recog 2.3.22 → 2.3.23

Sign up to get free protection for your applications and to get access to all the features.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/h323_callresp.xml CHANGED
@@ -91,7 +91,7 @@
91
91
 
92
92
  <fingerprint pattern="^0x0900003d\:(.*)\:.*?(\d*\.*\d*\.*\d*)" flags="REG_ICASE">
93
93
  <description>Equivalence (OpenH323) H.323 Server</description>
94
- <example>0x0900003D:Null Team YATE:3.3.2 (OpenH323 v1.19.0)</example>
94
+ <example service.product="Null Team YATE" service.version="3.3.2">0x0900003D:Null Team YATE:3.3.2 (OpenH323 v1.19.0)</example>
95
95
  <param pos="0" name="service.vendor" value="Equivalence (OpenH323)"/>
96
96
  <param pos="1" name="service.product"/>
97
97
  <param pos="2" name="service.version"/>
@@ -596,7 +596,7 @@
596
596
 
597
597
  <fingerprint pattern="^0xb5002331\:(.*)\:Release\s[\s-]*(\d+\.+\d+\.*\d*)" flags="REG_ICASE">
598
598
  <description>ViaVideo/PolyCom H.323 Server</description>
599
- <example>0xb5002331:ViewStation 7.0:Release 7.5.4 - 04 Mar 2005</example>
599
+ <example service.product="ViewStation 7.0" service.version="7.5.4">0xb5002331:ViewStation 7.0:Release 7.5.4 - 04 Mar 2005</example>
600
600
  <param pos="0" name="service.vendor" value="ViaVideo/PolyCom"/>
601
601
  <param pos="1" name="service.product"/>
602
602
  <param pos="2" name="service.version"/>
data/xml/hp_pjl_id.xml CHANGED
@@ -15,11 +15,11 @@
15
15
 
16
16
  <fingerprint pattern="(?i)laserjet (.*)(?: series)?">
17
17
  <description>HP JetDirect Printer</description>
18
- <example>HP LaserJet 4100 Series</example>
19
- <example>HP LaserJet 2200</example>
20
- <example>LASERJET 4050</example>
21
- <example>LASERJET 4 PLUS</example>
22
- <example>HP LaserJet Professional P1606dn</example>
18
+ <example os.product="4100 Series">HP LaserJet 4100 Series</example>
19
+ <example os.product="2200">HP LaserJet 2200</example>
20
+ <example os.product="4050">LASERJET 4050</example>
21
+ <example os.product="4 PLUS">LASERJET 4 PLUS</example>
22
+ <example os.product="Professional P1606dn">HP LaserJet Professional P1606dn</example>
23
23
  <param pos="0" name="service.vendor" value="HP"/>
24
24
  <param pos="0" name="service.product" value="JetDirect"/>
25
25
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -31,10 +31,10 @@
31
31
 
32
32
  <fingerprint pattern="(?i)(designjet \S+)">
33
33
  <description>HP Designjet printer</description>
34
- <example>hp designjet 110plus</example>
35
- <example>DESIGNJET 1050C</example>
36
- <example>DESIGNJET 1055CM</example>
37
- <example>DESIGNJET 700</example>
34
+ <example os.product="designjet 110plus">hp designjet 110plus</example>
35
+ <example os.product="DESIGNJET 1050C">DESIGNJET 1050C</example>
36
+ <example os.product="DESIGNJET 1055CM">DESIGNJET 1055CM</example>
37
+ <example os.product="DESIGNJET 700">DESIGNJET 700</example>
38
38
  <param pos="0" name="service.vendor" value="HP"/>
39
39
  <param pos="0" name="service.product" value="JetDirect"/>
40
40
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -46,9 +46,9 @@
46
46
 
47
47
  <fingerprint pattern="^Xerox ColorQube (\S+)$">
48
48
  <description>Xerox ColorQube Multifunction Printer</description>
49
- <example>Xerox ColorQube 8570DN</example>
50
- <example>Xerox ColorQube 8570DT</example>
51
- <example>Xerox ColorQube 8570N</example>
49
+ <example os.product="8570DN">Xerox ColorQube 8570DN</example>
50
+ <example os.product="8570DT">Xerox ColorQube 8570DT</example>
51
+ <example os.product="8570N">Xerox ColorQube 8570N</example>
52
52
  <param pos="0" name="os.vendor" value="Xerox"/>
53
53
  <param pos="0" name="os.family" value="ColorQube"/>
54
54
  <param pos="1" name="os.product"/>
@@ -57,7 +57,7 @@
57
57
 
58
58
  <fingerprint pattern="^Brother (.+)$">
59
59
  <description>Brother Printer</description>
60
- <example>Brother HL-1660e</example>
60
+ <example os.product="HL-1660e">Brother HL-1660e</example>
61
61
  <param pos="0" name="os.vendor" value="Brother"/>
62
62
  <param pos="0" name="os.device" value="Printer"/>
63
63
  <param pos="1" name="os.product"/>
@@ -67,9 +67,9 @@
67
67
 
68
68
  <fingerprint pattern="^(iR ?\S+)">
69
69
  <description>Canon iR multifunction device</description>
70
- <example>iR 3180C EUR</example>
71
- <example>iR C4080/C4580</example>
72
- <example>iR1020/1024/1025</example>
70
+ <example os.product="iR 3180C">iR 3180C EUR</example>
71
+ <example os.product="iR C4080/C4580">iR C4080/C4580</example>
72
+ <example os.product="iR1020/1024/1025">iR1020/1024/1025</example>
73
73
  <param pos="0" name="os.vendor" value="Canon"/>
74
74
  <param pos="0" name="os.family" value="iR Series"/>
75
75
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -78,16 +78,16 @@
78
78
 
79
79
  <fingerprint pattern="^(?:Dell (?:Color Laser |Laser Printer )?|(?:Color Laser |Laser Printer ))(\d+(?:n|cn|dn|cdn))(?: Color Laser| Laser Printer)?$">
80
80
  <description>Dell Laser Printer</description>
81
- <example>Dell Laser Printer 1710n</example>
82
- <example>Dell Color Laser 3110cn</example>
83
- <example>Laser Printer 5100cn</example>
84
- <example>Dell 2130cn Color Laser</example>
85
- <example>Dell 2330dn Laser Printer</example>
86
- <example>Dell 2350dn Laser Printer</example>
87
- <example>Dell 3130cn Color Laser</example>
88
- <example>Dell 5130cdn Color Laser</example>
89
- <example>Dell 5230n Laser Printer</example>
90
- <example>Dell 2145cn</example>
81
+ <example os.product="1710n">Dell Laser Printer 1710n</example>
82
+ <example os.product="3110cn">Dell Color Laser 3110cn</example>
83
+ <example os.product="5100cn">Laser Printer 5100cn</example>
84
+ <example os.product="2130cn">Dell 2130cn Color Laser</example>
85
+ <example os.product="2330dn">Dell 2330dn Laser Printer</example>
86
+ <example os.product="2350dn">Dell 2350dn Laser Printer</example>
87
+ <example os.product="3130cn">Dell 3130cn Color Laser</example>
88
+ <example os.product="5130cdn">Dell 5130cdn Color Laser</example>
89
+ <example os.product="5230n">Dell 5230n Laser Printer</example>
90
+ <example os.product="2145cn">Dell 2145cn</example>
91
91
  <param pos="0" name="os.vendor" value="Dell"/>
92
92
  <param pos="0" name="os.family" value="Laser Printer"/>
93
93
  <param pos="0" name="os.device" value="Printer"/>
@@ -96,8 +96,8 @@
96
96
 
97
97
  <fingerprint pattern="^Dell (\d+(?:n|cn|dn|cdn)) MFP$">
98
98
  <description>Dell Laser multifunction device</description>
99
- <example>Dell 2135cn MFP</example>
100
- <example>Dell 2335dn MFP</example>
99
+ <example os.product="2135cn">Dell 2135cn MFP</example>
100
+ <example os.product="2335dn">Dell 2335dn MFP</example>
101
101
  <param pos="0" name="os.vendor" value="Dell"/>
102
102
  <param pos="0" name="os.family" value="Laser Printer"/>
103
103
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -106,7 +106,7 @@
106
106
 
107
107
  <fingerprint pattern="^HP (\S+ Digital Sender)$">
108
108
  <description>HP Digital Sender scanner</description>
109
- <example>HP 9250C Digital Sender</example>
109
+ <example os.product="9250C Digital Sender">HP 9250C Digital Sender</example>
110
110
  <param pos="0" name="os.vendor" value="HP"/>
111
111
  <param pos="0" name="os.device" value="Scanner"/>
112
112
  <param pos="0" name="os.family" value="Digital Sender"/>
@@ -123,7 +123,7 @@
123
123
 
124
124
  <fingerprint pattern="^KM-(.*)$">
125
125
  <description>Konica Minolta printer</description>
126
- <example>KM-5050</example>
126
+ <example os.product="5050">KM-5050</example>
127
127
  <param pos="0" name="os.vendor" value="Lexmark"/>
128
128
  <param pos="0" name="os.device" value="Printer"/>
129
129
  <param pos="1" name="os.product"/>
@@ -131,9 +131,9 @@
131
131
 
132
132
  <fingerprint pattern="^(FS-\S+MFP\S*)$">
133
133
  <description>Kyocera Mita Multifunction device</description>
134
- <example>FS-C2126MFP</example>
135
- <example>FS-C2126MFP+</example>
136
- <example>FS-1035MFP/DP</example>
134
+ <example os.product="FS-C2126MFP">FS-C2126MFP</example>
135
+ <example os.product="FS-C2126MFP+">FS-C2126MFP+</example>
136
+ <example os.product="FS-1035MFP/DP">FS-1035MFP/DP</example>
137
137
  <param pos="0" name="os.vendor" value="Kyocera Mita"/>
138
138
  <param pos="0" name="os.device" value="Multifunction Device"/>
139
139
  <param pos="0" name="os.family" value="FS"/>
@@ -142,9 +142,9 @@
142
142
 
143
143
  <fingerprint pattern="^(FS-(?:C)?\d+(?:D|DN))$">
144
144
  <description>Kyocera Mita Printer</description>
145
- <example>FS-C8500DN</example>
146
- <example>FS-4100DN</example>
147
- <example>FS-2020D</example>
145
+ <example os.product="FS-C8500DN">FS-C8500DN</example>
146
+ <example os.product="FS-4100DN">FS-4100DN</example>
147
+ <example os.product="FS-2020D">FS-2020D</example>
148
148
  <param pos="0" name="os.vendor" value="Kyocera Mita"/>
149
149
  <param pos="0" name="os.device" value="Printer"/>
150
150
  <param pos="0" name="os.family" value="FS"/>
@@ -153,9 +153,9 @@
153
153
 
154
154
  <fingerprint pattern="^(TASKalfa \S+)$">
155
155
  <description>Kyocera Mita TASKalfa multifunction device</description>
156
- <example>TASKalfa 300ci</example>
157
- <example>TASKalfa 520i</example>
158
- <example>TASKalfa 250ci</example>
156
+ <example os.product="TASKalfa 300ci">TASKalfa 300ci</example>
157
+ <example os.product="TASKalfa 520i">TASKalfa 520i</example>
158
+ <example os.product="TASKalfa 250ci">TASKalfa 250ci</example>
159
159
  <param pos="0" name="os.vendor" value="Kyocera Mita"/>
160
160
  <param pos="0" name="os.device" value="Multifunction Device"/>
161
161
  <param pos="0" name="os.family" value="TASKalfa"/>
@@ -164,9 +164,9 @@
164
164
 
165
165
  <fingerprint pattern="^Lexmark (.*)$">
166
166
  <description>Lexmark JetDirect printer</description>
167
- <example>Lexmark C910</example>
168
- <example>Lexmark Optra LaserPrinter</example>
169
- <example>Lexmark Optra S 1250</example>
167
+ <example os.product="C910">Lexmark C910</example>
168
+ <example os.product="Optra LaserPrinter">Lexmark Optra LaserPrinter</example>
169
+ <example os.product="Optra S 1250">Lexmark Optra S 1250</example>
170
170
  <param pos="0" name="os.vendor" value="Lexmark"/>
171
171
  <param pos="0" name="os.device" value="Printer"/>
172
172
  <param pos="1" name="os.product"/>
@@ -183,7 +183,7 @@
183
183
 
184
184
  <fingerprint pattern="(?i)^Oce (VL\S+):">
185
185
  <description>Oce VarioLink multifunction device</description>
186
- <example>Oce VL3200:8C5-D92:Ver.B</example>
186
+ <example os.product="VL3200:8C5-D92">Oce VL3200:8C5-D92:Ver.B</example>
187
187
  <param pos="0" name="os.vendor" value="Oce"/>
188
188
  <param pos="0" name="os.family" value="VarioLink"/>
189
189
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -205,7 +205,7 @@
205
205
 
206
206
  <fingerprint pattern="(?i)^Imagistics (im\S+) (.+)">
207
207
  <description>Oce IM series multifunction device</description>
208
- <example>Imagistics im3510/4510 02-Aug-04 10:56</example>
208
+ <example os.product="im3510/4510" system.time="02-Aug-04 10:56">Imagistics im3510/4510 02-Aug-04 10:56</example>
209
209
  <param pos="0" name="os.vendor" value="Oce"/>
210
210
  <param pos="0" name="os.family" value="IM Series"/>
211
211
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -218,9 +218,9 @@
218
218
 
219
219
  <fingerprint pattern="^OKI (C\d+)\S*$">
220
220
  <description>Okidata color printer</description>
221
- <example>OKI C610</example>
222
- <example>OKI C710</example>
223
- <example>OKI C710dn</example>
221
+ <example os.product="C610">OKI C610</example>
222
+ <example os.product="C710">OKI C710</example>
223
+ <example os.product="C710">OKI C710dn</example>
224
224
  <param pos="0" name="os.vendor" value="Okidata"/>
225
225
  <param pos="0" name="os.device" value="Printer"/>
226
226
  <param pos="1" name="os.product"/>
@@ -228,7 +228,7 @@
228
228
 
229
229
  <fingerprint pattern="^OKI (MC\d+)\S*$">
230
230
  <description>Okidata multifunction device</description>
231
- <example>OKI MC860</example>
231
+ <example os.product="MC860">OKI MC860</example>
232
232
  <param pos="0" name="os.vendor" value="Okidata"/>
233
233
  <param pos="0" name="os.device" value="Multifunction Device"/>
234
234
  <param pos="1" name="os.product"/>
@@ -236,10 +236,10 @@
236
236
 
237
237
  <fingerprint pattern="(?i)^RICOH ((?:Aficio|MP|SP) .*)$">
238
238
  <description>Ricoh Aficio Printer</description>
239
- <example>RICOH Aficio 2075</example>
240
- <example>RICOH Aficio AP610N</example>
241
- <example>RICOH Aficio SP 8100DN</example>
242
- <example>RICOH MP C1500/615C</example>
239
+ <example os.product="Aficio 2075">RICOH Aficio 2075</example>
240
+ <example os.product="Aficio AP610N">RICOH Aficio AP610N</example>
241
+ <example os.product="Aficio SP 8100DN">RICOH Aficio SP 8100DN</example>
242
+ <example os.product="MP C1500/615C">RICOH MP C1500/615C</example>
243
243
  <param pos="0" name="os.vendor" value="Ricoh"/>
244
244
  <param pos="0" name="os.family" value="Aficio"/>
245
245
  <param pos="1" name="os.product"/>
@@ -251,14 +251,14 @@
251
251
 
252
252
  <fingerprint pattern="(?i)^NRG ([MS]P \S+)$">
253
253
  <description>Ricoh NRG printer</description>
254
- <example>NRG MP 171</example>
255
- <example>NRG MP 3350</example>
256
- <example>NRG MP C2550</example>
257
- <example>NRG MP C2800</example>
258
- <example>NRG MP C3500</example>
259
- <example>NRG MP C4000</example>
260
- <example>NRG MP C4500</example>
261
- <example>NRG SP C231SF</example>
254
+ <example os.product="MP 171">NRG MP 171</example>
255
+ <example os.product="MP 3350">NRG MP 3350</example>
256
+ <example os.product="MP C2550">NRG MP C2550</example>
257
+ <example os.product="MP C2800">NRG MP C2800</example>
258
+ <example os.product="MP C3500">NRG MP C3500</example>
259
+ <example os.product="MP C4000">NRG MP C4000</example>
260
+ <example os.product="MP C4500">NRG MP C4500</example>
261
+ <example os.product="SP C231SF">NRG SP C231SF</example>
262
262
  <param pos="0" name="os.vendor" value="Ricoh"/>
263
263
  <param pos="0" name="os.device" value="Printer"/>
264
264
  <param pos="1" name="os.product"/>
@@ -269,7 +269,7 @@
269
269
 
270
270
  <fingerprint pattern="(?i)^Gestetner (MP\S+/DSc\S+)$">
271
271
  <description>Ricoh Gestetner multifunction device</description>
272
- <example>Gestetner MPC2500/DSc525</example>
272
+ <example os.product="MPC2500/DSc525">Gestetner MPC2500/DSc525</example>
273
273
  <param pos="0" name="os.vendor" value="Ricoh"/>
274
274
  <param pos="0" name="os.device" value="Multifunction Device"/>
275
275
  <param pos="1" name="os.product"/>
@@ -285,7 +285,7 @@
285
285
 
286
286
  <fingerprint pattern="(?i)^Savin (\S+)$">
287
287
  <description>Savin Printer</description>
288
- <example>SAVIN 4075</example>
288
+ <example os.product="4075">SAVIN 4075</example>
289
289
  <param pos="0" name="os.vendor" value="Savin"/>
290
290
  <param pos="0" name="os.device" value="Printer"/>
291
291
  <param pos="1" name="os.product"/>
@@ -293,8 +293,8 @@
293
293
 
294
294
  <fingerprint pattern="(?i)^Samsung ((?:SCX|CLX)-\S+) Series$">
295
295
  <description>Samsung multifunction device</description>
296
- <example>Samsung SCX-5835_5935 Series</example>
297
- <example>Samsung CLX-4195 Series</example>
296
+ <example os.product="SCX-5835_5935">Samsung SCX-5835_5935 Series</example>
297
+ <example os.product="CLX-4195">Samsung CLX-4195 Series</example>
298
298
  <param pos="0" name="os.vendor" value="Samsung"/>
299
299
  <param pos="0" name="os.device" value="Multifunction Device"/>
300
300
  <param pos="1" name="os.product"/>
@@ -302,8 +302,8 @@
302
302
 
303
303
  <fingerprint pattern="(?i)^Samsung ((?:ML|CLP)-\S+) Series$">
304
304
  <description>Samsung printer</description>
305
- <example>Samsung CLP-680 Series</example>
306
- <example>Samsung ML-5012_5512 Series</example>
305
+ <example os.product="CLP-680">Samsung CLP-680 Series</example>
306
+ <example os.product="ML-5012_5512">Samsung ML-5012_5512 Series</example>
307
307
  <param pos="0" name="os.vendor" value="Samsung"/>
308
308
  <param pos="0" name="os.device" value="Printer"/>
309
309
  <param pos="1" name="os.product"/>
@@ -311,8 +311,8 @@
311
311
 
312
312
  <fingerprint pattern="(?i)^SHARP (\S+-\S+)">
313
313
  <description>Sharp Printer</description>
314
- <example>Sharp MX-NBX3 18-Mar-08 10:22</example>
315
- <example>Sharp AR-P17 24-Mar-04 19:55</example>
314
+ <example os.product="MX-NBX3">Sharp MX-NBX3 18-Mar-08 10:22</example>
315
+ <example os.product="AR-P17">Sharp AR-P17 24-Mar-04 19:55</example>
316
316
  <param pos="0" name="os.vendor" value="Sharp"/>
317
317
  <param pos="0" name="os.device" value="Printer"/>
318
318
  <param pos="1" name="os.product"/>
@@ -320,7 +320,7 @@
320
320
 
321
321
  <fingerprint pattern="(?i)^Source Technologies (\S+)$">
322
322
  <description>Source Technologies Printer</description>
323
- <example>Source Technologies ST-9620</example>
323
+ <example os.product="ST-9620">Source Technologies ST-9620</example>
324
324
  <param pos="0" name="os.vendor" value="Source Technologies"/>
325
325
  <param pos="0" name="os.device" value="Printer"/>
326
326
  <param pos="1" name="os.product"/>
@@ -330,10 +330,10 @@
330
330
 
331
331
  <fingerprint pattern="^TOSHIBA (e-STUDIO\S+)(?:\s+.*)?" certainty="0.9">
332
332
  <description>Toshiba e-STUDIO multifunction device</description>
333
- <example>TOSHIBA e-STUDIO350 V468Z 20061013</example>
334
- <example>TOSHIBA e-STUDIO350-450 V444Z 20041104</example>
335
- <example>TOSHIBA e-STUDIO450 V468Z 20061013</example>
336
- <example>TOSHIBA e-STUDIO500S</example>
333
+ <example os.product="e-STUDIO350">TOSHIBA e-STUDIO350 V468Z 20061013</example>
334
+ <example os.product="e-STUDIO350-450">TOSHIBA e-STUDIO350-450 V444Z 20041104</example>
335
+ <example os.product="e-STUDIO450">TOSHIBA e-STUDIO450 V468Z 20061013</example>
336
+ <example os.product="e-STUDIO500S">TOSHIBA e-STUDIO500S</example>
337
337
  <param pos="0" name="os.vendor" value="Toshiba"/>
338
338
  <param pos="0" name="os.family" value="e-STUDIO"/>
339
339
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -351,8 +351,8 @@
351
351
 
352
352
  <fingerprint pattern="^(?:ID=)?Xerox (Phaser \S+)$" certainty="0.9">
353
353
  <description>Xerox Phaser Printer</description>
354
- <example>Xerox Phaser 6180MFP-D</example>
355
- <example>ID=Xerox Phaser 5400</example>
354
+ <example os.product="Phaser 6180MFP-D">Xerox Phaser 6180MFP-D</example>
355
+ <example os.product="Phaser 5400">ID=Xerox Phaser 5400</example>
356
356
  <param pos="0" name="os.vendor" value="Xerox"/>
357
357
  <param pos="0" name="os.family" value="Phaser"/>
358
358
  <param pos="0" name="os.device" value="Printer"/>
@@ -361,9 +361,9 @@
361
361
 
362
362
  <fingerprint pattern="^Xerox (WorkCentre .*)$" certainty="0.9">
363
363
  <description>Xerox Workcentre Printer</description>
364
- <example>Xerox WorkCentre 7425</example>
365
- <example>Xerox WorkCentre Pro 245</example>
366
- <example>Xerox WorkCentre Pro 55, v1 Multifunction System</example>
364
+ <example os.product="WorkCentre 7425">Xerox WorkCentre 7425</example>
365
+ <example os.product="WorkCentre Pro 245">Xerox WorkCentre Pro 245</example>
366
+ <example os.product="WorkCentre Pro 55, v1 Multifunction System">Xerox WorkCentre Pro 55, v1 Multifunction System</example>
367
367
  <param pos="0" name="os.vendor" value="Xerox"/>
368
368
  <param pos="0" name="os.family" value="WorkCentre"/>
369
369
  <param pos="1" name="os.product"/>
@@ -372,7 +372,7 @@
372
372
 
373
373
  <fingerprint pattern="^(XC\S+)$" certainty="0.9">
374
374
  <description>Xerox XC Printer</description>
375
- <example>XC560</example>
375
+ <example os.product="XC560">XC560</example>
376
376
  <param pos="0" name="os.vendor" value="Xerox"/>
377
377
  <param pos="0" name="os.family" value="XC"/>
378
378
  <param pos="0" name="os.device" value="Printer"/>
@@ -381,7 +381,7 @@
381
381
 
382
382
  <fingerprint pattern="^(DC\S+)$" certainty="0.9">
383
383
  <description>Xerox DocuColor Printer</description>
384
- <example>DC250</example>
384
+ <example os.product="DC250">DC250</example>
385
385
  <param pos="0" name="os.vendor" value="Xerox"/>
386
386
  <param pos="0" name="os.family" value="DocuColor"/>
387
387
  <param pos="0" name="os.device" value="Printer"/>
@@ -390,7 +390,7 @@
390
390
 
391
391
  <fingerprint pattern="^(EX\d+-\d+)$" certainty="0.9">
392
392
  <description>Xerox EX Print Server, powered by EFI Fiery</description>
393
- <example>EX4112-4127</example>
393
+ <example os.product="EX4112-4127">EX4112-4127</example>
394
394
  <param pos="0" name="os.vendor" value="Xerox"/>
395
395
  <param pos="0" name="os.family" value="EX"/>
396
396
  <param pos="0" name="os.device" value="Print Server"/>
data/xml/html_title.xml CHANGED
@@ -214,6 +214,17 @@
214
214
  <param pos="0" name="hw.device" value="DVR"/>
215
215
  </fingerprint>
216
216
 
217
+ <!-- Xiongmai Technology is rebranded by a number of DVR and IP Camera manufacturers -->
218
+
219
+ <fingerprint pattern="^NETSurveillance WEB$">
220
+ <description>NetSurveillance web interface on DVR and IP Camera devices sourced from Xiongmai Technology</description>
221
+ <example>NETSurveillance WEB</example>
222
+ <param pos="0" name="service.vendor" value="Xiongmai Technology"/>
223
+ <param pos="0" name="service.product" value="uc-httpd"/>
224
+ <param pos="0" name="service.cpe23" value="cpe:/a:xiongmaitech:uc-httpd:-"/>
225
+ <param pos="0" name="os.vendor" value="Xiongmai Technology"/>
226
+ </fingerprint>
227
+
217
228
  <fingerprint pattern="^FRITZ!Box$">
218
229
  <description>AVM FRITZ!Box</description>
219
230
  <example>FRITZ!Box</example>
@@ -635,8 +646,8 @@
635
646
 
636
647
  <fingerprint pattern="^Wowza Streaming Engine 4 (Subscription|Perpetual Pro) Edition (\d\.[\w.]+) build(\d+)$">
637
648
  <description>Wowza Streaming Engine</description>
638
- <example service.version="4.7.7.01" service.version.version="20190222144406">Wowza Streaming Engine 4 Subscription Edition 4.7.7.01 build20190222144406</example>
639
- <example service.edition="Perpetual Pro">Wowza Streaming Engine 4 Perpetual Pro Edition 4.8.8.01 build20201216140014</example>
649
+ <example service.version="4.7.7.01" service.version.version="20190222144406" service.edition="Subscription">Wowza Streaming Engine 4 Subscription Edition 4.7.7.01 build20190222144406</example>
650
+ <example service.edition="Perpetual Pro" service.version="4.8.8.01" service.version.version="20201216140014">Wowza Streaming Engine 4 Perpetual Pro Edition 4.8.8.01 build20201216140014</example>
640
651
  <param pos="0" name="service.vendor" value="Wowza"/>
641
652
  <param pos="0" name="service.product" value="Streaming Engine"/>
642
653
  <param pos="1" name="service.edition"/>
@@ -673,7 +684,7 @@
673
684
  <param pos="0" name="service.product" value="nginx"/>
674
685
  <param pos="0" name="service.family" value="nginx"/>
675
686
  <param pos="0" name="service.vendor" value="nginx"/>
676
- <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
687
+ <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:-"/>
677
688
  </fingerprint>
678
689
 
679
690
  <fingerprint pattern="^Test Page for the Nginx HTTP Server on (?:Fedora|EPEL)$">
@@ -682,11 +693,11 @@
682
693
  <param pos="0" name="service.product" value="nginx"/>
683
694
  <param pos="0" name="service.family" value="nginx"/>
684
695
  <param pos="0" name="service.vendor" value="nginx"/>
685
- <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
696
+ <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:-"/>
686
697
  <param pos="0" name="os.family" value="Linux"/>
687
- <param pos="0" name="os.vendor" value="Red Hat"/>
688
- <param pos="0" name="os.product" value="Fedora Core Linux"/>
689
- <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:-"/>
698
+ <param pos="0" name="os.vendor" value="Fedora Project"/>
699
+ <param pos="0" name="os.product" value="Fedora Core"/>
700
+ <param pos="0" name="os.cpe23" value="cpe:/o:fedoraproject:fedora_core:-"/>
690
701
  </fingerprint>
691
702
 
692
703
  <fingerprint pattern="^Welcome to nginx on Debian!$">
@@ -695,7 +706,7 @@
695
706
  <param pos="0" name="service.product" value="nginx"/>
696
707
  <param pos="0" name="service.family" value="nginx"/>
697
708
  <param pos="0" name="service.vendor" value="nginx"/>
698
- <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
709
+ <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:-"/>
699
710
  <param pos="0" name="os.vendor" value="Debian"/>
700
711
  <param pos="0" name="os.product" value="Linux"/>
701
712
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
@@ -1367,6 +1378,7 @@
1367
1378
  <param pos="0" name="os.device" value="Switch"/>
1368
1379
  <param pos="0" name="os.product" value="MDS 9000"/>
1369
1380
  <param pos="1" name="os.version"/>
1381
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:mds_9000_san-os:{os.version}"/>
1370
1382
  </fingerprint>
1371
1383
 
1372
1384
  <fingerprint pattern="^Stealthwatch Management Console$">
@@ -3112,7 +3124,7 @@
3112
3124
  <example>Log In - Confluence</example>
3113
3125
  <param pos="0" name="service.vendor" value="Atlassian"/>
3114
3126
  <param pos="0" name="service.product" value="Confluence"/>
3115
- <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence:-"/>
3127
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence_server:-"/>
3116
3128
  </fingerprint>
3117
3129
 
3118
3130
  <fingerprint pattern="^System Dashboard - ">
@@ -3724,4 +3736,161 @@
3724
3736
  <param pos="0" name="hw.product" value="Eternus"/>
3725
3737
  </fingerprint>
3726
3738
 
3739
+ <fingerprint pattern="^Covenant - Login$">
3740
+ <description>Covenant .NET C2 framework</description>
3741
+ <example>Covenant - Login</example>
3742
+ <param pos="0" name="service.product" value="Covenant"/>
3743
+ </fingerprint>
3744
+
3745
+ <fingerprint pattern="^Login \| CALDERA$">
3746
+ <description>MITRE CALDERA C2 framework</description>
3747
+ <example>Login | CALDERA</example>
3748
+ <param pos="0" name="service.vendor" value="MITRE"/>
3749
+ <param pos="0" name="service.product" value="CALDERA"/>
3750
+ <param pos="0" name="service.cpe23" value="cpe:/a:mitre:caldera:-"/>
3751
+ </fingerprint>
3752
+
3753
+ <fingerprint pattern="(?:(\S{1,512}):\d{1,5} / \S{1,512} \| )?phpMyAdmin(?: ([\d.]+(?:-[a-zA-Z0-9]+)?(?:\+\d{8}\.[a-f0-9]{4,40})?))?">
3754
+ <description>phpMyAdmin web interface for MySQL and MariaDB</description>
3755
+ <example>phpMyAdmin</example>
3756
+ <example service.version="2.10.0.2">phpMyAdmin 2.10.0.2</example>
3757
+ <example service.version="5.0.0-rc1">phpMyAdmin 5.0.0-rc1</example>
3758
+ <example service.version="5.3.0-dev">phpMyAdmin 5.3.0-dev</example>
3759
+ <example host.name="10.10.10.10" service.version="5.0.4">10.10.10.10:8080 / db.foo.bar | phpMyAdmin 5.0.4</example>
3760
+ <example host.name="localhost" service.version="5.3.0-dev+20220208.47252f9cf8">localhost:8080 / mysql-server | phpMyAdmin 5.3.0-dev+20220208.47252f9cf8</example>
3761
+ <example host.name="[::ffff:10.10.10.10]" service.version="5.3.0-dev+20220208.47252f9cf8">[::ffff:10.10.10.10]:8080 / mysql-server | phpMyAdmin 5.3.0-dev+20220208.47252f9cf8</example>
3762
+ <param pos="0" name="service.vendor" value="phpMyAdmin"/>
3763
+ <param pos="0" name="service.product" value="phpMyAdmin"/>
3764
+ <param pos="1" name="host.name"/>
3765
+ <param pos="2" name="service.version"/>
3766
+ <param pos="0" name="service.cpe23" value="cpe:/a:phpmyadmin:phpmyadmin:{service.version}"/>
3767
+ </fingerprint>
3768
+
3769
+ <fingerprint pattern="^Login - Adminer$">
3770
+ <description>Adminer database management tool</description>
3771
+ <example>Login - Adminer</example>
3772
+ <param pos="0" name="service.vendor" value="Adminer"/>
3773
+ <param pos="0" name="service.product" value="Adminer"/>
3774
+ <param pos="0" name="service.cpe23" value="cpe:/a:adminer:adminer:-"/>
3775
+ </fingerprint>
3776
+
3777
+ <fingerprint pattern="^Home - Mongo Express$">
3778
+ <description>mongo-express web-based MongoDB admin interface</description>
3779
+ <example>Home - Mongo Express</example>
3780
+ <param pos="0" name="service.vendor" value="mongo-express Project"/>
3781
+ <param pos="0" name="service.product" value="mongo-express"/>
3782
+ <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
3783
+ </fingerprint>
3784
+
3785
+ <fingerprint pattern="^Solr Admin$">
3786
+ <description>Apache Solr</description>
3787
+ <example>Solr Admin</example>
3788
+ <param pos="0" name="service.vendor" value="Apache"/>
3789
+ <param pos="0" name="service.product" value="Solr"/>
3790
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:solr:-"/>
3791
+ </fingerprint>
3792
+
3793
+ <fingerprint pattern="^Spark (?:Master|Worker) at (?:spark:\/\/)?(\S{1,512}):\d{1,5}$">
3794
+ <description>Apache Spark</description>
3795
+ <example host.name="spark-master-0.foo.bar">Spark Master at spark://spark-master-0.foo.bar:7077</example>
3796
+ <example host.name="10.10.10.10">Spark Master at spark://10.10.10.10:7077</example>
3797
+ <example host.name="10.10.10.10">Spark Worker at 10.10.10.10:45339</example>
3798
+ <param pos="0" name="service.vendor" value="Apache"/>
3799
+ <param pos="0" name="service.product" value="Spark"/>
3800
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:spark:-"/>
3801
+ <param pos="1" name="host.name"/>
3802
+ </fingerprint>
3803
+
3804
+ <fingerprint pattern="^pfSense - Login$">
3805
+ <description>pfSense Firewall</description>
3806
+ <example>pfSense - Login</example>
3807
+ <param pos="0" name="service.vendor" value="pfSense"/>
3808
+ <param pos="0" name="service.product" value="pfSense"/>
3809
+ <param pos="0" name="service.device" value="Firewall"/>
3810
+ <param pos="0" name="service.cpe23" value="cpe:/a:pfsense:pfsense:-"/>
3811
+ <param pos="0" name="service.component.vendor" value="nginx"/>
3812
+ <param pos="0" name="service.component.product" value="nginx"/>
3813
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:f5:nginx:-"/>
3814
+ <param pos="0" name="os.vendor" value="pfSense"/>
3815
+ <param pos="0" name="os.product" value="FreeBSD"/>
3816
+ </fingerprint>
3817
+
3818
+ <fingerprint pattern="^Netgate pfSense Plus - Login$">
3819
+ <description>pfSense Plus Firewall</description>
3820
+ <example>Netgate pfSense Plus - Login</example>
3821
+ <param pos="0" name="service.vendor" value="Netgate"/>
3822
+ <param pos="0" name="service.product" value="pfSense"/>
3823
+ <param pos="0" name="service.device" value="Firewall"/>
3824
+ <param pos="0" name="service.cpe23" value="cpe:/a:netgate:pfsense:-"/>
3825
+ <param pos="0" name="service.component.vendor" value="nginx"/>
3826
+ <param pos="0" name="service.component.product" value="nginx"/>
3827
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:f5:nginx:-"/>
3828
+ <param pos="0" name="os.vendor" value="pfSense"/>
3829
+ <param pos="0" name="os.product" value="FreeBSD"/>
3830
+ </fingerprint>
3831
+
3832
+ <fingerprint pattern="^Vigor Login Page$">
3833
+ <description>DrayTek Vigor network equipment - without model or version</description>
3834
+ <example>Vigor Login Page</example>
3835
+ <param pos="0" name="os.vendor" value="DrayTek"/>
3836
+ <param pos="0" name="os.family" value="Vigor"/>
3837
+ <param pos="0" name="hw.vendor" value="DrayTek"/>
3838
+ <param pos="0" name="hw.family" value="Vigor"/>
3839
+ </fingerprint>
3840
+
3841
+ <!-- Specific Eltex fingerprints to enable CPE generation -->
3842
+
3843
+ <fingerprint pattern="^Eltex - NTP-RG-1402G$">
3844
+ <description>Eltex - NTP-RG-1402G broadband router</description>
3845
+ <example>Eltex - NTP-RG-1402G</example>
3846
+ <param pos="0" name="os.vendor" value="Eltex"/>
3847
+ <param pos="0" name="os.product" value="NTP-RG-1402G Firmware"/>
3848
+ <param pos="0" name="os.device" value="Broadband Router"/>
3849
+ <param pos="0" name="os.cpe23" value="cpe:/o:eltex-co:ntp-rg-1402g_firmware:-"/>
3850
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3851
+ <param pos="0" name="hw.product" value="NTP-RG-1402G"/>
3852
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3853
+ <param pos="0" name="hw.cpe23" value="cpe:/h:eltex-co:ntp-rg-1402g:-"/>
3854
+ </fingerprint>
3855
+
3856
+ <fingerprint pattern="^Eltex - NTP-2$">
3857
+ <description>Eltex - NTP-2 broadband router</description>
3858
+ <example>Eltex - NTP-2</example>
3859
+ <param pos="0" name="os.vendor" value="Eltex"/>
3860
+ <param pos="0" name="os.product" value="NTP-2 Firmware"/>
3861
+ <param pos="0" name="os.device" value="Broadband Router"/>
3862
+ <param pos="0" name="os.cpe23" value="cpe:/o:eltex-co:ntp-2_firmware:-"/>
3863
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3864
+ <param pos="0" name="hw.product" value="NTP-2"/>
3865
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3866
+ <param pos="0" name="hw.cpe23" value="cpe:/h:eltex-co:ntp-2:-"/>
3867
+ </fingerprint>
3868
+
3869
+ <!-- General Eltex fingerprints -->
3870
+
3871
+ <fingerprint pattern="^Eltex - (NT[PU]-RG-\d[\w-]+):?(:?rev\.\w\w?)?$">
3872
+ <description>Eltex RG model ONT class broadband router</description>
3873
+ <example hw.product="NTU-RG-1402G-W">Eltex - NTU-RG-1402G-W</example>
3874
+ <example hw.product="NTU-RG-1421G-Wac" hw.version="rev.A1">Eltex - NTU-RG-1421G-Wac:rev.A1</example>
3875
+ <example hw.product="NTP-RG-1402G-W" hw.version="rev.C">Eltex - NTP-RG-1402G-W:rev.C</example>
3876
+ <param pos="0" name="os.vendor" value="Eltex"/>
3877
+ <param pos="0" name="os.device" value="Broadband Router"/>
3878
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3879
+ <param pos="1" name="hw.product"/>
3880
+ <param pos="2" name="hw.version"/>
3881
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3882
+ </fingerprint>
3883
+
3884
+ <fingerprint pattern="^Eltex - (NT[PU]-2\w\w?)$">
3885
+ <description>Eltex - NTP / NTU model broadband router</description>
3886
+ <example hw.product="NTU-2V">Eltex - NTU-2V</example>
3887
+ <example hw.product="NTU-2VC">Eltex - NTU-2VC</example>
3888
+ <example hw.product="NTP-2C">Eltex - NTP-2C</example>
3889
+ <param pos="0" name="os.vendor" value="Eltex"/>
3890
+ <param pos="0" name="os.device" value="Broadband Router"/>
3891
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3892
+ <param pos="1" name="hw.product"/>
3893
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3894
+ </fingerprint>
3895
+
3727
3896
  </fingerprints>