recog 2.3.22 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/h323_callresp.xml CHANGED
@@ -91,7 +91,7 @@
91
91
 
92
92
  <fingerprint pattern="^0x0900003d\:(.*)\:.*?(\d*\.*\d*\.*\d*)" flags="REG_ICASE">
93
93
  <description>Equivalence (OpenH323) H.323 Server</description>
94
- <example>0x0900003D:Null Team YATE:3.3.2 (OpenH323 v1.19.0)</example>
94
+ <example service.product="Null Team YATE" service.version="3.3.2">0x0900003D:Null Team YATE:3.3.2 (OpenH323 v1.19.0)</example>
95
95
  <param pos="0" name="service.vendor" value="Equivalence (OpenH323)"/>
96
96
  <param pos="1" name="service.product"/>
97
97
  <param pos="2" name="service.version"/>
@@ -596,7 +596,7 @@
596
596
 
597
597
  <fingerprint pattern="^0xb5002331\:(.*)\:Release\s[\s-]*(\d+\.+\d+\.*\d*)" flags="REG_ICASE">
598
598
  <description>ViaVideo/PolyCom H.323 Server</description>
599
- <example>0xb5002331:ViewStation 7.0:Release 7.5.4 - 04 Mar 2005</example>
599
+ <example service.product="ViewStation 7.0" service.version="7.5.4">0xb5002331:ViewStation 7.0:Release 7.5.4 - 04 Mar 2005</example>
600
600
  <param pos="0" name="service.vendor" value="ViaVideo/PolyCom"/>
601
601
  <param pos="1" name="service.product"/>
602
602
  <param pos="2" name="service.version"/>
data/xml/hp_pjl_id.xml CHANGED
@@ -15,11 +15,11 @@
15
15
 
16
16
  <fingerprint pattern="(?i)laserjet (.*)(?: series)?">
17
17
  <description>HP JetDirect Printer</description>
18
- <example>HP LaserJet 4100 Series</example>
19
- <example>HP LaserJet 2200</example>
20
- <example>LASERJET 4050</example>
21
- <example>LASERJET 4 PLUS</example>
22
- <example>HP LaserJet Professional P1606dn</example>
18
+ <example os.product="4100 Series">HP LaserJet 4100 Series</example>
19
+ <example os.product="2200">HP LaserJet 2200</example>
20
+ <example os.product="4050">LASERJET 4050</example>
21
+ <example os.product="4 PLUS">LASERJET 4 PLUS</example>
22
+ <example os.product="Professional P1606dn">HP LaserJet Professional P1606dn</example>
23
23
  <param pos="0" name="service.vendor" value="HP"/>
24
24
  <param pos="0" name="service.product" value="JetDirect"/>
25
25
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -31,10 +31,10 @@
31
31
 
32
32
  <fingerprint pattern="(?i)(designjet \S+)">
33
33
  <description>HP Designjet printer</description>
34
- <example>hp designjet 110plus</example>
35
- <example>DESIGNJET 1050C</example>
36
- <example>DESIGNJET 1055CM</example>
37
- <example>DESIGNJET 700</example>
34
+ <example os.product="designjet 110plus">hp designjet 110plus</example>
35
+ <example os.product="DESIGNJET 1050C">DESIGNJET 1050C</example>
36
+ <example os.product="DESIGNJET 1055CM">DESIGNJET 1055CM</example>
37
+ <example os.product="DESIGNJET 700">DESIGNJET 700</example>
38
38
  <param pos="0" name="service.vendor" value="HP"/>
39
39
  <param pos="0" name="service.product" value="JetDirect"/>
40
40
  <param pos="0" name="service.family" value="JetDirect"/>
@@ -46,9 +46,9 @@
46
46
 
47
47
  <fingerprint pattern="^Xerox ColorQube (\S+)$">
48
48
  <description>Xerox ColorQube Multifunction Printer</description>
49
- <example>Xerox ColorQube 8570DN</example>
50
- <example>Xerox ColorQube 8570DT</example>
51
- <example>Xerox ColorQube 8570N</example>
49
+ <example os.product="8570DN">Xerox ColorQube 8570DN</example>
50
+ <example os.product="8570DT">Xerox ColorQube 8570DT</example>
51
+ <example os.product="8570N">Xerox ColorQube 8570N</example>
52
52
  <param pos="0" name="os.vendor" value="Xerox"/>
53
53
  <param pos="0" name="os.family" value="ColorQube"/>
54
54
  <param pos="1" name="os.product"/>
@@ -57,7 +57,7 @@
57
57
 
58
58
  <fingerprint pattern="^Brother (.+)$">
59
59
  <description>Brother Printer</description>
60
- <example>Brother HL-1660e</example>
60
+ <example os.product="HL-1660e">Brother HL-1660e</example>
61
61
  <param pos="0" name="os.vendor" value="Brother"/>
62
62
  <param pos="0" name="os.device" value="Printer"/>
63
63
  <param pos="1" name="os.product"/>
@@ -67,9 +67,9 @@
67
67
 
68
68
  <fingerprint pattern="^(iR ?\S+)">
69
69
  <description>Canon iR multifunction device</description>
70
- <example>iR 3180C EUR</example>
71
- <example>iR C4080/C4580</example>
72
- <example>iR1020/1024/1025</example>
70
+ <example os.product="iR 3180C">iR 3180C EUR</example>
71
+ <example os.product="iR C4080/C4580">iR C4080/C4580</example>
72
+ <example os.product="iR1020/1024/1025">iR1020/1024/1025</example>
73
73
  <param pos="0" name="os.vendor" value="Canon"/>
74
74
  <param pos="0" name="os.family" value="iR Series"/>
75
75
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -78,16 +78,16 @@
78
78
 
79
79
  <fingerprint pattern="^(?:Dell (?:Color Laser |Laser Printer )?|(?:Color Laser |Laser Printer ))(\d+(?:n|cn|dn|cdn))(?: Color Laser| Laser Printer)?$">
80
80
  <description>Dell Laser Printer</description>
81
- <example>Dell Laser Printer 1710n</example>
82
- <example>Dell Color Laser 3110cn</example>
83
- <example>Laser Printer 5100cn</example>
84
- <example>Dell 2130cn Color Laser</example>
85
- <example>Dell 2330dn Laser Printer</example>
86
- <example>Dell 2350dn Laser Printer</example>
87
- <example>Dell 3130cn Color Laser</example>
88
- <example>Dell 5130cdn Color Laser</example>
89
- <example>Dell 5230n Laser Printer</example>
90
- <example>Dell 2145cn</example>
81
+ <example os.product="1710n">Dell Laser Printer 1710n</example>
82
+ <example os.product="3110cn">Dell Color Laser 3110cn</example>
83
+ <example os.product="5100cn">Laser Printer 5100cn</example>
84
+ <example os.product="2130cn">Dell 2130cn Color Laser</example>
85
+ <example os.product="2330dn">Dell 2330dn Laser Printer</example>
86
+ <example os.product="2350dn">Dell 2350dn Laser Printer</example>
87
+ <example os.product="3130cn">Dell 3130cn Color Laser</example>
88
+ <example os.product="5130cdn">Dell 5130cdn Color Laser</example>
89
+ <example os.product="5230n">Dell 5230n Laser Printer</example>
90
+ <example os.product="2145cn">Dell 2145cn</example>
91
91
  <param pos="0" name="os.vendor" value="Dell"/>
92
92
  <param pos="0" name="os.family" value="Laser Printer"/>
93
93
  <param pos="0" name="os.device" value="Printer"/>
@@ -96,8 +96,8 @@
96
96
 
97
97
  <fingerprint pattern="^Dell (\d+(?:n|cn|dn|cdn)) MFP$">
98
98
  <description>Dell Laser multifunction device</description>
99
- <example>Dell 2135cn MFP</example>
100
- <example>Dell 2335dn MFP</example>
99
+ <example os.product="2135cn">Dell 2135cn MFP</example>
100
+ <example os.product="2335dn">Dell 2335dn MFP</example>
101
101
  <param pos="0" name="os.vendor" value="Dell"/>
102
102
  <param pos="0" name="os.family" value="Laser Printer"/>
103
103
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -106,7 +106,7 @@
106
106
 
107
107
  <fingerprint pattern="^HP (\S+ Digital Sender)$">
108
108
  <description>HP Digital Sender scanner</description>
109
- <example>HP 9250C Digital Sender</example>
109
+ <example os.product="9250C Digital Sender">HP 9250C Digital Sender</example>
110
110
  <param pos="0" name="os.vendor" value="HP"/>
111
111
  <param pos="0" name="os.device" value="Scanner"/>
112
112
  <param pos="0" name="os.family" value="Digital Sender"/>
@@ -123,7 +123,7 @@
123
123
 
124
124
  <fingerprint pattern="^KM-(.*)$">
125
125
  <description>Konica Minolta printer</description>
126
- <example>KM-5050</example>
126
+ <example os.product="5050">KM-5050</example>
127
127
  <param pos="0" name="os.vendor" value="Lexmark"/>
128
128
  <param pos="0" name="os.device" value="Printer"/>
129
129
  <param pos="1" name="os.product"/>
@@ -131,9 +131,9 @@
131
131
 
132
132
  <fingerprint pattern="^(FS-\S+MFP\S*)$">
133
133
  <description>Kyocera Mita Multifunction device</description>
134
- <example>FS-C2126MFP</example>
135
- <example>FS-C2126MFP+</example>
136
- <example>FS-1035MFP/DP</example>
134
+ <example os.product="FS-C2126MFP">FS-C2126MFP</example>
135
+ <example os.product="FS-C2126MFP+">FS-C2126MFP+</example>
136
+ <example os.product="FS-1035MFP/DP">FS-1035MFP/DP</example>
137
137
  <param pos="0" name="os.vendor" value="Kyocera Mita"/>
138
138
  <param pos="0" name="os.device" value="Multifunction Device"/>
139
139
  <param pos="0" name="os.family" value="FS"/>
@@ -142,9 +142,9 @@
142
142
 
143
143
  <fingerprint pattern="^(FS-(?:C)?\d+(?:D|DN))$">
144
144
  <description>Kyocera Mita Printer</description>
145
- <example>FS-C8500DN</example>
146
- <example>FS-4100DN</example>
147
- <example>FS-2020D</example>
145
+ <example os.product="FS-C8500DN">FS-C8500DN</example>
146
+ <example os.product="FS-4100DN">FS-4100DN</example>
147
+ <example os.product="FS-2020D">FS-2020D</example>
148
148
  <param pos="0" name="os.vendor" value="Kyocera Mita"/>
149
149
  <param pos="0" name="os.device" value="Printer"/>
150
150
  <param pos="0" name="os.family" value="FS"/>
@@ -153,9 +153,9 @@
153
153
 
154
154
  <fingerprint pattern="^(TASKalfa \S+)$">
155
155
  <description>Kyocera Mita TASKalfa multifunction device</description>
156
- <example>TASKalfa 300ci</example>
157
- <example>TASKalfa 520i</example>
158
- <example>TASKalfa 250ci</example>
156
+ <example os.product="TASKalfa 300ci">TASKalfa 300ci</example>
157
+ <example os.product="TASKalfa 520i">TASKalfa 520i</example>
158
+ <example os.product="TASKalfa 250ci">TASKalfa 250ci</example>
159
159
  <param pos="0" name="os.vendor" value="Kyocera Mita"/>
160
160
  <param pos="0" name="os.device" value="Multifunction Device"/>
161
161
  <param pos="0" name="os.family" value="TASKalfa"/>
@@ -164,9 +164,9 @@
164
164
 
165
165
  <fingerprint pattern="^Lexmark (.*)$">
166
166
  <description>Lexmark JetDirect printer</description>
167
- <example>Lexmark C910</example>
168
- <example>Lexmark Optra LaserPrinter</example>
169
- <example>Lexmark Optra S 1250</example>
167
+ <example os.product="C910">Lexmark C910</example>
168
+ <example os.product="Optra LaserPrinter">Lexmark Optra LaserPrinter</example>
169
+ <example os.product="Optra S 1250">Lexmark Optra S 1250</example>
170
170
  <param pos="0" name="os.vendor" value="Lexmark"/>
171
171
  <param pos="0" name="os.device" value="Printer"/>
172
172
  <param pos="1" name="os.product"/>
@@ -183,7 +183,7 @@
183
183
 
184
184
  <fingerprint pattern="(?i)^Oce (VL\S+):">
185
185
  <description>Oce VarioLink multifunction device</description>
186
- <example>Oce VL3200:8C5-D92:Ver.B</example>
186
+ <example os.product="VL3200:8C5-D92">Oce VL3200:8C5-D92:Ver.B</example>
187
187
  <param pos="0" name="os.vendor" value="Oce"/>
188
188
  <param pos="0" name="os.family" value="VarioLink"/>
189
189
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -205,7 +205,7 @@
205
205
 
206
206
  <fingerprint pattern="(?i)^Imagistics (im\S+) (.+)">
207
207
  <description>Oce IM series multifunction device</description>
208
- <example>Imagistics im3510/4510 02-Aug-04 10:56</example>
208
+ <example os.product="im3510/4510" system.time="02-Aug-04 10:56">Imagistics im3510/4510 02-Aug-04 10:56</example>
209
209
  <param pos="0" name="os.vendor" value="Oce"/>
210
210
  <param pos="0" name="os.family" value="IM Series"/>
211
211
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -218,9 +218,9 @@
218
218
 
219
219
  <fingerprint pattern="^OKI (C\d+)\S*$">
220
220
  <description>Okidata color printer</description>
221
- <example>OKI C610</example>
222
- <example>OKI C710</example>
223
- <example>OKI C710dn</example>
221
+ <example os.product="C610">OKI C610</example>
222
+ <example os.product="C710">OKI C710</example>
223
+ <example os.product="C710">OKI C710dn</example>
224
224
  <param pos="0" name="os.vendor" value="Okidata"/>
225
225
  <param pos="0" name="os.device" value="Printer"/>
226
226
  <param pos="1" name="os.product"/>
@@ -228,7 +228,7 @@
228
228
 
229
229
  <fingerprint pattern="^OKI (MC\d+)\S*$">
230
230
  <description>Okidata multifunction device</description>
231
- <example>OKI MC860</example>
231
+ <example os.product="MC860">OKI MC860</example>
232
232
  <param pos="0" name="os.vendor" value="Okidata"/>
233
233
  <param pos="0" name="os.device" value="Multifunction Device"/>
234
234
  <param pos="1" name="os.product"/>
@@ -236,10 +236,10 @@
236
236
 
237
237
  <fingerprint pattern="(?i)^RICOH ((?:Aficio|MP|SP) .*)$">
238
238
  <description>Ricoh Aficio Printer</description>
239
- <example>RICOH Aficio 2075</example>
240
- <example>RICOH Aficio AP610N</example>
241
- <example>RICOH Aficio SP 8100DN</example>
242
- <example>RICOH MP C1500/615C</example>
239
+ <example os.product="Aficio 2075">RICOH Aficio 2075</example>
240
+ <example os.product="Aficio AP610N">RICOH Aficio AP610N</example>
241
+ <example os.product="Aficio SP 8100DN">RICOH Aficio SP 8100DN</example>
242
+ <example os.product="MP C1500/615C">RICOH MP C1500/615C</example>
243
243
  <param pos="0" name="os.vendor" value="Ricoh"/>
244
244
  <param pos="0" name="os.family" value="Aficio"/>
245
245
  <param pos="1" name="os.product"/>
@@ -251,14 +251,14 @@
251
251
 
252
252
  <fingerprint pattern="(?i)^NRG ([MS]P \S+)$">
253
253
  <description>Ricoh NRG printer</description>
254
- <example>NRG MP 171</example>
255
- <example>NRG MP 3350</example>
256
- <example>NRG MP C2550</example>
257
- <example>NRG MP C2800</example>
258
- <example>NRG MP C3500</example>
259
- <example>NRG MP C4000</example>
260
- <example>NRG MP C4500</example>
261
- <example>NRG SP C231SF</example>
254
+ <example os.product="MP 171">NRG MP 171</example>
255
+ <example os.product="MP 3350">NRG MP 3350</example>
256
+ <example os.product="MP C2550">NRG MP C2550</example>
257
+ <example os.product="MP C2800">NRG MP C2800</example>
258
+ <example os.product="MP C3500">NRG MP C3500</example>
259
+ <example os.product="MP C4000">NRG MP C4000</example>
260
+ <example os.product="MP C4500">NRG MP C4500</example>
261
+ <example os.product="SP C231SF">NRG SP C231SF</example>
262
262
  <param pos="0" name="os.vendor" value="Ricoh"/>
263
263
  <param pos="0" name="os.device" value="Printer"/>
264
264
  <param pos="1" name="os.product"/>
@@ -269,7 +269,7 @@
269
269
 
270
270
  <fingerprint pattern="(?i)^Gestetner (MP\S+/DSc\S+)$">
271
271
  <description>Ricoh Gestetner multifunction device</description>
272
- <example>Gestetner MPC2500/DSc525</example>
272
+ <example os.product="MPC2500/DSc525">Gestetner MPC2500/DSc525</example>
273
273
  <param pos="0" name="os.vendor" value="Ricoh"/>
274
274
  <param pos="0" name="os.device" value="Multifunction Device"/>
275
275
  <param pos="1" name="os.product"/>
@@ -285,7 +285,7 @@
285
285
 
286
286
  <fingerprint pattern="(?i)^Savin (\S+)$">
287
287
  <description>Savin Printer</description>
288
- <example>SAVIN 4075</example>
288
+ <example os.product="4075">SAVIN 4075</example>
289
289
  <param pos="0" name="os.vendor" value="Savin"/>
290
290
  <param pos="0" name="os.device" value="Printer"/>
291
291
  <param pos="1" name="os.product"/>
@@ -293,8 +293,8 @@
293
293
 
294
294
  <fingerprint pattern="(?i)^Samsung ((?:SCX|CLX)-\S+) Series$">
295
295
  <description>Samsung multifunction device</description>
296
- <example>Samsung SCX-5835_5935 Series</example>
297
- <example>Samsung CLX-4195 Series</example>
296
+ <example os.product="SCX-5835_5935">Samsung SCX-5835_5935 Series</example>
297
+ <example os.product="CLX-4195">Samsung CLX-4195 Series</example>
298
298
  <param pos="0" name="os.vendor" value="Samsung"/>
299
299
  <param pos="0" name="os.device" value="Multifunction Device"/>
300
300
  <param pos="1" name="os.product"/>
@@ -302,8 +302,8 @@
302
302
 
303
303
  <fingerprint pattern="(?i)^Samsung ((?:ML|CLP)-\S+) Series$">
304
304
  <description>Samsung printer</description>
305
- <example>Samsung CLP-680 Series</example>
306
- <example>Samsung ML-5012_5512 Series</example>
305
+ <example os.product="CLP-680">Samsung CLP-680 Series</example>
306
+ <example os.product="ML-5012_5512">Samsung ML-5012_5512 Series</example>
307
307
  <param pos="0" name="os.vendor" value="Samsung"/>
308
308
  <param pos="0" name="os.device" value="Printer"/>
309
309
  <param pos="1" name="os.product"/>
@@ -311,8 +311,8 @@
311
311
 
312
312
  <fingerprint pattern="(?i)^SHARP (\S+-\S+)">
313
313
  <description>Sharp Printer</description>
314
- <example>Sharp MX-NBX3 18-Mar-08 10:22</example>
315
- <example>Sharp AR-P17 24-Mar-04 19:55</example>
314
+ <example os.product="MX-NBX3">Sharp MX-NBX3 18-Mar-08 10:22</example>
315
+ <example os.product="AR-P17">Sharp AR-P17 24-Mar-04 19:55</example>
316
316
  <param pos="0" name="os.vendor" value="Sharp"/>
317
317
  <param pos="0" name="os.device" value="Printer"/>
318
318
  <param pos="1" name="os.product"/>
@@ -320,7 +320,7 @@
320
320
 
321
321
  <fingerprint pattern="(?i)^Source Technologies (\S+)$">
322
322
  <description>Source Technologies Printer</description>
323
- <example>Source Technologies ST-9620</example>
323
+ <example os.product="ST-9620">Source Technologies ST-9620</example>
324
324
  <param pos="0" name="os.vendor" value="Source Technologies"/>
325
325
  <param pos="0" name="os.device" value="Printer"/>
326
326
  <param pos="1" name="os.product"/>
@@ -330,10 +330,10 @@
330
330
 
331
331
  <fingerprint pattern="^TOSHIBA (e-STUDIO\S+)(?:\s+.*)?" certainty="0.9">
332
332
  <description>Toshiba e-STUDIO multifunction device</description>
333
- <example>TOSHIBA e-STUDIO350 V468Z 20061013</example>
334
- <example>TOSHIBA e-STUDIO350-450 V444Z 20041104</example>
335
- <example>TOSHIBA e-STUDIO450 V468Z 20061013</example>
336
- <example>TOSHIBA e-STUDIO500S</example>
333
+ <example os.product="e-STUDIO350">TOSHIBA e-STUDIO350 V468Z 20061013</example>
334
+ <example os.product="e-STUDIO350-450">TOSHIBA e-STUDIO350-450 V444Z 20041104</example>
335
+ <example os.product="e-STUDIO450">TOSHIBA e-STUDIO450 V468Z 20061013</example>
336
+ <example os.product="e-STUDIO500S">TOSHIBA e-STUDIO500S</example>
337
337
  <param pos="0" name="os.vendor" value="Toshiba"/>
338
338
  <param pos="0" name="os.family" value="e-STUDIO"/>
339
339
  <param pos="0" name="os.device" value="Multifunction Device"/>
@@ -351,8 +351,8 @@
351
351
 
352
352
  <fingerprint pattern="^(?:ID=)?Xerox (Phaser \S+)$" certainty="0.9">
353
353
  <description>Xerox Phaser Printer</description>
354
- <example>Xerox Phaser 6180MFP-D</example>
355
- <example>ID=Xerox Phaser 5400</example>
354
+ <example os.product="Phaser 6180MFP-D">Xerox Phaser 6180MFP-D</example>
355
+ <example os.product="Phaser 5400">ID=Xerox Phaser 5400</example>
356
356
  <param pos="0" name="os.vendor" value="Xerox"/>
357
357
  <param pos="0" name="os.family" value="Phaser"/>
358
358
  <param pos="0" name="os.device" value="Printer"/>
@@ -361,9 +361,9 @@
361
361
 
362
362
  <fingerprint pattern="^Xerox (WorkCentre .*)$" certainty="0.9">
363
363
  <description>Xerox Workcentre Printer</description>
364
- <example>Xerox WorkCentre 7425</example>
365
- <example>Xerox WorkCentre Pro 245</example>
366
- <example>Xerox WorkCentre Pro 55, v1 Multifunction System</example>
364
+ <example os.product="WorkCentre 7425">Xerox WorkCentre 7425</example>
365
+ <example os.product="WorkCentre Pro 245">Xerox WorkCentre Pro 245</example>
366
+ <example os.product="WorkCentre Pro 55, v1 Multifunction System">Xerox WorkCentre Pro 55, v1 Multifunction System</example>
367
367
  <param pos="0" name="os.vendor" value="Xerox"/>
368
368
  <param pos="0" name="os.family" value="WorkCentre"/>
369
369
  <param pos="1" name="os.product"/>
@@ -372,7 +372,7 @@
372
372
 
373
373
  <fingerprint pattern="^(XC\S+)$" certainty="0.9">
374
374
  <description>Xerox XC Printer</description>
375
- <example>XC560</example>
375
+ <example os.product="XC560">XC560</example>
376
376
  <param pos="0" name="os.vendor" value="Xerox"/>
377
377
  <param pos="0" name="os.family" value="XC"/>
378
378
  <param pos="0" name="os.device" value="Printer"/>
@@ -381,7 +381,7 @@
381
381
 
382
382
  <fingerprint pattern="^(DC\S+)$" certainty="0.9">
383
383
  <description>Xerox DocuColor Printer</description>
384
- <example>DC250</example>
384
+ <example os.product="DC250">DC250</example>
385
385
  <param pos="0" name="os.vendor" value="Xerox"/>
386
386
  <param pos="0" name="os.family" value="DocuColor"/>
387
387
  <param pos="0" name="os.device" value="Printer"/>
@@ -390,7 +390,7 @@
390
390
 
391
391
  <fingerprint pattern="^(EX\d+-\d+)$" certainty="0.9">
392
392
  <description>Xerox EX Print Server, powered by EFI Fiery</description>
393
- <example>EX4112-4127</example>
393
+ <example os.product="EX4112-4127">EX4112-4127</example>
394
394
  <param pos="0" name="os.vendor" value="Xerox"/>
395
395
  <param pos="0" name="os.family" value="EX"/>
396
396
  <param pos="0" name="os.device" value="Print Server"/>
data/xml/html_title.xml CHANGED
@@ -214,6 +214,17 @@
214
214
  <param pos="0" name="hw.device" value="DVR"/>
215
215
  </fingerprint>
216
216
 
217
+ <!-- Xiongmai Technology is rebranded by a number of DVR and IP Camera manufacturers -->
218
+
219
+ <fingerprint pattern="^NETSurveillance WEB$">
220
+ <description>NetSurveillance web interface on DVR and IP Camera devices sourced from Xiongmai Technology</description>
221
+ <example>NETSurveillance WEB</example>
222
+ <param pos="0" name="service.vendor" value="Xiongmai Technology"/>
223
+ <param pos="0" name="service.product" value="uc-httpd"/>
224
+ <param pos="0" name="service.cpe23" value="cpe:/a:xiongmaitech:uc-httpd:-"/>
225
+ <param pos="0" name="os.vendor" value="Xiongmai Technology"/>
226
+ </fingerprint>
227
+
217
228
  <fingerprint pattern="^FRITZ!Box$">
218
229
  <description>AVM FRITZ!Box</description>
219
230
  <example>FRITZ!Box</example>
@@ -635,8 +646,8 @@
635
646
 
636
647
  <fingerprint pattern="^Wowza Streaming Engine 4 (Subscription|Perpetual Pro) Edition (\d\.[\w.]+) build(\d+)$">
637
648
  <description>Wowza Streaming Engine</description>
638
- <example service.version="4.7.7.01" service.version.version="20190222144406">Wowza Streaming Engine 4 Subscription Edition 4.7.7.01 build20190222144406</example>
639
- <example service.edition="Perpetual Pro">Wowza Streaming Engine 4 Perpetual Pro Edition 4.8.8.01 build20201216140014</example>
649
+ <example service.version="4.7.7.01" service.version.version="20190222144406" service.edition="Subscription">Wowza Streaming Engine 4 Subscription Edition 4.7.7.01 build20190222144406</example>
650
+ <example service.edition="Perpetual Pro" service.version="4.8.8.01" service.version.version="20201216140014">Wowza Streaming Engine 4 Perpetual Pro Edition 4.8.8.01 build20201216140014</example>
640
651
  <param pos="0" name="service.vendor" value="Wowza"/>
641
652
  <param pos="0" name="service.product" value="Streaming Engine"/>
642
653
  <param pos="1" name="service.edition"/>
@@ -673,7 +684,7 @@
673
684
  <param pos="0" name="service.product" value="nginx"/>
674
685
  <param pos="0" name="service.family" value="nginx"/>
675
686
  <param pos="0" name="service.vendor" value="nginx"/>
676
- <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
687
+ <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:-"/>
677
688
  </fingerprint>
678
689
 
679
690
  <fingerprint pattern="^Test Page for the Nginx HTTP Server on (?:Fedora|EPEL)$">
@@ -682,11 +693,11 @@
682
693
  <param pos="0" name="service.product" value="nginx"/>
683
694
  <param pos="0" name="service.family" value="nginx"/>
684
695
  <param pos="0" name="service.vendor" value="nginx"/>
685
- <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
696
+ <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:-"/>
686
697
  <param pos="0" name="os.family" value="Linux"/>
687
- <param pos="0" name="os.vendor" value="Red Hat"/>
688
- <param pos="0" name="os.product" value="Fedora Core Linux"/>
689
- <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:-"/>
698
+ <param pos="0" name="os.vendor" value="Fedora Project"/>
699
+ <param pos="0" name="os.product" value="Fedora Core"/>
700
+ <param pos="0" name="os.cpe23" value="cpe:/o:fedoraproject:fedora_core:-"/>
690
701
  </fingerprint>
691
702
 
692
703
  <fingerprint pattern="^Welcome to nginx on Debian!$">
@@ -695,7 +706,7 @@
695
706
  <param pos="0" name="service.product" value="nginx"/>
696
707
  <param pos="0" name="service.family" value="nginx"/>
697
708
  <param pos="0" name="service.vendor" value="nginx"/>
698
- <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
709
+ <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:-"/>
699
710
  <param pos="0" name="os.vendor" value="Debian"/>
700
711
  <param pos="0" name="os.product" value="Linux"/>
701
712
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
@@ -1367,6 +1378,7 @@
1367
1378
  <param pos="0" name="os.device" value="Switch"/>
1368
1379
  <param pos="0" name="os.product" value="MDS 9000"/>
1369
1380
  <param pos="1" name="os.version"/>
1381
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:mds_9000_san-os:{os.version}"/>
1370
1382
  </fingerprint>
1371
1383
 
1372
1384
  <fingerprint pattern="^Stealthwatch Management Console$">
@@ -3112,7 +3124,7 @@
3112
3124
  <example>Log In - Confluence</example>
3113
3125
  <param pos="0" name="service.vendor" value="Atlassian"/>
3114
3126
  <param pos="0" name="service.product" value="Confluence"/>
3115
- <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence:-"/>
3127
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:confluence_server:-"/>
3116
3128
  </fingerprint>
3117
3129
 
3118
3130
  <fingerprint pattern="^System Dashboard - ">
@@ -3724,4 +3736,161 @@
3724
3736
  <param pos="0" name="hw.product" value="Eternus"/>
3725
3737
  </fingerprint>
3726
3738
 
3739
+ <fingerprint pattern="^Covenant - Login$">
3740
+ <description>Covenant .NET C2 framework</description>
3741
+ <example>Covenant - Login</example>
3742
+ <param pos="0" name="service.product" value="Covenant"/>
3743
+ </fingerprint>
3744
+
3745
+ <fingerprint pattern="^Login \| CALDERA$">
3746
+ <description>MITRE CALDERA C2 framework</description>
3747
+ <example>Login | CALDERA</example>
3748
+ <param pos="0" name="service.vendor" value="MITRE"/>
3749
+ <param pos="0" name="service.product" value="CALDERA"/>
3750
+ <param pos="0" name="service.cpe23" value="cpe:/a:mitre:caldera:-"/>
3751
+ </fingerprint>
3752
+
3753
+ <fingerprint pattern="(?:(\S{1,512}):\d{1,5} / \S{1,512} \| )?phpMyAdmin(?: ([\d.]+(?:-[a-zA-Z0-9]+)?(?:\+\d{8}\.[a-f0-9]{4,40})?))?">
3754
+ <description>phpMyAdmin web interface for MySQL and MariaDB</description>
3755
+ <example>phpMyAdmin</example>
3756
+ <example service.version="2.10.0.2">phpMyAdmin 2.10.0.2</example>
3757
+ <example service.version="5.0.0-rc1">phpMyAdmin 5.0.0-rc1</example>
3758
+ <example service.version="5.3.0-dev">phpMyAdmin 5.3.0-dev</example>
3759
+ <example host.name="10.10.10.10" service.version="5.0.4">10.10.10.10:8080 / db.foo.bar | phpMyAdmin 5.0.4</example>
3760
+ <example host.name="localhost" service.version="5.3.0-dev+20220208.47252f9cf8">localhost:8080 / mysql-server | phpMyAdmin 5.3.0-dev+20220208.47252f9cf8</example>
3761
+ <example host.name="[::ffff:10.10.10.10]" service.version="5.3.0-dev+20220208.47252f9cf8">[::ffff:10.10.10.10]:8080 / mysql-server | phpMyAdmin 5.3.0-dev+20220208.47252f9cf8</example>
3762
+ <param pos="0" name="service.vendor" value="phpMyAdmin"/>
3763
+ <param pos="0" name="service.product" value="phpMyAdmin"/>
3764
+ <param pos="1" name="host.name"/>
3765
+ <param pos="2" name="service.version"/>
3766
+ <param pos="0" name="service.cpe23" value="cpe:/a:phpmyadmin:phpmyadmin:{service.version}"/>
3767
+ </fingerprint>
3768
+
3769
+ <fingerprint pattern="^Login - Adminer$">
3770
+ <description>Adminer database management tool</description>
3771
+ <example>Login - Adminer</example>
3772
+ <param pos="0" name="service.vendor" value="Adminer"/>
3773
+ <param pos="0" name="service.product" value="Adminer"/>
3774
+ <param pos="0" name="service.cpe23" value="cpe:/a:adminer:adminer:-"/>
3775
+ </fingerprint>
3776
+
3777
+ <fingerprint pattern="^Home - Mongo Express$">
3778
+ <description>mongo-express web-based MongoDB admin interface</description>
3779
+ <example>Home - Mongo Express</example>
3780
+ <param pos="0" name="service.vendor" value="mongo-express Project"/>
3781
+ <param pos="0" name="service.product" value="mongo-express"/>
3782
+ <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
3783
+ </fingerprint>
3784
+
3785
+ <fingerprint pattern="^Solr Admin$">
3786
+ <description>Apache Solr</description>
3787
+ <example>Solr Admin</example>
3788
+ <param pos="0" name="service.vendor" value="Apache"/>
3789
+ <param pos="0" name="service.product" value="Solr"/>
3790
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:solr:-"/>
3791
+ </fingerprint>
3792
+
3793
+ <fingerprint pattern="^Spark (?:Master|Worker) at (?:spark:\/\/)?(\S{1,512}):\d{1,5}$">
3794
+ <description>Apache Spark</description>
3795
+ <example host.name="spark-master-0.foo.bar">Spark Master at spark://spark-master-0.foo.bar:7077</example>
3796
+ <example host.name="10.10.10.10">Spark Master at spark://10.10.10.10:7077</example>
3797
+ <example host.name="10.10.10.10">Spark Worker at 10.10.10.10:45339</example>
3798
+ <param pos="0" name="service.vendor" value="Apache"/>
3799
+ <param pos="0" name="service.product" value="Spark"/>
3800
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:spark:-"/>
3801
+ <param pos="1" name="host.name"/>
3802
+ </fingerprint>
3803
+
3804
+ <fingerprint pattern="^pfSense - Login$">
3805
+ <description>pfSense Firewall</description>
3806
+ <example>pfSense - Login</example>
3807
+ <param pos="0" name="service.vendor" value="pfSense"/>
3808
+ <param pos="0" name="service.product" value="pfSense"/>
3809
+ <param pos="0" name="service.device" value="Firewall"/>
3810
+ <param pos="0" name="service.cpe23" value="cpe:/a:pfsense:pfsense:-"/>
3811
+ <param pos="0" name="service.component.vendor" value="nginx"/>
3812
+ <param pos="0" name="service.component.product" value="nginx"/>
3813
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:f5:nginx:-"/>
3814
+ <param pos="0" name="os.vendor" value="pfSense"/>
3815
+ <param pos="0" name="os.product" value="FreeBSD"/>
3816
+ </fingerprint>
3817
+
3818
+ <fingerprint pattern="^Netgate pfSense Plus - Login$">
3819
+ <description>pfSense Plus Firewall</description>
3820
+ <example>Netgate pfSense Plus - Login</example>
3821
+ <param pos="0" name="service.vendor" value="Netgate"/>
3822
+ <param pos="0" name="service.product" value="pfSense"/>
3823
+ <param pos="0" name="service.device" value="Firewall"/>
3824
+ <param pos="0" name="service.cpe23" value="cpe:/a:netgate:pfsense:-"/>
3825
+ <param pos="0" name="service.component.vendor" value="nginx"/>
3826
+ <param pos="0" name="service.component.product" value="nginx"/>
3827
+ <param pos="0" name="service.component.cpe23" value="cpe:/a:f5:nginx:-"/>
3828
+ <param pos="0" name="os.vendor" value="pfSense"/>
3829
+ <param pos="0" name="os.product" value="FreeBSD"/>
3830
+ </fingerprint>
3831
+
3832
+ <fingerprint pattern="^Vigor Login Page$">
3833
+ <description>DrayTek Vigor network equipment - without model or version</description>
3834
+ <example>Vigor Login Page</example>
3835
+ <param pos="0" name="os.vendor" value="DrayTek"/>
3836
+ <param pos="0" name="os.family" value="Vigor"/>
3837
+ <param pos="0" name="hw.vendor" value="DrayTek"/>
3838
+ <param pos="0" name="hw.family" value="Vigor"/>
3839
+ </fingerprint>
3840
+
3841
+ <!-- Specific Eltex fingerprints to enable CPE generation -->
3842
+
3843
+ <fingerprint pattern="^Eltex - NTP-RG-1402G$">
3844
+ <description>Eltex - NTP-RG-1402G broadband router</description>
3845
+ <example>Eltex - NTP-RG-1402G</example>
3846
+ <param pos="0" name="os.vendor" value="Eltex"/>
3847
+ <param pos="0" name="os.product" value="NTP-RG-1402G Firmware"/>
3848
+ <param pos="0" name="os.device" value="Broadband Router"/>
3849
+ <param pos="0" name="os.cpe23" value="cpe:/o:eltex-co:ntp-rg-1402g_firmware:-"/>
3850
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3851
+ <param pos="0" name="hw.product" value="NTP-RG-1402G"/>
3852
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3853
+ <param pos="0" name="hw.cpe23" value="cpe:/h:eltex-co:ntp-rg-1402g:-"/>
3854
+ </fingerprint>
3855
+
3856
+ <fingerprint pattern="^Eltex - NTP-2$">
3857
+ <description>Eltex - NTP-2 broadband router</description>
3858
+ <example>Eltex - NTP-2</example>
3859
+ <param pos="0" name="os.vendor" value="Eltex"/>
3860
+ <param pos="0" name="os.product" value="NTP-2 Firmware"/>
3861
+ <param pos="0" name="os.device" value="Broadband Router"/>
3862
+ <param pos="0" name="os.cpe23" value="cpe:/o:eltex-co:ntp-2_firmware:-"/>
3863
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3864
+ <param pos="0" name="hw.product" value="NTP-2"/>
3865
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3866
+ <param pos="0" name="hw.cpe23" value="cpe:/h:eltex-co:ntp-2:-"/>
3867
+ </fingerprint>
3868
+
3869
+ <!-- General Eltex fingerprints -->
3870
+
3871
+ <fingerprint pattern="^Eltex - (NT[PU]-RG-\d[\w-]+):?(:?rev\.\w\w?)?$">
3872
+ <description>Eltex RG model ONT class broadband router</description>
3873
+ <example hw.product="NTU-RG-1402G-W">Eltex - NTU-RG-1402G-W</example>
3874
+ <example hw.product="NTU-RG-1421G-Wac" hw.version="rev.A1">Eltex - NTU-RG-1421G-Wac:rev.A1</example>
3875
+ <example hw.product="NTP-RG-1402G-W" hw.version="rev.C">Eltex - NTP-RG-1402G-W:rev.C</example>
3876
+ <param pos="0" name="os.vendor" value="Eltex"/>
3877
+ <param pos="0" name="os.device" value="Broadband Router"/>
3878
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3879
+ <param pos="1" name="hw.product"/>
3880
+ <param pos="2" name="hw.version"/>
3881
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3882
+ </fingerprint>
3883
+
3884
+ <fingerprint pattern="^Eltex - (NT[PU]-2\w\w?)$">
3885
+ <description>Eltex - NTP / NTU model broadband router</description>
3886
+ <example hw.product="NTU-2V">Eltex - NTU-2V</example>
3887
+ <example hw.product="NTU-2VC">Eltex - NTU-2VC</example>
3888
+ <example hw.product="NTP-2C">Eltex - NTP-2C</example>
3889
+ <param pos="0" name="os.vendor" value="Eltex"/>
3890
+ <param pos="0" name="os.device" value="Broadband Router"/>
3891
+ <param pos="0" name="hw.vendor" value="Eltex"/>
3892
+ <param pos="1" name="hw.product"/>
3893
+ <param pos="0" name="hw.device" value="Broadband Router"/>
3894
+ </fingerprint>
3895
+
3727
3896
  </fingerprints>