recog 2.3.7 → 2.3.12
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +9 -2
- data/.ruby-gemset +1 -0
- data/.ruby-version +1 -0
- data/.travis.yml +2 -4
- data/CONTRIBUTING.md +136 -37
- data/Gemfile +2 -5
- data/README.md +18 -16
- data/bin/recog_cleanup +16 -0
- data/bin/recog_standardize +142 -0
- data/cpe-remap.yaml +36 -1
- data/features/match.feature +4 -0
- data/features/support/aruba.rb +3 -0
- data/features/verify.feature +5 -0
- data/identifiers/README.md +56 -0
- data/identifiers/hw_device.txt +77 -0
- data/identifiers/hw_family.txt +96 -0
- data/identifiers/hw_product.txt +328 -0
- data/identifiers/os_architecture.txt +20 -0
- data/identifiers/os_device.txt +94 -0
- data/identifiers/os_family.txt +325 -0
- data/identifiers/os_product.txt +420 -0
- data/identifiers/service_family.txt +272 -0
- data/identifiers/service_product.txt +557 -0
- data/identifiers/software_class.txt +26 -0
- data/identifiers/software_family.txt +91 -0
- data/identifiers/software_product.txt +333 -0
- data/identifiers/vendor.txt +891 -0
- data/lib/recog/version.rb +1 -1
- data/requirements.txt +1 -1
- data/spec/lib/fingerprint_self_test_spec.rb +1 -1
- data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +1 -1
- data/update_cpes.py +4 -1
- data/xml/apache_modules.xml +292 -5
- data/xml/apache_os.xml +50 -2
- data/xml/architecture.xml +19 -7
- data/xml/dns_versionbind.xml +200 -26
- data/xml/favicons.xml +1701 -0
- data/xml/ftp_banners.xml +276 -16
- data/xml/h323_callresp.xml +112 -12
- data/xml/hp_pjl_id.xml +47 -5
- data/xml/html_title.xml +1419 -72
- data/xml/http_cookies.xml +77 -10
- data/xml/http_servers.xml +898 -47
- data/xml/http_wwwauth.xml +154 -27
- data/xml/imap_banners.xml +23 -13
- data/xml/ldap_searchresult.xml +81 -9
- data/xml/mdns_device-info_txt.xml +194 -17
- data/xml/mdns_workstation_txt.xml +4 -2
- data/xml/mysql_banners.xml +554 -45
- data/xml/mysql_error.xml +113 -6
- data/xml/nntp_banners.xml +10 -2
- data/xml/ntp_banners.xml +95 -11
- data/xml/operating_system.xml +90 -3
- data/xml/pop_banners.xml +32 -31
- data/xml/rsh_resp.xml +11 -2
- data/xml/rtsp_servers.xml +43 -23
- data/xml/sip_banners.xml +9 -14
- data/xml/sip_user_agents.xml +69 -3
- data/xml/smb_native_lm.xml +10 -2
- data/xml/smb_native_os.xml +80 -2
- data/xml/smtp_banners.xml +233 -13
- data/xml/smtp_debug.xml +6 -4
- data/xml/smtp_ehlo.xml +7 -5
- data/xml/smtp_expn.xml +13 -4
- data/xml/smtp_help.xml +23 -4
- data/xml/smtp_mailfrom.xml +5 -2
- data/xml/smtp_noop.xml +6 -5
- data/xml/smtp_quit.xml +5 -4
- data/xml/smtp_rcptto.xml +5 -2
- data/xml/smtp_rset.xml +4 -4
- data/xml/smtp_turn.xml +4 -4
- data/xml/smtp_vrfy.xml +14 -4
- data/xml/snmp_sysdescr.xml +776 -52
- data/xml/snmp_sysobjid.xml +47 -2
- data/xml/ssh_banners.xml +259 -80
- data/xml/telnet_banners.xml +376 -23
- data/xml/x11_banners.xml +27 -4
- data/xml/x509_issuers.xml +37 -13
- data/xml/x509_subjects.xml +525 -55
- metadata +29 -6
data/xml/telnet_banners.xml
CHANGED
@@ -1,53 +1,63 @@
|
|
1
|
-
<?xml version=
|
1
|
+
<?xml version='1.0' encoding='UTF-8'?>
|
2
2
|
<fingerprints protocol="telnet" database_type="service" preference=".80">
|
3
3
|
<!--
|
4
4
|
TELNET banners with CR/LF/whitespace trimmed from either end.
|
5
5
|
Examples with CR, LF, etc must be base64 encoded in order to past tests.
|
6
6
|
Please follow the style established below.
|
7
7
|
-->
|
8
|
+
|
8
9
|
<!--
|
9
10
|
The following 'assert nothing' block is intended to handle banners so simple
|
10
11
|
that they cannot be attributed to a product or vendor. They are at the
|
11
12
|
beginning of the file as a performance tweak given how frequenty they occur.
|
12
|
-
|
13
13
|
NOTE:
|
14
14
|
Due to the multi-line nature of TELNET banners the regex are leveraging \A
|
15
15
|
instead of ^ to prevent matching in the beginning of a 'line' (^) instead of
|
16
16
|
at the beginning of the string (\A). This has been verified to work with
|
17
17
|
Ruby, Python, Java, and Golang.
|
18
18
|
-->
|
19
|
+
|
19
20
|
<fingerprint pattern="\A(?i)(?:\r|\n)*login:\s*$">
|
20
21
|
<description>bare 'login:' -- assert nothing.</description>
|
21
22
|
<example>login:</example>
|
22
23
|
</fingerprint>
|
24
|
+
|
23
25
|
<fingerprint pattern="\A(?i)(?:\r|\n)*User(?:name)?\s*:\s*$">
|
24
26
|
<description>bare 'Username:' -- assert nothing.</description>
|
25
27
|
<example>Username:</example>
|
26
28
|
<example>User:</example>
|
27
29
|
</fingerprint>
|
30
|
+
|
28
31
|
<fingerprint pattern="\A(?i)(?:\r|\n)*Password:\s*$">
|
29
32
|
<description>bare 'Password:' -- assert nothing.</description>
|
30
33
|
<example>Password:</example>
|
31
34
|
</fingerprint>
|
35
|
+
|
32
36
|
<fingerprint pattern="\A(?i)(?:\r|\n)*Account:\s*$">
|
33
37
|
<description>bare 'Account:' -- assert nothing.</description>
|
34
38
|
<example>Account:</example>
|
35
39
|
</fingerprint>
|
40
|
+
|
36
41
|
<fingerprint pattern="\A(?i)Connection refused(?:\r|\n)*$">
|
37
42
|
<description>bare 'Connection refused' -- assert nothing.</description>
|
38
43
|
<example>Connection refused</example>
|
39
44
|
</fingerprint>
|
45
|
+
|
40
46
|
<!-- end of assert nothing block -->
|
47
|
+
|
41
48
|
<fingerprint pattern="^(?:\r|\n)*User Access Verification(?:\r|\n)+(?:Username|Password):\s*$">
|
42
49
|
<description>Cisco switch or router - user access variant</description>
|
43
50
|
<!-- User Access Verification\r\n\r\nUsername: -->
|
51
|
+
|
44
52
|
<example _encoding="base64">VXNlciBBY2Nlc3MgVmVyaWZpY2F0aW9uDQoNClVzZXJuYW1lOgo=</example>
|
45
53
|
<!-- User Access Verification\r\n\r\nPassword: -->
|
54
|
+
|
46
55
|
<example _encoding="base64">VXNlciBBY2Nlc3MgVmVyaWZpY2F0aW9uDQoNClBhc3N3b3JkOgo=</example>
|
47
56
|
<param pos="0" name="service.vendor" value="Cisco"/>
|
48
57
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
49
58
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
50
59
|
</fingerprint>
|
60
|
+
|
51
61
|
<fingerprint pattern="^(?:\r|\n)*Password required, but none set(?:\r|\n)*$">
|
52
62
|
<description>Cisco switch or router - password not set variant</description>
|
53
63
|
<example>Password required, but none set</example>
|
@@ -55,15 +65,20 @@
|
|
55
65
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
56
66
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
57
67
|
</fingerprint>
|
68
|
+
|
58
69
|
<fingerprint pattern="^(?:\r|\n)*MikroTik v([\w.]+)(?: \(\w+\))?(?:\r|\n)+Login:\s*$">
|
59
70
|
<description>MikroTik RouterOS</description>
|
60
71
|
<!-- MikroTik v5.2\r\nLogin: -->
|
72
|
+
|
61
73
|
<example _encoding="base64" os.version="5.2">TWlrcm9UaWsgdjUuMg0KTG9naW46Cg==</example>
|
62
74
|
<!-- MikroTik v6.42.3 (stable)\r\nLogin: -->
|
75
|
+
|
63
76
|
<example _encoding="base64" os.version="6.42.3">TWlrcm9UaWsgdjYuNDIuMyAoc3RhYmxlKQ0KTG9naW46Cg==</example>
|
64
77
|
<!-- MikroTik v6.40.8 (bugfix)\r\nLogin: -->
|
78
|
+
|
65
79
|
<example _encoding="base64" os.version="6.40.8">TWlrcm9UaWsgdjYuNDAuOCAoYnVnZml4KQ0KTG9naW46Cg==</example>
|
66
80
|
<!-- MikroTik v6.36rc12 (testing)\r\nLogin: -->
|
81
|
+
|
67
82
|
<example _encoding="base64" os.version="6.36rc12">TWlrcm9UaWsgdjYuMzZyYzEyICh0ZXN0aW5nKQ0KTG9naW46Cg==</example>
|
68
83
|
<param pos="0" name="os.vendor" value="MikroTik"/>
|
69
84
|
<param pos="0" name="os.device" value="Router"/>
|
@@ -73,13 +88,17 @@
|
|
73
88
|
<param pos="0" name="hw.vendor" value="MikroTik"/>
|
74
89
|
<param pos="0" name="hw.device" value="Router"/>
|
75
90
|
</fingerprint>
|
91
|
+
|
76
92
|
<fingerprint pattern="^(?:\r|\n)?ZXHN (\w+)(?: V([\d.]+))?(?:\r|\n)*Login:\s*$">
|
77
93
|
<description>ZTE ZXHN router</description>
|
78
94
|
<!-- ZXHN H108N\r\nLogin: -->
|
95
|
+
|
79
96
|
<example _encoding="base64" hw.product="H108N">WlhITiBIMTA4Tg0KTG9naW46Cg==</example>
|
80
97
|
<!-- ZXHN H298A V1.1\r\nLogin: -->
|
98
|
+
|
81
99
|
<example _encoding="base64" hw.product="H298A" hw.version="1.1">WlhITiBIMjk4QSBWMS4xDQpMb2dpbjoK</example>
|
82
100
|
<!-- ZXHN H367N\r\n\rLogin: -->
|
101
|
+
|
83
102
|
<example _encoding="base64" hw.product="H367N">WlhITiBIMzY3Tg0KDUxvZ2luOgo=</example>
|
84
103
|
<param pos="0" name="hw.vendor" value="ZTE"/>
|
85
104
|
<param pos="0" name="hw.device" value="Router"/>
|
@@ -87,24 +106,30 @@
|
|
87
106
|
<param pos="1" name="hw.product"/>
|
88
107
|
<param pos="2" name="hw.version"/>
|
89
108
|
</fingerprint>
|
109
|
+
|
90
110
|
<fingerprint pattern="^(F6\d+\w?)\r\n\rLogin:\s*$">
|
91
111
|
<description>ZTE F6xx series GPON router</description>
|
92
112
|
<!-- F668\r\n\rLogin: -->
|
113
|
+
|
93
114
|
<example _encoding="base64" hw.product="F668">RjY2OA0KDUxvZ2luOgo=</example>
|
94
115
|
<!-- F612W\r\n\rLogin: -->
|
116
|
+
|
95
117
|
<example _encoding="base64" hw.product="F612W">RjYxMlcNCg1Mb2dpbjoK</example>
|
96
118
|
<param pos="0" name="hw.vendor" value="ZTE"/>
|
97
119
|
<param pos="0" name="hw.device" value="Router"/>
|
98
120
|
<param pos="1" name="hw.product"/>
|
99
121
|
</fingerprint>
|
122
|
+
|
100
123
|
<fingerprint pattern="^(?:\r|\n)*DD-WRT v([\d.]+)(?:-(\w+))? ([\w-]+) \(c\) \d{4} NewMedia-NET GmbH(?:\r|\n)+Release: \d+\/\d+\/\d+ \(SVN revision: ([:\w]+)\)(?:\r|\n)+.* login:\s*$">
|
101
124
|
<description>DD-WRT - 24 family</description>
|
102
125
|
<!-- DD-WRT v24-sp2 mini (c) 2013 NewMedia-NET GmbH\r\nRelease: 05/27/13 (SVN revision: 21676)\r\n\r\nDD-WRT login: -->
|
126
|
+
|
103
127
|
<example _encoding="base64" os.version="24" os.version.version="sp2" os.edition="mini" os.build="21676">
|
104
128
|
REQtV1JUIHYyNC1zcDIgbWluaSAoYykgMjAxMyBOZXdNZWRpYS1ORVQgR21iSA0KUmVsZWFzZ
|
105
129
|
TogMDUvMjcvMTMgKFNWTiByZXZpc2lvbjogMjE2NzYpDQoNCkRELVdSVCBsb2dpbjoK
|
106
130
|
</example>
|
107
131
|
<!-- DD-WRT v24 micro (c) 2010 NewMedia-NET GmbH\r\nRelease: 08/07/10 (SVN revision: 14896)\r\n\r\nProliant DL980R07 X6550 8-core 4P SAS login: -->
|
132
|
+
|
108
133
|
<example _encoding="base64" os.version="24" os.edition="micro" os.build="14896">
|
109
134
|
REQtV1JUIHYyNCBtaWNybyAoYykgMjAxMCBOZXdNZWRpYS1ORVQgR21iSA0KUmVsZWFzZTogM
|
110
135
|
DgvMDcvMTAgKFNWTiByZXZpc2lvbjogMTQ4OTYpDQoNClByb2xpYW50IERMOTgwUjA3IFg2NT
|
@@ -117,11 +142,14 @@
|
|
117
142
|
<param pos="2" name="os.version.version"/>
|
118
143
|
<param pos="3" name="os.edition"/>
|
119
144
|
<param pos="4" name="os.build"/>
|
145
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:dd-wrt:dd-wrt:{os.version}"/>
|
120
146
|
<param pos="0" name="hw.device" value="Router"/>
|
121
147
|
</fingerprint>
|
148
|
+
|
122
149
|
<fingerprint pattern="^(?:\r|\n)*DD-WRT v(3.\d)-(r([\w]+)) ([\w-]+) \(c\) \d{4} NewMedia-NET GmbH(?:\r|\n)+Release: \d+\/\d+\/\d+(?:\r|\n)+.* login:\s*$">
|
123
150
|
<description>DD-WRT - 3.0 family</description>
|
124
151
|
<!-- DD-WRT v3.0-r34886M std (c) 2018 NewMedia-NET GmbH\r\nRelease: 02/10/18\r\n\r\nwibrate login: -->
|
152
|
+
|
125
153
|
<example _encoding="base64" os.version="3.0" os.version.version="r34886M" os.edition="std" os.build="34886M">
|
126
154
|
REQtV1JUIHYzLjAtcjM0ODg2TSBzdGQgKGMpIDIwMTggTmV3TWVkaWEtTkVUIEdtYkgNClJlb
|
127
155
|
GVhc2U6IDAyLzEwLzE4DQoNCndpYnJhdGUgbG9naW46Cg==
|
@@ -133,35 +161,43 @@
|
|
133
161
|
<param pos="2" name="os.version.version"/>
|
134
162
|
<param pos="3" name="os.build"/>
|
135
163
|
<param pos="4" name="os.edition"/>
|
164
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:dd-wrt:dd-wrt:{os.version}"/>
|
136
165
|
<param pos="0" name="hw.device" value="Router"/>
|
137
166
|
</fingerprint>
|
167
|
+
|
138
168
|
<fingerprint pattern="^(TD-\w+) [\d.]+ DSL Modem Router(?:\r|\n)+Authorization failed after trying \d+ times!!!\.(?:\r|\n)+Please login after \d+ seconds!\s*$">
|
139
169
|
<description>TP-LINK TD Family DSL Modem/Router</description>
|
140
170
|
<!-- TD-W8960N 5.0 DSL Modem Router\r\nAuthorization failed after trying 5 times!!!.\r\nPlease login after 416 seconds! -->
|
171
|
+
|
141
172
|
<example _encoding="base64" hw.product="TD-W8960N">
|
142
173
|
VEQtVzg5NjBOIDUuMCBEU0wgTW9kZW0gUm91dGVyDQpBdXRob3JpemF0aW9uIGZhaWxlZCBhZ
|
143
174
|
nRlciB0cnlpbmcgNSB0aW1lcyEhIS4NClBsZWFzZSBsb2dpbiBhZnRlciA0MTYgc2Vjb25kcy
|
144
175
|
E=
|
145
176
|
</example>
|
146
|
-
<param pos="0" name="hw.vendor" value="TP-
|
177
|
+
<param pos="0" name="hw.vendor" value="TP-LINK"/>
|
147
178
|
<param pos="1" name="hw.product"/>
|
148
179
|
<param pos="0" name="hw.device" value="Router"/>
|
149
180
|
</fingerprint>
|
181
|
+
|
150
182
|
<fingerprint pattern="^(?:\r|\n)*ZyXEL login:$">
|
151
183
|
<description>ZyXEL simple</description>
|
152
184
|
<example>ZyXEL login:</example>
|
153
|
-
<param pos="0" name="hw.vendor" value="
|
185
|
+
<param pos="0" name="hw.vendor" value="Zyxel"/>
|
154
186
|
</fingerprint>
|
187
|
+
|
155
188
|
<fingerprint pattern="^ZyXEL \w?DSL Router\r\nLogin:$">
|
156
189
|
<description>ZyXEL Router - simple</description>
|
157
190
|
<!-- ZyXEL VDSL Router\r\nLogin: -->
|
191
|
+
|
158
192
|
<example _encoding="base64">WnlYRUwgVkRTTCBSb3V0ZXINCkxvZ2luOgo=</example>
|
159
|
-
<param pos="0" name="hw.vendor" value="
|
193
|
+
<param pos="0" name="hw.vendor" value="Zyxel"/>
|
160
194
|
<param pos="0" name="hw.device" value="Router"/>
|
161
195
|
</fingerprint>
|
196
|
+
|
162
197
|
<fingerprint pattern="^Debian GNU\/Linux 9(?:\r|\n)+([\w.-]+) login:\s*$">
|
163
198
|
<description>Debian 9.0 (stretch)</description>
|
164
199
|
<!-- Debian GNU/Linux 9\r\nserver-01.2 login: -->
|
200
|
+
|
165
201
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA5DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
|
166
202
|
<param pos="0" name="os.vendor" value="Debian"/>
|
167
203
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -170,9 +206,11 @@
|
|
170
206
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:9.0"/>
|
171
207
|
<param pos="1" name="host.name"/>
|
172
208
|
</fingerprint>
|
209
|
+
|
173
210
|
<fingerprint pattern="^Debian GNU\/Linux 8(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
174
211
|
<description>Debian 8.0 (jessie)</description>
|
175
212
|
<!-- Debian GNU/Linux 8\r\nserver-01.2 login: -->
|
213
|
+
|
176
214
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA4DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
|
177
215
|
<param pos="0" name="os.vendor" value="Debian"/>
|
178
216
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -181,9 +219,11 @@
|
|
181
219
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
|
182
220
|
<param pos="1" name="host.name"/>
|
183
221
|
</fingerprint>
|
222
|
+
|
184
223
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 7(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
185
224
|
<description>Debian 7.0 (wheezy)</description>
|
186
225
|
<!-- Debian GNU/Linux 7\r\nserver-01.2 login: -->
|
226
|
+
|
187
227
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA3DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
|
188
228
|
<param pos="0" name="os.vendor" value="Debian"/>
|
189
229
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -192,9 +232,11 @@
|
|
192
232
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
|
193
233
|
<param pos="1" name="host.name"/>
|
194
234
|
</fingerprint>
|
235
|
+
|
195
236
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 6(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
196
237
|
<description>Debian 6.0 (sqeeze)</description>
|
197
238
|
<!-- Debian GNU/Linux 6.0\r\nserver-01.2 login: -->
|
239
|
+
|
198
240
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA2LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
|
199
241
|
<param pos="0" name="os.vendor" value="Debian"/>
|
200
242
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -203,9 +245,11 @@
|
|
203
245
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:6.0"/>
|
204
246
|
<param pos="1" name="host.name"/>
|
205
247
|
</fingerprint>
|
248
|
+
|
206
249
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 5(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
207
250
|
<description>Debian 5.0 (lenny)</description>
|
208
251
|
<!-- Debian GNU/Linux 5.0\r\nserver-01.2 login: -->
|
252
|
+
|
209
253
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA1LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
|
210
254
|
<param pos="0" name="os.vendor" value="Debian"/>
|
211
255
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -214,9 +258,11 @@
|
|
214
258
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:5.0"/>
|
215
259
|
<param pos="1" name="host.name"/>
|
216
260
|
</fingerprint>
|
261
|
+
|
217
262
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 4(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
218
263
|
<description>Debian 4.0 (etch)</description>
|
219
264
|
<!-- Debian GNU/Linux 4.0\r\nserver-01.2 login: -->
|
265
|
+
|
220
266
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA0LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
|
221
267
|
<param pos="0" name="os.vendor" value="Debian"/>
|
222
268
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -225,9 +271,11 @@
|
|
225
271
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:4.0"/>
|
226
272
|
<param pos="1" name="host.name"/>
|
227
273
|
</fingerprint>
|
274
|
+
|
228
275
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux (3.\d)(?: [\w.-]+)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
229
276
|
<description>Debian 3.x (woody/sarge)</description>
|
230
277
|
<!-- Debian GNU/Linux 3.1\r\nserver-01.2 login: -->
|
278
|
+
|
231
279
|
<example _encoding="base64" os.version="3.1" host.name="server-01.2">
|
232
280
|
RGViaWFuIEdOVS9MaW51eCAzLjENCnNlcnZlci0wMS4yIGxvZ2luOgo=
|
233
281
|
</example>
|
@@ -238,13 +286,16 @@
|
|
238
286
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:{os.version}"/>
|
239
287
|
<param pos="2" name="host.name"/>
|
240
288
|
</fingerprint>
|
289
|
+
|
241
290
|
<fingerprint pattern="^(?:\r|\n)*Ubuntu ([\d.]+)(?: LTS)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
242
291
|
<description>Ubuntu - most versions</description>
|
243
292
|
<!-- Ubuntu 16.04.4 LTS\r\nserver-01.2 login: -->
|
293
|
+
|
244
294
|
<example _encoding="base64" os.version="16.04.4" host.name="server-01.2">
|
245
295
|
VWJ1bnR1IDE2LjA0LjQgTFRTDQpzZXJ2ZXItMDEuMiBsb2dpbjoK
|
246
296
|
</example>
|
247
297
|
<!-- Ubuntu 17.04\r\nnginx login: -->
|
298
|
+
|
248
299
|
<example _encoding="base64" os.version="17.04" host.name="nginx">
|
249
300
|
VWJ1bnR1IDE3LjA0DQpuZ2lueCBsb2dpbjoK
|
250
301
|
</example>
|
@@ -255,13 +306,16 @@
|
|
255
306
|
<param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:{os.version}"/>
|
256
307
|
<param pos="2" name="host.name"/>
|
257
308
|
</fingerprint>
|
309
|
+
|
258
310
|
<fingerprint pattern="(?:\r|\n)*Debian GNU\/Linux (2.\d)(?: [\w.-]+)?(?:\r|\n)+([\w.-]+) login:\s*">
|
259
311
|
<description>Debian 2.x (hamm/slink/potato)</description>
|
260
312
|
<!-- Debian GNU/Linux 2.2\r\nserver-01.2 login: -->
|
313
|
+
|
261
314
|
<example _encoding="base64" os.version="2.2" host.name="server-01.2">
|
262
315
|
RGViaWFuIEdOVS9MaW51eCAyLjINCnNlcnZlci0wMS4yIGxvZ2luOgo=
|
263
316
|
</example>
|
264
317
|
<!-- Debian GNU/Linux 2.2 localhost.localdomain\r\nmoon login: -->
|
318
|
+
|
265
319
|
<example _encoding="base64" os.version="2.2" host.name="moon">
|
266
320
|
RGViaWFuIEdOVS9MaW51eCAyLjIgbG9jYWxob3N0LmxvY2FsZG9tYWluDQptb29uIGxvZ2luOgo=
|
267
321
|
</example>
|
@@ -272,14 +326,17 @@
|
|
272
326
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:{os.version}"/>
|
273
327
|
<param pos="2" name="host.name"/>
|
274
328
|
</fingerprint>
|
329
|
+
|
275
330
|
<fingerprint pattern="^CentOS release ([\d.]+) \(Final\)(?:\r|\n)+Kernel ([\w.-]+) on an (\w+)(?:\r|\n)+(?:([\w.-]+) )?login:\s*$">
|
276
331
|
<description>CentOS</description>
|
277
332
|
<!-- CentOS release 5.9 (Final)\r\nKernel 2.6.18-348.6.1.el5 on an i686\r\nlogin: -->
|
333
|
+
|
278
334
|
<example _encoding="base64" os.version="5.9" linux.kernel.version="2.6.18-348.6.1.el5" os.arch="i686">
|
279
335
|
Q2VudE9TIHJlbGVhc2UgNS45IChGaW5hbCkNCktlcm5lbCAyLjYuMTgtMzQ4LjYuMS5lbDUgb
|
280
336
|
24gYW4gaTY4Ng0KbG9naW46Cg==
|
281
337
|
</example>
|
282
338
|
<!-- CentOS release 6.10 (Final)\r\nKernel 2.6.32-754.2.1.el6.x86_64 on an x86_64\r\nserver-01.2 login: -->
|
339
|
+
|
283
340
|
<example _encoding="base64" os.version="6.10" linux.kernel.version="2.6.32-754.2.1.el6.x86_64" os.arch="x86_64" host.name="server-01.2">
|
284
341
|
Q2VudE9TIHJlbGVhc2UgNi4xMCAoRmluYWwpDQpLZXJuZWwgMi42LjMyLTc1NC4yLjEuZWw2L
|
285
342
|
ng4Nl82NCBvbiBhbiB4ODZfNjQNCnNlcnZlci0wMS4yIGxvZ2luOgo=
|
@@ -293,6 +350,7 @@
|
|
293
350
|
<param pos="0" name="os.cpe23" value="cpe:/o:centos:centos:{os.version}"/>
|
294
351
|
<param pos="4" name="host.name"/>
|
295
352
|
</fingerprint>
|
353
|
+
|
296
354
|
<fingerprint pattern="^(?:\r|\n)*(RT-AC\d\d\w) login:\s*$">
|
297
355
|
<description>Asus Wireless Access Point/Router - RT-AC prefix</description>
|
298
356
|
<example hw.product="RT-AC54U">RT-AC54U login:</example>
|
@@ -303,6 +361,7 @@
|
|
303
361
|
<param pos="0" name="hw.device" value="WAP"/>
|
304
362
|
<param pos="1" name="hw.product"/>
|
305
363
|
</fingerprint>
|
364
|
+
|
306
365
|
<fingerprint pattern="^(?:\r|\n)*(AC\d\d00) login:\s*$">
|
307
366
|
<description>Asus Wireless Access Point/Router - AC prefix</description>
|
308
367
|
<example hw.product="AC1000">AC1000 login:</example>
|
@@ -313,6 +372,7 @@
|
|
313
372
|
<param pos="0" name="hw.device" value="WAP"/>
|
314
373
|
<param pos="1" name="hw.product"/>
|
315
374
|
</fingerprint>
|
375
|
+
|
316
376
|
<fingerprint pattern="^(?:\r|\n)*(Air5\d+\w{0,2}) login:\s*$">
|
317
377
|
<description>Airties</description>
|
318
378
|
<example hw.product="Air5650">Air5650 login:</example>
|
@@ -321,9 +381,11 @@
|
|
321
381
|
<param pos="0" name="hw.device" value="WAP"/>
|
322
382
|
<param pos="1" name="hw.product"/>
|
323
383
|
</fingerprint>
|
384
|
+
|
324
385
|
<fingerprint pattern="^Amazon Linux AMI release ([\d.]+)(?:\r|\n)+Kernel ([\w.-]+) on an (\w+)(?:\r|\n)+(?:([\w.-]+) )?login:\s*$">
|
325
386
|
<description>Amazon Linux AMI</description>
|
326
387
|
<!-- Amazon Linux AMI release 2013.09\r\nKernel 3.4.68-59.97.amzn1.x86_64 on an x86_64\r\nserver-01.2 login: -->
|
388
|
+
|
327
389
|
<example _encoding="base64" os.version="2013.09" linux.kernel.version="3.4.68-59.97.amzn1.x86_64" os.arch="x86_64" host.name="server-01.2">
|
328
390
|
QW1hem9uIExpbnV4IEFNSSByZWxlYXNlIDIwMTMuMDkNCktlcm5lbCAzLjQuNjgtNTkuOTcuY
|
329
391
|
W16bjEueDg2XzY0IG9uIGFuIHg4Nl82NA0Kc2VydmVyLTAxLjIgbG9naW46Cg==
|
@@ -336,9 +398,11 @@
|
|
336
398
|
<param pos="3" name="os.arch"/>
|
337
399
|
<param pos="4" name="host.name"/>
|
338
400
|
</fingerprint>
|
401
|
+
|
339
402
|
<fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)/([\w]+) ALCATEL (SR [\S]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
|
340
403
|
<description>ALCATEL Service Router running TiMOS</description>
|
341
404
|
<!-- TiMOS-C-12.0.R12 cpm/hops64 ALCATEL SR 7750 Copyright (c) 2000-2015 Alcatel-Lucent.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
405
|
+
|
342
406
|
<example _encoding="base64" os.version="12.0.R12" hw.product="SR 7750" os.arch="hops64">
|
343
407
|
VGlNT1MtQy0xMi4wLlIxMiBjcG0vaG9wczY0IEFMQ0FURUwgU1IgNzc1MCBDb3B5cmlnaHQgK
|
344
408
|
GMpIDIwMDAtMjAxNSBBbGNhdGVsLUx1Y2VudC4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQ
|
@@ -354,16 +418,20 @@
|
|
354
418
|
<param pos="0" name="hw.device" value="Router"/>
|
355
419
|
<param pos="3" name="hw.product"/>
|
356
420
|
</fingerprint>
|
421
|
+
|
357
422
|
<!-- Nokia purchased Alcatel Lucent, finalized in Nov 2016 -->
|
423
|
+
|
358
424
|
<fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia ([\S]+ [SRX]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
|
359
425
|
<description>Nokia Service Router running TiMOS</description>
|
360
426
|
<!-- TiMOS-C-14.0.R5 cpm/hops64 Nokia 7750 SR Copyright (c) 2000-2016 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
427
|
+
|
361
428
|
<example _encoding="base64" os.version="14.0.R5" os.arch="hops64" hw.product="7750 SR">
|
362
429
|
VGlNT1MtQy0xNC4wLlI1IGNwbS9ob3BzNjQgTm9raWEgNzc1MCBTUiBDb3B5cmlnaHQgKGMpI
|
363
430
|
DIwMDAtMjAxNiBOb2tpYS4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQpCcmV2aXR5DQpMb2
|
364
431
|
dpbjoK
|
365
432
|
</example>
|
366
433
|
<!-- TiMOS-C-14.0.R10 cpm/hops64 Nokia 7950 XRS Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
434
|
+
|
367
435
|
<example _encoding="base64" os.version="14.0.R10" os.arch="hops64" hw.product="7950 XRS">
|
368
436
|
VGlNT1MtQy0xNC4wLlIxMCBjcG0vaG9wczY0IE5va2lhIDc5NTAgWFJTIENvcHlyaWdodCAoY
|
369
437
|
ykgMjAwMC0yMDE3IE5va2lhLg0NCkJhbm5lciBTaG9ydGVuZWQgRm9yIA0NCkJyZXZpdHkNCk
|
@@ -379,15 +447,18 @@
|
|
379
447
|
<param pos="0" name="hw.device" value="Router"/>
|
380
448
|
<param pos="3" name="hw.product"/>
|
381
449
|
</fingerprint>
|
450
|
+
|
382
451
|
<fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia (SAS[+\w\s-]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
|
383
452
|
<description>Nokia Service Access Switch running TiMOS</description>
|
384
453
|
<!-- TiMOS-B-8.0.R12 both/hops Nokia SAS-Mxp 22F2C 4SFP+ 7210 Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
454
|
+
|
385
455
|
<example _encoding="base64" os.version="8.0.R12" os.arch="hops" hw.product="SAS-Mxp 22F2C 4SFP+ 7210">
|
386
456
|
VGlNT1MtQi04LjAuUjEyIGJvdGgvaG9wcyBOb2tpYSBTQVMtTXhwIDIyRjJDIDRTRlArIDcyM
|
387
457
|
TAgQ29weXJpZ2h0IChjKSAyMDAwLTIwMTcgTm9raWEuDQ0KQmFubmVyIFNob3J0ZW5lZCBGb3
|
388
458
|
IgDQ0KQnJldml0eQ0KTG9naW46Cg==
|
389
459
|
</example>
|
390
460
|
<!-- TiMOS-B-9.0.R9 both/mpc Nokia SAS-M 24F 2XFP 7210 Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
461
|
+
|
391
462
|
<example _encoding="base64" os.version="9.0.R9" os.arch="mpc" hw.product="SAS-M 24F 2XFP 7210">
|
392
463
|
VGlNT1MtQi05LjAuUjkgYm90aC9tcGMgTm9raWEgU0FTLU0gMjRGIDJYRlAgNzIxMCBDb3B5c
|
393
464
|
mlnaHQgKGMpIDIwMDAtMjAxNyBOb2tpYS4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQpCcm
|
@@ -403,14 +474,17 @@
|
|
403
474
|
<param pos="0" name="hw.device" value="Switch"/>
|
404
475
|
<param pos="3" name="hw.product"/>
|
405
476
|
</fingerprint>
|
477
|
+
|
406
478
|
<fingerprint pattern="^(?:\r|\n)*Grandstream (HT[\d-]+)\s+(?:V\d\.\d\w?\s+)?Command Shell Copyright \d\d\d\d-\d\d\d\d(?:\r|\n)+Password:\s*$">
|
407
479
|
<description>Grandstream HandyTone Analog Telephone Adapters</description>
|
408
480
|
<!-- Grandstream HT812 Command Shell Copyright 2006-2017\r\nPassword: -->
|
481
|
+
|
409
482
|
<example _encoding="base64" hw.product="HT812">
|
410
483
|
R3JhbmRzdHJlYW0gSFQ4MTIgQ29tbWFuZCBTaGVsbCBDb3B5cmlnaHQgMjAwNi0yMDE3DQpQY
|
411
484
|
XNzd29yZDoK
|
412
485
|
</example>
|
413
486
|
<!-- Grandstream HT-502 V2.0A Command Shell Copyright 2006-2014\r\nPassword: -->
|
487
|
+
|
414
488
|
<example _encoding="base64" hw.product="HT-502">
|
415
489
|
R3JhbmRzdHJlYW0gSFQtNTAyICBWMi4wQSBDb21tYW5kIFNoZWxsIENvcHlyaWdodCAyMDA2L
|
416
490
|
TIwMTQNClBhc3N3b3JkOgo=
|
@@ -420,14 +494,17 @@
|
|
420
494
|
<param pos="0" name="hw.device" value="VoIP"/>
|
421
495
|
<param pos="1" name="hw.product"/>
|
422
496
|
</fingerprint>
|
497
|
+
|
423
498
|
<fingerprint pattern="^(?:\r|\n)*Grandstream (GXW[\d-]+)\s+(?:V\d\.\d\w?\s+)?Command Shell Copyright \d\d\d\d(?:-\d\d\d\d)?(?:\r|\n)+Password:\s*$">
|
424
499
|
<description>Grandstream Analog VoIP Gateways</description>
|
425
500
|
<!-- Grandstream GXW-4008 V1.5A Command Shell Copyright 2006-2015\r\nPassword: -->
|
501
|
+
|
426
502
|
<example _encoding="base64" hw.product="GXW-4008">
|
427
503
|
R3JhbmRzdHJlYW0gR1hXLTQwMDggIFYxLjVBIENvbW1hbmQgU2hlbGwgQ29weXJpZ2h0IDIwM
|
428
504
|
DYtMjAxNQ0KUGFzc3dvcmQ6Cg==
|
429
505
|
</example>
|
430
506
|
<!-- Grandstream GXW4216 V2.3B Command Shell Copyright 2015\r\nPassword: -->
|
507
|
+
|
431
508
|
<example _encoding="base64" hw.product="GXW4216">
|
432
509
|
R3JhbmRzdHJlYW0gR1hXNDIxNiAgVjIuM0IgQ29tbWFuZCBTaGVsbCBDb3B5cmlnaHQgMjAxN
|
433
510
|
Q0KUGFzc3dvcmQ6Cg==
|
@@ -437,9 +514,11 @@
|
|
437
514
|
<param pos="0" name="hw.device" value="VoIP"/>
|
438
515
|
<param pos="1" name="hw.product"/>
|
439
516
|
</fingerprint>
|
517
|
+
|
440
518
|
<fingerprint pattern="^(?:\r|\n|\s)*Grandstream (GXV[\w-]+)\s+(?:V\d\.\d\w?\s+)?Shell Command.Copyight \d\d\d\d-\d\d\d\d(?:\r|\n)+Username:\s*$">
|
441
519
|
<description>Grandstream IP Cameras</description>
|
442
520
|
<!-- Grandstream GXV3674_FHD_VF Shell Command.Copyight 2011-2014\r\nUsername: -->
|
521
|
+
|
443
522
|
<example _encoding="base64" hw.product="GXV3674_FHD_VF">
|
444
523
|
R3JhbmRzdHJlYW0gR1hWMzY3NF9GSERfVkYgICAgU2hlbGwgQ29tbWFuZC5Db3B5aWdodCAyM
|
445
524
|
DExLTIwMTQNClVzZXJuYW1lOgo=
|
@@ -449,14 +528,17 @@
|
|
449
528
|
<param pos="0" name="hw.device" value="Web cam"/>
|
450
529
|
<param pos="1" name="hw.product"/>
|
451
530
|
</fingerprint>
|
531
|
+
|
452
532
|
<fingerprint pattern="^(?:\r|\n)*Welcome to Polycom RMX\s*(\w+) \(COP\) Console Utility(?:\r|\n)+Copyright \(C\) \d\d\d\d-\d\d\d\d POLYCOM(?:\r|\n)+Password:\s*$">
|
453
533
|
<description>Polycom Real Time Media Conferencing</description>
|
454
534
|
<!-- Welcome to Polycom RMX 500 (COP) Console Utility\r\n\rCopyright (C) 2008-2010 POLYCOM\r\n\r\r\n\rPassword: -->
|
535
|
+
|
455
536
|
<example _encoding="base64" hw.product="500">
|
456
537
|
V2VsY29tZSB0byBQb2x5Y29tIFJNWCA1MDAgKENPUCkgQ29uc29sZSBVdGlsaXR5DQoNQ29we
|
457
538
|
XJpZ2h0IChDKSAyMDA4LTIwMTAgUE9MWUNPTQ0KDQ0KDVBhc3N3b3JkOgo=
|
458
539
|
</example>
|
459
540
|
<!-- Welcome to Polycom RMX 1000C (COP) Console Utility\r\n\rCopyright (C) 2008-2012 POLYCOM\r\n\r\r\n\rPassword: -->
|
541
|
+
|
460
542
|
<example _encoding="base64" hw.product="1000C">
|
461
543
|
V2VsY29tZSB0byBQb2x5Y29tIFJNWCAxMDAwQyAoQ09QKSBDb25zb2xlIFV0aWxpdHkNCg1Db
|
462
544
|
3B5cmlnaHQgKEMpIDIwMDgtMjAxMiBQT0xZQ09NDQoNDQoNUGFzc3dvcmQ6Cg==
|
@@ -466,9 +548,11 @@
|
|
466
548
|
<param pos="0" name="hw.device" value="Video Conferencing"/>
|
467
549
|
<param pos="1" name="hw.product"/>
|
468
550
|
</fingerprint>
|
551
|
+
|
469
552
|
<fingerprint pattern="^(?:\r|\n)*Hi, my name is :\s+[\w.\s-]+(?:\r|\n)+Here is what I know about myself:(?:\r|\n)+Model:\s+VSX (\w+)(?:\r|\n)+Serial Number:\s+(\w+)(?:\r|\n)+Software Version:\s+Release ([\d.-]+)\s">
|
470
553
|
<description>Polycom Video Conferencing - VSX Family</description>
|
471
554
|
<!-- Hi, my name is : Something Pity\r\nHere is what I know about myself:\r\nModel: VSX 6000A\r\nSerial Number: 00070906FC34F6\r\nSoftware Version: Release 9.0.6.2-103 - 04Sep2011 21:27\r\nBuild Information: ecomman -->
|
555
|
+
|
472
556
|
<example _encoding="base64" hw.product="6000A" host.id="00070906FC34F6" os.version="9.0.6.2-103">
|
473
557
|
SGksIG15IG5hbWUgaXMgOiAgICAgU29tZXRoaW5nIFBpdHkNCkhlcmUgaXMgd2hhdCBJIGtub
|
474
558
|
3cgYWJvdXQgbXlzZWxmOg0KTW9kZWw6ICAgICAgICAgICAgICAgVlNYIDYwMDBBDQpTZXJpYW
|
@@ -483,9 +567,11 @@
|
|
483
567
|
<param pos="2" name="host.id"/>
|
484
568
|
<param pos="3" name="os.version"/>
|
485
569
|
</fingerprint>
|
570
|
+
|
486
571
|
<fingerprint pattern="Polycom Command Shell(?:\r|\n)+XCOM host:\s+localhost port: \d+">
|
487
572
|
<description>Polycom Diagnotic Service</description>
|
488
573
|
<!-- Polycom Command Shell\r\r\nXCOM host: localhost port: 4121\r\r\nTTY name: /dev/pts/0\r\r\nSession type: telnet\r\r\nNCF\r\nNCF\r\n2018-08-15 18:03:10 DEBUG -->
|
574
|
+
|
489
575
|
<example _encoding="base64">
|
490
576
|
UG9seWNvbSBDb21tYW5kIFNoZWxsDQ0KWENPTSBob3N0OiAgICBsb2NhbGhvc3QgcG9ydDogN
|
491
577
|
DEyMQ0NClRUWSBuYW1lOiAgICAgL2Rldi9wdHMvMA0NClNlc3Npb24gdHlwZTogdGVsbmV0DQ
|
@@ -494,9 +580,11 @@
|
|
494
580
|
<param pos="0" name="hw.vendor" value="Polycom"/>
|
495
581
|
<param pos="0" name="hw.device" value="Video Conferencing"/>
|
496
582
|
</fingerprint>
|
583
|
+
|
497
584
|
<fingerprint pattern="^Welcome to the Windows CE Telnet Service on (WEBBOX[\w.-]+)(?:\r|\n)+login:\s*$">
|
498
585
|
<description>Sunny WebBox Windows CE</description>
|
499
586
|
<!-- Welcome to the Windows CE Telnet Service on WEBBOX150000000\r\n\r\nlogin: -->
|
587
|
+
|
500
588
|
<example _encoding="base64" host.name="WEBBOX150000000">
|
501
589
|
V2VsY29tZSB0byB0aGUgV2luZG93cyBDRSBUZWxuZXQgU2VydmljZSBvbiBXRUJCT1gxNTAwM
|
502
590
|
DAwMDANCg0KbG9naW46Cg==
|
@@ -511,9 +599,11 @@
|
|
511
599
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_ce:-"/>
|
512
600
|
<param pos="1" name="host.name"/>
|
513
601
|
</fingerprint>
|
602
|
+
|
514
603
|
<fingerprint pattern="^Welcome to the Windows CE Telnet Service on ([\w.-]+)(?:\r|\n)+login:\s*$">
|
515
604
|
<description>Windows CE</description>
|
516
605
|
<!-- Welcome to the Windows CE Telnet Service on MY-CE-DEVICE\r\n\r\nlogin: -->
|
606
|
+
|
517
607
|
<example _encoding="base64" host.name="MY-CE-DEVICE">
|
518
608
|
V2VsY29tZSB0byB0aGUgV2luZG93cyBDRSBUZWxuZXQgU2VydmljZSBvbiBNWS1DRS1ERVZJQ
|
519
609
|
0UNCg0KbG9naW46Cg==
|
@@ -524,15 +614,18 @@
|
|
524
614
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_ce:-"/>
|
525
615
|
<param pos="1" name="host.name"/>
|
526
616
|
</fingerprint>
|
617
|
+
|
527
618
|
<fingerprint pattern="^(?:\r|\n)*HP JetDirect(?:\r|\n)+$">
|
528
619
|
<description>HP Printer - Jet Direct</description>
|
529
620
|
<!-- HP JetDirect\r\nPassword is not set\r\n\r\nPlease type "menu" for the MENU system, \r\nor "?" for help, or "/" for current settings.\r\n> -->
|
621
|
+
|
530
622
|
<example _encoding="base64">
|
531
623
|
SFAgSmV0RGlyZWN0DQpQYXNzd29yZCBpcyBub3Qgc2V0DQoNClBsZWFzZSB0eXBlICJtZW51I
|
532
624
|
iBmb3IgdGhlIE1FTlUgc3lzdGVtLCANCm9yICI/IiBmb3IgaGVscCwgb3IgIi8iIGZvciBjdX
|
533
625
|
JyZW50IHNldHRpbmdzLg0KPgo=
|
534
626
|
</example>
|
535
627
|
<!-- HP JetDirect\r\n\r\nEnter username: -->
|
628
|
+
|
536
629
|
<example _encoding="base64">SFAgSmV0RGlyZWN0DQoNCkVudGVyIHVzZXJuYW1lOgo=</example>
|
537
630
|
<param pos="0" name="service.vendor" value="HP"/>
|
538
631
|
<param pos="0" name="service.product" value="JetDirect"/>
|
@@ -546,16 +639,20 @@
|
|
546
639
|
<param pos="0" name="hw.product" value="JetDirect"/>
|
547
640
|
<param pos="0" name="hw.device" value="Printer"/>
|
548
641
|
</fingerprint>
|
642
|
+
|
549
643
|
<fingerprint pattern="^(?:\r|\n)*%connection closed by remote host!(?:\x00)?$">
|
550
644
|
<description>HP switch blocking connection using network ACL</description>
|
551
645
|
<!-- %connection closed by remote host! -->
|
646
|
+
|
552
647
|
<example _encoding="base64">JWNvbm5lY3Rpb24gY2xvc2VkIGJ5IHJlbW90ZSBob3N0IQ==</example>
|
553
648
|
<param pos="0" name="hw.vendor" value="HP"/>
|
554
649
|
<param pos="0" name="hw.device" value="Switch"/>
|
555
650
|
</fingerprint>
|
651
|
+
|
556
652
|
<fingerprint pattern="^(?:\r|\n)*Welcome Visiting Huawei Home Gateway\r\nCopyright by Huawei Technologies Co., Ltd.\r\n\r\nLogin:$">
|
557
653
|
<description>Huawei HG series Home Gateway routers</description>
|
558
654
|
<!-- Welcome Visiting Huawei Home Gateway\r\nCopyright by Huawei Technologies Co., Ltd.\r\n\r\nLogin: -->
|
655
|
+
|
559
656
|
<example _encoding="base64">
|
560
657
|
V2VsY29tZSBWaXNpdGluZyBIdWF3ZWkgSG9tZSBHYXRld2F5DQpDb3B5cmlnaHQgYnkgSHVhd
|
561
658
|
2VpIFRlY2hub2xvZ2llcyBDby4sIEx0ZC4NCg0KTG9naW46Cg==
|
@@ -563,9 +660,11 @@
|
|
563
660
|
<param pos="0" name="hw.vendor" value="Huawei"/>
|
564
661
|
<param pos="0" name="hw.device" value="Router"/>
|
565
662
|
</fingerprint>
|
663
|
+
|
566
664
|
<fingerprint pattern="^(?:\r|\n)*Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.(?:(?:\r|\n)+Login authentication)?(?:\r|\n)+Username:$">
|
567
665
|
<description>Huawei Router</description>
|
568
666
|
<!-- Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.\r\n\r\nLogin authentication\r\n\r\n\r\nUsername: -->
|
667
|
+
|
569
668
|
<example _encoding="base64">
|
570
669
|
V2FybmluZzogVGVsbmV0IGlzIG5vdCBhIHNlY3VyZSBwcm90b2NvbCwgYW5kIGl0IGlzIHJlY
|
571
670
|
29tbWVuZGVkIHRvIHVzZSBTdGVsbmV0Lg0KDQpMb2dpbiBhdXRoZW50aWNhdGlvbg0KDQoNCl
|
@@ -574,10 +673,13 @@
|
|
574
673
|
<param pos="0" name="hw.vendor" value="Huawei"/>
|
575
674
|
<param pos="0" name="hw.device" value="Router"/>
|
576
675
|
</fingerprint>
|
676
|
+
|
577
677
|
<fingerprint pattern="^(?:\r|\n)*(?:% Password expiration warning.\r\n)?-+\r\nCisco Configuration Professional \(Cisco CP\) is installed on this device. \r\nThis feature requires the one-time use of the username">
|
578
678
|
<description>Cisco router - Cisco Configuration Pro variant</description>
|
579
679
|
<!-- There are are roughly 69 dash characters before the CRLF in the banner below but can't be included in XML comments. -->
|
680
|
+
|
580
681
|
<!-- \r\nCisco Configuration Professional (Cisco CP) is installed on this device. \r\nThis feature requires the one-time use of the username -->
|
682
|
+
|
581
683
|
<example _encoding="base64">
|
582
684
|
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
|
583
685
|
S0tLS0tLS0tLS0tLS0tLS0NCkNpc2NvIENvbmZpZ3VyYXRpb24gUHJvZmVzc2lvbmFsIChDaX
|
@@ -593,10 +695,13 @@
|
|
593
695
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
594
696
|
<param pos="0" name="hw.device" value="Router"/>
|
595
697
|
</fingerprint>
|
698
|
+
|
596
699
|
<fingerprint pattern="^(?m)(?:\r|\n)*Catalyst 1900 Management Console(?:\r|\n)+.*Ethernet Address:\s+([\w-]+)(?:\r|\n)+.*Model Number:\s+([\w-]+)(?:\r|\n)+System Serial Number:\s+(\w+)(?:\r|\n)+Power Supply" flags="REG_MULTILINE">
|
597
700
|
<description>Cisco Catalyst 1900</description>
|
598
701
|
<!-- Catalyst 1900, unlike other Catalyst models, didn't run CatOS or IOS -->
|
702
|
+
|
599
703
|
<!-- Catalyst 1900 Management Console\r\nCopyright (c) Cisco Systems, Inc. 1993-1998\r\nAll rights reserved.\r\nEnterprise Edition Software\r\nEthernet Address: 00-AA-19-38-AA-00\r\n\r\nPCA Number: 73-31AA-AA\r\nPCA Serial Number: FAB033AAAAA\r\nModel Number: WS-C1924-EN\r\nSystem Serial Number: FAB0341AAAA\r\nPower Supply S/N: -->
|
704
|
+
|
600
705
|
<example _encoding="base64" host.mac="00-AA-19-38-AA-00" hw.model="WS-C1924-EN" host.id="FAB0341AAAA">
|
601
706
|
Q2F0YWx5c3QgMTkwMCBNYW5hZ2VtZW50IENvbnNvbGUNCkNvcHlyaWdodCAoYykgQ2lzY28gU
|
602
707
|
3lzdGVtcywgSW5jLiAgMTk5My0xOTk4DQpBbGwgcmlnaHRzIHJlc2VydmVkLg0KRW50ZXJwcm
|
@@ -616,15 +721,18 @@
|
|
616
721
|
<param pos="2" name="hw.model"/>
|
617
722
|
<param pos="3" name="host.id"/>
|
618
723
|
</fingerprint>
|
724
|
+
|
619
725
|
<fingerprint pattern="^192.0.0.64 login:\s*$">
|
620
726
|
<description>Hikvision cameras and NVRs (multiple)</description>
|
621
727
|
<example>192.0.0.64 login:</example>
|
622
728
|
<param pos="0" name="os.vendor" value="Hikvision"/>
|
623
729
|
<param pos="0" name="hw.vendor" value="Hikvision"/>
|
624
730
|
</fingerprint>
|
731
|
+
|
625
732
|
<fingerprint pattern="^Remote Management Console\r\nlogin:\s*$">
|
626
733
|
<description>Juniper Netscreen</description>
|
627
734
|
<!-- Remote Management Console\r\nlogin: -->
|
735
|
+
|
628
736
|
<example _encoding="base64">UmVtb3RlIE1hbmFnZW1lbnQgQ29uc29sZQ0KbG9naW46Cg==</example>
|
629
737
|
<param pos="0" name="os.vendor" value="Juniper"/>
|
630
738
|
<param pos="0" name="os.device" value="Firewall"/>
|
@@ -635,6 +743,7 @@
|
|
635
743
|
<param pos="0" name="hw.device" value="Firewall"/>
|
636
744
|
<param pos="0" name="hw.product" value="NetScreen"/>
|
637
745
|
</fingerprint>
|
746
|
+
|
638
747
|
<fingerprint pattern="^(?:\r|\n)*(FGT\w{13}) login:\s*$">
|
639
748
|
<description>Fortinet FortiGate - w/ autogenerated hostname</description>
|
640
749
|
<example host.name="FGT60C3G13001111">FGT60C3G13001111 login:</example>
|
@@ -648,6 +757,7 @@
|
|
648
757
|
<param pos="0" name="hw.device" value="Firewall"/>
|
649
758
|
<param pos="1" name="host.name"/>
|
650
759
|
</fingerprint>
|
760
|
+
|
651
761
|
<fingerprint pattern="^(?:\r|\n)*KWS-1043N login:\s*$">
|
652
762
|
<description>Clipcomm KWS router</description>
|
653
763
|
<example hw.product="KWS-1043N">KWS-1043N login:</example>
|
@@ -655,6 +765,7 @@
|
|
655
765
|
<param pos="0" name="hw.device" value="Router"/>
|
656
766
|
<param pos="0" name="hw.product" value="KWS-1043N"/>
|
657
767
|
</fingerprint>
|
768
|
+
|
658
769
|
<fingerprint pattern="^(?:\r|\n)*(SMCD3\w+-\w\w\w) login:\s*$">
|
659
770
|
<description>SMC Cable Modem</description>
|
660
771
|
<example hw.product="SMCD3GN2-BIZ">SMCD3GN2-BIZ login:</example>
|
@@ -662,6 +773,7 @@
|
|
662
773
|
<param pos="0" name="hw.device" value="Cable Modem"/>
|
663
774
|
<param pos="1" name="hw.product"/>
|
664
775
|
</fingerprint>
|
776
|
+
|
665
777
|
<fingerprint pattern="^(?:\r|\n)*ADB-4820CD login:\s*$">
|
666
778
|
<description>ADB ADB-4820CD DVR</description>
|
667
779
|
<example>ADB-4820CD login:</example>
|
@@ -669,6 +781,7 @@
|
|
669
781
|
<param pos="0" name="hw.device" value="DVR"/>
|
670
782
|
<param pos="0" name="hw.product" value="ADB-4820CD"/>
|
671
783
|
</fingerprint>
|
784
|
+
|
672
785
|
<fingerprint pattern="^(?:\r|\n)*IMDVRS login:\s*$">
|
673
786
|
<description>Rifatron IMDVRS DVR</description>
|
674
787
|
<example>IMDVRS login:</example>
|
@@ -676,41 +789,51 @@
|
|
676
789
|
<param pos="0" name="hw.family" value="IMDVR"/>
|
677
790
|
<param pos="0" name="hw.device" value="DVR"/>
|
678
791
|
</fingerprint>
|
792
|
+
|
679
793
|
<fingerprint pattern="^(?:\r|\n)*Ruijie login:\s*$">
|
680
794
|
<description>Ruijie device (likely router/switch)</description>
|
681
795
|
<example>Ruijie login:</example>
|
682
796
|
<param pos="0" name="hw.vendor" value="Ruijie"/>
|
683
797
|
</fingerprint>
|
798
|
+
|
684
799
|
<fingerprint pattern="^Welcome to Microsoft Telnet Service \r\n\n\rlogin:\s*$">
|
685
800
|
<description>Microsoft Windows</description>
|
686
801
|
<!-- Welcome to Microsoft Telnet Service \r\n\n\rlogin: -->
|
802
|
+
|
687
803
|
<example _encoding="base64">V2VsY29tZSB0byBNaWNyb3NvZnQgVGVsbmV0IFNlcnZpY2UgDQoKDWxvZ2luOgo=</example>
|
688
804
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
689
805
|
<param pos="0" name="os.family" value="Windows"/>
|
690
806
|
<param pos="0" name="os.product" value="Windows"/>
|
691
807
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
692
808
|
</fingerprint>
|
809
|
+
|
693
810
|
<!-- The following fingerprints are for generic Broadcom hardware where the
|
694
811
|
vendor has left the default banner in place. These could be rebadged by
|
695
812
|
ZTE, CenturyLink, Sky, Huawei, etc.
|
696
813
|
-->
|
814
|
+
|
697
815
|
<fingerprint pattern="^(BCM\d+) (?:Broadband|ADSL|xDSL|DSL) Router\r\nLogin:\s*">
|
698
816
|
<description>OEM'd Broadcom Router</description>
|
699
817
|
<!-- BCM963268 Broadband Router\r\nLogin: -->
|
818
|
+
|
700
819
|
<example _encoding="base64" hw.product="BCM963268">QkNNOTYzMjY4IEJyb2FkYmFuZCBSb3V0ZXINCkxvZ2luOgo=</example>
|
701
820
|
<param pos="0" name="hw.device" value="Router"/>
|
702
821
|
<param pos="1" name="hw.product"/>
|
703
822
|
</fingerprint>
|
823
|
+
|
704
824
|
<fingerprint pattern="^(BCM\d+) Broadband Router\r\nTelnet is Disabled in WAN Side$">
|
705
825
|
<description>OEM'd Broadcom Router - telnet disabled on WAN side</description>
|
706
826
|
<!-- BCM963268 Broadband Router\r\nTelnet is Disabled in WAN Side -->
|
827
|
+
|
707
828
|
<example _encoding="base64" hw.product="BCM963268">QkNNOTYzMjY4IEJyb2FkYmFuZCBSb3V0ZXINClRlbG5ldCBpcyBEaXNhYmxlZCBpbiBXQU4gU2lkZQo=</example>
|
708
829
|
<param pos="0" name="hw.device" value="Router"/>
|
709
830
|
<param pos="1" name="hw.product"/>
|
710
831
|
</fingerprint>
|
832
|
+
|
711
833
|
<fingerprint pattern="^(?m)(BCM\d+) Broadband Router\r\n.*Please input the verification code:$" flags="REG_MULTILINE">
|
712
834
|
<description>OEM'd Broadcom Router - input validation code</description>
|
713
835
|
<!-- BCM96318 Broadband Router\r\n====================================================\r\n * * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * * * * \r\n====================================================\r\nPlease input the verification code: -->
|
836
|
+
|
714
837
|
<example _encoding="base64" hw.product="BCM96318">
|
715
838
|
QkNNOTYzMTggQnJvYWRiYW5kIFJvdXRlcg0KPT09PT09PT09PT09PT09PT09PT09PT09PT09P
|
716
839
|
T09PT09PT09PT09PT09PT09PT09PT09PQ0KICAgICogKiAgICAgICAgICogKiAqICogICAgIC
|
@@ -726,9 +849,11 @@
|
|
726
849
|
<param pos="0" name="hw.device" value="Router"/>
|
727
850
|
<param pos="1" name="hw.product"/>
|
728
851
|
</fingerprint>
|
852
|
+
|
729
853
|
<fingerprint pattern="^(BCM\d+) Broadband Router\r\nMaximum number of incorrect account entries exceeded.">
|
730
854
|
<description>OEM'd Broadcom Router - Max incorrect tries - variant 1</description>
|
731
855
|
<!-- BCM96328 Broadband Router\r\nMaximum number of incorrect account entries exceeded. -->
|
856
|
+
|
732
857
|
<example _encoding="base64" hw.product="BCM96328">
|
733
858
|
QkNNOTYzMjggQnJvYWRiYW5kIFJvdXRlcg0KTWF4aW11bSBudW1iZXIgb2YgaW5jb3JyZWN0I
|
734
859
|
GFjY291bnQgZW50cmllcyBleGNlZWRlZC4K
|
@@ -736,9 +861,11 @@
|
|
736
861
|
<param pos="0" name="hw.device" value="Router"/>
|
737
862
|
<param pos="1" name="hw.product"/>
|
738
863
|
</fingerprint>
|
864
|
+
|
739
865
|
<fingerprint pattern="^(BCM\d+) Broadband Router\r\nSorry, you need to wait for \d+ second before next login attempt.(?:\r|\n)*">
|
740
866
|
<description>OEM'd Broadcom Router - Max incorrect tries - variant 2</description>
|
741
867
|
<!-- BCM96816 Broadband Router\r\nSorry, you need to wait for 119 second before next login attempt. -->
|
868
|
+
|
742
869
|
<example _encoding="base64" hw.product="BCM96816">
|
743
870
|
QkNNOTY4MTYgQnJvYWRiYW5kIFJvdXRlcg0KU29ycnksIHlvdSBuZWVkIHRvIHdhaXQgZm9yI
|
744
871
|
DExOSBzZWNvbmQgYmVmb3JlIG5leHQgbG9naW4gYXR0ZW1wdC4K
|
@@ -746,10 +873,13 @@
|
|
746
873
|
<param pos="0" name="hw.device" value="Router"/>
|
747
874
|
<param pos="1" name="hw.product"/>
|
748
875
|
</fingerprint>
|
876
|
+
|
749
877
|
<!-- Moxa Industrial Solutions-->
|
878
|
+
|
750
879
|
<fingerprint pattern="^(?:\r|\n)*NPort (NP6[\w-]+)(?:\r|\n|\x00)+Console terminal type">
|
751
880
|
<description>Moxa NPort Terminal Server - 6xxx Series</description>
|
752
881
|
<!-- NPort NP6610-32\r\u0000\nConsole terminal type (1: ansi/vt100, 2: vt52) : 1 -->
|
882
|
+
|
753
883
|
<example _encoding="base64" hw.product="NP6610-32">
|
754
884
|
TlBvcnQgTlA2NjEwLTMyDQAKQ29uc29sZSB0ZXJtaW5hbCB0eXBlICgxOiBhbnNpL3Z0MTAwLC
|
755
885
|
AyOiB2dDUyKSA6IDE=
|
@@ -759,9 +889,11 @@
|
|
759
889
|
<param pos="0" name="hw.device" value="Device Server"/>
|
760
890
|
<param pos="1" name="hw.product"/>
|
761
891
|
</fingerprint>
|
892
|
+
|
762
893
|
<fingerprint pattern="^Model name\s+: NPort (IA-\d+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+System uptime">
|
763
894
|
<description>Moxa NPort Device Server - IA Series</description>
|
764
895
|
<!-- Model name : NPort IA-5250\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 281\r\u0000\nFirmware version : 1.6 Build 17060616\r\u0000\nSystem uptime : 31 days, 06h:03m:45s\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
896
|
+
|
765
897
|
<example _encoding="base64" hw.product="IA-5250" host.mac="00:90:E8:AA:AA:AA" host.id="281" os.version="1.6" os.version.version="17060616">
|
766
898
|
TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IElBLTUyNTANAApNQUMgYWRkcmVzcyAgICAgIDogM
|
767
899
|
DA6OTA6RTg6QUE6QUE6QUENAApTZXJpYWwgTm8uICAgICAgIDogMjgxDQAKRmlybXdhcmUgdm
|
@@ -777,10 +909,13 @@
|
|
777
909
|
<param pos="4" name="os.version"/>
|
778
910
|
<param pos="5" name="os.version.version"/>
|
779
911
|
</fingerprint>
|
912
|
+
|
780
913
|
<fingerprint pattern="^(?:\r|\n|\x00|-)*Model name\s+: NPort (5[\w-]+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
|
781
914
|
<description>Moxa NPort Device Server - 5xxx Series</description>
|
782
915
|
<!-- Some versions of the banner below have a line full of dashes which cannot be included in the example comment -->
|
916
|
+
|
783
917
|
<!-- Model name : NPort 5610-8-DT\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9522\r\u0000\nFirmware version : 2.2 Build 11090613\r\u0000\nSystem uptime : 8 days, 02h:11m:44s\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
918
|
+
|
784
919
|
<example _encoding="base64" hw.product="5610-8-DT" host.mac="00:90:E8:AA:AA:AA" host.id="9522" os.version="2.2" os.version.version="11090613">
|
785
920
|
TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IDU2MTAtOC1EVA0ACk1BQyBhZGRyZXNzICAgICAgO
|
786
921
|
iAwMDo5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NTIyDQAKRmlybXdhcm
|
@@ -796,9 +931,11 @@
|
|
796
931
|
<param pos="4" name="os.version"/>
|
797
932
|
<param pos="5" name="os.version.version"/>
|
798
933
|
</fingerprint>
|
934
|
+
|
799
935
|
<fingerprint pattern="^Model name\s+: MGate (MB3[\w-]+)(?:\r|\n|\x00|)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
|
800
936
|
<description>Moxa MGate Modbus Gateway</description>
|
801
937
|
<!-- Model name : MGate MB3180\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9474\r\u0000\nFirmware version : 1.2 Build 09101913\r\u0000\nSystem uptime : 15 days, 16h:37m:48s\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
938
|
+
|
802
939
|
<example _encoding="base64" hw.product="MB3180" host.mac="00:90:E8:AA:AA:AA" host.id="9474" os.version="1.2" os.version.version="09101913">
|
803
940
|
TW9kZWwgbmFtZSAgICAgICA6IE1HYXRlIE1CMzE4MA0ACk1BQyBhZGRyZXNzICAgICAgOiAwM
|
804
941
|
Do5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NDc0DQAKRmlybXdhcmUgdm
|
@@ -814,9 +951,11 @@
|
|
814
951
|
<param pos="4" name="os.version"/>
|
815
952
|
<param pos="5" name="os.version.version"/>
|
816
953
|
</fingerprint>
|
954
|
+
|
817
955
|
<fingerprint pattern="^Model name\s+: (NE[\w-]+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
|
818
956
|
<description>Moxa NE Series Embedded device server</description>
|
819
957
|
<!-- Model name : NE-4110S\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No : 3616\r\u0000\nFirmware version : 4.1 Build 07061517\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
958
|
+
|
820
959
|
<example _encoding="base64" hw.product="NE-4110S" host.mac="00:90:E8:AA:AA:AA" host.id="3616" os.version="4.1" os.version.version="07061517">
|
821
960
|
TW9kZWwgbmFtZSAgICAgICA6IE5FLTQxMTBTDQAKTUFDIGFkZHJlc3MgICAgICA6IDAwOjkwO
|
822
961
|
kU4OkFBOkFBOkFBDQAKU2VyaWFsIE5vICAgICAgICA6IDM2MTYNAApGaXJtd2FyZSB2ZXJzaW
|
@@ -831,25 +970,29 @@
|
|
831
970
|
<param pos="4" name="os.version"/>
|
832
971
|
<param pos="5" name="os.version.version"/>
|
833
972
|
</fingerprint>
|
973
|
+
|
834
974
|
<fingerprint pattern="^Red Hat Linux release ([^\\s]+)\\s*.*$">
|
835
975
|
<description>RedHat general purpose linux</description>
|
836
976
|
<!-- Red Hat Linux release 9 (Shrike)\nKernel 2.4.20-8 on an i686\nlogin: -->
|
977
|
+
|
837
978
|
<example _encoding="base64" os.version="9 (Shrike)">
|
838
979
|
UmVkIEhhdCBMaW51eCByZWxlYXNlIDkgKFNocmlrZSlcbktlcm5lbCAyLjQuMjAtOCBvbiBhbiBpNjg2XG5sb2dpbjo=
|
839
980
|
</example>
|
840
|
-
<param pos="0" name="os.vendor" value="
|
981
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
841
982
|
<param pos="0" name="os.family" value="Linux"/>
|
842
983
|
<param pos="0" name="os.device" value="Linux"/>
|
843
984
|
<param pos="1" name="os.version"/>
|
844
985
|
</fingerprint>
|
986
|
+
|
845
987
|
<fingerprint pattern="^(?m)Red Hat Enterprise Linux ES release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
|
846
988
|
<description>RedHat Enterprise Linux ES</description>
|
847
989
|
<!-- Red Hat Enterprise Linux ES release 3 (Taroon Update 9\nKernel 2.4.21-47.EL on an x86_64\nlogin: -->
|
990
|
+
|
848
991
|
<example _encoding="base64" os.version="3" linux.kernel.version="2.4.21-47.EL" os.arch="x86_64">
|
849
992
|
UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IEVTIHJlbGVhc2UgMyAoVGFyb29uIFVwZGF0ZSA5KQpLZXJuZWwgMi40LjIxLTQ3Lk
|
850
993
|
VMIG9uIGFuIHg4Nl82NApsb2dpbjo=
|
851
994
|
</example>
|
852
|
-
<param pos="0" name="os.vendor" value="
|
995
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
853
996
|
<param pos="0" name="os.family" value="Linux"/>
|
854
997
|
<param pos="0" name="os.product" value="Linux"/>
|
855
998
|
<param pos="1" name="os.version"/>
|
@@ -857,41 +1000,47 @@
|
|
857
1000
|
<param pos="3" name="os.arch"/>
|
858
1001
|
<param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:{os.version}"/>
|
859
1002
|
</fingerprint>
|
1003
|
+
|
860
1004
|
<fingerprint pattern="^(?m)Red Hat Enterprise Linux AS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
|
861
1005
|
<description>RedHat Enterprise Linux AS</description>
|
862
1006
|
<!-- Red Hat Enterprise Linux AS release 5.8 (Tikanga)\nKernel 2.6.18-308.11.1.el5 on an x86_64\nlogin: -->
|
1007
|
+
|
863
1008
|
<example _encoding="base64" os.version="5.8" linux.kernel.version="2.6.18-308.11.1.el5" os.arch="x86_64">
|
864
1009
|
UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IEFTIHJlbGVhc2UgNS44IChUaWthbmdhKQpLZXJuZWwgM
|
865
1010
|
i42LjE4LTMwOC4xMS4xLmVsNSBvbiBhbiB4ODZfNjQKbG9naW46
|
866
1011
|
</example>
|
867
|
-
<param pos="0" name="os.vendor" value="
|
1012
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
868
1013
|
<param pos="0" name="os.family" value="Linux"/>
|
869
1014
|
<param pos="0" name="os.product" value="RedHat Enterprise AS"/>
|
870
1015
|
<param pos="1" name="os.version"/>
|
871
1016
|
<param pos="2" name="linux.kernel.version"/>
|
872
1017
|
<param pos="3" name="os.arch"/>
|
873
1018
|
</fingerprint>
|
1019
|
+
|
874
1020
|
<fingerprint pattern="^(?m)Red Hat Enterprise Linux WS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*)" flags="REG_MULTILINE">
|
875
1021
|
<description>RedHat Enterprise Linux WS</description>
|
876
1022
|
<!--Red Hat Enterprise Linux WS release 2.1 (Tampa) \nKernel 2.4.9-e.40smp on an i686 \nlogin: -->
|
1023
|
+
|
877
1024
|
<example _encoding="base64" os.version="2.1" linux.kernel.version="2.4.9-e.40smp" os.arch="i686">
|
878
1025
|
UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IFdTIHJlbGVhc2UgMi4xIChUYW1wY
|
879
1026
|
SkgCktlcm5lbCAyLjQuOS1lLjQwc21wIG9uIGFuIGk2ODYgCmxvZ2luOiA=
|
880
1027
|
</example>
|
881
|
-
<param pos="0" name="os.vendor" value="
|
1028
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
882
1029
|
<param pos="0" name="os.family" value="Linux"/>
|
883
1030
|
<param pos="0" name="os.product" value="RedHat Enterprise WS"/>
|
884
1031
|
<param pos="1" name="os.version"/>
|
885
1032
|
<param pos="2" name="linux.kernel.version"/>
|
886
1033
|
<param pos="3" name="os.arch"/>
|
887
1034
|
</fingerprint>
|
1035
|
+
|
888
1036
|
<fingerprint pattern="^(?m)Fedora Core.release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d).*$" flags="REG_MULTILINE">
|
889
1037
|
<description>Fedora Core Release</description>
|
890
1038
|
<!-- Fedora Core release 1 (Yarrow)\nKernel 2.4.20-13.9ensim-3.5.0-13 on an i686\nlogin:-->
|
1039
|
+
|
891
1040
|
<example _encoding="base64" os.version="1" linux.kernel.version="2.4.20-13.9ensim-3.5.0-13" os.arch="i686">
|
892
1041
|
RmVkb3JhIENvcmUgcmVsZWFzZSAxIChZYXJyb3cpCktlcm5lbCAyLjQuMjAtMTMuOWVuc2ltLTMuNS4wLTEzIG9uIGFuIGk2ODYKbG9naW46
|
893
1042
|
</example>
|
894
|
-
<param pos="0" name="os.vendor" value="
|
1043
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
895
1044
|
<param pos="0" name="os.family" value="Linux"/>
|
896
1045
|
<param pos="0" name="os.product" value="Fedora"/>
|
897
1046
|
<param pos="1" name="os.version"/>
|
@@ -899,9 +1048,11 @@
|
|
899
1048
|
<param pos="3" name="os.arch"/>
|
900
1049
|
<param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora:{os.version}"/>
|
901
1050
|
</fingerprint>
|
1051
|
+
|
902
1052
|
<fingerprint pattern="^(?m)Welcome to SuSE Linux (.*) \(([^\)]+)\) - Kernel (.*) .*">
|
903
1053
|
<description>SuSE Linux</description>
|
904
1054
|
<!-- Welcome to SuSE Linux 7.0 (i386) - Kernel 2.2.16-RAID (0). 2VG029037\n\nlogin: -->
|
1055
|
+
|
905
1056
|
<example _encoding="base64" os.version="7.0" os.arch="i386" linux.kernel.version="2.2.16-RAID (0). 2VG029037">
|
906
1057
|
V2VsY29tZSB0byBTdVNFIExpbnV4IDcuMCAoaTM4NikgLSBLZXJuZWwgMi4yLjE2LVJBSUQgKDApLiAyVkcwMjkwMzcgCgpsb2dpbjo=
|
907
1058
|
</example>
|
@@ -913,9 +1064,11 @@
|
|
913
1064
|
<param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:{os.version}"/>
|
914
1065
|
<param pos="3" name="linux.kernel.version"/>
|
915
1066
|
</fingerprint>
|
1067
|
+
|
916
1068
|
<fingerprint pattern="^Turbolinux ApplianceServer (\d+\.\d+).*">
|
917
1069
|
<description>Turbolinux ApplianceServer</description>
|
918
1070
|
<!--Turbolinux ApplianceServer 4.0 (Atlas2) Linux 2.6.32-431.23.3.el6.x86_64 on a x86_64\n(senyo191x89.digitalink.ne.jp) TTY: 12:15 on Tuesday, 02 October 2018 login: -->
|
1071
|
+
|
919
1072
|
<example _encoding="base64" os.version="4.0">
|
920
1073
|
VHVyYm9saW51eCBBcHBsaWFuY2VTZXJ2ZXIgNC4wIChBdGxhczIpIExpbnV4IDIuNi4zMi00MzEuMjMuMy5lbDYueDg
|
921
1074
|
2XzY0IG9uIGEgeDg2XzY0IChzZW55bzE5MXg4OS5kaWdpdGFsaW5rLm5lLmpwKSBUVFk6IDEyOjE1IG9uIFR1ZXNkYX
|
@@ -926,9 +1079,11 @@
|
|
926
1079
|
<param pos="0" name="os.product" value="Linux"/>
|
927
1080
|
<param pos="1" name="os.version"/>
|
928
1081
|
</fingerprint>
|
1082
|
+
|
929
1083
|
<fingerprint pattern="^UnixWare ([^ ]+).*$">
|
930
1084
|
<description>UnixWare</description>
|
931
1085
|
<!-- UnixWare 2.1.3 (profil) (pts/3)\n\n\nlogin: -->
|
1086
|
+
|
932
1087
|
<example _encoding="base64" os.version="2.1.3">
|
933
1088
|
VW5peFdhcmUgMi4xLjMgKHByb2ZpbCkgKHB0cy8zKQoKCgpsb2dpbjog
|
934
1089
|
</example>
|
@@ -938,9 +1093,11 @@
|
|
938
1093
|
<param pos="0" name="os.product" value="UnixWare"/>
|
939
1094
|
<param pos="1" name="os.version"/>
|
940
1095
|
</fingerprint>
|
1096
|
+
|
941
1097
|
<fingerprint pattern="^Telnet Server Build (5.*)">
|
942
1098
|
<description>Windows 2000</description>
|
943
1099
|
<!--Microsoft (R) Windows NT (TM) Version 4.00 (Build 1381)\nWelcome to Microsoft Telnet Service \nTelnet Server Build 5.00.99034.1\nlogin: -->
|
1100
|
+
|
944
1101
|
<example _encoding="base64" os.version="5.00.99034.1">
|
945
1102
|
TWljcm9zb2Z0IChSKSBXaW5kb3dzIE5UIChUTSkgVmVyc2lvbiA0LjAwIChCdWlsZCAxMzgxKQpXZWxj
|
946
1103
|
b21lIHRvIE1pY3Jvc29mdCBUZWxuZXQgU2VydmljZSAKVGVsbmV0IFNlcnZlciBCdWlsZCA1LjAwLjk5MDM0LjEKCmxvZ2luOiA=
|
@@ -951,9 +1108,11 @@
|
|
951
1108
|
<param pos="1" name="os.version"/>
|
952
1109
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:{os.version}"/>
|
953
1110
|
</fingerprint>
|
1111
|
+
|
954
1112
|
<fingerprint pattern="^Welcome. Type return, enter password at # prompt">
|
955
1113
|
<description>Brother Printer</description>
|
956
1114
|
<!-- Welcome. Type return, enter password at # prompt -->
|
1115
|
+
|
957
1116
|
<example _encoding="base64">
|
958
1117
|
V2VsY29tZS4gVHlwZSByZXR1cm4sIGVudGVyIHBhc3N3b3JkIGF0ICMgcHJvbXB0Cg==
|
959
1118
|
</example>
|
@@ -962,9 +1121,11 @@
|
|
962
1121
|
<param pos="0" name="os.device" value="Printer"/>
|
963
1122
|
<param pos="0" name="os.product" value="Brother Printer"/>
|
964
1123
|
</fingerprint>
|
1124
|
+
|
965
1125
|
<fingerprint pattern="^(.*) Copyright by ARESCOM">
|
966
1126
|
<description>Arescom System</description>
|
967
1127
|
<!--NDS1260HE-TLI Copyright by ARESCOM 2002\n\n\nPassword: -->
|
1128
|
+
|
968
1129
|
<example _encoding="base64" os.model="NDS1260HE-TLI">
|
969
1130
|
TkRTMTI2MEhFLVRMSSBDb3B5cmlnaHQgYnkgQVJFU0NPTSAyMDAyCgoKClBhc3N3b3JkOgo=
|
970
1131
|
</example>
|
@@ -972,30 +1133,36 @@
|
|
972
1133
|
<param pos="0" name="os.device" value="WAP"/>
|
973
1134
|
<param pos="1" name="os.model"/>
|
974
1135
|
</fingerprint>
|
1136
|
+
|
975
1137
|
<fingerprint pattern="^Welcome to ViewStation">
|
976
1138
|
<description>Polycom ViewStation Video Vonference System</description>
|
977
1139
|
<!-- Welcome to ViewStation\nPassword: -->
|
1140
|
+
|
978
1141
|
<example _encoding="base64">
|
979
1142
|
V2VsY29tZSB0byBWaWV3U3RhdGlvbgoKUGFzc3dvcmQ6
|
980
1143
|
</example>
|
981
1144
|
<param pos="0" name="os.vendor" value="Polycom"/>
|
982
1145
|
<param pos="0" name="os.device" value="ViewStation"/>
|
983
1146
|
</fingerprint>
|
1147
|
+
|
984
1148
|
<fingerprint pattern="^FlowPoint\/(.*) SDSL \[ATM\] Router .*v(.*) Ready">
|
985
1149
|
<!--FlowPoint/2200 SDSL [ATM] Router fp2200-12 v3.0.2 Ready\nLogin: -->
|
1150
|
+
|
986
1151
|
<description>FlowPoint 2200 DSL router</description>
|
987
1152
|
<example _encoding="base64" hw.model="2200" os.version="3.0.2">
|
988
1153
|
Rmxvd1BvaW50LzIyMDAgU0RTTCBbQVRNXSBSb3V0ZXIgZnAyMjAwLTEyIHYzLjAuMiBSZWFkeQpMb2dpbjog
|
989
1154
|
</example>
|
990
|
-
<param pos="0" name="os.vendor" value="
|
1155
|
+
<param pos="0" name="os.vendor" value="FlowPoint"/>
|
991
1156
|
<param pos="0" name="hw.device" value="Broadband router"/>
|
992
|
-
<param pos="0" name="hw.product" value="DSL
|
1157
|
+
<param pos="0" name="hw.product" value="DSL Router"/>
|
993
1158
|
<param pos="1" name="hw.model"/>
|
994
1159
|
<param pos="2" name="os.version"/>
|
995
1160
|
</fingerprint>
|
1161
|
+
|
996
1162
|
<fingerprint pattern="^GlobespanVirata Inc\., Software Release (.*)">
|
997
1163
|
<description>GlobespanVirata broadband router</description>
|
998
1164
|
<!--GlobespanVirata Inc., Software Release 2.1.040407a3_u_e_A\nCopyright (c) 2001-2003 by GlobespanVirata, Inc.\n\nlogin: -->
|
1165
|
+
|
999
1166
|
<example _encoding="base64" os.version="2.1.040407a3_u_e_A">
|
1000
1167
|
R2xvYmVzcGFuVmlyYXRhIEluYy4sIFNvZnR3YXJlIFJlbGVhc2UgMi4xLjA0MDQwN2EzX3VfZV9BCgpDb3B5cmlnaHQgKG
|
1001
1168
|
MpIDIwMDEtMjAwMyBieSBHbG9iZXNwYW5WaXJhdGEsIEluYy4KCgpsb2dpbjog
|
@@ -1004,14 +1171,17 @@
|
|
1004
1171
|
<param pos="0" name="hw.device" value="Broadband router"/>
|
1005
1172
|
<param pos="1" name="os.version"/>
|
1006
1173
|
</fingerprint>
|
1174
|
+
|
1007
1175
|
<fingerprint pattern="^VxWorks login:">
|
1008
1176
|
<description>VxWorks embedded device</description>
|
1009
1177
|
<example>VxWorks login: </example>
|
1010
1178
|
<param pos="0" name="os.family" value="VxWorks"/>
|
1011
1179
|
</fingerprint>
|
1180
|
+
|
1012
1181
|
<fingerprint pattern=".*Nortel.*Passport ([^ ]*) .*Software Release ([^ ]*).*">
|
1013
1182
|
<description>Nortel Passport</description>
|
1014
1183
|
<!-- *********************************************\n\n\n* Copyright (c) 2003 Nortel Networks, Inc. *\n\n\n* All Rights Reserved *\n\n\n* Passport 8010 *\n\n\n* Software Release 3.5.0.0 *\n\n\n*********************************************\n\n\n\n\nLogin: -->
|
1184
|
+
|
1015
1185
|
<example _encoding="base64" os.product="8010" os.version="3.5.0.0">
|
1016
1186
|
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG5cblxuKiBDb3B5cmlnaHQgKG
|
1017
1187
|
MpIDIwMDMgTm9ydGVsIE5ldHdvcmtzLCBJbmMuICAqXG5cblxuKiBBbGwgUmlnaHRzIFJlc2VydmVkICAgICAg
|
@@ -1024,9 +1194,11 @@
|
|
1024
1194
|
<param pos="1" name="os.product"/>
|
1025
1195
|
<param pos="2" name="os.version"/>
|
1026
1196
|
</fingerprint>
|
1197
|
+
|
1027
1198
|
<fingerprint pattern="^IPSO.* \((.*)\) \(tty.*\)">
|
1028
1199
|
<description>Checkpoint Firewall-1 running on a Nokia IPSO appliance</description>
|
1029
1200
|
<!-- IPSO/i386 (BJ-IDC-FW2) (ttyp7)\n\n\nThis system is for authorized use only.\n\n\n\n\n\n\nlogin: -->
|
1201
|
+
|
1030
1202
|
<example _encoding="base64" host.name="BJ-IDC-FW2">
|
1031
1203
|
SVBTTy9pMzg2IChCSi1JREMtRlcyKSAodHR5cDcpCgoKClRoaXMgc3lzdGVtIGlzIGZvciBhdXRob3Jpem
|
1032
1204
|
VkIHVzZSBvbmx5LgoKCgoKCgoKbG9naW46IA==
|
@@ -1037,10 +1209,13 @@
|
|
1037
1209
|
<param pos="0" name="os.product" value="IPSO"/>
|
1038
1210
|
<param pos="1" name="host.name"/>
|
1039
1211
|
</fingerprint>
|
1212
|
+
|
1040
1213
|
<fingerprint pattern="Tasman Networks Inc.*Telnet Login">
|
1041
1214
|
<description>Tasman Networks Login</description>
|
1042
1215
|
<!-- #\n# Tasman Networks Inc. Telnet Login\n#Escape character is '^]'\n\n\n\nlogin: -->
|
1216
|
+
|
1043
1217
|
<!-- Dashes removed from example banner due to xml issue -->
|
1218
|
+
|
1044
1219
|
<example _encoding="base64" os.vendor="Tasman Networks">
|
1045
1220
|
Iy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0
|
1046
1221
|
tLS0tLS0tCiMgVGFzbWFuIE5ldHdvcmtzIEluYy4gVGVsbmV0IExvZ2luCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS
|
@@ -1051,9 +1226,11 @@
|
|
1051
1226
|
<param pos="0" name="os.device" value="Router"/>
|
1052
1227
|
<param pos="0" name="os.product" value="Tasman Networks router"/>
|
1053
1228
|
</fingerprint>
|
1229
|
+
|
1054
1230
|
<fingerprint pattern="Pragma Systems">
|
1055
1231
|
<description>MS Windows running Pragma TelnetD server</description>
|
1056
1232
|
<!-- Welcome to Gemadept Logistics RF Server\n(C) Copyright 1994-2012 Pragma Systems, Inc.\nlogin name: -->
|
1233
|
+
|
1057
1234
|
<example _encoding="base64">
|
1058
1235
|
V2VsY29tZSB0byBHZW1hZGVwdCBMb2dpc3RpY3MgUkYgU2VydmVyCihDKSBDb3B5cmlnaHQgMTk5NC0yMDEyIFB
|
1059
1236
|
yYWdtYSBTeXN0ZW1zLCBJbmMuCgpsb2dpbiBuYW1lOiA=
|
@@ -1063,18 +1240,25 @@
|
|
1063
1240
|
<param pos="0" name="os.product" value="Windows"/>
|
1064
1241
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1065
1242
|
</fingerprint>
|
1243
|
+
|
1066
1244
|
<fingerprint pattern="^Application Required. No Installation Default">
|
1067
1245
|
<description>probably IBM AS/400 running TN3270 or 5250 emulation server</description>
|
1068
1246
|
<!-- Application Required. No Installation Default\nEnter Application Name: -->
|
1247
|
+
|
1069
1248
|
<example _encoding="base64">
|
1070
1249
|
QXBwbGljYXRpb24gUmVxdWlyZWQuIE5vIEluc3RhbGxhdGlvbiBEZWZhdWx0ICAgICAgICA
|
1071
1250
|
gICAgICAgICAgICAgICAgICAgICAgICAgIApFbnRlciBBcHBsaWNhdGlvbiBOYW1lOg==
|
1072
1251
|
</example>
|
1073
1252
|
<param pos="0" name="os.vendor" value="IBM"/>
|
1253
|
+
<param pos="0" name="os.family" value="OS/400"/>
|
1254
|
+
<param pos="0" name="os.product" value="OS/400"/>
|
1255
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:-"/>
|
1074
1256
|
</fingerprint>
|
1257
|
+
|
1075
1258
|
<fingerprint pattern="^This copy of the Ataman TCP Remote Logon Services">
|
1076
1259
|
<description>Windows NT/2k/2k3 running Ataman telnet server</description>
|
1077
1260
|
<!-- This copy of the Ataman TCP Remote Logon Services is registered as licensed to:\nECI2/DDMS\nAccount Name: -->
|
1261
|
+
|
1078
1262
|
<example _encoding="base64">
|
1079
1263
|
VGhpcyBjb3B5IG9mIHRoZSBBdGFtYW4gVENQIFJlbW90ZSBMb2dvbiBTZXJ2aWNlcyBpcyByZWdpc3RlcmVkIG
|
1080
1264
|
FzIGxpY2Vuc2VkIHRvOgoJRUNJMi9ERE1TCgpBY2NvdW50IE5hbWU6IA==
|
@@ -1084,9 +1268,11 @@
|
|
1084
1268
|
<param pos="0" name="os.product" value="Windows"/>
|
1085
1269
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1086
1270
|
</fingerprint>
|
1271
|
+
|
1087
1272
|
<fingerprint pattern="Cobalt Linux release\W(.*)\W\(.*">
|
1088
1273
|
<description>Cobalt Linux</description>
|
1089
1274
|
<!-- Cobalt Linux release 6.0 (Shinkansen)\nKernel 2.2.16C37_III on an i586\nlogin: -->
|
1275
|
+
|
1090
1276
|
<example _encoding="base64" os.version="6.0">
|
1091
1277
|
Q29iYWx0IExpbnV4IHJlbGVhc2UgNi4wIChTaGlua2Fuc2VuKQpLZXJuZWwgMi4yLjE2QzM3X0lJSSBvbiBhbiBpNTg2CmxvZ2luOiA=
|
1092
1278
|
</example>
|
@@ -1095,9 +1281,11 @@
|
|
1095
1281
|
<param pos="0" name="os.product" value="Linux"/>
|
1096
1282
|
<param pos="1" name="os.version"/>
|
1097
1283
|
</fingerprint>
|
1284
|
+
|
1098
1285
|
<fingerprint pattern="^Check Point FireWall-1 authenticated Telnet server running on (.*)">
|
1099
1286
|
<description>Check Point Firewall-1</description>
|
1100
1287
|
<!-- Check Point FireWall-1 authenticated Telnet server running on gaatdrf2\nUser: -->
|
1288
|
+
|
1101
1289
|
<example _encoding="base64" host.name="gaatdrf2">
|
1102
1290
|
Q2hlY2sgUG9pbnQgRmlyZVdhbGwtMSBhdXRoZW50aWNhdGVkIFRlbG5ldCBzZXJ2ZXIgcnVubmluZyBvbiBnYWF0ZHJmMgoKVXNlcjog
|
1103
1291
|
</example>
|
@@ -1107,9 +1295,11 @@
|
|
1107
1295
|
<param pos="0" name="os.product" value="Checkpoint FW1"/>
|
1108
1296
|
<param pos="1" name="host.name"/>
|
1109
1297
|
</fingerprint>
|
1298
|
+
|
1110
1299
|
<fingerprint pattern="^Raptor Firewall">
|
1111
1300
|
<description>Raptor Firewall</description>
|
1112
1301
|
<!-- Raptor Firewall Secure Gateway.\nHostname: -->
|
1302
|
+
|
1113
1303
|
<example _encoding="base64">
|
1114
1304
|
UmFwdG9yIEZpcmV3YWxsIFNlY3VyZSBHYXRld2F5LgoKSG9zdG5hbWU6IA==
|
1115
1305
|
</example>
|
@@ -1118,9 +1308,11 @@
|
|
1118
1308
|
<param pos="0" name="os.device" value="Firewall"/>
|
1119
1309
|
<param pos="0" name="os.product" value="Raptor"/>
|
1120
1310
|
</fingerprint>
|
1311
|
+
|
1121
1312
|
<fingerprint pattern="UNIX\(r\) System V Release (\d*.\d*)">
|
1122
1313
|
<description>SunOS (Solaris)</description>
|
1123
1314
|
<!-- Raptor Firewall Secure Gateway.\nHostname: -->
|
1315
|
+
|
1124
1316
|
<example _encoding="base64" os.version="4.0">
|
1125
1317
|
VU5JWChyKSBTeXN0ZW0gViBSZWxlYXNlIDQuMCAoVGhlLVNlcnZlcikKCgoKbG9naW46IA==
|
1126
1318
|
</example>
|
@@ -1130,9 +1322,11 @@
|
|
1130
1322
|
<param pos="1" name="os.version"/>
|
1131
1323
|
<param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
|
1132
1324
|
</fingerprint>
|
1325
|
+
|
1133
1326
|
<fingerprint pattern="Solaris (.*)">
|
1134
1327
|
<description>Solaris</description>
|
1135
1328
|
<!-- Seattle Community Network Sun Solaris 1.1.1.B\nPlease login as 'visitor' if you are a visitorn\n\nSunOS UNIX (scn)\n\n\nlogin:-->
|
1329
|
+
|
1136
1330
|
<example _encoding="base64" os.version="1.1.1.B">
|
1137
1331
|
U2VhdHRsZSBDb21tdW5pdHkgTmV0d29yayBTdW4gU29sYXJpcyAxLjEuMS5CClBsZWFzZSBsb2dpbiBhcyAndml
|
1138
1332
|
zaXRvcicgaWYgeW91IGFyZSBhIHZpc2l0b3IKCgpTdW5PUyBVTklYIChzY24pCgoKCmxvZ2luOg==
|
@@ -1143,9 +1337,11 @@
|
|
1143
1337
|
<param pos="1" name="os.version"/>
|
1144
1338
|
<param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
|
1145
1339
|
</fingerprint>
|
1340
|
+
|
1146
1341
|
<fingerprint pattern="^Digital UNIX \(([^)]+).*">
|
1147
1342
|
<description>Digital Unix</description>
|
1148
1343
|
<!-- Digital UNIX (journal) (ttyp2)\n\n\nlogin: -->
|
1344
|
+
|
1149
1345
|
<example _encoding="base64" host.name="journal">
|
1150
1346
|
RGlnaXRhbCBVTklYIChqb3VybmFsKSAodHR5cDIpCgoKCmxvZ2luOiA=
|
1151
1347
|
</example>
|
@@ -1154,9 +1350,11 @@
|
|
1154
1350
|
<param pos="0" name="os.product" value="Digital Unix"/>
|
1155
1351
|
<param pos="1" name="host.name"/>
|
1156
1352
|
</fingerprint>
|
1353
|
+
|
1157
1354
|
<fingerprint pattern="^(?m)Compaq Tru64 UNIX V(.*) \(Rev. (.*\d)\) .*">
|
1158
1355
|
<description>Compaq Tru64 UNIX V</description>
|
1159
1356
|
<!-- Compaq Tru64 UNIX V5.1B (Rev. 2650) (docalpha) (pts/11)\n\n\n\n\nlogin: -->
|
1357
|
+
|
1160
1358
|
<example _encoding="base64" os.version="5.1B" os.rev="2650">
|
1161
1359
|
Q29tcGFxIFRydTY0IFVOSVggVjUuMUIgKFJldi4gMjY1MCkgKGRvY2FscGhhKSAocHRzLzExKQoKCgoKCmxvZ2luOg==
|
1162
1360
|
</example>
|
@@ -1167,9 +1365,11 @@
|
|
1167
1365
|
<param pos="2" name="os.rev"/>
|
1168
1366
|
<param pos="0" name="os.cpe23" value="cpe:/o:hp:tru64:{os.version}"/>
|
1169
1367
|
</fingerprint>
|
1368
|
+
|
1170
1369
|
<fingerprint pattern="HP-UX ([^ ]+) [A-Z]\.([^ ]+) ([^ ]+) ([^ ]+)\s([^ ]+\)).*$">
|
1171
1370
|
<description>System HP-UX</description>
|
1172
1371
|
<!-- HP-UX ctout B.11.11 U 9000/800 (tc)\nlogin: -->
|
1372
|
+
|
1173
1373
|
<example _encoding="base64" host.name="ctout" os.version="11.11" hw.series="9000/800" hw.model="(tc)">
|
1174
1374
|
SFAtVVggY3RvdXQgQi4xMS4xMSBVIDkwMDAvODAwICh0YykKCmxvZ2luOiA=
|
1175
1375
|
</example>
|
@@ -1183,18 +1383,22 @@
|
|
1183
1383
|
<param pos="4" name="hw.series"/>
|
1184
1384
|
<param pos="5" name="hw.model"/>
|
1185
1385
|
</fingerprint>
|
1386
|
+
|
1186
1387
|
<fingerprint pattern="^Data ONTAP">
|
1187
1388
|
<description>A NetApp apliance</description>
|
1188
1389
|
<!-- Data ONTAP (s500.)\nlogin: -->
|
1390
|
+
|
1189
1391
|
<example _encoding="base64">RGF0YSBPTlRBUCAoczUwMC4pCmxvZ2luOiA=</example>
|
1190
1392
|
<param pos="0" name="os.vendor" value="NetApp"/>
|
1191
1393
|
<param pos="0" name="os.family" value="Data ONTAP"/>
|
1192
1394
|
<param pos="0" name="os.product" value="Data ONTAP"/>
|
1193
1395
|
<param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:-"/>
|
1194
1396
|
</fingerprint>
|
1397
|
+
|
1195
1398
|
<fingerprint pattern="OpenVMS.*Version\sV([^\s]+).*">
|
1196
1399
|
<description>OpenVMS</description>
|
1197
1400
|
<!-- Welcome to OpenVMS (TM) Alpha Operating System, Version V8.4 - NOT70\n\nUsername: -->
|
1401
|
+
|
1198
1402
|
<example _encoding="base64" os.version="8.4">
|
1199
1403
|
IFdlbGNvbWUgdG8gT3BlblZNUyAoVE0pIEFscGhhIE9wZXJhdGluZyBTeXN0Z
|
1200
1404
|
W0sIFZlcnNpb24gVjguNCAgICAgLSBOT1Q3MAoKClVzZXJuYW1lOiA=
|
@@ -1204,9 +1408,11 @@
|
|
1204
1408
|
<param pos="0" name="os.product" value="VMS"/>
|
1205
1409
|
<param pos="1" name="os.version"/>
|
1206
1410
|
</fingerprint>
|
1411
|
+
|
1207
1412
|
<fingerprint pattern="^(?m)SCO OpenServer\(TM\) Release ([^ ]+).*$">
|
1208
1413
|
<description>SCO OpenServer</description>
|
1209
1414
|
<!-- SCO OpenServer(TM) Release 5 (bomdia.co.za) (ttyp6)\nlogin: -->
|
1415
|
+
|
1210
1416
|
<example _encoding="base64" os.version="5">
|
1211
1417
|
U0NPIE9wZW5TZXJ2ZXIoVE0pIFJlbGVhc2UgNSAoYm9tZGlhLmNvLnphKSAodHR5cDYpCgpsb2dpbjo=
|
1212
1418
|
</example>
|
@@ -1215,9 +1421,11 @@
|
|
1215
1421
|
<param pos="0" name="os.product" value="OpenServer"/>
|
1216
1422
|
<param pos="1" name="os.version"/>
|
1217
1423
|
</fingerprint>
|
1424
|
+
|
1218
1425
|
<fingerprint pattern="^% Username: timeout expired!">
|
1219
1426
|
<description>Some kind of Cisco device</description>
|
1220
1427
|
<!-- % Username: timeout expired!-->
|
1428
|
+
|
1221
1429
|
<example _encoding="base64">
|
1222
1430
|
JSBVc2VybmFtZTogIHRpbWVvdXQgZXhwaXJlZCE=
|
1223
1431
|
</example>
|
@@ -1226,6 +1434,7 @@
|
|
1226
1434
|
<param pos="0" name="os.product" value="IOS"/>
|
1227
1435
|
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:-"/>
|
1228
1436
|
</fingerprint>
|
1437
|
+
|
1229
1438
|
<fingerprint pattern="^Welcome to MKS Telnet Server Version">
|
1230
1439
|
<description>Windows running MKS Telnet Server</description>
|
1231
1440
|
<example _encoding="base64">
|
@@ -1236,15 +1445,18 @@
|
|
1236
1445
|
<param pos="0" name="os.product" value="Windows"/>
|
1237
1446
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1238
1447
|
</fingerprint>
|
1448
|
+
|
1239
1449
|
<fingerprint pattern="^Sorry, this system is engaged\.">
|
1240
1450
|
<description>an embedded print server</description>
|
1241
1451
|
<example>Sorry, this system is engaged.</example>
|
1242
1452
|
<param pos="0" name="os.vendor" value="Epson"/>
|
1243
1453
|
<param pos="0" name="os.device" value="Printer"/>
|
1244
1454
|
</fingerprint>
|
1455
|
+
|
1245
1456
|
<fingerprint pattern="^TELNET session now in ESTABLISHED state">
|
1246
1457
|
<description>an Allied Telesyn router</description>
|
1247
1458
|
<!-- TELNET session now in ESTABLISHED state\n\nGEO-003 login: -->
|
1459
|
+
|
1248
1460
|
<example _encoding="base64">
|
1249
1461
|
VEVMTkVUIHNlc3Npb24gbm93IGluIEVTVEFCTElTSEVEIHN0YXRlCgpHRU8tMDAzIGxvZ2luOiA=
|
1250
1462
|
</example>
|
@@ -1252,9 +1464,11 @@
|
|
1252
1464
|
<param pos="0" name="os.device" value="Router"/>
|
1253
1465
|
<param pos="0" name="os.product" value="Allied Telesyn router"/>
|
1254
1466
|
</fingerprint>
|
1467
|
+
|
1255
1468
|
<fingerprint pattern="^CONEXANT SYSTEMS.*ACCESS RUNNER ADSL">
|
1256
1469
|
<description>a Conexant ADSL router</description>
|
1257
1470
|
<!-- CONEXANT SYSTEMS, INC. ACCESS RUNNER ADSL CONSOLE PORT>>>LOGON PASSWORD>3.27****** -->
|
1471
|
+
|
1258
1472
|
<example _encoding="base64">
|
1259
1473
|
Q09ORVhBTlQgU1lTVEVNUywgSU5DLiBBQ0NFU1MgUlVOTkVSIEFEU0wgQ09OU09MRSBQ
|
1260
1474
|
T1JUPj4+TE9HT04gUEFTU1dPUkQ+My4yNyoqKioqKg==
|
@@ -1263,9 +1477,11 @@
|
|
1263
1477
|
<param pos="0" name="os.device" value="Broadband router"/>
|
1264
1478
|
<param pos="0" name="os.product" value="AccessRunner ADSL router"/>
|
1265
1479
|
</fingerprint>
|
1480
|
+
|
1266
1481
|
<fingerprint pattern="^System administrator is connecting from">
|
1267
1482
|
<description>a DrayTek Vigor SOHO Router</description>
|
1268
1483
|
<!-- System administrator is connecting from 54.39.173.86\n\nReject the connection request !!! -->
|
1484
|
+
|
1269
1485
|
<example _encoding="base64">
|
1270
1486
|
U3lzdGVtIGFkbWluaXN0cmF0b3IgaXMgY29ubmVjdGluZyBmcm9tIDU0LjM5LjE3My44NgoKUmVqZWN0IH
|
1271
1487
|
RoZSBjb25uZWN0aW9uIHJlcXVlc3QgISEh
|
@@ -1274,9 +1490,11 @@
|
|
1274
1490
|
<param pos="0" name="hw.device" value="Broadband router"/>
|
1275
1491
|
<param pos="0" name="hw.product" value="Vigor"/>
|
1276
1492
|
</fingerprint>
|
1493
|
+
|
1277
1494
|
<fingerprint pattern=".*Version\s(\d*.\d*)\/OpenBSD.*">
|
1278
1495
|
<description>OpenBSD</description>
|
1279
1496
|
<!-- 220 killer09 FTP server (Version 6.4/OpenBSD/Linux-ftpd-0.17) ready. -->
|
1497
|
+
|
1280
1498
|
<example _encoding="base64" os.version="6.4">
|
1281
1499
|
MjIwIGtpbGxlcjA5IEZUUCBzZXJ2ZXIgKFZlcnNpb24gNi40L09wZW5CU0QvTGludXgtZnRwZC0wLjE3KSByZWFkeS4K
|
1282
1500
|
</example>
|
@@ -1286,9 +1504,11 @@
|
|
1286
1504
|
<param pos="1" name="os.version"/>
|
1287
1505
|
<param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:{os.version}"/>
|
1288
1506
|
</fingerprint>
|
1507
|
+
|
1289
1508
|
<fingerprint pattern="^FreeBSD\/([^\\s]+)\s+\(([^\s]+)\)">
|
1290
1509
|
<description>a FreeBSD</description>
|
1291
1510
|
<!-- FreeBSD/amd64 (ms.gymspgs.cz) (pts/0)\n\n\n\nlogin: -->
|
1511
|
+
|
1292
1512
|
<example _encoding="base64" os.arch="amd64" host.name="ms.gymspgs.cz">
|
1293
1513
|
RnJlZUJTRC9hbWQ2NCAobXMuZ3ltc3Bncy5jeikgKHB0cy8wKQoKCgpsb2dpbjo=
|
1294
1514
|
</example>
|
@@ -1299,9 +1519,11 @@
|
|
1299
1519
|
<param pos="0" name="os.cpe23" value="cpe:/o:freebsd:freebsd:-"/>
|
1300
1520
|
<param pos="2" name="host.name"/>
|
1301
1521
|
</fingerprint>
|
1522
|
+
|
1302
1523
|
<fingerprint pattern="^NetBSD">
|
1303
1524
|
<description>NetBSD</description>
|
1304
1525
|
<!-- NetBSD/evbsh3 (Fukuyama.Host_AKS_0555_WL-v2.60d) (ttyp1) -->
|
1526
|
+
|
1305
1527
|
<example _encoding="base64">
|
1306
1528
|
TmV0QlNEL21lc3NpbWlwcyAoKSAodHR5cDMpCgpsb2dpbjog
|
1307
1529
|
</example>
|
@@ -1310,9 +1532,11 @@
|
|
1310
1532
|
<param pos="0" name="os.product" value="NetBSD"/>
|
1311
1533
|
<param pos="0" name="os.cpe23" value="cpe:/o:netbsd:netbsd:-"/>
|
1312
1534
|
</fingerprint>
|
1535
|
+
|
1313
1536
|
<fingerprint pattern="^IRIX\W\((.*)\)">
|
1314
1537
|
<description>SGI IRIX</description>
|
1315
1538
|
<!-- IRIX (artemis.biol.uoa.gr)\n\n\n\nlogin: -->
|
1539
|
+
|
1316
1540
|
<example _encoding="base64" host.name="artemis.biol.uoa.gr">
|
1317
1541
|
SVJJWCAoYXJ0ZW1pcy5iaW9sLnVvYS5ncikKCgoKbG9naW46IA==
|
1318
1542
|
</example>
|
@@ -1322,12 +1546,15 @@
|
|
1322
1546
|
<param pos="0" name="os.cpe23" value="cpe:/o:sgi:irix:-"/>
|
1323
1547
|
<param pos="1" name="host.name"/>
|
1324
1548
|
</fingerprint>
|
1549
|
+
|
1325
1550
|
<fingerprint pattern="(?m)(ES|RS)\s([^\s]+) System Software, Version ([^\s]+).*Riverstone Networks" flags="REG_MULTILINE">
|
1326
1551
|
<description>a Riverstone router</description>
|
1327
1552
|
<!-- Using '+' instead of '-' due to xml issue -->
|
1553
|
+
|
1328
1554
|
<!-- ++++++++++++++++++++++++++++++++++\nES 10170 System Software, Version 9.3.0.4\n
|
1329
1555
|
Riverstone Networks, Inc., Copyright (c) 2000-2003. All rights reserved.\nSystem started on 2018-09-06 15:58:\n
|
1330
1556
|
+++++++++++++++++++++++++++++++++++++++ -->
|
1557
|
+
|
1331
1558
|
<example _encoding="base64" os.product="10170" os.version="9.3.0.4" os.family="ES">
|
1332
1559
|
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
|
1333
1560
|
S0tLS0tLQpFUyAxMDE3MCBTeXN0ZW0gU29mdHdhcmUsIFZlcnNpb24gOS4zLjAuNApSaXZlcnN0b25lIE5ldH
|
@@ -1338,6 +1565,7 @@
|
|
1338
1565
|
<!-- +++++++++++++++++++++++++++++++++++++++\nRS 10170 System Software, Version 9.3.0.5\n
|
1339
1566
|
Riverstone Networks, Inc., Copyright (c) 2000-2003. All rights reserved.\nSystem started on 2018-09-06 15:58:\n
|
1340
1567
|
+++++++++++++++++++++++++++++++++++++++ -->
|
1568
|
+
|
1341
1569
|
<example _encoding="base64" os.product="8000" os.version="9.3.0.5" os.family="RS">
|
1342
1570
|
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
|
1343
1571
|
S0tLS0tLQpSUyA4MDAwIFN5c3RlbSBTb2Z0d2FyZSwgVmVyc2lvbiA5LjMuMC41ClJpdmVyc3RvbmUgTmV0d2
|
@@ -1351,6 +1579,7 @@
|
|
1351
1579
|
<param pos="2" name="os.product"/>
|
1352
1580
|
<param pos="3" name="os.version"/>
|
1353
1581
|
</fingerprint>
|
1582
|
+
|
1354
1583
|
<fingerprint pattern="^HP ([^\s]+) ProCurve Switch">
|
1355
1584
|
<description>HP ProCurve Switch</description>
|
1356
1585
|
<!-- ==============================================================================\nHP J4121A ProCurve Switch 4000M\n
|
@@ -1361,6 +1590,7 @@
|
|
1361
1590
|
Software feature updates\n* New product announcements\n* Special events\n\n\nPlease register your
|
1362
1591
|
products now at: www.ProCurve.com\n==============================================================================\n
|
1363
1592
|
\n\nUsername: -->
|
1593
|
+
|
1364
1594
|
<example _encoding="base64" os.product="J4121A">
|
1365
1595
|
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09P
|
1366
1596
|
T09PT09PT09PT09PT09PT09PT09PT09CkhQIEo0MTIxQSBQcm9DdXJ2ZSBTd2l0Y2ggNDAwME
|
@@ -1384,11 +1614,13 @@
|
|
1384
1614
|
<param pos="0" name="os.device" value="Switch"/>
|
1385
1615
|
<param pos="1" name="os.product"/>
|
1386
1616
|
</fingerprint>
|
1617
|
+
|
1387
1618
|
<fingerprint pattern="^(?m).*ConnectUPS">
|
1388
1619
|
<description>PowerWare ConnectUPS</description>
|
1389
1620
|
<!-- +============================================================================+\n| [ ConnectUPS Web/SNMP
|
1390
1621
|
Card Configuration Utility ] |\n+============================================================================+\n
|
1391
1622
|
\nEnter Password: -->
|
1623
|
+
|
1392
1624
|
<example _encoding="base64">
|
1393
1625
|
Kz09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0
|
1394
1626
|
9PT09PT09PT09PT09PT0rCnwgICAgICAgICAgICBbIENvbm5lY3RVUFMgV2ViL1NOTVAgQ2FyZCBDb25maW
|
@@ -1401,9 +1633,11 @@
|
|
1401
1633
|
<param pos="0" name="os.device" value="UPS"/>
|
1402
1634
|
<param pos="0" name="os.product" value="ConnectUPS"/>
|
1403
1635
|
</fingerprint>
|
1636
|
+
|
1404
1637
|
<fingerprint pattern="^Imagistics.*im">
|
1405
1638
|
<description>an Imagistics device</description>
|
1406
1639
|
<!-- Imagistics im3511/im4511 Ver 01.00.20 TELNET server.\nCopyright(c) 2001-2005, silex technology, Inc.\nlogin: -->
|
1640
|
+
|
1407
1641
|
<example _encoding="base64">
|
1408
1642
|
SW1hZ2lzdGljcyBpbTM1MTEvaW00NTExIFZlciAwMS4wMC4yMCBURUxORVQgc2VydmVyLgpDb3B5cmlnaH
|
1409
1643
|
QoYykgMjAwMS0yMDA1LCBzaWxleCB0ZWNobm9sb2d5LCBJbmMuCmxvZ2luOiA=
|
@@ -1413,9 +1647,11 @@
|
|
1413
1647
|
<param pos="0" name="os.device" value="Multifunction Device"/>
|
1414
1648
|
<param pos="0" name="os.product" value="im"/>
|
1415
1649
|
</fingerprint>
|
1650
|
+
|
1416
1651
|
<fingerprint pattern="^NRG Maintenance Shell">
|
1417
1652
|
<description>a Ricoh NRG device</description>
|
1418
1653
|
<!-- NRG Maintenance Shell. \nUser access verification.\nlogin: -->
|
1654
|
+
|
1419
1655
|
<example _encoding="base64">
|
1420
1656
|
TlJHIE1haW50ZW5hbmNlIFNoZWxsLiAgIAoKVXNlciBhY2Nlc3MgdmVyaWZpY2F0aW9uLgoKbG9naW46
|
1421
1657
|
</example>
|
@@ -1423,9 +1659,11 @@
|
|
1423
1659
|
<param pos="0" name="os.device" value="Printer"/>
|
1424
1660
|
<param pos="0" name="os.product" value="NRG Printer"/>
|
1425
1661
|
</fingerprint>
|
1662
|
+
|
1426
1663
|
<fingerprint pattern="^SHARP (AR-[^\\s]+) Ver ([^\\s]+) TELNET server">
|
1427
1664
|
<description>SHARP AR Series multifunction device</description>
|
1428
1665
|
<!-- SHARP AR-M351U Ver 01.00.18 TELNET server.\nCopyright(c) 2001-2005, silex technology, Inc.\nlogin: -->
|
1666
|
+
|
1429
1667
|
<example _encoding="base64" os.product="AR-M351U" os.version="01.00.18">
|
1430
1668
|
U0hBUlAgQVItTTM1MVUgVmVyIDAxLjAwLjE4IFRFTE5FVCBzZXJ2ZXIuCkNvcHlyaWdodChjKSAyMDAx
|
1431
1669
|
LTIwMDUsIHNpbGV4IHRlY2hub2xvZ3ksIEluYy4KbG9naW46IA==
|
@@ -1436,10 +1674,12 @@
|
|
1436
1674
|
<param pos="1" name="os.product"/>
|
1437
1675
|
<param pos="2" name="os.version"/>
|
1438
1676
|
</fingerprint>
|
1677
|
+
|
1439
1678
|
<fingerprint pattern="^SHARP (MX-[^\\s]+) Ver ([^\\s]+) TELNET server">
|
1440
1679
|
<description>SHARP MX Series multifunction device</description>
|
1441
1680
|
<!-- SHARP MX-3610N Ver 01.05.00.0o.18 TELNET server.\nCopyright(C) 2005- SHARP CORPORATION\nCopyright(C) 2005-
|
1442
1681
|
silex technology, Inc.\nlogin: -->
|
1682
|
+
|
1443
1683
|
<example _encoding="base64" os.product="MX-3610N" os.version="01.05.00.0o.18">
|
1444
1684
|
U0hBUlAgTVgtMzYxME4gVmVyIDAxLjA1LjAwLjBvLjE4IFRFTE5FVCBzZXJ2ZXIuCkNvcHlyaWdodC
|
1445
1685
|
hDKSAyMDA1LSAgICAgU0hBUlAgQ09SUE9SQVRJT04KQ29weXJpZ2h0KEMpIDIwMDUtICAgICBzaWxl
|
@@ -1451,11 +1691,13 @@
|
|
1451
1691
|
<param pos="1" name="os.product"/>
|
1452
1692
|
<param pos="2" name="os.version"/>
|
1453
1693
|
</fingerprint>
|
1694
|
+
|
1454
1695
|
<fingerprint pattern="^(?m).*Welcome to MELCO Print Server.*Server Name *: *([^ ]*)\W.*Server Model *: *([^ ]*).*F \/ W Version *: *([^ ]*).*MAC Address *: *(.. .. .. .. .. ..).*$">
|
1455
1696
|
<description>System is a Buffalo/MELCO Embedded Print Server</description>
|
1456
1697
|
<!-- ***********************************\n* Welcome to MELCO Print Server *\n* Telnet Console *\n***********************************
|
1457
1698
|
\n \nServer Name: PS-B04E8E\nServer Model: LPV 2 - TX 1\nF / W Version: 2.00 J \nMAC Address: AE 32 EA 21 BB E3\n
|
1458
1699
|
Uptime: 0 days, 00: 00: 12\n \nPlease Enter Password:"-->
|
1700
|
+
|
1459
1701
|
<example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" os.model="LPV" os.address="AE 32 EA 21 BB E3">
|
1460
1702
|
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiogV2VsY29tZSB0byBNRUxDTyBQc
|
1461
1703
|
mludCBTZXJ2ZXIgKlxuKiBUZWxuZXQgQ29uc29sZSAqXG4qKioqKioqKioqKioqKioqKioqKioqKi
|
@@ -1472,9 +1714,11 @@
|
|
1472
1714
|
<param pos="3" name="os.version"/>
|
1473
1715
|
<param pos="4" name="os.address"/>
|
1474
1716
|
</fingerprint>
|
1717
|
+
|
1475
1718
|
<fingerprint pattern="^(?m)AIX Version\W(\d).*">
|
1476
1719
|
<description>System is IBM AIX v</description>
|
1477
1720
|
<!-- AIX Version 6\nCopyright IBM Corporation, 1982, 2007.\nlogin: -->
|
1721
|
+
|
1478
1722
|
<example _encoding="base64" os.version="6">
|
1479
1723
|
QUlYIFZlcnNpb24gNgpDb3B5cmlnaHQgSUJNIENvcnBvcmF0aW9uLCAxOTgyLCAyMDA3Lgpsb2dpbjogCg==
|
1480
1724
|
</example>
|
@@ -1484,9 +1728,11 @@
|
|
1484
1728
|
<param pos="1" name="os.version"/>
|
1485
1729
|
<param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
|
1486
1730
|
</fingerprint>
|
1731
|
+
|
1487
1732
|
<fingerprint pattern="^(?m)CIMC Debug Firmware Utility Shell\W([^\s]+).*">
|
1488
1733
|
<description>System is Cisco UCS Device</description>
|
1489
1734
|
<!-- CIMC Debug Firmware Utility Shell\nfake-ucs-device-3-1-p login: -->
|
1735
|
+
|
1490
1736
|
<example _encoding="base64" host.name="fake-ucs-device-3-1-p">
|
1491
1737
|
Q0lNQyBEZWJ1ZyBGaXJtd2FyZSBVdGlsaXR5IFNoZWxsCmZha2UtdWNzLWRldmljZS0zLTEtcCBsb2dpbjogCg==
|
1492
1738
|
</example>
|
@@ -1496,6 +1742,7 @@
|
|
1496
1742
|
<param pos="0" name="os.product" value="UCS Device"/>
|
1497
1743
|
<param pos="1" name="host.name"/>
|
1498
1744
|
</fingerprint>
|
1745
|
+
|
1499
1746
|
<fingerprint pattern="^(?m)HP ProLiant.*v(\d+.\d+)">
|
1500
1747
|
<description>Sytem is HP ProLiant server</description>
|
1501
1748
|
<!-- HP ProLiant BL e-Class Integrated Administrator v2.00
|
@@ -1504,6 +1751,7 @@
|
|
1504
1751
|
authorized user. Any authorized or unauthorized access and use may be moni-
|
1505
1752
|
tored and can result in criminal or civil prosecution under applicable law.
|
1506
1753
|
IA-00508BEBAA59 login: -->
|
1754
|
+
|
1507
1755
|
<example _encoding="base64" os.version="2.00">
|
1508
1756
|
SFAgUHJvTGlhbnQgQkwgZS1DbGFzcyBJbnRlZ3JhdGVkIEFkbWluaXN0cmF0b3IgdjIuMDAKICAgICAgI
|
1509
1757
|
CAgQ29weXJpZ2h0IDIwMDUgSGV3bGV0dC1QYWNrYXJkIERldmVsb3BtZW50IEdyb3VwLCBMLlAuCgogIC
|
@@ -1521,56 +1769,161 @@
|
|
1521
1769
|
<param pos="0" name="os.product" value="ProLiant"/>
|
1522
1770
|
<param pos="1" name="os.version"/>
|
1523
1771
|
</fingerprint>
|
1772
|
+
|
1524
1773
|
<fingerprint pattern="^Power Measurement Ltd. Meter ION ([[:alnum:]]+)">
|
1525
1774
|
<!-- Power Measurement Ltd. Meter ION 7330V271 ETH ETH7330V272
|
1526
1775
|
Serial#: PB-0204A058-11
|
1527
|
-
|
1528
1776
|
login: -->
|
1777
|
+
|
1529
1778
|
<description>Power Measurement ION Power Meter</description>
|
1530
1779
|
<example _encoding="base64" hw.vendor="Power Measurement Ltd." hw.family="ION" hw.version="7330V271">
|
1531
1780
|
UG93ZXIgTWVhc3VyZW1lbnQgTHRkLiBNZXRlciBJT04gNzMzMFYyNzEgRVRIIEVUSDczMzBWMjcyCg1TZ
|
1532
1781
|
XJpYWwjOiBQQi0wMjA0QTA1OC0xMQoNCg1sb2dpbjo=
|
1533
1782
|
</example>
|
1534
|
-
<param pos="0" name="hw.vendor" value
|
1535
|
-
<param pos="0" name="hw.family" value
|
1783
|
+
<param pos="0" name="hw.vendor" value="Power Measurement Ltd."/>
|
1784
|
+
<param pos="0" name="hw.family" value="ION"/>
|
1536
1785
|
<param pos="1" name="hw.version"/>
|
1537
1786
|
</fingerprint>
|
1787
|
+
|
1538
1788
|
<fingerprint pattern="^GW25 v([[:digit:]\.]+) - Intelligent Power Meters GPRS Gateway[[:space:]]+Developed by Satelitech">
|
1539
1789
|
<!-- GW25 v1.2.1 - Intelligent Power Meters GPRS Gateway
|
1540
1790
|
Developed by Satelitech S.A for ESG Dilec
|
1541
1791
|
Enter password: -->
|
1792
|
+
|
1542
1793
|
<description>Satelitech Power Meter</description>
|
1543
1794
|
<example _encoding="base64" hw.vendor="Satelitech" hw.family="GW25" hw.version="1.2.1">
|
1544
1795
|
R1cyNSB2MS4yLjEgLSBJbnRlbGxpZ2VudCBQb3dlciBNZXRlcnMgR1BSUyBHYXRld2F5Cg1EZXZlbG9wZ
|
1545
1796
|
WQgYnkgU2F0ZWxpdGVjaCBTLkEgZm9yIEVTRyBEaWxlYwoNRW50ZXIgcGFzc3dvcmQ6
|
1546
1797
|
</example>
|
1547
|
-
<param pos="0" name="hw.vendor" value
|
1548
|
-
<param pos="0" name="hw.family" value
|
1798
|
+
<param pos="0" name="hw.vendor" value="Satelitech"/>
|
1799
|
+
<param pos="0" name="hw.family" value="GW25"/>
|
1549
1800
|
<param pos="1" name="hw.version"/>
|
1550
1801
|
</fingerprint>
|
1802
|
+
|
1551
1803
|
<fingerprint pattern="^RDK \(A Yocto Project based Distro\) ([^ ]+) Docsis-Gateway">
|
1552
1804
|
<!-- RDK (A Yocto Project based Distro) 2.0 Docsis-Gateway
|
1553
|
-
|
1554
1805
|
Docsis-Gateway login: -->
|
1806
|
+
|
1555
1807
|
<description>DOCSIS Cable Modem Running RDK</description>
|
1556
1808
|
<example _encoding="base64" hw.device="DOCSIS Cable Modem" os.vendor="Yocto" os.product="RDK" os.version="2.0">
|
1557
1809
|
UkRLIChBIFlvY3RvIFByb2plY3QgYmFzZWQgRGlzdHJvKSAyLjAgRG9jc2lzLUdhdGV3YXkNCg0NCg1Eb
|
1558
1810
|
2NzaXMtR2F0ZXdheSBsb2dpbjo=
|
1559
1811
|
</example>
|
1560
|
-
<param pos="0" name="hw.device" value
|
1561
|
-
<param pos="0" name="os.vendor" value
|
1562
|
-
<param pos="0" name="os.product" value
|
1812
|
+
<param pos="0" name="hw.device" value="DOCSIS Cable Modem"/>
|
1813
|
+
<param pos="0" name="os.vendor" value="Yocto"/>
|
1814
|
+
<param pos="0" name="os.product" value="RDK"/>
|
1563
1815
|
<param pos="1" name="os.version"/>
|
1564
1816
|
</fingerprint>
|
1817
|
+
|
1565
1818
|
<fingerprint pattern="^RICOH Maintenance Shell">
|
1566
1819
|
<description>a Ricoh device</description>
|
1567
|
-
<!-- RICOH Maintenance Shell.
|
1820
|
+
<!-- RICOH Maintenance Shell.
|
1568
1821
|
User access verification.
|
1569
1822
|
login:-->
|
1823
|
+
|
1570
1824
|
<example _encoding="base64">
|
1571
1825
|
UklDT0ggTWFpbnRlbmFuY2UgU2hlbGwuICAgCg1Vc2VyIGFjY2VzcyB2ZXJpZmljYXRpb24uCg1sb2dpbjo=
|
1572
1826
|
</example>
|
1573
1827
|
<param pos="0" name="os.vendor" value="Ricoh"/>
|
1574
1828
|
<param pos="0" name="os.device" value="Printer"/>
|
1575
1829
|
</fingerprint>
|
1576
|
-
|
1830
|
+
|
1831
|
+
<fingerprint pattern="Precise/RTCS v([\d\.]+) Telnet server">
|
1832
|
+
<description>Liebert UPS</description>
|
1833
|
+
<!-- Precise/RTCS v2.90.00 Telnet server
|
1834
|
+
Service Port Manager Active
|
1835
|
+
<Esc> Ends Session
|
1836
|
+
-->
|
1837
|
+
|
1838
|
+
<example _encoding="base64" os.version="2.90.00">
|
1839
|
+
UHJlY2lzZS9SVENTIHYyLjkwLjAwIFRlbG5ldCBzZXJ2ZXIKCgpTZXJ2aWNlIFBvcnQgTWFuYWdlciBBY3RpdmUKCjxFc2M+IEVuZHMgU2Vzc2lvbgoKroot
|
1840
|
+
</example>
|
1841
|
+
<param pos="0" name="hw.device" value="Power device"/>
|
1842
|
+
<param pos="0" name="hw.vendor" value="Liebert"/>
|
1843
|
+
<param pos="0" name="os.device" value="Power device"/>
|
1844
|
+
<param pos="0" name="os.vendor" value="Liebert"/>
|
1845
|
+
<param pos="1" name="os.version"/>
|
1846
|
+
</fingerprint>
|
1847
|
+
|
1848
|
+
<fingerprint pattern="Telnet Administration (?:\r|\n)+ SAP J2EE Engine v([\d.]+)(?:\r|\n)+">
|
1849
|
+
<description>SAP NetWeaver Application Server Java telnet service</description>
|
1850
|
+
<!-- ***********************************************
|
1851
|
+
**********************************************
|
1852
|
+
****###*******####*****#######**************
|
1853
|
+
**##***##****##**##****##****##************
|
1854
|
+
***##*******##****##***##****##**********
|
1855
|
+
*****##*****########***######***********
|
1856
|
+
******##****##****##***##*************
|
1857
|
+
**##***##**##******##**##************
|
1858
|
+
****###****##******##**##**********
|
1859
|
+
**********************************
|
1860
|
+
********************************
|
1861
|
+
Telnet Administration
|
1862
|
+
SAP J2EE Engine v7.00
|
1863
|
+
Login:
|
1864
|
+
-->
|
1865
|
+
|
1866
|
+
<example _encoding="base64" service.version="7.00">
|
1867
|
+
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiogCiAgICoqKi
|
1868
|
+
oqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiogCiAgICoqKiojIyMq
|
1869
|
+
KioqKioqIyMjIyoqKioqIyMjIyMjIyoqKioqKioqKioqKioqIAogICAqKiMjKioqIyMqKioqIy
|
1870
|
+
MqKiMjKioqKiMjKioqKiMjKioqKioqKioqKioqIAogICAqKiojIyoqKioqKiojIyoqKiojIyoq
|
1871
|
+
KiMjKioqKiMjKioqKioqKioqKiAKICAgKioqKiojIyoqKioqIyMjIyMjIyMqKiojIyMjIyMqKi
|
1872
|
+
oqKioqKioqKiAKICAgKioqKioqIyMqKioqIyMqKioqIyMqKiojIyoqKioqKioqKioqKiogCiAg
|
1873
|
+
ICoqIyMqKiojIyoqIyMqKioqKiojIyoqIyMqKioqKioqKioqKiogCiAgICoqKiojIyMqKioqIy
|
1874
|
+
MqKioqKiojIyoqIyMqKioqKioqKioqIAogICAqKioqKioqKioqKioqKioqKioqKioqKioqKioq
|
1875
|
+
KioqKioqIAogICAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiAKCiAgIFRlbG5ldC
|
1876
|
+
BBZG1pbmlzdHJhdGlvbiAKICAgU0FQIEoyRUUgRW5naW5lIHY3LjAwCgoKCkxvZ2luOgo=
|
1877
|
+
</example>
|
1878
|
+
<param pos="0" name="service.vendor" value="SAP"/>
|
1879
|
+
<param pos="0" name="service.product" value="NetWeaver Application Server Java"/>
|
1880
|
+
<param pos="0" name="service.family" value="NetWeaver"/>
|
1881
|
+
<param pos="1" name="service.version"/>
|
1882
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:sap:netweaver_application_server_java:{service.version}"/>
|
1883
|
+
<param pos="0" name="service.component.vendor" value="SAP"/>
|
1884
|
+
<param pos="0" name="service.component.product" value="NetWeaver Application Server"/>
|
1885
|
+
<param pos="0" name="service.component.cpe23" value="cpe:/a:sap:netweaver_application_server:-"/>
|
1886
|
+
</fingerprint>
|
1887
|
+
|
1888
|
+
<fingerprint pattern="Telnet Administration (?:\r|\n)+ SAP Java EE Application Server v([\d.]+)(?:\r|\n)+">
|
1889
|
+
<description>SAP NetWeaver Application Server Java telnet service - newer variant</description>
|
1890
|
+
<!-- ***********************************************
|
1891
|
+
**********************************************
|
1892
|
+
****###*******####*****#######**************
|
1893
|
+
**##***##****##**##****##****##************
|
1894
|
+
***##*******##****##***##****##**********
|
1895
|
+
*****##*****########***######***********
|
1896
|
+
******##****##****##***##*************
|
1897
|
+
**##***##**##******##**##************
|
1898
|
+
****###****##******##**##**********
|
1899
|
+
**********************************
|
1900
|
+
********************************
|
1901
|
+
Telnet Administration
|
1902
|
+
SAP Java EE Application Server v7.50
|
1903
|
+
User name:
|
1904
|
+
-->
|
1905
|
+
|
1906
|
+
<example _encoding="base64" service.version="7.50">
|
1907
|
+
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiogCiAgICoqKi
|
1908
|
+
oqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiogCiAgICoqKiojIyMq
|
1909
|
+
KioqKioqIyMjIyoqKioqIyMjIyMjIyoqKioqKioqKioqKioqIAogICAqKiMjKioqIyMqKioqIy
|
1910
|
+
MqKiMjKioqKiMjKioqKiMjKioqKioqKioqKioqIAogICAqKiojIyoqKioqKiojIyoqKiojIyoq
|
1911
|
+
KiMjKioqKiMjKioqKioqKioqKiAKICAgKioqKiojIyoqKioqIyMjIyMjIyMqKiojIyMjIyMqKi
|
1912
|
+
oqKioqKioqKiAKICAgKioqKioqIyMqKioqIyMqKioqIyMqKiojIyoqKioqKioqKioqKiogCiAg
|
1913
|
+
ICoqIyMqKiojIyoqIyMqKioqKiojIyoqIyMqKioqKioqKioqKiogCiAgICoqKiojIyMqKioqIy
|
1914
|
+
MqKioqKiojIyoqIyMqKioqKioqKioqIAogICAqKioqKioqKioqKioqKioqKioqKioqKioqKioq
|
1915
|
+
KioqKioqIAogICAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiAKCiAgIFRlbG5ldC
|
1916
|
+
BBZG1pbmlzdHJhdGlvbiAKICAgU0FQIEphdmEgRUUgQXBwbGljYXRpb24gU2VydmVyIHY3LjUw
|
1917
|
+
CgoKVXNlciBuYW1lOgo=
|
1918
|
+
</example>
|
1919
|
+
<param pos="0" name="service.vendor" value="SAP"/>
|
1920
|
+
<param pos="0" name="service.product" value="NetWeaver Application Server Java"/>
|
1921
|
+
<param pos="0" name="service.family" value="NetWeaver"/>
|
1922
|
+
<param pos="1" name="service.version"/>
|
1923
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:sap:netweaver_application_server_java:{service.version}"/>
|
1924
|
+
<param pos="0" name="service.component.vendor" value="SAP"/>
|
1925
|
+
<param pos="0" name="service.component.product" value="NetWeaver Application Server"/>
|
1926
|
+
<param pos="0" name="service.component.cpe23" value="cpe:/a:sap:netweaver_application_server:-"/>
|
1927
|
+
</fingerprint>
|
1928
|
+
|
1929
|
+
</fingerprints>
|