recog 2.3.21 → 2.3.22

Sign up to get free protection for your applications and to get access to all the features.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/verify.yml +89 -0
  4. data/CONTRIBUTING.md +6 -0
  5. data/README.md +17 -0
  6. data/bin/recog_standardize +28 -13
  7. data/bin/recog_verify +1 -2
  8. data/cpe-remap.yaml +13 -0
  9. data/features/verify.feature +14 -14
  10. data/identifiers/fields.txt +5 -4
  11. data/identifiers/hw_device.txt +6 -0
  12. data/identifiers/hw_family.txt +8 -0
  13. data/identifiers/hw_product.txt +51 -0
  14. data/identifiers/os_family.txt +1 -0
  15. data/identifiers/os_product.txt +10 -0
  16. data/identifiers/service_product.txt +12 -0
  17. data/identifiers/vendor.txt +49 -0
  18. data/lib/recog/db.rb +2 -1
  19. data/lib/recog/fingerprint.rb +18 -5
  20. data/lib/recog/verifier.rb +5 -5
  21. data/lib/recog/verifier_factory.rb +3 -3
  22. data/lib/recog/verify_reporter.rb +14 -4
  23. data/lib/recog/version.rb +1 -1
  24. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  25. data/spec/lib/recog/verify_reporter_spec.rb +69 -0
  26. data/tools/dev/hooks/pre-commit +21 -0
  27. data/update_cpes.py +1 -1
  28. data/xml/apache_os.xml +38 -38
  29. data/xml/dhcp_vendor_class.xml +206 -0
  30. data/xml/favicons.xml +148 -42
  31. data/xml/ftp_banners.xml +30 -16
  32. data/xml/h323_callresp.xml +99 -99
  33. data/xml/hp_pjl_id.xml +3 -3
  34. data/xml/html_title.xml +502 -25
  35. data/xml/http_cookies.xml +64 -56
  36. data/xml/http_servers.xml +74 -14
  37. data/xml/http_wwwauth.xml +107 -38
  38. data/xml/imap_banners.xml +3 -3
  39. data/xml/mdns_device-info_txt.xml +389 -26
  40. data/xml/mysql_banners.xml +1 -1
  41. data/xml/nntp_banners.xml +3 -3
  42. data/xml/ntp_banners.xml +64 -64
  43. data/xml/operating_system.xml +3 -3
  44. data/xml/pop_banners.xml +7 -7
  45. data/xml/rsh_resp.xml +3 -3
  46. data/xml/sip_banners.xml +27 -0
  47. data/xml/sip_user_agents.xml +54 -1
  48. data/xml/smtp_banners.xml +15 -15
  49. data/xml/smtp_ehlo.xml +1 -1
  50. data/xml/smtp_help.xml +10 -10
  51. data/xml/smtp_noop.xml +2 -2
  52. data/xml/snmp_sysdescr.xml +325 -200
  53. data/xml/snmp_sysobjid.xml +25 -25
  54. data/xml/ssh_banners.xml +7 -5
  55. data/xml/telnet_banners.xml +155 -20
  56. data/xml/tls_jarm.xml +26 -4
  57. data/xml/x509_issuers.xml +36 -0
  58. data/xml/x509_subjects.xml +136 -35
  59. metadata +7 -3
data/xml/tls_jarm.xml CHANGED
@@ -14,13 +14,33 @@
14
14
  <param pos="0" name="service.cpe23" value="cpe:/a:torproject:tor:-"/>
15
15
  </fingerprint>
16
16
 
17
- <fingerprint pattern="^2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d$">
18
- <description>Synology NAS</description>
17
+ <fingerprint pattern="^2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d|29d29d15d29d29d21c29d29d29d29d10d7a07cb776562eccb97246005feba5|2ad2ad0002ad2ad0002ad2ad2ad2ad5bf44aec534289dfa8e33148b66cd6c3|29d29d15d29d29d21c29d29d29d29de857600fcd9f89735d87c3704c4e141b$">
18
+ <description>Synology NAS DSM 6</description>
19
+ <example>29d29d15d29d29d21c29d29d29d29d10d7a07cb776562eccb97246005feba5</example>
20
+ <example>29d29d15d29d29d21c29d29d29d29de857600fcd9f89735d87c3704c4e141b</example>
21
+ <example>2ad2ad0002ad2ad0002ad2ad2ad2ad5bf44aec534289dfa8e33148b66cd6c3</example>
19
22
  <example>2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d</example>
20
23
  <param pos="0" name="os.device" value="NAS"/>
21
24
  <param pos="0" name="os.family" value="Linux"/>
22
25
  <param pos="0" name="os.product" value="DSM"/>
23
26
  <param pos="0" name="os.vendor" value="Synology"/>
27
+ <param pos="0" name="os.version" value="6"/>
28
+ <param pos="0" name="hw.vendor" value="Synology"/>
29
+ <param pos="0" name="hw.device" value="NAS"/>
30
+ </fingerprint>
31
+
32
+ <fingerprint pattern="^00000000000000000042d42d0000009535d5979f591ae8e547c5e5743e5b64|29d29d15d29d29d00042d42d00000068f5dc63852f94da932cd6b61b1cd9e3|29d29d15d29d29d21c42d42d000000bf85d79ff39d9f5079675604a74fc04b|29d29d15d29d29d00042d42d000000038eaaf490bec8dc33757f165ce01762|29d29d15d29d29d21c42d42d000000790cb01ea78cc2a73fe8428d61afc0c8$">
33
+ <description>Synology NAS DSM 7</description>
34
+ <example>00000000000000000042d42d0000009535d5979f591ae8e547c5e5743e5b64</example>
35
+ <example>29d29d15d29d29d00042d42d000000038eaaf490bec8dc33757f165ce01762</example>
36
+ <example>29d29d15d29d29d00042d42d00000068f5dc63852f94da932cd6b61b1cd9e3</example>
37
+ <example>29d29d15d29d29d21c42d42d000000790cb01ea78cc2a73fe8428d61afc0c8</example>
38
+ <example>29d29d15d29d29d21c42d42d000000bf85d79ff39d9f5079675604a74fc04b</example>
39
+ <param pos="0" name="os.device" value="NAS"/>
40
+ <param pos="0" name="os.family" value="Linux"/>
41
+ <param pos="0" name="os.product" value="DSM"/>
42
+ <param pos="0" name="os.vendor" value="Synology"/>
43
+ <param pos="0" name="os.version" value="7"/>
24
44
  <param pos="0" name="hw.vendor" value="Synology"/>
25
45
  <param pos="0" name="hw.device" value="NAS"/>
26
46
  </fingerprint>
@@ -118,11 +138,13 @@
118
138
  <param pos="0" name="hw.device" value="Media Server"/>
119
139
  <param pos="0" name="hw.vendor" value="Google"/>
120
140
  <param pos="0" name="hw.product" value="Chromecast"/>
141
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
121
142
  </fingerprint>
122
143
 
123
- <fingerprint pattern="^21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601$">
124
- <description>VMWare ESXi</description>
144
+ <fingerprint pattern="^21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601|2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d$">
145
+ <description>VMware ESXi</description>
125
146
  <example>21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601</example>
147
+ <example>2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d</example>
126
148
  <param pos="0" name="os.vendor" value="VMware"/>
127
149
  <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
128
150
  <param pos="0" name="os.product" value="VMware ESXi Server"/>
data/xml/x509_issuers.xml CHANGED
@@ -106,6 +106,7 @@
106
106
  <param pos="0" name="hw.vendor" value="Google"/>
107
107
  <param pos="0" name="hw.product" value="Chromecast"/>
108
108
  <param pos="0" name="hw.certainty" value="0.5"/>
109
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
109
110
  <param pos="0" name="chromecast.generation" value="1"/>
110
111
  </fingerprint>
111
112
 
@@ -127,6 +128,7 @@
127
128
  <param pos="0" name="hw.vendor" value="Google"/>
128
129
  <param pos="0" name="hw.product" value="Chromecast"/>
129
130
  <param pos="0" name="hw.certainty" value="0.5"/>
131
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
130
132
  <param pos="1" name="chromecast.generation"/>
131
133
  <param pos="2" name="chromecast.capabilities"/>
132
134
  </fingerprint>
@@ -357,4 +359,38 @@
357
359
  <param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
358
360
  </fingerprint>
359
361
 
362
+ <fingerprint pattern="^CN=Avaya cu360 (\S+)$">
363
+ <description>Avaya Video Conferencing Device - CU360</description>
364
+ <example hw.serial_number="11YT11111111">CN=Avaya cu360 11YT11111111</example>
365
+ <param pos="0" name="hw.vendor" value="Avaya"/>
366
+ <param pos="0" name="hw.device" value="Video Conference"/>
367
+ <param pos="0" name="hw.product" value="CU360"/>
368
+ <param pos="1" name="hw.serial_number"/>
369
+ </fingerprint>
370
+
371
+ <fingerprint pattern="^CN=Roomba CA,OU=\S+,O=iRobot,L=Bedford,ST=MA,C=US$">
372
+ <description>Roomba Device</description>
373
+ <example hw.product="Roomba" hw.vendor="iRobot">CN=Roomba CA,OU=HBU,O=iRobot,L=Bedford,ST=MA,C=US</example>
374
+ <param pos="0" name="hw.vendor" value="iRobot"/>
375
+ <param pos="0" name="hw.device" value="Device"/>
376
+ <param pos="0" name="hw.product" value="Roomba"/>
377
+ </fingerprint>
378
+
379
+ <fingerprint pattern="(?i)^CN=\S+,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US(?:.*)$">
380
+ <description>FreshTomato Router Fireware</description>
381
+ <example>CN=192.168.1.1,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US</example>
382
+ <param pos="0" name="os.vendor" value="FreshTomato"/>
383
+ <param pos="0" name="os.product" value="Linux"/>
384
+ <param pos="0" name="os.device" value="Router"/>
385
+ </fingerprint>
386
+
387
+ <fingerprint pattern="(?i)^SERIALNUMBER=(\d+),CN=(\S+),OU=ST-VS,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,C=DE">
388
+ <description>Bosch Device</description>
389
+ <example hw.serial_number="111111111111111111" host.mac="00-07-5f-11-11-11">SERIALNUMBER=111111111111111111,CN=00-07-5f-11-11-11,OU=ST-VS,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,C=DE</example>
390
+ <param pos="0" name="os.vendor" value="Bosch"/>
391
+ <param pos="0" name="hw.vendor" value="Bosch"/>
392
+ <param pos="1" name="hw.serial_number"/>
393
+ <param pos="2" name="host.mac"/>
394
+ </fingerprint>
395
+
360
396
  </fingerprints>
data/xml/x509_subjects.xml CHANGED
@@ -69,13 +69,12 @@
69
69
 
70
70
  <fingerprint pattern="^SERIALNUMBER=PID:([^ ]+) SN:([^,]+),CN=(?:[a-zA-Z0-9\-]+)-SEP([a-fA-F0-9]{12}),OU=[CV]TG,O=Cisco Systems Inc\.$">
71
71
  <description>Cisco IP phone with serial number</description>
72
- <example host.mac="B07D47D33A1C" hw.product="CP-8851" cisco.serial_number="FCH1924AHCA" hw.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
73
- <example host.mac="64D989000000" hw.product="CP-9951" cisco.serial_number="FCH15200000" hw.serial_number="FCH15200000">SERIALNUMBER=PID:CP-9951 SN:FCH15200000,CN=CP-9951-SEP64D989000000,OU=VTG,O=Cisco Systems Inc.</example>
72
+ <example host.mac="B07D47D33A1C" hw.product="CP-8851" hw.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
73
+ <example host.mac="64D989000000" hw.product="CP-9951" hw.serial_number="FCH15200000">SERIALNUMBER=PID:CP-9951 SN:FCH15200000,CN=CP-9951-SEP64D989000000,OU=VTG,O=Cisco Systems Inc.</example>
74
74
  <param pos="0" name="hw.device" value="VoIP"/>
75
75
  <param pos="0" name="hw.vendor" value="Cisco"/>
76
76
  <param pos="1" name="hw.product"/>
77
77
  <param pos="2" name="hw.serial_number"/>
78
- <param pos="2" name="cisco.serial_number"/>
79
78
  <param pos="3" name="host.mac"/>
80
79
  </fingerprint>
81
80
 
@@ -217,7 +216,7 @@
217
216
 
218
217
  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US$">
219
218
  <description>HP iLO</description>
220
- <example>CN=SERVER-1231,OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US</example>
219
+ <example host.name="SERVER-1231">CN=SERVER-1231,OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US</example>
221
220
  <param pos="0" name="hw.device" value="Lights Out Management"/>
222
221
  <param pos="0" name="hw.vendor" value="HP"/>
223
222
  <param pos="0" name="hw.family" value="iLO"/>
@@ -248,7 +247,7 @@
248
247
 
249
248
  <fingerprint pattern="^CN=OA\-([a-fA-F0-9]+),OU=Onboard Administrator,">
250
249
  <description>HP iLO (Onboard Administrator)</description>
251
- <example>CN=OA-001F296E21A3,OU=Onboard Administrator,O=Corp.,L=Location,ST=N/A,C=US</example>
250
+ <example host.mac="001F296E21A3">CN=OA-001F296E21A3,OU=Onboard Administrator,O=Corp.,L=Location,ST=N/A,C=US</example>
252
251
  <example>CN=OA-80C16E999999,OU=Onboard Administrator,O=Hewlett-Packard</example>
253
252
  <param pos="0" name="hw.device" value="Lights Out Management"/>
254
253
  <param pos="0" name="hw.vendor" value="HP"/>
@@ -265,7 +264,7 @@
265
264
 
266
265
  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=Hewlett Packard Enterprise Network Management Software \(SMH\),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US$">
267
266
  <description>HP iLO - Enterprise Mgmt variant</description>
268
- <example>CN=bigsrv99,OU=Hewlett Packard Enterprise Network Management Software (SMH),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
267
+ <example host.name="bigsrv99">CN=bigsrv99,OU=Hewlett Packard Enterprise Network Management Software (SMH),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
269
268
  <param pos="0" name="hw.device" value="Lights Out Management"/>
270
269
  <param pos="0" name="hw.vendor" value="HP"/>
271
270
  <param pos="0" name="hw.family" value="iLO"/>
@@ -309,29 +308,27 @@
309
308
 
310
309
  <fingerprint pattern="^CN=C-series CIMC,OU=PID:([^ ]+) SERIAL:([^,]+),O=Cisco">
311
310
  <description>Cisco Integrated Management Controller</description>
312
- <example cisco.serial_number="FCH18999AAA" hw.serial_number="FCH18999AAA" cisco.imc_model="UCSC-C220-M3S">CN=C-series CIMC,OU=PID:UCSC-C220-M3S SERIAL:FCH18999AAA,O=Cisco Self Signed,L=San Jose,ST=California,C=US</example>
311
+ <example hw.serial_number="FCH18999AAA" cisco.imc_model="UCSC-C220-M3S">CN=C-series CIMC,OU=PID:UCSC-C220-M3S SERIAL:FCH18999AAA,O=Cisco Self Signed,L=San Jose,ST=California,C=US</example>
313
312
  <param pos="0" name="hw.device" value="Lights Out Management"/>
314
313
  <param pos="0" name="hw.vendor" value="Cisco"/>
315
314
  <param pos="0" name="hw.product" value="IMC"/>
316
- <param pos="2" name="hw.serial_number"/>
317
315
  <param pos="0" name="os.vendor" value="Cisco"/>
318
316
  <param pos="0" name="os.family" value="Linux"/>
319
317
  <param pos="0" name="os.product" value="IMC"/>
320
- <param pos="2" name="cisco.serial_number"/>
318
+ <param pos="2" name="hw.serial_number"/>
321
319
  <param pos="1" name="cisco.imc_model"/>
322
320
  </fingerprint>
323
321
 
324
322
  <fingerprint pattern="^CN=C220-(FCH[^,]+),OU=null,O=Cisco Systems Inc">
325
323
  <description>Cisco Integrated Management Controller C220</description>
326
- <example cisco.serial_number="FCH17999AAA" hw.serial_number="FCH17999AAA">CN=C220-FCH17999AAA,OU=null,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US</example>
324
+ <example hw.serial_number="FCH17999AAA">CN=C220-FCH17999AAA,OU=null,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US</example>
327
325
  <param pos="0" name="hw.device" value="Lights Out Management"/>
328
326
  <param pos="0" name="hw.vendor" value="Cisco"/>
329
327
  <param pos="0" name="hw.product" value="IMC"/>
330
- <param pos="1" name="hw.serial_number"/>
331
328
  <param pos="0" name="os.vendor" value="Cisco"/>
332
329
  <param pos="0" name="os.family" value="Linux"/>
333
330
  <param pos="0" name="os.product" value="IMC"/>
334
- <param pos="1" name="cisco.serial_number"/>
331
+ <param pos="1" name="hw.serial_number"/>
335
332
  </fingerprint>
336
333
 
337
334
  <fingerprint pattern="^CN=avocent.com,OU=AESS,O=Avocent,L=Sunrise,ST=FL,C=US$">
@@ -411,12 +408,11 @@
411
408
 
412
409
  <fingerprint pattern="^SERIALNUMBER=([a-zA-Z0-9]+),CN=DEVICE-vWLC,O=Cisco Virtual WLC$">
413
410
  <description>Cisco vWLC</description>
414
- <example cisco.serial_number="9C89M2088D1" hw.serial_number="9C89M2088D1">SERIALNUMBER=9C89M2088D1,CN=DEVICE-vWLC,O=Cisco Virtual WLC</example>
411
+ <example hw.serial_number="9C89M2088D1">SERIALNUMBER=9C89M2088D1,CN=DEVICE-vWLC,O=Cisco Virtual WLC</example>
415
412
  <param pos="0" name="os.vendor" value="Cisco"/>
416
413
  <param pos="0" name="os.device" value="Wireless Controller"/>
417
414
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
418
415
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
419
- <param pos="1" name="cisco.serial_number"/>
420
416
  <param pos="1" name="hw.serial_number"/>
421
417
  </fingerprint>
422
418
 
@@ -508,7 +504,7 @@
508
504
 
509
505
  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=VMware ESX Server Default Certificate,O=VMware\\, Inc,L=Palo Alto,ST=California,C=US$">
510
506
  <description>VMware ESX</description>
511
- <example>CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
507
+ <example host.name="server99.">CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
512
508
  <param pos="0" name="service.vendor" value="VMware"/>
513
509
  <param pos="0" name="os.vendor" value="VMware"/>
514
510
  <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
@@ -619,8 +615,8 @@
619
615
 
620
616
  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=(?:Cast|Google TV),O=Google Inc,L=Mountain View,ST=California,C=US$">
621
617
  <description>Google Chromecast</description>
622
- <example chromecast.serial_number="LVDZG5" host.mac_local="FA8FCA67413D" hw.serial_number="LVDZG5">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
623
- <example chromecast.serial_number="YRBLE" host.mac_local="FA8FCA7DE87D" hw.serial_number="YRBLE">CN=YRBLE FA8FCA7DE87D,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
618
+ <example host.mac_local="FA8FCA67413D" hw.serial_number="LVDZG5">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
619
+ <example host.mac_local="FA8FCA7DE87D" hw.serial_number="YRBLE">CN=YRBLE FA8FCA7DE87D,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
624
620
  <param pos="0" name="os.vendor" value="Google"/>
625
621
  <param pos="0" name="os.product" value="Chrome OS"/>
626
622
  <param pos="0" name="os.certainty" value="0.5"/>
@@ -628,9 +624,9 @@
628
624
  <param pos="0" name="hw.device" value="Media Server"/>
629
625
  <param pos="0" name="hw.vendor" value="Google"/>
630
626
  <param pos="0" name="hw.product" value="Chromecast"/>
631
- <param pos="1" name="hw.serial_number"/>
632
627
  <param pos="0" name="hw.certainty" value="0.5"/>
633
- <param pos="1" name="chromecast.serial_number"/>
628
+ <param pos="1" name="hw.serial_number"/>
629
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
634
630
  <!-- This is the hotspot-mode MAC address (clear bit 2) -->
635
631
 
636
632
  <param pos="2" name="host.mac_local"/>
@@ -638,7 +634,7 @@
638
634
 
639
635
  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=Cast TV \(Vizio\),O=Google Inc,L=Mountain View,ST=California,C=US$">
640
636
  <description>Vizio SmartTV (Android) with Google Cast</description>
641
- <example chromecast.serial_number="9V039WC9" hw.serial_number="9V039WC9" host.mac_local="FA8FCA697898">CN=9V039WC9 FA8FCA697898,OU=Cast TV (Vizio),O=Google Inc,L=Mountain View,ST=California,C=US</example>
637
+ <example hw.serial_number="9V039WC9" host.mac_local="FA8FCA697898">CN=9V039WC9 FA8FCA697898,OU=Cast TV (Vizio),O=Google Inc,L=Mountain View,ST=California,C=US</example>
642
638
  <param pos="0" name="os.vendor" value="Google"/>
643
639
  <param pos="0" name="os.family" value="Linux"/>
644
640
  <param pos="0" name="os.product" value="Android"/>
@@ -646,7 +642,6 @@
646
642
  <param pos="0" name="hw.device" value="Smart TV"/>
647
643
  <param pos="0" name="hw.vendor" value="Vizio"/>
648
644
  <param pos="1" name="hw.serial_number"/>
649
- <param pos="1" name="chromecast.serial_number"/>
650
645
  <!-- This is the hotspot-mode MAC address (clear bit 2) -->
651
646
 
652
647
  <param pos="2" name="host.mac_local"/>
@@ -885,31 +880,29 @@
885
880
 
886
881
  <fingerprint pattern="^CN=([A-Za-z0-9]+),OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
887
882
  <description>Fortinet Gateway</description>
888
- <example fortinet.serial_number="FG100ETK1800118" hw.serial_number="FG100ETK1800118">CN=FG100ETK1800118,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
889
- <example fortinet.serial_number="FGT30D3X15038375" hw.serial_number="FGT30D3X15038375">CN=FGT30D3X15038375,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
883
+ <example hw.serial_number="FG100ETK1800118">CN=FG100ETK1800118,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
884
+ <example hw.serial_number="FGT30D3X15038375">CN=FGT30D3X15038375,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
890
885
  <param pos="0" name="hw.vendor" value="Fortinet"/>
891
886
  <param pos="0" name="hw.device" value="Firewall"/>
892
- <param pos="1" name="hw.serial_number"/>
893
887
  <param pos="0" name="os.vendor" value="Fortinet"/>
894
888
  <param pos="0" name="os.family" value="Linux"/>
895
889
  <param pos="0" name="os.device" value="Firewall"/>
896
890
  <param pos="0" name="os.product" value="FortiOS"/>
897
891
  <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
898
- <param pos="1" name="fortinet.serial_number"/>
892
+ <param pos="1" name="hw.serial_number"/>
899
893
  </fingerprint>
900
894
 
901
895
  <fingerprint pattern="^CN=([A-Za-z0-9]+),O=Fortinet Ltd\.$">
902
896
  <description>Fortinet Gateway (Older)</description>
903
- <example fortinet.serial_number="FG100D3G13803999" hw.serial_number="FG100D3G13803999">CN=FG100D3G13803999,O=Fortinet Ltd.</example>
897
+ <example hw.serial_number="FG100D3G13803999">CN=FG100D3G13803999,O=Fortinet Ltd.</example>
904
898
  <param pos="0" name="hw.vendor" value="Fortinet"/>
905
899
  <param pos="0" name="hw.device" value="Firewall"/>
906
- <param pos="1" name="hw.serial_number"/>
907
900
  <param pos="0" name="os.vendor" value="Fortinet"/>
908
901
  <param pos="0" name="os.family" value="Linux"/>
909
902
  <param pos="0" name="os.device" value="Firewall"/>
910
903
  <param pos="0" name="os.product" value="FortiOS"/>
911
904
  <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
912
- <param pos="1" name="fortinet.serial_number"/>
905
+ <param pos="1" name="hw.serial_number"/>
913
906
  </fingerprint>
914
907
 
915
908
  <fingerprint pattern="^CN=FortiMail,OU=FortiMail,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
@@ -1139,10 +1132,11 @@
1139
1132
  <param pos="0" name="os.product" value="Linux"/>
1140
1133
  </fingerprint>
1141
1134
 
1142
- <fingerprint pattern="^CN=MAC([a-fA-F0-9]{12}),OU=([^,]+),O=Mercury Security Products\\, LLC,L=Long Beach,ST=CA,C=US$">
1135
+ <fingerprint pattern="^CN=MAC([a-fA-F0-9]{12}),OU=([^,]+),O=Mercury Security Products\\, LLC,L=Long Beach,ST=CA,C=US(?:,\S+)?$">
1143
1136
  <description>Mercurity Security (now HID Global)</description>
1144
1137
  <example hw.product="M5IC" host.mac="000FE507A1F1">CN=MAC000FE507A1F1,OU=M5IC,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US</example>
1145
1138
  <example hw.product="EP-1502" host.mac="000FE508BC71">CN=MAC000FE508BC71,OU=EP-1502,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US</example>
1139
+ <example hw.product="LP-1501" host.mac="000FE5091111">CN=MAC000FE5091111,OU=LP-1501,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US,2.5.4.4=#111111111111111111</example>
1146
1140
  <param pos="0" name="hw.vendor" value="Mercury Security"/>
1147
1141
  <param pos="0" name="hw.device" value="Access Control"/>
1148
1142
  <param pos="1" name="host.mac"/>
@@ -1242,7 +1236,7 @@
1242
1236
 
1243
1237
  <fingerprint pattern="^CN=Canon (iR-[a-zA-Z0-9\.\-\_]+)$">
1244
1238
  <description>Canon iR-ADV Printer with product info</description>
1245
- <example os.product="iR-ADV">CN=Canon iR-ADV</example>
1239
+ <example os.product="iR-ADV" hw.product="iR-ADV">CN=Canon iR-ADV</example>
1246
1240
  <param pos="0" name="hw.device" value="Printer"/>
1247
1241
  <param pos="0" name="hw.vendor" value="Canon"/>
1248
1242
  <param pos="0" name="os.device" value="Printer"/>
@@ -1307,20 +1301,28 @@
1307
1301
 
1308
1302
  <fingerprint pattern="^CN=Ruckus Wireless ZoneDirector SN-(\d+),O=Ruckus Wireless\\, Inc\.,ST=CA,C=US$">
1309
1303
  <description>Ruckus Zone Director</description>
1310
- <example ruckus.serial_number="221301007591" hw.serial_number="221301007591">CN=Ruckus Wireless ZoneDirector SN-221301007591,O=Ruckus Wireless\, Inc.,ST=CA,C=US</example>
1304
+ <example hw.serial_number="221301007591">CN=Ruckus Wireless ZoneDirector SN-221301007591,O=Ruckus Wireless\, Inc.,ST=CA,C=US</example>
1311
1305
  <param pos="0" name="hw.device" value="Wireless Controller"/>
1312
1306
  <param pos="0" name="hw.vendor" value="Ruckus"/>
1313
1307
  <param pos="0" name="hw.product" value="Zone Director"/>
1314
- <param pos="1" name="hw.serial_number"/>
1315
1308
  <param pos="0" name="os.device" value="Wireless Controller"/>
1316
1309
  <param pos="0" name="os.vendor" value="Ruckus"/>
1317
1310
  <param pos="0" name="os.product" value="Zone Director"/>
1318
- <param pos="1" name="ruckus.serial_number"/>
1311
+ <param pos="1" name="hw.serial_number"/>
1312
+ </fingerprint>
1313
+
1314
+ <fingerprint pattern="^CN=SN-(\d+),O=Ruckus Wireless Inc.,L=Sunnyvale,ST=California,C=US$">
1315
+ <description>Ruckus Wireless Access Point</description>
1316
+ <example hw.serial_number="010101010101">CN=SN-010101010101,O=Ruckus Wireless Inc.,L=Sunnyvale,ST=California,C=US</example>
1317
+ <param pos="0" name="hw.device" value="WAP"/>
1318
+ <param pos="0" name="hw.vendor" value="Ruckus"/>
1319
+ <param pos="0" name="hw.product" value="Access Point"/>
1320
+ <param pos="1" name="hw.serial_number"/>
1319
1321
  </fingerprint>
1320
1322
 
1321
1323
  <fingerprint pattern="^CN=DT([^\s]+) Series,O=NEC Corporation,ST=Tokyo,C=JP$">
1322
1324
  <description>NEC DT Series IP Phone</description>
1323
- <example>CN=DT800 Series,O=NEC Corporation,ST=Tokyo,C=JP</example>
1325
+ <example hw.product="800">CN=DT800 Series,O=NEC Corporation,ST=Tokyo,C=JP</example>
1324
1326
  <param pos="0" name="os.vendor" value="NEC"/>
1325
1327
  <param pos="0" name="os.device" value="VoIP"/>
1326
1328
  <param pos="0" name="hw.vendor" value="NEC"/>
@@ -1469,9 +1471,10 @@
1469
1471
  <param pos="0" name="hw.product" value="Sensor"/>
1470
1472
  </fingerprint>
1471
1473
 
1472
- <fingerprint pattern="^CN=HiveAP,OU=Default,O=Aerohive,ST=California,C=US$">
1474
+ <fingerprint pattern="^CN=HiveAP,OU=Default,O=Aerohive,(?:L=Sunnyvale,)?ST=California,C=US$">
1473
1475
  <description>Aerohive Access Point</description>
1474
1476
  <example>CN=HiveAP,OU=Default,O=Aerohive,ST=California,C=US</example>
1477
+ <example>CN=HiveAP,OU=Default,O=Aerohive,L=Sunnyvale,ST=California,C=US</example>
1475
1478
  <param pos="0" name="hw.vendor" value="Aerohive"/>
1476
1479
  <param pos="0" name="hw.device" value="WAP"/>
1477
1480
  <param pos="0" name="hw.product" value="Access Point"/>
@@ -1654,4 +1657,102 @@
1654
1657
  <param pos="1" name="host.name"/>
1655
1658
  </fingerprint>
1656
1659
 
1660
+ <fingerprint pattern="^CN=Freebox Intermediate CA,O=Freebox,ST=France,C=FR$">
1661
+ <description>Freebox Device</description>
1662
+ <example>CN=Freebox Intermediate CA,O=Freebox,ST=France,C=FR</example>
1663
+ <param pos="0" name="hw.vendor" value="Freebox"/>
1664
+ </fingerprint>
1665
+
1666
+ <fingerprint pattern="^CN=TP-LINK CA,O=TP-LINK Technologies CO.\\, LTD.,L=Shenzhen,ST=Guangdong,C=CN(?:,\S+)?$">
1667
+ <description>TP-LINK Device</description>
1668
+ <example>CN=TP-LINK CA,O=TP-LINK Technologies CO.\, LTD.,L=Shenzhen,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c16736572766963654074702d6c696e6b2e636f6d2e636e</example>
1669
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
1670
+ </fingerprint>
1671
+
1672
+ <fingerprint pattern="^CN=BHA-([0-9a-fA-F]{12}),O=Bird Home Automation$">
1673
+ <description>Bird Home Automation</description>
1674
+ <example host.mac="0123456789AB">CN=BHA-0123456789AB,O=Bird Home Automation</example>
1675
+ <param pos="0" name="hw.device" value="Device"/>
1676
+ <param pos="0" name="hw.vendor" value="Bird Home Automation"/>
1677
+ <param pos="1" name="host.mac"/>
1678
+ </fingerprint>
1679
+
1680
+ <fingerprint pattern="^CN=\S+,OU=Media Server,O=Avaya Inc\.,C=US">
1681
+ <description>Avaya Media Server</description>
1682
+ <example>CN=192.168.0.3,OU=Media Server,O=Avaya Inc.,C=US</example>
1683
+ <param pos="0" name="os.vendor" value="Avaya"/>
1684
+ <param pos="0" name="os.device" value="Media Gateway"/>
1685
+ <param pos="0" name="os.product" value="Media Server"/>
1686
+ </fingerprint>
1687
+
1688
+ <fingerprint pattern="^CN=iSTAR Ultra">
1689
+ <description>iSTAR Ultra</description>
1690
+ <example>CN=iSTAR Ultra,OU=Access Control and Video Division,O=Johnson Controls,L=Westford,ST=Massachusetts,C=US</example>
1691
+ <param pos="0" name="os.vendor" value="Software House"/>
1692
+ <param pos="0" name="os.family" value="Linux"/>
1693
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
1694
+ <param pos="0" name="hw.vendor" value="Software House"/>
1695
+ <param pos="0" name="hw.device" value="Access Control"/>
1696
+ <param pos="0" name="hw.family" value="iSTAR Door Controllers"/>
1697
+ <param pos="0" name="hw.product" value="iSTAR Ultra"/>
1698
+ <param pos="0" name="hw.cpe23" value="cpe:/h:swhouse:istar_ultra:-"/>
1699
+ </fingerprint>
1700
+
1701
+ <fingerprint pattern="^O=SpotteRF - NetworkedIO$">
1702
+ <description>SpotterRF</description>
1703
+ <example>O=SpotteRF - NetworkedIO</example>
1704
+ <param pos="0" name="os.vendor" value="SpotterRF"/>
1705
+ <param pos="0" name="os.family" value="Linux"/>
1706
+ <param pos="0" name="os.certainty" value="0.90"/>
1707
+ <param pos="0" name="hw.vendor" value="SpotterRF"/>
1708
+ <param pos="0" name="hw.device" value="Sensor"/>
1709
+ <param pos="0" name="hw.product" value="Drone Detector"/>
1710
+ </fingerprint>
1711
+
1712
+ <fingerprint pattern="(?i)^CN=.{0,1000}myboschcam.net,O=Bosch Sicherheitssysteme">
1713
+ <description>Bosch AutoDome IP Camera</description>
1714
+ <example>CN=local.myboschcam.net,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,ST=Bayern,C=DE</example>
1715
+ <param pos="0" name="hw.vendor" value="Bosch"/>
1716
+ <param pos="0" name="hw.device" value="Web Cam"/>
1717
+ <param pos="0" name="hw.product" value="AutoDome"/>
1718
+ <param pos="0" name="hw.certainty" value="0.50"/>
1719
+ </fingerprint>
1720
+
1721
+ <fingerprint pattern="(?i)CN=(\w+),OU=BWI,O=Redline Communications Inc">
1722
+ <description>Redline Communication Radios</description>
1723
+ <example hw.product="an80i">CN=an80i,OU=BWI,O=Redline Communications Inc.,C=CA</example>
1724
+ <param pos="0" name="hw.vendor" value="Redline"/>
1725
+ <param pos="0" name="hw.device" value="WAP"/>
1726
+ <param pos="1" name="hw.product"/>
1727
+ </fingerprint>
1728
+
1729
+ <fingerprint pattern="(?i)CN=Vaddio Device,O=Vaddio,L=Minnetonka,ST=MN,C=US">
1730
+ <description>Vadio DocCom</description>
1731
+ <example>CN=Vaddio Device,O=Vaddio,L=Minnetonka,ST=MN,C=US</example>
1732
+ <param pos="0" name="hw.vendor" value="Vaddio"/>
1733
+ <param pos="0" name="hw.device" value="Web Cam"/>
1734
+ <param pos="0" name="hw.product" value="DocCam"/>
1735
+ <param pos="0" name="hw.certainty" value="0.50"/>
1736
+ </fingerprint>
1737
+
1738
+ <fingerprint pattern="(?i)CN=.{0,1000},OU=2N IP Intercoms,O=2N Telekomunikace a.s.,L=Prague,ST=Czech Republic,C=CZ">
1739
+ <description>2N IP Intercoms</description>
1740
+ <example>CN=11111111111d,OU=2N IP Intercoms,O=2N Telekomunikace a.s.,L=Prague,ST=Czech Republic,C=CZ</example>
1741
+ <param pos="0" name="hw.vendor" value="2N Telekomunikace"/>
1742
+ <param pos="0" name="hw.device" value="IP Camera"/>
1743
+ <param pos="0" name="hw.certainty" value="0.50"/>
1744
+ </fingerprint>
1745
+
1746
+ <fingerprint pattern="^CN=(.{1,256}),OU=PVE Cluster Node,O=Proxmox Virtual Environment$">
1747
+ <description>Proxmox open-source virtualization platform</description>
1748
+ <example host.name="pve.example.org">CN=pve.example.org,OU=PVE Cluster Node,O=Proxmox Virtual Environment</example>
1749
+ <param pos="1" name="host.name"/>
1750
+ <param pos="0" name="service.vendor" value="Proxmox"/>
1751
+ <param pos="0" name="service.product" value="Virtual Environment"/>
1752
+ <param pos="0" name="service.cpe23" value="cpe:/a:proxmox:virtual_environment:-"/>
1753
+ <param pos="0" name="os.vendor" value="Proxmox"/>
1754
+ <param pos="0" name="os.family" value="Linux"/>
1755
+ <param pos="0" name="os.product" value="Proxmox"/>
1756
+ </fingerprint>
1757
+
1657
1758
  </fingerprints>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.3.21
4
+ version: 2.3.22
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-08-02 00:00:00.000000000 Z
11
+ date: 2021-12-14 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec
@@ -128,7 +128,9 @@ files:
128
128
  - ".github/ISSUE_TEMPLATE/fingerprint_request.md"
129
129
  - ".github/PULL_REQUEST_TEMPLATE"
130
130
  - ".github/SECURITY.md"
131
+ - ".github/dependabot.yml"
131
132
  - ".github/workflows/ci.yml"
133
+ - ".github/workflows/verify.yml"
132
134
  - ".gitignore"
133
135
  - ".rspec"
134
136
  - ".ruby-gemset"
@@ -207,10 +209,12 @@ files:
207
209
  - spec/lib/recog/nizer_spec.rb
208
210
  - spec/lib/recog/verify_reporter_spec.rb
209
211
  - spec/spec_helper.rb
212
+ - tools/dev/hooks/pre-commit
210
213
  - update_cpes.py
211
214
  - xml/apache_modules.xml
212
215
  - xml/apache_os.xml
213
216
  - xml/architecture.xml
217
+ - xml/dhcp_vendor_class.xml
214
218
  - xml/dns_versionbind.xml
215
219
  - xml/favicons.xml
216
220
  - xml/fingerprints.xsd
@@ -275,7 +279,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
275
279
  - !ruby/object:Gem::Version
276
280
  version: '0'
277
281
  requirements: []
278
- rubygems_version: 3.0.8
282
+ rubygems_version: 3.0.3
279
283
  signing_key:
280
284
  specification_version: 4
281
285
  summary: Network service fingerprint database, classes, and utilities