recog 2.3.20 → 2.3.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (32) hide show
  1. checksums.yaml +4 -4
  2. data/cpe-remap.yaml +29 -1
  3. data/identifiers/fields.txt +1 -1
  4. data/identifiers/hw_product.txt +1 -0
  5. data/identifiers/os_product.txt +0 -1
  6. data/lib/recog/nizer.rb +1 -82
  7. data/lib/recog/version.rb +1 -1
  8. data/xml/apache_os.xml +1 -1
  9. data/xml/dns_versionbind.xml +10 -0
  10. data/xml/favicons.xml +1 -0
  11. data/xml/ftp_banners.xml +56 -44
  12. data/xml/html_title.xml +36 -12
  13. data/xml/http_cookies.xml +2 -3
  14. data/xml/http_servers.xml +28 -28
  15. data/xml/http_wwwauth.xml +3 -3
  16. data/xml/imap_banners.xml +5 -5
  17. data/xml/mdns_device-info_txt.xml +32 -0
  18. data/xml/mysql_banners.xml +2 -1
  19. data/xml/nntp_banners.xml +1 -1
  20. data/xml/ntp_banners.xml +1 -1
  21. data/xml/operating_system.xml +4 -4
  22. data/xml/pop_banners.xml +4 -4
  23. data/xml/sip_banners.xml +3 -3
  24. data/xml/sip_user_agents.xml +5 -0
  25. data/xml/smb_native_os.xml +3 -0
  26. data/xml/smtp_banners.xml +130 -127
  27. data/xml/snmp_sysdescr.xml +26 -26
  28. data/xml/ssh_banners.xml +12 -11
  29. data/xml/telnet_banners.xml +59 -44
  30. data/xml/x509_issuers.xml +32 -2
  31. data/xml/x509_subjects.xml +23 -13
  32. metadata +2 -2
data/xml/html_title.xml CHANGED
@@ -1,41 +1,62 @@
1
1
  <?xml version='1.0' encoding='UTF-8'?>
2
- <fingerprints matches="html_title" database_type="service" preference="0.90">
2
+ <fingerprints matches="html_title" protocol="http" database_type="service" preference="0.90">
3
3
  <!-- HTML Title elements found in HTTP response bodies are matched against these patterns to fingerprint HTTP servers. -->
4
4
 
5
5
  <fingerprint pattern="^301 Moved Permanently$">
6
6
  <description>301 Moved Permanently - generic -- assert nothing.</description>
7
7
  <example>301 Moved Permanently</example>
8
+ <param pos="0" name="hw.certainty" value="0.0"/>
9
+ <param pos="0" name="os.certainty" value="0.0"/>
10
+ <param pos="0" name="service.certainty" value="0.0"/>
8
11
  </fingerprint>
9
12
 
10
13
  <fingerprint pattern="^302 Found$">
11
14
  <description>302 Found - generic -- assert nothing.</description>
12
15
  <example>302 Found</example>
16
+ <param pos="0" name="hw.certainty" value="0.0"/>
17
+ <param pos="0" name="os.certainty" value="0.0"/>
18
+ <param pos="0" name="service.certainty" value="0.0"/>
13
19
  </fingerprint>
14
20
 
15
21
  <fingerprint pattern="^400 Bad Request$">
16
22
  <description>400 Bad Request - generic -- assert nothing.</description>
17
23
  <example>400 Bad Request</example>
24
+ <param pos="0" name="hw.certainty" value="0.0"/>
25
+ <param pos="0" name="os.certainty" value="0.0"/>
26
+ <param pos="0" name="service.certainty" value="0.0"/>
18
27
  </fingerprint>
19
28
 
20
29
  <fingerprint pattern="^401 Unauthorized$">
21
30
  <description>401 Unauthorized - generic -- assert nothing.</description>
22
31
  <example>401 Unauthorized</example>
32
+ <param pos="0" name="hw.certainty" value="0.0"/>
33
+ <param pos="0" name="os.certainty" value="0.0"/>
34
+ <param pos="0" name="service.certainty" value="0.0"/>
23
35
  </fingerprint>
24
36
 
25
37
  <fingerprint pattern="^403 Forbidden$">
26
38
  <description>403 Forbidden - generic -- assert nothing.</description>
27
39
  <example>403 Forbidden</example>
40
+ <param pos="0" name="hw.certainty" value="0.0"/>
41
+ <param pos="0" name="os.certainty" value="0.0"/>
42
+ <param pos="0" name="service.certainty" value="0.0"/>
28
43
  </fingerprint>
29
44
 
30
45
  <fingerprint pattern="^(?:404 )?Not Found$">
31
46
  <description>404 Not Found - generic -- assert nothing.</description>
32
47
  <example>404 Not Found</example>
33
48
  <example>Not Found</example>
49
+ <param pos="0" name="hw.certainty" value="0.0"/>
50
+ <param pos="0" name="os.certainty" value="0.0"/>
51
+ <param pos="0" name="service.certainty" value="0.0"/>
34
52
  </fingerprint>
35
53
 
36
54
  <fingerprint pattern="^Invalid URL$">
37
55
  <description>Invalid URL - generic -- assert nothing.</description>
38
56
  <example>Invalid URL</example>
57
+ <param pos="0" name="hw.certainty" value="0.0"/>
58
+ <param pos="0" name="os.certainty" value="0.0"/>
59
+ <param pos="0" name="service.certainty" value="0.0"/>
39
60
  </fingerprint>
40
61
 
41
62
  <fingerprint pattern="^ERROR: The request could not be satisfied$">
@@ -353,7 +374,7 @@
353
374
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
354
375
  </fingerprint>
355
376
 
356
- <fingerprint pattern="^(?i)Default (?:Parallels )?Plesk (?:Panel )?Page$">
377
+ <fingerprint pattern="(?i)^Default (?:Parallels )?Plesk (?:Panel )?Page$">
357
378
  <description>Plesk web hosting platform with no version</description>
358
379
  <example>Default Parallels Plesk Panel Page</example>
359
380
  <example>Default Parallels Plesk Page</example>
@@ -378,7 +399,7 @@
378
399
  <param pos="0" name="hw.device" value="DVR"/>
379
400
  </fingerprint>
380
401
 
381
- <fingerprint pattern="^(?i)(?:Dell )?Sonicwall - Authentication$">
402
+ <fingerprint pattern="(?i)^(?:Dell )?Sonicwall - Authentication$">
382
403
  <description>Sonicwall firewalls</description>
383
404
  <example>SonicWall - Authentication</example>
384
405
  <param pos="0" name="os.vendor" value="SonicWall"/>
@@ -412,7 +433,7 @@
412
433
  <param pos="0" name="os.cpe23" value="cpe:/o:watchguard:fireware:-"/>
413
434
  </fingerprint>
414
435
 
415
- <fingerprint pattern="^(.*).nbsp;-.nbsp;Synology.nbsp;DiskStation$">
436
+ <fingerprint pattern="^(.{0,512}).nbsp;-.nbsp;Synology.nbsp;DiskStation$">
416
437
  <description>Synology DiskStation</description>
417
438
  <example host.name="DiskStation">DiskStation&amp;nbsp;-&amp;nbsp;Synology&amp;nbsp;DiskStation</example>
418
439
  <example host.name="DS218">DS218&amp;nbsp;-&amp;nbsp;Synology&amp;nbsp;DiskStation</example>
@@ -699,7 +720,7 @@
699
720
  <param pos="0" name="hw.product" value="Prosafe Plus"/>
700
721
  </fingerprint>
701
722
 
702
- <fingerprint pattern="^(.*).nbsp;Configuration and Management$">
723
+ <fingerprint pattern="^(.{0,256}).nbsp;Configuration and Management$">
703
724
  <description>Digi Terminal Servers</description>
704
725
  <example hw.product="Digi One SP">Digi One SP&amp;nbsp;Configuration and Management</example>
705
726
  <example hw.product="PortServer TS 4">PortServer TS 4&amp;nbsp;Configuration and Management</example>
@@ -820,7 +841,7 @@
820
841
  <param pos="0" name="hw.product" value="Rack PDU Card"/>
821
842
  </fingerprint>
822
843
 
823
- <fingerprint pattern="^(.*) IntelliSlot Web(?:/\d+)? Card?$">
844
+ <fingerprint pattern="^(.{0,256}) IntelliSlot Web(?:/\d+)? Card?$">
824
845
  <description>Emerson Network Power IntelliSlot Web Card and rebrands</description>
825
846
  <example hw.vendor="Emerson Network Power">Emerson Network Power IntelliSlot Web Card</example>
826
847
  <example hw.vendor="Emerson Network Power">Emerson Network Power IntelliSlot Web/485 Card</example>
@@ -1038,7 +1059,7 @@
1038
1059
  <param pos="0" name="hw.product" value="OpenManage Switch"/>
1039
1060
  </fingerprint>
1040
1061
 
1041
- <fingerprint pattern="^(\S+)\s+-\s+ProCurve Switch (\S+) \((.*)\)$">
1062
+ <fingerprint pattern="^(\S{1,512})\s{1,8}-\s{1,8}ProCurve Switch (\S+) \((.*)\)$">
1042
1063
  <description>HPE ProCurve Switch w/Hostname</description>
1043
1064
  <example host.name="SW1" hw.product="4204vl" procurve.model="J8770A">SW1 - ProCurve Switch 4204vl (J8770A)</example>
1044
1065
  <param pos="0" name="hw.vendor" value="HPE"/>
@@ -1134,20 +1155,22 @@
1134
1155
 
1135
1156
  <fingerprint pattern="^Agilent 33220A \((.*)\)$">
1136
1157
  <description>Agilent 33220A</description>
1137
- <example agilent.serial="MY44041111">Agilent 33220A (MY44041111)</example>
1158
+ <example agilent.serial="MY44041111" hw.serial_number="MY44041111">Agilent 33220A (MY44041111)</example>
1138
1159
  <param pos="0" name="hw.vendor" value="Agilent"/>
1139
1160
  <param pos="0" name="hw.device" value="Test Instrument"/>
1140
1161
  <param pos="0" name="hw.product" value="33220A Waveform Generator"/>
1141
1162
  <param pos="1" name="agilent.serial"/>
1163
+ <param pos="1" name="hw.serial_number"/>
1142
1164
  </fingerprint>
1143
1165
 
1144
1166
  <fingerprint pattern="^Agilent N5172B (?:EXG )?(MY\S+)$">
1145
1167
  <description>Agilent N5172B</description>
1146
- <example agilent.serial="MY44041111">Agilent N5172B EXG MY44041111</example>
1168
+ <example agilent.serial="MY44041111" hw.serial_number="MY44041111">Agilent N5172B EXG MY44041111</example>
1147
1169
  <param pos="0" name="hw.vendor" value="Agilent"/>
1148
1170
  <param pos="0" name="hw.device" value="Test Instrument"/>
1149
1171
  <param pos="0" name="hw.product" value="N5172B Signal Generator"/>
1150
1172
  <param pos="1" name="agilent.serial"/>
1173
+ <param pos="1" name="hw.serial_number"/>
1151
1174
  </fingerprint>
1152
1175
 
1153
1176
  <fingerprint pattern="^Polycom - Configuration Utility$">
@@ -1397,6 +1420,7 @@
1397
1420
  <param pos="0" name="hw.vendor" value="KACE"/>
1398
1421
  <param pos="0" name="hw.device" value="Support Appliance"/>
1399
1422
  <param pos="0" name="hw.product" value="K1000"/>
1423
+ <param pos="0" name="hw.cpe23" value="cpe:/h:dell:kace_k1000_systems_management_appliance:-"/>
1400
1424
  <param pos="0" name="os.vendor" value="KACE"/>
1401
1425
  <param pos="0" name="os.family" value="FreeBSD"/>
1402
1426
  </fingerprint>
@@ -1678,7 +1702,7 @@
1678
1702
  <param pos="0" name="service.cpe23" value="cpe:/a:realvnc:realvnc:-"/>
1679
1703
  </fingerprint>
1680
1704
 
1681
- <fingerprint pattern="^.* \[Jenkins\]$">
1705
+ <fingerprint pattern="^.{0,1024} \[Jenkins\]$">
1682
1706
  <description>Jenkins Customized Dashboard</description>
1683
1707
  <example>Continuous Integrations [Jenkins]</example>
1684
1708
  <example>Dashboard [Jenkins]</example>
@@ -2341,7 +2365,7 @@
2341
2365
  <param pos="0" name="service.product" value="SonarQube"/>
2342
2366
  </fingerprint>
2343
2367
 
2344
- <fingerprint pattern="^(\S+) - Opengear Management Console$">
2368
+ <fingerprint pattern="^(\S{1,512}) - Opengear Management Console$">
2345
2369
  <description>Opengear Management Console</description>
2346
2370
  <example host.name="server01">server01 - Opengear Management Console</example>
2347
2371
  <param pos="0" name="service.vendor" value="Opengear"/>
@@ -2607,7 +2631,7 @@
2607
2631
  <param pos="0" name="service.cpe23" value="cpe:/a:zabbix:zabbix:-"/>
2608
2632
  </fingerprint>
2609
2633
 
2610
- <fingerprint pattern="^(\S+) \(build (\S+)\) - Info$">
2634
+ <fingerprint pattern="^(\S{1,512}) \(build (\S+)\) - Info$">
2611
2635
  <description>DD-WRT</description>
2612
2636
  <example host.name="SubTerraVia-NUC" os.version="36104" os.build="36104">SubTerraVia-NUC (build 36104) - Info</example>
2613
2637
  <example host.name="DD-WRT" os.version="35030M" os.build="35030M">DD-WRT (build 35030M) - Info</example>
data/xml/http_cookies.xml CHANGED
@@ -163,14 +163,13 @@
163
163
  The cookie value breaks down to [box-id][service-id][timeout-value]
164
164
  unfortunately, there's no separator so it's hard to tell what the
165
165
  actual break is between the pieces of data.
166
- http://www.cisco.com/warp/public/117/AP_cookies.html
167
166
  -->
168
167
 
169
168
  <fingerprint pattern="^ARPT=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+.*">
170
169
  <description>Cisco 11000 Series Content Service Switch (CSS)</description>
171
- <example host.id="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
170
+ <example host.name="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
172
171
  <param pos="0" name="cookie" value="ARPT"/>
173
- <param pos="1" name="host.id"/>
172
+ <param pos="1" name="host.name"/>
174
173
  <param pos="2" name="host.ip"/>
175
174
  <param pos="0" name="service.vendor" value="Cisco"/>
176
175
  <param pos="0" name="service.family" value="Content Service Switch"/>
data/xml/http_servers.xml CHANGED
@@ -840,7 +840,7 @@
840
840
  </fingerprint>
841
841
 
842
842
  <fingerprint pattern="^UOS$">
843
- <description>HTTP Server that appears unique to Managment Console on HP TippingPoint IPS Devices</description>
843
+ <description>HTTP Server that appears unique to Management Console on HP TippingPoint IPS Devices</description>
844
844
  <example>UOS</example>
845
845
  <param pos="0" name="service.vendor" value="HP"/>
846
846
  <param pos="0" name="service.product" value="HTTP"/>
@@ -878,10 +878,10 @@
878
878
  <param pos="0" name="service.cpe23" value="cpe:/a:acme:mini_httpd:-"/>
879
879
  </fingerprint>
880
880
 
881
- <fingerprint pattern="^LiteSpeed\/?(:?[\d.]+)?(?: \S+)?">
881
+ <fingerprint pattern="^LiteSpeed\/?([\d.]+)?(?: \S+)?">
882
882
  <description>LiteSpeed</description>
883
883
  <example>LiteSpeed</example>
884
- <example>LiteSpeed/5.2.8 Enterprise</example>
884
+ <example service.version="5.2.8">LiteSpeed/5.2.8 Enterprise</example>
885
885
  <param pos="0" name="service.vendor" value="LiteSpeed Technologies"/>
886
886
  <param pos="0" name="service.product" value="LiteSpeed Web Server"/>
887
887
  <param pos="1" name="service.version"/>
@@ -897,7 +897,7 @@
897
897
  <param pos="1" name="service.version"/>
898
898
  </fingerprint>
899
899
 
900
- <fingerprint pattern="^openresty\/?(:?[\d.]+)?$">
900
+ <fingerprint pattern="^openresty\/?([\d.]+)?$">
901
901
  <description>OpenResty OpenResty</description>
902
902
  <example>openresty</example>
903
903
  <example service.version="1.13.6.2">openresty/1.13.6.2</example>
@@ -945,7 +945,7 @@
945
945
  <param pos="0" name="service.cpe23" value="cpe:/a:wftpserver:wing_ftp_server:-"/>
946
946
  </fingerprint>
947
947
 
948
- <fingerprint pattern="^(?i)Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \((BR\d+)\)$">
948
+ <fingerprint pattern="(?i)^Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \((BR\d+)\)$">
949
949
  <description>Sonos Bridge/ZoneBridge</description>
950
950
  <example hw.model="BR100" hw.version="47.2-59120">Linux UPnP/1.0 Sonos/47.2-59120 (BR100)</example>
951
951
  <param pos="0" name="hw.vendor" value="Sonos"/>
@@ -956,7 +956,7 @@
956
956
  <param pos="0" name="os.product" value="Linux"/>
957
957
  </fingerprint>
958
958
 
959
- <fingerprint pattern="^(?i)Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \(ANVIL\)$">
959
+ <fingerprint pattern="(?i)^Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \(ANVIL\)$">
960
960
  <description>Sonos Subwoofer Speaker</description>
961
961
  <example>Linux UPnP/1.0 Sonos/31.3-22220 (ANVIL)</example>
962
962
  <param pos="0" name="hw.vendor" value="Sonos"/>
@@ -1000,7 +1000,7 @@
1000
1000
  <param pos="0" name="service.cpe23" value="cpe:/a:varnish-cache:varnish:-"/>
1001
1001
  </fingerprint>
1002
1002
 
1003
- <fingerprint pattern="^Tengine\/?(:?[\d.]+)?$">
1003
+ <fingerprint pattern="^Tengine\/?([\d.]+)?$">
1004
1004
  <description>Tengine</description>
1005
1005
  <example>Tengine</example>
1006
1006
  <example service.version="2.0.0">Tengine/2.0.0</example>
@@ -1423,7 +1423,7 @@
1423
1423
  <param pos="0" name="service.cpe23" value="cpe:/a:eclipse:jetty:{service.version}"/>
1424
1424
  </fingerprint>
1425
1425
 
1426
- <fingerprint pattern="^(?i)squid/(\d+\.[\w.\-\+]+)$">
1426
+ <fingerprint pattern="(?i)^squid/(\d+\.[\w.\-\+]+)$">
1427
1427
  <description>Squid Web Proxy with a version</description>
1428
1428
  <example service.version="2.3.STABLE1">Squid/2.3.STABLE1</example>
1429
1429
  <example service.version="4.4">squid/4.4</example>
@@ -1435,7 +1435,7 @@
1435
1435
  <param pos="0" name="service.cpe23" value="cpe:/a:squid-cache:squid:{service.version}"/>
1436
1436
  </fingerprint>
1437
1437
 
1438
- <fingerprint pattern="^(?i)squid$">
1438
+ <fingerprint pattern="(?i)^squid$">
1439
1439
  <description>Squid Web Proxy without a version</description>
1440
1440
  <example>Squid</example>
1441
1441
  <example>squid</example>
@@ -1492,7 +1492,7 @@
1492
1492
  <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
1493
1493
  </fingerprint>
1494
1494
 
1495
- <fingerprint pattern="^nginx\/?(:?[\d.]+)?">
1495
+ <fingerprint pattern="^nginx\/?([\d.]+)?">
1496
1496
  <description>nginx with version info and/or mods</description>
1497
1497
  <example service.version="0.8.53">nginx/0.8.53 + Phusion Passenger 3.0.0 (mod_rails/mod_rack)</example>
1498
1498
  <example>nginx/0.8.53</example>
@@ -1993,11 +1993,11 @@
1993
1993
  this information useful and mappable to CPE
1994
1994
  -->
1995
1995
 
1996
- <fingerprint pattern="^HP HTTP Server; (?:Hewlett-Packard )?HP ((\S+) \S+)">
1996
+ <fingerprint pattern="^HP HTTP Server; (?:Hewlett-Packard )?HP ((\S+) \S+)[^;]+; Serial Number: ([^;]+);">
1997
1997
  <description>HP Printer</description>
1998
- <example os.product="Photosmart C309a" os.family="Photosmart">HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
1999
- <example os.product="Officejet 6500" os.family="Officejet">HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2000
- <example os.product="Designjet T520" os.family="Designjet">HP HTTP Server; Hewlett-Packard HP Designjet T520 36in - ABC123; Serial Number: 0123456789; Built:Tue Sep 09, 2014 08:32:54AM {012345678901}</example>
1998
+ <example os.product="Photosmart C309a" os.family="Photosmart" hw.serial_number="abc123">HP HTTP Server; HP Photosmart C309a series - CC335A; Serial Number: abc123; Vader Built:Wed Apr 15, 2009 11:40:58AM {abc123, ASIC id 0x00280004}</example>
1999
+ <example os.product="Officejet 6500" os.family="Officejet" hw.serial_number="abc123">HP HTTP Server; HP Officejet 6500 E709n - CB057A; Serial Number: abc123; Rainbow Built:Sat Dec 13, 2008 10:58:21AM {abc123, ASIC id 0x00ffc2105}</example>
2000
+ <example os.product="Designjet T520" os.family="Designjet" hw.serial_number="0123456789">HP HTTP Server; Hewlett-Packard HP Designjet T520 36in - ABC123; Serial Number: 0123456789; Built:Tue Sep 09, 2014 08:32:54AM {012345678901}</example>
2001
2001
  <param pos="0" name="service.vendor" value="HP"/>
2002
2002
  <param pos="0" name="service.product" value="JetDirect"/>
2003
2003
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -2009,6 +2009,7 @@
2009
2009
  <param pos="0" name="hw.family" value="JetDirect"/>
2010
2010
  <param pos="0" name="hw.product" value="JetDirect"/>
2011
2011
  <param pos="0" name="hw.device" value="Printer"/>
2012
+ <param pos="3" name="hw.serial_number"/>
2012
2013
  </fingerprint>
2013
2014
 
2014
2015
  <fingerprint pattern="^HTTP/1\.0$">
@@ -2650,7 +2651,7 @@
2650
2651
  <param pos="1" name="service.version"/>
2651
2652
  </fingerprint>
2652
2653
 
2653
- <fingerprint pattern="^Embedthis-(?:Appweb|http)\/?(:?[\d.]+)?$">
2654
+ <fingerprint pattern="^Embedthis-(?:Appweb|http)\/?([\d.]+)?$">
2654
2655
  <description>Embedthis AppWeb</description>
2655
2656
  <example service.version="3.2.3">Embedthis-Appweb/3.2.3</example>
2656
2657
  <example>Embedthis-http</example>
@@ -2964,29 +2965,28 @@
2964
2965
  <param pos="0" name="service.product" value="2wire"/>
2965
2966
  </fingerprint>
2966
2967
 
2967
- <!-- junit says,
2968
- "Example pattern '' from http_servers.xml didn't match pattern '^$'"
2969
- Figure out if we have a way to support matching empty strings later.
2970
- <fingerprint pattern="^?">
2971
- <example></example>
2972
- <description>A blank banner; assert nothing.</description>
2973
- </fingerprint>
2974
-
2975
- -->
2976
-
2977
2968
  <fingerprint pattern="^(?:(?:\d{1,3}\.){3}\d{1,3}):\d{1,4}$">
2978
2969
  <description>A banner consisting of an IPv4 address and port -- assert nothing.</description>
2979
2970
  <example>192.168.0.4:9999</example>
2971
+ <param pos="0" name="hw.certainty" value="0.0"/>
2972
+ <param pos="0" name="os.certainty" value="0.0"/>
2973
+ <param pos="0" name="service.certainty" value="0.0"/>
2980
2974
  </fingerprint>
2981
2975
 
2982
2976
  <fingerprint pattern="^Web-Server/(?:\d+\.+\d+)$">
2983
2977
  <description>Obfuscated web server -- assert nothing.</description>
2984
2978
  <example>Web-Server/3.0</example>
2979
+ <param pos="0" name="hw.certainty" value="0.0"/>
2980
+ <param pos="0" name="os.certainty" value="0.0"/>
2981
+ <param pos="0" name="service.certainty" value="0.0"/>
2985
2982
  </fingerprint>
2986
2983
 
2987
2984
  <fingerprint pattern="^httpd$">
2988
2985
  <description>httpd - generic -- assert nothing.</description>
2989
2986
  <example>httpd</example>
2987
+ <param pos="0" name="hw.certainty" value="0.0"/>
2988
+ <param pos="0" name="os.certainty" value="0.0"/>
2989
+ <param pos="0" name="service.certainty" value="0.0"/>
2990
2990
  </fingerprint>
2991
2991
 
2992
2992
  <!-- Service provider equipment (CDNs, etc) -->
@@ -3283,7 +3283,7 @@
3283
3283
  <param pos="0" name="service.product" value="Node"/>
3284
3284
  </fingerprint>
3285
3285
 
3286
- <fingerprint pattern="(?i)^(.*) UPnP/[\d\.]+\s+AVM FRITZ!(.*) ([\d\.]+)$">
3286
+ <fingerprint pattern="(?i)^(.{0,256}) UPnP/[\d\.]+\s+AVM FRITZ!(.*) ([\d\.]+)$">
3287
3287
  <description>AVM FRITZ! devices of various types</description>
3288
3288
  <example host.name="some thing" os.product="WLAN Repeater 1750E" os.version="134.07.01">some thing UPnP/1.0 AVM FRITZ!WLAN Repeater 1750E 134.07.01</example>
3289
3289
  <param pos="0" name="os.vendor" value="AVM"/>
@@ -3680,7 +3680,7 @@
3680
3680
  <param pos="0" name="service.cpe23" value="cpe:/a:miniupnp_project:miniupnpd:{service.version}"/>
3681
3681
  </fingerprint>
3682
3682
 
3683
- <fingerprint pattern="^(\S+) \d+/Service Pack \d+, UPnP/[\d\.]+, TVersity Media Server$">
3683
+ <fingerprint pattern="^(\S{1,16}) \d+/Service Pack \d+, UPnP/[\d\.]+, TVersity Media Server$">
3684
3684
  <description>TVersity Media Server UPnP Server with Service Pack</description>
3685
3685
  <example>5.2.3790 2/Service Pack 1, UPnP/1.0, TVersity Media Server</example>
3686
3686
  <example>5.1.2600 2/Service Pack 3, UPnP/1.0, TVersity Media Server</example>
@@ -3689,7 +3689,7 @@
3689
3689
  <param pos="1" name="service.version"/>
3690
3690
  </fingerprint>
3691
3691
 
3692
- <fingerprint pattern="^(\S+) 2/, UPnP/\S+, TVersity Media Server$">
3692
+ <fingerprint pattern="^(\S{1,16}) 2/, UPnP/\S+, TVersity Media Server$">
3693
3693
  <description>TVersity Media Server UPnP Server</description>
3694
3694
  <example>6.2.8400 2/, UPnP/1.0, TVersity Media Server</example>
3695
3695
  <example>6.2.9200 2/, UPnP/1.0, TVersity Media Server</example>
data/xml/http_wwwauth.xml CHANGED
@@ -419,7 +419,7 @@
419
419
  <param pos="0" name="service.product" value="SWAT"/>
420
420
  </fingerprint>
421
421
 
422
- <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
422
+ <fingerprint pattern="^.{0,1024}(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
423
423
  <description>SPIP publishing system (www.spip.net)</description>
424
424
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
425
425
  <param pos="0" name="service.vendor" value="SPIP"/>
@@ -427,7 +427,7 @@
427
427
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
428
428
  </fingerprint>
429
429
 
430
- <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
430
+ <fingerprint pattern="^.{0,1024}(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
431
431
  <description>HP Instant Support Enterprise Edition with a hostname</description>
432
432
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
433
433
  <param pos="0" name="service.vendor" value="HP"/>
@@ -435,7 +435,7 @@
435
435
  <param pos="1" name="host.name"/>
436
436
  </fingerprint>
437
437
 
438
- <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
438
+ <fingerprint pattern="^.{0,1024}(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
439
439
  <description>Generic F5 Big-IP</description>
440
440
  <example>Basic realm="BIG-IP"</example>
441
441
  <param pos="0" name="service.vendor" value="F5"/>
data/xml/imap_banners.xml CHANGED
@@ -166,7 +166,7 @@
166
166
  <param pos="0" name="service.product" value="Courier IMAP"/>
167
167
  </fingerprint>
168
168
 
169
- <fingerprint pattern="^(\S+) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
169
+ <fingerprint pattern="^(\S{1,512}) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
170
170
  <description>Nortel CallPilot</description>
171
171
  <example>nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
172
172
  <example>test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
@@ -177,7 +177,7 @@
177
177
  <param pos="1" name="host.name"/>
178
178
  </fingerprint>
179
179
 
180
- <fingerprint pattern="^(\S+) Zimbra IMAP4rev1 server ready\.?$">
180
+ <fingerprint pattern="^(\S{1,512}) Zimbra IMAP4rev1 server ready\.?$">
181
181
  <description>VMware Zimbra IMAP</description>
182
182
  <example host.name="foo.bar">foo.bar Zimbra IMAP4rev1 server ready</example>
183
183
  <param pos="0" name="service.vendor" value="VMware"/>
@@ -186,7 +186,7 @@
186
186
  <param pos="1" name="host.name"/>
187
187
  </fingerprint>
188
188
 
189
- <fingerprint pattern="^(\S+) Zimbra (\S+) IMAP4rev1 server ready\.?$">
189
+ <fingerprint pattern="^(\S{1,512}) Zimbra (\S+) IMAP4rev1 server ready\.?$">
190
190
  <description>VMware Zimbra IMAP with service version</description>
191
191
  <example host.name="foo.bar" service.version="7.0.0_GA_3079">foo.bar Zimbra 7.0.0_GA_3079 IMAP4rev1 server ready</example>
192
192
  <param pos="0" name="service.vendor" value="VMware"/>
@@ -196,7 +196,7 @@
196
196
  <param pos="1" name="host.name"/>
197
197
  </fingerprint>
198
198
 
199
- <fingerprint pattern="^(.+) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
199
+ <fingerprint pattern="^(\S{1,512}) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
200
200
  <description>CMU Cyrus IMAP on Mac OS X</description>
201
201
  <example host.name="example.com" service.version="2.2.12" os.version="10.4.0">example.com Cyrus IMAP4 v2.2.12-OS X 10.4.0 server ready</example>
202
202
  <example host.name="example.com" service.version="2.3.8" os.version="10.5">example.com Cyrus IMAP4 v2.3.8-OS X Server 10.5: 9A562 server ready</example>
@@ -213,7 +213,7 @@
213
213
  <param pos="1" name="host.name"/>
214
214
  </fingerprint>
215
215
 
216
- <fingerprint pattern="^(.+) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
216
+ <fingerprint pattern="^(\S{1,512}) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
217
217
  <description>CMU Cyrus IMAP</description>
218
218
  <example host.name="example.com" service.version="2.3.7">example.com Cyrus IMAP4 v2.3.7 server ready</example>
219
219
  <example host.name="example.com" service.version="2.4.8-Invoca-RPM-2.4.8-1">example.com Cyrus IMAP Murder v2.4.8-Invoca-RPM-2.4.8-1 server ready</example>
data/xml/mdns_device-info_txt.xml CHANGED
@@ -259,6 +259,7 @@
259
259
  <param pos="0" name="hw.family" value="MacBook Pro"/>
260
260
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, M1, 2020)"/>
261
261
  <param pos="0" name="hw.device" value="Laptop"/>
262
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
262
263
  </fingerprint>
263
264
 
264
265
  <fingerprint pattern="^model=MacBookPro16,1$">
@@ -272,6 +273,7 @@
272
273
  <param pos="0" name="hw.family" value="MacBook Pro"/>
273
274
  <param pos="0" name="hw.product" value="MacBook Pro (16-inch, 2019)"/>
274
275
  <param pos="0" name="hw.device" value="Laptop"/>
276
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
275
277
  </fingerprint>
276
278
 
277
279
  <fingerprint pattern="^model=MacBookPro16,[23]$">
@@ -286,6 +288,7 @@
286
288
  <param pos="0" name="hw.family" value="MacBook Pro"/>
287
289
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, 2020)"/>
288
290
  <param pos="0" name="hw.device" value="Laptop"/>
291
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
289
292
  </fingerprint>
290
293
 
291
294
  <fingerprint pattern="^model=MacBookPro15,4$">
@@ -299,6 +302,7 @@
299
302
  <param pos="0" name="hw.family" value="MacBook Pro"/>
300
303
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, 2019, Two Thunderbolt 3 ports)"/>
301
304
  <param pos="0" name="hw.device" value="Laptop"/>
305
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
302
306
  </fingerprint>
303
307
 
304
308
  <fingerprint pattern="^model=MacBookPro15,3$">
@@ -312,6 +316,7 @@
312
316
  <param pos="0" name="hw.family" value="MacBook Pro"/>
313
317
  <param pos="0" name="hw.product" value="MacBook Pro (15-inch, 2019)"/>
314
318
  <param pos="0" name="hw.device" value="Laptop"/>
319
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
315
320
  </fingerprint>
316
321
 
317
322
  <fingerprint pattern="^model=MacBookPro15,2$">
@@ -325,6 +330,7 @@
325
330
  <param pos="0" name="hw.family" value="MacBook Pro"/>
326
331
  <param pos="0" name="hw.product" value="MacBook Pro (13-inch, 2018, Four Thunderbolt 3 ports)"/>
327
332
  <param pos="0" name="hw.device" value="Laptop"/>
333
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
328
334
  </fingerprint>
329
335
 
330
336
  <fingerprint pattern="^model=MacBookPro15,1$">
@@ -338,6 +344,7 @@
338
344
  <param pos="0" name="hw.family" value="MacBook Pro"/>
339
345
  <param pos="0" name="hw.product" value="MacBook Pro (15-inch, 2018)"/>
340
346
  <param pos="0" name="hw.device" value="Laptop"/>
347
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
341
348
  </fingerprint>
342
349
 
343
350
  <fingerprint pattern="^model=MacBookPro14,3$">
@@ -429,6 +436,7 @@
429
436
  <param pos="0" name="hw.family" value="MacBook Pro"/>
430
437
  <param pos="0" name="hw.product" value="MacBook Pro (Retina, 13-inch, Early 2015)"/>
431
438
  <param pos="0" name="hw.device" value="Laptop"/>
439
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
432
440
  </fingerprint>
433
441
 
434
442
  <fingerprint pattern="^model=MacBookPro11,[45]$">
@@ -443,6 +451,7 @@
443
451
  <param pos="0" name="hw.family" value="MacBook Pro"/>
444
452
  <param pos="0" name="hw.product" value="MacBook Pro (Retina, 15-inch, Mid 2015)"/>
445
453
  <param pos="0" name="hw.device" value="Laptop"/>
454
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_pro:-"/>
446
455
  </fingerprint>
447
456
 
448
457
  <fingerprint pattern="^model=MacBookPro11,3$">
@@ -746,6 +755,7 @@
746
755
  <param pos="0" name="hw.family" value="MacBook"/>
747
756
  <param pos="0" name="hw.product" value="MacBook Air (M1, 2020)"/>
748
757
  <param pos="0" name="hw.device" value="Laptop"/>
758
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
749
759
  </fingerprint>
750
760
 
751
761
  <fingerprint pattern="^model=MacBookAir9,1$">
@@ -759,6 +769,7 @@
759
769
  <param pos="0" name="hw.family" value="MacBook"/>
760
770
  <param pos="0" name="hw.product" value="MacBook Air (Retina, 13-inch, 2020)"/>
761
771
  <param pos="0" name="hw.device" value="Laptop"/>
772
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
762
773
  </fingerprint>
763
774
 
764
775
  <fingerprint pattern="^model=MacBookAir8,2$">
@@ -772,6 +783,7 @@
772
783
  <param pos="0" name="hw.family" value="MacBook"/>
773
784
  <param pos="0" name="hw.product" value="MacBook Air (Retina, 13-inch, 2019)"/>
774
785
  <param pos="0" name="hw.device" value="Laptop"/>
786
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
775
787
  </fingerprint>
776
788
 
777
789
  <fingerprint pattern="^model=MacBookAir8,1$">
@@ -785,6 +797,7 @@
785
797
  <param pos="0" name="hw.family" value="MacBook"/>
786
798
  <param pos="0" name="hw.product" value="MacBook Air (Retina, 13-inch, 2018)"/>
787
799
  <param pos="0" name="hw.device" value="Laptop"/>
800
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
788
801
  </fingerprint>
789
802
 
790
803
  <fingerprint pattern="^model=MacBookAir7,2$">
@@ -798,6 +811,7 @@
798
811
  <param pos="0" name="hw.family" value="MacBook"/>
799
812
  <param pos="0" name="hw.product" value="MacBook Air (13-inch, 2017)"/>
800
813
  <param pos="0" name="hw.device" value="Laptop"/>
814
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:macbook_air:-"/>
801
815
  </fingerprint>
802
816
 
803
817
  <fingerprint pattern="^model=MacBookAir7,1$">
@@ -1236,6 +1250,7 @@
1236
1250
  <param pos="0" name="hw.family" value="iMac"/>
1237
1251
  <param pos="0" name="hw.product" value="iMac (Retina 5K, 27-inch, 2020)"/>
1238
1252
  <param pos="0" name="hw.device" value="Desktop"/>
1253
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1239
1254
  </fingerprint>
1240
1255
 
1241
1256
  <fingerprint pattern="^model=iMac19,1$">
@@ -1249,6 +1264,7 @@
1249
1264
  <param pos="0" name="hw.family" value="iMac"/>
1250
1265
  <param pos="0" name="hw.product" value="iMac (Retina 5K, 27-inch, 2019)"/>
1251
1266
  <param pos="0" name="hw.device" value="Desktop"/>
1267
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1252
1268
  </fingerprint>
1253
1269
 
1254
1270
  <fingerprint pattern="^model=iMac19,2$">
@@ -1262,6 +1278,7 @@
1262
1278
  <param pos="0" name="hw.family" value="iMac"/>
1263
1279
  <param pos="0" name="hw.product" value="iMac (Retina 4K, 21.5-inch, 2019)"/>
1264
1280
  <param pos="0" name="hw.device" value="Desktop"/>
1281
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1265
1282
  </fingerprint>
1266
1283
 
1267
1284
  <fingerprint pattern="^model=iMacPro1,1$">
@@ -1288,6 +1305,7 @@
1288
1305
  <param pos="0" name="hw.family" value="iMac"/>
1289
1306
  <param pos="0" name="hw.product" value="iMac (Retina 5K, 27-inch, 2017)"/>
1290
1307
  <param pos="0" name="hw.device" value="Desktop"/>
1308
+ <param pos="0" name="hw.cpe23" value="cpe:/h:apple:imac:-"/>
1291
1309
  </fingerprint>
1292
1310
 
1293
1311
  <fingerprint pattern="^model=iMac18,2$">
@@ -1817,6 +1835,20 @@
1817
1835
 
1818
1836
  <!-- Apple TV -->
1819
1837
 
1838
+ <fingerprint pattern="^model=(?:J305AP|AppleTV11,1)$">
1839
+ <description>Apple TV 4K (2nd generation)</description>
1840
+ <example>model=J305AP</example>
1841
+ <example>model=AppleTV11,1</example>
1842
+ <param pos="0" name="os.vendor" value="Apple"/>
1843
+ <param pos="0" name="os.family" value="tvOS"/>
1844
+ <param pos="0" name="os.product" value="tvOS"/>
1845
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:tvos:-"/>
1846
+ <param pos="0" name="hw.vendor" value="Apple"/>
1847
+ <param pos="0" name="hw.family" value="Apple TV"/>
1848
+ <param pos="0" name="hw.product" value="Apple TV 4K (2nd generation)"/>
1849
+ <param pos="0" name="hw.device" value="Media Server"/>
1850
+ </fingerprint>
1851
+
1820
1852
  <fingerprint pattern="^model=(?:J105aAP|AppleTV6,2)$">
1821
1853
  <description>Apple TV 4K</description>
1822
1854
  <example>model=J105aAP</example>