number="0123456789">HP HTTP Server; Hewlett-Packard HP Designjet T520 36in - ABC123; Serial Number: 0123456789; Built:Tue Sep 09, 2014 08:32:54AM {012345678901}</example>
2001
2001
  <param pos="0" name="service.vendor" value="HP"/>
2002
2002
  <param pos="0" name="service.product" value="JetDirect"/>
2003
2003
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -2009,6 +2009,7 @@
2009
2009
  <param pos="0" name="hw.family" value="JetDirect"/>
2010
2010
  <param pos="0" name="hw.product" value="JetDirect"/>
2011
2011
  <param pos="0" name="hw.device" value="Printer"/>
2012
+ <param pos="3" name="hw.serial_number"/>
2012
2013
  </fingerprint>
2013
2014
 
2014
2015
  <fingerprint pattern="^HTTP/1\.0$">
@@ -2650,7 +2651,7 @@
2650
2651
  <param pos="1" name="service.version"/>
2651
2652
  </fingerprint>
2652
2653
 
2653
- <fingerprint pattern="^Embedthis-(?:Appweb|http)\/?(:?[\d.]+)?$">
2654
+ <fingerprint pattern="^Embedthis-(?:Appweb|http)\/?([\d.]+)?$">
2654
2655
  <description>Embedthis AppWeb</description>
2655
2656
  <example service.version="3.2.3">Embedthis-Appweb/3.2.3</example>
2656
2657
  <example>Embedthis-http</example>
@@ -2964,29 +2965,28 @@
2964
2965
  <param pos="0" name="service.product" value="2wire"/>
2965
2966
  </fingerprint>
2966
2967
 
2967
- <!-- junit says,
2968
- "Example pattern '' from http_servers.xml didn't match pattern '^$'"
2969
- Figure out if we have a way to support matching empty strings later.
2970
- <fingerprint pattern="^?">
2971
- <example></example>
2972
- <description>A blank banner; assert nothing.</description>
2973
- </fingerprint>
2974
-
2975
- -->
2976
-
2977
2968
  <fingerprint pattern="^(?:(?:\d{1,3}\.){3}\d{1,3}):\d{1,4}$">
2978
2969
  <description>A banner consisting of an IPv4 address and port -- assert nothing.</description>
2979
2970
  <example>192.168.0.4:9999</example>
2971
+ <param pos="0" name="hw.certainty" value="0.0"/>
2972
+ <param pos="0" name="os.certainty" value="0.0"/>
2973
+ <param pos="0" name="service.certainty" value="0.0"/>
2980
2974
  </fingerprint>
2981
2975
 
2982
2976
  <fingerprint pattern="^Web-Server/(?:\d+\.+\d+)$">
2983
2977
  <description>Obfuscated web server -- assert nothing.</description>
2984
2978
  <example>Web-Server/3.0</example>
2979
+ <param pos="0" name="hw.certainty" value="0.0"/>
2980
+ <param pos="0" name="os.certainty" value="0.0"/>
2981
+ <param pos="0" name="service.certainty" value="0.0"/>
2985
2982
  </fingerprint>
2986
2983
 
2987
2984
  <fingerprint pattern="^httpd$">
2988
2985
  <description>httpd - generic -- assert nothing.</description>
2989
2986
  <example>httpd</example>
2987
+ <param pos="0" name="hw.certainty" value="0.0"/>
2988
+ <param pos="0" name="os.certainty" value="0.0"/>
2989
+ <param pos="0" name="service.certainty" value="0.0"/>
2990
2990
  </fingerprint>
2991
2991
 
2992
2992
  <!-- Service provider equipment (CDNs, etc) -->
@@ -3283,7 +3283,7 @@
3283
3283
  <param pos="0" name="service.product" value="Node"/>
3284
3284
  </fingerprint>
3285
3285
 
3286
- <fingerprint pattern="(?i)^(.*) UPnP/[\d\.]+\s+AVM FRITZ!(.*) ([\d\.]+)$">
3286
+ <fingerprint pattern="(?i)^(.{0,256}) UPnP/[\d\.]+\s+AVM FRITZ!(.*) ([\d\.]+)$">
3287
3287
  <description>AVM FRITZ! devices of various types</description>
3288
3288
  <example host.name="some thing" os.product="WLAN Repeater 1750E" os.version="134.07.01">some thing UPnP/1.0 AVM FRITZ!WLAN Repeater 1750E 134.07.01</example>
3289
3289
  <param pos="0" name="os.vendor" value="AVM"/>
@@ -3680,7 +3680,7 @@
3680
3680
  <param pos="0" name="service.cpe23" value="cpe:/a:miniupnp_project:miniupnpd:{service.version}"/>
3681
3681
  </fingerprint>
3682
3682
 
3683
- <fingerprint pattern="^(\S+) \d+/Service Pack \d+, UPnP/[\d\.]+, TVersity Media Server$">
3683
+ <fingerprint pattern="^(\S{1,16}) \d+/Service Pack \d+, UPnP/[\d\.]+, TVersity Media Server$">
3684
3684
  <description>TVersity Media Server UPnP Server with Service Pack</description>
3685
3685
  <example>5.2.3790 2/Service Pack 1, UPnP/1.0, TVersity Media Server</example>
3686
3686
  <example>5.1.2600 2/Service Pack 3, UPnP/1.0, TVersity Media Server</example>
@@ -3689,7 +3689,7 @@
3689
3689
  <param pos="1" name="service.version"/>
3690
3690
  </fingerprint>
3691
3691
 
3692
- <fingerprint pattern="^(\S+) 2/, UPnP/\S+, TVersity Media Server$">
3692
+ <fingerprint pattern="^(\S{1,16}) 2/, UPnP/\S+, TVersity Media Server$">
3693
3693
  <description>TVersity Media Server UPnP Server</description>
3694
3694
  <example>6.2.8400 2/, UPnP/1.0, TVersity Media Server</example>
3695
3695
  <example>6.2.9200 2/, UPnP/1.0, TVersity Media Server</example>
data/xml/http_wwwauth.xml CHANGED
@@ -419,7 +419,7 @@
419
419
  <param pos="0" name="service.product" value="SWAT"/>
420
420
  </fingerprint>
421
421
 
422
- <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
422
+ <fingerprint pattern="^.{0,1024}(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
423
423
  <description>SPIP publishing system (www.spip.net)</description>
424
424
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
425
425
  <param pos="0" name="service.vendor" value="SPIP"/>
@@ -427,7 +427,7 @@
427
427
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
428
428
  </fingerprint>
429
429
 
430
- <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
430
+ <fingerprint pattern="^.{0,1024}(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
431
431
  <description>HP Instant Support Enterprise Edition with a hostname</description>
432
432
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
433
433
  <param pos="0" name="service.vendor" value="HP"/>
@@ -435,7 +435,7 @@
435
435
  <param pos="1" name="host.name"/>
436
436
  </fingerprint>
437
437
 
438
- <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
438
+ <fingerprint pattern="^.{0,1024}(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
439
439
  <description>Generic F5 Big-IP</description>
440
440
  <example>Basic realm="BIG-IP"</example>
441
441
  <param pos="0" name="service.vendor" value="F5"/>
data/xml/imap_banners.xml CHANGED
@@ -166,7 +166,7 @@
166
166
  <param pos="0" name="service.product" value="Courier IMAP"/>
167
167
  </fingerprint>
168
168
 
169
- <fingerprint pattern="^(\S+) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
169
+ <fingerprint pattern="^(\S{1,512}) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
170
170
  <description>Nortel CallPilot</description>
171
171
  <example>nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
172
172
  <example>test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
@@ -177,7 +177,7 @@
177
177
  <param pos="1" name="host.name"/>
178
178
  </fingerprint>
179
179
 
180
- <fingerprint pattern="^(\S+) Zimbra IMAP4rev1 server ready\.?$">
180
+ <fingerprint pattern="^(\S{1,512}) Zimbra IMAP4rev1 server ready\.?$">
181
181
  <description>VMware Zimbra IMAP</description>
182
182
  <example host.name="foo.bar">foo.bar Zimbra IMAP4rev1 server ready</example>
183
183
  <param pos="0" name="service.vendor" value="VMware"/>
@@ -186,7 +186,7 @@
186
186
  <param pos="1" name="host.name"/>
187
187
  </fingerprint>
188
188
 
189
- <fingerprint pattern="^(\S+) Zimbra (\S+) IMAP4rev1 server ready\.?$">
189
+ <fingerprint pattern="^(\S{1,512}) Zimbra (\S+) IMAP4rev1 server ready\.?$">
190
190
  <description>VMware Zimbra IMAP with service version</description>
191
191
  <example host.name="foo.bar" service.version="7.0.0_GA_3079">foo.bar Zimbra 7.0.0_GA_3079 IMAP4rev1 server ready</example>
192
192
  <param pos="0" name="service.vendor" value="VMware"/>
@@ -196,7 +196,7 @@
196
196
  <param pos="1" name="host.name"/>
197
197
  </fingerprint>
198
198
 
199
- <fingerprint pattern="^(.+) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
199
+ <fingerprint pattern="^(\S{1,512}) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
200
200
  <description>CMU Cyrus IMAP on Mac OS X</description>
201
201
  <example host.name="example.com" service.version="2.2.12" os.version="10.4.0">example.com Cyrus IMAP4 v2.2.12-OS X 10.4.0 server ready</example>
202
202
  <example host.name="example.com" service.version="2.3.8" os.version="10.5">example.com Cyrus IMAP4 v2.3.8-OS X Server 10.5: 9A562 server ready</example>
@@ -213,7 +213,7 @@
213
213
  <param pos="1" name="host.name"/>
214
214
  </fingerprint>
215
215
 
216
- <fingerprint pattern="^(.+) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
216
+ <fingerprint pattern="^(\S{1,512}) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
217
217
  <description>CMU Cyrus IMAP</description>
218
218
  <example host.name="example.com" service.version="2.3.7">example.com Cyrus IMAP4 v2.3.7 server ready</example>
219
219
  <example host.name="example.com" service.version="2.4.8-Invoca-RPM-2.4.8-1">example.com Cyrus IMAP Murder v2.4.8-Invoca-RPM-2.4.8-1 server ready</example>
data/xml/mdns_device-info_txt.xml CHANGED
@@ -259,6 +259,7 @@
259
259
  <param pos="0" name="hw.family" value="MacBook Pro"/>
260
260
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, M1, 2020)"/>
261
261
  <param pos="0" name="hw.device" value="Laptop"/>
262
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
262
263
  </fingerprint>
263
264
 
264
265
  <fingerprint pattern="^model=MacBookPro16,1$">
@@ -272,6 +273,7 @@
272
273
  <param pos="0" name="hw.family" value="MacBook Pro"/>
273
274
  <param pos="0" name="hw.product" value="MacBook Pro (16-inch, 2019)"/>
274
275
  <param pos="0" name="hw.device" value="Laptop"/>
276
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
275
277
  </fingerprint>
276
278
 
277
279
  <fingerprint pattern="^model=MacBookPro16,[23]$">
@@ -286,6 +288,7 @@
286
288
  <param pos="0" name="hw.family" value="MacBook Pro"/>
287
289
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, 2020)"/>
288
290
  <param pos="0" name="hw.device" value="Laptop"/>
291
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
289
292
  </fingerprint>
290
293
 
291
294
  <fingerprint pattern="^model=MacBookPro15,4$">
@@ -299,6 +302,7 @@
299
302
  <param pos="0" name="hw.family" value="MacBook Pro"/>
300
303
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, 2019, Two Thunderbolt 3 ports)"/>
301
304
  <param pos="0" name="hw.device" value="Laptop"/>
305
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
302
306
  </fingerprint>
303
307
 
304
308
  <fingerprint pattern="^model=MacBookPro15,3$">
@@ -312,6 +316,7 @@
312
316
  <param pos="0" name="hw.family" value="MacBook Pro"/>
313
317
  <param pos="0" name="hw.product" value="MacBook Pro (15-inch, 2019)"/>
314
318
  <param pos="0" name="hw.device" value="Laptop"/>
319
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
315
320
  </fingerprint>
316
321
 
317
322
  <fingerprint pattern="^model=MacBookPro15,2$">
@@ -325,6 +330,7 @@
325
330
  <param pos="0" name="hw.family" value="MacBook Pro"/>
326
331
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, 2018, Four Thunderbolt 3 ports)"/>
327
332
  <param pos="0" name="hw.device" value="Laptop"/>
333
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
328
334
  </fingerprint>
329
335
 
330
336
  <fingerprint pattern="^model=MacBookPro15,1$">
@@ -338,6 +344,7 @@
338
344
  <param pos="0" name="hw.family" value="MacBook Pro"/>
339
345
  <param pos="0" name="hw.product" value="MacBook Pro (15-inch, 2018)"/>
340
346
  <param pos="0" name="hw.device" value="Laptop"/>
347
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
341
348
  </fingerprint>
342
349
 
343
350
  <fingerprint pattern="^model=MacBookPro14,3$">
@@ -429,6 +436,7 @@
429
436
  <param pos="0" name="hw.family" value="MacBook Pro"/>
430
437
  <param pos="0" name="hw.product" value="MacBook Pro (Retina, 13-inch, Early 2015)"/>
431
438
  <param pos="0" name="hw.device" value="Laptop"/>
439
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
432
440
  </fingerprint>
433
441
 
434
442
  <fingerprint pattern="^model=MacBookPro11,[45]$">
@@ -443,6 +451,7 @@
443
451
  <param pos="0" name="hw.family" value="MacBook Pro"/>
444
452
  <param pos="0" name="hw.product" value="MacBook Pro (Retina, 15-inch, Mid 2015)"/>
445
453
  <param pos="0" name="hw.device" value="Laptop"/>
454
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
446
455
  </fingerprint>
447
456
 
448
457
  <fingerprint pattern="^model=MacBookPro11,3$">
@@ -746,6 +755,7 @@
746
755
  <param pos="0" name="hw.family" value="MacBook"/>
747
756
  <param pos="0" name="hw.product" value="MacBook Air (M1, 2020)"/>
748
757
  <param pos="0" name="hw.device" value="Laptop"/>
758
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
749
759
  </fingerprint>
750
760
 
751
761
  <fingerprint pattern="^model=MacBookAir9,1$">
@@ -759,6 +769,7 @@
759
769
  <param pos="0" name="hw.family" value="MacBook"/>
760
770
  <param pos="0" name="hw.product" value="MacBook Air (Retina, 13-inch, 2020)"/>
761
771
  <param pos="0" name="hw.device" value="Laptop"/>
772
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
762
773
  </fingerprint>
763
774
 
764
775
  <fingerprint pattern="^model=MacBookAir8,2$">
@@ -772,6 +783,7 @@
772
783
  <param pos="0" name="hw.family" value="MacBook"/>
773
784
  <param pos="0" name="hw.product" value="MacBook Air (Retina, 13-inch, 2019)"/>
774
785
  <param pos="0" name="hw.device" value="Laptop"/>
786
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
775
787
  </fingerprint>
776
788
 
777
789
  <fingerprint pattern="^model=MacBookAir8,1$">
@@ -785,6 +797,7 @@
785
797
  <param pos="0" name="hw.family" value="MacBook"/>
786
798
  <param pos="0" name="hw.product" value="MacBook Air (Retina, 13-inch, 2018)"/>
787
799
  <param pos="0" name="hw.device" value="Laptop"/>
800
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
788
801
  </fingerprint>
789
802
 
790
803
  <fingerprint pattern="^model=MacBookAir7,2$">
@@ -798,6 +811,7 @@
798
811
  <param pos="0" name="hw.family" value="MacBook"/>
799
812
  <param pos="0" name="hw.product" value="MacBook Air (13-inch, 2017)"/>
800
813
  <param pos="0" name="hw.device" value="Laptop"/>
814
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
801
815
  </fingerprint>
802
816
 
803
817
  <fingerprint pattern="^model=MacBookAir7,1$">
@@ -1236,6 +1250,7 @@
1236
1250
  <param pos="0" name="hw.family" value="iMac"/>
1237
1251
  <param pos="0" name="hw.product" value="iMac (Retina 5K, 27-inch, 2020)"/>
1238
1252
  <param pos="0" name="hw.device" value="Desktop"/>
1253
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1239
1254
  </fingerprint>
1240
1255
 
1241
1256
  <fingerprint pattern="^model=iMac19,1$">
@@ -1249,6 +1264,7 @@
1249
1264
  <param pos="0" name="hw.family" value="iMac"/>
1250
1265
  <param pos="0" name="hw.product" value="iMac (Retina 5K, 27-inch, 2019)"/>
1251
1266
  <param pos="0" name="hw.device" value="Desktop"/>
1267
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1252
1268
  </fingerprint>
1253
1269
 
1254
1270
  <fingerprint pattern="^model=iMac19,2$">
@@ -1262,6 +1278,7 @@
1262
1278
  <param pos="0" name="hw.family" value="iMac"/>
1263
1279
  <param pos="0" name="hw.product" value="iMac (Retina 4K, 21.5-inch, 2019)"/>
1264
1280
  <param pos="0" name="hw.device" value="Desktop"/>
1281
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1265
1282
  </fingerprint>
1266
1283
 
1267
1284
  <fingerprint pattern="^model=iMacPro1,1$">
@@ -1288,6 +1305,7 @@
1288
1305
  <param pos="0" name="hw.family" value="iMac"/>
1289
1306
  <param pos="0" name="hw.product" value="iMac (Retina 5K, 27-inch, 2017)"/>
1290
1307
  <param pos="0" name="hw.device" value="Desktop"/>
1308
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1291
1309
  </fingerprint>
1292
1310
 
1293
1311
  <fingerprint pattern="^model=iMac18,2$">
@@ -1817,6 +1835,20 @@
1817
1835
 
1818
1836
  <!-- Apple TV -->
1819
1837
 
1838
+ <fingerprint pattern="^model=(?:J305AP|AppleTV11,1)$">
1839
+ <description>Apple TV 4K (2nd generation)</description>
1840
+ <example>model=J305AP</example>
1841
+ <example>model=AppleTV11,1</example>
1842
+ <param pos="0" name="os.vendor" value="Apple"/>
1843
+ <param pos="0" name="os.family" value="tvOS"/>
1844
+ <param pos="0" name="os.product" value="tvOS"/>
1845
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:tvos:-"/>
1846
+ <param pos="0" name="hw.vendor" value="Apple"/>
1847
+ <param pos="0" name="hw.family" value="Apple TV"/>
1848
+ <param pos="0" name="hw.product" value="Apple TV 4K (2nd generation)"/>
1849
+ <param pos="0" name="hw.device" value="Media Server"/>
1850
+ </fingerprint>
1851
+
1820
1852
  <fingerprint pattern="^model=(?:J105aAP|AppleTV6,2)$">
1821
1853
  <description>Apple TV 4K</description>
1822
1854
  <example>model=J105aAP</example>