recog 2.3.22 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/http_cookies.xml CHANGED
@@ -79,17 +79,31 @@
79
79
 
80
80
  <fingerprint pattern="^ANsession\d+=(\S+);">
81
81
  <description>Array Networks Secure Access Gateway / SSL VPN</description>
82
- <example>ANsession0002262072457555=IPMI; path=/;secure</example>
82
+ <example cookie="IPMI">ANsession0002262072457555=IPMI; path=/;secure</example>
83
83
  <param pos="1" name="cookie"/>
84
84
  <param pos="0" name="service.vendor" value="Array Networks"/>
85
85
  <param pos="0" name="service.family" value="Secure Access Gateway"/>
86
86
  <param pos="0" name="hw.device" value="VPN"/>
87
87
  </fingerprint>
88
88
 
89
- <fingerprint pattern="^(Apache)=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]+);">
90
- <description>Apache</description>
91
- <param pos="1" name="cookie"/>
92
- <param pos="2" name="system.time.micros"/>
89
+ <fingerprint pattern="^Apache=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\.[0-9]+(?:\.[0-9]+)?;">
90
+ <description>Apache with session ID containing IP and timestamp (timestamp can be micros, millis or seconds)</description>
91
+ <example host.ip="10.10.130.165">Apache=10.10.130.165.1643670182768255; path=/</example>
92
+ <example host.ip="10.0.101.6">Apache=10.0.101.6.1643663969718158; path=/; expires=Wed, 31-Jan-24 21:19:29 GMT; domain=.contoso.com</example>
93
+ <example host.ip="10.10.20.18">Apache=10.10.20.18.1643510579.1915; domain=foo.com; path=/; expires=Mon, 30-Jan-2023 02:42:58 GMT</example>
94
+ <example host.ip="10.23.219.241">Apache=10.23.219.241.1643541709604; path=/; expires=Tue, 19-Jan-2038 03:14:07 GMT</example>
95
+ <param pos="0" name="cookie" value="Apache"/>
96
+ <param pos="1" name="host.ip"/>
97
+ <param pos="0" name="service.vendor" value="Apache"/>
98
+ <param pos="0" name="service.family" value="Apache"/>
99
+ <param pos="0" name="service.product" value="HTTPD"/>
100
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:http_server:-"/>
101
+ </fingerprint>
102
+
103
+ <fingerprint pattern="^Apache=[0-9a-z]{8}\.[0-9a-z]{13};">
104
+ <description>Apache with opaque session ID</description>
105
+ <example>Apache=1148b9c3.5d6e61e36f2f9; path=/; domain=.foo.com</example>
106
+ <param pos="0" name="cookie" value="Apache"/>
93
107
  <param pos="0" name="service.vendor" value="Apache"/>
94
108
  <param pos="0" name="service.family" value="Apache"/>
95
109
  <param pos="0" name="service.product" value="HTTPD"/>
@@ -123,27 +137,20 @@
123
137
  <param pos="0" name="service.cpe23" value="cpe:/a:mozilla:bugzilla:-"/>
124
138
  </fingerprint>
125
139
 
126
- <fingerprint pattern="^(WebLogicSession)=[^!]+![^!]+!([0-9]+);">
127
- <description>BEA WebLogic (with timestamp)</description>
128
- <param pos="1" name="cookie"/>
129
- <param pos="2" name="system.time.millis"/>
130
- <param pos="0" name="service.vendor" value="BEA"/>
131
- <param pos="0" name="service.family" value="WebLogic"/>
132
- <param pos="0" name="service.product" value="WebLogic"/>
133
- <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
134
- </fingerprint>
135
-
136
- <fingerprint pattern="^(WebLogicSession)=">
140
+ <fingerprint pattern="^WebLogicSession=">
137
141
  <description>BEA WebLogic (no timestamp)</description>
138
- <param pos="1" name="cookie"/>
142
+ <example>WebLogicSession=YfifY2Ck8aWILbJPiaoY3L8aKBjh2MZhUAjHXypG6IBwvWXrun3i|-3385140432258369694/-900104935/6/7009/7009/7010/7010/7009/-1; path=/</example>
143
+ <example>WebLogicSession=QKRlJZbj0b948CrXnoQw8FNuSWvO6fXaJNadlcCWwA3qm6CtqD5a; path=/</example>
144
+ <param pos="0" name="cookie" value="WebLogicSession"/>
139
145
  <param pos="0" name="service.vendor" value="BEA"/>
140
146
  <param pos="0" name="service.family" value="WebLogic"/>
141
147
  <param pos="0" name="service.product" value="WebLogic"/>
142
148
  <param pos="0" name="service.cpe23" value="cpe:/a:bea:weblogic_server:-"/>
143
149
  </fingerprint>
144
150
 
145
- <fingerprint pattern="^(BCSI-CSC[0-9A-Za-z]+)=">
151
+ <fingerprint pattern="^(BCSI-CS-[0-9A-Za-z]+)=">
146
152
  <description>BlueCoat Proxy</description>
153
+ <example cookie="BCSI-CS-2f6c78bdf64f3b32">BCSI-CS-2f6c78bdf64f3b32=2; Path=/</example>
147
154
  <param pos="1" name="cookie"/>
148
155
  <param pos="0" name="service.vendor" value="Blue Coat"/>
149
156
  <param pos="0" name="service.family" value="Proxy"/>
@@ -208,6 +215,7 @@
208
215
 
209
216
  <fingerprint pattern="^st8id=">
210
217
  <description>Citrix Application Protection System, Enterprise - http://support.citrix.com/article/CTX109330</description>
218
+ <example>st8id=1e1bcc1010b6de32734c584317443b31.00.641b86ac5ed3ebb0799138f83af9b63f;</example>
211
219
  <param pos="0" name="cookie" value="st8id"/>
212
220
  <param pos="0" name="service.vendor" value="Citrix"/>
213
221
  <param pos="0" name="service.family" value="Application Protection System"/>
@@ -271,7 +279,7 @@
271
279
 
272
280
  <fingerprint pattern="(?i)^(BIGipServer([^=]+))=">
273
281
  <description>F5 BIG-IP LTM - Server variant</description>
274
- <example loadbalancer.poolname="CustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
282
+ <example loadbalancer.poolname="CustomerRP" cookie="BigIpServerCustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
275
283
  <param pos="1" name="cookie"/>
276
284
  <param pos="2" name="loadbalancer.poolname"/>
277
285
  <param pos="0" name="service.vendor" value="F5"/>
@@ -365,6 +373,9 @@
365
373
 
366
374
  <fingerprint pattern="^IBMCBR=">
367
375
  <description>IBM WebSphere Load Balancer</description>
376
+ <!-- Replace with a valid example if one is discovered -->
377
+
378
+ <example>IBMCBR=fakevalue</example>
368
379
  <param pos="0" name="cookie" value="IBMCBR"/>
369
380
  <param pos="0" name="service.vendor" value="IBM"/>
370
381
  <param pos="0" name="service.family" value="WebSphere"/>
@@ -382,12 +393,14 @@
382
393
 
383
394
  <fingerprint pattern="^_mastodon_session=">
384
395
  <description>Mastodon</description>
396
+ <example>_mastodon_session=U09wSzlaMHNuZVI3RGJjR1M2d2lqNFhXc1BXNlJtOXBueTdoM1J2Ykk3UjRXa2V3WkNUNm5BUmY4Z0NISk9FaEtrOVQrMXJCRldvbk1kY3BUaDZkMlRuZkNBUDVXU01EakN3S1JEZDdjbzhNQ0t5MHpXZE9WSGlTOVhKNkhlZWhlaWsxM3Mvd0poU1NHWkZjWUNucmJoeDdNdU85ekpkQVJSbkhDeXdKZ08wMkNuUm1BYnE3cGVBK2FBN1FTUU9SLS1EdUVoNWtLOFFWaWsxNmY2bzErbFVRPT0%3D--4b6087906fdfa25f0bfd46b13d3c1c3a9fb379cd; path=/; secure; HttpOnly</example>
385
397
  <param pos="0" name="cookie" value="_mastodon_session"/>
386
398
  <param pos="0" name="service.product" value="Mastodon"/>
387
399
  </fingerprint>
388
400
 
389
401
  <fingerprint pattern="^(MSCSAuth|MSCSProfile)=">
390
402
  <description>Microsoft Commerce Server - http://msdn2.microsoft.com/en-us/library/ms953828.aspx</description>
403
+ <example cookie="MSCSProfile">MSCSProfile=287001FD2674671C7869448243193407F294F4F921DD7D627A0F4EE0CC7F3FAC36B5E45588612D30B2A6C57F1D461CB5EE0887989EE7F09E4529B0795EF87BB095FFF1DE42BD5E8F00273BCAACB9DC80733367D09A4B6A48A6802C4DCD6EB029BF5B207BCE523E8BF2EE3EBCDF5776BAC6B6BCD4BF54EF9C178F9605E75D0DDA; path=/</example>
391
404
  <param pos="1" name="cookie"/>
392
405
  <param pos="0" name="service.vendor" value="Microsoft"/>
393
406
  <param pos="0" name="service.family" value="Commerce Server"/>
@@ -399,7 +412,7 @@
399
412
  <description>Nextcloud</description>
400
413
  <example cookie="nc_sameSiteCookiestrict">nc_sameSiteCookiestrict=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict</example>
401
414
  <example cookie="nc_sameSiteCookielax">nc_sameSiteCookielax=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax</example>
402
- <example>oc_sessionPassphrase=Y%2BZjBn8Gn%2B8jIJPVx468Tlt8qDNm%2B5IVXLxgtwlY%2BQU2T7edVmDS4091nQrT; path=/nextcloud; secure; HttpOnly</example>
415
+ <example cookie="oc_sessionPassphrase">oc_sessionPassphrase=Y%2BZjBn8Gn%2B8jIJPVx468Tlt8qDNm%2B5IVXLxgtwlY%2BQU2T7edVmDS4091nQrT; path=/nextcloud; secure; HttpOnly</example>
403
416
  <param pos="1" name="cookie"/>
404
417
  <param pos="0" name="service.vendor" value="Nextcloud"/>
405
418
  <param pos="0" name="service.product" value="Nextcloud Server"/>
@@ -426,6 +439,8 @@
426
439
 
427
440
  <fingerprint pattern="^((?:SS_X_)?CSINTERSESSIONID)=">
428
441
  <description>OpenMarket/FatWire Content Server (www.fatwire.com)</description>
442
+ <example cookie="SS_X_CSINTERSESSIONID">SS_X_CSINTERSESSIONID=0001P73k2FUEYEU4Ks5TtKxcs2K:vv0b9pej; path=/</example>
443
+ <example cookie="CSINTERSESSIONID">CSINTERSESSIONID=0001xquPwAx2NFUFvi7yw-43f35:vv7sdeqs;Path=/</example>
429
444
  <param pos="1" name="cookie"/>
430
445
  <param pos="0" name="service.vendor" value="FatWire"/>
431
446
  <param pos="0" name="service.family" value="Content Server"/>
@@ -434,6 +449,7 @@
434
449
 
435
450
  <fingerprint pattern="^parkinglot=">
436
451
  <description>Oversee Webserver</description>
452
+ <example>parkinglot=1; domain=.foo.com; path=/; expires=Sun, 11-May-2008 13:51:17 GMT</example>
437
453
  <param pos="0" name="cookie" value="parkinglot"/>
438
454
  <param pos="0" name="service.vendor" value="Oversee"/>
439
455
  <param pos="0" name="service.family" value="Webserver"/>
@@ -491,6 +507,7 @@
491
507
 
492
508
  <fingerprint pattern="^NSES40Session=">
493
509
  <description>Netscape Enterprise Server (subsequently iPlanet Web Server, Sun ONE Web Server, presently Sun Java System Web Server)</description>
510
+ <example>NSES40Session=2%253A3e57d375%253Adc59172283a7e72c;path=/;expires=Sat, 22-Feb-2003 20:15:57 GMT</example>
494
511
  <param pos="0" name="cookie" value="NSES40Session"/>
495
512
  <param pos="0" name="service.vendor" value="Sun"/>
496
513
  <param pos="0" name="service.family" value="Java System Web Server"/>
@@ -517,8 +534,10 @@
517
534
  <param pos="0" name="service.product" value="Sage X3 Syracuse Web Server"/>
518
535
  </fingerprint>
519
536
 
520
- <fingerprint pattern="^(gx_session_id|JROUTE)=">
537
+ <fingerprint pattern="^(GX_SESSION_ID|JROUTE)=">
521
538
  <description>Sun Java System Application Server (formerly iPlanet Application Server, Sun ONE Application Server)</description>
539
+ <example cookie="GX_SESSION_ID">GX_SESSION_ID=ji7vouPhPt5CAtGF%2BWPMXBrhjjxWZAD9HRNeEEITGCA%3D</example>
540
+ <example cookie="JROUTE">JROUTE=KbDs; Path=/</example>
522
541
  <param pos="1" name="cookie"/>
523
542
  <param pos="0" name="service.vendor" value="Sun"/>
524
543
  <param pos="0" name="service.family" value="Java System Application Server"/>
@@ -565,6 +584,7 @@
565
584
 
566
585
  <fingerprint pattern="^(vgncontext|vgnvisitor|ssuid)=">
567
586
  <description>Vignette</description>
587
+ <example cookie="vgnvisitor">vgnvisitor=2KM2OM00bZ40000PovANt0Dgn0; path=/; expires=Saturday, 06-Sep-2014 23:50:08 GMT</example>
568
588
  <param pos="1" name="cookie"/>
569
589
  <param pos="0" name="service.vendor" value="Vignette"/>
570
590
  <param pos="0" name="service.family" value="Vignette"/>
@@ -607,10 +627,11 @@
607
627
  <param pos="0" name="service.product" value="Zope"/>
608
628
  </fingerprint>
609
629
 
610
- <fingerprint pattern="^(portal)=([0-9]+\.[0-9]+\.[0-9]+)">
630
+ <fingerprint pattern="^portal=([0-9]+\.[0-9]+\.[0-9]+)">
611
631
  <description>OracleAS Portal default cookie name - http://download.oracle.com/docs/cd/B14099_19/portal.1014/b19305/cg_app_f.htm</description>
612
- <param pos="1" name="cookie"/>
613
- <param pos="2" name="service.version"/>
632
+ <example service.version="2173348032.20480.0000">portal=2173348032.20480.0000;</example>
633
+ <param pos="0" name="cookie" value="portal"/>
634
+ <param pos="1" name="service.version"/>
614
635
  <param pos="0" name="service.vendor" value="Oracle"/>
615
636
  <param pos="0" name="service.family" value="OracleAS"/>
616
637
  <param pos="0" name="service.product" value="Application Server Portal"/>
@@ -650,6 +671,32 @@
650
671
  <param pos="0" name="service.certainty" value="0.5"/>
651
672
  </fingerprint>
652
673
 
674
+ <fingerprint pattern="^phpMyAdmin=">
675
+ <description>phpMyAdmin web interface for MySQL and MariaDB</description>
676
+ <example>phpMyAdmin=28600e9ff9772c871dacec70f9c5edaa; path=/; HttpOnly</example>
677
+ <param pos="0" name="service.vendor" value="phpMyAdmin"/>
678
+ <param pos="0" name="service.product" value="phpMyAdmin"/>
679
+ <param pos="0" name="service.cpe23" value="cpe:/a:phpmyadmin:phpmyadmin:-"/>
680
+ </fingerprint>
681
+
682
+ <fingerprint pattern="^(adminer_(?:sid|key))=">
683
+ <description>Adminer database management tool</description>
684
+ <example cookie="adminer_sid">adminer_sid=6580f6449f9572f817ec99600bc619d2; path=/; HttpOnly</example>
685
+ <example cookie="adminer_key">adminer_key=b8eebd6de0deabc8b30c26a67e01c5b9; path=/; HttpOnly; SameSite=lax</example>
686
+ <param pos="1" name="cookie"/>
687
+ <param pos="0" name="service.vendor" value="Adminer"/>
688
+ <param pos="0" name="service.product" value="Adminer"/>
689
+ <param pos="0" name="service.cpe23" value="cpe:/a:adminer:adminer:-"/>
690
+ </fingerprint>
691
+
692
+ <fingerprint pattern="^mongo-express=">
693
+ <description>mongo-express web-based MongoDB admin interface</description>
694
+ <example>mongo-express=s%3A1qAVXDHaoFE5J0G4wkYKfyjuv6_0Zd9E.l2DGc0YAb7MJQfUleYVEla5i79pbkhDYVayvCEPFCDc; Path=/; HttpOnly</example>
695
+ <param pos="0" name="service.vendor" value="mongo-express Project"/>
696
+ <param pos="0" name="service.product" value="mongo-express"/>
697
+ <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
698
+ </fingerprint>
699
+
653
700
  <!--
654
701
  Ignore various cookies that are very generic cookies for session IDs
655
702
  that are not necessarily indicative of any particular
@@ -659,23 +706,32 @@
659
706
  -->
660
707
 
661
708
  <fingerprint pattern="(?i)^JSESSIONID(?:\.[^=]+)?=[^;]+;">
662
- <description>Ignore simple JSESSIONID and related cookies</description>
709
+ <description>Ignore simple JSESSIONID and related cookies -- assert nothing</description>
663
710
  <example>JSESSIONID=6ooov35i4l3n36qtaf8csvg0;Path=/</example>
664
711
  <example>jsessionid=6nkp66iogcdc92720%2Dc6e4%2D4989%2Db7b2%2D5021624cfdff;Path=/;secure</example>
665
712
  <example>JSESSIONID.c00a9623=v216643eijh19p9duve5srgf;Path=/;HttpOnly</example>
713
+ <param pos="0" name="hw.certainty" value="0.0"/>
714
+ <param pos="0" name="os.certainty" value="0.0"/>
715
+ <param pos="0" name="service.certainty" value="0.0"/>
666
716
  </fingerprint>
667
717
 
668
718
  <fingerprint pattern="(?i)^_?SESSION_?ID\s*=\s*[^;]+;">
669
- <description>Ignore simple SESSIONID and related cookies</description>
719
+ <description>Ignore simple SESSIONID and related cookies -- assert nothing</description>
670
720
  <example>sessionId=7dba3249cfcd4b59854055311099a294; path=/;</example>
671
721
  <example>_session_id=7fe933db0fea13e9c872103ba2d142db; path=/; HttpOnly</example>
672
722
  <example>sessionId =0VrS6Ro6uC5QPXKgNdqGvyUgUFtUOVwv6OWAEWcWQ3jLRtAk2TVAgAApN9yTWVz;postId=; path=/;</example>
673
723
  <example>_session_id=18b3e173aa11db0533fd01752e81f583; path=/; HttpOnly</example>
724
+ <param pos="0" name="hw.certainty" value="0.0"/>
725
+ <param pos="0" name="os.certainty" value="0.0"/>
726
+ <param pos="0" name="service.certainty" value="0.0"/>
674
727
  </fingerprint>
675
728
 
676
729
  <fingerprint pattern="(?i)^sid=[^;]+;">
677
- <description>Ignore simple SID and related cookies</description>
730
+ <description>Ignore simple SID and related cookies -- assert nothing</description>
678
731
  <example>sid=sfd10bf73-654458f687aa3c68b3874915f651e0ca;path=/;"</example>
732
+ <param pos="0" name="hw.certainty" value="0.0"/>
733
+ <param pos="0" name="os.certainty" value="0.0"/>
734
+ <param pos="0" name="service.certainty" value="0.0"/>
679
735
  </fingerprint>
680
736
 
681
737
  </fingerprints>