recog 2.3.5 → 2.3.10

Sign up to get free protection for your applications and to get access to all the features.
Files changed (86) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +17 -5
  3. data/.ruby-gemset +1 -0
  4. data/.ruby-version +1 -0
  5. data/.travis.yml +7 -4
  6. data/CONTRIBUTING.md +136 -37
  7. data/Gemfile +2 -5
  8. data/README.md +34 -29
  9. data/bin/recog_cleanup +16 -0
  10. data/bin/recog_standardize +142 -0
  11. data/cpe-remap.yaml +21 -0
  12. data/features/data/successful_tests.xml +1 -1
  13. data/features/data/tests_with_warnings.xml +1 -1
  14. data/features/match.feature +4 -0
  15. data/features/support/aruba.rb +3 -0
  16. data/features/verify.feature +8 -4
  17. data/identifiers/README.md +56 -0
  18. data/identifiers/hw_device.txt +77 -0
  19. data/identifiers/hw_family.txt +96 -0
  20. data/identifiers/hw_product.txt +328 -0
  21. data/identifiers/os_architecture.txt +20 -0
  22. data/identifiers/os_device.txt +94 -0
  23. data/identifiers/os_family.txt +325 -0
  24. data/identifiers/os_product.txt +420 -0
  25. data/identifiers/service_family.txt +272 -0
  26. data/identifiers/service_product.txt +556 -0
  27. data/identifiers/software_class.txt +26 -0
  28. data/identifiers/software_family.txt +91 -0
  29. data/identifiers/software_product.txt +333 -0
  30. data/identifiers/vendor.txt +890 -0
  31. data/lib/recog/fingerprint.rb +46 -0
  32. data/lib/recog/version.rb +1 -1
  33. data/requirements.txt +1 -1
  34. data/spec/data/verification_fingerprints.xml +86 -0
  35. data/spec/lib/fingerprint_self_test_spec.rb +1 -1
  36. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +1 -1
  37. data/spec/lib/recog/fingerprint_spec.rb +89 -0
  38. data/update_cpes.py +1 -1
  39. data/xml/apache_modules.xml +292 -5
  40. data/xml/apache_os.xml +50 -2
  41. data/xml/architecture.xml +19 -7
  42. data/xml/dns_versionbind.xml +113 -11
  43. data/xml/favicons.xml +1700 -0
  44. data/xml/ftp_banners.xml +287 -15
  45. data/xml/h323_callresp.xml +112 -12
  46. data/xml/hp_pjl_id.xml +47 -5
  47. data/xml/html_title.xml +2371 -17
  48. data/xml/http_cookies.xml +82 -7
  49. data/xml/http_servers.xml +839 -41
  50. data/xml/http_wwwauth.xml +154 -27
  51. data/xml/imap_banners.xml +19 -13
  52. data/xml/ldap_searchresult.xml +81 -9
  53. data/xml/mdns_device-info_txt.xml +194 -17
  54. data/xml/mdns_workstation_txt.xml +4 -2
  55. data/xml/mysql_banners.xml +554 -45
  56. data/xml/mysql_error.xml +113 -6
  57. data/xml/nntp_banners.xml +10 -2
  58. data/xml/ntp_banners.xml +95 -11
  59. data/xml/operating_system.xml +90 -3
  60. data/xml/pop_banners.xml +30 -31
  61. data/xml/rsh_resp.xml +11 -2
  62. data/xml/rtsp_servers.xml +96 -0
  63. data/xml/sip_banners.xml +192 -17
  64. data/xml/sip_user_agents.xml +69 -3
  65. data/xml/smb_native_lm.xml +10 -2
  66. data/xml/smb_native_os.xml +80 -2
  67. data/xml/smtp_banners.xml +166 -9
  68. data/xml/smtp_debug.xml +6 -4
  69. data/xml/smtp_ehlo.xml +7 -5
  70. data/xml/smtp_expn.xml +13 -4
  71. data/xml/smtp_help.xml +23 -4
  72. data/xml/smtp_mailfrom.xml +5 -2
  73. data/xml/smtp_noop.xml +6 -5
  74. data/xml/smtp_quit.xml +5 -4
  75. data/xml/smtp_rcptto.xml +5 -2
  76. data/xml/smtp_rset.xml +4 -4
  77. data/xml/smtp_turn.xml +4 -4
  78. data/xml/smtp_vrfy.xml +14 -4
  79. data/xml/snmp_sysdescr.xml +862 -122
  80. data/xml/snmp_sysobjid.xml +47 -2
  81. data/xml/ssh_banners.xml +1153 -192
  82. data/xml/telnet_banners.xml +419 -14
  83. data/xml/x11_banners.xml +27 -4
  84. data/xml/x509_issuers.xml +39 -15
  85. data/xml/x509_subjects.xml +545 -64
  86. metadata +32 -6
data/xml/http_wwwauth.xml CHANGED
@@ -1,6 +1,7 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="http_header.wwwauth" protocol="http" database_type="service" preference="0.85">
3
3
  <!-- HTTP WWW-Authenticate headers are matched against these patterns to fingerprint HTTP servers. -->
4
+
4
5
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;access&quot;$">
5
6
  <description>Cisco IOS 11.x</description>
6
7
  <example>Basic realm="access"</example>
@@ -18,6 +19,7 @@
18
19
  <param pos="0" name="hw.vendor" value="Cisco"/>
19
20
  <param pos="0" name="hw.device" value="Router"/>
20
21
  </fingerprint>
22
+
21
23
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]15[ _]or[ _]view[ _]access&quot;$">
22
24
  <description>Cisco IOS 12.x - view access variant</description>
23
25
  <example>Basic realm="level_15 or view_access"</example>
@@ -36,6 +38,7 @@
36
38
  <param pos="0" name="hw.vendor" value="Cisco"/>
37
39
  <param pos="0" name="hw.device" value="Router"/>
38
40
  </fingerprint>
41
+
39
42
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]\d\d?[ _]access&quot;$">
40
43
  <description>Cisco IOS 12.x</description>
41
44
  <example>Basic realm="level_15_access"</example>
@@ -54,11 +57,25 @@
54
57
  <param pos="0" name="hw.vendor" value="Cisco"/>
55
58
  <param pos="0" name="hw.device" value="Router"/>
56
59
  </fingerprint>
60
+
61
+ <fingerprint pattern="^Basic realm=&quot;(NetVanta [^&quot;]+)&quot;$" certainty="1.0">
62
+ <description>ADTRAN Netvanta Router</description>
63
+ <example hw.product="NetVanta 1238 PoE">Basic realm="NetVanta 1238 PoE"</example>
64
+ <param pos="0" name="os.device" value="Router"/>
65
+ <param pos="0" name="os.vendor" value="ADTRAN"/>
66
+ <param pos="0" name="os.family" value="NetVanta"/>
67
+ <param pos="0" name="hw.device" value="Router"/>
68
+ <param pos="0" name="hw.vendor" value="ADTRAN"/>
69
+ <param pos="0" name="hw.family" value="NetVanta"/>
70
+ <param pos="1" name="hw.product"/>
71
+ </fingerprint>
72
+
57
73
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;.*$">
58
74
  <description>Generic Cisco CWMP/CPE equipment</description>
59
75
  <example>Basic realm="Cisco_CCSP_CWMP_TCPCR"</example>
60
76
  <param pos="0" name="hw.vendor" value="Cisco"/>
61
77
  </fingerprint>
78
+
62
79
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;FW-1. Reason: no user Server &quot;$">
63
80
  <description>Check Point FireWall-1</description>
64
81
  <example>Basic realm="FW-1. Reason: no user Server "</example>
@@ -71,12 +88,15 @@
71
88
  <param pos="0" name="os.family" value="Firewall-1"/>
72
89
  <param pos="0" name="os.product" value="Firewall-1"/>
73
90
  </fingerprint>
91
+
74
92
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;.*">
75
93
  <description>cPanel</description>
76
94
  <example>Basic realm="cPanel"</example>
77
95
  <param pos="0" name="service.vendor" value="cPanel"/>
78
96
  <param pos="0" name="service.product" value="cPanel"/>
97
+ <param pos="0" name="service.cpe23" value="cpe:/a:cpanel:cpanel:-"/>
79
98
  </fingerprint>
99
+
80
100
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;APC Management Card&quot;$">
81
101
  <description>APC device</description>
82
102
  <example>Basic realm="APC Management Card"</example>
@@ -85,6 +105,7 @@
85
105
  <param pos="0" name="os.vendor" value="APC"/>
86
106
  <param pos="0" name="os.device" value="Power device"/>
87
107
  </fingerprint>
108
+
88
109
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
89
110
  <description>Generic ADSL modems/routers</description>
90
111
  <example>Basic realm="ADSL Modem"</example>
@@ -93,22 +114,27 @@
93
114
  <example>Basic realm="ADSL2+ Router"</example>
94
115
  <param pos="0" name="hw.device" value="ADSL Modem"/>
95
116
  </fingerprint>
117
+
96
118
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;.*$">
97
119
  <description>Generic Broadband modems/routers</description>
98
120
  <example>Basic realm="Broadband Router"</example>
99
121
  <param pos="0" name="hw.device" value="Broadband router"/>
100
122
  </fingerprint>
123
+
101
124
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
102
125
  <description>Generic DSL modems/routers</description>
103
126
  <example>Basic realm="DSL Modem"</example>
104
127
  <param pos="0" name="hw.device" value="DSL Modem"/>
105
128
  </fingerprint>
129
+
106
130
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;.*$">
107
131
  <description>Generic DVR</description>
108
132
  <example>Basic realm="DVR"</example>
109
133
  <param pos="0" name="hw.device" value="DVR"/>
110
134
  </fingerprint>
135
+
111
136
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
137
+
112
138
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;.*$">
113
139
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
114
140
  <example>Basic realm="hikvision"</example>
@@ -116,19 +142,23 @@
116
142
  <param pos="0" name="service.product" value="Hikvision Web Server"/>
117
143
  <param pos="0" name="os.vendor" value="Hikvision"/>
118
144
  <param pos="0" name="os.device" value="DVR"/>
145
+ <param pos="0" name="hw.vendor" value="Hikvision"/>
119
146
  <param pos="0" name="hw.device" value="DVR"/>
120
147
  </fingerprint>
148
+
121
149
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;.*$">
122
150
  <description>Merit LILIN generic device</description>
123
151
  <example>Basic realm="Merit LILIN Ent. Co., Ltd,"</example>
124
152
  <example>Basic realm="Merit LILIN Ent. Co., Ltd."</example>
125
153
  <param pos="0" name="hw.vendor" value="Merit LILIN"/>
126
154
  </fingerprint>
155
+
127
156
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;.*$">
128
157
  <description>Generic WAP</description>
129
158
  <example>Basic realm="Wireless Access Point"</example>
130
159
  <param pos="0" name="hw.device" value="WAP"/>
131
160
  </fingerprint>
161
+
132
162
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;.*$">
133
163
  <description>Generic IP Cameras</description>
134
164
  <example>Basic realm="camera"</example>
@@ -136,6 +166,7 @@
136
166
  <example>Basic realm="Mini Dome IP Camera"</example>
137
167
  <param pos="0" name="hw.device" value="Web cam"/>
138
168
  </fingerprint>
169
+
139
170
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
140
171
  <description>D-Link DCS IP Cameras</description>
141
172
  <example hw.product="DCS-5222LB1">Basic realm="DCS-5222LB1"</example>
@@ -144,6 +175,7 @@
144
175
  <param pos="0" name="hw.device" value="Web cam"/>
145
176
  <param pos="1" name="hw.product"/>
146
177
  </fingerprint>
178
+
147
179
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
148
180
  <description>GoAhead webserver</description>
149
181
  <example>Basic realm="GoAhead"</example>
@@ -151,25 +183,19 @@
151
183
  <param pos="0" name="service.product" value="GoAhead Webserver"/>
152
184
  <param pos="0" name="service.family" value="GoAhead Webserver"/>
153
185
  </fingerprint>
186
+
154
187
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
155
188
  <description>Kubernetes master nodes</description>
156
189
  <example>Basic realm="kubernetes-master"</example>
157
190
  <param pos="0" name="service.vendor" value="Kubernetes"/>
158
191
  </fingerprint>
159
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
160
- <description>Netgear Orbi</description>
161
- <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
162
- <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
163
- <param pos="0" name="hw.vendor" value="Netgear"/>
164
- <param pos="0" name="hw.device" value="WAP"/>
165
- <param pos="0" name="hw.family" value="Orbi"/>
166
- <param pos="1" name="hw.product"/>
167
- </fingerprint>
192
+
168
193
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
169
194
  <description>Ruijie Networks generic</description>
170
195
  <example>Digest realm="RUIJIE-CPE"</example>
171
196
  <param pos="0" name="hw.vendor" value="Ruijie"/>
172
197
  </fingerprint>
198
+
173
199
  <fingerprint pattern="^Basic realm=&quot;SpeedTouch&quot;$">
174
200
  <description>Thomson SpeedTouch xDSL router - short variant</description>
175
201
  <example>Basic realm="SpeedTouch"</example>
@@ -183,6 +209,7 @@
183
209
  <param pos="0" name="hw.family" value="SpeedTouch"/>
184
210
  <param pos="0" name="hw.device" value="Broadband router"/>
185
211
  </fingerprint>
212
+
186
213
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch \(([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2})\)&quot;$">
187
214
  <description>Thomson SpeedTouch xDSL router</description>
188
215
  <example host.mac="00-90-D0-F9-91-52">Basic realm="SpeedTouch (00-90-D0-F9-91-52)"</example>
@@ -198,10 +225,12 @@
198
225
  <param pos="0" name="hw.device" value="Broadband router"/>
199
226
  <param pos="1" name="host.mac"/>
200
227
  </fingerprint>
228
+
201
229
  <!--
202
230
  Really need some examples for the fingerprints below. The regex and params
203
231
  imply that the nonce inlcudes the MAC address.
204
232
  -->
233
+
205
234
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
206
235
  <description>Thomson SpeedTouch xDSL router - qop variant</description>
207
236
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -216,6 +245,7 @@
216
245
  <param pos="0" name="hw.device" value="Broadband router"/>
217
246
  <param pos="1" name="host.mac"/>
218
247
  </fingerprint>
248
+
219
249
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ST (\d+) R 5.x Telecom Italia&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
220
250
  <description>Thomson SpeedTouch xDSL router - Telecom Italia</description>
221
251
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -230,6 +260,7 @@
230
260
  <param pos="1" name="os.product"/>
231
261
  <param pos="2" name="host.mac"/>
232
262
  </fingerprint>
263
+
233
264
  <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;.*$">
234
265
  <description>Thomson generic devices</description>
235
266
  <example>Digest realm="Thomson Gateway"</example>
@@ -237,6 +268,7 @@
237
268
  <param pos="0" name="hw.vendor" value="Thomson"/>
238
269
  <param pos="0" name="hw.device" value="Broadband router"/>
239
270
  </fingerprint>
271
+
240
272
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
241
273
  <description>Huawei xDSL routers</description>
242
274
  <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
@@ -252,6 +284,7 @@
252
284
  <param pos="0" name="hw.family" value="MT"/>
253
285
  <param pos="1" name="hw.product"/>
254
286
  </fingerprint>
287
+
255
288
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;.*$">
256
289
  <description>Huawei Home Gateway Routers</description>
257
290
  <example>Basic realm="HuaweiHomeGateway"</example>
@@ -259,6 +292,7 @@
259
292
  <param pos="0" name="hw.device" value="Broadband router"/>
260
293
  <param pos="0" name="hw.product" value="Home Gateway"/>
261
294
  </fingerprint>
295
+
262
296
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;.*$">
263
297
  <description>Huawei EchoLife Home Gateways</description>
264
298
  <example>Basic realm="EchoLife Portal de Inicio"</example>
@@ -267,6 +301,7 @@
267
301
  <param pos="0" name="hw.device" value="Broadband router"/>
268
302
  <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
269
303
  </fingerprint>
304
+
270
305
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
271
306
  <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
272
307
  <example hw.product="WRT54G">Basic realm="WRT54G"</example>
@@ -280,6 +315,7 @@
280
315
  <param pos="0" name="hw.device" value="WAP"/>
281
316
  <param pos="1" name="hw.product"/>
282
317
  </fingerprint>
318
+
283
319
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
284
320
  <description>TP-LINK SoHo Router - dash variant</description>
285
321
  <example>Basic realm="TD-W8901G"</example>
@@ -289,6 +325,7 @@
289
325
  <param pos="0" name="os.device" value="Router"/>
290
326
  <param pos="1" name="os.product"/>
291
327
  </fingerprint>
328
+
292
329
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
293
330
  <description>TP-LINK SoHo Router</description>
294
331
  <example>Basic realm="TD854W"</example>
@@ -299,6 +336,7 @@
299
336
  <param pos="0" name="os.device" value="Router"/>
300
337
  <param pos="1" name="os.product"/>
301
338
  </fingerprint>
339
+
302
340
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
303
341
  <description>TP-LINK SoHo Router - verbose variant</description>
304
342
  <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
@@ -321,27 +359,31 @@
321
359
  <param pos="0" name="os.device" value="WAP"/>
322
360
  <param pos="1" name="os.product"/>
323
361
  </fingerprint>
362
+
324
363
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
325
364
  <description>TP-LINK Routers</description>
326
365
  <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
327
366
  <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
328
367
  <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
329
- <param pos="0" name="hw.vendor" value="TP-Link"/>
368
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
330
369
  <param pos="0" name="hw.device" value="Router"/>
331
370
  <param pos="1" name="hw.product"/>
332
371
  </fingerprint>
372
+
333
373
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;.*$">
334
374
  <description>TP-LINK IP-Cameras</description>
335
375
  <example>Basic realm="TP-LINK IP-Camera"</example>
336
- <param pos="0" name="hw.vendor" value="TP-Link"/>
376
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
337
377
  <param pos="0" name="hw.device" value="Web cam"/>
338
378
  </fingerprint>
379
+
339
380
  <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
340
381
  <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>
341
382
  <example>Digest qop="auth", realm="Broadcom Management Service", nonce="AAAAAAAAAAAAAP//DwHpMwYy1zc=", algorithm="MD5"</example>
342
383
  <param pos="0" name="service.vendor" value="Broadcom"/>
343
384
  <param pos="0" name="service.product" value="Management Service"/>
344
385
  </fingerprint>
386
+
345
387
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;.*$">
346
388
  <description>Samba Web Administration Tool (SWAT)</description>
347
389
  <example>Basic realm="SWAT"</example>
@@ -349,6 +391,7 @@
349
391
  <param pos="0" name="service.family" value="Samba"/>
350
392
  <param pos="0" name="service.product" value="SWAT"/>
351
393
  </fingerprint>
394
+
352
395
  <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
353
396
  <description>SPIP publishing system (www.spip.net)</description>
354
397
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
@@ -356,6 +399,7 @@
356
399
  <param pos="0" name="service.product" value="SPIP"/>
357
400
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
358
401
  </fingerprint>
402
+
359
403
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
360
404
  <description>HP Instant Support Enterprise Edition with a hostname</description>
361
405
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
@@ -363,6 +407,7 @@
363
407
  <param pos="0" name="service.product" value="ISEE"/>
364
408
  <param pos="1" name="host.name"/>
365
409
  </fingerprint>
410
+
366
411
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
367
412
  <description>Generic F5 Big-IP</description>
368
413
  <example>Basic realm="BIG-IP"</example>
@@ -371,7 +416,9 @@
371
416
  <param pos="0" name="service.product" value="BIG-IP LTM"/>
372
417
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
373
418
  </fingerprint>
419
+
374
420
  <!-- HP ProCurve -->
421
+
375
422
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[3]\d{3}A)&quot;$">
376
423
  <description>HP ProCurve Hubs</description>
377
424
  <example os.product="J3295A">Basic realm="HP J3295A"</example>
@@ -380,6 +427,7 @@
380
427
  <param pos="0" name="os.device" value="Hub"/>
381
428
  <param pos="1" name="os.product"/>
382
429
  </fingerprint>
430
+
383
431
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[489]\d{3}A)&quot;$">
384
432
  <description>HP ProCurve Switches</description>
385
433
  <example os.product="J4110A">Basic realm="HP J4110A"</example>
@@ -391,11 +439,13 @@
391
439
  <param pos="0" name="os.device" value="Switch"/>
392
440
  <param pos="1" name="os.product"/>
393
441
  </fingerprint>
442
+
394
443
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;.*$">
395
444
  <description>Assorted Sercomm CPE devices</description>
396
445
  <example>Digest realm="SERCOMM CPE Authentication"</example>
397
446
  <param pos="0" name="hw.vendor" value="Sercomm"/>
398
447
  </fingerprint>
448
+
399
449
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;.*$">
400
450
  <description>Tivo DVR</description>
401
451
  <example>Digest realm="TiVo DVR"</example>
@@ -403,12 +453,14 @@
403
453
  <param pos="0" name="hw.family" value="DVR"/>
404
454
  <param pos="0" name="hw.device" value="DVR"/>
405
455
  </fingerprint>
456
+
406
457
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;.*$">
407
458
  <description>Ubee Cable Modems</description>
408
459
  <example>Digest qop="auth", realm="Ubee", nonce="1544738973"</example>
409
460
  <param pos="0" name="hw.vendor" value="Ubee"/>
410
461
  <param pos="0" name="hw.device" value="Broadband router"/>
411
462
  </fingerprint>
463
+
412
464
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;XDB&quot;$">
413
465
  <description>Web server providing web services for Oracle's XML DB.</description>
414
466
  <example>Basic realm="XDB"</example>
@@ -416,11 +468,13 @@
416
468
  <param pos="0" name="service.product" value="XML DB"/>
417
469
  <param pos="0" name="service.family" value="Oracle"/>
418
470
  </fingerprint>
471
+
419
472
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;.*$">
420
473
  <description>Assorted ZTE CPE devices</description>
421
474
  <example>Digest realm="cpe@zte.com"</example>
422
475
  <param pos="0" name="hw.vendor" value="ZTE"/>
423
476
  </fingerprint>
477
+
424
478
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;.*$">
425
479
  <description>ZTE ZXHN router</description>
426
480
  <example>Basic realm="ZXHN H108L"</example>
@@ -429,6 +483,7 @@
429
483
  <param pos="0" name="hw.family" value="ZXHN"/>
430
484
  <param pos="1" name="hw.product"/>
431
485
  </fingerprint>
486
+
432
487
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;.*$">
433
488
  <description>ZTE ZXV router</description>
434
489
  <example hw.product="ZXV10 W300">Basic realm="ZXV10 W300"</example>
@@ -437,20 +492,98 @@
437
492
  <param pos="0" name="hw.family" value="ZXV"/>
438
493
  <param pos="1" name="hw.product"/>
439
494
  </fingerprint>
495
+
496
+ <fingerprint pattern="(?i)^(?:Basic|Digest)\s+realm=&quot;Siqura&quot;$">
497
+ <description>Siqura Video Encoder</description>
498
+ <example>Basic realm="Siqura"</example>
499
+ <param pos="0" name="os.vendor" value="Siqura"/>
500
+ <param pos="0" name="os.family" value="Linux"/>
501
+ <param pos="0" name="hw.vendor" value="Siqura"/>
502
+ <param pos="0" name="hw.device" value="Video Encoder"/>
503
+ </fingerprint>
504
+
505
+ <fingerprint pattern="^Digest realm=&quot;(Orbit-351)&quot;">
506
+ <description>Steinsvik Orbit 351 IP Camera (Truen TCAM Rebrand)</description>
507
+ <example hw.product="Orbit-351">Digest realm="Orbit-351", nonce="0000040dY892418598785d2a2304a74adf22f6098f2792", stale=FALSE</example>
508
+ <param pos="0" name="hw.vendor" value="Steinsvik"/>
509
+ <param pos="0" name="hw.device" value="Web cam"/>
510
+ <param pos="1" name="hw.product"/>
511
+ <param pos="0" name="os.vendor" value="Steinsvik"/>
512
+ <param pos="0" name="os.family" value="Linux"/>
513
+ <param pos="0" name="os.product" value="Linux"/>
514
+ </fingerprint>
515
+
516
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
517
+ <description>Netgear Orbi</description>
518
+ <example hw.product="Orbi">Basic realm=&quot;NETGEAR Orbi&quot;</example>
519
+ <example hw.product="Orbi-micro">Basic realm=&quot;NETGEAR Orbi-micro&quot;</example>
520
+ <example hw.product="Orbi-mini">Basic realm=&quot;NETGEAR Orbi-mini&quot;</example>
521
+ <param pos="0" name="hw.vendor" value="Netgear"/>
522
+ <param pos="0" name="hw.device" value="WAP"/>
523
+ <param pos="0" name="hw.family" value="Orbi"/>
524
+ <param pos="1" name="hw.product"/>
525
+ </fingerprint>
526
+
527
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;.*$">
528
+ <description>Netgear Routers</description>
529
+ <example hw.product="DG834">Basic realm=&quot;NETGEAR DG834 &quot;</example>
530
+ <example hw.product="C7000v2">Basic realm=&quot;NETGEAR C7000v2&quot;</example>
531
+ <example hw.product="R7000P">Basic realm=&quot;NETGEAR R7000P&quot;</example>
532
+ <param pos="0" name="hw.vendor" value="Netgear"/>
533
+ <param pos="0" name="hw.device" value="Router"/>
534
+ <param pos="1" name="hw.product"/>
535
+ </fingerprint>
536
+
537
+ <!-- Fallback to the most generic Netgear match -->
538
+
539
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;.*$">
540
+ <description>Netgear Unspecified Router</description>
541
+ <example>Basic realm=&quot;Netgear&quot;</example>
542
+ <param pos="0" name="hw.vendor" value="Netgear"/>
543
+ <param pos="0" name="hw.device" value="Router"/>
544
+ </fingerprint>
545
+
546
+ <!-- This fingerprint is suspect, as it's missing the Basic/Digest qualifier -->
547
+
548
+ <fingerprint pattern="^(?:NETGEAR|NetGear) Router ([a-zA-Z0-9\-\+]+)$">
549
+ <description>Netgear Routers w/o Authentication Type</description>
550
+ <example hw.product="WNR2000v4">NETGEAR Router WNR2000v4</example>
551
+ <example hw.product="R6100">NETGEAR Router R6100</example>
552
+ <param pos="0" name="hw.vendor" value="Netgear"/>
553
+ <param pos="0" name="hw.device" value="Router"/>
554
+ <param pos="1" name="hw.product"/>
555
+ </fingerprint>
556
+
557
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
558
+ <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
559
+ <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
560
+ <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
561
+ <param pos="0" name="service.product" value="RemoteView"/>
562
+ <param pos="0" name="service.family" value="RemoteView"/>
563
+ <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
564
+ <param pos="0" name="hw.family" value="Primergy"/>
565
+ <param pos="0" name="hw.product" value="Primergy"/>
566
+ <param pos="1" name="host.name"/>
567
+ </fingerprint>
568
+
440
569
  <!-- a variety of headers we currently just ignore -->
570
+
441
571
  <fingerprint pattern="(?i)^NTLM$">
442
572
  <description>Ignore NTLM-only</description>
443
573
  <example>NTLM</example>
444
574
  <example>Ntlm</example>
445
575
  </fingerprint>
576
+
446
577
  <fingerprint pattern="^Negotiate$">
447
578
  <description>Ignore Negotiate-only</description>
448
579
  <example>Negotiate</example>
449
580
  </fingerprint>
450
- <!--
581
+
582
+ <!--
451
583
  Using a wildcard . instead of ['&quot;] in the following line will result in
452
584
  this fingerprint matching examples from other fingerprints.
453
585
  -->
586
+
454
587
  <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
455
588
  <description>Ignore null/empty/period/index.</description>
456
589
  <example>Basic realm="null"</example>
@@ -460,37 +593,30 @@
460
593
  <example>Basic realm='/'</example>
461
594
  <example>Basic realm="index.html"</example>
462
595
  </fingerprint>
596
+
463
597
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;.*$">
464
598
  <description>Ignore realms with an IPv4 address</description>
465
599
  <example>Basic realm="192.168.0.1"</example>
466
600
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
467
601
  </fingerprint>
602
+
468
603
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;.*$">
469
604
  <description>Ignore generic 'config' realms</description>
470
605
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
471
606
  </fingerprint>
472
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
473
- <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
474
- <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
475
- <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
476
- <param pos="0" name="service.product" value="RemoteView"/>
477
- <param pos="0" name="service.family" value="RemoteView"/>
478
- <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
479
- <param pos="0" name="hw.family" value="Primergy"/>
480
- <param pos="0" name="hw.product" value="Primergy"/>
481
- <param pos="1" name="host.name"/>
482
- </fingerprint>
607
+
483
608
  <!--
484
609
  Temporarily disable this version-less fingerprint because it overrode the
485
610
  one in http_servers.xml (see NEX-1255).
486
-
487
611
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Lyris ListManager: enter email address and password&quot;$">
488
612
  <description>Lyris ListManager</description>
489
613
  <example>Basic realm="Lyris ListManager: enter email address and password"</example>
490
614
  <param pos="0" name="service.vendor" value="Lyris"/>
491
615
  <param pos="0" name="service.product" value="ListManager"/>
492
616
  </fingerprint>
617
+
493
618
  -->
619
+
494
620
  <!--
495
621
  Basic realm= StarVoice
496
622
  Basic realm="802.11g Remote-Motion CCD Network Camera"
@@ -538,7 +664,6 @@ Basic realm="Login to Vigor 3300"
538
664
  Basic realm="Login"
539
665
  Basic realm="MR314"
540
666
  Basic realm="NetComm NB1300"
541
- Basic realm="NETGEAR DG834 "
542
667
  Basic realm="NetLinx"
543
668
  Basic realm="Netopia-2000"
544
669
  Basic realm="Netopia-3000"
@@ -578,7 +703,9 @@ Digest realm="HiPER", domain="222.66.99.209", qop="auth", nonce="aa81b6584c4716f
578
703
  Digest realm="i3micro VRG", nonce="1186428394", qop="auth", algorithm=MD5
579
704
  Digest realm="WatchGuard SOHO Configuration",qop="auth",nonce="7c8e98007db668881687bd538e6e8581"
580
705
  -->
706
+
581
707
  <!-- This is in various PHP coding examples, but is not a reliable FP source:
582
708
  Basic realm="User Login"
583
709
  -->
584
- </fingerprints>
710
+
711
+ </fingerprints>