recog 2.3.6 → 2.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +10 -5
  3. data/README.md +22 -19
  4. data/lib/recog/version.rb +1 -1
  5. data/xml/dns_versionbind.xml +36 -0
  6. data/xml/html_title.xml +1011 -4
  7. data/xml/http_cookies.xml +9 -1
  8. data/xml/http_servers.xml +16 -1
  9. data/xml/rtsp_servers.xml +76 -0
  10. data/xml/sip_banners.xml +197 -17
  11. data/xml/smtp_banners.xml +19 -0
  12. data/xml/snmp_sysdescr.xml +92 -75
  13. data/xml/telnet_banners.xml +53 -1
  14. data/xml/x509_issuers.xml +2 -2
  15. data/xml/x509_subjects.xml +20 -9
  16. metadata +4 -3
data/xml/http_cookies.xml CHANGED
@@ -123,7 +123,7 @@
123
123
  <param pos="0" name="service.family" value="Application Protection System"/>
124
124
  <param pos="0" name="service.product" value="Application Protection System, Enterprise"/>
125
125
  </fingerprint>
126
- <fingerprint pattern="^NSC_(?:AAAC|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS])=.*">
126
+ <fingerprint pattern="^NSC_(?:AAAC|CERT|DLGE|EPAC|TASS|TEMP|TMA[APS]|PERS)=.*">
127
127
  <description>Citrix NetScaler</description>
128
128
  <example>NSC_AAAC=xyz;</example>
129
129
  <param pos="0" name="os.vendor" value="Citrix"/>
@@ -131,6 +131,14 @@
131
131
  <param pos="0" name="os.device" value="Network Management Device"/>
132
132
  <param pos="0" name="os.product" value="NetScaler"/>
133
133
  </fingerprint>
134
+ <fingerprint pattern="^DSSignInURL=/">
135
+ <description>Pulse Secure VPN</description>
136
+ <example>DSSignInURL=/; path=/; secure</example>
137
+ <param pos="0" name="os.vendor" value="Pulse Secure"/>
138
+ <param pos="0" name="os.family" value="SSL VPN"/>
139
+ <param pos="0" name="os.device" value="SSL VPN"/>
140
+ <param pos="0" name="os.product" value="SSL VPN"/>
141
+ </fingerprint>
134
142
  <fingerprint pattern="^(EktGUID|ecm)=.*">
135
143
  <description>Ektron CMS400.net</description>
136
144
  <param pos="1" name="cookie"/>
data/xml/http_servers.xml CHANGED
@@ -1617,6 +1617,13 @@
1617
1617
  <param pos="0" name="service.family" value="ePolicy Orchestrator"/>
1618
1618
  <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:epolicy_orchestrator:-"/>
1619
1619
  </fingerprint>
1620
+ <fingerprint pattern="^LANDesk Management Agent/.*$">
1621
+ <description>LANDesk Management Agent</description>
1622
+ <param pos="0" name="service.vendor" value="LANDesk"/>
1623
+ <param pos="0" name="service.product" value="Management Agent"/>
1624
+ <param pos="0" name="service.family" value="Management Agent"/>
1625
+ <param pos="0" name="service.cpe23" value="cpe:/a:landesk:management_agent:-"/>
1626
+ </fingerprint>
1620
1627
  <fingerprint pattern="^EWS-NIC\d/(\S+)$">
1621
1628
  <description>Xerox Embedded Web Server (EWS)</description>
1622
1629
  <example service.version="6.31">EWS-NIC3/6.31</example>
@@ -3050,4 +3057,12 @@
3050
3057
  <param pos="0" name="hw.device" value="NAS"/>
3051
3058
  <param pos="1" name="host.name"/>
3052
3059
  </fingerprint>
3053
- </fingerprints>
3060
+ <fingerprint pattern="^NetData Embedded HTTP Server v([a-zA-Z0-9\-\.]+)$">
3061
+ <description>NetData Embedded HTTP Server</description>
3062
+ <example service.version="1.16.1-146-g2f5e36ef">NetData Embedded HTTP Server v1.16.1-146-g2f5e36ef</example>
3063
+ <param pos="0" name="service.vendor" value="NetData"/>
3064
+ <param pos="0" name="service.product" value="NetData"/>
3065
+ <param pos="1" name="service.version"/>
3066
+ </fingerprint>
3067
+
3068
+ </fingerprints>
data/xml/rtsp_servers.xml ADDED
@@ -0,0 +1,76 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="rtsp_header.server" protocol="rtsp" database_type="service" preference="0.85">
3
+ <fingerprint pattern="^Flussonic \(http:\/\/www.flussonic.com\/\) ([\d\.]+)$">
4
+ <description>Flussonic Media Server</description>
5
+ <example service.version="19.04">Flussonic (http://www.flussonic.com/) 19.04</example>
6
+ <example service.version="20.01">Flussonic (http://www.flussonic.com/) 20.01</example>
7
+ <param pos="0" name="service.vendor" value="Flussonic"/>
8
+ <param pos="0" name="service.product" value="Flussonic Media Server" />
9
+ <param pos="1" name="service.version" />
10
+ </fingerprint>
11
+ <fingerprint pattern="^Hipcam RealServer\/V([\d\.]+)$">
12
+ <description>Hipcam IP camera running the RealServer RTSP server.</description>
13
+ <example service.version="1.0">Hipcam RealServer/V1.0</example>
14
+ <param pos="0" name="service.vendor" value="RealNetworks"/>
15
+ <param pos="0" name="service.product" value="RealServer" />
16
+ <param pos="1" name="service.version" />
17
+ <param pos="0" name="hw.vendor" value="Hipcam" />
18
+ <param pos="0" name="hw.device" value="IP Camera" />
19
+ </fingerprint>
20
+ <fingerprint pattern="^Dahua Rtsp Server$">
21
+ <description>Dahua IP Camera</description>
22
+ <example>Dahua Rtsp Server</example>
23
+ <param pos="0" name="service.vendor" value="Dahua"/>
24
+ <param pos="0" name="hw.vendor" value="Dahua" />
25
+ <param pos="0" name="hw.device" value="IP Camera" />
26
+ </fingerprint>
27
+ <fingerprint pattern="^GStreamer RTSP server$">
28
+ <description>GStreamer RTSP Server (https://github.com/GStreamer/gst-rtsp-server)</description>
29
+ <example>GStreamer RTSP server</example>
30
+ <param pos="0" name="service.vendor" value="GStreamer"/>
31
+ <param pos="0" name="service.product" value="GStreamer RTSP Server" />
32
+ </fingerprint>
33
+ <fingerprint pattern="^WMServer\/([\d\.]+)$">
34
+ <description>Windows Media Server</description>
35
+ <example service.version="9.1.1.3862">WMServer/9.1.1.3862</example>
36
+ <example service.version="9.5.6001.22609">WMServer/9.5.6001.22609</example>
37
+ <param pos="0" name="service.vendor" value="Microsoft"/>
38
+ <param pos="0" name="service.product" value="Windows Media Server" />
39
+ <param pos="0" name="service.family" value="Windows Media Server"/>
40
+ <param pos="1" name="service.version" />
41
+ <param pos="0" name="os.vendor" value="Microsoft"/>
42
+ <param pos="0" name="os.family" value="Windows"/>
43
+ </fingerprint>
44
+ <fingerprint pattern="^Wowza (Streaming Engine|Media Server) ([\d\.]+) build(\d*)$">
45
+ <description>Wowza Media Systems Streaming Video Services</description>
46
+ <example service.version="4.7.7" service.version.version="20181108145350" service.product="Streaming Engine">Wowza Streaming Engine 4.7.7 build20181108145350</example>
47
+ <example service.version="3.6.4" service.version.version="9641" service.product="Media Server">Wowza Media Server 3.6.4 build9641</example>
48
+ <param pos="0" name="service.vendor" value="Wowza Media Systems"/>
49
+ <param pos="1" name="service.product" />
50
+ <param pos="2" name="service.version" />
51
+ <param pos="3" name="service.version.version" />
52
+ </fingerprint>
53
+ <fingerprint pattern="^HiIpcam\/V\d+R\d+ VodServer\/[\d\.]+$">
54
+ <description>Foscam IP Camera</description>
55
+ <example>HiIpcam/V100R003 VodServer/1.0.0</example>
56
+ <param pos="0" name="hw.vendor" value="Foscam" />
57
+ <param pos="0" name="hw.device" value="IP Camera" />
58
+ </fingerprint>
59
+ <fingerprint pattern="^Indigo\-Security\/[\d\.]+$">
60
+ <description>Indigo Security IP Camera</description>
61
+ <example>Indigo-Security/1.0</example>
62
+ <param pos="0" name="hw.vendor" value="Indigo Security" />
63
+ <param pos="0" name="hw.device" value="IP Camera" />
64
+ </fingerprint>
65
+ <fingerprint pattern="^Cisco MediaSense Media Server$">
66
+ <description>Cisco MediaSense Media Server (RTSP)</description>
67
+ <example>Cisco MediaSense Media Server</example>
68
+ <param pos="0" name="service.vendor" value="Cisco"/>
69
+ <param pos="0" name="service.product" value="MediaSense Media Server"/>
70
+ <param pos="0" name="service.cpe23" value="cpe:2.3:a:cisco:mediasense:-"/>
71
+ <param pos="0" name="os.vendor" value="Cisco"/>
72
+ <param pos="0" name="hw.vendor" value="Cisco"/>
73
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
74
+ <param pos="0" name="hw.product" value="MediaSense Server"/>
75
+ </fingerprint>
76
+ </fingerprints>
data/xml/sip_banners.xml CHANGED
@@ -3,26 +3,48 @@
3
3
  <!--
4
4
  SIP Server header values are matched against these patterns to fingerprint SIP devices.
5
5
  -->
6
- <fingerprint pattern="^Cisco-SIPGateway/IOS-(\d+)\.x$">
7
- <description>Cisco IOS with SIPGateway with only major version</description>
6
+
7
+ <!-- Cisco/Tandberg Products -->
8
+
9
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)\.x$">
10
+ <description>Cisco IOS SIP Gateway w/ Vague Version</description>
8
11
  <example os.version="12">Cisco-SIPGateway/IOS-12.x</example>
12
+ <param pos="0" name="service.vendor" value="Cisco"/>
13
+ <param pos="0" name="service.family" value="IOS"/>
14
+ <param pos="0" name="service.product" value="IOS"/>
15
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
9
16
  <param pos="0" name="os.vendor" value="Cisco"/>
17
+ <param pos="0" name="os.family" value="IOS"/>
10
18
  <param pos="0" name="os.product" value="IOS"/>
19
+ <param pos="0" name="os.certainty" value="0.8"/>
11
20
  <param pos="1" name="os.version"/>
12
21
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
22
+ <param pos="0" name="hw.vendor" value="Cisco"/>
23
+ <param pos="0" name="hw.device" value="Router"/>
13
24
  </fingerprint>
14
- <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.a-zA-Z]+)$">
15
- <description>Cisco IOS with SIPGateway</description>
25
+
26
+ <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)$">
27
+ <description>Cisco IOS SIP Gateway w/ Full Version</description>
28
+ <example os.version="15.2.4.M3">Cisco-SIPGateway/IOS-15.2.4.M3</example>
16
29
  <example os.version="15.2.2.T1">Cisco-SIPGateway/IOS-15.2.2.T1</example>
17
30
  <example os.version="15.2.3.T">Cisco-SIPGateway/IOS-15.2.3.T</example>
18
31
  <example os.version="15.4.3.S5">Cisco-SIPGateway/IOS-15.4.3.S5</example>
19
32
  <example os.version="15.6.3.M0a">Cisco-SIPGateway/IOS-15.6.3.M0a</example>
20
- <example os.version="16.3.6">Cisco-SIPGateway/IOS-16.3.6</example>
33
+ <example os.version="16.3.6">Cisco-SIPGateway/IOS-16.3.6</example>
34
+ <param pos="0" name="service.vendor" value="Cisco"/>
35
+ <param pos="0" name="service.family" value="IOS"/>
36
+ <param pos="0" name="service.product" value="IOS"/>
37
+ <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:{os.version}"/>
21
38
  <param pos="0" name="os.vendor" value="Cisco"/>
39
+ <param pos="0" name="os.family" value="IOS"/>
22
40
  <param pos="0" name="os.product" value="IOS"/>
41
+ <param pos="0" name="os.certainty" value="1.0"/>
23
42
  <param pos="1" name="os.version"/>
24
43
  <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
44
+ <param pos="0" name="hw.vendor" value="Cisco"/>
45
+ <param pos="0" name="hw.device" value="Router"/>
25
46
  </fingerprint>
47
+
26
48
  <fingerprint pattern="^Cisco-CP-?(\d+G?)(?:-\S+)?/([\d\.]+)">
27
49
  <description>Cisco CP VoIP Phone</description>
28
50
  <example hw.model="7960G" hw.version="8.0">Cisco-CP7960G/8.0</example>
@@ -37,6 +59,7 @@
37
59
  <param pos="1" name="hw.model"/>
38
60
  <param pos="2" name="hw.version"/>
39
61
  </fingerprint>
62
+
40
63
  <fingerprint pattern="(?:Cisco|Linksys)/(SPA\d+[DG]?\d?)-([\d\.a-zA-Z]+)">
41
64
  <description>Cisco/Linksys SPA VoIP Phone</description>
42
65
  <example hw.model="SPA112" hw.version="1.4.1SR1">Cisco/SPA112-1.4.1SR1(002)d-hisec</example>
@@ -54,6 +77,7 @@
54
77
  <param pos="1" name="hw.model"/>
55
78
  <param pos="2" name="hw.version"/>
56
79
  </fingerprint>
80
+
57
81
  <fingerprint pattern="(?:Cisco|Linksys)(?: |/)(PAP2T?)(?:-|/)(\S+)$">
58
82
  <description>Cisco/Linksys VoIP / Internet Phone adapter</description>
59
83
  <example hw.version="3.1.22(LS)" hw.model="PAP2">PhoneSystems.net aabbccddeeff Linksys/PAP2-3.1.22(LS)</example>
@@ -69,6 +93,7 @@
69
93
  <param pos="1" name="hw.model"/>
70
94
  <param pos="2" name="hw.version"/>
71
95
  </fingerprint>
96
+
72
97
  <fingerprint pattern="^Cisco/(SRP\d+)-([\d\.]+)">
73
98
  <description>Cisco Services Ready Platforms (SRP) Router</description>
74
99
  <example hw.model="SRP541" hw.version="1.2.6">Cisco/SRP541-1.2.6(003)</example>
@@ -81,6 +106,7 @@
81
106
  <param pos="1" name="hw.model"/>
82
107
  <param pos="2" name="hw.version"/>
83
108
  </fingerprint>
109
+
84
110
  <fingerprint pattern="(?:Cisco|Linksys)/(WRP\d+)-(\S+)$">
85
111
  <description>Cisco/Linksys WRP Wireless Router</description>
86
112
  <example hw.version="2.00.26" hw.model="WRP400">aabbccddeeff_FinalStage_Linksys/WRP400-2.00.26</example>
@@ -94,6 +120,45 @@
94
120
  <param pos="1" name="hw.model"/>
95
121
  <param pos="2" name="hw.version"/>
96
122
  </fingerprint>
123
+
124
+ <fingerprint pattern="^TANDBERG/(\d+) \((.*)\) Cisco-(\S+)$">
125
+ <description>Cisco/Tandberg TelePresence w/Cisco Model Name</description>
126
+ <example os.version="TC7.3.7.01c84fd" tandberg.model="528" hw.product="EX60">TANDBERG/528 (TC7.3.7.01c84fd) Cisco-EX60</example>
127
+ <example os.version="ce9.6.0.76c1685b70e" tandberg.model="529" hw.product="RoomKitMini">TANDBERG/529 (ce9.6.0.76c1685b70e) Cisco-RoomKitMini</example>
128
+ <param pos="0" name="os.vendor" value="Tandberg"/>
129
+ <param pos="0" name="os.family" value="Linux"/>
130
+ <param pos="0" name="os.product" value="Linux"/>
131
+ <param pos="1" name="tandberg.model"/>
132
+ <param pos="2" name="os.version"/>
133
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
134
+ <param pos="0" name="hw.vendor" value="Cisco"/>
135
+ <param pos="0" name="hw.family" value="TelePresence"/>
136
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
137
+ <param pos="3" name="hw.product"/>
138
+ </fingerprint>
139
+
140
+ <fingerprint pattern="^(TANDBERG/(\d+)) \((\S+).*\)$">
141
+ <description>Cisco/Tandberg TelePresence</description>
142
+ <example os.version="TC7.0.2.aecf2d9" tandberg.model="519" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
143
+ <example os.version="X12.5.2" tandberg.model="4137" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
144
+ <example os.version="X8.2.1" hw.product="TANDBERG/4130">TANDBERG/4130 (X8.2.1)</example>
145
+ <example os.version="XC2.2.1-b2bua-1.0" hw.product="TANDBERG/4353" tandberg.model="4353">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
146
+ <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516" tandberg.model="516">TANDBERG/516 (TC5.1.4.295090)</example>
147
+ <example os.version="TCNC5.1.4.295090" hw.product="TANDBERG/517" tandberg.model="517">TANDBERG/517 (TCNC5.1.4.295090)</example>
148
+ <param pos="0" name="os.vendor" value="Tandberg"/>
149
+ <param pos="0" name="os.family" value="Linux"/>
150
+ <param pos="0" name="os.product" value="Linux"/>
151
+ <param pos="2" name="tandberg.model"/>
152
+ <param pos="3" name="os.version"/>
153
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:telepresence:{os.version}"/>
154
+ <param pos="0" name="hw.vendor" value="Cisco"/>
155
+ <param pos="0" name="hw.family" value="TelePresence"/>
156
+ <param pos="0" name="hw.device" value="Video Conferencing"/>
157
+ <param pos="1" name="hw.product"/>
158
+ </fingerprint>
159
+
160
+ <!-- Various -->
161
+
97
162
  <fingerprint pattern="EnGenius_Router$">
98
163
  <description>EnGenius DuraFon IP Phone</description>
99
164
  <example>EnGenius_Router</example>
@@ -101,6 +166,7 @@
101
166
  <param pos="0" name="hw.product" value="DuraFon"/>
102
167
  <param pos="0" name="hw.device" value="VoIP"/>
103
168
  </fingerprint>
169
+
104
170
  <fingerprint pattern="(?i)^Huawei (SoftX\d+) (?:V\d.*)$">
105
171
  <description>Huawei Softswitch</description>
106
172
  <example hw.model="SoftX3000">Huawei SoftX3000 V300R006</example>
@@ -109,11 +175,13 @@
109
175
  <param pos="0" name="hw.product" value="Softswitch"/>
110
176
  <param pos="1" name="hw.model"/>
111
177
  </fingerprint>
178
+
112
179
  <fingerprint pattern="(?i)^SIP/1.0 \(Huawei\)$">
113
180
  <description>Huawei generic</description>
114
181
  <example>SIP/1.0 (Huawei)</example>
115
182
  <param pos="0" name="hw.vendor" value="Huawei"/>
116
183
  </fingerprint>
184
+
117
185
  <fingerprint pattern="^M5T SIP(?: Stack|-UA SAFE)/v?([\d\.]+)">
118
186
  <description>Media5 Corporation SIP Stack</description>
119
187
  <example service.version="4.1.2.2">M5T SIP Stack/4.1.2.2</example>
@@ -124,17 +192,7 @@
124
192
  <param pos="1" name="service.version"/>
125
193
  <param pos="0" name="hw.device" value="VoIP"/>
126
194
  </fingerprint>
127
- <fingerprint pattern="^TANDBERG/\d+ \(([a-zA-Z]+\d+(?:\.\d+)+).*\)">
128
- <description>Cisco TelePresence</description>
129
- <example os.version="X8.2.1">TANDBERG/4130 (X8.2.1)</example>
130
- <example os.version="XC2.2.1">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
131
- <example os.version="TC5.1.4.295090">TANDBERG/516 (TC5.1.4.295090)</example>
132
- <example os.version="TCNC5.1.4.295090">TANDBERG/517 (TCNC5.1.4.295090)</example>
133
- <example os.version="S5.30">TANDBERG/80 (S5.30)</example>
134
- <param pos="0" name="os.vendor" value="Cisco"/>
135
- <param pos="0" name="os.product" value="TelePresence"/>
136
- <param pos="1" name="os.version"/>
137
- </fingerprint>
195
+
138
196
  <fingerprint pattern="^Tilgin Vood ([^_\s]+)">
139
197
  <description>Tilgin Vood</description>
140
198
  <example hw.model="HG238x">Tilgin Vood HG238x_ESx000-02_07_03_26</example>
@@ -144,6 +202,7 @@
144
202
  <param pos="0" name="hw.product" value="Vood"/>
145
203
  <param pos="1" name="hw.model"/>
146
204
  </fingerprint>
205
+
147
206
  <fingerprint pattern="^(F\d{3})/VT?(\d(?:[\d\.A-Z]+))$">
148
207
  <description>ZTE GPON Router</description>
149
208
  <example hw.product="F620" hw.version="3.30.20P5T4S">F620/V3.30.20P5T4S</example>
@@ -154,6 +213,7 @@
154
213
  <param pos="1" name="hw.product"/>
155
214
  <param pos="2" name="hw.version"/>
156
215
  </fingerprint>
216
+
157
217
  <fingerprint pattern="^ZXDSL (\S+)/V?(\d(?:[\d\.A-Z_]+))$">
158
218
  <description>ZTE ZXDSL router</description>
159
219
  <example hw.product="931VII" hw.version="2.0.00.OTET06">ZXDSL 931VII/V2.0.00.OTET06</example>
@@ -163,6 +223,7 @@
163
223
  <param pos="1" name="hw.product"/>
164
224
  <param pos="2" name="hw.version"/>
165
225
  </fingerprint>
226
+
166
227
  <fingerprint pattern="^(?:ZXHN )?(H\d{3}N)/V?(\d(?:[\d\.A-Z_]+))$">
167
228
  <description>ZTE ZXHN router</description>
168
229
  <example hw.product="H218N" hw.version="1.02.01_ERS">ZXHN H218N/V1.02.01_ERS</example>
@@ -176,4 +237,123 @@
176
237
  <param pos="1" name="hw.product"/>
177
238
  <param pos="2" name="hw.version"/>
178
239
  </fingerprint>
179
- </fingerprints>
240
+
241
+ <fingerprint pattern="^Aastra ([^/]+)/([a-zA-Z0-9\.\-]+)$">
242
+ <description>Aastra IP Phone</description>
243
+ <example hw.product="6865i" os.version="4.2.0.2023">Aastra 6865i/4.2.0.2023</example>
244
+ <param pos="0" name="os.vendor" value="Aastra"/>
245
+ <param pos="0" name="os.family" value="VoIP"/>
246
+ <param pos="0" name="os.product" value="VoIP"/>
247
+ <param pos="2" name="os.version"/>
248
+ <param pos="0" name="hw.vendor" value="Aastra"/>
249
+ <param pos="0" name="hw.family" value="VoIP"/>
250
+ <param pos="0" name="hw.device" value="VoIP"/>
251
+ <param pos="1" name="hw.product"/>
252
+ </fingerprint>
253
+
254
+ <fingerprint pattern="^(?:Audiocodes-Sip-Gateway-)?(\S+) FX[A-Z_]+/v.(\S+)$">
255
+ <description>Audiocodes-Sip-Gateway</description>
256
+ <example hw.product="MP-124" os.version="6.00A.034.003">Audiocodes-Sip-Gateway-MP-124 FXS/v.6.00A.034.003</example>
257
+ <example hw.product="MP-124" os.version="6.60A.342.003">MP-124 FXS/v.6.60A.342.003</example>
258
+ <example hw.product="MP-114" os.version="6.60A.241.010">MP-114 FXS_FXO/v.6.60A.241.010</example>
259
+ <param pos="0" name="os.vendor" value="Audiocodes"/>
260
+ <param pos="0" name="os.family" value="SIP Gateway"/>
261
+ <param pos="2" name="os.version"/>
262
+ <param pos="0" name="hw.vendor" value="Audiocodes"/>
263
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
264
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
265
+ <param pos="1" name="hw.product"/>
266
+ </fingerprint>
267
+
268
+ <fingerprint pattern="^Wildix GW-(\S+)$">
269
+ <description>Wildix SIP Gateway</description>
270
+ <example os.version="5.0.3.42145">Wildix GW-5.0.3.42145</example>
271
+ <param pos="0" name="os.vendor" value="Wildix"/>
272
+ <param pos="0" name="os.family" value="SIP Gateway"/>
273
+ <param pos="1" name="os.version"/>
274
+ <param pos="0" name="hw.vendor" value="Wildix"/>
275
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
276
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
277
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
278
+ </fingerprint>
279
+
280
+ <fingerprint pattern="^Wildix GW$">
281
+ <description>Wildix SIP Gateway w/o Version</description>
282
+ <example>Wildix GW</example>
283
+ <param pos="0" name="os.vendor" value="Wildix"/>
284
+ <param pos="0" name="os.family" value="SIP Gateway"/>
285
+ <param pos="0" name="hw.vendor" value="Wildix"/>
286
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
287
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
288
+ <param pos="0" name="hw.product" value="SIP Gateway"/>
289
+ </fingerprint>
290
+
291
+ <fingerprint pattern="^Asterisk PBX (\S+)$">
292
+ <description>Asterisk PBX w/ Version</description>
293
+ <example service.version="13.18.0-6.7.1.1.rl.1538157944.1c65507">Asterisk PBX 13.18.0-6.7.1.1.rl.1538157944.1c65507</example>
294
+ <example service.version="16.2.1~dfsg-1">Asterisk PBX 16.2.1~dfsg-1</example>
295
+ <param pos="0" name="service.vendor" value="Asterisk"/>
296
+ <param pos="0" name="service.family" value="PBX"/>
297
+ <param pos="0" name="service.product" value="PBX"/>
298
+ <param pos="1" name="service.version"/>
299
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:{service.version}"/>
300
+ </fingerprint>
301
+
302
+ <fingerprint pattern="^Asterisk PBX$">
303
+ <description>Asterisk PBX w/o Version</description>
304
+ <example>Asterisk PBX</example>
305
+ <param pos="0" name="service.vendor" value="Asterisk"/>
306
+ <param pos="0" name="service.family" value="PBX"/>
307
+ <param pos="0" name="service.product" value="PBX"/>
308
+ <param pos="0" name="service.cpe23" value="cpe:/a:asterisk:asterisk:-"/>
309
+ </fingerprint>
310
+
311
+ <fingerprint pattern="^FPBX-(\S+)$">
312
+ <description>FreePBX</description>
313
+ <example service.version="12.0.70(11.20.0)">FPBX-12.0.70(11.20.0)</example>
314
+ <example service.version="2.11.0(11.20.0)">FPBX-2.11.0(11.20.0)</example>
315
+ <param pos="0" name="service.vendor" value="FreePBX"/>
316
+ <param pos="0" name="service.family" value="PBX"/>
317
+ <param pos="0" name="service.product" value="PBX"/>
318
+ <param pos="1" name="service.version"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:freepbx:freepbx:{service.version}"/>
320
+ </fingerprint>
321
+
322
+ <fingerprint pattern="^kamailio \((\S+) \((.*)\)\)$">
323
+ <description>Kamailio SIP Server</description>
324
+ <example service.version="4.4.4" kamailio.platform="x86_64/linux">kamailio (4.4.4 (x86_64/linux))</example>
325
+ <param pos="0" name="service.vendor" value="Kamailio"/>
326
+ <param pos="0" name="service.family" value="SIP Server"/>
327
+ <param pos="0" name="service.product" value="SIP Server"/>
328
+ <param pos="1" name="service.version"/>
329
+ <param pos="2" name="kamailio.platform"/>
330
+ <param pos="0" name="service.cpe23" value="cpe:/a:kamailio:kamailio:{service.version}"/>
331
+ </fingerprint>
332
+
333
+ <!-- This match covers multiple product families and should be split up further -->
334
+ <fingerprint pattern="^Algo-([^/]+)/(.*)$">
335
+ <description>Algo SIP Device</description>
336
+ <example hw.product="8186" os.version="1.7">Algo-8186/1.7</example>
337
+ <param pos="0" name="os.vendor" value="Algo"/>
338
+ <param pos="0" name="os.family" value="SIP Device"/>
339
+ <param pos="2" name="os.version"/>
340
+ <param pos="0" name="hw.vendor" value="Algo"/>
341
+ <param pos="0" name="hw.family" value="SIP Device"/>
342
+ <param pos="0" name="hw.device" value="SIP Device"/>
343
+ <param pos="1" name="hw.product"/>
344
+ </fingerprint>
345
+
346
+ <fingerprint pattern="^(?:SIParator|Ingate-Firewall)/(\S+)$">
347
+ <description>Ingate SIParator Firewall</description>
348
+ <example os.version="5.0.10">Ingate-Firewall/5.0.10</example>
349
+ <example os.version="6.0.4">SIParator/6.0.4</example>
350
+ <param pos="0" name="os.vendor" value="Ingate"/>
351
+ <param pos="0" name="os.family" value="SIP Gateway"/>
352
+ <param pos="1" name="os.version"/>
353
+ <param pos="0" name="hw.vendor" value="Ingate"/>
354
+ <param pos="0" name="hw.family" value="SIP Gateway"/>
355
+ <param pos="0" name="hw.device" value="SIP Gateway"/>
356
+ <param pos="0" name="hw.product" value="SIParator Firewall"/>
357
+ </fingerprint>
358
+
359
+ </fingerprints>
data/xml/smtp_banners.xml CHANGED
@@ -393,6 +393,15 @@
393
393
  <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
394
394
  <param pos="2" name="system.time"/>
395
395
  </fingerprint>
396
+ <fingerprint pattern="^ ?([^, ]+) Exim ESMTP Service ready$">
397
+ <description>Exim - with hostname </description>
398
+ <example host.name="foo.bar">foo.bar Exim ESMTP Service ready</example>
399
+ <param pos="0" name="service.vendor" value="exim"/>
400
+ <param pos="0" name="service.family" value="exim"/>
401
+ <param pos="0" name="service.product" value="exim"/>
402
+ <param pos="1" name="host.name"/>
403
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
404
+ </fingerprint>
396
405
  <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
397
406
  <description>FTGate mail server, runs on Windows 9x/NT/2k (http://www.ftgate.com)</description>
398
407
  <example host.name="foo.bar">foo.bar FTGate server ready -attitude [C.o.r.E]</example>
@@ -1668,4 +1677,14 @@
1668
1677
  <example>ESMTP READY</example>
1669
1678
  <param pos="1" name="host.name"/>
1670
1679
  </fingerprint>
1680
+ <fingerprint pattern="^([^ ]+) ESMTP OpenSMTPD$">
1681
+ <description>OpenSMPTD</description>
1682
+ <example host.name="foo.bar">foo.bar ESMTP OpenSMTPD</example>
1683
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1684
+ <param pos="0" name="service.family" value="OpenSMTPD"/>
1685
+ <param pos="0" name="service.product" value="OpenSMTPD"/>
1686
+ <param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:-"/>
1687
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:opensmtpd:-"/>
1688
+ <param pos="1" name="host.name"/>
1689
+ </fingerprint>
1671
1690
  </fingerprints>