recog 2.3.21 → 2.3.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/verify.yml +89 -0
  4. data/CONTRIBUTING.md +6 -0
  5. data/README.md +17 -0
  6. data/bin/recog_standardize +28 -13
  7. data/bin/recog_verify +1 -2
  8. data/cpe-remap.yaml +13 -0
  9. data/features/verify.feature +14 -14
  10. data/identifiers/fields.txt +5 -4
  11. data/identifiers/hw_device.txt +6 -0
  12. data/identifiers/hw_family.txt +8 -0
  13. data/identifiers/hw_product.txt +51 -0
  14. data/identifiers/os_family.txt +1 -0
  15. data/identifiers/os_product.txt +10 -0
  16. data/identifiers/service_product.txt +12 -0
  17. data/identifiers/vendor.txt +49 -0
  18. data/lib/recog/db.rb +2 -1
  19. data/lib/recog/fingerprint.rb +18 -5
  20. data/lib/recog/verifier.rb +5 -5
  21. data/lib/recog/verifier_factory.rb +3 -3
  22. data/lib/recog/verify_reporter.rb +14 -4
  23. data/lib/recog/version.rb +1 -1
  24. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  25. data/spec/lib/recog/verify_reporter_spec.rb +69 -0
  26. data/tools/dev/hooks/pre-commit +21 -0
  27. data/update_cpes.py +1 -1
  28. data/xml/apache_os.xml +38 -38
  29. data/xml/dhcp_vendor_class.xml +206 -0
  30. data/xml/favicons.xml +148 -42
  31. data/xml/ftp_banners.xml +30 -16
  32. data/xml/h323_callresp.xml +99 -99
  33. data/xml/hp_pjl_id.xml +3 -3
  34. data/xml/html_title.xml +502 -25
  35. data/xml/http_cookies.xml +64 -56
  36. data/xml/http_servers.xml +74 -14
  37. data/xml/http_wwwauth.xml +107 -38
  38. data/xml/imap_banners.xml +3 -3
  39. data/xml/mdns_device-info_txt.xml +389 -26
  40. data/xml/mysql_banners.xml +1 -1
  41. data/xml/nntp_banners.xml +3 -3
  42. data/xml/ntp_banners.xml +64 -64
  43. data/xml/operating_system.xml +3 -3
  44. data/xml/pop_banners.xml +7 -7
  45. data/xml/rsh_resp.xml +3 -3
  46. data/xml/sip_banners.xml +27 -0
  47. data/xml/sip_user_agents.xml +54 -1
  48. data/xml/smtp_banners.xml +15 -15
  49. data/xml/smtp_ehlo.xml +1 -1
  50. data/xml/smtp_help.xml +10 -10
  51. data/xml/smtp_noop.xml +2 -2
  52. data/xml/snmp_sysdescr.xml +325 -200
  53. data/xml/snmp_sysobjid.xml +25 -25
  54. data/xml/ssh_banners.xml +7 -5
  55. data/xml/telnet_banners.xml +155 -20
  56. data/xml/tls_jarm.xml +26 -4
  57. data/xml/x509_issuers.xml +36 -0
  58. data/xml/x509_subjects.xml +136 -35
  59. metadata +7 -3
data/xml/tls_jarm.xml CHANGED
@@ -14,13 +14,33 @@
14
14
  <param pos="0" name="service.cpe23" value="cpe:/a:torproject:tor:-"/>
15
15
  </fingerprint>
16
16
 
17
- <fingerprint pattern="^2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d$">
18
- <description>Synology NAS</description>
17
+ <fingerprint pattern="^2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d|29d29d15d29d29d21c29d29d29d29d10d7a07cb776562eccb97246005feba5|2ad2ad0002ad2ad0002ad2ad2ad2ad5bf44aec534289dfa8e33148b66cd6c3|29d29d15d29d29d21c29d29d29d29de857600fcd9f89735d87c3704c4e141b$">
18
+ <description>Synology NAS DSM 6</description>
19
+ <example>29d29d15d29d29d21c29d29d29d29d10d7a07cb776562eccb97246005feba5</example>
20
+ <example>29d29d15d29d29d21c29d29d29d29de857600fcd9f89735d87c3704c4e141b</example>
21
+ <example>2ad2ad0002ad2ad0002ad2ad2ad2ad5bf44aec534289dfa8e33148b66cd6c3</example>
19
22
  <example>2ad2ad0002ad2ad0002ad2ad2ad2ada9e96d3ba9f7903758a731e0fa01453d</example>
20
23
  <param pos="0" name="os.device" value="NAS"/>
21
24
  <param pos="0" name="os.family" value="Linux"/>
22
25
  <param pos="0" name="os.product" value="DSM"/>
23
26
  <param pos="0" name="os.vendor" value="Synology"/>
27
+ <param pos="0" name="os.version" value="6"/>
28
+ <param pos="0" name="hw.vendor" value="Synology"/>
29
+ <param pos="0" name="hw.device" value="NAS"/>
30
+ </fingerprint>
31
+
32
+ <fingerprint pattern="^00000000000000000042d42d0000009535d5979f591ae8e547c5e5743e5b64|29d29d15d29d29d00042d42d00000068f5dc63852f94da932cd6b61b1cd9e3|29d29d15d29d29d21c42d42d000000bf85d79ff39d9f5079675604a74fc04b|29d29d15d29d29d00042d42d000000038eaaf490bec8dc33757f165ce01762|29d29d15d29d29d21c42d42d000000790cb01ea78cc2a73fe8428d61afc0c8$">
33
+ <description>Synology NAS DSM 7</description>
34
+ <example>00000000000000000042d42d0000009535d5979f591ae8e547c5e5743e5b64</example>
35
+ <example>29d29d15d29d29d00042d42d000000038eaaf490bec8dc33757f165ce01762</example>
36
+ <example>29d29d15d29d29d00042d42d00000068f5dc63852f94da932cd6b61b1cd9e3</example>
37
+ <example>29d29d15d29d29d21c42d42d000000790cb01ea78cc2a73fe8428d61afc0c8</example>
38
+ <example>29d29d15d29d29d21c42d42d000000bf85d79ff39d9f5079675604a74fc04b</example>
39
+ <param pos="0" name="os.device" value="NAS"/>
40
+ <param pos="0" name="os.family" value="Linux"/>
41
+ <param pos="0" name="os.product" value="DSM"/>
42
+ <param pos="0" name="os.vendor" value="Synology"/>
43
+ <param pos="0" name="os.version" value="7"/>
24
44
  <param pos="0" name="hw.vendor" value="Synology"/>
25
45
  <param pos="0" name="hw.device" value="NAS"/>
26
46
  </fingerprint>
@@ -118,11 +138,13 @@
118
138
  <param pos="0" name="hw.device" value="Media Server"/>
119
139
  <param pos="0" name="hw.vendor" value="Google"/>
120
140
  <param pos="0" name="hw.product" value="Chromecast"/>
141
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
121
142
  </fingerprint>
122
143
 
123
- <fingerprint pattern="^21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601$">
124
- <description>VMWare ESXi</description>
144
+ <fingerprint pattern="^21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601|2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d$">
145
+ <description>VMware ESXi</description>
125
146
  <example>21d14d00021d21d21c21d14d21d21d3e9a0dda94718e521eb7d1409c9e3601</example>
147
+ <example>2ad2ad0002ad2ad0002ad2ad2ad2ad755a2cec4b52fb1bce1ac7f1e48c8a7d</example>
126
148
  <param pos="0" name="os.vendor" value="VMware"/>
127
149
  <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
128
150
  <param pos="0" name="os.product" value="VMware ESXi Server"/>
data/xml/x509_issuers.xml CHANGED
@@ -106,6 +106,7 @@
106
106
  <param pos="0" name="hw.vendor" value="Google"/>
107
107
  <param pos="0" name="hw.product" value="Chromecast"/>
108
108
  <param pos="0" name="hw.certainty" value="0.5"/>
109
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
109
110
  <param pos="0" name="chromecast.generation" value="1"/>
110
111
  </fingerprint>
111
112
 
@@ -127,6 +128,7 @@
127
128
  <param pos="0" name="hw.vendor" value="Google"/>
128
129
  <param pos="0" name="hw.product" value="Chromecast"/>
129
130
  <param pos="0" name="hw.certainty" value="0.5"/>
131
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
130
132
  <param pos="1" name="chromecast.generation"/>
131
133
  <param pos="2" name="chromecast.capabilities"/>
132
134
  </fingerprint>
@@ -357,4 +359,38 @@
357
359
  <param pos="0" name="service.cpe23" value="cpe:/a:caddyserver:caddy:-"/>
358
360
  </fingerprint>
359
361
 
362
+ <fingerprint pattern="^CN=Avaya cu360 (\S+)$">
363
+ <description>Avaya Video Conferencing Device - CU360</description>
364
+ <example hw.serial_number="11YT11111111">CN=Avaya cu360 11YT11111111</example>
365
+ <param pos="0" name="hw.vendor" value="Avaya"/>
366
+ <param pos="0" name="hw.device" value="Video Conference"/>
367
+ <param pos="0" name="hw.product" value="CU360"/>
368
+ <param pos="1" name="hw.serial_number"/>
369
+ </fingerprint>
370
+
371
+ <fingerprint pattern="^CN=Roomba CA,OU=\S+,O=iRobot,L=Bedford,ST=MA,C=US$">
372
+ <description>Roomba Device</description>
373
+ <example hw.product="Roomba" hw.vendor="iRobot">CN=Roomba CA,OU=HBU,O=iRobot,L=Bedford,ST=MA,C=US</example>
374
+ <param pos="0" name="hw.vendor" value="iRobot"/>
375
+ <param pos="0" name="hw.device" value="Device"/>
376
+ <param pos="0" name="hw.product" value="Roomba"/>
377
+ </fingerprint>
378
+
379
+ <fingerprint pattern="(?i)^CN=\S+,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US(?:.*)$">
380
+ <description>FreshTomato Router Fireware</description>
381
+ <example>CN=192.168.1.1,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US</example>
382
+ <param pos="0" name="os.vendor" value="FreshTomato"/>
383
+ <param pos="0" name="os.product" value="Linux"/>
384
+ <param pos="0" name="os.device" value="Router"/>
385
+ </fingerprint>
386
+
387
+ <fingerprint pattern="(?i)^SERIALNUMBER=(\d+),CN=(\S+),OU=ST-VS,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,C=DE">
388
+ <description>Bosch Device</description>
389
+ <example hw.serial_number="111111111111111111" host.mac="00-07-5f-11-11-11">SERIALNUMBER=111111111111111111,CN=00-07-5f-11-11-11,OU=ST-VS,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,C=DE</example>
390
+ <param pos="0" name="os.vendor" value="Bosch"/>
391
+ <param pos="0" name="hw.vendor" value="Bosch"/>
392
+ <param pos="1" name="hw.serial_number"/>
393
+ <param pos="2" name="host.mac"/>
394
+ </fingerprint>
395
+
360
396
  </fingerprints>
data/xml/x509_subjects.xml CHANGED
@@ -69,13 +69,12 @@
69
69
 
70
70
  <fingerprint pattern="^SERIALNUMBER=PID:([^ ]+) SN:([^,]+),CN=(?:[a-zA-Z0-9\-]+)-SEP([a-fA-F0-9]{12}),OU=[CV]TG,O=Cisco Systems Inc\.$">
71
71
  <description>Cisco IP phone with serial number</description>
72
- <example host.mac="B07D47D33A1C" hw.product="CP-8851" cisco.serial_number="FCH1924AHCA" hw.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
73
- <example host.mac="64D989000000" hw.product="CP-9951" cisco.serial_number="FCH15200000" hw.serial_number="FCH15200000">SERIALNUMBER=PID:CP-9951 SN:FCH15200000,CN=CP-9951-SEP64D989000000,OU=VTG,O=Cisco Systems Inc.</example>
72
+ <example host.mac="B07D47D33A1C" hw.product="CP-8851" hw.serial_number="FCH1924AHCA">SERIALNUMBER=PID:CP-8851 SN:FCH1924AHCA,CN=CP-8851-SEPB07D47D33A1C,OU=CTG,O=Cisco Systems Inc.</example>
73
+ <example host.mac="64D989000000" hw.product="CP-9951" hw.serial_number="FCH15200000">SERIALNUMBER=PID:CP-9951 SN:FCH15200000,CN=CP-9951-SEP64D989000000,OU=VTG,O=Cisco Systems Inc.</example>
74
74
  <param pos="0" name="hw.device" value="VoIP"/>
75
75
  <param pos="0" name="hw.vendor" value="Cisco"/>
76
76
  <param pos="1" name="hw.product"/>
77
77
  <param pos="2" name="hw.serial_number"/>
78
- <param pos="2" name="cisco.serial_number"/>
79
78
  <param pos="3" name="host.mac"/>
80
79
  </fingerprint>
81
80
 
@@ -217,7 +216,7 @@
217
216
 
218
217
  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US$">
219
218
  <description>HP iLO</description>
220
- <example>CN=SERVER-1231,OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US</example>
219
+ <example host.name="SERVER-1231">CN=SERVER-1231,OU=ISS,O=Hewlett-Packard Company,L=Houston,ST=Texas,C=US</example>
221
220
  <param pos="0" name="hw.device" value="Lights Out Management"/>
222
221
  <param pos="0" name="hw.vendor" value="HP"/>
223
222
  <param pos="0" name="hw.family" value="iLO"/>
@@ -248,7 +247,7 @@
248
247
 
249
248
  <fingerprint pattern="^CN=OA\-([a-fA-F0-9]+),OU=Onboard Administrator,">
250
249
  <description>HP iLO (Onboard Administrator)</description>
251
- <example>CN=OA-001F296E21A3,OU=Onboard Administrator,O=Corp.,L=Location,ST=N/A,C=US</example>
250
+ <example host.mac="001F296E21A3">CN=OA-001F296E21A3,OU=Onboard Administrator,O=Corp.,L=Location,ST=N/A,C=US</example>
252
251
  <example>CN=OA-80C16E999999,OU=Onboard Administrator,O=Hewlett-Packard</example>
253
252
  <param pos="0" name="hw.device" value="Lights Out Management"/>
254
253
  <param pos="0" name="hw.vendor" value="HP"/>
@@ -265,7 +264,7 @@
265
264
 
266
265
  <fingerprint pattern="^CN=([A-Za-z0-9\_\-\.]+),OU=Hewlett Packard Enterprise Network Management Software \(SMH\),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US$">
267
266
  <description>HP iLO - Enterprise Mgmt variant</description>
268
- <example>CN=bigsrv99,OU=Hewlett Packard Enterprise Network Management Software (SMH),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
267
+ <example host.name="bigsrv99">CN=bigsrv99,OU=Hewlett Packard Enterprise Network Management Software (SMH),O=Hewlett Packard Enterprise,L=Houston,ST=Texas,C=US</example>
269
268
  <param pos="0" name="hw.device" value="Lights Out Management"/>
270
269
  <param pos="0" name="hw.vendor" value="HP"/>
271
270
  <param pos="0" name="hw.family" value="iLO"/>
@@ -309,29 +308,27 @@
309
308
 
310
309
  <fingerprint pattern="^CN=C-series CIMC,OU=PID:([^ ]+) SERIAL:([^,]+),O=Cisco">
311
310
  <description>Cisco Integrated Management Controller</description>
312
- <example cisco.serial_number="FCH18999AAA" hw.serial_number="FCH18999AAA" cisco.imc_model="UCSC-C220-M3S">CN=C-series CIMC,OU=PID:UCSC-C220-M3S SERIAL:FCH18999AAA,O=Cisco Self Signed,L=San Jose,ST=California,C=US</example>
311
+ <example hw.serial_number="FCH18999AAA" cisco.imc_model="UCSC-C220-M3S">CN=C-series CIMC,OU=PID:UCSC-C220-M3S SERIAL:FCH18999AAA,O=Cisco Self Signed,L=San Jose,ST=California,C=US</example>
313
312
  <param pos="0" name="hw.device" value="Lights Out Management"/>
314
313
  <param pos="0" name="hw.vendor" value="Cisco"/>
315
314
  <param pos="0" name="hw.product" value="IMC"/>
316
- <param pos="2" name="hw.serial_number"/>
317
315
  <param pos="0" name="os.vendor" value="Cisco"/>
318
316
  <param pos="0" name="os.family" value="Linux"/>
319
317
  <param pos="0" name="os.product" value="IMC"/>
320
- <param pos="2" name="cisco.serial_number"/>
318
+ <param pos="2" name="hw.serial_number"/>
321
319
  <param pos="1" name="cisco.imc_model"/>
322
320
  </fingerprint>
323
321
 
324
322
  <fingerprint pattern="^CN=C220-(FCH[^,]+),OU=null,O=Cisco Systems Inc">
325
323
  <description>Cisco Integrated Management Controller C220</description>
326
- <example cisco.serial_number="FCH17999AAA" hw.serial_number="FCH17999AAA">CN=C220-FCH17999AAA,OU=null,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US</example>
324
+ <example hw.serial_number="FCH17999AAA">CN=C220-FCH17999AAA,OU=null,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US</example>
327
325
  <param pos="0" name="hw.device" value="Lights Out Management"/>
328
326
  <param pos="0" name="hw.vendor" value="Cisco"/>
329
327
  <param pos="0" name="hw.product" value="IMC"/>
330
- <param pos="1" name="hw.serial_number"/>
331
328
  <param pos="0" name="os.vendor" value="Cisco"/>
332
329
  <param pos="0" name="os.family" value="Linux"/>
333
330
  <param pos="0" name="os.product" value="IMC"/>
334
- <param pos="1" name="cisco.serial_number"/>
331
+ <param pos="1" name="hw.serial_number"/>
335
332
  </fingerprint>
336
333
 
337
334
  <fingerprint pattern="^CN=avocent.com,OU=AESS,O=Avocent,L=Sunrise,ST=FL,C=US$">
@@ -411,12 +408,11 @@
411
408
 
412
409
  <fingerprint pattern="^SERIALNUMBER=([a-zA-Z0-9]+),CN=DEVICE-vWLC,O=Cisco Virtual WLC$">
413
410
  <description>Cisco vWLC</description>
414
- <example cisco.serial_number="9C89M2088D1" hw.serial_number="9C89M2088D1">SERIALNUMBER=9C89M2088D1,CN=DEVICE-vWLC,O=Cisco Virtual WLC</example>
411
+ <example hw.serial_number="9C89M2088D1">SERIALNUMBER=9C89M2088D1,CN=DEVICE-vWLC,O=Cisco Virtual WLC</example>
415
412
  <param pos="0" name="os.vendor" value="Cisco"/>
416
413
  <param pos="0" name="os.device" value="Wireless Controller"/>
417
414
  <param pos="0" name="os.product" value="Wireless LAN Controller"/>
418
415
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:wireless_lan_controller_software:-"/>
419
- <param pos="1" name="cisco.serial_number"/>
420
416
  <param pos="1" name="hw.serial_number"/>
421
417
  </fingerprint>
422
418
 
@@ -508,7 +504,7 @@
508
504
 
509
505
  <fingerprint pattern="^CN=([a-zA-Z0-9\.\-\_]+),OU=VMware ESX Server Default Certificate,O=VMware\\, Inc,L=Palo Alto,ST=California,C=US$">
510
506
  <description>VMware ESX</description>
511
- <example>CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
507
+ <example host.name="server99.">CN=server99.,OU=VMware ESX Server Default Certificate,O=VMware\, Inc,L=Palo Alto,ST=California,C=US</example>
512
508
  <param pos="0" name="service.vendor" value="VMware"/>
513
509
  <param pos="0" name="os.vendor" value="VMware"/>
514
510
  <param pos="0" name="os.family" value="VMware ESX/ESXi"/>
@@ -619,8 +615,8 @@
619
615
 
620
616
  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=(?:Cast|Google TV),O=Google Inc,L=Mountain View,ST=California,C=US$">
621
617
  <description>Google Chromecast</description>
622
- <example chromecast.serial_number="LVDZG5" host.mac_local="FA8FCA67413D" hw.serial_number="LVDZG5">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
623
- <example chromecast.serial_number="YRBLE" host.mac_local="FA8FCA7DE87D" hw.serial_number="YRBLE">CN=YRBLE FA8FCA7DE87D,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
618
+ <example host.mac_local="FA8FCA67413D" hw.serial_number="LVDZG5">CN=LVDZG5 FA8FCA67413D,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
619
+ <example host.mac_local="FA8FCA7DE87D" hw.serial_number="YRBLE">CN=YRBLE FA8FCA7DE87D,OU=Google TV,O=Google Inc,L=Mountain View,ST=California,C=US</example>
624
620
  <param pos="0" name="os.vendor" value="Google"/>
625
621
  <param pos="0" name="os.product" value="Chrome OS"/>
626
622
  <param pos="0" name="os.certainty" value="0.5"/>
@@ -628,9 +624,9 @@
628
624
  <param pos="0" name="hw.device" value="Media Server"/>
629
625
  <param pos="0" name="hw.vendor" value="Google"/>
630
626
  <param pos="0" name="hw.product" value="Chromecast"/>
631
- <param pos="1" name="hw.serial_number"/>
632
627
  <param pos="0" name="hw.certainty" value="0.5"/>
633
- <param pos="1" name="chromecast.serial_number"/>
628
+ <param pos="1" name="hw.serial_number"/>
629
+ <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
634
630
  <!-- This is the hotspot-mode MAC address (clear bit 2) -->
635
631
 
636
632
  <param pos="2" name="host.mac_local"/>
@@ -638,7 +634,7 @@
638
634
 
639
635
  <fingerprint pattern="^CN=([a-zA-Z0-9]{5,12}) ([a-zA-Z0-9]{12}),OU=Cast TV \(Vizio\),O=Google Inc,L=Mountain View,ST=California,C=US$">
640
636
  <description>Vizio SmartTV (Android) with Google Cast</description>
641
- <example chromecast.serial_number="9V039WC9" hw.serial_number="9V039WC9" host.mac_local="FA8FCA697898">CN=9V039WC9 FA8FCA697898,OU=Cast TV (Vizio),O=Google Inc,L=Mountain View,ST=California,C=US</example>
637
+ <example hw.serial_number="9V039WC9" host.mac_local="FA8FCA697898">CN=9V039WC9 FA8FCA697898,OU=Cast TV (Vizio),O=Google Inc,L=Mountain View,ST=California,C=US</example>
642
638
  <param pos="0" name="os.vendor" value="Google"/>
643
639
  <param pos="0" name="os.family" value="Linux"/>
644
640
  <param pos="0" name="os.product" value="Android"/>
@@ -646,7 +642,6 @@
646
642
  <param pos="0" name="hw.device" value="Smart TV"/>
647
643
  <param pos="0" name="hw.vendor" value="Vizio"/>
648
644
  <param pos="1" name="hw.serial_number"/>
649
- <param pos="1" name="chromecast.serial_number"/>
650
645
  <!-- This is the hotspot-mode MAC address (clear bit 2) -->
651
646
 
652
647
  <param pos="2" name="host.mac_local"/>
@@ -885,31 +880,29 @@
885
880
 
886
881
  <fingerprint pattern="^CN=([A-Za-z0-9]+),OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
887
882
  <description>Fortinet Gateway</description>
888
- <example fortinet.serial_number="FG100ETK1800118" hw.serial_number="FG100ETK1800118">CN=FG100ETK1800118,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
889
- <example fortinet.serial_number="FGT30D3X15038375" hw.serial_number="FGT30D3X15038375">CN=FGT30D3X15038375,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
883
+ <example hw.serial_number="FG100ETK1800118">CN=FG100ETK1800118,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
884
+ <example hw.serial_number="FGT30D3X15038375">CN=FGT30D3X15038375,OU=FortiGate,O=Fortinet,L=Sunnyvale,ST=California,C=US</example>
890
885
  <param pos="0" name="hw.vendor" value="Fortinet"/>
891
886
  <param pos="0" name="hw.device" value="Firewall"/>
892
- <param pos="1" name="hw.serial_number"/>
893
887
  <param pos="0" name="os.vendor" value="Fortinet"/>
894
888
  <param pos="0" name="os.family" value="Linux"/>
895
889
  <param pos="0" name="os.device" value="Firewall"/>
896
890
  <param pos="0" name="os.product" value="FortiOS"/>
897
891
  <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
898
- <param pos="1" name="fortinet.serial_number"/>
892
+ <param pos="1" name="hw.serial_number"/>
899
893
  </fingerprint>
900
894
 
901
895
  <fingerprint pattern="^CN=([A-Za-z0-9]+),O=Fortinet Ltd\.$">
902
896
  <description>Fortinet Gateway (Older)</description>
903
- <example fortinet.serial_number="FG100D3G13803999" hw.serial_number="FG100D3G13803999">CN=FG100D3G13803999,O=Fortinet Ltd.</example>
897
+ <example hw.serial_number="FG100D3G13803999">CN=FG100D3G13803999,O=Fortinet Ltd.</example>
904
898
  <param pos="0" name="hw.vendor" value="Fortinet"/>
905
899
  <param pos="0" name="hw.device" value="Firewall"/>
906
- <param pos="1" name="hw.serial_number"/>
907
900
  <param pos="0" name="os.vendor" value="Fortinet"/>
908
901
  <param pos="0" name="os.family" value="Linux"/>
909
902
  <param pos="0" name="os.device" value="Firewall"/>
910
903
  <param pos="0" name="os.product" value="FortiOS"/>
911
904
  <param pos="0" name="os.cpe23" value="cpe:/o:fortinet:fortios:-"/>
912
- <param pos="1" name="fortinet.serial_number"/>
905
+ <param pos="1" name="hw.serial_number"/>
913
906
  </fingerprint>
914
907
 
915
908
  <fingerprint pattern="^CN=FortiMail,OU=FortiMail,O=Fortinet,L=Sunnyvale,ST=California,C=US$">
@@ -1139,10 +1132,11 @@
1139
1132
  <param pos="0" name="os.product" value="Linux"/>
1140
1133
  </fingerprint>
1141
1134
 
1142
- <fingerprint pattern="^CN=MAC([a-fA-F0-9]{12}),OU=([^,]+),O=Mercury Security Products\\, LLC,L=Long Beach,ST=CA,C=US$">
1135
+ <fingerprint pattern="^CN=MAC([a-fA-F0-9]{12}),OU=([^,]+),O=Mercury Security Products\\, LLC,L=Long Beach,ST=CA,C=US(?:,\S+)?$">
1143
1136
  <description>Mercurity Security (now HID Global)</description>
1144
1137
  <example hw.product="M5IC" host.mac="000FE507A1F1">CN=MAC000FE507A1F1,OU=M5IC,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US</example>
1145
1138
  <example hw.product="EP-1502" host.mac="000FE508BC71">CN=MAC000FE508BC71,OU=EP-1502,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US</example>
1139
+ <example hw.product="LP-1501" host.mac="000FE5091111">CN=MAC000FE5091111,OU=LP-1501,O=Mercury Security Products\, LLC,L=Long Beach,ST=CA,C=US,2.5.4.4=#111111111111111111</example>
1146
1140
  <param pos="0" name="hw.vendor" value="Mercury Security"/>
1147
1141
  <param pos="0" name="hw.device" value="Access Control"/>
1148
1142
  <param pos="1" name="host.mac"/>
@@ -1242,7 +1236,7 @@
1242
1236
 
1243
1237
  <fingerprint pattern="^CN=Canon (iR-[a-zA-Z0-9\.\-\_]+)$">
1244
1238
  <description>Canon iR-ADV Printer with product info</description>
1245
- <example os.product="iR-ADV">CN=Canon iR-ADV</example>
1239
+ <example os.product="iR-ADV" hw.product="iR-ADV">CN=Canon iR-ADV</example>
1246
1240
  <param pos="0" name="hw.device" value="Printer"/>
1247
1241
  <param pos="0" name="hw.vendor" value="Canon"/>
1248
1242
  <param pos="0" name="os.device" value="Printer"/>
@@ -1307,20 +1301,28 @@
1307
1301
 
1308
1302
  <fingerprint pattern="^CN=Ruckus Wireless ZoneDirector SN-(\d+),O=Ruckus Wireless\\, Inc\.,ST=CA,C=US$">
1309
1303
  <description>Ruckus Zone Director</description>
1310
- <example ruckus.serial_number="221301007591" hw.serial_number="221301007591">CN=Ruckus Wireless ZoneDirector SN-221301007591,O=Ruckus Wireless\, Inc.,ST=CA,C=US</example>
1304
+ <example hw.serial_number="221301007591">CN=Ruckus Wireless ZoneDirector SN-221301007591,O=Ruckus Wireless\, Inc.,ST=CA,C=US</example>
1311
1305
  <param pos="0" name="hw.device" value="Wireless Controller"/>
1312
1306
  <param pos="0" name="hw.vendor" value="Ruckus"/>
1313
1307
  <param pos="0" name="hw.product" value="Zone Director"/>
1314
- <param pos="1" name="hw.serial_number"/>
1315
1308
  <param pos="0" name="os.device" value="Wireless Controller"/>
1316
1309
  <param pos="0" name="os.vendor" value="Ruckus"/>
1317
1310
  <param pos="0" name="os.product" value="Zone Director"/>
1318
- <param pos="1" name="ruckus.serial_number"/>
1311
+ <param pos="1" name="hw.serial_number"/>
1312
+ </fingerprint>
1313
+
1314
+ <fingerprint pattern="^CN=SN-(\d+),O=Ruckus Wireless Inc.,L=Sunnyvale,ST=California,C=US$">
1315
+ <description>Ruckus Wireless Access Point</description>
1316
+ <example hw.serial_number="010101010101">CN=SN-010101010101,O=Ruckus Wireless Inc.,L=Sunnyvale,ST=California,C=US</example>
1317
+ <param pos="0" name="hw.device" value="WAP"/>
1318
+ <param pos="0" name="hw.vendor" value="Ruckus"/>
1319
+ <param pos="0" name="hw.product" value="Access Point"/>
1320
+ <param pos="1" name="hw.serial_number"/>
1319
1321
  </fingerprint>
1320
1322
 
1321
1323
  <fingerprint pattern="^CN=DT([^\s]+) Series,O=NEC Corporation,ST=Tokyo,C=JP$">
1322
1324
  <description>NEC DT Series IP Phone</description>
1323
- <example>CN=DT800 Series,O=NEC Corporation,ST=Tokyo,C=JP</example>
1325
+ <example hw.product="800">CN=DT800 Series,O=NEC Corporation,ST=Tokyo,C=JP</example>
1324
1326
  <param pos="0" name="os.vendor" value="NEC"/>
1325
1327
  <param pos="0" name="os.device" value="VoIP"/>
1326
1328
  <param pos="0" name="hw.vendor" value="NEC"/>
@@ -1469,9 +1471,10 @@
1469
1471
  <param pos="0" name="hw.product" value="Sensor"/>
1470
1472
  </fingerprint>
1471
1473
 
1472
- <fingerprint pattern="^CN=HiveAP,OU=Default,O=Aerohive,ST=California,C=US$">
1474
+ <fingerprint pattern="^CN=HiveAP,OU=Default,O=Aerohive,(?:L=Sunnyvale,)?ST=California,C=US$">
1473
1475
  <description>Aerohive Access Point</description>
1474
1476
  <example>CN=HiveAP,OU=Default,O=Aerohive,ST=California,C=US</example>
1477
+ <example>CN=HiveAP,OU=Default,O=Aerohive,L=Sunnyvale,ST=California,C=US</example>
1475
1478
  <param pos="0" name="hw.vendor" value="Aerohive"/>
1476
1479
  <param pos="0" name="hw.device" value="WAP"/>
1477
1480
  <param pos="0" name="hw.product" value="Access Point"/>
@@ -1654,4 +1657,102 @@
1654
1657
  <param pos="1" name="host.name"/>
1655
1658
  </fingerprint>
1656
1659
 
1660
+ <fingerprint pattern="^CN=Freebox Intermediate CA,O=Freebox,ST=France,C=FR$">
1661
+ <description>Freebox Device</description>
1662
+ <example>CN=Freebox Intermediate CA,O=Freebox,ST=France,C=FR</example>
1663
+ <param pos="0" name="hw.vendor" value="Freebox"/>
1664
+ </fingerprint>
1665
+
1666
+ <fingerprint pattern="^CN=TP-LINK CA,O=TP-LINK Technologies CO.\\, LTD.,L=Shenzhen,ST=Guangdong,C=CN(?:,\S+)?$">
1667
+ <description>TP-LINK Device</description>
1668
+ <example>CN=TP-LINK CA,O=TP-LINK Technologies CO.\, LTD.,L=Shenzhen,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c16736572766963654074702d6c696e6b2e636f6d2e636e</example>
1669
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
1670
+ </fingerprint>
1671
+
1672
+ <fingerprint pattern="^CN=BHA-([0-9a-fA-F]{12}),O=Bird Home Automation$">
1673
+ <description>Bird Home Automation</description>
1674
+ <example host.mac="0123456789AB">CN=BHA-0123456789AB,O=Bird Home Automation</example>
1675
+ <param pos="0" name="hw.device" value="Device"/>
1676
+ <param pos="0" name="hw.vendor" value="Bird Home Automation"/>
1677
+ <param pos="1" name="host.mac"/>
1678
+ </fingerprint>
1679
+
1680
+ <fingerprint pattern="^CN=\S+,OU=Media Server,O=Avaya Inc\.,C=US">
1681
+ <description>Avaya Media Server</description>
1682
+ <example>CN=192.168.0.3,OU=Media Server,O=Avaya Inc.,C=US</example>
1683
+ <param pos="0" name="os.vendor" value="Avaya"/>
1684
+ <param pos="0" name="os.device" value="Media Gateway"/>
1685
+ <param pos="0" name="os.product" value="Media Server"/>
1686
+ </fingerprint>
1687
+
1688
+ <fingerprint pattern="^CN=iSTAR Ultra">
1689
+ <description>iSTAR Ultra</description>
1690
+ <example>CN=iSTAR Ultra,OU=Access Control and Video Division,O=Johnson Controls,L=Westford,ST=Massachusetts,C=US</example>
1691
+ <param pos="0" name="os.vendor" value="Software House"/>
1692
+ <param pos="0" name="os.family" value="Linux"/>
1693
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
1694
+ <param pos="0" name="hw.vendor" value="Software House"/>
1695
+ <param pos="0" name="hw.device" value="Access Control"/>
1696
+ <param pos="0" name="hw.family" value="iSTAR Door Controllers"/>
1697
+ <param pos="0" name="hw.product" value="iSTAR Ultra"/>
1698
+ <param pos="0" name="hw.cpe23" value="cpe:/h:swhouse:istar_ultra:-"/>
1699
+ </fingerprint>
1700
+
1701
+ <fingerprint pattern="^O=SpotteRF - NetworkedIO$">
1702
+ <description>SpotterRF</description>
1703
+ <example>O=SpotteRF - NetworkedIO</example>
1704
+ <param pos="0" name="os.vendor" value="SpotterRF"/>
1705
+ <param pos="0" name="os.family" value="Linux"/>
1706
+ <param pos="0" name="os.certainty" value="0.90"/>
1707
+ <param pos="0" name="hw.vendor" value="SpotterRF"/>
1708
+ <param pos="0" name="hw.device" value="Sensor"/>
1709
+ <param pos="0" name="hw.product" value="Drone Detector"/>
1710
+ </fingerprint>
1711
+
1712
+ <fingerprint pattern="(?i)^CN=.{0,1000}myboschcam.net,O=Bosch Sicherheitssysteme">
1713
+ <description>Bosch AutoDome IP Camera</description>
1714
+ <example>CN=local.myboschcam.net,O=Bosch Sicherheitssysteme GmbH,L=Grasbrunn,ST=Bayern,C=DE</example>
1715
+ <param pos="0" name="hw.vendor" value="Bosch"/>
1716
+ <param pos="0" name="hw.device" value="Web Cam"/>
1717
+ <param pos="0" name="hw.product" value="AutoDome"/>
1718
+ <param pos="0" name="hw.certainty" value="0.50"/>
1719
+ </fingerprint>
1720
+
1721
+ <fingerprint pattern="(?i)CN=(\w+),OU=BWI,O=Redline Communications Inc">
1722
+ <description>Redline Communication Radios</description>
1723
+ <example hw.product="an80i">CN=an80i,OU=BWI,O=Redline Communications Inc.,C=CA</example>
1724
+ <param pos="0" name="hw.vendor" value="Redline"/>
1725
+ <param pos="0" name="hw.device" value="WAP"/>
1726
+ <param pos="1" name="hw.product"/>
1727
+ </fingerprint>
1728
+
1729
+ <fingerprint pattern="(?i)CN=Vaddio Device,O=Vaddio,L=Minnetonka,ST=MN,C=US">
1730
+ <description>Vadio DocCom</description>
1731
+ <example>CN=Vaddio Device,O=Vaddio,L=Minnetonka,ST=MN,C=US</example>
1732
+ <param pos="0" name="hw.vendor" value="Vaddio"/>
1733
+ <param pos="0" name="hw.device" value="Web Cam"/>
1734
+ <param pos="0" name="hw.product" value="DocCam"/>
1735
+ <param pos="0" name="hw.certainty" value="0.50"/>
1736
+ </fingerprint>
1737
+
1738
+ <fingerprint pattern="(?i)CN=.{0,1000},OU=2N IP Intercoms,O=2N Telekomunikace a.s.,L=Prague,ST=Czech Republic,C=CZ">
1739
+ <description>2N IP Intercoms</description>
1740
+ <example>CN=11111111111d,OU=2N IP Intercoms,O=2N Telekomunikace a.s.,L=Prague,ST=Czech Republic,C=CZ</example>
1741
+ <param pos="0" name="hw.vendor" value="2N Telekomunikace"/>
1742
+ <param pos="0" name="hw.device" value="IP Camera"/>
1743
+ <param pos="0" name="hw.certainty" value="0.50"/>
1744
+ </fingerprint>
1745
+
1746
+ <fingerprint pattern="^CN=(.{1,256}),OU=PVE Cluster Node,O=Proxmox Virtual Environment$">
1747
+ <description>Proxmox open-source virtualization platform</description>
1748
+ <example host.name="pve.example.org">CN=pve.example.org,OU=PVE Cluster Node,O=Proxmox Virtual Environment</example>
1749
+ <param pos="1" name="host.name"/>
1750
+ <param pos="0" name="service.vendor" value="Proxmox"/>
1751
+ <param pos="0" name="service.product" value="Virtual Environment"/>
1752
+ <param pos="0" name="service.cpe23" value="cpe:/a:proxmox:virtual_environment:-"/>
1753
+ <param pos="0" name="os.vendor" value="Proxmox"/>
1754
+ <param pos="0" name="os.family" value="Linux"/>
1755
+ <param pos="0" name="os.product" value="Proxmox"/>
1756
+ </fingerprint>
1757
+
1657
1758
  </fingerprints>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.3.21
4
+ version: 2.3.22
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-08-02 00:00:00.000000000 Z
11
+ date: 2021-12-14 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec
@@ -128,7 +128,9 @@ files:
128
128
  - ".github/ISSUE_TEMPLATE/fingerprint_request.md"
129
129
  - ".github/PULL_REQUEST_TEMPLATE"
130
130
  - ".github/SECURITY.md"
131
+ - ".github/dependabot.yml"
131
132
  - ".github/workflows/ci.yml"
133
+ - ".github/workflows/verify.yml"
132
134
  - ".gitignore"
133
135
  - ".rspec"
134
136
  - ".ruby-gemset"
@@ -207,10 +209,12 @@ files:
207
209
  - spec/lib/recog/nizer_spec.rb
208
210
  - spec/lib/recog/verify_reporter_spec.rb
209
211
  - spec/spec_helper.rb
212
+ - tools/dev/hooks/pre-commit
210
213
  - update_cpes.py
211
214
  - xml/apache_modules.xml
212
215
  - xml/apache_os.xml
213
216
  - xml/architecture.xml
217
+ - xml/dhcp_vendor_class.xml
214
218
  - xml/dns_versionbind.xml
215
219
  - xml/favicons.xml
216
220
  - xml/fingerprints.xsd
@@ -275,7 +279,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
275
279
  - !ruby/object:Gem::Version
276
280
  version: '0'
277
281
  requirements: []
278
- rubygems_version: 3.0.8
282
+ rubygems_version: 3.0.3
279
283
  signing_key:
280
284
  specification_version: 4
281
285
  summary: Network service fingerprint database, classes, and utilities