recog 2.3.20 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/ci.yml +1 -1
  4. data/.github/workflows/verify.yml +89 -0
  5. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  6. data/.vscode/extensions.json +5 -0
  7. data/.vscode/settings.json +8 -0
  8. data/.vscode/tasks.json +77 -0
  9. data/CONTRIBUTING.md +8 -0
  10. data/README.md +17 -0
  11. data/bin/recog_standardize +28 -13
  12. data/bin/recog_verify +42 -8
  13. data/cpe-remap.yaml +62 -3
  14. data/features/data/schema_failure.xml +4 -0
  15. data/features/data/tests_with_failures.xml +6 -0
  16. data/features/support/hooks.rb +9 -0
  17. data/features/verify.feature +85 -21
  18. data/identifiers/fields.txt +6 -5
  19. data/identifiers/hw_device.txt +8 -0
  20. data/identifiers/hw_family.txt +8 -0
  21. data/identifiers/hw_product.txt +54 -0
  22. data/identifiers/os_device.txt +2 -0
  23. data/identifiers/os_family.txt +2 -0
  24. data/identifiers/os_product.txt +18 -2
  25. data/identifiers/service_product.txt +26 -0
  26. data/identifiers/vendor.txt +62 -1
  27. data/lib/recog/db.rb +2 -1
  28. data/lib/recog/fingerprint.rb +33 -6
  29. data/lib/recog/fingerprint_parse_error.rb +10 -0
  30. data/lib/recog/nizer.rb +1 -82
  31. data/lib/recog/verifier.rb +9 -9
  32. data/lib/recog/verify_reporter.rb +17 -6
  33. data/lib/recog/version.rb +1 -1
  34. data/requirements.txt +1 -1
  35. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  36. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  37. data/spec/data/external_example_fingerprint.xml +8 -0
  38. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  39. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  40. data/spec/lib/recog/db_spec.rb +84 -61
  41. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  42. data/spec/lib/recog/verify_reporter_spec.rb +73 -4
  43. data/tools/dev/hooks/pre-commit +21 -0
  44. data/update_cpes.py +130 -37
  45. data/xml/apache_os.xml +98 -56
  46. data/xml/architecture.xml +15 -1
  47. data/xml/dhcp_vendor_class.xml +206 -0
  48. data/xml/dns_versionbind.xml +26 -13
  49. data/xml/favicons.xml +236 -47
  50. data/xml/fingerprints.xsd +9 -1
  51. data/xml/ftp_banners.xml +213 -197
  52. data/xml/h323_callresp.xml +101 -101
  53. data/xml/hp_pjl_id.xml +84 -84
  54. data/xml/html_title.xml +715 -45
  55. data/xml/http_cookies.xml +143 -80
  56. data/xml/http_servers.xml +510 -310
  57. data/xml/http_wwwauth.xml +177 -75
  58. data/xml/imap_banners.xml +10 -10
  59. data/xml/mdns_device-info_txt.xml +421 -26
  60. data/xml/mysql_banners.xml +3 -2
  61. data/xml/nntp_banners.xml +12 -9
  62. data/xml/ntp_banners.xml +97 -97
  63. data/xml/operating_system.xml +98 -83
  64. data/xml/pop_banners.xml +27 -27
  65. data/xml/rsh_resp.xml +3 -3
  66. data/xml/sip_banners.xml +46 -8
  67. data/xml/sip_user_agents.xml +180 -27
  68. data/xml/smb_native_lm.xml +5 -5
  69. data/xml/smb_native_os.xml +28 -25
  70. data/xml/smtp_banners.xml +258 -254
  71. data/xml/smtp_ehlo.xml +1 -1
  72. data/xml/smtp_help.xml +11 -11
  73. data/xml/smtp_noop.xml +2 -2
  74. data/xml/snmp_sysdescr.xml +1554 -1429
  75. data/xml/snmp_sysobjid.xml +27 -27
  76. data/xml/ssh_banners.xml +27 -20
  77. data/xml/telnet_banners.xml +256 -57
  78. data/xml/tls_jarm.xml +48 -6
  79. data/xml/x11_banners.xml +3 -3
  80. data/xml/x509_issuers.xml +69 -2
  81. data/xml/x509_subjects.xml +144 -33
  82. metadata +24 -4
  83. data/lib/recog/verifier_factory.rb +0 -13
data/xml/http_cookies.xml CHANGED
@@ -15,7 +15,7 @@
15
15
  <param pos="0" name="service.cpe23" value="cpe:/a:cloudflare:load_balancing:-"/>
16
16
  </fingerprint>
17
17
 
18
- <fingerprint pattern="^(AWSALB(?:TG)?(?:CORS)?)=.*$">
18
+ <fingerprint pattern="^(AWSALB(?:TG)?(?:CORS)?)=">
19
19
  <description>Amazon Application Load Balancer</description>
20
20
  <example cookie="AWSALB">AWSALB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
21
21
  <example cookie="AWSALBCORS">AWSALBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
@@ -26,7 +26,7 @@
26
26
  <param pos="0" name="service.product" value="Application Load Balancer"/>
27
27
  </fingerprint>
28
28
 
29
- <fingerprint pattern="^(AWSELB(?:CORS)?)=.*$">
29
+ <fingerprint pattern="^(AWSELB(?:CORS)?)=">
30
30
  <description>Amazon Elastic Load Balancer</description>
31
31
  <example cookie="AWSELB">AWSELB=791357231C9C446E295988DA51A2CD313D13788329433D96A05631377389B17BF097D4C8A2D0BE5BC4F3C649AED7DFF939364A5790E2EC67F33C4483E2E9DD17E99814071B;PATH=/;HttpOnly;Secure</example>
32
32
  <example cookie="AWSELBCORS">AWSELBCORS=D5A3BF7B08C8E0626B1C77DAAEAB0A7542DEB35F43097F06FD3833E22A9BA2543B805B7AE1B6E97F2BE3A701A19AF5D2CC898E0DB5E52055B0B983CC64EAD006CF77C1CF72;PATH=/;SECURE;SAMESITE=None</example>
@@ -36,7 +36,7 @@
36
36
  <param pos="0" name="service.product" value="Elastic Load Balancer"/>
37
37
  </fingerprint>
38
38
 
39
- <fingerprint pattern="^(PHPSESSI(?:D|ON))=.*">
39
+ <fingerprint pattern="^(PHPSESSI(?:D|ON))=">
40
40
  <description>PHP - http://www.php.net/ref.session</description>
41
41
  <example cookie="PHPSESSID">PHPSESSID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
42
42
  <example cookie="PHPSESSION">PHPSESSION=vt2ag6n7t6ngvlg8adk4860h46; path=/</example>
@@ -47,7 +47,7 @@
47
47
  <param pos="0" name="service.cpe23" value="cpe:/a:php:php:-"/>
48
48
  </fingerprint>
49
49
 
50
- <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=.*">
50
+ <fingerprint pattern="^(ASPSESSIONID[A-Z]+|ASP\.NET_SessionId|\.ASPXANONYMOUS)=">
51
51
  <description>Microsoft IIS (ASP.NET)
52
52
  http://msdn2.microsoft.com/en-us/library/ms953828.aspx
53
53
  http://msdn2.microsoft.com/en-us/library/91ka2e6a.aspx
@@ -66,7 +66,7 @@
66
66
  <param pos="0" name="service.component.cpe23" value="cpe:/a:microsoft:asp.net:-"/>
67
67
  </fingerprint>
68
68
 
69
- <fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=.*">
69
+ <fingerprint pattern="^(CFCLIENT_[^=]+|CFGLOBALS|CFID|CFTOKEN)=">
70
70
  <description>Adobe (Macromedia) ColdFusion uses various cookies</description>
71
71
  <example cookie="CFTOKEN">CFTOKEN=f3863673461e83d7-8B854468-1866-DAAC-99FBB842C6018037;expires=Mon, 01-Aug-2050 01:05:45 GMT;path=/;HttpOnly;</example>
72
72
  <example cookie="CFCLIENT_FOO_CORP">CFCLIENT_FOO_CORP=preflanguage%3DEN%23; Expires=Wed, 12-Apr-2051 01:11:37 GMT; Path=/</example>
@@ -77,26 +77,40 @@
77
77
  <param pos="0" name="service.cpe23" value="cpe:/a:adobe:coldfusion:-"/>
78
78
  </fingerprint>
79
79
 
80
- <fingerprint pattern="^ANsession\d+=(\S+);.*">
80
+ <fingerprint pattern="^ANsession\d+=(\S+);">
81
81
  <description>Array Networks Secure Access Gateway / SSL VPN</description>
82
- <example>ANsession0002262072457555=IPMI; path=/;secure</example>
82
+ <example cookie="IPMI">ANsession0002262072457555=IPMI; path=/;secure</example>
83
83
  <param pos="1" name="cookie"/>
84
84
  <param pos="0" name="service.vendor" value="Array Networks"/>
85
85
  <param pos="0" name="service.family" value="Secure Access Gateway"/>
86
86
  <param pos="0" name="hw.device" value="VPN"/>
87
87
  </fingerprint>
88
88
 
89
- <fingerprint pattern="^(Apache)=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]+);.*">
90
- <description>Apache</description>
91
- <param pos="1" name="cookie"/>
92
- <param pos="2" name="system.time.micros"/>
89
+ <fingerprint pattern="^Apache=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\.[0-9]+(?:\.[0-9]+)?;">
90
+ <description>Apache with session ID containing IP and timestamp (timestamp can be micros, millis or seconds)</description>
91
+ <example host.ip="10.10.130.165">Apache=10.10.130.165.1643670182768255; path=/</example>
92
+ <example host.ip="10.0.101.6">Apache=10.0.101.6.1643663969718158; path=/; expires=Wed, 31-Jan-24 21:19:29 GMT; domain=.contoso.com</example>
93
+ <example host.ip="10.10.20.18">Apache=10.10.20.18.1643510579.1915; domain=foo.com; path=/; expires=Mon, 30-Jan-2023 02:42:58 GMT</example>
94
+ <example host.ip="10.23.219.241">Apache=10.23.219.241.1643541709604; path=/; expires=Tue, 19-Jan-2038 03:14:07 GMT</example>
95
+ <param pos="0" name="cookie" value="Apache"/>
96
+ <param pos="1" name="host.ip"/>
97
+ <param pos="0" name="service.vendor" value="Apache"/>
98
+ <param pos="0" name="service.family" value="Apache"/>
99
+ <param pos="0" name="service.product" value="HTTPD"/>
100
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:http_server:-"/>
101
+ </fingerprint>
102
+
103
+ <fingerprint pattern="^Apache=[0-9a-z]{8}\.[0-9a-z]{13};">
104
+ <description>Apache with opaque session ID</description>
105
+ <example>Apache=1148b9c3.5d6e61e36f2f9; path=/; domain=.foo.com</example>
106
+ <param pos="0" name="cookie" value="Apache"/>
93
107
  <param pos="0" name="service.vendor" value="Apache"/>
94
108
  <param pos="0" name="service.family" value="Apache"/>
95
109
  <param pos="0" name="service.product" value="HTTPD"/>
96
110
  <param pos="0" name="service.cpe23" value="cpe:/a:apache:http_server:-"/>
97
111
  </fingerprint>
98
112
 
99
- <fingerprint pattern="^JServSessionIdroot=.*">
113
+ <fingerprint pattern="^JServSessionIdroot=">
100
114
  <description>Apache JServ</description>
101
115
  <example>JServSessionIdroot=tphxjy73e1.JS1; path=/</example>
102
116
  <param pos="0" name="cookie" value="JServSessionIdroot"/>
@@ -105,7 +119,7 @@
105
119
  <param pos="0" name="service.product" value="JServ"/>
106
120
  </fingerprint>
107
121
 
108
- <fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=.*">
122
+ <fingerprint pattern="^(ATG_SESSION_ID|DYN_USER_CONFIRM|DYN_USER_ID)=">
109
123
  <description>ATG Dynamo</description>
110
124
  <example cookie="ATG_SESSION_ID">ATG_SESSION_ID=yuAUs8xnkzLaF8P3Zk1v5hR28XB4dKsOKZ4jCkVO; path=/</example>
111
125
  <param pos="1" name="cookie"/>
@@ -114,7 +128,7 @@
114
128
  <param pos="0" name="service.product" value="Dynamo"/>
115
129
  </fingerprint>
116
130
 
117
- <fingerprint pattern="^Bugzilla_login_request_cookie=.*">
131
+ <fingerprint pattern="^Bugzilla_login_request_cookie=">
118
132
  <description>Bugzilla</description>
119
133
  <example>Bugzilla_login_request_cookie=ylMVo9ZDtd; path=/; secure</example>
120
134
  <param pos="0" name="cookie" value="Bugzilla_login_request_cookie"/>
@@ -123,34 +137,27 @@
123
137
  <param pos="0" name="service.cpe23" value="cpe:/a:mozilla:bugzilla:-"/>
124
138
  </fingerprint>
125
139
 
126
- <fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);.*">
127
- <description>BEA WebLogic (with timestamp)</description>
128
- <param pos="1" name="cookie"/>
129
- <param pos="2" name="system.time.millis"/>
130
- <param pos="0" name="service.vendor" value="BEA"/>
131
- <param pos="0" name="service.family" value="WebLogic"/>
132
- <param pos="0" name="service.product" value="WebLogic"/>
133
- <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
134
- </fingerprint>
135
-
136
- <fingerprint pattern="^(WebLogicSession)=.*">
140
+ <fingerprint pattern="^WebLogicSession=">
137
141
  <description>BEA WebLogic (no timestamp)</description>
138
- <param pos="1" name="cookie"/>
142
+ <example>WebLogicSession=YfifY2Ck8aWILbJPiaoY3L8aKBjh2MZhUAjHXypG6IBwvWXrun3i|-3385140432258369694/-900104935/6/7009/7009/7010/7010/7009/-1; path=/</example>
143
+ <example>WebLogicSession=QKRlJZbj0b948CrXnoQw8FNuSWvO6fXaJNadlcCWwA3qm6CtqD5a; path=/</example>
144
+ <param pos="0" name="cookie" value="WebLogicSession"/>
139
145
  <param pos="0" name="service.vendor" value="BEA"/>
140
146
  <param pos="0" name="service.family" value="WebLogic"/>
141
147
  <param pos="0" name="service.product" value="WebLogic"/>
142
148
  <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
143
149
  </fingerprint>
144
150
 
145
- <fingerprint pattern="^(BCSI-CSC[0-9A-Za-z]+)=.*">
151
+ <fingerprint pattern="^(BCSI-CS-[0-9A-Za-z]+)=">
146
152
  <description>BlueCoat Proxy</description>
153
+ <example cookie="BCSI-CS-2f6c78bdf64f3b32">BCSI-CS-2f6c78bdf64f3b32=2; Path=/</example>
147
154
  <param pos="1" name="cookie"/>
148
155
  <param pos="0" name="service.vendor" value="Blue Coat"/>
149
156
  <param pos="0" name="service.family" value="Proxy"/>
150
157
  <param pos="0" name="service.product" value="Proxy"/>
151
158
  </fingerprint>
152
159
 
153
- <fingerprint pattern="^CAKEPHP=.*">
160
+ <fingerprint pattern="^CAKEPHP=">
154
161
  <description>CakePHP - http://www.cakephp.org/</description>
155
162
  <example>CAKEPHP=03bgv7jqfurftnm5crn3lc0ob1; expires=Mon, 19-Apr-2021 08:56:06 GMT; Max-Age=14400; path=/; HttpOnly</example>
156
163
  <param pos="0" name="cookie" value="CAKEPHP"/>
@@ -163,21 +170,20 @@
163
170
  The cookie value breaks down to [box-id][service-id][timeout-value]
164
171
  unfortunately, there's no separator so it's hard to tell what the
165
172
  actual break is between the pieces of data.
166
- http://www.cisco.com/warp/public/117/AP_cookies.html
167
173
  -->
168
174
 
169
- <fingerprint pattern="^ARPT=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+.*">
175
+ <fingerprint pattern="^ARPT=([A-Z]+)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})[A-Z]+">
170
176
  <description>Cisco 11000 Series Content Service Switch (CSS)</description>
171
- <example host.id="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
177
+ <example host.name="FOOOB" host.ip="192.168.15.52">ARPT=FOOOB192.168.15.52CKOKM; path=/</example>
172
178
  <param pos="0" name="cookie" value="ARPT"/>
173
- <param pos="1" name="host.id"/>
179
+ <param pos="1" name="host.name"/>
174
180
  <param pos="2" name="host.ip"/>
175
181
  <param pos="0" name="service.vendor" value="Cisco"/>
176
182
  <param pos="0" name="service.family" value="Content Service Switch"/>
177
183
  <param pos="0" name="service.product" value="11000 Series Content Service Switch"/>
178
184
  </fingerprint>
179
185
 
180
- <fingerprint pattern="^ARPT=.*">
186
+ <fingerprint pattern="^ARPT=">
181
187
  <description>Cisco 11000 Series Content Service Switch (CSS) - catch all variant</description>
182
188
  <example>ARPT=388766892.51247.0000; path=/; Httponly/</example>
183
189
  <param pos="0" name="cookie" value="ARPT"/>
@@ -207,15 +213,16 @@
207
213
  <param pos="0" name="hw.cpe23" value="cpe:/h:cisco:adaptive_security_appliance:-"/>
208
214
  </fingerprint>
209
215
 
210
- <fingerprint pattern="^st8id=.*">
216
+ <fingerprint pattern="^st8id=">
211
217
  <description>Citrix Application Protection System, Enterprise - http://support.citrix.com/article/CTX109330</description>
218
+ <example>st8id=1e1bcc1010b6de32734c584317443b31.00.641b86ac5ed3ebb0799138f83af9b63f;</example>
212
219
  <param pos="0" name="cookie" value="st8id"/>
213
220
  <param pos="0" name="service.vendor" value="Citrix"/>
214
221
  <param pos="0" name="service.family" value="Application Protection System"/>
215
222
  <param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
216
223
  </fingerprint>
217
224
 
218
- <fingerprint pattern="^NSC_(?:AAAC|BASEURL|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS|USER)=.*">
225
+ <fingerprint pattern="^NSC_(?:AAAC|BASEURL|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS|USER)=">
219
226
  <description>Citrix NetScaler</description>
220
227
  <example>NSC_AAAC=xyz;</example>
221
228
  <example>NSC_TEMP=xyz;</example>
@@ -243,7 +250,7 @@
243
250
  <param pos="0" name="os.product" value="Pulse Connect Secure"/>
244
251
  </fingerprint>
245
252
 
246
- <fingerprint pattern="^DokuWiki=.*">
253
+ <fingerprint pattern="^DokuWiki=">
247
254
  <description>Dokuwiki</description>
248
255
  <example>DokuWiki=t8l1aev7703vbtejovp165pv01; path=/; secure</example>
249
256
  <param pos="0" name="cookie" value="DokuWiki"/>
@@ -252,7 +259,7 @@
252
259
  <param pos="0" name="service.cpe23" value="cpe:/a:dokuwiki:dokuwiki:-"/>
253
260
  </fingerprint>
254
261
 
255
- <fingerprint pattern="^(EktGUID|ecm)=.*">
262
+ <fingerprint pattern="^(EktGUID|ecm)=">
256
263
  <description>Ektron CMS400.net</description>
257
264
  <example cookie="EktGUID">EktGUID=382107cc-a38d-4d25-8182-3748834e21c8; expires=Tue, 19-Apr-2022 03:12:15 GMT; path=/</example>
258
265
  <param pos="1" name="cookie"/>
@@ -270,9 +277,9 @@
270
277
  <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:fisheye:-"/>
271
278
  </fingerprint>
272
279
 
273
- <fingerprint pattern="(?i)^(BIGipServer([^=]+))=.*">
280
+ <fingerprint pattern="(?i)^(BIGipServer([^=]+))=">
274
281
  <description>F5 BIG-IP LTM - Server variant</description>
275
- <example loadbalancer.poolname="CustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
282
+ <example loadbalancer.poolname="CustomerRP" cookie="BigIpServerCustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
276
283
  <param pos="1" name="cookie"/>
277
284
  <param pos="2" name="loadbalancer.poolname"/>
278
285
  <param pos="0" name="service.vendor" value="F5"/>
@@ -281,7 +288,7 @@
281
288
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
282
289
  </fingerprint>
283
290
 
284
- <fingerprint pattern="^i_like_gogits=.*">
291
+ <fingerprint pattern="^i_like_gogits=">
285
292
  <description>Gogs</description>
286
293
  <example>i_like_gogits=fc3914645f1d5c76; Path=/; HttpOnly</example>
287
294
  <param pos="0" name="cookie" value="i_like_gogits"/>
@@ -290,7 +297,7 @@
290
297
  <param pos="0" name="service.cpe23" value="cpe:/a:gogs:gogs:-"/>
291
298
  </fingerprint>
292
299
 
293
- <fingerprint pattern="^(BigIPCookie[^=]*)=.*">
300
+ <fingerprint pattern="^(BigIPCookie[^=]*)=">
294
301
  <description>F5 BIG-IP LTM</description>
295
302
  <example cookie="BigIPCookie">BigIPCookie=855248779.20480.0000; path=/; Httponly</example>
296
303
  <example cookie="BigIPCookie_foo_corp_prod">BigIPCookie_foo_corp_prod=!tJHKH9zIwsUuJYJ38CCV0XSqmJXsZVQaOjj/m/SBSTQTg21/S+s2gmbsoGwwKXr5Tj9e0ijWZWItfA==; path=/; Httponly</example>
@@ -310,7 +317,7 @@
310
317
  <param pos="0" name="service.cpe23" value="cpe:/a:flyspray:flyspray:-"/>
311
318
  </fingerprint>
312
319
 
313
- <fingerprint pattern="^i_like_gitea=.*">
320
+ <fingerprint pattern="^i_like_gitea=">
314
321
  <description>Gitea</description>
315
322
  <example>i_like_gitea=fc39d4645b1d5c7c; Path=/</example>
316
323
  <param pos="0" name="cookie" value="i_like_gitea"/>
@@ -320,7 +327,7 @@
320
327
  <param pos="0" name="service.cpe23" value="cpe:/a:gitea:gitea:-"/>
321
328
  </fingerprint>
322
329
 
323
- <fingerprint pattern="^_gitlab_session=.*">
330
+ <fingerprint pattern="^_gitlab_session=">
324
331
  <description>GitLab</description>
325
332
  <example>_gitlab_session=032d024e9c2445b595e68255da9e6835; path=/; expires=Mon, 26 Apr 2021 03:09:57 -0000; HttpOnly</example>
326
333
  <param pos="0" name="cookie" value="_gitlab_session"/>
@@ -339,7 +346,7 @@
339
346
  <param pos="0" name="service.product" value="HAProxy"/>
340
347
  </fingerprint>
341
348
 
342
- <fingerprint pattern="^(AMWEBJCT!([^!]+)!([^=]+))=.*">
349
+ <fingerprint pattern="^(AMWEBJCT!([^!]+)!([^=]+))=">
343
350
  <description>IBM Tivoli Access Manager for e-business WebSEAL
344
351
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin180.htm
345
352
  </description>
@@ -352,7 +359,7 @@
352
359
  <param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
353
360
  </fingerprint>
354
361
 
355
- <fingerprint pattern="^(PD-S-SESSION-ID|PD-H-SESSION-ID|PD_STATEFUL_[^=]+)=.*">
362
+ <fingerprint pattern="^(PD-S-SESSION-ID|PD-H-SESSION-ID|PD_STATEFUL_[^=]+)=">
356
363
  <description>IBM Tivoli Access Manager for e-business WebSeal
357
364
  http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/am60_webseal_admin117.htm
358
365
  </description>
@@ -364,15 +371,18 @@
364
371
  <param pos="0" name="service.product" value="Tivoli Access Manager for e-business WebSEAL"/>
365
372
  </fingerprint>
366
373
 
367
- <fingerprint pattern="^IBMCBR=.*">
374
+ <fingerprint pattern="^IBMCBR=">
368
375
  <description>IBM WebSphere Load Balancer</description>
376
+ <!-- Replace with a valid example if one is discovered -->
377
+
378
+ <example>IBMCBR=fakevalue</example>
369
379
  <param pos="0" name="cookie" value="IBMCBR"/>
370
380
  <param pos="0" name="service.vendor" value="IBM"/>
371
381
  <param pos="0" name="service.family" value="WebSphere"/>
372
382
  <param pos="0" name="service.product" value="WebSphere Load Balancer"/>
373
383
  </fingerprint>
374
384
 
375
- <fingerprint pattern="^(mbfcookie(?:\[lang\])?)=.*">
385
+ <fingerprint pattern="^(mbfcookie(?:\[lang\])?)=">
376
386
  <description>Joom!Fish http://www.joomfish.net/</description>
377
387
  <example cookie="mbfcookie">mbfcookie=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/</example>
378
388
  <example cookie="mbfcookie[lang]">mbfcookie[lang]=pt_BR; expires=Tue, 20-Apr-2021 03:30:47 GMT; path=/</example>
@@ -383,12 +393,14 @@
383
393
 
384
394
  <fingerprint pattern="^_mastodon_session=">
385
395
  <description>Mastodon</description>
396
+ <example>_mastodon_session=U09wSzlaMHNuZVI3RGJjR1M2d2lqNFhXc1BXNlJtOXBueTdoM1J2Ykk3UjRXa2V3WkNUNm5BUmY4Z0NISk9FaEtrOVQrMXJCRldvbk1kY3BUaDZkMlRuZkNBUDVXU01EakN3S1JEZDdjbzhNQ0t5MHpXZE9WSGlTOVhKNkhlZWhlaWsxM3Mvd0poU1NHWkZjWUNucmJoeDdNdU85ekpkQVJSbkhDeXdKZ08wMkNuUm1BYnE3cGVBK2FBN1FTUU9SLS1EdUVoNWtLOFFWaWsxNmY2bzErbFVRPT0%3D--4b6087906fdfa25f0bfd46b13d3c1c3a9fb379cd; path=/; secure; HttpOnly</example>
386
397
  <param pos="0" name="cookie" value="_mastodon_session"/>
387
398
  <param pos="0" name="service.product" value="Mastodon"/>
388
399
  </fingerprint>
389
400
 
390
- <fingerprint pattern="^(MSCSAuth|MSCSProfile)=.*">
401
+ <fingerprint pattern="^(MSCSAuth|MSCSProfile)=">
391
402
  <description>Microsoft Commerce Server - http://msdn2.microsoft.com/en-us/library/ms953828.aspx</description>
403
+ <example cookie="MSCSProfile">MSCSProfile=287001FD2674671C7869448243193407F294F4F921DD7D627A0F4EE0CC7F3FAC36B5E45588612D30B2A6C57F1D461CB5EE0887989EE7F09E4529B0795EF87BB095FFF1DE42BD5E8F00273BCAACB9DC80733367D09A4B6A48A6802C4DCD6EB029BF5B207BCE523E8BF2EE3EBCDF5776BAC6B6BCD4BF54EF9C178F9605E75D0DDA; path=/</example>
392
404
  <param pos="1" name="cookie"/>
393
405
  <param pos="0" name="service.vendor" value="Microsoft"/>
394
406
  <param pos="0" name="service.family" value="Commerce Server"/>
@@ -396,18 +408,18 @@
396
408
  <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:commerce_server:-"/>
397
409
  </fingerprint>
398
410
 
399
- <fingerprint pattern="^(nc_sameSiteCookiestrict|nc_sameSiteCookielax|oc_sessionPassphrase)=.*">
411
+ <fingerprint pattern="^(nc_sameSiteCookiestrict|nc_sameSiteCookielax|oc_sessionPassphrase)=">
400
412
  <description>Nextcloud</description>
401
413
  <example cookie="nc_sameSiteCookiestrict">nc_sameSiteCookiestrict=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict</example>
402
414
  <example cookie="nc_sameSiteCookielax">nc_sameSiteCookielax=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax</example>
403
- <example>oc_sessionPassphrase=Y%2BZjBn8Gn%2B8jIJPVx468Tlt8qDNm%2B5IVXLxgtwlY%2BQU2T7edVmDS4091nQrT; path=/nextcloud; secure; HttpOnly</example>
415
+ <example cookie="oc_sessionPassphrase">oc_sessionPassphrase=Y%2BZjBn8Gn%2B8jIJPVx468Tlt8qDNm%2B5IVXLxgtwlY%2BQU2T7edVmDS4091nQrT; path=/nextcloud; secure; HttpOnly</example>
404
416
  <param pos="1" name="cookie"/>
405
417
  <param pos="0" name="service.vendor" value="Nextcloud"/>
406
418
  <param pos="0" name="service.product" value="Nextcloud Server"/>
407
419
  <param pos="0" name="service.cpe23" value="cpe:/a:nextcloud:nextcloud_server:-"/>
408
420
  </fingerprint>
409
421
 
410
- <fingerprint pattern="^AlteonP=.*">
422
+ <fingerprint pattern="^AlteonP=">
411
423
  <description>Nortel Alteon Web Switch</description>
412
424
  <example>AlteonP=c46736793e45929dbaeebabb; path=</example>
413
425
  <param pos="0" name="cookie" value="AlteonP"/>
@@ -416,7 +428,7 @@
416
428
  <param pos="0" name="service.product" value="Alteon Web Switch"/>
417
429
  </fingerprint>
418
430
 
419
- <fingerprint pattern="^OBSID=.*">
431
+ <fingerprint pattern="^OBSID=">
420
432
  <description>Observium</description>
421
433
  <example>OBSID=gud74jg1slhskdo7idqgklkamm6g3908; expires=Tue, 20-Apr-2021 01:31:27 GMT; Max-Age=86400; path=/; HttpOnly</example>
422
434
  <param pos="0" name="cookie" value="OBSID"/>
@@ -425,23 +437,26 @@
425
437
  <param pos="0" name="service.cpe23" value="cpe:/a:observium:observium:-"/>
426
438
  </fingerprint>
427
439
 
428
- <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=.*">
440
+ <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=">
429
441
  <description>OpenMarket/FatWire Content Server (www.fatwire.com)</description>
442
+ <example cookie="SS_X_CSINTERSESSIONID">SS_X_CSINTERSESSIONID=0001P73k2FUEYEU4Ks5TtKxcs2K:vv0b9pej; path=/</example>
443
+ <example cookie="CSINTERSESSIONID">CSINTERSESSIONID=0001xquPwAx2NFUFvi7yw-43f35:vv7sdeqs;Path=/</example>
430
444
  <param pos="1" name="cookie"/>
431
445
  <param pos="0" name="service.vendor" value="FatWire"/>
432
446
  <param pos="0" name="service.family" value="Content Server"/>
433
447
  <param pos="0" name="service.product" value="Content Server"/>
434
448
  </fingerprint>
435
449
 
436
- <fingerprint pattern="^parkinglot=.*">
450
+ <fingerprint pattern="^parkinglot=">
437
451
  <description>Oversee Webserver</description>
452
+ <example>parkinglot=1; domain=.foo.com; path=/; expires=Sun, 11-May-2008 13:51:17 GMT</example>
438
453
  <param pos="0" name="cookie" value="parkinglot"/>
439
454
  <param pos="0" name="service.vendor" value="Oversee"/>
440
455
  <param pos="0" name="service.family" value="Webserver"/>
441
456
  <param pos="0" name="service.product" value="Webserver"/>
442
457
  </fingerprint>
443
458
 
444
- <fingerprint pattern="^phsid=.*">
459
+ <fingerprint pattern="^phsid=">
445
460
  <description>Phabricator</description>
446
461
  <example>phsid=A%2Fxesybc4bypb74dlgojdgw2edct6osflno25h2fw7</example>
447
462
  <param pos="0" name="cookie" value="phsid"/>
@@ -451,7 +466,7 @@
451
466
  <param pos="0" name="service.cpe23" value="cpe:/a:phacility:phabricator:-"/>
452
467
  </fingerprint>
453
468
 
454
- <fingerprint pattern="^RMID=.*">
469
+ <fingerprint pattern="^RMID=">
455
470
  <description>RealMedia OpenAdStream</description>
456
471
  <example>RMID=36c12633607cf7a0; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.foo.bar</example>
457
472
  <param pos="0" name="cookie" value="RMID"/>
@@ -460,7 +475,7 @@
460
475
  <param pos="0" name="service.product" value="OpenAdStream"/>
461
476
  </fingerprint>
462
477
 
463
- <fingerprint pattern="^RoxenUserID=.*">
478
+ <fingerprint pattern="^RoxenUserID=">
464
479
  <description>Roxen WebServer</description>
465
480
  <example>RoxenUserID=c70fd536bc9e1342ce2a608b10547f88; expires=Wed, 19 Apr 2023 02:44:41 GMT; path=/</example>
466
481
  <param pos="0" name="cookie" value="RoxenUserID"/>
@@ -469,7 +484,7 @@
469
484
  <param pos="0" name="service.product" value="WebServer"/>
470
485
  </fingerprint>
471
486
 
472
- <fingerprint pattern="^_sn=.*">
487
+ <fingerprint pattern="^_sn=">
473
488
  <description>Siebel CRM</description>
474
489
  <example>_sn=e7139835ca75f921e25c364d4a8fef48; path=/; expires=Mon, 19 Apr 2021 06:06:58 GMT; HttpOnly</example>
475
490
  <param pos="0" name="cookie" value="_sn"/>
@@ -480,7 +495,7 @@
480
495
 
481
496
  <!-- This fingerprint is not specific enough. Multiple products are sold under
482
497
  the brand iPlanet/Sun ONE/Sun Java.
483
- <fingerprint pattern="^(iPlanetUserId)=.*">
498
+ <fingerprint pattern="^(iPlanetUserId)=">
484
499
  <description>Sun iPlanet</description>
485
500
  <param pos="1" name="cookie"/>
486
501
  <param pos="0" name="service.vendor" value="Sun"/>
@@ -490,8 +505,9 @@
490
505
 
491
506
  -->
492
507
 
493
- <fingerprint pattern="^NSES40Session=.*">
508
+ <fingerprint pattern="^NSES40Session=">
494
509
  <description>Netscape Enterprise Server (subsequently iPlanet Web Server, Sun ONE Web Server, presently Sun Java System Web Server)</description>
510
+ <example>NSES40Session=2%253A3e57d375%253Adc59172283a7e72c;path=/;expires=Sat, 22-Feb-2003 20:15:57 GMT</example>
495
511
  <param pos="0" name="cookie" value="NSES40Session"/>
496
512
  <param pos="0" name="service.vendor" value="Sun"/>
497
513
  <param pos="0" name="service.family" value="Java System Web Server"/>
@@ -500,7 +516,7 @@
500
516
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_web_server:4.0"/>
501
517
  </fingerprint>
502
518
 
503
- <fingerprint pattern="^_redmine_session=.*">
519
+ <fingerprint pattern="^_redmine_session=">
504
520
  <description>Redmine</description>
505
521
  <example>_redmine_session=BAh7B0kiD3Nlc3Npb25faWQGOgZFRkkiJWY2MGY5MTJiZjg0NGU1ZmQxZWI2OTViNzAxYjU4NTRiBjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMW1kV3Z5NDl6eVkwWDl4bFQvMUxSSmxmbjhhaDR1WWxERWUrMFQ4dVcvS0k9BjsARg%3D%3D--ce5f52d49b68e30a7ec34b75bf456d6c79d234d2; path=/; HttpOnly</example>
506
522
  <param pos="0" name="cookie" value="_redmine_session"/>
@@ -518,8 +534,10 @@
518
534
  <param pos="0" name="service.product" value="Sage X3 Syracuse Web Server"/>
519
535
  </fingerprint>
520
536
 
521
- <fingerprint pattern="^(gx_session_id|JROUTE)=.*">
537
+ <fingerprint pattern="^(GX_SESSION_ID|JROUTE)=">
522
538
  <description>Sun Java System Application Server (formerly iPlanet Application Server, Sun ONE Application Server)</description>
539
+ <example cookie="GX_SESSION_ID">GX_SESSION_ID=ji7vouPhPt5CAtGF%2BWPMXBrhjjxWZAD9HRNeEEITGCA%3D</example>
540
+ <example cookie="JROUTE">JROUTE=KbDs; Path=/</example>
523
541
  <param pos="1" name="cookie"/>
524
542
  <param pos="0" name="service.vendor" value="Sun"/>
525
543
  <param pos="0" name="service.family" value="Java System Application Server"/>
@@ -527,7 +545,7 @@
527
545
  <param pos="0" name="service.cpe23" value="cpe:/a:sun:java_system_application_server:-"/>
528
546
  </fingerprint>
529
547
 
530
- <fingerprint pattern="^fe_typo_user=.*">
548
+ <fingerprint pattern="^fe_typo_user=">
531
549
  <description>TYPO3 CMS - http://typo3.com/</description>
532
550
  <example>fe_typo_user=aae725f7dcb8cb5215e64f66d4584cc92; path=/</example>
533
551
  <param pos="0" name="cookie" value="fe_typo_user"/>
@@ -536,7 +554,7 @@
536
554
  <param pos="0" name="service.product" value="CMS"/>
537
555
  </fingerprint>
538
556
 
539
- <fingerprint pattern="^SaneID=.*">
557
+ <fingerprint pattern="^SaneID=">
540
558
  <description>Unica NetTracker - http://netinsight.unica.com/Products/NetTracker.cfm</description>
541
559
  <example>SaneID=10.1.1.223.1618798365976948; path=/; domain=.foo.bar</example>
542
560
  <param pos="0" name="cookie" value="SaneID"/>
@@ -545,7 +563,7 @@
545
563
  <param pos="0" name="service.product" value="NetTracker"/>
546
564
  </fingerprint>
547
565
 
548
- <fingerprint pattern="^(__utm[a-z])=.*">
566
+ <fingerprint pattern="^(__utm[a-z])=">
549
567
  <description>Urchin Tracking Module - http://www.google.com/support/urchin45/bin/answer.py?answer=28307&amp;topic=7425</description>
550
568
  <example cookie="__utmp">__utmp=2071164266.582676006.3393543082; path=/; domain=.foo.bar</example>
551
569
  <param pos="1" name="cookie"/>
@@ -564,15 +582,16 @@
564
582
  <param pos="0" name="hw.product" value="SD-WAN"/>
565
583
  </fingerprint>
566
584
 
567
- <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=.*">
585
+ <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=">
568
586
  <description>Vignette</description>
587
+ <example cookie="vgnvisitor">vgnvisitor=2KM2OM00bZ40000PovANt0Dgn0; path=/; expires=Saturday, 06-Sep-2014 23:50:08 GMT</example>
569
588
  <param pos="1" name="cookie"/>
570
589
  <param pos="0" name="service.vendor" value="Vignette"/>
571
590
  <param pos="0" name="service.family" value="Vignette"/>
572
591
  <param pos="0" name="service.product" value="Vignette"/>
573
592
  </fingerprint>
574
593
 
575
- <fingerprint pattern="^wgSession=.*">
594
+ <fingerprint pattern="^wgSession=">
576
595
  <description>Plain Black WebGUI - http://www.plainblack.com/webgui</description>
577
596
  <example>wgSession=xngFQdcbCap87x6d8qc1YA; path=/; expires=Thu, 17-Apr-2031 02:29:05 GMT</example>
578
597
  <param pos="0" name="cookie" value="wgSession"/>
@@ -581,7 +600,7 @@
581
600
  <param pos="0" name="service.product" value="WebGUI"/>
582
601
  </fingerprint>
583
602
 
584
- <fingerprint pattern="^(WEBTRENDS_?ID)=.*">
603
+ <fingerprint pattern="^(WEBTRENDS_?ID)=">
585
604
  <description>WebTrends</description>
586
605
  <example cookie="WEBTRENDS_ID">WEBTRENDS_ID=10.247.9.69.1618795409656141; path=/; expires=Tue, 19-Apr-22 01:23:29 GMT; domain=.foo.bar</example>
587
606
  <param pos="1" name="cookie"/>
@@ -590,7 +609,7 @@
590
609
  <param pos="0" name="service.product" value="WebTrends"/>
591
610
  </fingerprint>
592
611
 
593
- <fingerprint pattern="^(ZM_TEST|ZM_LOGIN_CSRF)=.*">
612
+ <fingerprint pattern="^(ZM_TEST|ZM_LOGIN_CSRF)=">
594
613
  <description>Zimbra</description>
595
614
  <example cookie="ZM_TEST">ZM_TEST=true;Secure</example>
596
615
  <example cookie="ZM_LOGIN_CSRF">ZM_LOGIN_CSRF=38ef0bea-a4c3-4f41-9ac3-73d7622f3131;Secure;HttpOnly</example>
@@ -600,7 +619,7 @@
600
619
  <param pos="0" name="service.cpe23" value="cpe:/a:synacor:zimbra_collaboration_suite:-"/>
601
620
  </fingerprint>
602
621
 
603
- <fingerprint pattern="^_ZopeId=.*">
622
+ <fingerprint pattern="^_ZopeId=">
604
623
  <description>Zope</description>
605
624
  <example>_ZopeId="91304233A995SVLz3SI"; Path=/</example>
606
625
  <param pos="0" name="cookie" value="_ZopeId"/>
@@ -608,17 +627,18 @@
608
627
  <param pos="0" name="service.product" value="Zope"/>
609
628
  </fingerprint>
610
629
 
611
- <fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+).*">
630
+ <fingerprint pattern="^portal=([0-9]+\.[0-9]+\.[0-9]+)">
612
631
  <description>OracleAS Portal default cookie name - http://download.oracle.com/docs/cd/B14099_19/portal.1014/b19305/cg_app_f.htm</description>
613
- <param pos="1" name="cookie"/>
614
- <param pos="2" name="service.version"/>
632
+ <example service.version="2173348032.20480.0000">portal=2173348032.20480.0000;</example>
633
+ <param pos="0" name="cookie" value="portal"/>
634
+ <param pos="1" name="service.version"/>
615
635
  <param pos="0" name="service.vendor" value="Oracle"/>
616
636
  <param pos="0" name="service.family" value="OracleAS"/>
617
637
  <param pos="0" name="service.product" value="Application Server Portal"/>
618
638
  <param pos="0" name="service.cpe23" value="cpe:/a:oracle:application_server_portal:{service.version}"/>
619
639
  </fingerprint>
620
640
 
621
- <fingerprint pattern="^Compaq-HMMD=[^;]+;.*$">
641
+ <fingerprint pattern="^Compaq-HMMD=[^;]+;">
622
642
  <description>HP System Management Homepage (SMH)</description>
623
643
  <example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/</example>
624
644
  <example>Compaq-HMMD=0001-c01fffff-487a-394a-aab0-ffffffffffff-ffffffffffffffff; path=/; Secure</example>
@@ -643,6 +663,40 @@
643
663
  <param pos="0" name="service.product" value="Arachni"/>
644
664
  </fingerprint>
645
665
 
666
+ <fingerprint pattern="^unraid_">
667
+ <description>Unraid</description>
668
+ <example>unraid_2e9e9f79999999999999999999r9b999=c5599999999999999999999999999e38; path=/; HttpOnly; SameSite=Lax</example>
669
+ <param pos="0" name="service.vendor" value="Lime Technologies"/>
670
+ <param pos="0" name="service.product" value="Unraid"/>
671
+ <param pos="0" name="service.certainty" value="0.5"/>
672
+ </fingerprint>
673
+
674
+ <fingerprint pattern="^phpMyAdmin=">
675
+ <description>phpMyAdmin web interface for MySQL and MariaDB</description>
676
+ <example>phpMyAdmin=28600e9ff9772c871dacec70f9c5edaa; path=/; HttpOnly</example>
677
+ <param pos="0" name="service.vendor" value="phpMyAdmin"/>
678
+ <param pos="0" name="service.product" value="phpMyAdmin"/>
679
+ <param pos="0" name="service.cpe23" value="cpe:/a:phpmyadmin:phpmyadmin:-"/>
680
+ </fingerprint>
681
+
682
+ <fingerprint pattern="^(adminer_(?:sid|key))=">
683
+ <description>Adminer database management tool</description>
684
+ <example cookie="adminer_sid">adminer_sid=6580f6449f9572f817ec99600bc619d2; path=/; HttpOnly</example>
685
+ <example cookie="adminer_key">adminer_key=b8eebd6de0deabc8b30c26a67e01c5b9; path=/; HttpOnly; SameSite=lax</example>
686
+ <param pos="1" name="cookie"/>
687
+ <param pos="0" name="service.vendor" value="Adminer"/>
688
+ <param pos="0" name="service.product" value="Adminer"/>
689
+ <param pos="0" name="service.cpe23" value="cpe:/a:adminer:adminer:-"/>
690
+ </fingerprint>
691
+
692
+ <fingerprint pattern="^mongo-express=">
693
+ <description>mongo-express web-based MongoDB admin interface</description>
694
+ <example>mongo-express=s%3A1qAVXDHaoFE5J0G4wkYKfyjuv6_0Zd9E.l2DGc0YAb7MJQfUleYVEla5i79pbkhDYVayvCEPFCDc; Path=/; HttpOnly</example>
695
+ <param pos="0" name="service.vendor" value="mongo-express Project"/>
696
+ <param pos="0" name="service.product" value="mongo-express"/>
697
+ <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
698
+ </fingerprint>
699
+
646
700
  <!--
647
701
  Ignore various cookies that are very generic cookies for session IDs
648
702
  that are not necessarily indicative of any particular
@@ -651,24 +705,33 @@
651
705
  these and this is enforced by rspec.
652
706
  -->
653
707
 
654
- <fingerprint pattern="(?i)^JSESSIONID(?:\.[^=]+)?=[^;]+;.*$">
655
- <description>Ignore simple JSESSIONID and related cookies</description>
708
+ <fingerprint pattern="(?i)^JSESSIONID(?:\.[^=]+)?=[^;]+;">
709
+ <description>Ignore simple JSESSIONID and related cookies -- assert nothing</description>
656
710
  <example>JSESSIONID=6ooov35i4l3n36qtaf8csvg0;Path=/</example>
657
711
  <example>jsessionid=6nkp66iogcdc92720%2Dc6e4%2D4989%2Db7b2%2D5021624cfdff;Path=/;secure</example>
658
712
  <example>JSESSIONID.c00a9623=v216643eijh19p9duve5srgf;Path=/;HttpOnly</example>
713
+ <param pos="0" name="hw.certainty" value="0.0"/>
714
+ <param pos="0" name="os.certainty" value="0.0"/>
715
+ <param pos="0" name="service.certainty" value="0.0"/>
659
716
  </fingerprint>
660
717
 
661
- <fingerprint pattern="(?i)^_?SESSION_?ID\s*=\s*[^;]+;.*$">
662
- <description>Ignore simple SESSIONID and related cookies</description>
718
+ <fingerprint pattern="(?i)^_?SESSION_?ID\s*=\s*[^;]+;">
719
+ <description>Ignore simple SESSIONID and related cookies -- assert nothing</description>
663
720
  <example>sessionId=7dba3249cfcd4b59854055311099a294; path=/;</example>
664
721
  <example>_session_id=7fe933db0fea13e9c872103ba2d142db; path=/; HttpOnly</example>
665
722
  <example>sessionId =0VrS6Ro6uC5QPXKgNdqGvyUgUFtUOVwv6OWAEWcWQ3jLRtAk2TVAgAApN9yTWVz;postId=; path=/;</example>
666
723
  <example>_session_id=18b3e173aa11db0533fd01752e81f583; path=/; HttpOnly</example>
724
+ <param pos="0" name="hw.certainty" value="0.0"/>
725
+ <param pos="0" name="os.certainty" value="0.0"/>
726
+ <param pos="0" name="service.certainty" value="0.0"/>
667
727
  </fingerprint>
668
728
 
669
- <fingerprint pattern="(?i)^sid=[^;]+;.*$">
670
- <description>Ignore simple SID and related cookies</description>
729
+ <fingerprint pattern="(?i)^sid=[^;]+;">
730
+ <description>Ignore simple SID and related cookies -- assert nothing</description>
671
731
  <example>sid=sfd10bf73-654458f687aa3c68b3874915f651e0ca;path=/;"</example>
732
+ <param pos="0" name="hw.certainty" value="0.0"/>
733
+ <param pos="0" name="os.certainty" value="0.0"/>
734
+ <param pos="0" name="service.certainty" value="0.0"/>
672
735
  </fingerprint>
673
736
 
674
737
  </fingerprints>