recog 2.3.22 → 2.3.23

Sign up to get free protection for your applications and to get access to all the features.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/dns_versionbind.xml CHANGED
@@ -68,8 +68,8 @@
68
68
  <example service.version="9.3.6-P1" os.version="5" os.version.version="11">9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.12</example>
69
69
  <example service.version="9.9.1-P3" os.version="6">9.9.1-P3-RedHat-9.9.1.P3.el6</example>
70
70
  <example service.version="9.9.3-rpz2+rl.13208.13-P2" os.version="6">9.9.3-rpz2+rl.13208.13-P2-RedHat-9.9.3-4.P2.el6</example>
71
- <example os.version="6" os.version.version="1">9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3</example>
72
- <example os.version="6" os.version.version="">9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6</example>
71
+ <example os.version="6" os.version.version="1" service.version="9.7.3-P3">9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3</example>
72
+ <example os.version="6" os.version.version="" service.version="9.8.2rc1">9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6</example>
73
73
  <param pos="0" name="service.vendor" value="ISC"/>
74
74
  <param pos="0" name="service.family" value="BIND"/>
75
75
  <param pos="0" name="service.product" value="BIND"/>
@@ -85,21 +85,21 @@
85
85
 
86
86
  <fingerprint pattern="^(9.[^-]+(?:-rl[.\d]+)?(?:-[SP]\d)?)-RedHat-[\d.]+-[\w.]+fc([\d]+)$">
87
87
  <description>ISC BIND: Fedora</description>
88
- <example service.version="9.10.4-P8">9.10.4-P8-RedHat-9.10.4-4.P8.fc25</example>
88
+ <example service.version="9.10.4-P8" os.version="25">9.10.4-P8-RedHat-9.10.4-4.P8.fc25</example>
89
89
  <!-- The '-rl' in the example below indicates a rate limiting patch -->
90
90
 
91
- <example service.version="9.9.3-rl.13207.22-P2">9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19</example>
92
- <example os.version="10">9.5.2-RedHat-9.5.2-1.fc10</example>
91
+ <example service.version="9.9.3-rl.13207.22-P2" os.version="19">9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19</example>
92
+ <example os.version="10" service.version="9.5.2">9.5.2-RedHat-9.5.2-1.fc10</example>
93
93
  <param pos="0" name="service.vendor" value="ISC"/>
94
94
  <param pos="0" name="service.family" value="BIND"/>
95
95
  <param pos="0" name="service.product" value="BIND"/>
96
96
  <param pos="1" name="service.version"/>
97
97
  <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
98
- <param pos="0" name="os.vendor" value="Red Hat"/>
98
+ <param pos="0" name="os.vendor" value="Fedora Project"/>
99
99
  <param pos="0" name="os.family" value="Linux"/>
100
- <param pos="0" name="os.product" value="Fedora Core Linux"/>
100
+ <param pos="0" name="os.product" value="Fedora Core"/>
101
101
  <param pos="2" name="os.version"/>
102
- <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:{os.version}"/>
102
+ <param pos="0" name="os.cpe23" value="cpe:/o:fedoraproject:fedora_core:{os.version}"/>
103
103
  </fingerprint>
104
104
 
105
105
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-RedHat-[\w.-]+amzn1$">
@@ -719,8 +719,11 @@
719
719
  -->
720
720
 
721
721
  <fingerprint pattern="^Microsoft DNS 6.0.6100 \(2AEF76E\)$">
722
- <description>SPOOFED - Microsoft DNS on Windows 2008 SP something</description>
722
+ <description>SPOOFED - Microsoft DNS on Windows 2008 SP something -- assert nothing.</description>
723
723
  <example>Microsoft DNS 6.0.6100 (2AEF76E)</example>
724
+ <param pos="0" name="hw.certainty" value="0.0"/>
725
+ <param pos="0" name="os.certainty" value="0.0"/>
726
+ <param pos="0" name="service.certainty" value="0.0"/>
724
727
  </fingerprint>
725
728
 
726
729
  <fingerprint pattern="^Microsoft DNS 6.0.6003(?: \(([^)]+)\))?$">
@@ -843,8 +846,8 @@
843
846
 
844
847
  <fingerprint pattern="^ALU DNS ([\d\.]+) Build (\d+)$">
845
848
  <description>ALU (Alcatel Lucent?) DNS</description>
846
- <example service.version="6.2">ALU DNS 6.2 Build 22</example>
847
- <example service.version.version="9">ALU DNS 6.2 Build 9</example>
849
+ <example service.version="6.2" service.version.version="22">ALU DNS 6.2 Build 22</example>
850
+ <example service.version.version="9" service.version="6.2">ALU DNS 6.2 Build 9</example>
848
851
  <param pos="0" name="service.vendor" value="ALU"/>
849
852
  <param pos="0" name="service.family" value="DNS"/>
850
853
  <param pos="0" name="service.product" value="DNS"/>
@@ -910,8 +913,8 @@
910
913
 
911
914
  <fingerprint pattern="^Meta IP[\s\/]DNS (?:V[\d\.]+ )?- BIND V([\d\.]+(?:-REL)?) \(Build (\d+)\s?\)$">
912
915
  <description>Check Point Meta IP</description>
913
- <example service.version="8.2.7-REL">Meta IP DNS - BIND V8.2.7-REL (Build 31)</example>
914
- <example service.version.version="4704">Meta IP/DNS V4.1 - BIND V8.1.2 (Build 4704 )</example>
916
+ <example service.version="8.2.7-REL" service.version.version="31">Meta IP DNS - BIND V8.2.7-REL (Build 31)</example>
917
+ <example service.version.version="4704" service.version="8.1.2">Meta IP/DNS V4.1 - BIND V8.1.2 (Build 4704 )</example>
915
918
  <param pos="0" name="service.vendor" value="Check Point"/>
916
919
  <param pos="0" name="service.family" value="META IP"/>
917
920
  <param pos="0" name="service.product" value="DNS"/>
data/xml/favicons.xml CHANGED
@@ -486,6 +486,15 @@
486
486
  <param pos="0" name="os.cpe23" value="cpe:/o:dd-wrt:dd-wrt:-"/>
487
487
  </fingerprint>
488
488
 
489
+ <fingerprint pattern="^cff908861188a1246a35c3f8325c7d2c$">
490
+ <description>Tomato Router Firmware</description>
491
+ <example>cff908861188a1246a35c3f8325c7d2c</example>
492
+ <param pos="0" name="os.vendor" value="Tomato"/>
493
+ <param pos="0" name="os.family" value="Linux"/>
494
+ <param pos="0" name="os.product" value="Tomato"/>
495
+ <param pos="0" name="os.device" value="Router"/>
496
+ </fingerprint>
497
+
489
498
  <fingerprint pattern="^bad2c1f96cd66e70b4aa119e7270cc62|966e60f8eb85b7ea43a7b0095f3e2336$">
490
499
  <description>Atlassian Confluence</description>
491
500
  <example>bad2c1f96cd66e70b4aa119e7270cc62</example>
@@ -493,7 +502,7 @@
493
502
  <param pos="0" name="service.vendor" value="Atlassian"/>
494
503
  <param pos="0" name="service.product" value="Confluence"/>
495
504
  <param pos="0" name="service.certainty" value="0.5"/>
496
- <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence:-"/>
505
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence_server:-"/>
497
506
  </fingerprint>
498
507
 
499
508
  <fingerprint pattern="^0fbe700fd7d07ec8d30ef8b3ac261484$">
@@ -1327,10 +1336,13 @@
1327
1336
  <description>pfSense Firewall</description>
1328
1337
  <example>5567e9ce23e5549e0fcd7195f3882816</example>
1329
1338
  <example>57f187c7a868faeac558007a8eb6cb2e</example>
1330
- <param pos="0" name="hw.vendor" value="pfSense"/>
1331
- <param pos="0" name="hw.device" value="Firewall"/>
1332
- <param pos="0" name="hw.product" value="Firewall"/>
1333
- <param pos="0" name="hw.certainty" value="0.5"/>
1339
+ <param pos="0" name="service.vendor" value="pfSense"/>
1340
+ <param pos="0" name="service.product" value="pfSense"/>
1341
+ <param pos="0" name="service.device" value="Firewall"/>
1342
+ <param pos="0" name="service.cpe23" value="cpe:/a:pfsense:pfsense:-"/>
1343
+ <param pos="0" name="service.component.vendor" value="nginx"/>
1344
+ <param pos="0" name="service.component.product" value="nginx"/>
1345
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:f5:nginx:-"/>
1334
1346
  <param pos="0" name="os.vendor" value="pfSense"/>
1335
1347
  <param pos="0" name="os.product" value="FreeBSD"/>
1336
1348
  <param pos="0" name="os.certainty" value="0.5"/>
@@ -1943,9 +1955,79 @@
1943
1955
  <param pos="0" name="os.vendor" value="LG"/>
1944
1956
  <param pos="0" name="os.product" value="webOS"/>
1945
1957
  <param pos="0" name="os.certainty" value="0.5"/>
1958
+ <param pos="0" name="os.cpe23" value="cpe:/o:lg:webos:-"/>
1946
1959
  <param pos="0" name="hw.vendor" value="LG"/>
1947
1960
  <param pos="0" name="hw.device" value="Smart TV"/>
1948
1961
  <param pos="0" name="hw.certainty" value="0.5"/>
1949
1962
  </fingerprint>
1950
1963
 
1964
+ <fingerprint pattern="^dd80f14145f075264b3067801f511c2f$">
1965
+ <description>Covenant .NET C2 framework</description>
1966
+ <example>dd80f14145f075264b3067801f511c2f</example>
1967
+ <param pos="0" name="service.product" value="Covenant"/>
1968
+ </fingerprint>
1969
+
1970
+ <fingerprint pattern="^5508e5abca6493613e11c72f4296ebf4$">
1971
+ <description>MITRE CALDERA C2 framework</description>
1972
+ <example>5508e5abca6493613e11c72f4296ebf4</example>
1973
+ <param pos="0" name="service.vendor" value="MITRE"/>
1974
+ <param pos="0" name="service.product" value="CALDERA"/>
1975
+ <param pos="0" name="service.cpe23" value="cpe:/a:mitre:caldera:-"/>
1976
+ </fingerprint>
1977
+
1978
+ <fingerprint pattern="^e4ce127909d4697b97bf404a42e7c428$">
1979
+ <description>mitmweb web interface for mitmproxy - https://github.com/mitmproxy/mitmproxy</description>
1980
+ <example>e4ce127909d4697b97bf404a42e7c428</example>
1981
+ <param pos="0" name="service.vendor" value="mitmproxy"/>
1982
+ <param pos="0" name="service.product" value="mitmproxy"/>
1983
+ <param pos="0" name="service.cpe23" value="cpe:/a:mitmproxy:mitmproxy:-"/>
1984
+ </fingerprint>
1985
+
1986
+ <fingerprint pattern="^531b63a51234bb06c9d77f219eb25553$">
1987
+ <description>phpMyAdmin web interface for MySQL and MariaDB</description>
1988
+ <example>531b63a51234bb06c9d77f219eb25553</example>
1989
+ <param pos="0" name="service.vendor" value="phpMyAdmin"/>
1990
+ <param pos="0" name="service.product" value="phpMyAdmin"/>
1991
+ <param pos="0" name="service.cpe23" value="cpe:/a:phpmyadmin:phpmyadmin:-"/>
1992
+ </fingerprint>
1993
+
1994
+ <fingerprint pattern="^ded14e8b701325c527da56f86b5d5616$">
1995
+ <description>Adminer database management tool</description>
1996
+ <example>ded14e8b701325c527da56f86b5d5616</example>
1997
+ <param pos="0" name="service.vendor" value="Adminer"/>
1998
+ <param pos="0" name="service.product" value="Adminer"/>
1999
+ <param pos="0" name="service.cpe23" value="cpe:/a:adminer:adminer:-"/>
2000
+ </fingerprint>
2001
+
2002
+ <fingerprint pattern="^6f6256748d679d8684123363bd50a8dd$">
2003
+ <description>mongo-express web-based MongoDB admin interface</description>
2004
+ <example>6f6256748d679d8684123363bd50a8dd</example>
2005
+ <param pos="0" name="service.vendor" value="mongo-express Project"/>
2006
+ <param pos="0" name="service.product" value="mongo-express"/>
2007
+ <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
2008
+ </fingerprint>
2009
+
2010
+ <fingerprint pattern="^ce83d230195be7e6d3f1513cc5057da5$">
2011
+ <description>Apache Solr</description>
2012
+ <example>ce83d230195be7e6d3f1513cc5057da5</example>
2013
+ <param pos="0" name="service.vendor" value="Apache"/>
2014
+ <param pos="0" name="service.product" value="Solr"/>
2015
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:solr:-"/>
2016
+ </fingerprint>
2017
+
2018
+ <fingerprint pattern="^165de54ff29d30a3773c53e7911227d3$">
2019
+ <description>Apache Spark</description>
2020
+ <example>165de54ff29d30a3773c53e7911227d3</example>
2021
+ <param pos="0" name="service.vendor" value="Apache"/>
2022
+ <param pos="0" name="service.product" value="Spark"/>
2023
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:spark:-"/>
2024
+ </fingerprint>
2025
+
2026
+ <fingerprint pattern="^a3dcb28303f26786e262e0760781057a$">
2027
+ <description>Eltex device web interface</description>
2028
+ <example>a3dcb28303f26786e262e0760781057a</example>
2029
+ <param pos="0" name="os.vendor" value="Eltex"/>
2030
+ <param pos="0" name="hw.vendor" value="Eltex"/>
2031
+ </fingerprint>
2032
+
1951
2033
  </fingerprints>
data/xml/fingerprints.xsd CHANGED
@@ -104,16 +104,24 @@
104
104
  <xsd:sequence>
105
105
  <xsd:element name="description" type="xsd:string" minOccurs="1" maxOccurs="1"/>
106
106
  <xsd:element name="example" type="example_element" minOccurs="0" maxOccurs="unbounded"/>
107
- <xsd:element name="param" type="param_element" minOccurs="0" maxOccurs="unbounded"/>
107
+ <xsd:element name="param" type="param_element" minOccurs="1" maxOccurs="unbounded"/>
108
108
  </xsd:sequence>
109
109
  <xsd:attribute name="certainty" type="xsd:string" use="optional"/>
110
110
  <xsd:attribute name="pattern" type="xsd:string" use="required"/>
111
111
  <xsd:attribute name="flags" type="xsd:string" use="optional"/>
112
112
  </xsd:complexType>
113
113
 
114
+ <xsd:simpleType name="encoding">
115
+ <xsd:restriction base="xsd:string">
116
+ <xsd:enumeration value="base64" />
117
+ </xsd:restriction>
118
+ </xsd:simpleType>
119
+
114
120
  <xsd:complexType name="example_element">
115
121
  <xsd:simpleContent>
116
122
  <xsd:extension base="xsd:string">
123
+ <xsd:attribute name="_encoding" type="encoding"/>
124
+ <xsd:attribute name="_filename" type="xsd:string"/>
117
125
  <xsd:anyAttribute processContents="skip"/>
118
126
  </xsd:extension>
119
127
  </xsd:simpleContent>