recog 2.3.20 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/ci.yml +1 -1
  4. data/.github/workflows/verify.yml +89 -0
  5. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  6. data/.vscode/extensions.json +5 -0
  7. data/.vscode/settings.json +8 -0
  8. data/.vscode/tasks.json +77 -0
  9. data/CONTRIBUTING.md +8 -0
  10. data/README.md +17 -0
  11. data/bin/recog_standardize +28 -13
  12. data/bin/recog_verify +42 -8
  13. data/cpe-remap.yaml +62 -3
  14. data/features/data/schema_failure.xml +4 -0
  15. data/features/data/tests_with_failures.xml +6 -0
  16. data/features/support/hooks.rb +9 -0
  17. data/features/verify.feature +85 -21
  18. data/identifiers/fields.txt +6 -5
  19. data/identifiers/hw_device.txt +8 -0
  20. data/identifiers/hw_family.txt +8 -0
  21. data/identifiers/hw_product.txt +54 -0
  22. data/identifiers/os_device.txt +2 -0
  23. data/identifiers/os_family.txt +2 -0
  24. data/identifiers/os_product.txt +18 -2
  25. data/identifiers/service_product.txt +26 -0
  26. data/identifiers/vendor.txt +62 -1
  27. data/lib/recog/db.rb +2 -1
  28. data/lib/recog/fingerprint.rb +33 -6
  29. data/lib/recog/fingerprint_parse_error.rb +10 -0
  30. data/lib/recog/nizer.rb +1 -82
  31. data/lib/recog/verifier.rb +9 -9
  32. data/lib/recog/verify_reporter.rb +17 -6
  33. data/lib/recog/version.rb +1 -1
  34. data/requirements.txt +1 -1
  35. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  36. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  37. data/spec/data/external_example_fingerprint.xml +8 -0
  38. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  39. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  40. data/spec/lib/recog/db_spec.rb +84 -61
  41. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  42. data/spec/lib/recog/verify_reporter_spec.rb +73 -4
  43. data/tools/dev/hooks/pre-commit +21 -0
  44. data/update_cpes.py +130 -37
  45. data/xml/apache_os.xml +98 -56
  46. data/xml/architecture.xml +15 -1
  47. data/xml/dhcp_vendor_class.xml +206 -0
  48. data/xml/dns_versionbind.xml +26 -13
  49. data/xml/favicons.xml +236 -47
  50. data/xml/fingerprints.xsd +9 -1
  51. data/xml/ftp_banners.xml +213 -197
  52. data/xml/h323_callresp.xml +101 -101
  53. data/xml/hp_pjl_id.xml +84 -84
  54. data/xml/html_title.xml +715 -45
  55. data/xml/http_cookies.xml +143 -80
  56. data/xml/http_servers.xml +510 -310
  57. data/xml/http_wwwauth.xml +177 -75
  58. data/xml/imap_banners.xml +10 -10
  59. data/xml/mdns_device-info_txt.xml +421 -26
  60. data/xml/mysql_banners.xml +3 -2
  61. data/xml/nntp_banners.xml +12 -9
  62. data/xml/ntp_banners.xml +97 -97
  63. data/xml/operating_system.xml +98 -83
  64. data/xml/pop_banners.xml +27 -27
  65. data/xml/rsh_resp.xml +3 -3
  66. data/xml/sip_banners.xml +46 -8
  67. data/xml/sip_user_agents.xml +180 -27
  68. data/xml/smb_native_lm.xml +5 -5
  69. data/xml/smb_native_os.xml +28 -25
  70. data/xml/smtp_banners.xml +258 -254
  71. data/xml/smtp_ehlo.xml +1 -1
  72. data/xml/smtp_help.xml +11 -11
  73. data/xml/smtp_noop.xml +2 -2
  74. data/xml/snmp_sysdescr.xml +1554 -1429
  75. data/xml/snmp_sysobjid.xml +27 -27
  76. data/xml/ssh_banners.xml +27 -20
  77. data/xml/telnet_banners.xml +256 -57
  78. data/xml/tls_jarm.xml +48 -6
  79. data/xml/x11_banners.xml +3 -3
  80. data/xml/x509_issuers.xml +69 -2
  81. data/xml/x509_subjects.xml +144 -33
  82. metadata +24 -4
  83. data/lib/recog/verifier_factory.rb +0 -13
data/xml/architecture.xml CHANGED
@@ -16,28 +16,42 @@
16
16
  <param pos="0" name="os.arch" value="x86"/>
17
17
  </fingerprint>
18
18
 
19
- <fingerprint pattern="PowerPC|PPC|POWER|ppc">
19
+ <fingerprint pattern="PowerPC|PPC|POWER" flags="REG_ICASE">
20
20
  <description>PowerPC</description>
21
+ <example>PowerPC</example>
22
+ <example>PPC</example>
23
+ <example>POWER</example>
24
+ <example>ppc</example>
21
25
  <param pos="0" name="os.arch" value="PowerPC"/>
22
26
  </fingerprint>
23
27
 
24
28
  <fingerprint pattern="SPARC" flags="REG_ICASE">
25
29
  <description>SPARC</description>
30
+ <example>SPARC</example>
31
+ <example>sparc</example>
26
32
  <param pos="0" name="os.arch" value="Sparc"/>
27
33
  </fingerprint>
28
34
 
29
35
  <fingerprint pattern="mips" flags="REG_ICASE">
30
36
  <description>MIPS</description>
37
+ <example>MIPS</example>
38
+ <example>mips</example>
31
39
  <param pos="0" name="os.arch" value="MIPS"/>
32
40
  </fingerprint>
33
41
 
34
42
  <fingerprint pattern="arm64|aarch64" flags="REG_ICASE">
35
43
  <description>ARM64 (aarch64)</description>
44
+ <example>arm64</example>
45
+ <example>ARM64</example>
46
+ <example>aarch64</example>
47
+ <example>AARCH64</example>
36
48
  <param pos="0" name="os.arch" value="ARM64"/>
37
49
  </fingerprint>
38
50
 
39
51
  <fingerprint pattern="arm" flags="REG_ICASE">
40
52
  <description>ARM</description>
53
+ <example>arm</example>
54
+ <example>ARM</example>
41
55
  <param pos="0" name="os.arch" value="ARM"/>
42
56
  </fingerprint>
43
57
 
data/xml/dhcp_vendor_class.xml ADDED
@@ -0,0 +1,206 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <fingerprints matches="dhcp_vendor_class" protocol="dhcp" database_type="service">
3
+ <!--
4
+ Fingerprint definitions that are matched against the string values in the
5
+ dhcp message vi_vendor_class field
6
+ This field is Option 60 as defined in RFC 2132 section 9.13.
7
+ The vi_vendor_class field can be found in client discover (1), request (3)
8
+ and inform (8) messages.
9
+ -->
10
+
11
+ <fingerprint pattern="^Mfg=(?:Fuji)?(?i:Xerox);Typ=(?:MFP|printer);Mod=(?:Xerox )?(\S+) ([a-zA-Z0-9]+).*;Ser=([A-Z0-9]{9})(?:;Loc=.*)?$">
12
+ <description>Xerox Multifunction Printer</description>
13
+ <example hw.family="VersaLink" hw.model="C405" hw.serial_number="ABC123456">Mfg=Xerox;Typ=MFP;Mod=VersaLink C405;Ser=ABC123456;Loc=Print Room</example>
14
+ <example hw.family="AltaLink" hw.model="C8055" hw.serial_number="1AB234567">Mfg=Xerox;Typ=MFP;Mod=Xerox AltaLink C8055 Multifunction Printer;Ser=1AB234567;Loc=Print Room2</example>
15
+ <example hw.family="WorkCentre" hw.model="3345" hw.serial_number="1AB234567">Mfg=XEROX;Typ=MFP;Mod=WorkCentre 3345;Ser=1AB234567;Loc=</example>
16
+ <example hw.family="WorkCentre" hw.model="7845" hw.serial_number="AB1234567">Mfg=Xerox;Typ=MFP;Mod=Xerox WorkCentre 7845 v1 Multifunction System;Ser=AB1234567;Loc=</example>
17
+ <example hw.family="Phaser" hw.model="6500DN" hw.serial_number="ABC123456">Mfg=FujiXerox;Typ=printer;Mod=Phaser 6500DN;Ser=ABC123456</example>
18
+ <param pos="0" name="hw.device" value="Printer"/>
19
+ <param pos="0" name="hw.vendor" value="Xerox"/>
20
+ <param pos="1" name="hw.family"/>
21
+ <param pos="2" name="hw.model"/>
22
+ <param pos="3" name="hw.serial_number"/>
23
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
24
+ <param pos="0" name="os.vendor" value="Xerox"/>
25
+ <param pos="0" name="os.device" value="Printer"/>
26
+ </fingerprint>
27
+
28
+ <fingerprint pattern="^Mfg=Hewlett Packard;Typ=Printer;Mod=HP (LaserJet 200|LaserJet 400) (?:color |colorMFP |MFP )?(M\d+\S+);Ser=([A-Z0-9]{10});$">
29
+ <description>HP Multifunction Printer</description>
30
+ <example hw.family="LaserJet 200" hw.model="M276nw" hw.serial_number="ABC1DE2F3G">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 200 colorMFP M276nw;Ser=ABC1DE2F3G;</example>
31
+ <example hw.family="LaserJet 400" hw.model="M401dne" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401dne;Ser=ABCDE12345;</example>
32
+ <example hw.family="LaserJet 400" hw.model="M401dw" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401dw;Ser=ABCDE12345;</example>
33
+ <example hw.family="LaserJet 400" hw.model="M401n" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401n;Ser=ABCDE12345;</example>
34
+ <example hw.family="LaserJet 400" hw.model="M425dn" hw.serial_number="ABC1D23E4E">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 MFP M425dn;Ser=ABC1D23E4E;</example>
35
+ <param pos="0" name="hw.device" value="Printer"/>
36
+ <param pos="0" name="hw.vendor" value="HP"/>
37
+ <param pos="1" name="hw.family"/>
38
+ <param pos="2" name="hw.model"/>
39
+ <param pos="3" name="hw.serial_number"/>
40
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
41
+ <param pos="0" name="os.vendor" value="HP"/>
42
+ <param pos="0" name="os.device" value="Printer"/>
43
+ </fingerprint>
44
+
45
+ <fingerprint pattern="^(?:Hewlett-Packard|HP) (OfficeJet|LaserJet|Printer|JetDirect)$">
46
+ <description>HP Printer</description>
47
+ <example hw.family="LaserJet">Hewlett-Packard LaserJet</example>
48
+ <example hw.family="OfficeJet">Hewlett-Packard OfficeJet</example>
49
+ <example hw.family="LaserJet">HP LaserJet</example>
50
+ <example hw.family="Printer">HP Printer</example>
51
+ <example hw.family="JetDirect">Hewlett-Packard JetDirect</example>
52
+ <param pos="0" name="hw.device" value="Printer"/>
53
+ <param pos="0" name="hw.vendor" value="HP"/>
54
+ <param pos="1" name="hw.family"/>
55
+ <param pos="0" name="os.vendor" value="HP"/>
56
+ <param pos="0" name="os.device" value="Printer"/>
57
+ </fingerprint>
58
+
59
+ <fingerprint pattern="^Mfg=LEXMARK;Typ=(?:MFP|Printer);Mod=Lexmark (\S+);Ser=([A-Z0-9]{13});$">
60
+ <description>Lexmark Printer</description>
61
+ <example hw.model="MX410de" hw.serial_number="12345ABC6D7EF">Mfg=LEXMARK;Typ=MFP;Mod=Lexmark MX410de;Ser=12345ABC6D7EF;</example>
62
+ <example hw.model="MS310dn" hw.serial_number="123456AB7C8DE">Mfg=LEXMARK;Typ=Printer;Mod=Lexmark MS310dn;Ser=123456AB7C8DE;</example>
63
+ <param pos="0" name="hw.device" value="Printer"/>
64
+ <param pos="0" name="hw.vendor" value="Lexmark"/>
65
+ <param pos="1" name="hw.model"/>
66
+ <param pos="2" name="hw.serial_number"/>
67
+ <param pos="0" name="os.vendor" value="Lexmark"/>
68
+ <param pos="0" name="os.device" value="Printer"/>
69
+ </fingerprint>
70
+
71
+ <fingerprint pattern="^Canon iR-ADV (C?\d+ ?\S*)$">
72
+ <description>Canon imageRunner Printer</description>
73
+ <example hw.model="C5535 III">Canon iR-ADV C5535 III</example>
74
+ <example hw.model="C350">Canon iR-ADV C350</example>
75
+ <example hw.model="4545 III">Canon iR-ADV 4545 III</example>
76
+ <example hw.model="525">Canon iR-ADV 525</example>
77
+ <param pos="0" name="hw.device" value="Printer"/>
78
+ <param pos="0" name="hw.vendor" value="Canon"/>
79
+ <param pos="0" name="hw.family" value="imageRunner"/>
80
+ <param pos="1" name="hw.model"/>
81
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
82
+ <param pos="0" name="os.vendor" value="Canon"/>
83
+ <param pos="0" name="os.device" value="Printer"/>
84
+ </fingerprint>
85
+
86
+ <fingerprint pattern="^Canon (D\d+) Series$">
87
+ <description>Canon imageClass Printer</description>
88
+ <example hw.model="D1600">Canon D1600 Series</example>
89
+ <param pos="0" name="hw.device" value="Printer"/>
90
+ <param pos="0" name="hw.vendor" value="Canon"/>
91
+ <param pos="0" name="hw.family" value="imageClass"/>
92
+ <param pos="1" name="hw.model"/>
93
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
94
+ <param pos="0" name="os.vendor" value="Canon"/>
95
+ <param pos="0" name="os.device" value="Printer"/>
96
+ </fingerprint>
97
+
98
+ <fingerprint pattern="^Polycom-(VVX\d{3})$">
99
+ <description>Polycom IP Phone</description>
100
+ <example hw.product="VVX410" hw.model="VVX410">Polycom-VVX410</example>
101
+ <param pos="0" name="hw.device" value="VoIP"/>
102
+ <param pos="0" name="hw.vendor" value="Polycom"/>
103
+ <param pos="0" name="hw.family" value="VVX"/>
104
+ <param pos="1" name="hw.model"/>
105
+ <param pos="0" name="hw.product" value="{hw.model}"/>
106
+ <param pos="0" name="os.vendor" value="Polycom"/>
107
+ </fingerprint>
108
+
109
+ <fingerprint pattern="^Aruba\s(JL\d+A)\s(\d+[A-Z]?)\S+\sSwitch(?:\sdslforum.org)?$">
110
+ <description>HP Aruba Network Switch</description>
111
+ <example hw.product="JL075A" hw.family="3810M">Aruba JL075A 3810M-16SFP+-2-slot Switch</example>
112
+ <example hw.product="JL253A" hw.family="2930F">Aruba JL253A 2930F-24G-4SFP+ Switch dslforum.org</example>
113
+ <example hw.product="JL256A" hw.family="2930F">Aruba JL256A 2930F-48G-PoE+-4SFP+ Switch</example>
114
+ <example hw.product="JL258A" hw.family="2930F">Aruba JL258A 2930F-8G-PoE+-2SFP+ Switch</example>
115
+ <example hw.product="JL357A" hw.family="2540">Aruba JL357A 2540-48G-PoE+-4SFP+ Switch</example>
116
+ <param pos="0" name="hw.device" value="Switch"/>
117
+ <param pos="0" name="hw.vendor" value="Aruba Networks"/>
118
+ <param pos="1" name="hw.product"/>
119
+ <param pos="2" name="hw.family"/>
120
+ <param pos="0" name="os.vendor" value="Aruba Networks"/>
121
+ </fingerprint>
122
+
123
+ <fingerprint pattern="^AXIS,(?:PTZ Dome )?Network Camera,(.*),([\d\.]+)$">
124
+ <description>Axis Network Camera</description>
125
+ <example hw.model="P3343" os.version="5.20.3">AXIS,Network Camera,P3343,5.20.3</example>
126
+ <example hw.model="M5014" os.version="5.50.3.7">AXIS,PTZ Dome Network Camera,M5014,5.50.3.7</example>
127
+ <example hw.model="P3225-LV Mk II" os.version="9.70.1.5">AXIS,Network Camera,P3225-LV Mk II,9.70.1.5</example>
128
+ <param pos="0" name="hw.device" value="IP Camera"/>
129
+ <param pos="0" name="hw.vendor" value="AXIS"/>
130
+ <param pos="1" name="hw.model"/>
131
+ <param pos="0" name="os.vendor" value="AXIS"/>
132
+ <param pos="2" name="os.version"/>
133
+ </fingerprint>
134
+
135
+ <fingerprint pattern="^AXIS,(?:Network Video Encoder|Video Server),(\S+),([\d\.]+)$">
136
+ <description>Axis Video Encoder</description>
137
+ <example hw.model="M7011" os.version="5.90.1">AXIS,Network Video Encoder,M7011,5.90.1</example>
138
+ <param pos="0" name="hw.device" value="Video Encoder"/>
139
+ <param pos="0" name="hw.vendor" value="AXIS"/>
140
+ <param pos="1" name="hw.model"/>
141
+ <param pos="0" name="os.vendor" value="AXIS"/>
142
+ <param pos="2" name="os.version"/>
143
+ </fingerprint>
144
+
145
+ <fingerprint pattern="^AXIS,Network IO Audio Module,(\S+),([\d\.]+)$">
146
+ <description>Axis IO Audio Module</description>
147
+ <example hw.model="P8221" os.version="5.10.2">AXIS,Network IO Audio Module,P8221,5.10.2</example>
148
+ <param pos="0" name="hw.device" value="Audio Encoder"/>
149
+ <param pos="0" name="hw.vendor" value="AXIS"/>
150
+ <param pos="1" name="hw.model"/>
151
+ <param pos="0" name="os.vendor" value="AXIS"/>
152
+ <param pos="2" name="os.version"/>
153
+ </fingerprint>
154
+
155
+ <fingerprint pattern="^PCoIP Endpoint$">
156
+ <description>PCoIP Endpoint Device</description>
157
+ <example>PCoIP Endpoint</example>
158
+ <param pos="0" name="hw.device" value="Thin Client"/>
159
+ <param pos="0" name="hw.product" value="PCoIP Endpoint Device"/>
160
+ <param pos="0" name="os.vendor" value="Teradici"/>
161
+ <param pos="0" name="os.family" value="Teradici"/>
162
+ </fingerprint>
163
+
164
+ <fingerprint pattern="^android-dhcp-([\d\.]*)$">
165
+ <description>Android Device</description>
166
+ <example os.version="7.1.1">android-dhcp-7.1.1</example>
167
+ <param pos="0" name="os.vendor" value="Google"/>
168
+ <param pos="0" name="os.family" value="Linux"/>
169
+ <param pos="0" name="os.product" value="Android"/>
170
+ <param pos="1" name="os.version"/>
171
+ <param pos="0" name="os.cpe23" value="cpe:/o:google:android:{os.version}"/>
172
+ </fingerprint>
173
+
174
+ <fingerprint pattern="^dhcpcd-(?:[\d\.]+):Linux-([\d\.]+).*:(\S*):">
175
+ <description>Linux</description>
176
+ <example os.version="4.14.78" os.arch="armv7l">dhcpcd-6.11.5:Linux-4.14.78:armv7l:Freescale</example>
177
+ <example os.version="4.19.155" os.arch="x86_64">dhcpcd-6.8.2:Linux-4.19.155-10581-g8bdb5ed8e80c:x86_64:GenuineIntel</example>
178
+ <param pos="0" name="os.family" value="Linux"/>
179
+ <param pos="0" name="os.product" value="Linux"/>
180
+ <param pos="1" name="os.version"/>
181
+ <param pos="2" name="os.arch"/>
182
+ </fingerprint>
183
+
184
+ <fingerprint pattern="^SAMSUNG Network Printer$">
185
+ <description>Samsung Network Printer</description>
186
+ <example>SAMSUNG Network Printer</example>
187
+ <param pos="0" name="hw.device" value="Printer"/>
188
+ <param pos="0" name="hw.vendor" value="Samsung"/>
189
+ <param pos="0" name="os.vendor" value="Samsung"/>
190
+ </fingerprint>
191
+
192
+ <fingerprint pattern="^MERAKI$">
193
+ <description>MERAKI Device</description>
194
+ <example>MERAKI</example>
195
+ <param pos="0" name="hw.vendor" value="Meraki"/>
196
+ <param pos="0" name="os.vendor" value="Meraki"/>
197
+ </fingerprint>
198
+
199
+ <fingerprint pattern="^MSFT 5.0$">
200
+ <description>Microsoft Windows Device</description>
201
+ <example>MSFT 5.0</example>
202
+ <param pos="0" name="os.vendor" value="Microsoft"/>
203
+ <param pos="0" name="os.family" value="Windows"/>
204
+ </fingerprint>
205
+
206
+ </fingerprints>
data/xml/dns_versionbind.xml CHANGED
@@ -17,30 +17,40 @@
17
17
  <fingerprint pattern="^$">
18
18
  <description>empty string -- assert nothing.</description>
19
19
  <example/>
20
+ <param pos="0" name="hw.certainty" value="0.0"/>
21
+ <param pos="0" name="os.certainty" value="0.0"/>
20
22
  <param pos="0" name="service.certainty" value="0.0"/>
21
23
  </fingerprint>
22
24
 
23
25
  <fingerprint pattern="^none$">
24
26
  <description>bare 'none' -- assert nothing.</description>
25
27
  <example>none</example>
28
+ <param pos="0" name="hw.certainty" value="0.0"/>
29
+ <param pos="0" name="os.certainty" value="0.0"/>
26
30
  <param pos="0" name="service.certainty" value="0.0"/>
27
31
  </fingerprint>
28
32
 
29
33
  <fingerprint pattern="^null$">
30
34
  <description>bare 'null' -- assert nothing.</description>
31
35
  <example>null</example>
36
+ <param pos="0" name="hw.certainty" value="0.0"/>
37
+ <param pos="0" name="os.certainty" value="0.0"/>
32
38
  <param pos="0" name="service.certainty" value="0.0"/>
33
39
  </fingerprint>
34
40
 
35
41
  <fingerprint pattern="(?i)^unknown$">
36
42
  <description>bare 'unknown' -- assert nothing.</description>
37
43
  <example>unknown</example>
44
+ <param pos="0" name="hw.certainty" value="0.0"/>
45
+ <param pos="0" name="os.certainty" value="0.0"/>
38
46
  <param pos="0" name="service.certainty" value="0.0"/>
39
47
  </fingerprint>
40
48
 
41
49
  <fingerprint pattern="^no version$">
42
50
  <description>bare 'no version' -- assert nothing.</description>
43
51
  <example>no version</example>
52
+ <param pos="0" name="hw.certainty" value="0.0"/>
53
+ <param pos="0" name="os.certainty" value="0.0"/>
44
54
  <param pos="0" name="service.certainty" value="0.0"/>
45
55
  </fingerprint>
46
56
 
@@ -58,8 +68,8 @@
58
68
  <example service.version="9.3.6-P1" os.version="5" os.version.version="11">9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.12</example>
59
69
  <example service.version="9.9.1-P3" os.version="6">9.9.1-P3-RedHat-9.9.1.P3.el6</example>
60
70
  <example service.version="9.9.3-rpz2+rl.13208.13-P2" os.version="6">9.9.3-rpz2+rl.13208.13-P2-RedHat-9.9.3-4.P2.el6</example>
61
- <example os.version="6" os.version.version="1">9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3</example>
62
- <example os.version="6" os.version.version="">9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6</example>
71
+ <example os.version="6" os.version.version="1" service.version="9.7.3-P3">9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3</example>
72
+ <example os.version="6" os.version.version="" service.version="9.8.2rc1">9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6</example>
63
73
  <param pos="0" name="service.vendor" value="ISC"/>
64
74
  <param pos="0" name="service.family" value="BIND"/>
65
75
  <param pos="0" name="service.product" value="BIND"/>
@@ -75,21 +85,21 @@
75
85
 
76
86
  <fingerprint pattern="^(9.[^-]+(?:-rl[.\d]+)?(?:-[SP]\d)?)-RedHat-[\d.]+-[\w.]+fc([\d]+)$">
77
87
  <description>ISC BIND: Fedora</description>
78
- <example service.version="9.10.4-P8">9.10.4-P8-RedHat-9.10.4-4.P8.fc25</example>
88
+ <example service.version="9.10.4-P8" os.version="25">9.10.4-P8-RedHat-9.10.4-4.P8.fc25</example>
79
89
  <!-- The '-rl' in the example below indicates a rate limiting patch -->
80
90
 
81
- <example service.version="9.9.3-rl.13207.22-P2">9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19</example>
82
- <example os.version="10">9.5.2-RedHat-9.5.2-1.fc10</example>
91
+ <example service.version="9.9.3-rl.13207.22-P2" os.version="19">9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19</example>
92
+ <example os.version="10" service.version="9.5.2">9.5.2-RedHat-9.5.2-1.fc10</example>
83
93
  <param pos="0" name="service.vendor" value="ISC"/>
84
94
  <param pos="0" name="service.family" value="BIND"/>
85
95
  <param pos="0" name="service.product" value="BIND"/>
86
96
  <param pos="1" name="service.version"/>
87
97
  <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
88
- <param pos="0" name="os.vendor" value="Red Hat"/>
98
+ <param pos="0" name="os.vendor" value="Fedora Project"/>
89
99
  <param pos="0" name="os.family" value="Linux"/>
90
- <param pos="0" name="os.product" value="Fedora Core Linux"/>
100
+ <param pos="0" name="os.product" value="Fedora Core"/>
91
101
  <param pos="2" name="os.version"/>
92
- <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:{os.version}"/>
102
+ <param pos="0" name="os.cpe23" value="cpe:/o:fedoraproject:fedora_core:{os.version}"/>
93
103
  </fingerprint>
94
104
 
95
105
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-RedHat-[\w.-]+amzn1$">
@@ -709,8 +719,11 @@
709
719
  -->
710
720
 
711
721
  <fingerprint pattern="^Microsoft DNS 6.0.6100 \(2AEF76E\)$">
712
- <description>SPOOFED - Microsoft DNS on Windows 2008 SP something</description>
722
+ <description>SPOOFED - Microsoft DNS on Windows 2008 SP something -- assert nothing.</description>
713
723
  <example>Microsoft DNS 6.0.6100 (2AEF76E)</example>
724
+ <param pos="0" name="hw.certainty" value="0.0"/>
725
+ <param pos="0" name="os.certainty" value="0.0"/>
726
+ <param pos="0" name="service.certainty" value="0.0"/>
714
727
  </fingerprint>
715
728
 
716
729
  <fingerprint pattern="^Microsoft DNS 6.0.6003(?: \(([^)]+)\))?$">
@@ -833,8 +846,8 @@
833
846
 
834
847
  <fingerprint pattern="^ALU DNS ([\d\.]+) Build (\d+)$">
835
848
  <description>ALU (Alcatel Lucent?) DNS</description>
836
- <example service.version="6.2">ALU DNS 6.2 Build 22</example>
837
- <example service.version.version="9">ALU DNS 6.2 Build 9</example>
849
+ <example service.version="6.2" service.version.version="22">ALU DNS 6.2 Build 22</example>
850
+ <example service.version.version="9" service.version="6.2">ALU DNS 6.2 Build 9</example>
838
851
  <param pos="0" name="service.vendor" value="ALU"/>
839
852
  <param pos="0" name="service.family" value="DNS"/>
840
853
  <param pos="0" name="service.product" value="DNS"/>
@@ -900,8 +913,8 @@
900
913
 
901
914
  <fingerprint pattern="^Meta IP[\s\/]DNS (?:V[\d\.]+ )?- BIND V([\d\.]+(?:-REL)?) \(Build (\d+)\s?\)$">
902
915
  <description>Check Point Meta IP</description>
903
- <example service.version="8.2.7-REL">Meta IP DNS - BIND V8.2.7-REL (Build 31)</example>
904
- <example service.version.version="4704">Meta IP/DNS V4.1 - BIND V8.1.2 (Build 4704 )</example>
916
+ <example service.version="8.2.7-REL" service.version.version="31">Meta IP DNS - BIND V8.2.7-REL (Build 31)</example>
917
+ <example service.version.version="4704" service.version="8.1.2">Meta IP/DNS V4.1 - BIND V8.1.2 (Build 4704 )</example>
905
918
  <param pos="0" name="service.vendor" value="Check Point"/>
906
919
  <param pos="0" name="service.family" value="META IP"/>
907
920
  <param pos="0" name="service.product" value="DNS"/>