recog 2.3.7 → 2.3.12

data/cpe-remap.yaml

@@ -1,4 +1,6 @@
 mappings:
+  alpine:
+    vendor: alpinelinux
   apache:
     vendor: apache
     products:
@@ -14,6 +16,10 @@ mappings:
       weblogic: weblogic_server
   blue_coat:
     vendor: bluecoat
+  carnegie_mellon_university:
+    vendor: cmu
+    products:
+      cyrus_imap: cyrus_imap_server
   centos:
     vendor: centos
     products:
@@ -30,6 +36,9 @@ mappings:
     vendor: debian
     products:
       linux: debian_linux
+  embedthis:
+    products:
+       goahead_webserver: goahead
   f5:
     vendor: f5
     products:
@@ -39,16 +48,26 @@ mappings:
     vendor: hp
     products:
       ilo: integrated_lights_out
-      lotus_domino: lotus_domino_server
       tru64_unix: tru64
   ibm:
     vendor: ibm
     products:
       lotus_domino: lotus_domino_server
+      ibm_domino: lotus_domino
+      os/400: os_400
+  jamf:
+    products:
+      jamf_pro: jamf
   juniper:
     vendor: juniper
     products:
       junos_os: junos
+  kibana:
+    vendor: elasticsearch
+  cz.nic:
+    vendor: knot-dns
+  litespeed_technologies:
+    vendor: litespeedtech
   linux:
     vendor: linux
     products:
@@ -86,6 +105,10 @@ mappings:
     vendor: modwsgi
   mort_bay:
     vendor: mortbay
+  nlnet_labs:
+    vendor: nlnetlabs
+    products:
+      dnsd: name_server_daemon
   net-snmp:
     vendor: net-snmp
     products:
@@ -94,6 +117,11 @@ mappings:
     vendor: paloaltonetworks
     products:
       pa_firewall: pan-os
+  parallels:
+    products:
+      plesk: parallels_plesk_panel
+  plesk:
+    vendor: parallels
   proftpd_project:
     vendor: proftpd
   realvnc_ltd.:
@@ -113,6 +141,13 @@ mappings:
     vendor: sun
     products:
       solaris: sunos
+  tandberg:
+    vendor: cisco
+  tightvnc:
+    products:
+      desktop: tightvnc
+  ubiquiti:
+    vendor: ui
   ubuntu:
     vendor: canonical
     products:

data/features/match.feature

@@ -1,4 +1,5 @@
 Feature: Match
+  @no-clobber
   Scenario: Finds matches
     When I run `recog_match matching_banners_fingerprints.xml sample_banner.txt`
     Then it should pass with:
@@ -7,6 +8,7 @@ Feature: Match
       MATCH: {"matched"=>"SunOS/Solaris", "os.vendor"=>"Sun", "os.family"=>"Solaris", "os.product"=>"Solaris", "os.device"=>"General", "host.name"=>"polaris", "os.version"=>"5.8", "service.protocol"=>"ftp", "fingerprint_db"=>"matching_banners_fingerprints", "data"=>"polaris FTP server (SunOS 5.8) ready."}
       """
 
+  @no-clobber
   Scenario: Fails at finding matches
     When I run `recog_match failing_banners_fingerprints.xml sample_banner.txt`
     Then it should pass with:
@@ -15,6 +17,7 @@ Feature: Match
       FAIL: polaris FTP server (SunOS 5.8) ready
       """
 
+  @no-clobber
   Scenario: Finds multiple matches
     When I run `recog_match multiple_banners_fingerprints.xml sample_banner.txt --multi-match`
     Then it should pass with:
@@ -23,6 +26,7 @@ Feature: Match
       MATCHES: {"matched"=>"Generic FTP, Checks for the existence of the word FTP in the line", "service.protocol"=>"", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"polaris FTP server (SunOS 5.8) ready."},{"matched"=>"SunOS/Solaris", "service.protocol"=>"ftp", "os.vendor"=>"Sun", "os.family"=>"Solaris", "os.product"=>"Solaris", "os.device"=>"General", "host.name"=>"polaris", "os.version"=>"5.8", "fingerprint_db"=>"multiple_banners_fingerprints", "data"=>"polaris FTP server (SunOS 5.8) ready."}
       """
 
+  @no-clobber
   Scenario: Finds first matches using no-multi-match flag
     When I run `recog_match multiple_banners_fingerprints.xml sample_banner.txt --no-multi-match`
     Then it should pass with:

data/features/support/aruba.rb

@@ -0,0 +1,3 @@
+Aruba.configure do |config|
+  config.working_directory = 'features/data'
+end

data/features/verify.feature

@@ -1,4 +1,5 @@
 Feature: Verify
+  @no-clobber
   Scenario: No tests
     When I run `recog_verify no_tests.xml`
     Then it should pass with:
@@ -6,6 +7,7 @@ Feature: Verify
       SUMMARY: Test completed with 0 successful, 0 warnings, and 0 failures
       """
 
+  @no-clobber
   Scenario: Successful tests
     When I run `recog_verify successful_tests.xml`
     Then it should pass with:
@@ -13,6 +15,7 @@ Feature: Verify
       SUMMARY: Test completed with 4 successful, 0 warnings, and 0 failures
       """
 
+  @no-clobber
   Scenario: Tests with warnings, warnings enabled
     When I run `recog_verify tests_with_warnings.xml`
     Then it should fail with:
@@ -23,6 +26,7 @@ Feature: Verify
       """
     And the exit status should be 2
 
+  @no-clobber
   Scenario: Tests with warnings, warnings disabled
     When I run `recog_verify --no-warnings tests_with_warnings.xml`
     Then it should pass with:
@@ -30,6 +34,7 @@ Feature: Verify
       SUMMARY: Test completed with 1 successful, 0 warnings, and 0 failures
       """
 
+  @no-clobber
   Scenario: Tests with failures
     When I run `recog_verify tests_with_failures.xml`
     Then it should fail with:

data/identifiers/README.md

@@ -0,0 +1,56 @@
+# Recog: Identifiers
+
+This directory contains lists of standard identifiers for mapping Recog matches. The goal is define a standard set of constants to represent known software, hardware, vendors, and categories.
+
+This is currently incomplete and will be updated as standardization work moves forward.
+
+Fingerprints should use these identifiers whenever possible; if a different name or syntax for a given identifier is preferred, this should be implemented in the application through a mapping function.
+
+## Lists
+
+### Vendors
+
+`vendor.txt` defines known vendor names, covering services, operating systems, and hardware.
+
+### Operating Systems
+
+`os_architecture.txt` defines known CPU types.
+
+`os_product.txt` defines known operating system names.
+
+`os_family.txt` defines known operating system families.
+
+`os_device.txt` defines known types of devices by function or purpose.
+
+
+### Hardware
+
+`hw_product.txt` defines known hardware product names.
+
+`hw_family.txt` defines known hardware product families.
+
+`hw_device.txt` defines known types of devices by function or purpose (overlaps with `os_device.txt`).
+
+### Services
+
+`service_product.txt` defines known service product names.
+
+`service_family.txt` defines known service product families.
+
+### Software
+
+`software_product.txt` defines known software product names.
+
+`software_family.txt` defines known software product families.
+
+`software_class.txt` defines known types of software by function or purpose.
+
+## Pending Work
+
+  * All existing fingerprints should be correlated against these lists to identify mismatches and updated accordingly.
+
+  * All net new identifiers from the existing fingerprints should be merged into these lists.
+
+  * All fingerprint assertions should be enumerated, documented, and standardized where possible (`host.mac`, etc).
+
+  * Hardware identifiers should be enumerated, consolidated, and standardized.

data/identifiers/hw_device.txt

@@ -0,0 +1,77 @@
+ADSL Modem
+AV Receiver
+Access Control
+Alarm Panel
+Appliance
+Audio Encoder
+Broadband router
+Building Automation
+Cable Modem
+Check Scanner
+DOCSIS Cable Modem
+DSL Modem
+DVR
+Data Terminal
+Desktop
+Device
+Device Hub
+Device Server
+Display Controller
+Environment Control
+Ethernet Adapter
+Firewall
+HMI Controller
+Handheld Scanner
+IP Camera
+IPS
+Industrial Control
+JTAG Adapter
+KVM
+Laptop
+Light Bulb
+Lights Out Management
+Media Receiver
+Media Server
+Mobile Phone
+Monitoring
+Multifunction Device
+NAS
+Network Appliance
+Network Audio
+Network Management Device
+PLC
+Power Relay
+Power device
+Powerline
+Print server
+Printer
+Router
+SD-WAN Appliance
+SIP Device
+SIP Gateway
+Scanner
+Security Appliance
+Smart TV
+Storage
+Storage Appliance
+Support Appliance
+Switch
+Tablet
+Tape Library
+Telecom
+Test Instrument
+VPN
+Video Conference
+Video Conferencing
+Video Decoder
+Video Encoder
+VoIP
+VoIP Server
+VoIP Switch
+Voice Appliance
+WAP
+WLAN Repeater
+Web cam
+Whiteboard
+Wireless Controller
+Wireless Presenter

data/identifiers/hw_family.txt

@@ -0,0 +1,96 @@
+AR Series
+Adaptive Security Appliance
+Aficio
+AirPort
+Apple TV
+Communication Manager
+DVR
+DiskStation
+Document Centre
+Extended Systems ExtendNet
+FRITZ!Box
+FRITZ!Powerline
+FRITZ!WLAN Repeater
+FS
+Firewall-1
+Forms Printer
+FortiGate
+GW25
+GXV
+GXW
+HDX
+HandyTone
+HomePod
+Honeywell
+ILOM
+IMDVR
+ION
+JetDirect
+LaserJet
+LinkCom Xpress
+MGate
+MPEG4 DVR
+MT
+MX Series
+Mac mini
+MacBook
+MacBook Pro
+MegaRAC
+Multifunction
+My Book
+NE
+NPort
+NetVanta
+Network Audio
+Network Video Door Station
+Optra
+Orbi
+POWER System
+Phaser
+Primergy
+Pro Series
+RMX
+ReadyNAS
+RealPresence
+RealPresence Group
+Router
+S500 Range
+SIP Device
+SIP Gateway
+Service Access Switch
+Service Router
+SoundPoint
+SoundTouch
+SpeedTouch
+Speedport
+Storage
+Sun Fire
+Sunny
+Switch
+System X
+TASKalfa
+TelePresence
+Time Capsule
+TippingPoint
+Turbo Station
+UniFi
+Unified Security Gateway
+VSX
+VoIP
+WD2GO
+WiMax
+Wide Format
+Wide Format Printer
+WorkCentre
+WorkCentre Pro
+Xserve
+ZXDSL
+ZXHN
+ZXV
+iLO
+iMac
+iPad
+iPad Air
+iPad Pro
+iPad mini
+iPhone

data/identifiers/hw_product.txt

@@ -0,0 +1,328 @@
+33220A Waveform Generator
+33521A Waveform Generator
+34972A Data Logger
+3PAR
+53230A Frequency Counter
+ADB-4820CD
+APIC
+AV Receiver
+AVC787
+Access Gateway
+Access Point
+Adaptive Security Appliance
+AirPort Express
+AirPort Extreme
+AppDynamics
+Apple TV (2nd generation)
+Apple TV (3rd generation)
+Apple TV (4th generation)
+Apple TV 4K
+Appliance
+ArchiveTeam Warrior
+Asset Management
+AutoVu SharpV
+BladeSystem Onboard Administrator
+Border GW
+Bridge
+CC EtherNet/IP
+CP
+Camera
+Captive Portal
+CarDetector
+Catalyst
+Catalyst 1900
+Celerra
+Chromecast
+ClickShare
+CloudKey
+CommandPost
+ConnectUPS Web Card
+Crosswork SON Appliance
+DD OS
+DNA Center
+DSL Router
+Digital Signage Player
+Discover
+Discovery
+Document Centre
+DuraFon
+ECOM100
+EP-series
+EXA Signal Analyzer
+Eagle Eye Director II
+EchoLife Home Gateway
+EdgeSwitch
+Elevation
+EqualLogic
+Ethernet Relay Module
+Excella
+Fastmark M5
+Fiber Network Box
+Firepower
+Firewall
+Firewall-1
+FlexiPacket Hub
+FortiMail
+FortiManager
+GigaVUE
+HDHomeRun
+HDIPCam
+HDX {hw.model}
+HiPer Access Router Card
+Home Controller
+Home Gateway
+HomePod
+Hue
+IA Appliance
+IAM
+IBHLink S7++
+ILOM
+IMC
+IP Camera
+IP Link Control Processor
+IP2IR
+IPMI
+IVR
+IntelliSlot Web Card
+Internet Payment Gateway
+Internet Phone Adapter
+Isilon InsightIQ
+Isilon OneFS
+J-Link Pro
+J9155A
+JetDirect
+K1000
+KWS-1043N
+Key Management
+Lantick Ethernet Relay Controller
+Lencore Sound Manager 2
+MDS 9000
+MXA Signal Analyzer
+Mac Pro (Early 2008)
+Mac Pro (Early 2009)
+Mac Pro (Late 2013)
+Mac Pro (Late 2019)
+Mac Pro (Mid 2006)
+Mac Pro (Mid 2007)
+Mac Pro (Mid 2012)
+Mac mini (Late 2009)
+Mac mini (Late 2012)
+Mac mini (Late 2014)
+Mac mini (Late 2018)
+Mac mini (Mid 2007)
+Mac mini (Mid 2010)
+Mac mini (Mid 2011)
+MacBook (13-inch, Mid 2010)
+MacBook (Retina, 12-inch, 2017)
+MacBook (Retina, 12-inch, Early 2015)
+MacBook (Retina, 12-inch, Early 2016)
+MacBook Air (11-inch, Early 2014)
+MacBook Air (11-inch, Early 2015)
+MacBook Air (11-inch, Late 2010)
+MacBook Air (11-inch, Mid 2011)
+MacBook Air (11-inch, Mid 2012)
+MacBook Air (13-inch, 2017)
+MacBook Air (13-inch, Early 2014)
+MacBook Air (13-inch, Late 2010)
+MacBook Air (13-inch, Mid 2011)
+MacBook Air (13-inch, Mid 2012)
+MacBook Air (Mid 2009)
+MacBook Air (Retina, 13-inch, 2018)
+MacBook Air (Retina, 13-inch, 2019)
+MacBook Pro (13-inch, 2016, Four Thunderbolt 3 ports)
+MacBook Pro (13-inch, 2016, Two Thunderbolt 3 ports)
+MacBook Pro (13-inch, 2017, Four Thunderbolt 3 ports)
+MacBook Pro (13-inch, 2017, Two Thunderbolt 3 ports)
+MacBook Pro (13-inch, 2018, Four Thunderbolt 3 ports)
+MacBook Pro (13-inch, 2019, Two Thunderbolt 3 ports)
+MacBook Pro (13-inch, Late 2011)
+MacBook Pro (13-inch, Mid 2009)
+MacBook Pro (13-inch, Mid 2010)
+MacBook Pro (13-inch, Mid 2012)
+MacBook Pro (15-inch, 2016)
+MacBook Pro (15-inch, 2017)
+MacBook Pro (15-inch, 2018)
+MacBook Pro (15-inch, 2019)
+MacBook Pro (15-inch, Late 2008)
+MacBook Pro (15-inch, Late 2011)
+MacBook Pro (15-inch, Mid 2009)
+MacBook Pro (15-inch, Mid 2010)
+MacBook Pro (17-inch, Early 2008)
+MacBook Pro (17-inch, Late 2011)
+MacBook Pro (17-inch, Mid 2009)
+MacBook Pro (17-inch, Mid 2010)
+MacBook Pro (Retina, 13-inch, Early 2013)
+MacBook Pro (Retina, 13-inch, Early 2015)
+MacBook Pro (Retina, 13-inch, Late 2013)
+MacBook Pro (Retina, 15-inch, Early 2013)
+MacBook Pro (Retina, 15-inch, Late 2013)
+MacBook Pro (Retina, 15-inch, Mid 2015)
+Makito X Decoder
+MediaLink Controller
+MediaSense
+Meeting Management
+MegaRAC
+Mercury
+Mergepoint
+Miniserver
+My Book Live
+N5172B Signal Generator
+NFVIS
+NPort
+NetScreen
+NetVR
+Netbox
+Network Gateway
+Network Node
+Nexus Player
+OnHub
+OpenManage
+OpenManage Switch
+OpenNAC
+Orbit IP Camera
+PDR M800
+PLAY
+PLC-5
+Paragon-100G
+Photonic Switch
+PoliWall
+PowerVault 124T
+Prime Collaboration Manager
+Primergy
+Printer
+Prosafe Plus
+RTU
+Rack PDU Card
+Raspberry Pi
+ReadyNAS
+RealPresence Group {hw.model}
+RealPresence Trio {hw.model}
+RecoverPoint
+ReeCam
+Roku
+Room Alert {hw.product.model}
+S7 DALI Gateway
+SHIELD
+SIP Gateway
+SIParator Firewall
+SLS
+SPA
+SRP
+ScanFront
+Scrutinizer
+Sensor
+Sentry Switched CDU
+ShareLink Pro
+Sigma Control 2
+SimpliVity OmniStack
+Site Recovery Manager
+SmartEdge Sensor
+Softswitch
+SolsticePod
+SoundPoint
+Spot
+Stealthwatch
+Storage Appliance
+Sub
+SuperStack 3
+SuperStack 3 Firewall
+SuperStack II
+Symmetry EN-2DBC
+System Management
+TelePresence
+TelePresence MCU
+TemPageR {hw.product.model}
+Tenable Appliance
+Tenable Core
+Thermal Label Printer {hw.model}
+Time Capsule
+TouchLink Control Panel
+UCS Manager
+UniFi Cloud Key
+UniFi NVR
+UniFi Security Gateway
+Universal Media Gateway
+VBrick Rev
+Verizon FiOS Router
+Video Controller
+Vigor
+Virtual Connect Manager
+Virtual Traffic Manager
+Vood
+WLAN AP
+WebBox
+Whiteboard
+Wireless Dock
+Wireless LAN Controller
+Wireless Router
+XCC
+Xserve (Early 2008)
+Xserve (Early 2009)
+Xserve (Late 2006)
+Xserve G4
+Xserve G4 (Slot Load)
+Xserve G5
+Zone Director
+airCube
+e-STUDIO
+iCOM Control Panel
+iDRAC
+iLO
+iMac (21.5-inch, 2017)
+iMac (21.5-inch, Late 2012)
+iMac (21.5-inch, Late 2013)
+iMac (21.5-inch, Late 2015)
+iMac (21.5-inch, Mid 2010)
+iMac (21.5-inch, Mid 2011)
+iMac (21.5-inch, Mid 2014)
+iMac (24-inch, Early 2009)
+iMac (27-inch, Late 2009)
+iMac (27-inch, Late 2012)
+iMac (27-inch, Late 2013)
+iMac (27-inch, Mid 2010)
+iMac (27-inch, Mid 2011)
+iMac (Retina 4K, 21.5-inch, 2017)
+iMac (Retina 4K, 21.5-inch, 2019)
+iMac (Retina 4K, 21.5-inch, Late 2015)
+iMac (Retina 5K, 27-inch, 2017)
+iMac (Retina 5K, 27-inch, 2019)
+iMac (Retina 5K, 27-inch, Late 2015)
+iMac (Retina 5K, 27-inch, Mid 2015)
+iMac Pro (Retina 5K, Late 2017)
+iPad (4th generation)
+iPad (5th generation)
+iPad (6th generation)
+iPad Air
+iPad Air (3rd generation)
+iPad Air 2
+iPad Pro (10.5-inch)
+iPad Pro (11-inch)
+iPad Pro (12.9-inch)
+iPad Pro (9.7-inch)
+iPad mini
+iPad mini (5th generation)
+iPad mini 2
+iPad mini 3
+iPad mini 4
+iPhone
+iPhone 3G
+iPhone 3GS
+iPhone 4
+iPhone 4s
+iPhone 5
+iPhone 5c
+iPhone 5s
+iPhone 6
+iPhone 6 Plus
+iPhone 6s
+iPhone 6s Plus
+iPhone 7
+iPhone 7 Plus
+iPhone 8
+iPhone 8 Plus
+iPhone SE
+iPhone X
+iPhone XR
+iPhone XS
+iPhone XS Max
+vManage