recog 2.3.22 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/dns_versionbind.xml CHANGED
@@ -68,8 +68,8 @@
68
68
  <example service.version="9.3.6-P1" os.version="5" os.version.version="11">9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.12</example>
69
69
  <example service.version="9.9.1-P3" os.version="6">9.9.1-P3-RedHat-9.9.1.P3.el6</example>
70
70
  <example service.version="9.9.3-rpz2+rl.13208.13-P2" os.version="6">9.9.3-rpz2+rl.13208.13-P2-RedHat-9.9.3-4.P2.el6</example>
71
- <example os.version="6" os.version.version="1">9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3</example>
72
- <example os.version="6" os.version.version="">9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6</example>
71
+ <example os.version="6" os.version.version="1" service.version="9.7.3-P3">9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3</example>
72
+ <example os.version="6" os.version.version="" service.version="9.8.2rc1">9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6</example>
73
73
  <param pos="0" name="service.vendor" value="ISC"/>
74
74
  <param pos="0" name="service.family" value="BIND"/>
75
75
  <param pos="0" name="service.product" value="BIND"/>
@@ -85,21 +85,21 @@
85
85
 
86
86
  <fingerprint pattern="^(9.[^-]+(?:-rl[.\d]+)?(?:-[SP]\d)?)-RedHat-[\d.]+-[\w.]+fc([\d]+)$">
87
87
  <description>ISC BIND: Fedora</description>
88
- <example service.version="9.10.4-P8">9.10.4-P8-RedHat-9.10.4-4.P8.fc25</example>
88
+ <example service.version="9.10.4-P8" os.version="25">9.10.4-P8-RedHat-9.10.4-4.P8.fc25</example>
89
89
  <!-- The '-rl' in the example below indicates a rate limiting patch -->
90
90
 
91
- <example service.version="9.9.3-rl.13207.22-P2">9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19</example>
92
- <example os.version="10">9.5.2-RedHat-9.5.2-1.fc10</example>
91
+ <example service.version="9.9.3-rl.13207.22-P2" os.version="19">9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19</example>
92
+ <example os.version="10" service.version="9.5.2">9.5.2-RedHat-9.5.2-1.fc10</example>
93
93
  <param pos="0" name="service.vendor" value="ISC"/>
94
94
  <param pos="0" name="service.family" value="BIND"/>
95
95
  <param pos="0" name="service.product" value="BIND"/>
96
96
  <param pos="1" name="service.version"/>
97
97
  <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
98
- <param pos="0" name="os.vendor" value="Red Hat"/>
98
+ <param pos="0" name="os.vendor" value="Fedora Project"/>
99
99
  <param pos="0" name="os.family" value="Linux"/>
100
- <param pos="0" name="os.product" value="Fedora Core Linux"/>
100
+ <param pos="0" name="os.product" value="Fedora Core"/>
101
101
  <param pos="2" name="os.version"/>
102
- <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:{os.version}"/>
102
+ <param pos="0" name="os.cpe23" value="cpe:/o:fedoraproject:fedora_core:{os.version}"/>
103
103
  </fingerprint>
104
104
 
105
105
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-RedHat-[\w.-]+amzn1$">
@@ -719,8 +719,11 @@
719
719
  -->
720
720
 
721
721
  <fingerprint pattern="^Microsoft DNS 6.0.6100 \(2AEF76E\)$">
722
- <description>SPOOFED - Microsoft DNS on Windows 2008 SP something</description>
722
+ <description>SPOOFED - Microsoft DNS on Windows 2008 SP something -- assert nothing.</description>
723
723
  <example>Microsoft DNS 6.0.6100 (2AEF76E)</example>
724
+ <param pos="0" name="hw.certainty" value="0.0"/>
725
+ <param pos="0" name="os.certainty" value="0.0"/>
726
+ <param pos="0" name="service.certainty" value="0.0"/>
724
727
  </fingerprint>
725
728
 
726
729
  <fingerprint pattern="^Microsoft DNS 6.0.6003(?: \(([^)]+)\))?$">
@@ -843,8 +846,8 @@
843
846
 
844
847
  <fingerprint pattern="^ALU DNS ([\d\.]+) Build (\d+)$">
845
848
  <description>ALU (Alcatel Lucent?) DNS</description>
846
- <example service.version="6.2">ALU DNS 6.2 Build 22</example>
847
- <example service.version.version="9">ALU DNS 6.2 Build 9</example>
849
+ <example service.version="6.2" service.version.version="22">ALU DNS 6.2 Build 22</example>
850
+ <example service.version.version="9" service.version="6.2">ALU DNS 6.2 Build 9</example>
848
851
  <param pos="0" name="service.vendor" value="ALU"/>
849
852
  <param pos="0" name="service.family" value="DNS"/>
850
853
  <param pos="0" name="service.product" value="DNS"/>
@@ -910,8 +913,8 @@
910
913
 
911
914
  <fingerprint pattern="^Meta IP[\s\/]DNS (?:V[\d\.]+ )?- BIND V([\d\.]+(?:-REL)?) \(Build (\d+)\s?\)$">
912
915
  <description>Check Point Meta IP</description>
913
- <example service.version="8.2.7-REL">Meta IP DNS - BIND V8.2.7-REL (Build 31)</example>
914
- <example service.version.version="4704">Meta IP/DNS V4.1 - BIND V8.1.2 (Build 4704 )</example>
916
+ <example service.version="8.2.7-REL" service.version.version="31">Meta IP DNS - BIND V8.2.7-REL (Build 31)</example>
917
+ <example service.version.version="4704" service.version="8.1.2">Meta IP/DNS V4.1 - BIND V8.1.2 (Build 4704 )</example>
915
918
  <param pos="0" name="service.vendor" value="Check Point"/>
916
919
  <param pos="0" name="service.family" value="META IP"/>
917
920
  <param pos="0" name="service.product" value="DNS"/>
data/xml/favicons.xml CHANGED
@@ -486,6 +486,15 @@
486
486
  <param pos="0" name="os.cpe23" value="cpe:/o:dd-wrt:dd-wrt:-"/>
487
487
  </fingerprint>
488
488
 
489
+ <fingerprint pattern="^cff908861188a1246a35c3f8325c7d2c$">
490
+ <description>Tomato Router Firmware</description>
491
+ <example>cff908861188a1246a35c3f8325c7d2c</example>
492
+ <param pos="0" name="os.vendor" value="Tomato"/>
493
+ <param pos="0" name="os.family" value="Linux"/>
494
+ <param pos="0" name="os.product" value="Tomato"/>
495
+ <param pos="0" name="os.device" value="Router"/>
496
+ </fingerprint>
497
+
489
498
  <fingerprint pattern="^bad2c1f96cd66e70b4aa119e7270cc62|966e60f8eb85b7ea43a7b0095f3e2336$">
490
499
  <description>Atlassian Confluence</description>
491
500
  <example>bad2c1f96cd66e70b4aa119e7270cc62</example>
@@ -493,7 +502,7 @@
493
502
  <param pos="0" name="service.vendor" value="Atlassian"/>
494
503
  <param pos="0" name="service.product" value="Confluence"/>
495
504
  <param pos="0" name="service.certainty" value="0.5"/>
496
- <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence:-"/>
505
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence_server:-"/>
497
506
  </fingerprint>
498
507
 
499
508
  <fingerprint pattern="^0fbe700fd7d07ec8d30ef8b3ac261484$">
@@ -1327,10 +1336,13 @@
1327
1336
  <description>pfSense Firewall</description>
1328
1337
  <example>5567e9ce23e5549e0fcd7195f3882816</example>
1329
1338
  <example>57f187c7a868faeac558007a8eb6cb2e</example>
1330
- <param pos="0" name="hw.vendor" value="pfSense"/>
1331
- <param pos="0" name="hw.device" value="Firewall"/>
1332
- <param pos="0" name="hw.product" value="Firewall"/>
1333
- <param pos="0" name="hw.certainty" value="0.5"/>
1339
+ <param pos="0" name="service.vendor" value="pfSense"/>
1340
+ <param pos="0" name="service.product" value="pfSense"/>
1341
+ <param pos="0" name="service.device" value="Firewall"/>
1342
+ <param pos="0" name="service.cpe23" value="cpe:/a:pfsense:pfsense:-"/>
1343
+ <param pos="0" name="service.component.vendor" value="nginx"/>
1344
+ <param pos="0" name="service.component.product" value="nginx"/>
1345
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:f5:nginx:-"/>
1334
1346
  <param pos="0" name="os.vendor" value="pfSense"/>
1335
1347
  <param pos="0" name="os.product" value="FreeBSD"/>
1336
1348
  <param pos="0" name="os.certainty" value="0.5"/>
@@ -1943,9 +1955,79 @@
1943
1955
  <param pos="0" name="os.vendor" value="LG"/>
1944
1956
  <param pos="0" name="os.product" value="webOS"/>
1945
1957
  <param pos="0" name="os.certainty" value="0.5"/>
1958
+ <param pos="0" name="os.cpe23" value="cpe:/o:lg:webos:-"/>
1946
1959
  <param pos="0" name="hw.vendor" value="LG"/>
1947
1960
  <param pos="0" name="hw.device" value="Smart TV"/>
1948
1961
  <param pos="0" name="hw.certainty" value="0.5"/>
1949
1962
  </fingerprint>
1950
1963
 
1964
+ <fingerprint pattern="^dd80f14145f075264b3067801f511c2f$">
1965
+ <description>Covenant .NET C2 framework</description>
1966
+ <example>dd80f14145f075264b3067801f511c2f</example>
1967
+ <param pos="0" name="service.product" value="Covenant"/>
1968
+ </fingerprint>
1969
+
1970
+ <fingerprint pattern="^5508e5abca6493613e11c72f4296ebf4$">
1971
+ <description>MITRE CALDERA C2 framework</description>
1972
+ <example>5508e5abca6493613e11c72f4296ebf4</example>
1973
+ <param pos="0" name="service.vendor" value="MITRE"/>
1974
+ <param pos="0" name="service.product" value="CALDERA"/>
1975
+ <param pos="0" name="service.cpe23" value="cpe:/a:mitre:caldera:-"/>
1976
+ </fingerprint>
1977
+
1978
+ <fingerprint pattern="^e4ce127909d4697b97bf404a42e7c428$">
1979
+ <description>mitmweb web interface for mitmproxy - https://github.com/mitmproxy/mitmproxy</description>
1980
+ <example>e4ce127909d4697b97bf404a42e7c428</example>
1981
+ <param pos="0" name="service.vendor" value="mitmproxy"/>
1982
+ <param pos="0" name="service.product" value="mitmproxy"/>
1983
+ <param pos="0" name="service.cpe23" value="cpe:/a:mitmproxy:mitmproxy:-"/>
1984
+ </fingerprint>
1985
+
1986
+ <fingerprint pattern="^531b63a51234bb06c9d77f219eb25553$">
1987
+ <description>phpMyAdmin web interface for MySQL and MariaDB</description>
1988
+ <example>531b63a51234bb06c9d77f219eb25553</example>
1989
+ <param pos="0" name="service.vendor" value="phpMyAdmin"/>
1990
+ <param pos="0" name="service.product" value="phpMyAdmin"/>
1991
+ <param pos="0" name="service.cpe23" value="cpe:/a:phpmyadmin:phpmyadmin:-"/>
1992
+ </fingerprint>
1993
+
1994
+ <fingerprint pattern="^ded14e8b701325c527da56f86b5d5616$">
1995
+ <description>Adminer database management tool</description>
1996
+ <example>ded14e8b701325c527da56f86b5d5616</example>
1997
+ <param pos="0" name="service.vendor" value="Adminer"/>
1998
+ <param pos="0" name="service.product" value="Adminer"/>
1999
+ <param pos="0" name="service.cpe23" value="cpe:/a:adminer:adminer:-"/>
2000
+ </fingerprint>
2001
+
2002
+ <fingerprint pattern="^6f6256748d679d8684123363bd50a8dd$">
2003
+ <description>mongo-express web-based MongoDB admin interface</description>
2004
+ <example>6f6256748d679d8684123363bd50a8dd</example>
2005
+ <param pos="0" name="service.vendor" value="mongo-express Project"/>
2006
+ <param pos="0" name="service.product" value="mongo-express"/>
2007
+ <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
2008
+ </fingerprint>
2009
+
2010
+ <fingerprint pattern="^ce83d230195be7e6d3f1513cc5057da5$">
2011
+ <description>Apache Solr</description>
2012
+ <example>ce83d230195be7e6d3f1513cc5057da5</example>
2013
+ <param pos="0" name="service.vendor" value="Apache"/>
2014
+ <param pos="0" name="service.product" value="Solr"/>
2015
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:solr:-"/>
2016
+ </fingerprint>
2017
+
2018
+ <fingerprint pattern="^165de54ff29d30a3773c53e7911227d3$">
2019
+ <description>Apache Spark</description>
2020
+ <example>165de54ff29d30a3773c53e7911227d3</example>
2021
+ <param pos="0" name="service.vendor" value="Apache"/>
2022
+ <param pos="0" name="service.product" value="Spark"/>
2023
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:spark:-"/>
2024
+ </fingerprint>
2025
+
2026
+ <fingerprint pattern="^a3dcb28303f26786e262e0760781057a$">
2027
+ <description>Eltex device web interface</description>
2028
+ <example>a3dcb28303f26786e262e0760781057a</example>
2029
+ <param pos="0" name="os.vendor" value="Eltex"/>
2030
+ <param pos="0" name="hw.vendor" value="Eltex"/>
2031
+ </fingerprint>
2032
+
1951
2033
  </fingerprints>
data/xml/fingerprints.xsd CHANGED
@@ -104,16 +104,24 @@
104
104
  <xsd:sequence>
105
105
  <xsd:element name="description" type="xsd:string" minOccurs="1" maxOccurs="1"/>
106
106
  <xsd:element name="example" type="example_element" minOccurs="0" maxOccurs="unbounded"/>
107
- <xsd:element name="param" type="param_element" minOccurs="0" maxOccurs="unbounded"/>
107
+ <xsd:element name="param" type="param_element" minOccurs="1" maxOccurs="unbounded"/>
108
108
  </xsd:sequence>
109
109
  <xsd:attribute name="certainty" type="xsd:string" use="optional"/>
110
110
  <xsd:attribute name="pattern" type="xsd:string" use="required"/>
111
111
  <xsd:attribute name="flags" type="xsd:string" use="optional"/>
112
112
  </xsd:complexType>
113
113
 
114
+ <xsd:simpleType name="encoding">
115
+ <xsd:restriction base="xsd:string">
116
+ <xsd:enumeration value="base64" />
117
+ </xsd:restriction>
118
+ </xsd:simpleType>
119
+
114
120
  <xsd:complexType name="example_element">
115
121
  <xsd:simpleContent>
116
122
  <xsd:extension base="xsd:string">
123
+ <xsd:attribute name="_encoding" type="encoding"/>
124
+ <xsd:attribute name="_filename" type="xsd:string"/>
117
125
  <xsd:anyAttribute processContents="skip"/>
118
126
  </xsd:extension>
119
127
  </xsd:simpleContent>