recog 2.3.21 → 2.3.22

Sign up to get free protection for your applications and to get access to all the features.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/verify.yml +89 -0
  4. data/CONTRIBUTING.md +6 -0
  5. data/README.md +17 -0
  6. data/bin/recog_standardize +28 -13
  7. data/bin/recog_verify +1 -2
  8. data/cpe-remap.yaml +13 -0
  9. data/features/verify.feature +14 -14
  10. data/identifiers/fields.txt +5 -4
  11. data/identifiers/hw_device.txt +6 -0
  12. data/identifiers/hw_family.txt +8 -0
  13. data/identifiers/hw_product.txt +51 -0
  14. data/identifiers/os_family.txt +1 -0
  15. data/identifiers/os_product.txt +10 -0
  16. data/identifiers/service_product.txt +12 -0
  17. data/identifiers/vendor.txt +49 -0
  18. data/lib/recog/db.rb +2 -1
  19. data/lib/recog/fingerprint.rb +18 -5
  20. data/lib/recog/verifier.rb +5 -5
  21. data/lib/recog/verifier_factory.rb +3 -3
  22. data/lib/recog/verify_reporter.rb +14 -4
  23. data/lib/recog/version.rb +1 -1
  24. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  25. data/spec/lib/recog/verify_reporter_spec.rb +69 -0
  26. data/tools/dev/hooks/pre-commit +21 -0
  27. data/update_cpes.py +1 -1
  28. data/xml/apache_os.xml +38 -38
  29. data/xml/dhcp_vendor_class.xml +206 -0
  30. data/xml/favicons.xml +148 -42
  31. data/xml/ftp_banners.xml +30 -16
  32. data/xml/h323_callresp.xml +99 -99
  33. data/xml/hp_pjl_id.xml +3 -3
  34. data/xml/html_title.xml +502 -25
  35. data/xml/http_cookies.xml +64 -56
  36. data/xml/http_servers.xml +74 -14
  37. data/xml/http_wwwauth.xml +107 -38
  38. data/xml/imap_banners.xml +3 -3
  39. data/xml/mdns_device-info_txt.xml +389 -26
  40. data/xml/mysql_banners.xml +1 -1
  41. data/xml/nntp_banners.xml +3 -3
  42. data/xml/ntp_banners.xml +64 -64
  43. data/xml/operating_system.xml +3 -3
  44. data/xml/pop_banners.xml +7 -7
  45. data/xml/rsh_resp.xml +3 -3
  46. data/xml/sip_banners.xml +27 -0
  47. data/xml/sip_user_agents.xml +54 -1
  48. data/xml/smtp_banners.xml +15 -15
  49. data/xml/smtp_ehlo.xml +1 -1
  50. data/xml/smtp_help.xml +10 -10
  51. data/xml/smtp_noop.xml +2 -2
  52. data/xml/snmp_sysdescr.xml +325 -200
  53. data/xml/snmp_sysobjid.xml +25 -25
  54. data/xml/ssh_banners.xml +7 -5
  55. data/xml/telnet_banners.xml +155 -20
  56. data/xml/tls_jarm.xml +26 -4
  57. data/xml/x509_issuers.xml +36 -0
  58. data/xml/x509_subjects.xml +136 -35
  59. metadata +7 -3
data/xml/http_servers.xml CHANGED
@@ -199,7 +199,7 @@
199
199
  <param pos="2" name="apache.info"/>
200
200
  </fingerprint>
201
201
 
202
- <fingerprint pattern="(?i)^CouchDB/([\.\d]+) .*$">
202
+ <fingerprint pattern="(?i)^CouchDB/([\.\d]+)">
203
203
  <description>Apache CouchDB</description>
204
204
  <example service.version="2.1.1">CouchDB/2.1.1 (Erlang OTP/20)</example>
205
205
  <param pos="0" name="service.vendor" value="Apache"/>
@@ -711,7 +711,7 @@
711
711
  <param pos="0" name="service.cpe23" value="cpe:/a:oracle:web_cache:{service.version}"/>
712
712
  </fingerprint>
713
713
 
714
- <fingerprint pattern="^OracleAS-Web-Cache-10g/([\d.]+).*">
714
+ <fingerprint pattern="^OracleAS-Web-Cache-10g/([\d.]+)">
715
715
  <description>Oracle Application Server Web Cache</description>
716
716
  <example service.version="10.1.2.3.0">OracleAS-Web-Cache-10g/10.1.2.3.0</example>
717
717
  <param pos="0" name="service.vendor" value="Oracle"/>
@@ -1207,7 +1207,7 @@
1207
1207
  <param pos="1" name="apache.variant.version"/>
1208
1208
  </fingerprint>
1209
1209
 
1210
- <fingerprint pattern="(?i)^(?:IBM_HTTP_SERVER|IBM-HTTP-SERVER)$">
1210
+ <fingerprint pattern="(?i)^IBM_HTTP_SERVER|IBM-HTTP-SERVER$">
1211
1211
  <description>IBM HTTP Server with no version info</description>
1212
1212
  <example>IBM_HTTP_SERVER</example>
1213
1213
  <example>IBM_HTTP_Server</example>
@@ -1445,7 +1445,7 @@
1445
1445
  <param pos="0" name="service.cpe23" value="cpe:/a:squid-cache:squid:-"/>
1446
1446
  </fingerprint>
1447
1447
 
1448
- <fingerprint pattern="^thttpd/(\d\.[\w.]+)-MX\s*.*$">
1448
+ <fingerprint pattern="^thttpd/(\d\.[\w.]+)-MX\s*">
1449
1449
  <description>ACME thttpd with SSL support</description>
1450
1450
  <example service.version="2.19">thttpd/2.19-MX Jan 24 2006</example>
1451
1451
  <param pos="0" name="service.vendor" value="ACME"/>
@@ -1470,7 +1470,7 @@
1470
1470
  <param pos="0" name="service.cpe23" value="cpe:/a:acme:thttpd:{service.version}"/>
1471
1471
  </fingerprint>
1472
1472
 
1473
- <fingerprint pattern="(?i)^lighttpd(?:/(\d[\d.]+))?.*$">
1473
+ <fingerprint pattern="(?i)^lighttpd(?:/(\d[\d.]+))?">
1474
1474
  <description>Lighttpd</description>
1475
1475
  <example>lighttpd</example>
1476
1476
  <example>Lighttpd</example>
@@ -1528,7 +1528,7 @@
1528
1528
  <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
1529
1529
  </fingerprint>
1530
1530
 
1531
- <fingerprint pattern="^WebLogic (?:WebLogic )?Server (\d+\.\d+(?:\s+SP\d+)?)\s+.*$">
1531
+ <fingerprint pattern="^WebLogic (?:WebLogic )?Server (\d+\.\d+(?:\s+SP\d+)?)\s+">
1532
1532
  <description>BEA WebLogic</description>
1533
1533
  <example service.version="8.1 SP3">WebLogic Server 8.1 SP3 Tue Jun 29 23:11:19 PDT 2004 404973</example>
1534
1534
  <example service.version="7.0 SP4">WebLogic Server 7.0 SP4 Tue Aug 12 11:22:26 PDT 2003</example>
@@ -1945,7 +1945,7 @@
1945
1945
  <param pos="0" name="os.product" value="Appliance"/>
1946
1946
  </fingerprint>
1947
1947
 
1948
- <fingerprint pattern="^(?:BigIP|BIG-IP)$">
1948
+ <fingerprint pattern="^BigIP|BIG-IP$">
1949
1949
  <description>F5 BIG-IP</description>
1950
1950
  <param pos="0" name="service.vendor" value="F5"/>
1951
1951
  <param pos="0" name="service.product" value="BIG-IP LTM"/>
@@ -2064,7 +2064,7 @@
2064
2064
  <param pos="0" name="hw.device" value="Multifunction Device"/>
2065
2065
  </fingerprint>
2066
2066
 
2067
- <fingerprint pattern=".*Linksys.*">
2067
+ <fingerprint pattern="Linksys">
2068
2068
  <description>Linksys Wireless Access Point</description>
2069
2069
  <param pos="0" name="os.vendor" value="Linksys"/>
2070
2070
  <param pos="0" name="os.device" value="WAP"/>
@@ -2087,7 +2087,7 @@
2087
2087
  <param pos="0" name="hw.vendor" value="Cisco"/>
2088
2088
  </fingerprint>
2089
2089
 
2090
- <fingerprint pattern="^cisco-IOS/([^\s]+) HTTP-server/.*$">
2090
+ <fingerprint pattern="^cisco-IOS/([^\s]+) HTTP-server/">
2091
2091
  <description>Cisco IOS with version information</description>
2092
2092
  <example>cisco-IOS/12.1 HTTP-server/1.0(1)</example>
2093
2093
  <param pos="0" name="service.vendor" value="Cisco"/>
@@ -2159,7 +2159,7 @@
2159
2159
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
2160
2160
  </fingerprint>
2161
2161
 
2162
- <fingerprint pattern="^Agent-ListenServer-HttpSvr/.*$">
2162
+ <fingerprint pattern="^Agent-ListenServer-HttpSvr/">
2163
2163
  <description>McAfee ePolicy Orchestrator</description>
2164
2164
  <param pos="0" name="service.vendor" value="McAfee"/>
2165
2165
  <param pos="0" name="service.product" value="ePolicy Orchestrator"/>
@@ -2167,7 +2167,7 @@
2167
2167
  <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:epolicy_orchestrator:-"/>
2168
2168
  </fingerprint>
2169
2169
 
2170
- <fingerprint pattern="^LANDesk Management Agent/.*$">
2170
+ <fingerprint pattern="^LANDesk Management Agent/">
2171
2171
  <description>LANDesk Management Agent</description>
2172
2172
  <param pos="0" name="service.vendor" value="LANDesk"/>
2173
2173
  <param pos="0" name="service.product" value="Management Agent"/>
@@ -2308,7 +2308,7 @@
2308
2308
  <param pos="0" name="os.device" value="IP Camera"/>
2309
2309
  </fingerprint>
2310
2310
 
2311
- <fingerprint pattern="^ListManagerWeb/(\S+) .*$">
2311
+ <fingerprint pattern="^ListManagerWeb/(\S+)">
2312
2312
  <description>Lyris ListManager</description>
2313
2313
  <example>ListManagerWeb/8.8a (based on Tcl-Webserver/3.4.2)</example>
2314
2314
  <param pos="0" name="service.vendor" value="Lyris"/>
@@ -2887,7 +2887,7 @@
2887
2887
  <param pos="0" name="service.cpe23" value="cpe:/a:treck:tcp\/ip:{service.version}"/>
2888
2888
  </fingerprint>
2889
2889
 
2890
- <fingerprint pattern="^WEBrick/([\d\.]+) .*$">
2890
+ <fingerprint pattern="^WEBrick/([\d\.]+)">
2891
2891
  <description>WEBrick default setup</description>
2892
2892
  <example service.version="1.3.1">WEBrick/1.3.1 (Ruby/1.9.3/2013-02-22)</example>
2893
2893
  <param pos="0" name="service.vendor" value="Ruby-Lang"/>
@@ -3148,7 +3148,7 @@
3148
3148
  <param pos="0" name="service.cpe23" value="cpe:/a:intel:active_management_technology:{service.version}"/>
3149
3149
  </fingerprint>
3150
3150
 
3151
- <fingerprint pattern="^(?:AMT|Intel\(R\) Active Management Technology)$">
3151
+ <fingerprint pattern="^AMT|Intel\(R\) Active Management Technology$">
3152
3152
  <description>Intel(R) Active Management Technology (AMT) without a version</description>
3153
3153
  <example>AMT</example>
3154
3154
  <example>Intel(R) Active Management Technology</example>
@@ -3340,6 +3340,19 @@
3340
3340
  <param pos="0" name="os.device" value="WAP"/>
3341
3341
  </fingerprint>
3342
3342
 
3343
+ <fingerprint pattern="(?i)^(AsusWRT)\/(\S+) UPnP/\S+ MiniUPnPd/([\d.]+)$">
3344
+ <description>AsusWRT Firmware</description>
3345
+ <example os.product="AsusWRT" os.version="3.0.0.4" service.version="1.9">AsusWRT/3.0.0.4 UPnP/1.1 MiniUPnPd/1.9</example>
3346
+ <param pos="0" name="service.vendor" value="MiniUPnP Project"/>
3347
+ <param pos="0" name="service.product" value="MiniUPnPd"/>
3348
+ <param pos="3" name="service.version"/>
3349
+ <param pos="0" name="service.cpe23" value="cpe:/a:miniupnp_project:miniupnpd:{service.version}"/>
3350
+ <param pos="0" name="os.vendor" value="Asus"/>
3351
+ <param pos="1" name="os.product"/>
3352
+ <param pos="2" name="os.version"/>
3353
+ <param pos="0" name="os.device" value="Router"/>
3354
+ </fingerprint>
3355
+
3343
3356
  <fingerprint pattern="(?i)^DrayTek/Vigor(\S+) UPnP/\S+ miniupnpd/([\d.]+)$">
3344
3357
  <description>DrayTek Vigor router UPnP Server</description>
3345
3358
  <example service.version="1.0" hw.model="2130">DrayTek/Vigor2130 UPnP/1.0 miniupnpd/1.0</example>
@@ -3937,6 +3950,15 @@
3937
3950
  <param pos="0" name="hw.device" value="Router"/>
3938
3951
  </fingerprint>
3939
3952
 
3953
+ <fingerprint pattern="^TP-LINK HTTPD/1.0$">
3954
+ <description>TP-Link httpd</description>
3955
+ <example>TP-LINK HTTPD/1.0</example>
3956
+ <param pos="0" name="service.vendor" value="TP-LINK"/>
3957
+ <param pos="0" name="os.vendor" value="TP-LINK"/>
3958
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
3959
+ <param pos="0" name="hw.device" value="Device"/>
3960
+ </fingerprint>
3961
+
3940
3962
  <fingerprint pattern="^Linux/(\S+\_eureka_1), UPnP/[\d\.]+, Portable SDK for UPnP devices/(\S+)$">
3941
3963
  <description>Siqura Video Encoder</description>
3942
3964
  <example>Linux/2.6.37_eureka_1, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
@@ -4090,6 +4112,7 @@
4090
4112
  <param pos="0" name="hw.product" value="Roku"/>
4091
4113
  <param pos="0" name="hw.device" value="Media Server"/>
4092
4114
  <param pos="1" name="hw.version"/>
4115
+ <param pos="0" name="hw.cpe23" value="cpe:/h:roku:roku:{hw.version}"/>
4093
4116
  </fingerprint>
4094
4117
 
4095
4118
  <fingerprint pattern="^Roku/(\S+) UPnP/\S+ Roku/\S+$">
@@ -4099,6 +4122,7 @@
4099
4122
  <param pos="0" name="hw.product" value="Roku"/>
4100
4123
  <param pos="0" name="hw.device" value="Media Server"/>
4101
4124
  <param pos="1" name="hw.version"/>
4125
+ <param pos="0" name="hw.cpe23" value="cpe:/h:roku:roku:{hw.version}"/>
4102
4126
  </fingerprint>
4103
4127
 
4104
4128
  <fingerprint pattern="^Roku UPnP/\S+ MiniUPnPd/([\d\.]+)$">
@@ -4107,6 +4131,7 @@
4107
4131
  <param pos="0" name="hw.vendor" value="Roku"/>
4108
4132
  <param pos="0" name="hw.product" value="Roku"/>
4109
4133
  <param pos="0" name="hw.device" value="Media Server"/>
4134
+ <param pos="0" name="hw.cpe23" value="cpe:/h:roku:roku:-"/>
4110
4135
  <param pos="0" name="service.vendor" value="MiniUPnP Project"/>
4111
4136
  <param pos="0" name="service.product" value="MiniUPnPd"/>
4112
4137
  <param pos="1" name="service.version"/>
@@ -4544,6 +4569,14 @@
4544
4569
  <param pos="0" name="hw.device" value="IP Camera"/>
4545
4570
  </fingerprint>
4546
4571
 
4572
+ <fingerprint pattern="UNMS (\d+\.\d+\.\d+)">
4573
+ <description>Ubiquiti UNMS</description>
4574
+ <example>302 Found UNMS 1.2.7</example>
4575
+ <param pos="0" name="service.vendor" value="Ubiquiti"/>
4576
+ <param pos="0" name="service.product" value="UNMS"/>
4577
+ <param pos="1" name="service.version"/>
4578
+ </fingerprint>
4579
+
4547
4580
  <fingerprint pattern="^xxxxxxxx-xxxxx$">
4548
4581
  <description>Fortinet - device unknown</description>
4549
4582
  <example>xxxxxxxx-xxxxx</example>
@@ -4555,4 +4588,31 @@
4555
4588
  <param pos="0" name="hw.vendor" value="Fortinet"/>
4556
4589
  </fingerprint>
4557
4590
 
4591
+ <fingerprint pattern="^VBrick (\S+) Server$">
4592
+ <description>VBrick Encoding Server</description>
4593
+ <example service.product="VB6000">VBrick VB6000 Server</example>
4594
+ <param pos="0" name="service.vendor" value="VBrick"/>
4595
+ <param pos="1" name="service.product"/>
4596
+ <param pos="0" name="hw.product" value="{service.product}"/>
4597
+ <param pos="0" name="hw.vendor" value="{service.vendor}"/>
4598
+ <param pos="0" name="hw.device" value="Video Encoder"/>
4599
+ </fingerprint>
4600
+
4601
+ <fingerprint pattern="^kx-ns1000$">
4602
+ <description>Panasonic KX-NS1000 IP PBX</description>
4603
+ <example>kx-ns1000</example>
4604
+ <param pos="0" name="hw.product" value="KX-NS1000"/>
4605
+ <param pos="0" name="hw.vendor" value="Panasonic"/>
4606
+ <param pos="0" name="hw.device" value="VoIP Server"/>
4607
+ </fingerprint>
4608
+
4609
+ <fingerprint pattern="^Oce Express WebTools$">
4610
+ <description>Oce Printer</description>
4611
+ <example>Oce Express WebTools</example>
4612
+ <param pos="0" name="service.vendor" value="Oce"/>
4613
+ <param pos="0" name="service.product" value="Express WebTools"/>
4614
+ <param pos="0" name="hw.vendor" value="Oce"/>
4615
+ <param pos="0" name="hw.device" value="Printer"/>
4616
+ </fingerprint>
4617
+
4558
4618
  </fingerprints>
data/xml/http_wwwauth.xml CHANGED
@@ -78,7 +78,7 @@
78
78
  <param pos="1" name="hw.product"/>
79
79
  </fingerprint>
80
80
 
81
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;.*$">
81
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;">
82
82
  <description>Generic Cisco CWMP/CPE equipment</description>
83
83
  <example>Basic realm="Cisco_CCSP_CWMP_TCPCR"</example>
84
84
  <param pos="0" name="hw.vendor" value="Cisco"/>
@@ -97,7 +97,7 @@
97
97
  <param pos="0" name="os.product" value="Firewall-1"/>
98
98
  </fingerprint>
99
99
 
100
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;.*">
100
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;">
101
101
  <description>cPanel</description>
102
102
  <example>Basic realm="cPanel"</example>
103
103
  <param pos="0" name="service.vendor" value="cPanel"/>
@@ -114,7 +114,7 @@
114
114
  <param pos="0" name="os.device" value="Power Device"/>
115
115
  </fingerprint>
116
116
 
117
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
117
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;">
118
118
  <description>Generic ADSL modems/routers</description>
119
119
  <example>Basic realm="ADSL Modem"</example>
120
120
  <example>Basic realm="ADSL Modem/Router"</example>
@@ -123,19 +123,19 @@
123
123
  <param pos="0" name="hw.device" value="ADSL Modem"/>
124
124
  </fingerprint>
125
125
 
126
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;.*$">
126
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;">
127
127
  <description>Generic Broadband modems/routers</description>
128
128
  <example>Basic realm="Broadband Router"</example>
129
129
  <param pos="0" name="hw.device" value="Broadband Router"/>
130
130
  </fingerprint>
131
131
 
132
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
132
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;">
133
133
  <description>Generic DSL modems/routers</description>
134
134
  <example>Basic realm="DSL Modem"</example>
135
135
  <param pos="0" name="hw.device" value="DSL Modem"/>
136
136
  </fingerprint>
137
137
 
138
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;.*$">
138
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;">
139
139
  <description>Generic DVR</description>
140
140
  <example>Basic realm="DVR"</example>
141
141
  <param pos="0" name="hw.device" value="DVR"/>
@@ -143,7 +143,7 @@
143
143
 
144
144
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
145
145
 
146
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;.*$">
146
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;">
147
147
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
148
148
  <example>Basic realm="hikvision"</example>
149
149
  <param pos="0" name="service.vendor" value="Hikvision"/>
@@ -154,20 +154,20 @@
154
154
  <param pos="0" name="hw.device" value="DVR"/>
155
155
  </fingerprint>
156
156
 
157
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;.*$">
157
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;">
158
158
  <description>Merit LILIN generic device</description>
159
159
  <example>Basic realm="Merit LILIN Ent. Co., Ltd,"</example>
160
160
  <example>Basic realm="Merit LILIN Ent. Co., Ltd."</example>
161
161
  <param pos="0" name="hw.vendor" value="Merit LILIN"/>
162
162
  </fingerprint>
163
163
 
164
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;.*$">
164
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;">
165
165
  <description>Generic WAP</description>
166
166
  <example>Basic realm="Wireless Access Point"</example>
167
167
  <param pos="0" name="hw.device" value="WAP"/>
168
168
  </fingerprint>
169
169
 
170
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;.*$">
170
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;">
171
171
  <description>Generic IP Cameras</description>
172
172
  <example>Basic realm="camera"</example>
173
173
  <example>Basic realm="IPCamera Login"</example>
@@ -175,7 +175,7 @@
175
175
  <param pos="0" name="hw.device" value="IP Camera"/>
176
176
  </fingerprint>
177
177
 
178
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
178
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;">
179
179
  <description>D-Link DCS IP Cameras</description>
180
180
  <example hw.product="DCS-5222LB1">Basic realm="DCS-5222LB1"</example>
181
181
  <example hw.product="DCS-2530L">Basic realm="DCS-2530L"</example>
@@ -184,7 +184,7 @@
184
184
  <param pos="1" name="hw.product"/>
185
185
  </fingerprint>
186
186
 
187
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
187
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;">
188
188
  <description>GoAhead webserver</description>
189
189
  <example>Basic realm="GoAhead"</example>
190
190
  <param pos="0" name="service.vendor" value="Oracle"/>
@@ -192,14 +192,14 @@
192
192
  <param pos="0" name="service.family" value="GoAhead Webserver"/>
193
193
  </fingerprint>
194
194
 
195
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Logitech Media Server&quot;.*$">
195
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Logitech Media Server&quot;">
196
196
  <description>Logitech Media server</description>
197
197
  <example>Basic realm="Logitech Media Server"</example>
198
198
  <param pos="0" name="service.vendor" value="Logitech"/>
199
199
  <param pos="0" name="service.product" value="Squeezebox"/>
200
200
  </fingerprint>
201
201
 
202
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
202
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;">
203
203
  <description>Kubernetes master nodes</description>
204
204
  <example>Basic realm="kubernetes-master"</example>
205
205
  <param pos="0" name="service.vendor" value="Kubernetes"/>
@@ -208,7 +208,7 @@
208
208
  <param pos="0" name="service.cpe23" value="cpe:/a:kubernetes:kubernetes:-"/>
209
209
  </fingerprint>
210
210
 
211
- <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
211
+ <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;">
212
212
  <description>Ruijie Networks generic</description>
213
213
  <example>Digest realm="RUIJIE-CPE"</example>
214
214
  <param pos="0" name="hw.vendor" value="Ruijie"/>
@@ -279,7 +279,7 @@
279
279
  <param pos="2" name="host.mac"/>
280
280
  </fingerprint>
281
281
 
282
- <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;.*$">
282
+ <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;">
283
283
  <description>Thomson generic devices</description>
284
284
  <example>Digest realm="Thomson Gateway"</example>
285
285
  <example>Basic realm="Thomson"</example>
@@ -303,7 +303,7 @@
303
303
  <param pos="1" name="hw.product"/>
304
304
  </fingerprint>
305
305
 
306
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;.*$">
306
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;">
307
307
  <description>Huawei Home Gateway Routers</description>
308
308
  <example>Basic realm="HuaweiHomeGateway"</example>
309
309
  <param pos="0" name="hw.vendor" value="Huawei"/>
@@ -311,7 +311,7 @@
311
311
  <param pos="0" name="hw.product" value="Home Gateway"/>
312
312
  </fingerprint>
313
313
 
314
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;.*$">
314
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;">
315
315
  <description>Huawei EchoLife Home Gateways</description>
316
316
  <example>Basic realm="EchoLife Portal de Inicio"</example>
317
317
  <example>Basic realm="EchoLife Home Gateway"</example>
@@ -361,7 +361,7 @@
361
361
  <param pos="1" name="hw.product"/>
362
362
  </fingerprint>
363
363
 
364
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
364
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;">
365
365
  <description>TP-LINK SoHo Router - verbose variant</description>
366
366
  <example os.product="WA801N">Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
367
367
  <example hw.product="WA830RE">Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
@@ -387,7 +387,7 @@
387
387
  <param pos="1" name="hw.product"/>
388
388
  </fingerprint>
389
389
 
390
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
390
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;">
391
391
  <description>TP-LINK Routers</description>
392
392
  <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
393
393
  <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
@@ -397,21 +397,21 @@
397
397
  <param pos="1" name="hw.product"/>
398
398
  </fingerprint>
399
399
 
400
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;.*$">
400
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;">
401
401
  <description>TP-LINK IP-Cameras</description>
402
402
  <example>Basic realm="TP-LINK IP-Camera"</example>
403
403
  <param pos="0" name="hw.vendor" value="TP-LINK"/>
404
404
  <param pos="0" name="hw.device" value="IP Camera"/>
405
405
  </fingerprint>
406
406
 
407
- <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
407
+ <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;">
408
408
  <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>
409
409
  <example>Digest qop="auth", realm="Broadcom Management Service", nonce="AAAAAAAAAAAAAP//DwHpMwYy1zc=", algorithm="MD5"</example>
410
410
  <param pos="0" name="service.vendor" value="Broadcom"/>
411
411
  <param pos="0" name="service.product" value="Management Service"/>
412
412
  </fingerprint>
413
413
 
414
- <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;.*$">
414
+ <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;">
415
415
  <description>Samba Web Administration Tool (SWAT)</description>
416
416
  <example>Basic realm="SWAT"</example>
417
417
  <param pos="0" name="service.vendor" value="Samba"/>
@@ -419,7 +419,7 @@
419
419
  <param pos="0" name="service.product" value="SWAT"/>
420
420
  </fingerprint>
421
421
 
422
- <fingerprint pattern="^.{0,1024}(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
422
+ <fingerprint pattern="^.{0,1000}(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;">
423
423
  <description>SPIP publishing system (www.spip.net)</description>
424
424
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
425
425
  <param pos="0" name="service.vendor" value="SPIP"/>
@@ -427,7 +427,7 @@
427
427
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
428
428
  </fingerprint>
429
429
 
430
- <fingerprint pattern="^.{0,1024}(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
430
+ <fingerprint pattern="^.{0,1000}(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;">
431
431
  <description>HP Instant Support Enterprise Edition with a hostname</description>
432
432
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
433
433
  <param pos="0" name="service.vendor" value="HP"/>
@@ -435,7 +435,7 @@
435
435
  <param pos="1" name="host.name"/>
436
436
  </fingerprint>
437
437
 
438
- <fingerprint pattern="^.{0,1024}(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
438
+ <fingerprint pattern="^.{0,1000}(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;">
439
439
  <description>Generic F5 Big-IP</description>
440
440
  <example>Basic realm="BIG-IP"</example>
441
441
  <param pos="0" name="service.vendor" value="F5"/>
@@ -467,13 +467,13 @@
467
467
  <param pos="1" name="os.product"/>
468
468
  </fingerprint>
469
469
 
470
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;.*$">
470
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;">
471
471
  <description>Assorted Sercomm CPE devices</description>
472
472
  <example>Digest realm="SERCOMM CPE Authentication"</example>
473
473
  <param pos="0" name="hw.vendor" value="Sercomm"/>
474
474
  </fingerprint>
475
475
 
476
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;.*$">
476
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;">
477
477
  <description>Tivo DVR</description>
478
478
  <example>Digest realm="TiVo DVR"</example>
479
479
  <param pos="0" name="hw.vendor" value="Tivo"/>
@@ -481,7 +481,7 @@
481
481
  <param pos="0" name="hw.device" value="DVR"/>
482
482
  </fingerprint>
483
483
 
484
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;.*$">
484
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;">
485
485
  <description>Ubee Cable Modems</description>
486
486
  <example>Digest qop="auth", realm="Ubee", nonce="1544738973"</example>
487
487
  <param pos="0" name="hw.vendor" value="Ubee"/>
@@ -496,13 +496,13 @@
496
496
  <param pos="0" name="service.family" value="Oracle"/>
497
497
  </fingerprint>
498
498
 
499
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;.*$">
499
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;">
500
500
  <description>Assorted ZTE CPE devices</description>
501
501
  <example>Digest realm="cpe@zte.com"</example>
502
502
  <param pos="0" name="hw.vendor" value="ZTE"/>
503
503
  </fingerprint>
504
504
 
505
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;.*$">
505
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;">
506
506
  <description>ZTE ZXHN router</description>
507
507
  <example>Basic realm="ZXHN H108L"</example>
508
508
  <param pos="0" name="hw.vendor" value="ZTE"/>
@@ -511,7 +511,7 @@
511
511
  <param pos="1" name="hw.product"/>
512
512
  </fingerprint>
513
513
 
514
- <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;.*$">
514
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;">
515
515
  <description>ZTE ZXV router</description>
516
516
  <example hw.product="ZXV10 W300">Basic realm="ZXV10 W300"</example>
517
517
  <param pos="0" name="hw.vendor" value="ZTE"/>
@@ -540,7 +540,7 @@
540
540
  <param pos="0" name="os.product" value="Linux"/>
541
541
  </fingerprint>
542
542
 
543
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
543
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;">
544
544
  <description>Netgear Orbi</description>
545
545
  <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
546
546
  <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
@@ -551,7 +551,7 @@
551
551
  <param pos="1" name="hw.product"/>
552
552
  </fingerprint>
553
553
 
554
- <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;.*$">
554
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;">
555
555
  <description>Netgear Routers</description>
556
556
  <example hw.product="DG834">Basic realm="NETGEAR DG834 "</example>
557
557
  <example hw.product="C7000v2">Basic realm="NETGEAR C7000v2"</example>
@@ -563,7 +563,7 @@
563
563
 
564
564
  <!-- Fallback to the most generic Netgear match -->
565
565
 
566
- <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;.*$">
566
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;">
567
567
  <description>Netgear Unspecified Router</description>
568
568
  <example>Basic realm="Netgear"</example>
569
569
  <param pos="0" name="hw.vendor" value="Netgear"/>
@@ -581,7 +581,7 @@
581
581
  <param pos="1" name="hw.product"/>
582
582
  </fingerprint>
583
583
 
584
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
584
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;">
585
585
  <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
586
586
  <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
587
587
  <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
@@ -593,6 +593,75 @@
593
593
  <param pos="1" name="host.name"/>
594
594
  </fingerprint>
595
595
 
596
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DELL \| SonicWALL SonicPoint">
597
+ <description>SonicWall SonicPoint (non-specific)</description>
598
+ <example>Basic realm="DELL | SonicWALL SonicPoint ACe/ACi/N2"</example>
599
+ <param pos="0" name="os.vendor" value="SonicWall"/>
600
+ <param pos="0" name="os.device" value="WAP"/>
601
+ <param pos="0" name="os.product" value="SonicOS"/>
602
+ <param pos="0" name="os.cpe23" value="cpe:/o:sonicwall:sonicos:-"/>
603
+ <param pos="0" name="hw.vendor" value="SonicWall"/>
604
+ <param pos="0" name="hw.product" value="SonicPoint"/>
605
+ </fingerprint>
606
+
607
+ <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;rokudev&quot;">
608
+ <description>Roku Streaming Device</description>
609
+ <example>Digest qop="auth", realm="rokudev", nonce="1111111111"</example>
610
+ <param pos="0" name="hw.vendor" value="Roku"/>
611
+ <param pos="0" name="hw.device" value="Media Server"/>
612
+ </fingerprint>
613
+
614
+ <fingerprint pattern="(?i)^Basic realm=&quot;System Setup&quot;">
615
+ <description>Patton DSL Router</description>
616
+ <example>Basic realm="System Setup"</example>
617
+ <param pos="0" name="hw.vendor" value="Patton"/>
618
+ <param pos="0" name="hw.device" value="Router"/>
619
+ <param pos="0" name="hw.product" value="SHDSL Router"/>
620
+ <param pos="0" name="hw.certainty" value="0.50"/>
621
+ </fingerprint>
622
+
623
+ <fingerprint pattern="(?i)^Digest realm=&quot;Login to ND[0-9]{3,20}&quot;, nonce=">
624
+ <description>Lorex NR900 Series DVR</description>
625
+ <example>Digest realm="Login to ND011811000000", nonce="ec3682ef24b2cd9cedefe5cc26110000"</example>
626
+ <param pos="0" name="hw.vendor" value="Lorex"/>
627
+ <param pos="0" name="hw.device" value="DVR"/>
628
+ <param pos="0" name="hw.product" value="NR900"/>
629
+ <param pos="0" name="hw.certainty" value="0.50"/>
630
+ </fingerprint>
631
+
632
+ <fingerprint pattern="(?i)^Basic realm=&quot;the Access Point&quot;">
633
+ <description>Psion Teklogix</description>
634
+ <example>Basic realm="the Access Point"</example>
635
+ <param pos="0" name="hw.vendor" value="Psion Teklogix"/>
636
+ <param pos="0" name="hw.device" value="Network Appliance"/>
637
+ <param pos="0" name="hw.product" value="CommServer"/>
638
+ </fingerprint>
639
+
640
+ <fingerprint pattern="(?i)^Digest realm=&quot;Use 'live' as User Name">
641
+ <description>Bosch AutoDome IP Camera</description>
642
+ <example>Digest realm="Use 'live' as User Name",nonce="18e62d241a5358a9650640fa72c1773c",opaque="",stale=FALSE,algorithm=MD5</example>
643
+ <example>Digest realm="Use 'live' as User Name in order to log in to the respective level",nonce="2e6007092c2b28af7e2516b80b5b4f95",opaque="",stale=FALSE,algorithm=MD5,qop="auth"</example>
644
+ <param pos="0" name="hw.vendor" value="Bosch"/>
645
+ <param pos="0" name="hw.device" value="Web Cam"/>
646
+ <param pos="0" name="hw.product" value="AutoDome"/>
647
+ <param pos="0" name="hw.certainty" value="0.50"/>
648
+ </fingerprint>
649
+
650
+ <fingerprint pattern="(?i)^Basic realm=&quot;Shelly&quot;">
651
+ <description>Shelly Smart Device</description>
652
+ <example>Basic realm="Shelly"</example>
653
+ <param pos="0" name="hw.vendor" value="Shelly"/>
654
+ <param pos="0" name="hw.device" value="Device"/>
655
+ </fingerprint>
656
+
657
+ <fingerprint pattern="(?i)^Basic realm=&quot;Eurotherm&quot;">
658
+ <description>Schneider Electric Eurotherm Device</description>
659
+ <example>Basic realm="Eurotherm"</example>
660
+ <param pos="0" name="hw.vendor" value="Schneider Electric"/>
661
+ <param pos="0" name="hw.device" value="Device"/>
662
+ <param pos="0" name="hw.family" value="Eurotherm"/>
663
+ </fingerprint>
664
+
596
665
  <!-- a variety of headers we currently just ignore -->
597
666
 
598
667
  <fingerprint pattern="(?i)^NTLM$">
@@ -621,13 +690,13 @@
621
690
  <example>Basic realm="index.html"</example>
622
691
  </fingerprint>
623
692
 
624
- <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;.*$">
693
+ <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;">
625
694
  <description>Ignore realms with an IPv4 address</description>
626
695
  <example>Basic realm="192.168.0.1"</example>
627
696
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
628
697
  </fingerprint>
629
698
 
630
- <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;.*$">
699
+ <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;">
631
700
  <description>Ignore generic 'config' realms</description>
632
701
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
633
702
  </fingerprint>