recog 2.3.6 → 2.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (16) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +10 -5
  3. data/README.md +22 -19
  4. data/lib/recog/version.rb +1 -1
  5. data/xml/dns_versionbind.xml +36 -0
  6. data/xml/html_title.xml +1011 -4
  7. data/xml/http_cookies.xml +9 -1
  8. data/xml/http_servers.xml +16 -1
  9. data/xml/rtsp_servers.xml +76 -0
  10. data/xml/sip_banners.xml +197 -17
  11. data/xml/smtp_banners.xml +19 -0
  12. data/xml/snmp_sysdescr.xml +92 -75
  13. data/xml/telnet_banners.xml +53 -1
  14. data/xml/x509_issuers.xml +2 -2
  15. data/xml/x509_subjects.xml +20 -9
  16. metadata +4 -3
data/xml/http_cookies.xml CHANGED
@@ -123,7 +123,7 @@
123
123
  <param pos="0" name="service.family" value="Application Protection System"/>
124
124
  <param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
125
125
  </fingerprint>
126
- <fingerprint pattern="^NSC_(?:AAAC|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS])=.*">
126
+ <fingerprint pattern="^NSC_(?:AAAC|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS)=.*">
127
127
  <description>Citrix NetScaler</description>
128
128
  <example>NSC_AAAC=xyz;</example>
129
129
  <param pos="0" name="os.vendor" value="Citrix"/>
@@ -131,6 +131,14 @@
131
131
  <param pos="0" name="os.device" value="Network Management Device"/>
132
132
  <param pos="0" name="os.product" value="NetScaler"/>
133
133
  </fingerprint>
134
+ <fingerprint pattern="^DSSignInURL=/">
135
+ <description>Pulse Secure VPN</description>
136
+ <example>DSSignInURL=/; path=/; secure</example>
137
+ <param pos="0" name="os.vendor" value="Pulse Secure"/>
138
+ <param pos="0" name="os.family" value="SSL VPN"/>
139
+ <param pos="0" name="os.device" value="SSL VPN"/>
140
+ <param pos="0" name="os.product" value="SSL VPN"/>
141
+ </fingerprint>
134
142
  <fingerprint pattern="^(EktGUID|ecm)=.*">
135
143
  <description>Ektron CMS400.net</description>
136
144
  <param pos="1" name="cookie"/>
data/xml/http_servers.xml CHANGED
@@ -1617,6 +1617,13 @@
1617
1617
  <param pos="0" name="service.family" value="ePolicy Orchestrator"/>
1618
1618
  <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:epolicy_orchestrator:-"/>
1619
1619
  </fingerprint>
1620
+ <fingerprint pattern="^LANDesk Management Agent/.*$">
1621
+ <description>LANDesk Management Agent</description>
1622
+ <param pos="0" name="service.vendor" value="LANDesk"/>
1623
+ <param pos="0" name="service.product" value="Management Agent"/>
1624
+ <param pos="0" name="service.family" value="Management Agent"/>
1625
+ <param pos="0" name="service.cpe23" value="cpe:/a:landesk:management_agent:-"/>
1626
+ </fingerprint>
1620
1627
  <fingerprint pattern="^EWS-NIC\d/(\S+)$">
1621
1628
  <description>Xerox Embedded Web Server (EWS)</description>
1622
1629
  <example service.version="6.31">EWS-NIC3/6.31</example>
@@ -3050,4 +3057,12 @@
3050
3057
  <param pos="0" name="hw.device" value="NAS"/>
3051
3058
  <param pos="1" name="host.name"/>
3052
3059
  </fingerprint>
3053
- </fingerprints>
3060
+ <fingerprint pattern="^NetData Embedded HTTP Server v([a-zA-Z0-9\-\.]+)$">
3061
+ <description>NetData Embedded HTTP Server</description>
3062
+ <example service.version="1.16.1-146-g2f5e36ef">NetData Embedded HTTP Server v1.16.1-146-g2f5e36ef</example>
3063
+ <param pos="0" name="service.vendor" value="NetData"/>
3064
+ <param pos="0" name="service.product" value="NetData"/>
3065
+ <param pos="1" name="service.version"/>
3066
+ </fingerprint>
3067
+
3068
+ </fingerprints>
data/xml/rtsp_servers.xml ADDED
@@ -0,0 +1,76 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="rtsp_header.server" protocol="rtsp" database_type="service" preference="0.85">
3
+ <fingerprint pattern="^Flussonic \(http:\/\/www.flussonic.com\/\) ([\d\.]+)$">
4
+ <description>Flussonic Media Server</description>
5
+ <example service.version="19.04">Flussonic (http://www.flussonic.com/) 19.04</example>
6
+ <example service.version="20.01">Flussonic (http://www.flussonic.com/) 20.01</example>
7
+ <param pos="0" name="service.vendor" value="Flussonic"/>
8
+ <param pos="0" name="service.product" value="Flussonic Media Server" />
9
+ <param pos="1" name="service.version" />
10
+ </fingerprint>
11
+ <fingerprint pattern="^Hipcam RealServer\/V([\d\.]+)$">
12
+ <description>Hipcam IP camera running the RealServer RTSP server.</description>
13
+ <example service.version="1.0">Hipcam RealServer/V1.0</example>
14
+ <param pos="0" name="service.vendor" value="RealNetworks"/>
15
+ <param pos="0" name="service.product" value="RealServer" />
16
+ <param pos="1" name="service.version" />
17
+ <param pos="0" name="hw.vendor" value="Hipcam" />
18
+ <param pos="0" name="hw.device" value="IP Camera" />
19
+ </fingerprint>
20
+ <fingerprint pattern="^Dahua Rtsp Server$">
21
+ <description>Dahua IP Camera</description>
22
+ <example>Dahua Rtsp Server</example>
23
+ <param pos="0" name="service.vendor" value="Dahua"/>
24
+ <param pos="0" name="hw.vendor" value="Dahua" />
25
+ <param pos="0" name="hw.device" value="IP Camera" />
26
+ </fingerprint>
27
+ <fingerprint pattern="^GStreamer RTSP server$">
28
+ <description>GStreamer RTSP Server (https://github.com/GStreamer/gst-rtsp-server)</description>
29
+ <example>GStreamer RTSP server</example>
30
+ <param pos="0" name="service.vendor" value="GStreamer"/>
31
+ <param pos="0" name="service.product" value="GStreamer RTSP Server" />
32
+ </fingerprint>
33
+ <fingerprint pattern="^WMServer\/([\d\.]+)$">
34
+ <description>Windows Media Server</description>
35
+ <example service.version="9.1.1.3862">WMServer/9.1.1.3862</example>
36
+ <example service.version="9.5.6001.22609">WMServer/9.5.6001.22609</example>
37
+ <param pos="0" name="service.vendor" value="Microsoft"/>
38
+ <param pos="0" name="service.product" value="Windows Media Server" />
39
+ <param pos="0" name="service.family" value="Windows Media Server"/>
40
+ <param pos="1" name="service.version" />
41
+ <param pos="0" name="os.vendor" value="Microsoft"/>
42
+ <param pos="0" name="os.family" value="Windows"/>
43
+ </fingerprint>
44
+ <fingerprint pattern="^Wowza (Streaming Engine|Media Server) ([\d\.]+) build(\d*)$">
45
+ <description>Wowza Media Systems Streaming Video Services</description>
46
+ <example service.version="4.7.7" service.version.version="20181108145350" service.product="Streaming Engine">Wowza Streaming Engine 4.7.7 build20181108145350</example>
47
+ <example service.version="3.6.4" service.version.version="9641" service.product="Media Server">Wowza Media Server 3.6.4 build9641</example>
48
+ <param pos="0" name="service.vendor" value="Wowza Media Systems"/>
49
+ <param pos="1" name="service.product" />
50
+ <param pos="2" name="service.version" />
51
+ <param pos="3" name="service.version.version" />
52
+ </fingerprint>
53
+ <fingerprint pattern="^HiIpcam\/V\d+R\d+ VodServer\/[\d\.]+$">
54
+ <description>Foscam IP Camera</description>
55
+ <example>HiIpcam/V100R003 VodServer/1.0.0</example>
56
+ <param pos="0" name="hw.vendor" value="Foscam" />
57
+ <param pos="0" name="hw.device" value="IP Camera" />
58
+ </fingerprint>
59
+ <fingerprint pattern="^Indigo\-Security\/[\d\.]+$">
60
+ <description>Indigo Security IP Camera</description>
61
+ <example>Indigo-Security/1.0</example>
62
+ <param pos="0" name="hw.vendor" value="Indigo Security" />
63
+ <param pos="0" name="hw.device" value="IP Camera" />
64
+ </fingerprint>
65
+ <fingerprint pattern="^Cisco MediaSense Media Server$">
66
+ <description>Cisco MediaSense Media Server (RTSP)</description>
67
+ <example>Cisco MediaSense Media Server</example>
68
+ <param pos="0" name="service.vendor" value="Cisco"/>
69
+ <param pos="0" name="service.product" value="MediaSense Media Server"/>
70
+ <param pos="0" name="service.cpe23" value="cpe:2.3:a:cisco:mediasense:-"/>
71
+ <param pos="0" name="os.vendor" value="Cisco"/>
72
+ <param pos="0" name="hw.vendor" value="Cisco"/>
73
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
74
+ <param pos="0" name="hw.product" value="MediaSense Server"/>
75
+ </fingerprint>
76
+ </fingerprints>
data/xml/sip_banners.xml CHANGED
@@ -3,26 +3,48 @@
3
3
  <!--
4
4
  SIP Server header values are matched against these patterns to fingerprint SIP devices.
5
5
  -->
6
- <fingerprint pattern="^Cisco-SIPGateway/IOS-(\d+)\.x$">
7
- <description>Cisco IOS with SIPGateway with only major version</description>
6
+
7
+ <!-- Cisco/Tandberg Products -->
8
+
9
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)\.x$">
10
+ <description>Cisco IOS SIP Gateway w/ Vague Version</description>
8
11
  <example os.version="12">Cisco-SIPGateway/IOS-12.x</example>
12
+ <param pos="0" name="service.vendor" value="Cisco"/>
13
+ <param pos="0" name="service.family" value="IOS"/>
14
+ <param pos="0" name="service.product" value="IOS"/>
15
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
9
16
  <param pos="0" name="os.vendor" value="Cisco"/>
17
+ <param pos="0" name="os.family" value="IOS"/>
10
18
  <param pos="0" name="os.product" value="IOS"/>
19
+ <param pos="0" name="os.certainty" value="0.8"/>
11
20
  <param pos="1" name="os.version"/>
12
21
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
22
+ <param pos="0" name="hw.vendor" value="Cisco"/>
23
+ <param pos="0" name="hw.device" value="Router"/>
13
24
  </fingerprint>
14
- <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.a-zA-Z]+)$">
15
- <description>Cisco IOS with SIPGateway</description>
25
+
26
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)$">
27
+ <description>Cisco IOS SIP Gateway w/ Full Version</description>
28
+ <example os.version="15.2.4.M3">Cisco-SIPGateway/IOS-15.2.4.M3</example>
16
29
  <example os.version="15.2.2.T1">Cisco-SIPGateway/IOS-15.2.2.T1</example>
17
30
  <example os.version="15.2.3.T">Cisco-SIPGateway/IOS-15.2.3.T</example>
18
31
  <example os.version="15.4.3.S5">Cisco-SIPGateway/IOS-15.4.3.S5</example>
19
32
  <example os.version="15.6.3.M0a">Cisco-SIPGateway/IOS-15.6.3.M0a</example>
20
- <example os.version="16.3.6">Cisco-SIPGateway/IOS-16.3.6</example>
33
+ <example os.version="16.3.6">Cisco-SIPGateway/IOS-16.3.6</example>
34
+ <param pos="0" name="service.vendor" value="Cisco"/>
35
+ <param pos="0" name="service.family" value="IOS"/>
36
+ <param pos="0" name="service.product" value="IOS"/>
37
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
21
38
  <param pos="0" name="os.vendor" value="Cisco"/>
39
+ <param pos="0" name="os.family" value="IOS"/>
22
40
  <param pos="0" name="os.product" value="IOS"/>
41
+ <param pos="0" name="os.certainty" value="1.0"/>
23
42
  <param pos="1" name="os.version"/>
24
43
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
44
+ <param pos="0" name="hw.vendor" value="Cisco"/>
45
+ <param pos="0" name="hw.device" value="Router"/>
25
46
  </fingerprint>
47
+
26
48
  <fingerprint pattern="^Cisco-CP-?(\d+G?)(?:-\S+)?/([\d\.]+)">
27
49
  <description>Cisco CP VoIP Phone</description>
28
50
  <example hw.model="7960G" hw.version="8.0">Cisco-CP7960G/8.0</example>
@@ -37,6 +59,7 @@
37
59
  <param pos="1" name="hw.model"/>
38
60
  <param pos="2" name="hw.version"/>
39
61
  </fingerprint>
62
+
40
63
  <fingerprint pattern="(?:Cisco|Linksys)/(SPA\d+[DG]?\d?)-([\d\.a-zA-Z]+)">
41
64
  <description>Cisco/Linksys SPA VoIP Phone</description>
42
65
  <example hw.model="SPA112" hw.version="1.4.1SR1">Cisco/SPA112-1.4.1SR1(002)d-hisec</example>
@@ -54,6 +77,7 @@
54
77
  <param pos="1" name="hw.model"/>
55
78
  <param pos="2" name="hw.version"/>
56
79
  </fingerprint>
80
+
57
81
  <fingerprint pattern="(?:Cisco|Linksys)(?: |/)(PAP2T?)(?:-|/)(\S+)$">
58
82
  <description>Cisco/Linksys VoIP / Internet Phone adapter</description>
59
83
  <example hw.version="3.1.22(LS)" hw.model="PAP2">PhoneSystems.net aabbccddeeff Linksys/PAP2-3.1.22(LS)</example>
@@ -69,6 +93,7 @@
69
93
  <param pos="1" name="hw.model"/>
70
94
  <param pos="2" name="hw.version"/>
71
95
  </fingerprint>
96
+
72
97
  <fingerprint pattern="^Cisco/(SRP\d+)-([\d\.]+)">
73
98
  <description>Cisco Services Ready Platforms (SRP) Router</description>
74
99
  <example hw.model="SRP541" hw.version="1.2.6">Cisco/SRP541-1.2.6(003)</example>
@@ -81,6 +106,7 @@
81
106
  <param pos="1" name="hw.model"/>
82
107
  <param pos="2" name="hw.version"/>
83
108
  </fingerprint>
109
+
84
110
  <fingerprint pattern="(?:Cisco|Linksys)/(WRP\d+)-(\S+)$">
85
111
  <description>Cisco/Linksys WRP Wireless Router</description>
86
112
  <example hw.version="2.00.26" hw.model="WRP400">aabbccddeeff_FinalStage_Linksys/WRP400-2.00.26</example>
@@ -94,6 +120,45 @@
94
120
  <param pos="1" name="hw.model"/>
95
121
  <param pos="2" name="hw.version"/>
96
122
  </fingerprint>
123
+
124
+ <fingerprint pattern="^TANDBERG/(\d+) \((.*)\) Cisco-(\S+)$">
125
+ <description>Cisco/Tandberg TelePresence w/Cisco Model Name</description>
126
+ <example os.version="TC7.3.7.01c84fd" tandberg.model="528" hw.product="EX60">TANDBERG/528 (TC7.3.7.01c84fd) Cisco-EX60</example>
127
+ <example os.version="ce9.6.0.76c1685b70e" tandberg.model="529" hw.product="RoomKitMini">TANDBERG/529 (ce9.6.0.76c1685b70e) Cisco-RoomKitMini</example>
128
+ <param pos="0" name="os.vendor" value="Tandberg"/>
129
+ <param pos="0" name="os.family" value="Linux"/>
130
+ <param pos="0" name="os.product" value="Linux"/>
131
+ <param pos="1" name="tandberg.model"/>
132
+ <param pos="2" name="os.version"/>
133
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
134
+ <param pos="0" name="hw.vendor" value="Cisco"/>
135
+ <param pos="0" name="hw.family" value="TelePresence"/>
136
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
137
+ <param pos="3" name="hw.product"/>
138
+ </fingerprint>
139
+
140
+ <fingerprint pattern="^(TANDBERG/(\d+)) \((\S+).*\)$">
141
+ <description>Cisco/Tandberg TelePresence</description>
142
+ <example os.version="TC7.0.2.aecf2d9" tandberg.model="519" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
143
+ <example os.version="X12.5.2" tandberg.model="4137" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
144
+ <example os.version="X8.2.1" hw.product="TANDBERG/4130">TANDBERG/4130 (X8.2.1)</example>
145
+ <example os.version="XC2.2.1-b2bua-1.0" hw.product="TANDBERG/4353" tandberg.model="4353">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
146
+ <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516" tandberg.model="516">TANDBERG/516 (TC5.1.4.295090)</example>
147
+ <example os.version="TCNC5.1.4.295090" hw.product="TANDBERG/517" tandberg.model="517">TANDBERG/517 (TCNC5.1.4.295090)</example>
148
+ <param pos="0" name="os.vendor" value="Tandberg"/>
149
+ <param pos="0" name="os.family" value="Linux"/>
150
+ <param pos="0" name="os.product" value="Linux"/>
151
+ <param pos="2" name="tandberg.model"/>
152
+ <param pos="3" name="os.version"/>
153
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
154
+ <param pos="0" name="hw.vendor" value="Cisco"/>
155
+ <param pos="0" name="hw.family" value="TelePresence"/>
156
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
157
+ <param pos="1" name="hw.product"/>
158
+ </fingerprint>
159
+
160
+ <!-- Various -->
161
+
97
162
  <fingerprint pattern="EnGenius_Router$">
98
163
  <description>EnGenius DuraFon IP Phone</description>
99
164
  <example>EnGenius_Router</example>
@@ -101,6 +166,7 @@
101
166
  <param pos="0" name="hw.product" value="DuraFon"/>
102
167
  <param pos="0" name="hw.device" value="VoIP"/>
103
168
  </fingerprint>
169
+
104
170
  <fingerprint pattern="(?i)^Huawei (SoftX\d+) (?:V\d.*)$">
105
171
  <description>Huawei Softswitch</description>
106
172
  <example hw.model="SoftX3000">Huawei SoftX3000 V300R006</example>
@@ -109,11 +175,13 @@
109
175
  <param pos="0" name="hw.product" value="Softswitch"/>
110
176
  <param pos="1" name="hw.model"/>
111
177
  </fingerprint>
178
+
112
179
  <fingerprint pattern="(?i)^SIP/1.0 \(Huawei\)$">
113
180
  <description>Huawei generic</description>
114
181
  <example>SIP/1.0 (Huawei)</example>
115
182
  <param pos="0" name="hw.vendor" value="Huawei"/>
116
183
  </fingerprint>
184
+
117
185
  <fingerprint pattern="^M5T SIP(?: Stack|-UA SAFE)/v?([\d\.]+)">
118
186
  <description>Media5 Corporation SIP Stack</description>
119
187
  <example service.version="4.1.2.2">M5T SIP Stack/4.1.2.2</example>
@@ -124,17 +192,7 @@
124
192
  <param pos="1" name="service.version"/>
125
193
  <param pos="0" name="hw.device" value="VoIP"/>
126
194
  </fingerprint>
127
- <fingerprint pattern="^TANDBERG/\d+ \(([a-zA-Z]+\d+(?:\.\d+)+).*\)">
128
- <description>Cisco TelePresence</description>
129
- <example os.version="X8.2.1">TANDBERG/4130 (X8.2.1)</example>
130
- <example os.version="XC2.2.1">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
131
- <example os.version="TC5.1.4.295090">TANDBERG/516 (TC5.1.4.295090)</example>
132
- <example os.version="TCNC5.1.4.295090">TANDBERG/517 (TCNC5.1.4.295090)</example>
133
- <example os.version="S5.30">TANDBERG/80 (S5.30)</example>
134
- <param pos="0" name="os.vendor" value="Cisco"/>
135
- <param pos="0" name="os.product" value="TelePresence"/>
136
- <param pos="1" name="os.version"/>
137
- </fingerprint>
195
+
138
196
  <fingerprint pattern="^Tilgin Vood ([^_\s]+)">
139
197
  <description>Tilgin Vood</description>
140
198
  <example hw.model="HG238x">Tilgin Vood HG238x_ESx000-02_07_03_26</example>
@@ -144,6 +202,7 @@
144
202
  <param pos="0" name="hw.product" value="Vood"/>
145
203
  <param pos="1" name="hw.model"/>
146
204
  </fingerprint>
205
+
147
206
  <fingerprint pattern="^(F\d{3})/VT?(\d(?:[\d\.A-Z]+))$">
148
207
  <description>ZTE GPON Router</description>
149
208
  <example hw.product="F620" hw.version="3.30.20P5T4S">F620/V3.30.20P5T4S</example>
@@ -154,6 +213,7 @@
154
213
  <param pos="1" name="hw.product"/>
155
214
  <param pos="2" name="hw.version"/>
156
215
  </fingerprint>
216
+
157
217
  <fingerprint pattern="^ZXDSL (\S+)/V?(\d(?:[\d\.A-Z_]+))$">
158
218
  <description>ZTE ZXDSL router</description>
159
219
  <example hw.product="931VII" hw.version="2.0.00.OTET06">ZXDSL 931VII/V2.0.00.OTET06</example>
@@ -163,6 +223,7 @@
163
223
  <param pos="1" name="hw.product"/>
164
224
  <param pos="2" name="hw.version"/>
165
225
  </fingerprint>
226
+
166
227
  <fingerprint pattern="^(?:ZXHN )?(H\d{3}N)/V?(\d(?:[\d\.A-Z_]+))$">
167
228
  <description>ZTE ZXHN router</description>
168
229
  <example hw.product="H218N" hw.version="1.02.01_ERS">ZXHN H218N/V1.02.01_ERS</example>
@@ -176,4 +237,123 @@
176
237
  <param pos="1" name="hw.product"/>
177
238
  <param pos="2" name="hw.version"/>
178
239
  </fingerprint>
179
- </fingerprints>
240
+
241
+ <fingerprint pattern="^Aastra ([^/]+)/([a-zA-Z0-9\.\-]+)$">
242
+ <description>Aastra IP Phone</description>
243
+ <example hw.product="6865i" os.version="4.2.0.2023">Aastra 6865i/4.2.0.2023</example>
244
+ <param pos="0" name="os.vendor" value="Aastra"/>
245
+ <param pos="0" name="os.family" value="VoIP"/>
246
+ <param pos="0" name="os.product" value="VoIP"/>
247
+ <param pos="2" name="os.version"/>
248
+ <param pos="0" name="hw.vendor" value="Aastra"/>
249
+ <param pos="0" name="hw.family" value="VoIP"/>
250
+ <param pos="0" name="hw.device" value="VoIP"/>
251
+ <param pos="1" name="hw.product"/>
252
+ </fingerprint>
253
+
254
+ <fingerprint pattern="^(?:Audiocodes-Sip-Gateway-)?(\S+) FX[A-Z_]+/v.(\S+)$">
255
+ <description>Audiocodes-Sip-Gateway</description>
256
+ <example hw.product="MP-124" os.version="6.00A.034.003">Audiocodes-Sip-Gateway-MP-124 FXS/v.6.00A.034.003</example>
257
+ <example hw.product="MP-124" os.version="6.60A.342.003">MP-124 FXS/v.6.60A.342.003</example>
258
+ <example hw.product="MP-114" os.version="6.60A.241.010">MP-114 FXS_FXO/v.6.60A.241.010</example>
259
+ <param pos="0" name="os.vendor" value="Audiocodes"/>
260
+ <param pos="0" name="os.family" value="SIP Gateway"/>
261
+ <param pos="2" name="os.version"/>
262
+ <param pos="0" name="hw.vendor" value="Audiocodes"/>
263
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
264
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
265
+ <param pos="1" name="hw.product"/>
266
+ </fingerprint>
267
+
268
+ <fingerprint pattern="^Wildix GW-(\S+)$">
269
+ <description>Wildix SIP Gateway</description>
270
+ <example os.version="5.0.3.42145">Wildix GW-5.0.3.42145</example>
271
+ <param pos="0" name="os.vendor" value="Wildix"/>
272
+ <param pos="0" name="os.family" value="SIP Gateway"/>
273
+ <param pos="1" name="os.version"/>
274
+ <param pos="0" name="hw.vendor" value="Wildix"/>
275
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
276
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
277
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
278
+ </fingerprint>
279
+
280
+ <fingerprint pattern="^Wildix GW$">
281
+ <description>Wildix SIP Gateway w/o Version</description>
282
+ <example>Wildix GW</example>
283
+ <param pos="0" name="os.vendor" value="Wildix"/>
284
+ <param pos="0" name="os.family" value="SIP Gateway"/>
285
+ <param pos="0" name="hw.vendor" value="Wildix"/>
286
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
287
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
288
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
289
+ </fingerprint>
290
+
291
+ <fingerprint pattern="^Asterisk PBX (\S+)$">
292
+ <description>Asterisk PBX w/ Version</description>
293
+ <example service.version="13.18.0-6.7.1.1.rl.1538157944.1c65507">Asterisk PBX 13.18.0-6.7.1.1.rl.1538157944.1c65507</example>
294
+ <example service.version="16.2.1~dfsg-1">Asterisk PBX 16.2.1~dfsg-1</example>
295
+ <param pos="0" name="service.vendor" value="Asterisk"/>
296
+ <param pos="0" name="service.family" value="PBX"/>
297
+ <param pos="0" name="service.product" value="PBX"/>
298
+ <param pos="1" name="service.version"/>
299
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:{service.version}"/>
300
+ </fingerprint>
301
+
302
+ <fingerprint pattern="^Asterisk PBX$">
303
+ <description>Asterisk PBX w/o Version</description>
304
+ <example>Asterisk PBX</example>
305
+ <param pos="0" name="service.vendor" value="Asterisk"/>
306
+ <param pos="0" name="service.family" value="PBX"/>
307
+ <param pos="0" name="service.product" value="PBX"/>
308
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:-"/>
309
+ </fingerprint>
310
+
311
+ <fingerprint pattern="^FPBX-(\S+)$">
312
+ <description>FreePBX</description>
313
+ <example service.version="12.0.70(11.20.0)">FPBX-12.0.70(11.20.0)</example>
314
+ <example service.version="2.11.0(11.20.0)">FPBX-2.11.0(11.20.0)</example>
315
+ <param pos="0" name="service.vendor" value="FreePBX"/>
316
+ <param pos="0" name="service.family" value="PBX"/>
317
+ <param pos="0" name="service.product" value="PBX"/>
318
+ <param pos="1" name="service.version"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:freepbx:freepbx:{service.version}"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^kamailio \((\S+) \((.*)\)\)$">
323
+ <description>Kamailio SIP Server</description>
324
+ <example service.version="4.4.4" kamailio.platform="x86_64/linux">kamailio (4.4.4 (x86_64/linux))</example>
325
+ <param pos="0" name="service.vendor" value="Kamailio"/>
326
+ <param pos="0" name="service.family" value="SIP Server"/>
327
+ <param pos="0" name="service.product" value="SIP Server"/>
328
+ <param pos="1" name="service.version"/>
329
+ <param pos="2" name="kamailio.platform"/>
330
+ <param pos="0" name="service.cpe23" value="cpe:/a:kamailio:kamailio:{service.version}"/>
331
+ </fingerprint>
332
+
333
+ <!-- This match covers multiple product families and should be split up further -->
334
+ <fingerprint pattern="^Algo-([^/]+)/(.*)$">
335
+ <description>Algo SIP Device</description>
336
+ <example hw.product="8186" os.version="1.7">Algo-8186/1.7</example>
337
+ <param pos="0" name="os.vendor" value="Algo"/>
338
+ <param pos="0" name="os.family" value="SIP Device"/>
339
+ <param pos="2" name="os.version"/>
340
+ <param pos="0" name="hw.vendor" value="Algo"/>
341
+ <param pos="0" name="hw.family" value="SIP Device"/>
342
+ <param pos="0" name="hw.device" value="SIP Device"/>
343
+ <param pos="1" name="hw.product"/>
344
+ </fingerprint>
345
+
346
+ <fingerprint pattern="^(?:SIParator|Ingate-Firewall)/(\S+)$">
347
+ <description>Ingate SIParator Firewall</description>
348
+ <example os.version="5.0.10">Ingate-Firewall/5.0.10</example>
349
+ <example os.version="6.0.4">SIParator/6.0.4</example>
350
+ <param pos="0" name="os.vendor" value="Ingate"/>
351
+ <param pos="0" name="os.family" value="SIP Gateway"/>
352
+ <param pos="1" name="os.version"/>
353
+ <param pos="0" name="hw.vendor" value="Ingate"/>
354
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
355
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
356
+ <param pos="0" name="hw.product" value="SIParator Firewall"/>
357
+ </fingerprint>
358
+
359
+ </fingerprints>
data/xml/smtp_banners.xml CHANGED
@@ -393,6 +393,15 @@
393
393
  <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
394
394
  <param pos="2" name="system.time"/>
395
395
  </fingerprint>
396
+ <fingerprint pattern="^ ?([^, ]+) Exim ESMTP Service ready$">
397
+ <description>Exim - with hostname </description>
398
+ <example host.name="foo.bar">foo.bar Exim ESMTP Service ready</example>
399
+ <param pos="0" name="service.vendor" value="exim"/>
400
+ <param pos="0" name="service.family" value="exim"/>
401
+ <param pos="0" name="service.product" value="exim"/>
402
+ <param pos="1" name="host.name"/>
403
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
404
+ </fingerprint>
396
405
  <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
397
406
  <description>FTGate mail server, runs on Windows 9x/NT/2k (http://www.ftgate.com)</description>
398
407
  <example host.name="foo.bar">foo.bar FTGate server ready -attitude [C.o.r.E]</example>
@@ -1668,4 +1677,14 @@
1668
1677
  <example>ESMTP READY</example>
1669
1678
  <param pos="1" name="host.name"/>
1670
1679
  </fingerprint>
1680
+ <fingerprint pattern="^([^ ]+) ESMTP OpenSMTPD$">
1681
+ <description>OpenSMPTD</description>
1682
+ <example host.name="foo.bar">foo.bar ESMTP OpenSMTPD</example>
1683
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1684
+ <param pos="0" name="service.family" value="OpenSMTPD"/>
1685
+ <param pos="0" name="service.product" value="OpenSMTPD"/>
1686
+ <param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:-"/>
1687
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:opensmtpd:-"/>
1688
+ <param pos="1" name="host.name"/>
1689
+ </fingerprint>
1671
1690
  </fingerprints>