recog 2.3.21 → 2.3.22

Sign up to get free protection for your applications and to get access to all the features.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +8 -0
  3. data/.github/workflows/verify.yml +89 -0
  4. data/CONTRIBUTING.md +6 -0
  5. data/README.md +17 -0
  6. data/bin/recog_standardize +28 -13
  7. data/bin/recog_verify +1 -2
  8. data/cpe-remap.yaml +13 -0
  9. data/features/verify.feature +14 -14
  10. data/identifiers/fields.txt +5 -4
  11. data/identifiers/hw_device.txt +6 -0
  12. data/identifiers/hw_family.txt +8 -0
  13. data/identifiers/hw_product.txt +51 -0
  14. data/identifiers/os_family.txt +1 -0
  15. data/identifiers/os_product.txt +10 -0
  16. data/identifiers/service_product.txt +12 -0
  17. data/identifiers/vendor.txt +49 -0
  18. data/lib/recog/db.rb +2 -1
  19. data/lib/recog/fingerprint.rb +18 -5
  20. data/lib/recog/verifier.rb +5 -5
  21. data/lib/recog/verifier_factory.rb +3 -3
  22. data/lib/recog/verify_reporter.rb +14 -4
  23. data/lib/recog/version.rb +1 -1
  24. data/spec/lib/fingerprint_self_test_spec.rb +1 -0
  25. data/spec/lib/recog/verify_reporter_spec.rb +69 -0
  26. data/tools/dev/hooks/pre-commit +21 -0
  27. data/update_cpes.py +1 -1
  28. data/xml/apache_os.xml +38 -38
  29. data/xml/dhcp_vendor_class.xml +206 -0
  30. data/xml/favicons.xml +148 -42
  31. data/xml/ftp_banners.xml +30 -16
  32. data/xml/h323_callresp.xml +99 -99
  33. data/xml/hp_pjl_id.xml +3 -3
  34. data/xml/html_title.xml +502 -25
  35. data/xml/http_cookies.xml +64 -56
  36. data/xml/http_servers.xml +74 -14
  37. data/xml/http_wwwauth.xml +107 -38
  38. data/xml/imap_banners.xml +3 -3
  39. data/xml/mdns_device-info_txt.xml +389 -26
  40. data/xml/mysql_banners.xml +1 -1
  41. data/xml/nntp_banners.xml +3 -3
  42. data/xml/ntp_banners.xml +64 -64
  43. data/xml/operating_system.xml +3 -3
  44. data/xml/pop_banners.xml +7 -7
  45. data/xml/rsh_resp.xml +3 -3
  46. data/xml/sip_banners.xml +27 -0
  47. data/xml/sip_user_agents.xml +54 -1
  48. data/xml/smtp_banners.xml +15 -15
  49. data/xml/smtp_ehlo.xml +1 -1
  50. data/xml/smtp_help.xml +10 -10
  51. data/xml/smtp_noop.xml +2 -2
  52. data/xml/snmp_sysdescr.xml +325 -200
  53. data/xml/snmp_sysobjid.xml +25 -25
  54. data/xml/ssh_banners.xml +7 -5
  55. data/xml/telnet_banners.xml +155 -20
  56. data/xml/tls_jarm.xml +26 -4
  57. data/xml/x509_issuers.xml +36 -0
  58. data/xml/x509_subjects.xml +136 -35
  59. metadata +7 -3
data/xml/dhcp_vendor_class.xml ADDED
@@ -0,0 +1,206 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <fingerprints matches="dhcp_vendor_class" protocol="dhcp" database_type="service">
3
+ <!--
4
+ Fingerprint definitions that are matched against the string values in the
5
+ dhcp message vi_vendor_class field
6
+ This field is Option 60 as defined in RFC 2132 section 9.13.
7
+ The vi_vendor_class field can be found in client discover (1), request (3)
8
+ and inform (8) messages.
9
+ -->
10
+
11
+ <fingerprint pattern="^Mfg=(?:Fuji)?(?i:Xerox);Typ=(?:MFP|printer);Mod=(?:Xerox )?(\S+) ([a-zA-Z0-9]+).*;Ser=([A-Z0-9]{9})(?:;Loc=.*)?$">
12
+ <description>Xerox Multifunction Printer</description>
13
+ <example hw.family="VersaLink" hw.model="C405" hw.serial_number="ABC123456">Mfg=Xerox;Typ=MFP;Mod=VersaLink C405;Ser=ABC123456;Loc=Print Room</example>
14
+ <example hw.family="AltaLink" hw.model="C8055" hw.serial_number="1AB234567">Mfg=Xerox;Typ=MFP;Mod=Xerox AltaLink C8055 Multifunction Printer;Ser=1AB234567;Loc=Print Room2</example>
15
+ <example hw.family="WorkCentre" hw.model="3345" hw.serial_number="1AB234567">Mfg=XEROX;Typ=MFP;Mod=WorkCentre 3345;Ser=1AB234567;Loc=</example>
16
+ <example hw.family="WorkCentre" hw.model="7845" hw.serial_number="AB1234567">Mfg=Xerox;Typ=MFP;Mod=Xerox WorkCentre 7845 v1 Multifunction System;Ser=AB1234567;Loc=</example>
17
+ <example hw.family="Phaser" hw.model="6500DN" hw.serial_number="ABC123456">Mfg=FujiXerox;Typ=printer;Mod=Phaser 6500DN;Ser=ABC123456</example>
18
+ <param pos="0" name="hw.device" value="Printer"/>
19
+ <param pos="0" name="hw.vendor" value="Xerox"/>
20
+ <param pos="1" name="hw.family"/>
21
+ <param pos="2" name="hw.model"/>
22
+ <param pos="3" name="hw.serial_number"/>
23
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
24
+ <param pos="0" name="os.vendor" value="Xerox"/>
25
+ <param pos="0" name="os.device" value="Printer"/>
26
+ </fingerprint>
27
+
28
+ <fingerprint pattern="^Mfg=Hewlett Packard;Typ=Printer;Mod=HP (LaserJet 200|LaserJet 400) (?:color |colorMFP |MFP )?(M\d+\S+);Ser=([A-Z0-9]{10});$">
29
+ <description>HP Multifunction Printer</description>
30
+ <example hw.family="LaserJet 200" hw.model="M276nw" hw.serial_number="ABC1DE2F3G">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 200 colorMFP M276nw;Ser=ABC1DE2F3G;</example>
31
+ <example hw.family="LaserJet 400" hw.model="M401dne" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401dne;Ser=ABCDE12345;</example>
32
+ <example hw.family="LaserJet 400" hw.model="M401dw" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401dw;Ser=ABCDE12345;</example>
33
+ <example hw.family="LaserJet 400" hw.model="M401n" hw.serial_number="ABCDE12345">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 M401n;Ser=ABCDE12345;</example>
34
+ <example hw.family="LaserJet 400" hw.model="M425dn" hw.serial_number="ABC1D23E4E">Mfg=Hewlett Packard;Typ=Printer;Mod=HP LaserJet 400 MFP M425dn;Ser=ABC1D23E4E;</example>
35
+ <param pos="0" name="hw.device" value="Printer"/>
36
+ <param pos="0" name="hw.vendor" value="HP"/>
37
+ <param pos="1" name="hw.family"/>
38
+ <param pos="2" name="hw.model"/>
39
+ <param pos="3" name="hw.serial_number"/>
40
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
41
+ <param pos="0" name="os.vendor" value="HP"/>
42
+ <param pos="0" name="os.device" value="Printer"/>
43
+ </fingerprint>
44
+
45
+ <fingerprint pattern="^(?:Hewlett-Packard|HP) (OfficeJet|LaserJet|Printer|JetDirect)$">
46
+ <description>HP Printer</description>
47
+ <example hw.family="LaserJet">Hewlett-Packard LaserJet</example>
48
+ <example hw.family="OfficeJet">Hewlett-Packard OfficeJet</example>
49
+ <example hw.family="LaserJet">HP LaserJet</example>
50
+ <example hw.family="Printer">HP Printer</example>
51
+ <example>Hewlett-Packard JetDirect</example>
52
+ <param pos="0" name="hw.device" value="Printer"/>
53
+ <param pos="0" name="hw.vendor" value="HP"/>
54
+ <param pos="1" name="hw.family"/>
55
+ <param pos="0" name="os.vendor" value="HP"/>
56
+ <param pos="0" name="os.device" value="Printer"/>
57
+ </fingerprint>
58
+
59
+ <fingerprint pattern="^Mfg=LEXMARK;Typ=(?:MFP|Printer);Mod=Lexmark (\S+);Ser=([A-Z0-9]{13});$">
60
+ <description>Lexmark Printer</description>
61
+ <example hw.model="MX410de" hw.serial_number="12345ABC6D7EF">Mfg=LEXMARK;Typ=MFP;Mod=Lexmark MX410de;Ser=12345ABC6D7EF;</example>
62
+ <example hw.model="MS310dn" hw.serial_number="123456AB7C8DE">Mfg=LEXMARK;Typ=Printer;Mod=Lexmark MS310dn;Ser=123456AB7C8DE;</example>
63
+ <param pos="0" name="hw.device" value="Printer"/>
64
+ <param pos="0" name="hw.vendor" value="Lexmark"/>
65
+ <param pos="1" name="hw.model"/>
66
+ <param pos="2" name="hw.serial_number"/>
67
+ <param pos="0" name="os.vendor" value="Lexmark"/>
68
+ <param pos="0" name="os.device" value="Printer"/>
69
+ </fingerprint>
70
+
71
+ <fingerprint pattern="^Canon iR-ADV (C?\d+ ?\S*)$">
72
+ <description>Canon imageRunner Printer</description>
73
+ <example hw.model="C5535 III">Canon iR-ADV C5535 III</example>
74
+ <example hw.model="C350">Canon iR-ADV C350</example>
75
+ <example hw.model="4545 III">Canon iR-ADV 4545 III</example>
76
+ <example hw.model="525">Canon iR-ADV 525</example>
77
+ <param pos="0" name="hw.device" value="Printer"/>
78
+ <param pos="0" name="hw.vendor" value="Canon"/>
79
+ <param pos="0" name="hw.family" value="imageRunner"/>
80
+ <param pos="1" name="hw.model"/>
81
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
82
+ <param pos="0" name="os.vendor" value="Canon"/>
83
+ <param pos="0" name="os.device" value="Printer"/>
84
+ </fingerprint>
85
+
86
+ <fingerprint pattern="^Canon (D\d+) Series$">
87
+ <description>Canon imageClass Printer</description>
88
+ <example hw.model="D1600">Canon D1600 Series</example>
89
+ <param pos="0" name="hw.device" value="Printer"/>
90
+ <param pos="0" name="hw.vendor" value="Canon"/>
91
+ <param pos="0" name="hw.family" value="imageClass"/>
92
+ <param pos="1" name="hw.model"/>
93
+ <param pos="0" name="hw.product" value="{hw.family} {hw.model}"/>
94
+ <param pos="0" name="os.vendor" value="Canon"/>
95
+ <param pos="0" name="os.device" value="Printer"/>
96
+ </fingerprint>
97
+
98
+ <fingerprint pattern="^Polycom-(VVX\d{3})$">
99
+ <description>Polycom IP Phone</description>
100
+ <example hw.product="VVX410" hw.model="VVX410">Polycom-VVX410</example>
101
+ <param pos="0" name="hw.device" value="VoIP"/>
102
+ <param pos="0" name="hw.vendor" value="Polycom"/>
103
+ <param pos="0" name="hw.family" value="VVX"/>
104
+ <param pos="1" name="hw.model"/>
105
+ <param pos="0" name="hw.product" value="{hw.model}"/>
106
+ <param pos="0" name="os.vendor" value="Polycom"/>
107
+ </fingerprint>
108
+
109
+ <fingerprint pattern="^Aruba\s(JL\d+A)\s(\d+[A-Z]?)\S+\sSwitch(?:\sdslforum.org)?$">
110
+ <description>HP Aruba Network Switch</description>
111
+ <example hw.product="JL075A" hw.family="3810M">Aruba JL075A 3810M-16SFP+-2-slot Switch</example>
112
+ <example hw.product="JL253A" hw.family="2930F">Aruba JL253A 2930F-24G-4SFP+ Switch dslforum.org</example>
113
+ <example hw.product="JL256A" hw.family="2930F">Aruba JL256A 2930F-48G-PoE+-4SFP+ Switch</example>
114
+ <example hw.product="JL258A" hw.family="2930F">Aruba JL258A 2930F-8G-PoE+-2SFP+ Switch</example>
115
+ <example hw.product="JL357A" hw.family="2540">Aruba JL357A 2540-48G-PoE+-4SFP+ Switch</example>
116
+ <param pos="0" name="hw.device" value="Switch"/>
117
+ <param pos="0" name="hw.vendor" value="Aruba Networks"/>
118
+ <param pos="1" name="hw.product"/>
119
+ <param pos="2" name="hw.family"/>
120
+ <param pos="0" name="os.vendor" value="Aruba Networks"/>
121
+ </fingerprint>
122
+
123
+ <fingerprint pattern="^AXIS,(?:PTZ Dome )?Network Camera,(.*),([\d\.]+)$">
124
+ <description>Axis Network Camera</description>
125
+ <example hw.model="P3343" os.version="5.20.3">AXIS,Network Camera,P3343,5.20.3</example>
126
+ <example hw.model="M5014" os.version="5.50.3.7">AXIS,PTZ Dome Network Camera,M5014,5.50.3.7</example>
127
+ <example hw.model="P3225-LV Mk II" os.version="9.70.1.5">AXIS,Network Camera,P3225-LV Mk II,9.70.1.5</example>
128
+ <param pos="0" name="hw.device" value="IP Camera"/>
129
+ <param pos="0" name="hw.vendor" value="AXIS"/>
130
+ <param pos="1" name="hw.model"/>
131
+ <param pos="0" name="os.vendor" value="AXIS"/>
132
+ <param pos="2" name="os.version"/>
133
+ </fingerprint>
134
+
135
+ <fingerprint pattern="^AXIS,(?:Network Video Encoder|Video Server),(\S+),([\d\.]+)$">
136
+ <description>Axis Video Encoder</description>
137
+ <example hw.model="M7011" os.version="5.90.1">AXIS,Network Video Encoder,M7011,5.90.1</example>
138
+ <param pos="0" name="hw.device" value="Video Encoder"/>
139
+ <param pos="0" name="hw.vendor" value="AXIS"/>
140
+ <param pos="1" name="hw.model"/>
141
+ <param pos="0" name="os.vendor" value="AXIS"/>
142
+ <param pos="2" name="os.version"/>
143
+ </fingerprint>
144
+
145
+ <fingerprint pattern="^AXIS,Network IO Audio Module,(\S+),([\d\.]+)$">
146
+ <description>Axis IO Audio Module</description>
147
+ <example hw.model="P8221" os.version="5.10.2">AXIS,Network IO Audio Module,P8221,5.10.2</example>
148
+ <param pos="0" name="hw.device" value="Audio Encoder"/>
149
+ <param pos="0" name="hw.vendor" value="AXIS"/>
150
+ <param pos="1" name="hw.model"/>
151
+ <param pos="0" name="os.vendor" value="AXIS"/>
152
+ <param pos="2" name="os.version"/>
153
+ </fingerprint>
154
+
155
+ <fingerprint pattern="^PCoIP Endpoint$">
156
+ <description>PCoIP Endpoint Device</description>
157
+ <example>PCoIP Endpoint</example>
158
+ <param pos="0" name="hw.device" value="Thin Client"/>
159
+ <param pos="0" name="hw.product" value="PCoIP Endpoint Device"/>
160
+ <param pos="0" name="os.vendor" value="Teradici"/>
161
+ <param pos="0" name="os.family" value="Teradici"/>
162
+ </fingerprint>
163
+
164
+ <fingerprint pattern="^android-dhcp-([\d\.]*)$">
165
+ <description>Android Device</description>
166
+ <example os.version="7.1.1">android-dhcp-7.1.1</example>
167
+ <param pos="0" name="os.vendor" value="Google"/>
168
+ <param pos="0" name="os.family" value="Linux"/>
169
+ <param pos="0" name="os.product" value="Android"/>
170
+ <param pos="1" name="os.version"/>
171
+ <param pos="0" name="os.cpe23" value="cpe:/o:google:android:{os.version}"/>
172
+ </fingerprint>
173
+
174
+ <fingerprint pattern="^dhcpcd-(?:[\d\.]+):Linux-([\d\.]+).*:(\S*):">
175
+ <description>Linux</description>
176
+ <example os.version="4.14.78" os.arch="armv7l">dhcpcd-6.11.5:Linux-4.14.78:armv7l:Freescale</example>
177
+ <example os.version="4.19.155" os.arch="x86_64">dhcpcd-6.8.2:Linux-4.19.155-10581-g8bdb5ed8e80c:x86_64:GenuineIntel</example>
178
+ <param pos="0" name="os.family" value="Linux"/>
179
+ <param pos="0" name="os.product" value="Linux"/>
180
+ <param pos="1" name="os.version"/>
181
+ <param pos="2" name="os.arch"/>
182
+ </fingerprint>
183
+
184
+ <fingerprint pattern="^SAMSUNG Network Printer$">
185
+ <description>Samsung Network Printer</description>
186
+ <example>SAMSUNG Network Printer</example>
187
+ <param pos="0" name="hw.device" value="Printer"/>
188
+ <param pos="0" name="hw.vendor" value="Samsung"/>
189
+ <param pos="0" name="os.vendor" value="Samsung"/>
190
+ </fingerprint>
191
+
192
+ <fingerprint pattern="^MERAKI$">
193
+ <description>MERAKI Device</description>
194
+ <example>MERAKI</example>
195
+ <param pos="0" name="hw.vendor" value="Meraki"/>
196
+ <param pos="0" name="os.vendor" value="Meraki"/>
197
+ </fingerprint>
198
+
199
+ <fingerprint pattern="^MSFT 5.0$">
200
+ <description>Microsoft Windows Device</description>
201
+ <example>MSFT 5.0</example>
202
+ <param pos="0" name="os.vendor" value="Microsoft"/>
203
+ <param pos="0" name="os.family" value="Windows"/>
204
+ </fingerprint>
205
+
206
+ </fingerprints>