recog 2.3.7 → 2.3.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (81) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +9 -2
  3. data/.ruby-gemset +1 -0
  4. data/.ruby-version +1 -0
  5. data/.travis.yml +2 -4
  6. data/CONTRIBUTING.md +136 -37
  7. data/Gemfile +2 -5
  8. data/README.md +18 -16
  9. data/bin/recog_cleanup +16 -0
  10. data/bin/recog_standardize +142 -0
  11. data/cpe-remap.yaml +36 -1
  12. data/features/match.feature +4 -0
  13. data/features/support/aruba.rb +3 -0
  14. data/features/verify.feature +5 -0
  15. data/identifiers/README.md +56 -0
  16. data/identifiers/hw_device.txt +77 -0
  17. data/identifiers/hw_family.txt +96 -0
  18. data/identifiers/hw_product.txt +328 -0
  19. data/identifiers/os_architecture.txt +20 -0
  20. data/identifiers/os_device.txt +94 -0
  21. data/identifiers/os_family.txt +325 -0
  22. data/identifiers/os_product.txt +420 -0
  23. data/identifiers/service_family.txt +272 -0
  24. data/identifiers/service_product.txt +557 -0
  25. data/identifiers/software_class.txt +26 -0
  26. data/identifiers/software_family.txt +91 -0
  27. data/identifiers/software_product.txt +333 -0
  28. data/identifiers/vendor.txt +891 -0
  29. data/lib/recog/version.rb +1 -1
  30. data/requirements.txt +1 -1
  31. data/spec/lib/fingerprint_self_test_spec.rb +1 -1
  32. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +1 -1
  33. data/update_cpes.py +4 -1
  34. data/xml/apache_modules.xml +292 -5
  35. data/xml/apache_os.xml +50 -2
  36. data/xml/architecture.xml +19 -7
  37. data/xml/dns_versionbind.xml +200 -26
  38. data/xml/favicons.xml +1701 -0
  39. data/xml/ftp_banners.xml +276 -16
  40. data/xml/h323_callresp.xml +112 -12
  41. data/xml/hp_pjl_id.xml +47 -5
  42. data/xml/html_title.xml +1419 -72
  43. data/xml/http_cookies.xml +77 -10
  44. data/xml/http_servers.xml +898 -47
  45. data/xml/http_wwwauth.xml +154 -27
  46. data/xml/imap_banners.xml +23 -13
  47. data/xml/ldap_searchresult.xml +81 -9
  48. data/xml/mdns_device-info_txt.xml +194 -17
  49. data/xml/mdns_workstation_txt.xml +4 -2
  50. data/xml/mysql_banners.xml +554 -45
  51. data/xml/mysql_error.xml +113 -6
  52. data/xml/nntp_banners.xml +10 -2
  53. data/xml/ntp_banners.xml +95 -11
  54. data/xml/operating_system.xml +90 -3
  55. data/xml/pop_banners.xml +32 -31
  56. data/xml/rsh_resp.xml +11 -2
  57. data/xml/rtsp_servers.xml +43 -23
  58. data/xml/sip_banners.xml +9 -14
  59. data/xml/sip_user_agents.xml +69 -3
  60. data/xml/smb_native_lm.xml +10 -2
  61. data/xml/smb_native_os.xml +80 -2
  62. data/xml/smtp_banners.xml +233 -13
  63. data/xml/smtp_debug.xml +6 -4
  64. data/xml/smtp_ehlo.xml +7 -5
  65. data/xml/smtp_expn.xml +13 -4
  66. data/xml/smtp_help.xml +23 -4
  67. data/xml/smtp_mailfrom.xml +5 -2
  68. data/xml/smtp_noop.xml +6 -5
  69. data/xml/smtp_quit.xml +5 -4
  70. data/xml/smtp_rcptto.xml +5 -2
  71. data/xml/smtp_rset.xml +4 -4
  72. data/xml/smtp_turn.xml +4 -4
  73. data/xml/smtp_vrfy.xml +14 -4
  74. data/xml/snmp_sysdescr.xml +776 -52
  75. data/xml/snmp_sysobjid.xml +47 -2
  76. data/xml/ssh_banners.xml +259 -80
  77. data/xml/telnet_banners.xml +376 -23
  78. data/xml/x11_banners.xml +27 -4
  79. data/xml/x509_issuers.xml +37 -13
  80. data/xml/x509_subjects.xml +525 -55
  81. metadata +29 -6
data/xml/http_wwwauth.xml CHANGED
@@ -1,6 +1,7 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="http_header.wwwauth" protocol="http" database_type="service" preference="0.85">
3
3
  <!-- HTTP WWW-Authenticate headers are matched against these patterns to fingerprint HTTP servers. -->
4
+
4
5
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;access&quot;$">
5
6
  <description>Cisco IOS 11.x</description>
6
7
  <example>Basic realm="access"</example>
@@ -18,6 +19,7 @@
18
19
  <param pos="0" name="hw.vendor" value="Cisco"/>
19
20
  <param pos="0" name="hw.device" value="Router"/>
20
21
  </fingerprint>
22
+
21
23
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]15[ _]or[ _]view[ _]access&quot;$">
22
24
  <description>Cisco IOS 12.x - view access variant</description>
23
25
  <example>Basic realm="level_15 or view_access"</example>
@@ -36,6 +38,7 @@
36
38
  <param pos="0" name="hw.vendor" value="Cisco"/>
37
39
  <param pos="0" name="hw.device" value="Router"/>
38
40
  </fingerprint>
41
+
39
42
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]\d\d?[ _]access&quot;$">
40
43
  <description>Cisco IOS 12.x</description>
41
44
  <example>Basic realm="level_15_access"</example>
@@ -54,11 +57,25 @@
54
57
  <param pos="0" name="hw.vendor" value="Cisco"/>
55
58
  <param pos="0" name="hw.device" value="Router"/>
56
59
  </fingerprint>
60
+
61
+ <fingerprint pattern="^Basic realm=&quot;(NetVanta [^&quot;]+)&quot;$" certainty="1.0">
62
+ <description>ADTRAN Netvanta Router</description>
63
+ <example hw.product="NetVanta 1238 PoE">Basic realm="NetVanta 1238 PoE"</example>
64
+ <param pos="0" name="os.device" value="Router"/>
65
+ <param pos="0" name="os.vendor" value="ADTRAN"/>
66
+ <param pos="0" name="os.family" value="NetVanta"/>
67
+ <param pos="0" name="hw.device" value="Router"/>
68
+ <param pos="0" name="hw.vendor" value="ADTRAN"/>
69
+ <param pos="0" name="hw.family" value="NetVanta"/>
70
+ <param pos="1" name="hw.product"/>
71
+ </fingerprint>
72
+
57
73
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;.*$">
58
74
  <description>Generic Cisco CWMP/CPE equipment</description>
59
75
  <example>Basic realm="Cisco_CCSP_CWMP_TCPCR"</example>
60
76
  <param pos="0" name="hw.vendor" value="Cisco"/>
61
77
  </fingerprint>
78
+
62
79
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;FW-1. Reason: no user Server &quot;$">
63
80
  <description>Check Point FireWall-1</description>
64
81
  <example>Basic realm="FW-1. Reason: no user Server "</example>
@@ -71,12 +88,15 @@
71
88
  <param pos="0" name="os.family" value="Firewall-1"/>
72
89
  <param pos="0" name="os.product" value="Firewall-1"/>
73
90
  </fingerprint>
91
+
74
92
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;.*">
75
93
  <description>cPanel</description>
76
94
  <example>Basic realm="cPanel"</example>
77
95
  <param pos="0" name="service.vendor" value="cPanel"/>
78
96
  <param pos="0" name="service.product" value="cPanel"/>
97
+ <param pos="0" name="service.cpe23" value="cpe:/a:cpanel:cpanel:-"/>
79
98
  </fingerprint>
99
+
80
100
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;APC Management Card&quot;$">
81
101
  <description>APC device</description>
82
102
  <example>Basic realm="APC Management Card"</example>
@@ -85,6 +105,7 @@
85
105
  <param pos="0" name="os.vendor" value="APC"/>
86
106
  <param pos="0" name="os.device" value="Power device"/>
87
107
  </fingerprint>
108
+
88
109
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
89
110
  <description>Generic ADSL modems/routers</description>
90
111
  <example>Basic realm="ADSL Modem"</example>
@@ -93,22 +114,27 @@
93
114
  <example>Basic realm="ADSL2+ Router"</example>
94
115
  <param pos="0" name="hw.device" value="ADSL Modem"/>
95
116
  </fingerprint>
117
+
96
118
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;.*$">
97
119
  <description>Generic Broadband modems/routers</description>
98
120
  <example>Basic realm="Broadband Router"</example>
99
121
  <param pos="0" name="hw.device" value="Broadband router"/>
100
122
  </fingerprint>
123
+
101
124
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
102
125
  <description>Generic DSL modems/routers</description>
103
126
  <example>Basic realm="DSL Modem"</example>
104
127
  <param pos="0" name="hw.device" value="DSL Modem"/>
105
128
  </fingerprint>
129
+
106
130
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;.*$">
107
131
  <description>Generic DVR</description>
108
132
  <example>Basic realm="DVR"</example>
109
133
  <param pos="0" name="hw.device" value="DVR"/>
110
134
  </fingerprint>
135
+
111
136
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
137
+
112
138
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;.*$">
113
139
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
114
140
  <example>Basic realm="hikvision"</example>
@@ -116,19 +142,23 @@
116
142
  <param pos="0" name="service.product" value="Hikvision Web Server"/>
117
143
  <param pos="0" name="os.vendor" value="Hikvision"/>
118
144
  <param pos="0" name="os.device" value="DVR"/>
145
+ <param pos="0" name="hw.vendor" value="Hikvision"/>
119
146
  <param pos="0" name="hw.device" value="DVR"/>
120
147
  </fingerprint>
148
+
121
149
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;.*$">
122
150
  <description>Merit LILIN generic device</description>
123
151
  <example>Basic realm="Merit LILIN Ent. Co., Ltd,"</example>
124
152
  <example>Basic realm="Merit LILIN Ent. Co., Ltd."</example>
125
153
  <param pos="0" name="hw.vendor" value="Merit LILIN"/>
126
154
  </fingerprint>
155
+
127
156
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;.*$">
128
157
  <description>Generic WAP</description>
129
158
  <example>Basic realm="Wireless Access Point"</example>
130
159
  <param pos="0" name="hw.device" value="WAP"/>
131
160
  </fingerprint>
161
+
132
162
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;.*$">
133
163
  <description>Generic IP Cameras</description>
134
164
  <example>Basic realm="camera"</example>
@@ -136,6 +166,7 @@
136
166
  <example>Basic realm="Mini Dome IP Camera"</example>
137
167
  <param pos="0" name="hw.device" value="Web cam"/>
138
168
  </fingerprint>
169
+
139
170
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
140
171
  <description>D-Link DCS IP Cameras</description>
141
172
  <example hw.product="DCS-5222LB1">Basic realm="DCS-5222LB1"</example>
@@ -144,6 +175,7 @@
144
175
  <param pos="0" name="hw.device" value="Web cam"/>
145
176
  <param pos="1" name="hw.product"/>
146
177
  </fingerprint>
178
+
147
179
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
148
180
  <description>GoAhead webserver</description>
149
181
  <example>Basic realm="GoAhead"</example>
@@ -151,25 +183,19 @@
151
183
  <param pos="0" name="service.product" value="GoAhead Webserver"/>
152
184
  <param pos="0" name="service.family" value="GoAhead Webserver"/>
153
185
  </fingerprint>
186
+
154
187
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
155
188
  <description>Kubernetes master nodes</description>
156
189
  <example>Basic realm="kubernetes-master"</example>
157
190
  <param pos="0" name="service.vendor" value="Kubernetes"/>
158
191
  </fingerprint>
159
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
160
- <description>Netgear Orbi</description>
161
- <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
162
- <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
163
- <param pos="0" name="hw.vendor" value="Netgear"/>
164
- <param pos="0" name="hw.device" value="WAP"/>
165
- <param pos="0" name="hw.family" value="Orbi"/>
166
- <param pos="1" name="hw.product"/>
167
- </fingerprint>
192
+
168
193
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
169
194
  <description>Ruijie Networks generic</description>
170
195
  <example>Digest realm="RUIJIE-CPE"</example>
171
196
  <param pos="0" name="hw.vendor" value="Ruijie"/>
172
197
  </fingerprint>
198
+
173
199
  <fingerprint pattern="^Basic realm=&quot;SpeedTouch&quot;$">
174
200
  <description>Thomson SpeedTouch xDSL router - short variant</description>
175
201
  <example>Basic realm="SpeedTouch"</example>
@@ -183,6 +209,7 @@
183
209
  <param pos="0" name="hw.family" value="SpeedTouch"/>
184
210
  <param pos="0" name="hw.device" value="Broadband router"/>
185
211
  </fingerprint>
212
+
186
213
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch \(([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2})\)&quot;$">
187
214
  <description>Thomson SpeedTouch xDSL router</description>
188
215
  <example host.mac="00-90-D0-F9-91-52">Basic realm="SpeedTouch (00-90-D0-F9-91-52)"</example>
@@ -198,10 +225,12 @@
198
225
  <param pos="0" name="hw.device" value="Broadband router"/>
199
226
  <param pos="1" name="host.mac"/>
200
227
  </fingerprint>
228
+
201
229
  <!--
202
230
  Really need some examples for the fingerprints below. The regex and params
203
231
  imply that the nonce inlcudes the MAC address.
204
232
  -->
233
+
205
234
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
206
235
  <description>Thomson SpeedTouch xDSL router - qop variant</description>
207
236
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -216,6 +245,7 @@
216
245
  <param pos="0" name="hw.device" value="Broadband router"/>
217
246
  <param pos="1" name="host.mac"/>
218
247
  </fingerprint>
248
+
219
249
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ST (\d+) R 5.x Telecom Italia&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
220
250
  <description>Thomson SpeedTouch xDSL router - Telecom Italia</description>
221
251
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -230,6 +260,7 @@
230
260
  <param pos="1" name="os.product"/>
231
261
  <param pos="2" name="host.mac"/>
232
262
  </fingerprint>
263
+
233
264
  <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;.*$">
234
265
  <description>Thomson generic devices</description>
235
266
  <example>Digest realm="Thomson Gateway"</example>
@@ -237,6 +268,7 @@
237
268
  <param pos="0" name="hw.vendor" value="Thomson"/>
238
269
  <param pos="0" name="hw.device" value="Broadband router"/>
239
270
  </fingerprint>
271
+
240
272
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
241
273
  <description>Huawei xDSL routers</description>
242
274
  <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
@@ -252,6 +284,7 @@
252
284
  <param pos="0" name="hw.family" value="MT"/>
253
285
  <param pos="1" name="hw.product"/>
254
286
  </fingerprint>
287
+
255
288
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;.*$">
256
289
  <description>Huawei Home Gateway Routers</description>
257
290
  <example>Basic realm="HuaweiHomeGateway"</example>
@@ -259,6 +292,7 @@
259
292
  <param pos="0" name="hw.device" value="Broadband router"/>
260
293
  <param pos="0" name="hw.product" value="Home Gateway"/>
261
294
  </fingerprint>
295
+
262
296
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;.*$">
263
297
  <description>Huawei EchoLife Home Gateways</description>
264
298
  <example>Basic realm="EchoLife Portal de Inicio"</example>
@@ -267,6 +301,7 @@
267
301
  <param pos="0" name="hw.device" value="Broadband router"/>
268
302
  <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
269
303
  </fingerprint>
304
+
270
305
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
271
306
  <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
272
307
  <example hw.product="WRT54G">Basic realm="WRT54G"</example>
@@ -280,6 +315,7 @@
280
315
  <param pos="0" name="hw.device" value="WAP"/>
281
316
  <param pos="1" name="hw.product"/>
282
317
  </fingerprint>
318
+
283
319
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
284
320
  <description>TP-LINK SoHo Router - dash variant</description>
285
321
  <example>Basic realm="TD-W8901G"</example>
@@ -289,6 +325,7 @@
289
325
  <param pos="0" name="os.device" value="Router"/>
290
326
  <param pos="1" name="os.product"/>
291
327
  </fingerprint>
328
+
292
329
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
293
330
  <description>TP-LINK SoHo Router</description>
294
331
  <example>Basic realm="TD854W"</example>
@@ -299,6 +336,7 @@
299
336
  <param pos="0" name="os.device" value="Router"/>
300
337
  <param pos="1" name="os.product"/>
301
338
  </fingerprint>
339
+
302
340
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
303
341
  <description>TP-LINK SoHo Router - verbose variant</description>
304
342
  <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
@@ -321,27 +359,31 @@
321
359
  <param pos="0" name="os.device" value="WAP"/>
322
360
  <param pos="1" name="os.product"/>
323
361
  </fingerprint>
362
+
324
363
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
325
364
  <description>TP-LINK Routers</description>
326
365
  <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
327
366
  <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
328
367
  <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
329
- <param pos="0" name="hw.vendor" value="TP-Link"/>
368
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
330
369
  <param pos="0" name="hw.device" value="Router"/>
331
370
  <param pos="1" name="hw.product"/>
332
371
  </fingerprint>
372
+
333
373
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;.*$">
334
374
  <description>TP-LINK IP-Cameras</description>
335
375
  <example>Basic realm="TP-LINK IP-Camera"</example>
336
- <param pos="0" name="hw.vendor" value="TP-Link"/>
376
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
337
377
  <param pos="0" name="hw.device" value="Web cam"/>
338
378
  </fingerprint>
379
+
339
380
  <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
340
381
  <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>
341
382
  <example>Digest qop="auth", realm="Broadcom Management Service", nonce="AAAAAAAAAAAAAP//DwHpMwYy1zc=", algorithm="MD5"</example>
342
383
  <param pos="0" name="service.vendor" value="Broadcom"/>
343
384
  <param pos="0" name="service.product" value="Management Service"/>
344
385
  </fingerprint>
386
+
345
387
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;.*$">
346
388
  <description>Samba Web Administration Tool (SWAT)</description>
347
389
  <example>Basic realm="SWAT"</example>
@@ -349,6 +391,7 @@
349
391
  <param pos="0" name="service.family" value="Samba"/>
350
392
  <param pos="0" name="service.product" value="SWAT"/>
351
393
  </fingerprint>
394
+
352
395
  <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
353
396
  <description>SPIP publishing system (www.spip.net)</description>
354
397
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
@@ -356,6 +399,7 @@
356
399
  <param pos="0" name="service.product" value="SPIP"/>
357
400
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
358
401
  </fingerprint>
402
+
359
403
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
360
404
  <description>HP Instant Support Enterprise Edition with a hostname</description>
361
405
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
@@ -363,6 +407,7 @@
363
407
  <param pos="0" name="service.product" value="ISEE"/>
364
408
  <param pos="1" name="host.name"/>
365
409
  </fingerprint>
410
+
366
411
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
367
412
  <description>Generic F5 Big-IP</description>
368
413
  <example>Basic realm="BIG-IP"</example>
@@ -371,7 +416,9 @@
371
416
  <param pos="0" name="service.product" value="BIG-IP LTM"/>
372
417
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
373
418
  </fingerprint>
419
+
374
420
  <!-- HP ProCurve -->
421
+
375
422
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[3]\d{3}A)&quot;$">
376
423
  <description>HP ProCurve Hubs</description>
377
424
  <example os.product="J3295A">Basic realm="HP J3295A"</example>
@@ -380,6 +427,7 @@
380
427
  <param pos="0" name="os.device" value="Hub"/>
381
428
  <param pos="1" name="os.product"/>
382
429
  </fingerprint>
430
+
383
431
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[489]\d{3}A)&quot;$">
384
432
  <description>HP ProCurve Switches</description>
385
433
  <example os.product="J4110A">Basic realm="HP J4110A"</example>
@@ -391,11 +439,13 @@
391
439
  <param pos="0" name="os.device" value="Switch"/>
392
440
  <param pos="1" name="os.product"/>
393
441
  </fingerprint>
442
+
394
443
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;.*$">
395
444
  <description>Assorted Sercomm CPE devices</description>
396
445
  <example>Digest realm="SERCOMM CPE Authentication"</example>
397
446
  <param pos="0" name="hw.vendor" value="Sercomm"/>
398
447
  </fingerprint>
448
+
399
449
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;.*$">
400
450
  <description>Tivo DVR</description>
401
451
  <example>Digest realm="TiVo DVR"</example>
@@ -403,12 +453,14 @@
403
453
  <param pos="0" name="hw.family" value="DVR"/>
404
454
  <param pos="0" name="hw.device" value="DVR"/>
405
455
  </fingerprint>
456
+
406
457
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;.*$">
407
458
  <description>Ubee Cable Modems</description>
408
459
  <example>Digest qop="auth", realm="Ubee", nonce="1544738973"</example>
409
460
  <param pos="0" name="hw.vendor" value="Ubee"/>
410
461
  <param pos="0" name="hw.device" value="Broadband router"/>
411
462
  </fingerprint>
463
+
412
464
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;XDB&quot;$">
413
465
  <description>Web server providing web services for Oracle's XML DB.</description>
414
466
  <example>Basic realm="XDB"</example>
@@ -416,11 +468,13 @@
416
468
  <param pos="0" name="service.product" value="XML DB"/>
417
469
  <param pos="0" name="service.family" value="Oracle"/>
418
470
  </fingerprint>
471
+
419
472
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;.*$">
420
473
  <description>Assorted ZTE CPE devices</description>
421
474
  <example>Digest realm="cpe@zte.com"</example>
422
475
  <param pos="0" name="hw.vendor" value="ZTE"/>
423
476
  </fingerprint>
477
+
424
478
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;.*$">
425
479
  <description>ZTE ZXHN router</description>
426
480
  <example>Basic realm="ZXHN H108L"</example>
@@ -429,6 +483,7 @@
429
483
  <param pos="0" name="hw.family" value="ZXHN"/>
430
484
  <param pos="1" name="hw.product"/>
431
485
  </fingerprint>
486
+
432
487
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;.*$">
433
488
  <description>ZTE ZXV router</description>
434
489
  <example hw.product="ZXV10 W300">Basic realm="ZXV10 W300"</example>
@@ -437,20 +492,98 @@
437
492
  <param pos="0" name="hw.family" value="ZXV"/>
438
493
  <param pos="1" name="hw.product"/>
439
494
  </fingerprint>
495
+
496
+ <fingerprint pattern="(?i)^(?:Basic|Digest)\s+realm=&quot;Siqura&quot;$">
497
+ <description>Siqura Video Encoder</description>
498
+ <example>Basic realm="Siqura"</example>
499
+ <param pos="0" name="os.vendor" value="Siqura"/>
500
+ <param pos="0" name="os.family" value="Linux"/>
501
+ <param pos="0" name="hw.vendor" value="Siqura"/>
502
+ <param pos="0" name="hw.device" value="Video Encoder"/>
503
+ </fingerprint>
504
+
505
+ <fingerprint pattern="^Digest realm=&quot;(Orbit-351)&quot;">
506
+ <description>Steinsvik Orbit 351 IP Camera (Truen TCAM Rebrand)</description>
507
+ <example hw.product="Orbit-351">Digest realm="Orbit-351", nonce="0000040dY892418598785d2a2304a74adf22f6098f2792", stale=FALSE</example>
508
+ <param pos="0" name="hw.vendor" value="Steinsvik"/>
509
+ <param pos="0" name="hw.device" value="Web cam"/>
510
+ <param pos="1" name="hw.product"/>
511
+ <param pos="0" name="os.vendor" value="Steinsvik"/>
512
+ <param pos="0" name="os.family" value="Linux"/>
513
+ <param pos="0" name="os.product" value="Linux"/>
514
+ </fingerprint>
515
+
516
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
517
+ <description>Netgear Orbi</description>
518
+ <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
519
+ <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
520
+ <example hw.product="Orbi-mini">Basic realm="NETGEAR Orbi-mini"</example>
521
+ <param pos="0" name="hw.vendor" value="Netgear"/>
522
+ <param pos="0" name="hw.device" value="WAP"/>
523
+ <param pos="0" name="hw.family" value="Orbi"/>
524
+ <param pos="1" name="hw.product"/>
525
+ </fingerprint>
526
+
527
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;.*$">
528
+ <description>Netgear Routers</description>
529
+ <example hw.product="DG834">Basic realm="NETGEAR DG834 "</example>
530
+ <example hw.product="C7000v2">Basic realm="NETGEAR C7000v2"</example>
531
+ <example hw.product="R7000P">Basic realm="NETGEAR R7000P"</example>
532
+ <param pos="0" name="hw.vendor" value="Netgear"/>
533
+ <param pos="0" name="hw.device" value="Router"/>
534
+ <param pos="1" name="hw.product"/>
535
+ </fingerprint>
536
+
537
+ <!-- Fallback to the most generic Netgear match -->
538
+
539
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;.*$">
540
+ <description>Netgear Unspecified Router</description>
541
+ <example>Basic realm="Netgear"</example>
542
+ <param pos="0" name="hw.vendor" value="Netgear"/>
543
+ <param pos="0" name="hw.device" value="Router"/>
544
+ </fingerprint>
545
+
546
+ <!-- This fingerprint is suspect, as it's missing the Basic/Digest qualifier -->
547
+
548
+ <fingerprint pattern="^(?:NETGEAR|NetGear) Router ([a-zA-Z0-9\-\+]+)$">
549
+ <description>Netgear Routers w/o Authentication Type</description>
550
+ <example hw.product="WNR2000v4">NETGEAR Router WNR2000v4</example>
551
+ <example hw.product="R6100">NETGEAR Router R6100</example>
552
+ <param pos="0" name="hw.vendor" value="Netgear"/>
553
+ <param pos="0" name="hw.device" value="Router"/>
554
+ <param pos="1" name="hw.product"/>
555
+ </fingerprint>
556
+
557
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
558
+ <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
559
+ <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
560
+ <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
561
+ <param pos="0" name="service.product" value="RemoteView"/>
562
+ <param pos="0" name="service.family" value="RemoteView"/>
563
+ <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
564
+ <param pos="0" name="hw.family" value="Primergy"/>
565
+ <param pos="0" name="hw.product" value="Primergy"/>
566
+ <param pos="1" name="host.name"/>
567
+ </fingerprint>
568
+
440
569
  <!-- a variety of headers we currently just ignore -->
570
+
441
571
  <fingerprint pattern="(?i)^NTLM$">
442
572
  <description>Ignore NTLM-only</description>
443
573
  <example>NTLM</example>
444
574
  <example>Ntlm</example>
445
575
  </fingerprint>
576
+
446
577
  <fingerprint pattern="^Negotiate$">
447
578
  <description>Ignore Negotiate-only</description>
448
579
  <example>Negotiate</example>
449
580
  </fingerprint>
450
- <!--
581
+
582
+ <!--
451
583
  Using a wildcard . instead of ['&quot;] in the following line will result in
452
584
  this fingerprint matching examples from other fingerprints.
453
585
  -->
586
+
454
587
  <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
455
588
  <description>Ignore null/empty/period/index.</description>
456
589
  <example>Basic realm="null"</example>
@@ -460,37 +593,30 @@
460
593
  <example>Basic realm='/'</example>
461
594
  <example>Basic realm="index.html"</example>
462
595
  </fingerprint>
596
+
463
597
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;.*$">
464
598
  <description>Ignore realms with an IPv4 address</description>
465
599
  <example>Basic realm="192.168.0.1"</example>
466
600
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
467
601
  </fingerprint>
602
+
468
603
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;.*$">
469
604
  <description>Ignore generic 'config' realms</description>
470
605
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
471
606
  </fingerprint>
472
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
473
- <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
474
- <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
475
- <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
476
- <param pos="0" name="service.product" value="RemoteView"/>
477
- <param pos="0" name="service.family" value="RemoteView"/>
478
- <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
479
- <param pos="0" name="hw.family" value="Primergy"/>
480
- <param pos="0" name="hw.product" value="Primergy"/>
481
- <param pos="1" name="host.name"/>
482
- </fingerprint>
607
+
483
608
  <!--
484
609
  Temporarily disable this version-less fingerprint because it overrode the
485
610
  one in http_servers.xml (see NEX-1255).
486
-
487
611
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Lyris ListManager: enter email address and password&quot;$">
488
612
  <description>Lyris ListManager</description>
489
613
  <example>Basic realm="Lyris ListManager: enter email address and password"</example>
490
614
  <param pos="0" name="service.vendor" value="Lyris"/>
491
615
  <param pos="0" name="service.product" value="ListManager"/>
492
616
  </fingerprint>
617
+
493
618
  -->
619
+
494
620
  <!--
495
621
  Basic realm= StarVoice
496
622
  Basic realm="802.11g Remote-Motion CCD Network Camera"
@@ -538,7 +664,6 @@ Basic realm="Login to Vigor 3300"
538
664
  Basic realm="Login"
539
665
  Basic realm="MR314"
540
666
  Basic realm="NetComm NB1300"
541
- Basic realm="NETGEAR DG834 "
542
667
  Basic realm="NetLinx"
543
668
  Basic realm="Netopia-2000"
544
669
  Basic realm="Netopia-3000"
@@ -578,7 +703,9 @@ Digest realm="HiPER", domain="222.66.99.209", qop="auth", nonce="aa81b6584c4716f
578
703
  Digest realm="i3micro VRG", nonce="1186428394", qop="auth", algorithm=MD5
579
704
  Digest realm="WatchGuard SOHO Configuration",qop="auth",nonce="7c8e98007db668881687bd538e6e8581"
580
705
  -->
706
+
581
707
  <!-- This is in various PHP coding examples, but is not a reliable FP source:
582
708
  Basic realm="User Login"
583
709
  -->
584
- </fingerprints>
710
+
711
+ </fingerprints>