recog 2.3.20 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/ci.yml +1 -1
  4. data/.github/workflows/verify.yml +89 -0
  5. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  6. data/.vscode/extensions.json +5 -0
  7. data/.vscode/settings.json +8 -0
  8. data/.vscode/tasks.json +77 -0
  9. data/CONTRIBUTING.md +8 -0
  10. data/README.md +17 -0
  11. data/bin/recog_standardize +28 -13
  12. data/bin/recog_verify +42 -8
  13. data/cpe-remap.yaml +62 -3
  14. data/features/data/schema_failure.xml +4 -0
  15. data/features/data/tests_with_failures.xml +6 -0
  16. data/features/support/hooks.rb +9 -0
  17. data/features/verify.feature +85 -21
  18. data/identifiers/fields.txt +6 -5
  19. data/identifiers/hw_device.txt +8 -0
  20. data/identifiers/hw_family.txt +8 -0
  21. data/identifiers/hw_product.txt +54 -0
  22. data/identifiers/os_device.txt +2 -0
  23. data/identifiers/os_family.txt +2 -0
  24. data/identifiers/os_product.txt +18 -2
  25. data/identifiers/service_product.txt +26 -0
  26. data/identifiers/vendor.txt +62 -1
  27. data/lib/recog/db.rb +2 -1
  28. data/lib/recog/fingerprint.rb +33 -6
  29. data/lib/recog/fingerprint_parse_error.rb +10 -0
  30. data/lib/recog/nizer.rb +1 -82
  31. data/lib/recog/verifier.rb +9 -9
  32. data/lib/recog/verify_reporter.rb +17 -6
  33. data/lib/recog/version.rb +1 -1
  34. data/requirements.txt +1 -1
  35. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  36. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  37. data/spec/data/external_example_fingerprint.xml +8 -0
  38. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  39. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  40. data/spec/lib/recog/db_spec.rb +84 -61
  41. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  42. data/spec/lib/recog/verify_reporter_spec.rb +73 -4
  43. data/tools/dev/hooks/pre-commit +21 -0
  44. data/update_cpes.py +130 -37
  45. data/xml/apache_os.xml +98 -56
  46. data/xml/architecture.xml +15 -1
  47. data/xml/dhcp_vendor_class.xml +206 -0
  48. data/xml/dns_versionbind.xml +26 -13
  49. data/xml/favicons.xml +236 -47
  50. data/xml/fingerprints.xsd +9 -1
  51. data/xml/ftp_banners.xml +213 -197
  52. data/xml/h323_callresp.xml +101 -101
  53. data/xml/hp_pjl_id.xml +84 -84
  54. data/xml/html_title.xml +715 -45
  55. data/xml/http_cookies.xml +143 -80
  56. data/xml/http_servers.xml +510 -310
  57. data/xml/http_wwwauth.xml +177 -75
  58. data/xml/imap_banners.xml +10 -10
  59. data/xml/mdns_device-info_txt.xml +421 -26
  60. data/xml/mysql_banners.xml +3 -2
  61. data/xml/nntp_banners.xml +12 -9
  62. data/xml/ntp_banners.xml +97 -97
  63. data/xml/operating_system.xml +98 -83
  64. data/xml/pop_banners.xml +27 -27
  65. data/xml/rsh_resp.xml +3 -3
  66. data/xml/sip_banners.xml +46 -8
  67. data/xml/sip_user_agents.xml +180 -27
  68. data/xml/smb_native_lm.xml +5 -5
  69. data/xml/smb_native_os.xml +28 -25
  70. data/xml/smtp_banners.xml +258 -254
  71. data/xml/smtp_ehlo.xml +1 -1
  72. data/xml/smtp_help.xml +11 -11
  73. data/xml/smtp_noop.xml +2 -2
  74. data/xml/snmp_sysdescr.xml +1554 -1429
  75. data/xml/snmp_sysobjid.xml +27 -27
  76. data/xml/ssh_banners.xml +27 -20
  77. data/xml/telnet_banners.xml +256 -57
  78. data/xml/tls_jarm.xml +48 -6
  79. data/xml/x11_banners.xml +3 -3
  80. data/xml/x509_issuers.xml +69 -2
  81. data/xml/x509_subjects.xml +144 -33
  82. metadata +24 -4
  83. data/lib/recog/verifier_factory.rb +0 -13
data/xml/ftp_banners.xml CHANGED
@@ -5,9 +5,9 @@
5
5
  against these patterns to fingerprint FTP servers.
6
6
  -->
7
7
 
8
- <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version ([1234]\.\d+)\)\.$">
8
+ <fingerprint pattern="^([^ ]{1,512}) Microsoft FTP Service \(Version ([1234]\.\d+)\)\.$">
9
9
  <description>Microsoft FTP Server on Windows NT</description>
10
- <example>xx Microsoft FTP Service (Version 3.0).</example>
10
+ <example host.name="foo.bar" service.version="3.0">foo.bar Microsoft FTP Service (Version 3.0).</example>
11
11
  <param pos="0" name="service.vendor" value="Microsoft"/>
12
12
  <param pos="0" name="service.product" value="IIS"/>
13
13
  <param pos="0" name="service.family" value="IIS"/>
@@ -20,9 +20,9 @@
20
20
  <param pos="1" name="host.name"/>
21
21
  </fingerprint>
22
22
 
23
- <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.0\)\.$">
23
+ <fingerprint pattern="^([^ ]{1,512}) Microsoft FTP Service \(Version 5.0\)\.$">
24
24
  <description>Microsoft FTP Server on Windows 2000</description>
25
- <example>xxx Microsoft FTP Service (Version 5.0).</example>
25
+ <example host.name="foo.bar">foo.bar Microsoft FTP Service (Version 5.0).</example>
26
26
  <param pos="0" name="service.vendor" value="Microsoft"/>
27
27
  <param pos="0" name="service.product" value="IIS"/>
28
28
  <param pos="0" name="service.family" value="IIS"/>
@@ -35,9 +35,9 @@
35
35
  <param pos="1" name="host.name"/>
36
36
  </fingerprint>
37
37
 
38
- <fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.1\)\.$">
38
+ <fingerprint pattern="^([^ ]{1,512}) Microsoft FTP Service \(Version 5.1\)\.$">
39
39
  <description>Microsoft FTP Server on Windows XP, 2003 or later versions of 2000</description>
40
- <example>xxx Microsoft FTP Service (Version 5.1).</example>
40
+ <example host.name="foo.bar">foo.bar Microsoft FTP Service (Version 5.1).</example>
41
41
  <param pos="0" name="service.vendor" value="Microsoft"/>
42
42
  <param pos="0" name="service.product" value="IIS"/>
43
43
  <param pos="0" name="service.family" value="IIS"/>
@@ -49,9 +49,9 @@
49
49
  <param pos="1" name="host.name"/>
50
50
  </fingerprint>
51
51
 
52
- <fingerprint pattern="^([^ ]+) Microsoft FTP Service$">
52
+ <fingerprint pattern="^([^ ]{1,512}) Microsoft FTP Service$">
53
53
  <description>Microsoft FTP Server on Windows XP, 2003 or later without version</description>
54
- <example>hostname Microsoft FTP Service</example>
54
+ <example host.name="foo.bar">foo.bar Microsoft FTP Service</example>
55
55
  <param pos="0" name="service.vendor" value="Microsoft"/>
56
56
  <param pos="0" name="service.product" value="IIS"/>
57
57
  <param pos="0" name="service.family" value="IIS"/>
@@ -76,9 +76,9 @@
76
76
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
77
77
  </fingerprint>
78
78
 
79
- <fingerprint pattern="^([^ ]+) +FTP +Server \(Version ([^\(]+)\(PHNE_\d+\) [^\)]+\) ready.?$" flags="REG_ICASE">
79
+ <fingerprint pattern="^([^ ]{1,512}) +FTP +Server \(Version ([^\(]+)\(PHNE_\d+\) [^\)]+\) ready.?$" flags="REG_ICASE">
80
80
  <description>FTP on HPUX with a PHNE (HP Networking patch) installed</description>
81
- <example>example.com FTP server (Version 1.1.214.4(PHNE_38458) Mon Feb 15 06:03:12 GMT 2010) ready.</example>
81
+ <example host.name="example.com" service.version="1.1.214.4">example.com FTP server (Version 1.1.214.4(PHNE_38458) Mon Feb 15 06:03:12 GMT 2010) ready.</example>
82
82
  <param pos="0" name="service.vendor" value="HP"/>
83
83
  <param pos="0" name="service.product" value="FTPD"/>
84
84
  <param pos="0" name="os.vendor" value="HP"/>
@@ -89,9 +89,9 @@
89
89
  <param pos="2" name="service.version"/>
90
90
  </fingerprint>
91
91
 
92
- <fingerprint pattern="^([^ ]+) +FTP +Server \(Revision \S+ Version wuftpd-([^\(]+)\(PHNE_\d+\) [^\)]+\) ready.?$" flags="REG_ICASE">
92
+ <fingerprint pattern="^([^ ]{1,512}) +FTP +Server \(Revision \S+ Version wuftpd-([^\(]+)\(PHNE_\d+\) [^\)]+\) ready.?$" flags="REG_ICASE">
93
93
  <description>WU-FTPD on HPUX with a PHNE (HP Networking patch) installed</description>
94
- <example>example.com FTP server (Revision 1.1 Version wuftpd-2.6.1(PHNE_38578) Fri Sep 5 12:10:54 GMT 2008) ready.</example>
94
+ <example host.name="example.com" service.version="2.6.1">example.com FTP server (Revision 1.1 Version wuftpd-2.6.1(PHNE_38578) Fri Sep 5 12:10:54 GMT 2008) ready.</example>
95
95
  <param pos="0" name="service.vendor" value="Washington University"/>
96
96
  <param pos="0" name="service.product" value="WU-FTPD"/>
97
97
  <param pos="0" name="os.vendor" value="HP"/>
@@ -102,7 +102,7 @@
102
102
  <param pos="2" name="service.version"/>
103
103
  </fingerprint>
104
104
 
105
- <fingerprint pattern="^(\S+)(?: \S+)? FTP Server \((?:Revision [\d\.]+ )?Version wu(?:ftpd)?-([\d\.]+).*\) ready.?$" flags="REG_ICASE">
105
+ <fingerprint pattern="^(\S{1,512})(?: \S{1,512})? FTP Server \((?:Revision [\d\.]+ )?Version wu(?:ftpd)?-([\d\.]+).*\) ready.?$" flags="REG_ICASE">
106
106
  <description>WU-FTPD on various OS</description>
107
107
  <example host.name="example.com" service.version="2.6.2">example.com FTP server (Version wu-2.6.2(1) Sat Jul 19 16:21:30 UTC 2008) ready.</example>
108
108
  <example host.name="example.com" service.version="2.6.2">example.com 192.168.0.1 FTP server (Version wu-2.6.2(1) Wed Sep 21 11:16:21 MEST 2005) ready.</example>
@@ -114,7 +114,7 @@
114
114
  <param pos="2" name="service.version"/>
115
115
  </fingerprint>
116
116
 
117
- <fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\s+([\d\.]+).*\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
117
+ <fingerprint pattern="^(\S{1,512})\s{1,8}FTP Server \(Version:\s+Mac OS X Server\s+([\d\.]+).*\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
118
118
  <description>FTPD on Mac OS X Server with a version</description>
119
119
  <example host.name="example.com" os.version="10.3">example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
120
120
  <example host.name="example.com" os.version="10.3">this is a banner. change it.&#13;
@@ -129,7 +129,7 @@ example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</exampl
129
129
  <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x_server:{os.version}"/>
130
130
  </fingerprint>
131
131
 
132
- <fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
132
+ <fingerprint pattern="^(\S{1,512})\s{1,8}FTP Server \(Version:\s+Mac OS X Server\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
133
133
  <description>FTPD on Mac OS X Server without a version</description>
134
134
  <example host.name="example.com">example.com FTP server (Version: Mac OS X Server) ready.</example>
135
135
  <example host.name="example.com">this is a banner. change it.&#13;
@@ -143,7 +143,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
143
143
  <param pos="1" name="host.name"/>
144
144
  </fingerprint>
145
145
 
146
- <fingerprint pattern="^(\S+)\s+FTP Server \(tnftpd (.*)\) ready\.?$" flags="REG_ICASE">
146
+ <fingerprint pattern="^(\S{1,512})\s{1,8}FTP Server \(tnftpd (.*)\) ready\.?$" flags="REG_ICASE">
147
147
  <description>Simple tnftpd banner with a version</description>
148
148
  <example host.name="example.com" service.version="20061217">example.com FTP server (tnftpd 20061217) ready.</example>
149
149
  <param pos="0" name="service.product" value="tnftpd"/>
@@ -151,7 +151,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
151
151
  <param pos="1" name="host.name"/>
152
152
  </fingerprint>
153
153
 
154
- <fingerprint pattern="^(\S+) FTP Server \(SunOS 5.(1[1-9])\) ready\.?$" flags="REG_ICASE">
154
+ <fingerprint pattern="^(\S{1,512}) FTP Server \(SunOS 5.(1[1-9])\) ready\.?$" flags="REG_ICASE">
155
155
  <description>SunOS/Solaris</description>
156
156
  <example host.name="example.com" os.version="11">example.com FTP server (SunOS 5.11) ready.</example>
157
157
  <param pos="0" name="os.vendor" value="Oracle"/>
@@ -162,7 +162,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
162
162
  <param pos="0" name="os.cpe23" value="cpe:/o:oracle:solaris:{os.version}"/>
163
163
  </fingerprint>
164
164
 
165
- <fingerprint pattern="^(\S+) FTP Server \(SunOS 5.([789]|10)\) ready\.?$" flags="REG_ICASE">
165
+ <fingerprint pattern="^(\S{1,512}) FTP Server \(SunOS 5.([789]|10)\) ready\.?$" flags="REG_ICASE">
166
166
  <description>SunOS/Solaris 5.7-5.10</description>
167
167
  <example host.name="example.com" os.version="7">example.com FTP server (SunOS 5.7) ready.</example>
168
168
  <example host.name="example.com" os.version="10">example.com FTP server (SunOS 5.10) ready.</example>
@@ -174,7 +174,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
174
174
  <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
175
175
  </fingerprint>
176
176
 
177
- <fingerprint pattern="^(\S+) FTP Server \(SunOS 5.6\) ready\." flags="REG_ICASE">
177
+ <fingerprint pattern="^(\S{1,512}) FTP Server \(SunOS 5.6\) ready\." flags="REG_ICASE">
178
178
  <description>SunOS 5.6 (Solaris 2.6)</description>
179
179
  <example host.name="example.com">example.com FTP Server (SunOS 5.6) ready.</example>
180
180
  <param pos="0" name="os.vendor" value="Sun"/>
@@ -187,7 +187,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
187
187
 
188
188
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Debian\) \[(.+)\]$">
189
189
  <description>ProFTPD on Debian Linux</description>
190
- <example>ProFTPD 1.3.0rc2 Server (Debian) [host]</example>
190
+ <example service.version="1.3.0rc2" host.name="host">ProFTPD 1.3.0rc2 Server (Debian) [host]</example>
191
191
  <param pos="0" name="service.family" value="ProFTPD"/>
192
192
  <param pos="0" name="service.vendor" value="ProFTPD Project"/>
193
193
  <param pos="0" name="service.product" value="ProFTPD"/>
@@ -202,7 +202,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
202
202
 
203
203
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(W.+)\) \[(.+)\]$">
204
204
  <description>ProFTPD on a Linksys Wireless Access Point/Router</description>
205
- <example>ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
205
+ <example service.version="1.3.0rc2" os.product="WRT350N" hw.product="WRT350N" host.name="host">ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
206
206
  <param pos="0" name="service.family" value="ProFTPD"/>
207
207
  <param pos="0" name="service.vendor" value="ProFTPD Project"/>
208
208
  <param pos="0" name="service.product" value="ProFTPD"/>
@@ -211,6 +211,8 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
211
211
  <param pos="0" name="os.vendor" value="Linksys"/>
212
212
  <param pos="0" name="os.device" value="WAP"/>
213
213
  <param pos="2" name="os.product"/>
214
+ <param pos="0" name="hw.vendor" value="Linksys"/>
215
+ <param pos="2" name="hw.product"/>
214
216
  <param pos="3" name="host.name"/>
215
217
  </fingerprint>
216
218
 
@@ -241,24 +243,11 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
241
243
  <param pos="1" name="host.name"/>
242
244
  </fingerprint>
243
245
 
244
- <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(.*)\) \[(.+)\]$">
245
- <description>ProFTPD on a wired Linksys device</description>
246
- <param pos="0" name="service.family" value="ProFTPD"/>
247
- <param pos="0" name="service.vendor" value="ProFTPD Project"/>
248
- <param pos="0" name="service.product" value="ProFTPD"/>
249
- <param pos="1" name="service.version"/>
250
- <param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
251
- <param pos="0" name="os.vendor" value="Linksys"/>
252
- <param pos="0" name="os.device" value="Router"/>
253
- <param pos="2" name="os.product"/>
254
- <param pos="3" name="host.name"/>
255
- </fingerprint>
256
-
257
246
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[(.+)\]$">
258
247
  <description>ProFTPD with version info but no obvious OS info</description>
259
- <example service.version="1.2.10">ProFTPD 1.2.10 Server (Main FTP Server) [host]</example>
260
- <example proftpd.server.name="ProFTPD">ProFTPD 1.2.10 Server (ProFTPD) [host]</example>
261
- <example host.name="host">ProFTPD 1.2.10rc3 Server (ProFTPD Default Installation) [host]</example>
248
+ <example service.version="1.2.10" proftpd.server.name="Main FTP Server" host.name="host">ProFTPD 1.2.10 Server (Main FTP Server) [host]</example>
249
+ <example proftpd.server.name="ProFTPD" service.version="1.2.10" host.name="host">ProFTPD 1.2.10 Server (ProFTPD) [host]</example>
250
+ <example host.name="host" service.version="1.2.10rc3" proftpd.server.name="ProFTPD Default Installation">ProFTPD 1.2.10rc3 Server (ProFTPD Default Installation) [host]</example>
262
251
  <param pos="0" name="service.family" value="ProFTPD"/>
263
252
  <param pos="0" name="service.vendor" value="ProFTPD Project"/>
264
253
  <param pos="0" name="service.product" value="ProFTPD"/>
@@ -320,7 +309,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
320
309
  <param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:-"/>
321
310
  </fingerprint>
322
311
 
323
- <fingerprint pattern="^(?:\d{4}\-\d\d\-\d\d \d\d:\d\d:\d\d,\d\d\d )?(\S+) proftpd\[\d+\]: error: no valid servers configured">
312
+ <fingerprint pattern="^(?:\d{4}\-\d\d\-\d\d \d\d:\d\d:\d\d,\d\d\d )?(\S{1,512}) proftpd\[\d+\]: error: no valid servers configured">
324
313
  <description>ProFTPD no valid servers configured</description>
325
314
  <example host.name="ftp.host.com">ftp.host.com proftpd[40312]: error: no valid servers configured\n</example>
326
315
  <example host.name="hostname.com">2016-10-31 12:14:35,524 hostname.com proftpd[26992]: error: no valid servers configured\n</example>
@@ -333,9 +322,9 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
333
322
 
334
323
  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[[a-f\d.:\]]*$">
335
324
  <description>ProFTPD with version info - truncated</description>
336
- <example service.version="1.3.2c">ProFTPD 1.3.2c Server (ProFTPD Default Installation) [</example>
337
- <example proftpd.server.name="svrname.hosting.com">ProFTPD 1.3.0 Server (svrname.hosting.com) [10.10.10.</example>
338
- <example>ProFTPD 1.3.3a Server (randomstring) [::ff</example>
325
+ <example service.version="1.3.2c" proftpd.server.name="ProFTPD Default Installation">ProFTPD 1.3.2c Server (ProFTPD Default Installation) [</example>
326
+ <example proftpd.server.name="svrname.hosting.com" service.version="1.3.0">ProFTPD 1.3.0 Server (svrname.hosting.com) [10.10.10.</example>
327
+ <example service.version="1.3.3a" proftpd.server.name="randomstring">ProFTPD 1.3.3a Server (randomstring) [::ff</example>
339
328
  <param pos="0" name="service.family" value="ProFTPD"/>
340
329
  <param pos="0" name="service.vendor" value="ProFTPD Project"/>
341
330
  <param pos="0" name="service.product" value="ProFTPD"/>
@@ -369,11 +358,11 @@ more stuff</example>
369
358
 
370
359
  <fingerprint pattern="^-{9,10}(?:.*)\s+Pure-FTPd\s+(.*)-{9,10}">
371
360
  <description>Pure-FTPd versions &gt;= 1.0.14 - Config data can be zero or more of: [privsep] [TLS]</description>
372
- <example>---------- Welcome to Pure-FTPd ----------</example>
373
- <example>--------- Bienvenido a Pure-FTPd [privsep] [TLS] ----------</example>
374
- <example>--------- Pure-FTPd [privsep] ----------</example>
375
- <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------</example>
376
- <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;
361
+ <example pureftpd.config="-">---------- Welcome to Pure-FTPd ----------</example>
362
+ <example pureftpd.config="[privsep] [TLS] -">--------- Bienvenido a Pure-FTPd [privsep] [TLS] ----------</example>
363
+ <example pureftpd.config="[privsep] -">--------- Pure-FTPd [privsep] ----------</example>
364
+ <example pureftpd.config="[privsep] [TLS] -">--------- Welcome to Pure-FTPd [privsep] [TLS] ----------</example>
365
+ <example pureftpd.config="[privsep] [TLS] -">--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;
377
366
  more text</example>
378
367
  <param pos="1" name="pureftpd.config"/>
379
368
  <param pos="0" name="service.vendor" value="PureFTPd"/>
@@ -414,7 +403,7 @@ more text</example>
414
403
  <param pos="0" name="service.cpe23" value="cpe:/a:solarwinds:serv-u_ftp_server:{service.version}"/>
415
404
  </fingerprint>
416
405
 
417
- <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) for WinSock ready\.*$">
406
+ <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) for WinSock ready">
418
407
  <description>Serv-U Serv-U with version on Windows</description>
419
408
  <example service.version="2.5n">Serv-U FTP-Server v2.5n for WinSock ready...</example>
420
409
  <example service.version="6.0">Serv-U FTP Server v6.0 for WinSock ready</example>
@@ -429,7 +418,7 @@ more text</example>
429
418
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
430
419
  </fingerprint>
431
420
 
432
- <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) ready\.*$">
421
+ <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) ready">
433
422
  <description>Serv-U Serv-U with version </description>
434
423
  <example service.version="7.2">Serv-U FTP Server v7.2 ready...</example>
435
424
  <example service.version="14.0">Serv-U FTP Server v14.0 ready...</example>
@@ -443,6 +432,9 @@ more text</example>
443
432
  <fingerprint pattern="^Welcom to Serv-U FTP Server$">
444
433
  <description>Common FTP banner modification to look like Serv-U -- assert nothing.</description>
445
434
  <example>Welcom to Serv-U FTP Server</example>
435
+ <param pos="0" name="hw.certainty" value="0.0"/>
436
+ <param pos="0" name="os.certainty" value="0.0"/>
437
+ <param pos="0" name="service.certainty" value="0.0"/>
446
438
  </fingerprint>
447
439
 
448
440
  <fingerprint pattern="^zFTPServer v?(\S+), .*ready\.$" flags="REG_ICASE">
@@ -459,7 +451,7 @@ more text</example>
459
451
 
460
452
  <fingerprint pattern="^\(vsFTPd (\d+\..+)\)(?: (.+))?$">
461
453
  <description>vsFTPd (Very Secure FTP Daemon)</description>
462
- <example service.version="1.1.3">(vsFTPd 1.1.3) host</example>
454
+ <example service.version="1.1.3" host.name="host">(vsFTPd 1.1.3) host</example>
463
455
  <example service.version="2.0.5">(vsFTPd 2.0.5)</example>
464
456
  <param pos="0" name="service.vendor" value="vsFTPd Project"/>
465
457
  <param pos="0" name="service.family" value="vsFTPd"/>
@@ -488,7 +480,7 @@ more text</example>
488
480
  <param pos="1" name="service.version"/>
489
481
  </fingerprint>
490
482
 
491
- <fingerprint pattern="^OOPS: .*vsftp.*$">
483
+ <fingerprint pattern="^OOPS: .*vsftp">
492
484
  <description>vsFTPd (Very Secure FTP Daemon) error message</description>
493
485
  <example>OOPS: vsftpd: root is not mounted.</example>
494
486
  <example>OOPS: cannot read user list file:/etc/vsftpd.user_list</example>
@@ -498,7 +490,7 @@ more text</example>
498
490
  <param pos="0" name="service.cpe23" value="cpe:/a:vsftpd_project:vsftpd:-"/>
499
491
  </fingerprint>
500
492
 
501
- <fingerprint pattern="^FileZilla Server(?: version)? (?:v)?(\d\.[\w.]+(?: beta)?).*$">
493
+ <fingerprint pattern="^FileZilla Server(?: version)? (?:v)?(\d\.[\w.]+(?: beta)?)">
502
494
  <description>FileZilla FTP Server</description>
503
495
  <example service.version="0.9.2 beta">FileZilla Server version 0.9.2 beta</example>
504
496
  <example service.version="0.9.13a beta">FileZilla Server version 0.9.13a beta</example>
@@ -515,7 +507,7 @@ more text</example>
515
507
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
516
508
  </fingerprint>
517
509
 
518
- <fingerprint pattern="^\s*APC FTP server ready\.$">
510
+ <fingerprint pattern="^\s{0,1000}APC FTP server ready\.$">
519
511
  <description>APC device</description>
520
512
  <example>APC FTP server ready.</example>
521
513
  <param pos="0" name="service.vendor" value="APC"/>
@@ -526,11 +518,11 @@ more text</example>
526
518
  <param pos="0" name="hw.device" value="Power Device"/>
527
519
  </fingerprint>
528
520
 
529
- <fingerprint pattern="^(\S+) Network Management Card AOS v(\d+\..+) FTP server ready\.$">
521
+ <fingerprint pattern="^(\S{1,64}) Network Management Card AOS v(\d+\..+) FTP server ready\.$">
530
522
  <description>APC power/cooling device</description>
531
- <example service.version="3.3.4">AP7932 Network Management Card AOS v3.3.4 FTP server ready.</example>
532
- <example os.version="3.6.1">ACRC103 Network Management Card AOS v3.6.1 FTP server ready.</example>
533
- <example os.product="0G-9354-01">0G-9354-01 Network Management Card AOS v3.6.1 FTP server ready.</example>
523
+ <example service.version="3.3.4" os.product="AP7932" os.version="3.3.4">AP7932 Network Management Card AOS v3.3.4 FTP server ready.</example>
524
+ <example os.version="3.6.1" service.version="3.6.1" os.product="ACRC103">ACRC103 Network Management Card AOS v3.6.1 FTP server ready.</example>
525
+ <example os.product="0G-9354-01" service.version="3.6.1" os.version="3.6.1">0G-9354-01 Network Management Card AOS v3.6.1 FTP server ready.</example>
534
526
  <param pos="0" name="service.vendor" value="APC"/>
535
527
  <param pos="0" name="service.product" value="AOS"/>
536
528
  <param pos="0" name="service.family" value="AOS"/>
@@ -543,11 +535,11 @@ more text</example>
543
535
  <param pos="0" name="hw.device" value="Power Device"/>
544
536
  </fingerprint>
545
537
 
546
- <fingerprint pattern="^(\S+) FTP server \(EMC-SNAS: ([^\)]+)\)(?: \S+)?$">
538
+ <fingerprint pattern="^(\S{1,512}) FTP server \(EMC-SNAS: ([^\)]+)\)(?: \S+)?$">
547
539
  <description>EMC Celerra</description>
548
- <example service.version="5.6.47.11">foo2 FTP server (EMC-SNAS: 5.6.47.11)</example>
549
- <example service.version="5.6.50.203">foo2 FTP server (EMC-SNAS: 5.6.50.203) ready.</example>
550
- <example service.version="5.5.31.6">foo4 FTP server (EMC-SNAS: 5.5.31.6) r</example>
540
+ <example service.version="5.6.47.11" os.version="5.6.47.11" host.name="foo2">foo2 FTP server (EMC-SNAS: 5.6.47.11)</example>
541
+ <example service.version="5.6.50.203" os.version="5.6.50.203" host.name="foo2">foo2 FTP server (EMC-SNAS: 5.6.50.203) ready.</example>
542
+ <example service.version="5.5.31.6" os.version="5.5.31.6" host.name="foo4">foo4 FTP server (EMC-SNAS: 5.5.31.6) r</example>
551
543
  <param pos="0" name="service.vendor" value="EMC"/>
552
544
  <param pos="0" name="service.product" value="Celerra"/>
553
545
  <param pos="2" name="service.version"/>
@@ -562,7 +554,7 @@ more text</example>
562
554
  <param pos="0" name="hw.cpe23" value="cpe:/h:emc:celerra_network_attached_storage:-"/>
563
555
  </fingerprint>
564
556
 
565
- <fingerprint pattern="^JD FTP Server Ready.*$">
557
+ <fingerprint pattern="^JD FTP Server Ready">
566
558
  <description>HP JetDirect printer</description>
567
559
  <example>JD FTP Server Ready</example>
568
560
  <example>JD FTP Server Ready.</example>
@@ -608,13 +600,14 @@ more text</example>
608
600
 
609
601
  <fingerprint pattern="^---freeFTPd 1.0---warFTPd 1.65---$">
610
602
  <description>Nepenthes honeypot</description>
603
+ <example>---freeFTPd 1.0---warFTPd 1.65---</example>
611
604
  <param pos="0" name="service.family" value="Nepenthes"/>
612
605
  <param pos="0" name="service.product" value="Nepenthes"/>
613
606
  </fingerprint>
614
607
 
615
- <fingerprint pattern="^[^ ]+ IBM FTP CS (V1R\d+) at ([^,]*),.*">
608
+ <fingerprint pattern="^[^ ]{1,512} IBM FTP CS (V1R\d+) at ([^,]*),">
616
609
  <description>IBM z/OS FTP Service</description>
617
- <example>SFTPD1 IBM FTP CS V1R4 at x.y.z, 21:02:19 on 2007-12-15.</example>
610
+ <example os.version="V1R4" host.name="x.y.z">SFTPD1 IBM FTP CS V1R4 at x.y.z, 21:02:19 on 2007-12-15.</example>
618
611
  <param pos="0" name="service.vendor" value="IBM"/>
619
612
  <param pos="0" name="service.product" value="z/OS FTP Server"/>
620
613
  <param pos="0" name="os.vendor" value="IBM"/>
@@ -637,18 +630,18 @@ more text</example>
637
630
  <param pos="0" name="os.device" value="Point of Sale"/>
638
631
  </fingerprint>
639
632
 
640
- <fingerprint pattern="^([^ ]+) NcFTPd Server \(licensed copy\) ready\.$">
633
+ <fingerprint pattern="^([^ ]{1,512}) NcFTPd Server \(licensed copy\) ready\.$">
641
634
  <description>NcFTPd Server
642
635
  http://www.ncftp.com/ncftpd/</description>
643
- <example>ftp.example.com NcFTPd Server (licensed copy) ready.</example>
636
+ <example host.name="ftp.example.com">ftp.example.com NcFTPd Server (licensed copy) ready.</example>
644
637
  <param pos="0" name="service.vendor" value="NcFTP Software"/>
645
638
  <param pos="0" name="service.product" value="NcFTPd Server"/>
646
639
  <param pos="1" name="host.name"/>
647
640
  </fingerprint>
648
641
 
649
- <fingerprint pattern="^(\S+) DCS-2100 FTP server ready\.$">
642
+ <fingerprint pattern="^(\S{1,512}) DCS-2100 FTP server ready\.$">
650
643
  <description>D-Link DCS-2100 wireless internet camera</description>
651
- <example>hostname DCS-2100 FTP server ready.</example>
644
+ <example host.name="hostname">hostname DCS-2100 FTP server ready.</example>
652
645
  <param pos="0" name="os.vendor" value="D-Link"/>
653
646
  <param pos="0" name="os.product" value="DCS-2100"/>
654
647
  <param pos="0" name="os.device" value="IP Camera"/>
@@ -666,14 +659,14 @@ more text</example>
666
659
 
667
660
  <fingerprint pattern="^SUN StorEdge (\S+) RAID FTP server ready\.$">
668
661
  <description>Sun StorEdge disk array</description>
669
- <example>SUN StorEdge 3511 RAID FTP server ready.</example>
662
+ <example os.product="3511">SUN StorEdge 3511 RAID FTP server ready.</example>
670
663
  <param pos="0" name="os.vendor" value="Sun"/>
671
664
  <param pos="0" name="os.family" value="StorEdge"/>
672
665
  <param pos="1" name="os.product"/>
673
666
  <param pos="0" name="os.device" value="Storage"/>
674
667
  </fingerprint>
675
668
 
676
- <fingerprint pattern="(?i)^AXIS (\S+) .* Camera(?:\s+version)?\s+(\S+) .*">
669
+ <fingerprint pattern="(?i)^AXIS (\S+) .* Camera(?:\s+version)?\s+(\S+)">
677
670
  <description>Axis Network Camera</description>
678
671
  <example hw.product="2100" hw.version="2.43">Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
679
672
  <example hw.product="216FD" hw.version="4.47">AXIS 216FD Network Fixed Dome Camera 4.47 (Mar 13 2008) ready.</example>
@@ -690,11 +683,11 @@ more text</example>
690
683
  <param pos="0" name="os.device" value="IP Camera"/>
691
684
  </fingerprint>
692
685
 
693
- <fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?Video) (?:Encoder|Encoder Blade|Module|Server|Decoder) (\S+) .*">
686
+ <fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?Video) (?:Encoder(?: Blade)?|Module|Server|Decoder) (\S+)">
694
687
  <description>Axis Video encoders/servers</description>
695
- <example hw.product="Q7406">AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
696
- <example hw.product="241Q">AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
697
- <example hw.version="5.07.2">AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
688
+ <example hw.product="Q7406" hw.version="5.01">AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
689
+ <example hw.product="241Q" hw.version="4.47.2">AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
690
+ <example hw.version="5.07.2" hw.product="P7701">AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
698
691
  <example hw.product="Q7401" hw.version="5.01">AXIS Q7401 Video Encoder 5.01 (Aug 01 2008) ready.</example>
699
692
  <example hw.product="Q7401" hw.version="5.50.2_cst_412205_1">AXIS Q7401 Video Encoder 5.50.2_cst_412205_1 (2013)</example>
700
693
  <example hw.product="Q7424-R" hw.version="5.51.3.1">AXIS Q7424-R Mk II Video Encoder 5.51.3.1 (2016) ready.</example>
@@ -706,7 +699,7 @@ more text</example>
706
699
  <param pos="0" name="os.family" value="Linux"/>
707
700
  </fingerprint>
708
701
 
709
- <fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?IO Audio) (?:Encoder|Encoder Blade|Module|Server|Decoder) (\S+) .*">
702
+ <fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?IO Audio) (?:Encoder|Encoder Blade|Module|Server|Decoder) (\S+)">
710
703
  <description>Axis Audio encoders/servers</description>
711
704
  <example hw.product="P8221" hw.version="5.10.2">AXIS P8221 IO Audio Module 5.10.2 (Nov 07 2011) ready.</example>
712
705
  <param pos="0" name="hw.vendor" value="Axis"/>
@@ -728,9 +721,9 @@ more text</example>
728
721
 
729
722
  <fingerprint pattern="^AXIS (\S+) .*FTP Network Print Server V?([\d\.]+\S+) .* ready\.?$" flags="REG_ICASE">
730
723
  <description>Axis print servers</description>
731
- <example hw.product="5600+">AXIS 5600+ (rev 3) FTP Network Print Server V7.00 Sep 10 2004 ready.</example>
732
- <example hw.product="560">AXIS 560 FTP Network Print Server V6.00 Jul 7 1999 ready.</example>
733
- <example hw.version="6.30.beta2">AXIS 5470e FTP Network Print Server V6.30.beta2 Sep 25 2002 ready.</example>
724
+ <example hw.product="5600+" hw.version="7.00">AXIS 5600+ (rev 3) FTP Network Print Server V7.00 Sep 10 2004 ready.</example>
725
+ <example hw.product="560" hw.version="6.00">AXIS 560 FTP Network Print Server V6.00 Jul 7 1999 ready.</example>
726
+ <example hw.version="6.30.beta2" hw.product="5470e">AXIS 5470e FTP Network Print Server V6.30.beta2 Sep 25 2002 ready.</example>
734
727
  <param pos="0" name="hw.vendor" value="Axis"/>
735
728
  <param pos="0" name="hw.device" value="Print Server"/>
736
729
  <param pos="1" name="hw.product"/>
@@ -739,9 +732,9 @@ more text</example>
739
732
 
740
733
  <fingerprint pattern="^RICOH Aficio ((?:[MS]P )?\S+) FTP server \(([0-9\.a-zA-Z]+)\) ready.?$" flags="REG_ICASE">
741
734
  <description>Ricoh Aficio multifunction device</description>
742
- <example os.product="2045e">RICOH Aficio 2045e FTP server (4.12) ready.</example>
743
- <example os.version="8.63">RICOH Aficio SP 4210N FTP server (8.63) ready.</example>
744
- <example hw.product="MP C3000">RICOH Aficio MP C3000 FTP server (5.11) ready.</example>
735
+ <example os.product="2045e" hw.product="2045e" os.version="4.12">RICOH Aficio 2045e FTP server (4.12) ready.</example>
736
+ <example os.version="8.63" hw.product="SP 4210N" os.product="SP 4210N">RICOH Aficio SP 4210N FTP server (8.63) ready.</example>
737
+ <example hw.product="MP C3000" os.product="MP C3000" os.version="5.11">RICOH Aficio MP C3000 FTP server (5.11) ready.</example>
745
738
  <param pos="0" name="hw.vendor" value="Ricoh"/>
746
739
  <param pos="0" name="hw.family" value="Aficio"/>
747
740
  <param pos="0" name="hw.device" value="Multifunction Device"/>
@@ -755,14 +748,14 @@ more text</example>
755
748
 
756
749
  <fingerprint pattern="^NRG ((?:[MS]P )?\S+) FTP server \(([0-9\.a-zA-Z]+)\) ready.?$" flags="REG_ICASE">
757
750
  <description>Ricoh NRG multifunction device</description>
758
- <example>NRG MP C2800 FTP server (8.25) ready.</example>
759
- <example>NRG MP 3350 FTP server (7.05) ready.</example>
760
- <example>NRG MP C3500 FTP server (5.17) ready.</example>
761
- <example>NRG MP 171 FTP server (9.02.1) ready.</example>
762
- <example>NRG MP C2550 FTP server (8.25) ready.</example>
763
- <example>NRG MP C3500 FTP server (5.19) ready.</example>
764
- <example>NRG MP C4000 FTP server (8.30) ready.</example>
765
- <example>NRG MP C4500 FTP server (5.14) ready.</example>
751
+ <example os.product="MP C2800" os.version="8.25" hw.product="MP C2800">NRG MP C2800 FTP server (8.25) ready.</example>
752
+ <example os.product="MP 3350" os.version="7.05" hw.product="MP 3350">NRG MP 3350 FTP server (7.05) ready.</example>
753
+ <example os.product="MP C3500" os.version="5.17" hw.product="MP C3500">NRG MP C3500 FTP server (5.17) ready.</example>
754
+ <example os.product="MP 171" os.version="9.02.1" hw.product="MP 171">NRG MP 171 FTP server (9.02.1) ready.</example>
755
+ <example os.product="MP C2550" os.version="8.25" hw.product="MP C2550">NRG MP C2550 FTP server (8.25) ready.</example>
756
+ <example os.product="MP C3500" os.version="5.19" hw.product="MP C3500">NRG MP C3500 FTP server (5.19) ready.</example>
757
+ <example os.product="MP C4000" os.version="8.30" hw.product="MP C4000">NRG MP C4000 FTP server (8.30) ready.</example>
758
+ <example os.product="MP C4500" os.version="5.14" hw.product="MP C4500">NRG MP C4500 FTP server (5.14) ready.</example>
766
759
  <param pos="0" name="os.vendor" value="Ricoh"/>
767
760
  <param pos="0" name="os.device" value="Multifunction Device"/>
768
761
  <param pos="1" name="os.product"/>
@@ -772,7 +765,7 @@ more text</example>
772
765
  <param pos="1" name="hw.product"/>
773
766
  </fingerprint>
774
767
 
775
- <fingerprint pattern="^Xerox WorkCentre ([A-Za-z0-9]+).*$" certainty="1.0">
768
+ <fingerprint pattern="^Xerox WorkCentre ([A-Za-z0-9]+)" certainty="1.0">
776
769
  <description>Xerox WorkCentre</description>
777
770
  <example hw.product="6605DN">Xerox WorkCentre 6605DN</example>
778
771
  <example hw.product="3615">Xerox WorkCentre 3615</example>
@@ -789,8 +782,8 @@ more text</example>
789
782
 
790
783
  <fingerprint pattern="^Xerox Phaser (\S+)$" certainty="1.0">
791
784
  <description>Xerox Phaser Laser Printer</description>
792
- <example>Xerox Phaser 6130N</example>
793
- <example>Xerox Phaser 6180MFP-D</example>
785
+ <example os.product="6130N" hw.product="6130N">Xerox Phaser 6130N</example>
786
+ <example os.product="6180MFP-D" hw.product="6180MFP-D">Xerox Phaser 6180MFP-D</example>
794
787
  <param pos="0" name="os.vendor" value="Xerox"/>
795
788
  <param pos="0" name="os.family" value="Phaser"/>
796
789
  <param pos="0" name="os.device" value="Printer"/>
@@ -801,9 +794,9 @@ more text</example>
801
794
  <param pos="1" name="hw.product"/>
802
795
  </fingerprint>
803
796
 
804
- <fingerprint pattern="^XEROX (\d+) Wide Format .*$" certainty="1.0">
797
+ <fingerprint pattern="^XEROX (\d+) Wide Format" certainty="1.0">
805
798
  <description>Xerox Wide Format Series of Printers</description>
806
- <example>XEROX 6204 Wide Format FTP server ready</example>
799
+ <example os.product="6204" hw.product="6204">XEROX 6204 Wide Format FTP server ready</example>
807
800
  <param pos="0" name="os.vendor" value="Xerox"/>
808
801
  <param pos="0" name="os.family" value="Wide Format"/>
809
802
  <param pos="0" name="os.device" value="Printer"/>
@@ -816,9 +809,9 @@ more text</example>
816
809
 
817
810
  <fingerprint pattern="^FUJI XEROX DocuPrint (.*)$" certainty="1.0">
818
811
  <description>FUJI XEROX DocuPrint Series of Printers</description>
819
- <example>FUJI XEROX DocuPrint 3055</example>
820
- <example>FUJI XEROX DocuPrint C1190 FS</example>
821
- <example>FUJI XEROX DocuPrint C2100</example>
812
+ <example os.product="3055">FUJI XEROX DocuPrint 3055</example>
813
+ <example os.product="C1190 FS">FUJI XEROX DocuPrint C1190 FS</example>
814
+ <example os.product="C2100">FUJI XEROX DocuPrint C2100</example>
822
815
  <param pos="0" name="os.vendor" value="FUJI XEROX"/>
823
816
  <param pos="0" name="os.family" value="DocuPrint"/>
824
817
  <param pos="0" name="os.device" value="Printer"/>
@@ -837,7 +830,7 @@ more text</example>
837
830
  <param pos="2" name="hw.product"/>
838
831
  </fingerprint>
839
832
 
840
- <fingerprint pattern="^.*Lexmark (\S+) FTP Server (\S+) ready\.?$" certainty="1.0" flags="REG_ICASE">
833
+ <fingerprint pattern="Lexmark (\S+) FTP Server (\S+) ready\.?$" certainty="1.0" flags="REG_ICASE">
841
834
  <description>Lexmark printer with OS version</description>
842
835
  <example hw.product="T654" os.version="NR.APS.F368">ET0021718 Lexmark T654 FTP Server NR.APS.F368 ready.</example>
843
836
  <param pos="0" name="os.vendor" value="Lexmark"/>
@@ -848,7 +841,7 @@ more text</example>
848
841
  <param pos="1" name="hw.product"/>
849
842
  </fingerprint>
850
843
 
851
- <fingerprint pattern="^.*Lexmark (\S+) FTP Server ready\.?$" certainty="1.0" flags="REG_ICASE">
844
+ <fingerprint pattern="Lexmark (\S+) FTP Server ready\.?$" certainty="1.0" flags="REG_ICASE">
852
845
  <description>Lexmark printer</description>
853
846
  <example hw.product="X500">Lexmark X500 FTP server ready</example>
854
847
  <param pos="0" name="os.vendor" value="Lexmark"/>
@@ -888,7 +881,7 @@ more text</example>
888
881
  <param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:-"/>
889
882
  </fingerprint>
890
883
 
891
- <fingerprint pattern="^[\w\-\.]* FTP server \((?:VxWorks\s?)+([\d\.]+)\) ready.$" flags="REG_ICASE">
884
+ <fingerprint pattern="^[\w\-\.]{0,128} FTP server \((?:VxWorks\s?)+([\d\.]+)\) ready.$" flags="REG_ICASE">
892
885
  <description>VxWorks 6 with version information</description>
893
886
  <example os.version="6.6">NanoDAC FTP server (VxWorks VxWorks 6.6) ready.</example>
894
887
  <example os.version="6.4">BVS-MR-BSC2 FTP server (VxWorks 6.4) ready.</example>
@@ -898,7 +891,7 @@ more text</example>
898
891
  <param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
899
892
  </fingerprint>
900
893
 
901
- <fingerprint pattern="^[\w&lt;&gt;]+\s*Tenor Multipath Switch FTP server \(Version VxWorks([\d\.]+)\) ready\.$" flags="REG_ICASE">
894
+ <fingerprint pattern="^[\w&lt;&gt;]{1,32}\s{1,8}Tenor Multipath Switch FTP server \(Version VxWorks([\d\.]+)\) ready\.$" flags="REG_ICASE">
902
895
  <description>VxWorks on Tenor MultiPath with version information</description>
903
896
  <example os.version="5.4.2">&lt;38785ca0&gt; Tenor Multipath Switch FTP server (Version VxWorks5.4.2) ready.</example>
904
897
  <param pos="0" name="os.vendor" value="Wind River"/>
@@ -927,8 +920,8 @@ more text</example>
927
920
 
928
921
  <fingerprint pattern="^TASKalfa (\d+c?i) FTP server" certainty="1.0">
929
922
  <description>Taskalfa Series of Printers</description>
930
- <example>TASKalfa 300ci FTP server</example>
931
- <example>TASKalfa 520i FTP server</example>
923
+ <example os.product="300ci" hw.product="300ci">TASKalfa 300ci FTP server</example>
924
+ <example os.product="520i" hw.product="520i">TASKalfa 520i FTP server</example>
932
925
  <param pos="0" name="os.vendor" value="Kyocera"/>
933
926
  <param pos="0" name="os.family" value="TASKalfa"/>
934
927
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -941,16 +934,16 @@ more text</example>
941
934
 
942
935
  <fingerprint pattern="^SAVIN (\S+) FTP server \((.*)\) ready.$" certainty="1.0">
943
936
  <description>SAVIN Printer FTP Server</description>
944
- <example os.product="4075">SAVIN 4075 FTP server (4.08) ready.</example>
945
- <example hw.product="9025">SAVIN 9025 FTP server (7.23) ready.</example>
946
- <example os.version="7.30">SAVIN 9050 FTP server (7.30) ready.</example>
947
- <example os.version="9.03">SAVIN 917 FTP server (9.03) ready.</example>
948
- <example>SAVIN 917 FTP server (9.05.2) ready.</example>
949
- <example>SAVIN C2525 FTP server (5.14) ready.</example>
950
- <example>SAVIN C3528 FTP server (4.08.3) ready.</example>
951
- <example>SAVIN C3528 FTP server (4.17) ready.</example>
952
- <example>SAVIN C6055 FTP server (7.16) ready.</example>
953
- <example>SAVIN C9145 FTP server (10.51) ready.</example>
937
+ <example os.product="4075" os.version="4.08" hw.product="4075">SAVIN 4075 FTP server (4.08) ready.</example>
938
+ <example hw.product="9025" os.product="9025" os.version="7.23">SAVIN 9025 FTP server (7.23) ready.</example>
939
+ <example os.version="7.30" os.product="9050" hw.product="9050">SAVIN 9050 FTP server (7.30) ready.</example>
940
+ <example os.version="9.03" os.product="917" hw.product="917">SAVIN 917 FTP server (9.03) ready.</example>
941
+ <example os.product="917" os.version="9.05.2" hw.product="917">SAVIN 917 FTP server (9.05.2) ready.</example>
942
+ <example os.product="C2525" os.version="5.14" hw.product="C2525">SAVIN C2525 FTP server (5.14) ready.</example>
943
+ <example os.product="C3528" os.version="4.08.3" hw.product="C3528">SAVIN C3528 FTP server (4.08.3) ready.</example>
944
+ <example os.product="C3528" os.version="4.17" hw.product="C3528">SAVIN C3528 FTP server (4.17) ready.</example>
945
+ <example os.product="C6055" os.version="7.16" hw.product="C6055">SAVIN C6055 FTP server (7.16) ready.</example>
946
+ <example os.product="C9145" os.version="10.51" hw.product="C9145">SAVIN C9145 FTP server (10.51) ready.</example>
954
947
  <param pos="0" name="os.vendor" value="Savin"/>
955
948
  <param pos="0" name="os.device" value="Printer"/>
956
949
  <param pos="1" name="os.product"/>
@@ -962,8 +955,8 @@ more text</example>
962
955
 
963
956
  <fingerprint pattern="^Oce (im\d+) Ver (\S+) FTP server\.$" certainty="1.0">
964
957
  <description>OCE IM series Printer</description>
965
- <example>Oce im4512 Ver 01.04.00.0c FTP server.</example>
966
- <example>Oce im3512 Ver 01.04.00.0c FTP server.</example>
958
+ <example os.product="im4512" os.version="01.04.00.0c">Oce im4512 Ver 01.04.00.0c FTP server.</example>
959
+ <example os.product="im3512" os.version="01.04.00.0c">Oce im3512 Ver 01.04.00.0c FTP server.</example>
967
960
  <param pos="0" name="os.vendor" value="Oce"/>
968
961
  <param pos="0" name="os.device" value="Multifunction Device"/>
969
962
  <param pos="0" name="os.family" value="IM Series"/>
@@ -973,7 +966,7 @@ more text</example>
973
966
 
974
967
  <fingerprint pattern="^Oce (Plotwave\d+) FTP Service \(Version (\S+)\)\.$" certainty="1.0">
975
968
  <description>OCE Printer</description>
976
- <example>Oce Plotwave300 FTP Service (Version 4.5.7).</example>
969
+ <example os.product="Plotwave300" os.version="4.5.7">Oce Plotwave300 FTP Service (Version 4.5.7).</example>
977
970
  <param pos="0" name="os.vendor" value="Oce"/>
978
971
  <param pos="0" name="os.device" value="Printer"/>
979
972
  <param pos="0" name="os.family" value="Plotwave Series"/>
@@ -1002,10 +995,10 @@ more text</example>
1002
995
 
1003
996
  <fingerprint pattern="^LXKE\S+ IBM Infoprint (\d+) FTP Server (\d+\.\d+\.\d+) ready.$" certainty="1.0">
1004
997
  <description>IBM Infoprint FTP</description>
1005
- <example>LXKE82124 IBM Infoprint 1332 FTP Server 55.10.21 ready.</example>
1006
- <example>LXKE8255D IBM Infoprint 1332 FTP Server 55.10.21 ready.</example>
1007
- <example>LXKE825A0 IBM Infoprint 1332 FTP Server 55.10.21 ready.</example>
1008
- <example>LXKE93276 IBM Infoprint 1332 FTP Server 55.10.19 ready.</example>
998
+ <example os.product="1332" os.version="55.10.21">LXKE82124 IBM Infoprint 1332 FTP Server 55.10.21 ready.</example>
999
+ <example os.product="1332" os.version="55.10.21">LXKE8255D IBM Infoprint 1332 FTP Server 55.10.21 ready.</example>
1000
+ <example os.product="1332" os.version="55.10.21">LXKE825A0 IBM Infoprint 1332 FTP Server 55.10.21 ready.</example>
1001
+ <example os.product="1332" os.version="55.10.19">LXKE93276 IBM Infoprint 1332 FTP Server 55.10.19 ready.</example>
1009
1002
  <param pos="0" name="os.vendor" value="Ricoh"/>
1010
1003
  <param pos="0" name="os.family" value="Infoprint"/>
1011
1004
  <param pos="0" name="os.device" value="Printer"/>
@@ -1017,9 +1010,9 @@ more text</example>
1017
1010
  <description>Gestetner Printer FTP</description>
1018
1011
  <example os.product="Gestetner MP5500/DSm755" os.version="5.11c">Gestetner MP5500/DSm755 FTP server (5.11c) ready.</example>
1019
1012
  <example os.product="Gestetner MP C4502" os.version="11.77">Gestetner MP C4502 FTP server (11.77) ready.</example>
1020
- <example>Gestetner MP 161/DSm416 FTP server (6.11) ready. </example>
1021
- <example>Gestetner 3502 FTP server (1.66.1) ready</example>
1022
- <example>Gestetner C7526dn FTP server (6.05.1) ready.</example>
1013
+ <example os.product="Gestetner MP 161/DSm416" os.version="6.11">Gestetner MP 161/DSm416 FTP server (6.11) ready. </example>
1014
+ <example os.product="Gestetner 3502" os.version="1.66.1">Gestetner 3502 FTP server (1.66.1) ready</example>
1015
+ <example os.product="Gestetner C7526dn" os.version="6.05.1">Gestetner C7526dn FTP server (6.05.1) ready.</example>
1023
1016
  <param pos="0" name="os.vendor" value="Ricoh"/>
1024
1017
  <param pos="0" name="os.device" value="Multifunction Device"/>
1025
1018
  <param pos="1" name="os.product"/>
@@ -1028,7 +1021,7 @@ more text</example>
1028
1021
 
1029
1022
  <fingerprint pattern="^(Gestetner \S+)$" certainty="1.0">
1030
1023
  <description>Gestetner Printer FTP - short banner</description>
1031
- <example>Gestetner MPC2500</example>
1024
+ <example os.product="Gestetner MPC2500">Gestetner MPC2500</example>
1032
1025
  <param pos="0" name="os.vendor" value="Ricoh"/>
1033
1026
  <param pos="0" name="os.device" value="Multifunction Device"/>
1034
1027
  <param pos="1" name="os.product"/>
@@ -1036,7 +1029,7 @@ more text</example>
1036
1029
 
1037
1030
  <fingerprint pattern="^EUFSALE MarkNet (\S+) FTP Server (\d+\.\d+\.\d+) ready.$" certainty="1.0">
1038
1031
  <description>Lexmark Marknet Printers FTP</description>
1039
- <example>EUFSALE MarkNet X2011e FTP Server 4.20.21 ready.</example>
1032
+ <example os.product="X2011e" os.version="4.20.21">EUFSALE MarkNet X2011e FTP Server 4.20.21 ready.</example>
1040
1033
  <param pos="0" name="os.vendor" value="Lexmark"/>
1041
1034
  <param pos="0" name="os.family" value="MarkNet"/>
1042
1035
  <param pos="0" name="os.device" value="Print Server"/>
@@ -1044,11 +1037,11 @@ more text</example>
1044
1037
  <param pos="2" name="os.version"/>
1045
1038
  </fingerprint>
1046
1039
 
1047
- <fingerprint pattern="^ET(\S+) Source Technologies (ST-96\S+) FTP Server (\S+) ready\.?$">
1040
+ <fingerprint pattern="^ET(\S{1,12}) Source Technologies (ST-96\S+) FTP Server (\S+) ready\.?$">
1048
1041
  <description>Source Technologies ST9600 Series Secure Printer</description>
1049
- <example>ET0021B730F70E Source Technologies ST-9620 FTP Server NJ.APS.N254e ready.</example>
1050
- <example>ET0021B7549AF2 Source Technologies ST-9620 FTP Server NR.APS.N447b2 ready.</example>
1051
- <example>ET0021B7300F01 Source Technologies ST-9620 FTP Server NJ.APS.N254e ready.</example>
1042
+ <example host.mac="0021B730F70E" os.product="ST-9620" os.version="NJ.APS.N254e">ET0021B730F70E Source Technologies ST-9620 FTP Server NJ.APS.N254e ready.</example>
1043
+ <example host.mac="0021B7549AF2" os.product="ST-9620" os.version="NR.APS.N447b2">ET0021B7549AF2 Source Technologies ST-9620 FTP Server NR.APS.N447b2 ready.</example>
1044
+ <example host.mac="0021B7300F01" os.product="ST-9620" os.version="NJ.APS.N254e">ET0021B7300F01 Source Technologies ST-9620 FTP Server NJ.APS.N254e ready.</example>
1052
1045
  <param pos="0" name="os.vendor" value="Source Technologies"/>
1053
1046
  <param pos="0" name="os.family" value="ST9600 Series"/>
1054
1047
  <param pos="0" name="os.device" value="Printer"/>
@@ -1057,7 +1050,7 @@ more text</example>
1057
1050
  <param pos="3" name="os.version"/>
1058
1051
  </fingerprint>
1059
1052
 
1060
- <fingerprint pattern="^ET(\S+) (Pro\d+) Series FTP Server ready\.$" certainty="1.0">
1053
+ <fingerprint pattern="^ET(\S{1,12}) (Pro\d+) Series FTP Server ready\.$" certainty="1.0">
1061
1054
  <description>Lexmark ProXXX Series of Printers</description>
1062
1055
  <example host.mac="0020007E4D2A" hw.product="Pro700">ET0020007E4D2A Pro700 Series FTP Server ready.</example>
1063
1056
  <param pos="0" name="os.vendor" value="Lexmark"/>
@@ -1070,9 +1063,9 @@ more text</example>
1070
1063
  <param pos="2" name="hw.product"/>
1071
1064
  </fingerprint>
1072
1065
 
1073
- <fingerprint pattern="^ET(\S+) Lexmark Forms Printer (\d+) Ethernet FTP Server (\S+) ready\.$" certainty="1.0">
1066
+ <fingerprint pattern="^ET(\S{1,12}) Lexmark Forms Printer (\d+) Ethernet FTP Server (\S+) ready\.$" certainty="1.0">
1074
1067
  <description>Lexmark Forms Printer</description>
1075
- <example os.product="2590">ET0020004F54EE Lexmark Forms Printer 2590 Ethernet FTP Server LCL.CU.P012c ready.</example>
1068
+ <example os.product="2590" host.mac="0020004F54EE" os.version="LCL.CU.P012c" hw.product="2590">ET0020004F54EE Lexmark Forms Printer 2590 Ethernet FTP Server LCL.CU.P012c ready.</example>
1076
1069
  <param pos="0" name="os.vendor" value="Lexmark"/>
1077
1070
  <param pos="0" name="os.family" value="Forms Printer"/>
1078
1071
  <param pos="0" name="os.device" value="Printer"/>
@@ -1085,10 +1078,10 @@ more text</example>
1085
1078
  <param pos="2" name="hw.product"/>
1086
1079
  </fingerprint>
1087
1080
 
1088
- <fingerprint pattern="^ET(\S+) TOSHIBA e-STUDIO500S FTP Server (\S+) ready\.$" certainty="1.0">
1081
+ <fingerprint pattern="^ET(\S{1,12}) TOSHIBA e-STUDIO500S FTP Server (\S+) ready\.$" certainty="1.0">
1089
1082
  <description>Toshiba e-STUDIO Printer with MAC address</description>
1090
- <example os.version="NC2.NPS.N221">ET0004001E9C00 TOSHIBA e-STUDIO500S FTP Server NC2.NPS.N221 ready.</example>
1091
- <example host.mac="00040089BE42">ET00040089BE42 TOSHIBA e-STUDIO500S FTP Server NC2.NPS.N211 ready.</example>
1083
+ <example os.version="NC2.NPS.N221" host.mac="0004001E9C00">ET0004001E9C00 TOSHIBA e-STUDIO500S FTP Server NC2.NPS.N221 ready.</example>
1084
+ <example host.mac="00040089BE42" os.version="NC2.NPS.N211">ET00040089BE42 TOSHIBA e-STUDIO500S FTP Server NC2.NPS.N211 ready.</example>
1092
1085
  <param pos="0" name="os.vendor" value="Toshiba"/>
1093
1086
  <param pos="0" name="os.device" value="Multifunction Device"/>
1094
1087
  <param pos="0" name="os.product" value="e-STUDIO"/>
@@ -1099,7 +1092,7 @@ more text</example>
1099
1092
  <param pos="0" name="hw.product" value="e-STUDIO"/>
1100
1093
  </fingerprint>
1101
1094
 
1102
- <fingerprint pattern="^\S+ TOSHIBA e-STUDIO500S FTP Server (\S+) ready\.$" certainty="1.0">
1095
+ <fingerprint pattern="^\S{1,16} TOSHIBA e-STUDIO500S FTP Server (\S+) ready\.$" certainty="1.0">
1103
1096
  <description>Toshiba e-STUDIO Printer</description>
1104
1097
  <example os.version="NC2.NPS.N211">JHBPRN13 TOSHIBA e-STUDIO500S FTP Server NC2.NPS.N211 ready.</example>
1105
1098
  <param pos="0" name="os.vendor" value="Toshiba"/>
@@ -1111,10 +1104,10 @@ more text</example>
1111
1104
  <param pos="0" name="hw.product" value="e-STUDIO"/>
1112
1105
  </fingerprint>
1113
1106
 
1114
- <fingerprint pattern="^.*Lexmark Optra (\S+) FTP Server (\S+) ready\.$" certainty="1.0">
1107
+ <fingerprint pattern="Lexmark Optra (\S+) FTP Server (\S+) ready\.$" certainty="1.0">
1115
1108
  <description>Lexmark Optra Printer</description>
1116
- <example os.product="T612">lex142785470853 Lexmark Optra T612 FTP Server 3.20.30 ready.</example>
1117
- <example os.version="3.20.20">oppr1.s02504.us Lexmark Optra T610 FTP Server 3.20.20 ready.</example>
1109
+ <example os.product="T612" os.version="3.20.30" hw.product="T612">lex142785470853 Lexmark Optra T612 FTP Server 3.20.30 ready.</example>
1110
+ <example os.version="3.20.20" os.product="T610" hw.product="T610">oppr1.s02504.us Lexmark Optra T610 FTP Server 3.20.20 ready.</example>
1118
1111
  <param pos="0" name="os.vendor" value="Lexmark"/>
1119
1112
  <param pos="0" name="os.family" value="Optra"/>
1120
1113
  <param pos="0" name="os.device" value="Printer"/>
@@ -1128,15 +1121,15 @@ more text</example>
1128
1121
 
1129
1122
  <fingerprint pattern="^SHARP (MX-\S+) Ver (\S+) FTP server\.$" certainty="1.0">
1130
1123
  <description>Sharp Printer/Copier/Scanne</description>
1131
- <example os.product="MX-6200N" os.version="01.02.00.0e">SHARP MX-6200N Ver 01.02.00.0e FTP server.</example>
1132
- <example>SHARP MX-M363N Ver 01.05.00.0k FTP server.</example>
1133
- <example>SHARP MX-M363N Ver 01.05.00.1k FTP server.</example>
1134
- <example>SHARP MX-5001N Ver 01.05.00.0n FTP server.</example>
1135
- <example>SHARP MX-5500N Ver 01.02.00.09 FTP server.</example>
1136
- <example>SHARP MX-M453N Ver 01.05.00.0k FTP server.</example>
1137
- <example>SHARP MX-M503N Ver 01.05.00.1k FTP server.</example>
1138
- <example>SHARP MX-M620U Ver 01.03.00 FTP server.</example>
1139
- <example>SHARP MX-M620U Ver 01.04.00.04 FTP server.</example>
1124
+ <example os.product="MX-6200N" os.version="01.02.00.0e" hw.product="MX-6200N">SHARP MX-6200N Ver 01.02.00.0e FTP server.</example>
1125
+ <example os.product="MX-M363N" os.version="01.05.00.0k" hw.product="MX-M363N">SHARP MX-M363N Ver 01.05.00.0k FTP server.</example>
1126
+ <example os.product="MX-M363N" os.version="01.05.00.1k" hw.product="MX-M363N">SHARP MX-M363N Ver 01.05.00.1k FTP server.</example>
1127
+ <example os.product="MX-5001N" os.version="01.05.00.0n" hw.product="MX-5001N">SHARP MX-5001N Ver 01.05.00.0n FTP server.</example>
1128
+ <example os.product="MX-5500N" os.version="01.02.00.09" hw.product="MX-5500N">SHARP MX-5500N Ver 01.02.00.09 FTP server.</example>
1129
+ <example os.product="MX-M453N" os.version="01.05.00.0k" hw.product="MX-M453N">SHARP MX-M453N Ver 01.05.00.0k FTP server.</example>
1130
+ <example os.product="MX-M503N" os.version="01.05.00.1k" hw.product="MX-M503N">SHARP MX-M503N Ver 01.05.00.1k FTP server.</example>
1131
+ <example os.product="MX-M620U" os.version="01.03.00" hw.product="MX-M620U">SHARP MX-M620U Ver 01.03.00 FTP server.</example>
1132
+ <example os.product="MX-M620U" os.version="01.04.00.04" hw.product="MX-M620U">SHARP MX-M620U Ver 01.04.00.04 FTP server.</example>
1140
1133
  <param pos="0" name="os.vendor" value="Sharp"/>
1141
1134
  <param pos="0" name="os.device" value="Printer"/>
1142
1135
  <param pos="0" name="os.family" value="MX Series"/>
@@ -1150,9 +1143,9 @@ more text</example>
1150
1143
 
1151
1144
  <fingerprint pattern="^(FS-\S+MFP\S*?) FTP server\.?$" certainty="1.0">
1152
1145
  <description>Kyocera Printer with version string</description>
1153
- <example os.product="FS-C2126MFP">FS-C2126MFP FTP server</example>
1154
- <example hw.product="FS-C2026MFP+">FS-C2026MFP+ FTP server</example>
1155
- <example hw.product="FS-1128MFP">FS-1128MFP FTP server</example>
1146
+ <example os.product="FS-C2126MFP" hw.product="FS-C2126MFP">FS-C2126MFP FTP server</example>
1147
+ <example hw.product="FS-C2026MFP+" os.product="FS-C2026MFP+">FS-C2026MFP+ FTP server</example>
1148
+ <example hw.product="FS-1128MFP" os.product="FS-1128MFP">FS-1128MFP FTP server</example>
1156
1149
  <param pos="0" name="os.vendor" value="Kyocera"/>
1157
1150
  <param pos="0" name="os.device" value="Multifunction Device"/>
1158
1151
  <param pos="1" name="os.product"/>
@@ -1163,8 +1156,8 @@ more text</example>
1163
1156
 
1164
1157
  <fingerprint pattern="^(FS-\S+(?:DN|D|N)) FTP server\.?$" certainty="1.0">
1165
1158
  <description>Kyocera Printer</description>
1166
- <example os.product="FS-1370DN">FS-1370DN FTP server</example>
1167
- <example hw.product="FS-C5015N">FS-C5015N FTP server.</example>
1159
+ <example os.product="FS-1370DN" hw.product="FS-1370DN">FS-1370DN FTP server</example>
1160
+ <example hw.product="FS-C5015N" os.product="FS-C5015N">FS-C5015N FTP server.</example>
1168
1161
  <param pos="0" name="os.vendor" value="Kyocera"/>
1169
1162
  <param pos="0" name="os.device" value="Printer"/>
1170
1163
  <param pos="0" name="os.family" value="FS"/>
@@ -1177,16 +1170,16 @@ more text</example>
1177
1170
 
1178
1171
  <fingerprint pattern="^(ESI-\S+) Version (\S+) ready\.$" certainty="1.0">
1179
1172
  <description>Extended Systems ExtendNet Print Server</description>
1180
- <example os.product="ESI-2941B">ESI-2941B Version 6.34 ready.</example>
1181
- <example os.version="6.03">ESI-2941A Version 6.03 ready.</example>
1182
- <example hw.product="ESI-2933A">ESI-2933A Version 6.40 ready.</example>
1183
- <example>ESI-2831 Version 2.1 ready.</example>
1184
- <example>ESI-2833A Version 6.3 ready.</example>
1185
- <example>ESI-2900A Version 6.31 ready.</example>
1186
- <example>ESI-2841B Version 3.01 ready.</example>
1187
- <example>ESI-2841C Version 5.09e ready.</example>
1188
- <example>ESI-2933A Version 6.40a.05 ready.</example>
1189
- <example>ESI-2999A Version 6.30a.07 ready.</example>
1173
+ <example os.product="ESI-2941B" os.version="6.34" hw.product="ESI-2941B">ESI-2941B Version 6.34 ready.</example>
1174
+ <example os.version="6.03" os.product="ESI-2941A" hw.product="ESI-2941A">ESI-2941A Version 6.03 ready.</example>
1175
+ <example hw.product="ESI-2933A" os.product="ESI-2933A" os.version="6.40">ESI-2933A Version 6.40 ready.</example>
1176
+ <example os.product="ESI-2831" os.version="2.1" hw.product="ESI-2831">ESI-2831 Version 2.1 ready.</example>
1177
+ <example os.product="ESI-2833A" os.version="6.3" hw.product="ESI-2833A">ESI-2833A Version 6.3 ready.</example>
1178
+ <example os.product="ESI-2900A" os.version="6.31" hw.product="ESI-2900A">ESI-2900A Version 6.31 ready.</example>
1179
+ <example os.product="ESI-2841B" os.version="3.01" hw.product="ESI-2841B">ESI-2841B Version 3.01 ready.</example>
1180
+ <example os.product="ESI-2841C" os.version="5.09e" hw.product="ESI-2841C">ESI-2841C Version 5.09e ready.</example>
1181
+ <example os.product="ESI-2933A" os.version="6.40a.05" hw.product="ESI-2933A">ESI-2933A Version 6.40a.05 ready.</example>
1182
+ <example os.product="ESI-2999A" os.version="6.30a.07" hw.product="ESI-2999A">ESI-2999A Version 6.30a.07 ready.</example>
1190
1183
  <param pos="0" name="os.vendor" value="Sybase"/>
1191
1184
  <param pos="0" name="os.family" value="Extended Systems ExtendNet"/>
1192
1185
  <param pos="0" name="os.device" value="Print Server"/>
@@ -1200,7 +1193,7 @@ more text</example>
1200
1193
  <fingerprint pattern="^SATO SATO PRINTER Ver (\S+) FTP server\.$" certainty="1.0">
1201
1194
  <description>SATO Printer</description>
1202
1195
  <example os.version="A1.2.3">SATO SATO PRINTER Ver A1.2.3 FTP server.</example>
1203
- <example>SATO SATO PRINTER Ver A2.3.0 FTP server.</example>
1196
+ <example os.version="A2.3.0">SATO SATO PRINTER Ver A2.3.0 FTP server.</example>
1204
1197
  <param pos="0" name="os.vendor" value="SATO"/>
1205
1198
  <param pos="0" name="os.device" value="Printer"/>
1206
1199
  <param pos="1" name="os.version"/>
@@ -1210,11 +1203,11 @@ more text</example>
1210
1203
 
1211
1204
  <fingerprint pattern="^Printer FTP (\d+\.\d+\.\d+) ready at (\w{3} \d{2} \d{2}:\d{2}:\d{2})$" certainty="1.0">
1212
1205
  <description>AMTDatasouth Fastmark M5</description>
1213
- <example os.version="4.8.7">Printer FTP 4.8.7 ready at Apr 30 20:13:23</example>
1214
- <example system.time="Aug 31 16:43:22">Printer FTP 4.8.7 ready at Aug 31 16:43:22</example>
1215
- <example>Printer FTP 4.8.7 ready at Feb 28 11:27:46</example>
1216
- <example>Printer FTP 4.8.7 ready at Jan 31 00:40:04</example>
1217
- <example>Printer FTP 4.8.7 ready at Mar 31 06:28:25</example>
1206
+ <example os.version="4.8.7" system.time="Apr 30 20:13:23">Printer FTP 4.8.7 ready at Apr 30 20:13:23</example>
1207
+ <example system.time="Aug 31 16:43:22" os.version="4.8.7">Printer FTP 4.8.7 ready at Aug 31 16:43:22</example>
1208
+ <example os.version="4.8.7" system.time="Feb 28 11:27:46">Printer FTP 4.8.7 ready at Feb 28 11:27:46</example>
1209
+ <example os.version="4.8.7" system.time="Jan 31 00:40:04">Printer FTP 4.8.7 ready at Jan 31 00:40:04</example>
1210
+ <example os.version="4.8.7" system.time="Mar 31 06:28:25">Printer FTP 4.8.7 ready at Mar 31 06:28:25</example>
1218
1211
  <param pos="0" name="os.vendor" value="AMTDatasouth"/>
1219
1212
  <param pos="0" name="os.product" value="Fastmark M5"/>
1220
1213
  <param pos="0" name="os.device" value="Printer"/>
@@ -1240,7 +1233,7 @@ more text</example>
1240
1233
 
1241
1234
  <fingerprint pattern="^SHARP (AR-\S+) Ver (\S+) FTP server">
1242
1235
  <description>Sharp AR Series multifunction device</description>
1243
- <example os.product="AR-M450">SHARP AR-M450 Ver 01.05.00.0k FTP server.</example>
1236
+ <example os.product="AR-M450" os.version="01.05.00.0k" hw.product="AR-M450">SHARP AR-M450 Ver 01.05.00.0k FTP server.</example>
1244
1237
  <param pos="0" name="os.vendor" value="Sharp"/>
1245
1238
  <param pos="0" name="os.device" value="Multifunction Device"/>
1246
1239
  <param pos="0" name="os.family" value="AR Series"/>
@@ -1268,13 +1261,13 @@ more text</example>
1268
1261
  <fingerprint pattern="^(KM\S+) FTP server \(KM FTPD version (\d*(?:\.\d*))\) ready\.?$">
1269
1262
  <description>Konica Minolta FTP Server</description>
1270
1263
  <example os.product="KM23BC97" service.version="1.00">KM23BC97 FTP server (KM FTPD version 1.00) ready.</example>
1271
- <example>KM23BF0A FTP server (KM FTPD version 1.00) ready.</example>
1272
- <example>KM23CBDB FTP server (KM FTPD version 1.00) ready.</example>
1273
- <example>KM23E608 FTP server (KM FTPD version 1.00) ready.</example>
1274
- <example>KM23E8A2 FTP server (KM FTPD version 1.00) ready.</example>
1275
- <example>KM25015E FTP server (KM FTPD version 1.00) ready.</example>
1276
- <example>KM250E38 FTP server (KM FTPD version 1.00) ready.</example>
1277
- <example>KM251A4C FTP server (KM FTPD version 1.00) ready.</example>
1264
+ <example os.product="KM23BF0A" service.version="1.00">KM23BF0A FTP server (KM FTPD version 1.00) ready.</example>
1265
+ <example os.product="KM23CBDB" service.version="1.00">KM23CBDB FTP server (KM FTPD version 1.00) ready.</example>
1266
+ <example os.product="KM23E608" service.version="1.00">KM23E608 FTP server (KM FTPD version 1.00) ready.</example>
1267
+ <example os.product="KM23E8A2" service.version="1.00">KM23E8A2 FTP server (KM FTPD version 1.00) ready.</example>
1268
+ <example os.product="KM25015E" service.version="1.00">KM25015E FTP server (KM FTPD version 1.00) ready.</example>
1269
+ <example os.product="KM250E38" service.version="1.00">KM250E38 FTP server (KM FTPD version 1.00) ready.</example>
1270
+ <example os.product="KM251A4C" service.version="1.00">KM251A4C FTP server (KM FTPD version 1.00) ready.</example>
1278
1271
  <param pos="0" name="os.device" value="Printer"/>
1279
1272
  <param pos="0" name="os.vendor" value="Konica Minolta"/>
1280
1273
  <param pos="1" name="os.product"/>
@@ -1285,9 +1278,9 @@ more text</example>
1285
1278
 
1286
1279
  <fingerprint pattern="^(ZBR-\d+) Version (\S+) ready\.?$">
1287
1280
  <description>ZebraNet Print Server FTP</description>
1288
- <example os.product="ZBR-46686">ZBR-46686 Version 7.02 ready.</example>
1289
- <example os.version="V56.17.5Z">ZBR-79071 Version V56.17.5Z ready.</example>
1290
- <example os.version="7.02">ZBR-46687 Version 7.02 ready.</example>
1281
+ <example os.product="ZBR-46686" os.version="7.02" hw.product="ZBR-46686">ZBR-46686 Version 7.02 ready.</example>
1282
+ <example os.version="V56.17.5Z" os.product="ZBR-79071" hw.product="ZBR-79071">ZBR-79071 Version V56.17.5Z ready.</example>
1283
+ <example os.version="7.02" os.product="ZBR-46687" hw.product="ZBR-46687">ZBR-46687 Version 7.02 ready.</example>
1291
1284
  <param pos="0" name="os.vendor" value="ZebraNet"/>
1292
1285
  <param pos="0" name="os.device" value="Print Server"/>
1293
1286
  <param pos="1" name="os.product"/>
@@ -1297,7 +1290,7 @@ more text</example>
1297
1290
  <param pos="1" name="hw.product"/>
1298
1291
  </fingerprint>
1299
1292
 
1300
- <fingerprint pattern="^(ET(\S+)) Dell (\S+ Laser Printer) FTP Server">
1293
+ <fingerprint pattern="^(ET(\S{1,32})) Dell (\S+ Laser Printer) FTP Server">
1301
1294
  <description>Dell Laser Printer</description>
1302
1295
  <example host.name="ET0021B71A1111" host.mac="0021B71A1111" hw.product="2350dn Laser Printer">ET0021B71A1111 Dell 2350dn Laser Printer FTP Server NR.APS.N449 ready.</example>
1303
1296
  <param pos="0" name="os.vendor" value="Dell"/>
@@ -1309,11 +1302,14 @@ more text</example>
1309
1302
  <param pos="3" name="hw.product"/>
1310
1303
  </fingerprint>
1311
1304
 
1312
- <fingerprint pattern="^(\S+) FTP server \(Version \S+ \w+ \w+ \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} [A-Z]+ (?:1|2)\d{3}\) ready\.?$">
1305
+ <fingerprint pattern="^(\S{1,512}) FTP server \(Version \S+ \w+ \w+ \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} [A-Z]+ (?:1|2)\d{3}\) ready\.?$">
1313
1306
  <description>Generic/unknown FTP Server found on HP-UX and AIX systems</description>
1314
1307
  <example host.name="host.example.com">host.example.com FTP server (Version 4.1 Sat Sep 7 14:31:53 CDT 2002) ready.</example>
1315
1308
  <example host.name="host.example.com">host.example.com FTP server (Version 5.3 Sat Jan 10 14:01:03 CDT 2012) ready</example>
1316
1309
  <param pos="1" name="host.name"/>
1310
+ <param pos="0" name="hw.certainty" value="0.0"/>
1311
+ <param pos="0" name="os.certainty" value="0.0"/>
1312
+ <param pos="0" name="service.certainty" value="0.0"/>
1317
1313
  </fingerprint>
1318
1314
 
1319
1315
  <fingerprint pattern="^Welcome to the (?:Cisco )?(?:TelePresence) ([a-zA-Z\s]*?) ((?:MSE )?\d+), version (\d+.\d+\(\d+.\d+\)).*?" flags="REG_ICASE">
@@ -1332,7 +1328,7 @@ more text</example>
1332
1328
  <param pos="3" name="os.version"/>
1333
1329
  </fingerprint>
1334
1330
 
1335
- <fingerprint pattern="^(\S+) FTP server \((?:HP|Compaq) Tru64 UNIX Version (\S+)\) ready\.?$">
1331
+ <fingerprint pattern="^(\S{1,512}) FTP server \((?:HP|Compaq) Tru64 UNIX Version (\S+)\) ready\.?$">
1336
1332
  <description>Digital/Compaq/HP Tru64 Unix</description>
1337
1333
  <example host.name="example.com" os.version="5.60">example.com FTP server (Compaq Tru64 UNIX Version 5.60) ready.</example>
1338
1334
  <param pos="0" name="os.vendor" value="HP"/>
@@ -1343,7 +1339,7 @@ more text</example>
1343
1339
  <param pos="0" name="os.cpe23" value="cpe:/o:hp:tru64_unix:{os.version}"/>
1344
1340
  </fingerprint>
1345
1341
 
1346
- <fingerprint pattern="^(\S+) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
1342
+ <fingerprint pattern="^(\S{1,512}) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
1347
1343
  <description>Digital/Compaq/HP Tru64 Unix w/o branding</description>
1348
1344
  <example host.name="example.com" os.version="5.60">example.com FTP server (Digital UNIX Version 5.60) ready.</example>
1349
1345
  <param pos="0" name="os.vendor" value="HP"/>
@@ -1353,7 +1349,7 @@ more text</example>
1353
1349
  <param pos="2" name="os.version"/>
1354
1350
  </fingerprint>
1355
1351
 
1356
- <fingerprint pattern="^(\S+) FTP server \(MikroTik ([\d\.]+)\) ready\.?$">
1352
+ <fingerprint pattern="^(\S{1,512}) FTP server \(MikroTik ([\d\.]+)\) ready\.?$">
1357
1353
  <description>MikroTik</description>
1358
1354
  <example host.name="example.com" os.version="6.18">example.com FTP server (MikroTik 6.18) ready</example>
1359
1355
  <param pos="0" name="os.vendor" value="MikroTik"/>
@@ -1363,7 +1359,7 @@ more text</example>
1363
1359
  <param pos="0" name="os.cpe23" value="cpe:/o:mikrotik:routeros:{os.version}"/>
1364
1360
  </fingerprint>
1365
1361
 
1366
- <fingerprint pattern="^.* FTP server \(MikroTik (\d\.[\w\.]+)\) ready\.?$">
1362
+ <fingerprint pattern="^.{0,1000} FTP server \(MikroTik (\d\.[\w\.]+)\) ready\.?$">
1367
1363
  <description>MikroTik with description</description>
1368
1364
  <example os.version="6.43.16">Super Thing_Place- FTP server (MikroTik 6.43.16) ready</example>
1369
1365
  <example os.version="6.43.16beta2">Super Thing_Place- FTP server (MikroTik 6.43.16beta2) ready</example>
@@ -1541,7 +1537,7 @@ more text</example>
1541
1537
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
1542
1538
  </fingerprint>
1543
1539
 
1544
- <fingerprint pattern="^([\w.-]+) X2 WS_FTP Server ([\d.]{3,6}\s?\(\d+\))$">
1540
+ <fingerprint pattern="^([\w.-]{1,512}) X2 WS_FTP Server ([\d.]{3,6}\s?\(\d+\))$">
1545
1541
  <description>WS_FTP FTP Server on Windows - X2 variant</description>
1546
1542
  <example service.version="7.7(50012467)" host.name="a.host.name.tld">a.host.name.tld X2 WS_FTP Server 7.7(50012467)</example>
1547
1543
  <example service.version="5.0.5 (1989540204)" host.name="a.host.name.tld">a.host.name.tld X2 WS_FTP Server 5.0.5 (1989540204)</example>
@@ -1624,19 +1620,19 @@ more text</example>
1624
1620
 
1625
1621
  <fingerprint pattern="^Sofrel (S5[\w]+) SN ([\d-]+) ready. Time is (\d{2}:\d{2}:\d{2} \d{2}\/\d{2}\/\d{2})\.$">
1626
1622
  <description>Sofrel Remote Terminal Unit</description>
1627
- <example hw.product="S500" host.id="01-499-00427" system.time="00:11:39 01/11/16">Sofrel S500 SN 01-499-00427 ready. Time is 00:11:39 01/11/16.</example>
1623
+ <example hw.product="S500" hw.serial_number="01-499-00427" system.time="00:11:39 01/11/16">Sofrel S500 SN 01-499-00427 ready. Time is 00:11:39 01/11/16.</example>
1628
1624
  <param pos="0" name="hw.vendor" value="Sofrel"/>
1629
1625
  <param pos="0" name="hw.family" value="S500 Range"/>
1630
1626
  <param pos="1" name="hw.product"/>
1631
- <param pos="2" name="host.id"/>
1627
+ <param pos="2" name="hw.serial_number"/>
1632
1628
  <param pos="0" name="system.time.format" value="HH:mm:ss dd/MM/yy"/>
1633
1629
  <param pos="3" name="system.time"/>
1634
1630
  </fingerprint>
1635
1631
 
1636
1632
  <fingerprint pattern="^TiMOS-[CB]-([\S]+) cpm\/[\w]+ ALCATEL (SR [\S]+) Copyright .{1,4}$">
1637
1633
  <description>ALCATEL Service Router running TiMOS</description>
1638
- <example os.version="13.0.R9">TiMOS-C-13.0.R9 cpm/hops64 ALCATEL SR 7750 Copyright (</example>
1639
- <example hw.product="SR 7750">TiMOS-C-9.0.R8 cpm/hops ALCATEL SR 7750 Copyright (c) </example>
1634
+ <example os.version="13.0.R9" hw.product="SR 7750">TiMOS-C-13.0.R9 cpm/hops64 ALCATEL SR 7750 Copyright (</example>
1635
+ <example hw.product="SR 7750" os.version="9.0.R8">TiMOS-C-9.0.R8 cpm/hops ALCATEL SR 7750 Copyright (c) </example>
1640
1636
  <param pos="0" name="os.vendor" value="ALCATEL"/>
1641
1637
  <param pos="1" name="os.version"/>
1642
1638
  <param pos="0" name="hw.vendor" value="ALCATEL"/>
@@ -1644,13 +1640,16 @@ more text</example>
1644
1640
  <param pos="2" name="hw.product"/>
1645
1641
  </fingerprint>
1646
1642
 
1647
- <fingerprint pattern="^(\S+) FTP server ready\.?$" flags="REG_ICASE">
1643
+ <fingerprint pattern="^(\S{1,512}) FTP server ready\.?$" flags="REG_ICASE">
1648
1644
  <description>Generic FTP fingerprint with a hostname</description>
1649
1645
  <example host.name="example.com">example.com FTP server ready.</example>
1650
1646
  <param pos="1" name="host.name"/>
1647
+ <param pos="0" name="hw.certainty" value="0.0"/>
1648
+ <param pos="0" name="os.certainty" value="0.0"/>
1649
+ <param pos="0" name="service.certainty" value="0.0"/>
1651
1650
  </fingerprint>
1652
1651
 
1653
- <fingerprint pattern="^(\S+) FTP server \(Version (\d.*)\) ready\.?$" flags="REG_ICASE">
1652
+ <fingerprint pattern="^(\S{1,512}) FTP server \(Version (\d.*)\) ready\.?$" flags="REG_ICASE">
1654
1653
  <description>Generic FTP fingerprint with a hostname and a version for a generic FTP implementation</description>
1655
1654
  <example host.name="example.com" service.version="6.00LS">example.com FTP server (Version 6.00LS) ready.</example>
1656
1655
  <example host.name="example.com" service.version="1.2">example.com FTP server (Version 1.2) ready.</example>
@@ -1666,6 +1665,9 @@ more text</example>
1666
1665
  <example>FTP-Server</example>
1667
1666
  <example>FTP Server</example>
1668
1667
  <example>FTP service ready.</example>
1668
+ <param pos="0" name="hw.certainty" value="0.0"/>
1669
+ <param pos="0" name="os.certainty" value="0.0"/>
1670
+ <param pos="0" name="service.certainty" value="0.0"/>
1669
1671
  </fingerprint>
1670
1672
 
1671
1673
  <fingerprint pattern="^Welcom to ProRat Ftp Server$">
@@ -1675,7 +1677,7 @@ more text</example>
1675
1677
  <param pos="0" name="service.product" value="ProRat"/>
1676
1678
  </fingerprint>
1677
1679
 
1678
- <fingerprint pattern="^(?:(\S+) )?FTP Server \(vftpd ([\d.]+)\) ready\.?$">
1680
+ <fingerprint pattern="^(?:(\S{1,512}) )?FTP Server \(vftpd ([\d.]+)\) ready\.?$">
1679
1681
  <description>Vermillion FTP Daemon</description>
1680
1682
  <example host.name="srv.name" service.version="1.23">srv.name FTP Server (vftpd 1.23) ready.</example>
1681
1683
  <example service.version="1.31">FTP Server (vftpd 1.31) ready.</example>
@@ -1689,7 +1691,7 @@ more text</example>
1689
1691
  <param pos="1" name="host.name"/>
1690
1692
  </fingerprint>
1691
1693
 
1692
- <fingerprint pattern="^(?:(\S+) )?FTP server \(QVT\/Net ([\d.]+)\) ready\.?$">
1694
+ <fingerprint pattern="^(?:(\S{1,512}) )?FTP server \(QVT\/Net ([\d.]+)\) ready\.?$">
1693
1695
  <description>QVT/Net FTP Server</description>
1694
1696
  <example host.name="siren" service.version="5.1">siren FTP server (QVT/Net 5.1) ready.</example>
1695
1697
  <example host.name="qpc-qvtnet" service.version="4.1">qpc-qvtnet FTP server (QVT/Net 4.1) ready.</example>
@@ -1762,7 +1764,7 @@ more text</example>
1762
1764
 
1763
1765
  <fingerprint pattern="^Welcome to Honeywell Printer (PM\d+)\S+?$">
1764
1766
  <description>Honeywell Thermal Label Printer (Previously Intermec)</description>
1765
- <example hw.product="Thermal Label Printer PM43">Welcome to Honeywell Printer PM43c</example>
1767
+ <example hw.product="Thermal Label Printer PM43" hw.model="PM43">Welcome to Honeywell Printer PM43c</example>
1766
1768
  <param pos="0" name="hw.vendor" value="Honeywell"/>
1767
1769
  <param pos="1" name="hw.model"/>
1768
1770
  <param pos="0" name="hw.product" value="Thermal Label Printer {hw.model}"/>
@@ -1774,8 +1776,8 @@ more text</example>
1774
1776
 
1775
1777
  <fingerprint pattern="^SurgeFTP ([\S]+) \(Version ([a-f\d.]+)\)$">
1776
1778
  <description>NetWin SurgeFTP</description>
1777
- <example service.version="2.3a12">SurgeFTP 192.168.0.0 (Version 2.3a12)</example>
1778
- <example host.name="foo.bar.baz">SurgeFTP foo.bar.baz (Version 2.2f9)</example>
1779
+ <example service.version="2.3a12" host.name="192.168.0.0">SurgeFTP 192.168.0.0 (Version 2.3a12)</example>
1780
+ <example host.name="foo.bar.baz" service.version="2.2f9">SurgeFTP foo.bar.baz (Version 2.2f9)</example>
1779
1781
  <param pos="0" name="service.vendor" value="NetWin"/>
1780
1782
  <param pos="0" name="service.product" value="SurgeFTP"/>
1781
1783
  <param pos="2" name="service.version"/>
@@ -1783,4 +1785,18 @@ more text</example>
1783
1785
  <param pos="1" name="host.name"/>
1784
1786
  </fingerprint>
1785
1787
 
1788
+ <fingerprint pattern="^CyberPower Systems FTP Server Ready">
1789
+ <description>CyberPower UPS Device</description>
1790
+ <example>CyberPower Systems FTP Server Ready.</example>
1791
+ <param pos="0" name="hw.vendor" value="CyberPower"/>
1792
+ <param pos="0" name="hw.device" value="Power Device"/>
1793
+ </fingerprint>
1794
+
1795
+ <fingerprint pattern="^Printer's ftp server (?:\d+) Please login with USER and PASS\.$">
1796
+ <description>Weidmüller Printer</description>
1797
+ <example>Printer's ftp server 530 Please login with USER and PASS.</example>
1798
+ <param pos="0" name="hw.vendor" value="Weidmüller"/>
1799
+ <param pos="0" name="hw.device" value="Printer"/>
1800
+ </fingerprint>
1801
+
1786
1802
  </fingerprints>