recog 2.3.7 → 2.3.12

Sign up to get free protection for your applications and to get access to all the features.
Files changed (81) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +9 -2
  3. data/.ruby-gemset +1 -0
  4. data/.ruby-version +1 -0
  5. data/.travis.yml +2 -4
  6. data/CONTRIBUTING.md +136 -37
  7. data/Gemfile +2 -5
  8. data/README.md +18 -16
  9. data/bin/recog_cleanup +16 -0
  10. data/bin/recog_standardize +142 -0
  11. data/cpe-remap.yaml +36 -1
  12. data/features/match.feature +4 -0
  13. data/features/support/aruba.rb +3 -0
  14. data/features/verify.feature +5 -0
  15. data/identifiers/README.md +56 -0
  16. data/identifiers/hw_device.txt +77 -0
  17. data/identifiers/hw_family.txt +96 -0
  18. data/identifiers/hw_product.txt +328 -0
  19. data/identifiers/os_architecture.txt +20 -0
  20. data/identifiers/os_device.txt +94 -0
  21. data/identifiers/os_family.txt +325 -0
  22. data/identifiers/os_product.txt +420 -0
  23. data/identifiers/service_family.txt +272 -0
  24. data/identifiers/service_product.txt +557 -0
  25. data/identifiers/software_class.txt +26 -0
  26. data/identifiers/software_family.txt +91 -0
  27. data/identifiers/software_product.txt +333 -0
  28. data/identifiers/vendor.txt +891 -0
  29. data/lib/recog/version.rb +1 -1
  30. data/requirements.txt +1 -1
  31. data/spec/lib/fingerprint_self_test_spec.rb +1 -1
  32. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +1 -1
  33. data/update_cpes.py +4 -1
  34. data/xml/apache_modules.xml +292 -5
  35. data/xml/apache_os.xml +50 -2
  36. data/xml/architecture.xml +19 -7
  37. data/xml/dns_versionbind.xml +200 -26
  38. data/xml/favicons.xml +1701 -0
  39. data/xml/ftp_banners.xml +276 -16
  40. data/xml/h323_callresp.xml +112 -12
  41. data/xml/hp_pjl_id.xml +47 -5
  42. data/xml/html_title.xml +1419 -72
  43. data/xml/http_cookies.xml +77 -10
  44. data/xml/http_servers.xml +898 -47
  45. data/xml/http_wwwauth.xml +154 -27
  46. data/xml/imap_banners.xml +23 -13
  47. data/xml/ldap_searchresult.xml +81 -9
  48. data/xml/mdns_device-info_txt.xml +194 -17
  49. data/xml/mdns_workstation_txt.xml +4 -2
  50. data/xml/mysql_banners.xml +554 -45
  51. data/xml/mysql_error.xml +113 -6
  52. data/xml/nntp_banners.xml +10 -2
  53. data/xml/ntp_banners.xml +95 -11
  54. data/xml/operating_system.xml +90 -3
  55. data/xml/pop_banners.xml +32 -31
  56. data/xml/rsh_resp.xml +11 -2
  57. data/xml/rtsp_servers.xml +43 -23
  58. data/xml/sip_banners.xml +9 -14
  59. data/xml/sip_user_agents.xml +69 -3
  60. data/xml/smb_native_lm.xml +10 -2
  61. data/xml/smb_native_os.xml +80 -2
  62. data/xml/smtp_banners.xml +233 -13
  63. data/xml/smtp_debug.xml +6 -4
  64. data/xml/smtp_ehlo.xml +7 -5
  65. data/xml/smtp_expn.xml +13 -4
  66. data/xml/smtp_help.xml +23 -4
  67. data/xml/smtp_mailfrom.xml +5 -2
  68. data/xml/smtp_noop.xml +6 -5
  69. data/xml/smtp_quit.xml +5 -4
  70. data/xml/smtp_rcptto.xml +5 -2
  71. data/xml/smtp_rset.xml +4 -4
  72. data/xml/smtp_turn.xml +4 -4
  73. data/xml/smtp_vrfy.xml +14 -4
  74. data/xml/snmp_sysdescr.xml +776 -52
  75. data/xml/snmp_sysobjid.xml +47 -2
  76. data/xml/ssh_banners.xml +259 -80
  77. data/xml/telnet_banners.xml +376 -23
  78. data/xml/x11_banners.xml +27 -4
  79. data/xml/x509_issuers.xml +37 -13
  80. data/xml/x509_subjects.xml +525 -55
  81. metadata +29 -6
@@ -1,16 +1,19 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="apache_os" database_type="util.os" preference="0.10">
3
3
  <!--
4
4
  When an HTTP server is fingerprinted as Apache, a 2nd analysis pass is done
5
5
  on the server headers HTTPProtocolHelper.SERVER_HEADERS: they are matched
6
6
  against the following patterns to extract OS information.
7
7
  -->
8
+
8
9
  <fingerprint pattern=".*\(iSeries\).*">
9
10
  <description>IBM i5/OS iSeries (OS/400)</description>
10
11
  <param pos="0" name="os.vendor" value="IBM"/>
11
12
  <param pos="0" name="os.family" value="OS/400"/>
12
13
  <param pos="0" name="os.product" value="OS/400"/>
14
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:-"/>
13
15
  </fingerprint>
16
+
14
17
  <fingerprint pattern=".*\(Mandrake Linux/\d+\.\d+\.92mdk\).*">
15
18
  <description>Mandriva (formerly Mandrake) Linux 9.2</description>
16
19
  <param pos="0" name="os.certainty" value="0.9"/>
@@ -20,6 +23,7 @@
20
23
  <param pos="0" name="os.version" value="9.2"/>
21
24
  <param pos="0" name="os.cpe23" value="cpe:/o:mandriva:linux:9.2"/>
22
25
  </fingerprint>
26
+
23
27
  <fingerprint pattern=".*\(Mandrake Linux/\d+\.\d+\.100mdk\).*">
24
28
  <description>Mandriva (formerly Mandrake) Linux 10.0</description>
25
29
  <param pos="0" name="os.certainty" value="0.9"/>
@@ -29,6 +33,7 @@
29
33
  <param pos="0" name="os.version" value="10.0"/>
30
34
  <param pos="0" name="os.cpe23" value="cpe:/o:mandriva:linux:10.0"/>
31
35
  </fingerprint>
36
+
32
37
  <fingerprint pattern=".*\((?:Mandrake|Mandriva) Linux/.*">
33
38
  <description>Mandriva (formerly Mandrake) Linux unknown version</description>
34
39
  <param pos="0" name="os.vendor" value="Mandriva"/>
@@ -36,6 +41,7 @@
36
41
  <param pos="0" name="os.product" value="Linux"/>
37
42
  <param pos="0" name="os.cpe23" value="cpe:/o:mandriva:linux:-"/>
38
43
  </fingerprint>
44
+
39
45
  <fingerprint pattern=".*\(Mandrakelinux/.*">
40
46
  <description>Mandriva (formerly Mandrake) Linux unknown version - variant 2</description>
41
47
  <param pos="0" name="os.vendor" value="Mandriva"/>
@@ -43,12 +49,14 @@
43
49
  <param pos="0" name="os.product" value="Linux"/>
44
50
  <param pos="0" name="os.cpe23" value="cpe:/o:mandriva:linux:-"/>
45
51
  </fingerprint>
52
+
46
53
  <fingerprint pattern=".*\(PalmOS\).*">
47
54
  <description>PalmOS</description>
48
55
  <param pos="0" name="os.vendor" value="Palm"/>
49
56
  <param pos="0" name="os.family" value="PalmOS"/>
50
57
  <param pos="0" name="os.product" value="PalmOS"/>
51
58
  </fingerprint>
59
+
52
60
  <fingerprint pattern=".*\(Win32\).*">
53
61
  <description>Microsoft Windows</description>
54
62
  <param pos="0" name="os.certainty" value="0.75"/>
@@ -57,6 +65,7 @@
57
65
  <param pos="0" name="os.product" value="Windows"/>
58
66
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
59
67
  </fingerprint>
68
+
60
69
  <fingerprint pattern=".*\(Darwin\).*">
61
70
  <description>Apple Mac OS X</description>
62
71
  <param pos="0" name="os.vendor" value="Apple"/>
@@ -64,6 +73,7 @@
64
73
  <param pos="0" name="os.product" value="Mac OS X"/>
65
74
  <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:-"/>
66
75
  </fingerprint>
76
+
67
77
  <fingerprint pattern=".*\(Ubuntu\).*">
68
78
  <description>Ubuntu</description>
69
79
  <param pos="0" name="os.vendor" value="Ubuntu"/>
@@ -71,18 +81,21 @@
71
81
  <param pos="0" name="os.product" value="Linux"/>
72
82
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
73
83
  </fingerprint>
84
+
74
85
  <fingerprint pattern=".*(?:Sun )?Cobalt \(Unix\)?.*">
75
86
  <description>Sun Cobalt RaQ (Red Hat based Linux)</description>
76
87
  <param pos="0" name="os.vendor" value="Sun"/>
77
88
  <param pos="0" name="os.family" value="Linux"/>
78
89
  <param pos="0" name="os.product" value="Cobalt RaQ"/>
79
90
  </fingerprint>
91
+
80
92
  <fingerprint pattern=".*\(BlueQuartz\).*">
81
93
  <description>Blue Quartz is created by a Cobalt RaQ UG</description>
82
94
  <param pos="0" name="os.vendor" value="Sun"/>
83
95
  <param pos="0" name="os.family" value="Linux"/>
84
96
  <param pos="0" name="os.product" value="Cobalt RaQ"/>
85
97
  </fingerprint>
98
+
86
99
  <fingerprint pattern="^Apache\/2\.2\.11.*\(Fedora\).*">
87
100
  <description>Red Hat Fedora 11</description>
88
101
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -91,6 +104,7 @@
91
104
  <param pos="0" name="os.version" value="11"/>
92
105
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:11"/>
93
106
  </fingerprint>
107
+
94
108
  <fingerprint pattern="^Apache\/2\.2\.15.*\(Fedora\).*">
95
109
  <description>Red Hat Fedora 13</description>
96
110
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -99,6 +113,7 @@
99
113
  <param pos="0" name="os.version" value="13"/>
100
114
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:13"/>
101
115
  </fingerprint>
116
+
102
117
  <fingerprint pattern="^Apache\/2\.2\.16.*\(Fedora\).*">
103
118
  <description>Red Hat Fedora 14</description>
104
119
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -107,6 +122,7 @@
107
122
  <param pos="0" name="os.version" value="14"/>
108
123
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:14"/>
109
124
  </fingerprint>
125
+
110
126
  <fingerprint pattern="^Apache\/2\.2\.23.*\(Fedora\).*">
111
127
  <description>Red Hat Fedora 17</description>
112
128
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -115,6 +131,7 @@
115
131
  <param pos="0" name="os.version" value="17"/>
116
132
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:17"/>
117
133
  </fingerprint>
134
+
118
135
  <fingerprint pattern="^Apache\/2\.4\.3.*\(Fedora\).*">
119
136
  <description>Red Hat Fedora 18</description>
120
137
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -123,6 +140,7 @@
123
140
  <param pos="0" name="os.version" value="18"/>
124
141
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:18"/>
125
142
  </fingerprint>
143
+
126
144
  <fingerprint pattern=".*\(Fedora\).*">
127
145
  <description>Red Hat Fedora</description>
128
146
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -130,6 +148,7 @@
130
148
  <param pos="0" name="os.product" value="Fedora Core Linux"/>
131
149
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:-"/>
132
150
  </fingerprint>
151
+
133
152
  <fingerprint pattern=".*\(RHEL\).*">
134
153
  <description>Red Hat Enterprise Linux</description>
135
154
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -137,6 +156,7 @@
137
156
  <param pos="0" name="os.product" value="Enterprise Linux"/>
138
157
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:enterprise_linux:-"/>
139
158
  </fingerprint>
159
+
140
160
  <fingerprint pattern=".*\(Red[ -]Hat(?:[/ ]Linux)?\).*">
141
161
  <description>Red Hat Linux</description>
142
162
  <param pos="0" name="os.vendor" value="Red Hat"/>
@@ -144,6 +164,16 @@
144
164
  <param pos="0" name="os.product" value="Linux"/>
145
165
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:-"/>
146
166
  </fingerprint>
167
+
168
+ <fingerprint pattern=".*\(Red Hat Enterprise (?:Linux)?\).*">
169
+ <description>Apache OS: Red Hat Enterprise Linux</description>
170
+ <example os.vendor="Red Hat">Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips</example>
171
+ <param pos="0" name="os.vendor" value="Red Hat"/>
172
+ <param pos="0" name="os.family" value="Linux"/>
173
+ <param pos="0" name="os.product" value="Enterprise Linux"/>
174
+ <param pos="0" name="os.cpe23" value="cpe:/o:redhat:enterprise_linux:-"/>
175
+ </fingerprint>
176
+
147
177
  <fingerprint pattern=".*Debian(?:[/ ]GNU)?(?:/Linux)?.*">
148
178
  <description>Debian Linux</description>
149
179
  <param pos="0" name="os.vendor" value="Debian"/>
@@ -151,6 +181,7 @@
151
181
  <param pos="0" name="os.product" value="Linux"/>
152
182
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
153
183
  </fingerprint>
184
+
154
185
  <fingerprint pattern=".*\((?:Linux/)?S[uU]SE(?:/Linux)?\).*">
155
186
  <description>Novell SuSE Linux</description>
156
187
  <param pos="0" name="os.vendor" value="SuSE"/>
@@ -158,6 +189,7 @@
158
189
  <param pos="0" name="os.product" value="Linux"/>
159
190
  <param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:-"/>
160
191
  </fingerprint>
192
+
161
193
  <fingerprint pattern=".*\(NETWARE\).*">
162
194
  <description>Novell NetWare</description>
163
195
  <param pos="0" name="os.vendor" value="Novell"/>
@@ -165,6 +197,7 @@
165
197
  <param pos="0" name="os.product" value="NetWare"/>
166
198
  <param pos="0" name="os.cpe23" value="cpe:/o:novell:netware:-"/>
167
199
  </fingerprint>
200
+
168
201
  <fingerprint pattern=".*HP-UX_Apache-based_Web_Server.*">
169
202
  <description>HP HP-UX</description>
170
203
  <param pos="0" name="os.vendor" value="HP"/>
@@ -172,6 +205,7 @@
172
205
  <param pos="0" name="os.product" value="HP-UX"/>
173
206
  <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
174
207
  </fingerprint>
208
+
175
209
  <fingerprint pattern=".*\(CentOS\).*">
176
210
  <description>CentOS Linux</description>
177
211
  <param pos="0" name="os.vendor" value="CentOS"/>
@@ -179,12 +213,14 @@
179
213
  <param pos="0" name="os.product" value="Linux"/>
180
214
  <param pos="0" name="os.cpe23" value="cpe:/o:centos:centos:-"/>
181
215
  </fingerprint>
216
+
182
217
  <fingerprint pattern=".*\(Turbolinux\).*">
183
218
  <description>Turbolinux</description>
184
219
  <param pos="0" name="os.vendor" value="Turbolinux"/>
185
220
  <param pos="0" name="os.family" value="Linux"/>
186
221
  <param pos="0" name="os.product" value="Linux"/>
187
222
  </fingerprint>
223
+
188
224
  <fingerprint pattern=".*\(FreeBSD\).*">
189
225
  <description>FreeBSD</description>
190
226
  <param pos="0" name="os.vendor" value="FreeBSD"/>
@@ -192,12 +228,14 @@
192
228
  <param pos="0" name="os.product" value="FreeBSD"/>
193
229
  <param pos="0" name="os.cpe23" value="cpe:/o:freebsd:freebsd:-"/>
194
230
  </fingerprint>
231
+
195
232
  <fingerprint pattern=".*\(Asianux\).*">
196
233
  <description>Asianux Linux</description>
197
234
  <param pos="0" name="os.vendor" value="Asianux"/>
198
235
  <param pos="0" name="os.family" value="Linux"/>
199
236
  <param pos="0" name="os.product" value="Linux"/>
200
237
  </fingerprint>
238
+
201
239
  <fingerprint pattern=".*\(Gentoo(?:/Linux)?\).*">
202
240
  <description>Gentoo Linux</description>
203
241
  <param pos="0" name="os.vendor" value="Gentoo"/>
@@ -205,6 +243,7 @@
205
243
  <param pos="0" name="os.product" value="Linux"/>
206
244
  <param pos="0" name="os.cpe23" value="cpe:/o:gentoo:linux:-"/>
207
245
  </fingerprint>
246
+
208
247
  <fingerprint pattern=".*\(Conectiva(?:/Linux)?\).*">
209
248
  <description>Conectiva Linux</description>
210
249
  <param pos="0" name="os.vendor" value="Conectiva"/>
@@ -212,6 +251,7 @@
212
251
  <param pos="0" name="os.product" value="Linux"/>
213
252
  <param pos="0" name="os.cpe23" value="cpe:/o:conectiva:linux:-"/>
214
253
  </fingerprint>
254
+
215
255
  <fingerprint pattern=".*\(Trustix Secure Linux(?:/Linux)?\).*">
216
256
  <description>Trustix Linux</description>
217
257
  <param pos="0" name="os.vendor" value="Trustix"/>
@@ -219,46 +259,54 @@
219
259
  <param pos="0" name="os.product" value="Secure Linux"/>
220
260
  <param pos="0" name="os.cpe23" value="cpe:/o:trustix:secure_linux:-"/>
221
261
  </fingerprint>
262
+
222
263
  <fingerprint pattern=".*\(White Box\).*">
223
264
  <description>White Box Enterprise Linux</description>
224
265
  <param pos="0" name="os.vendor" value="White Box"/>
225
266
  <param pos="0" name="os.family" value="Linux"/>
226
267
  <param pos="0" name="os.product" value="Enterprise Linux"/>
227
268
  </fingerprint>
269
+
228
270
  <fingerprint pattern=".*\(UnitedLinux\).*">
229
271
  <description>UnitedLinux</description>
230
272
  <param pos="0" name="os.vendor" value="UnitedLinux"/>
231
273
  <param pos="0" name="os.family" value="Linux"/>
232
274
  <param pos="0" name="os.product" value="Linux"/>
233
275
  </fingerprint>
276
+
234
277
  <fingerprint pattern=".*\(PLD/Linux\).*">
235
278
  <description>PLD Linux</description>
236
279
  <param pos="0" name="os.vendor" value="PLD"/>
237
280
  <param pos="0" name="os.family" value="Linux"/>
238
281
  <param pos="0" name="os.product" value="Linux"/>
239
282
  </fingerprint>
283
+
240
284
  <fingerprint pattern=".*\(Vine/Linux\).*">
241
285
  <description>Vine Linux</description>
242
286
  <param pos="0" name="os.vendor" value="Vine"/>
243
287
  <param pos="0" name="os.family" value="Linux"/>
244
288
  <param pos="0" name="os.product" value="Linux"/>
245
289
  </fingerprint>
290
+
246
291
  <fingerprint pattern=".*\(rPath\).*">
247
292
  <description>rPath Linux</description>
248
293
  <param pos="0" name="os.vendor" value="rPath"/>
249
294
  <param pos="0" name="os.family" value="Linux"/>
250
295
  <param pos="0" name="os.product" value="Linux"/>
251
296
  </fingerprint>
297
+
252
298
  <fingerprint pattern=".*\(StartCom Linux\).*">
253
299
  <description>StartCom Linux</description>
254
300
  <param pos="0" name="os.vendor" value="StartCom"/>
255
301
  <param pos="0" name="os.family" value="Linux"/>
256
302
  <param pos="0" name="os.product" value="Linux"/>
257
303
  </fingerprint>
304
+
258
305
  <fingerprint pattern=".*Linux.*">
259
306
  <description>Generic Linux fallback</description>
260
307
  <param pos="0" name="os.certainty" value="0.75"/>
261
308
  <param pos="0" name="os.family" value="Linux"/>
262
309
  <param pos="0" name="os.product" value="Linux"/>
263
310
  </fingerprint>
264
- </fingerprints>
311
+
312
+ </fingerprints>
@@ -1,32 +1,44 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="architecture" database_type="util.os">
3
3
  <!--
4
4
  Generic rules for matching a machine architecture, platform, or chipset
5
5
  -->
6
+
6
7
  <fingerprint pattern="x64|amd64|x86_64" flags="REG_ICASE">
7
8
  <description>x64 (x86_x64)</description>
8
9
  <example>Linux claw 3.11.0-15-generic #23-Ubuntu SMP Mon Dec 9 18:17:04 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux</example>
9
- <param pos="0" name="os.arch" value="x64"/>
10
+ <param pos="0" name="os.arch" value="x86_64"/>
10
11
  </fingerprint>
12
+
11
13
  <fingerprint pattern="x86|i[3456]86" flags="REG_ICASE">
12
14
  <description>x86</description>
13
15
  <example>Linux bob 3.2.0-1-generic #3-Ubuntu SMP Wed Dec 11 19:12:55 UTC 2013 i686 i686 i686 GNU/Linux</example>
14
16
  <param pos="0" name="os.arch" value="x86"/>
15
17
  </fingerprint>
18
+
16
19
  <fingerprint pattern="PowerPC|PPC|POWER|ppc">
17
20
  <description>PowerPC</description>
18
- <param pos="0" name="os.arch" value="ppc"/>
21
+ <param pos="0" name="os.arch" value="PowerPC"/>
19
22
  </fingerprint>
23
+
20
24
  <fingerprint pattern="SPARC" flags="REG_ICASE">
21
25
  <description>SPARC</description>
22
- <param pos="0" name="os.arch" value="sparc"/>
26
+ <param pos="0" name="os.arch" value="Sparc"/>
23
27
  </fingerprint>
28
+
24
29
  <fingerprint pattern="mips" flags="REG_ICASE">
25
30
  <description>MIPS</description>
26
- <param pos="0" name="os.arch" value="mips"/>
31
+ <param pos="0" name="os.arch" value="MIPS"/>
27
32
  </fingerprint>
33
+
34
+ <fingerprint pattern="arm64|aarch64" flags="REG_ICASE">
35
+ <description>ARM64 (aarch64)</description>
36
+ <param pos="0" name="os.arch" value="ARM64"/>
37
+ </fingerprint>
38
+
28
39
  <fingerprint pattern="arm" flags="REG_ICASE">
29
40
  <description>ARM</description>
30
- <param pos="0" name="os.arch" value="arm"/>
41
+ <param pos="0" name="os.arch" value="ARM"/>
31
42
  </fingerprint>
32
- </fingerprints>
43
+
44
+ </fingerprints>
@@ -1,22 +1,56 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="dns.versionbind" protocol="dns" database_type="service" preference="0.750">
3
3
  <!--
4
4
  This fingerprint file matches the text string response from a DNS
5
5
  version.bind request.
6
-
7
6
  For example, the string 'dnsmasq-2.76-1-ubnt2' emitted by the command below:
8
-
9
7
  $ nslookup -type=txt -class=chaos VERSION.BIND <dns_server> | grep VERSION.BIND | cut -d\" -f2
10
8
  dnsmasq-2.76-1-ubnt2
9
+ -->
11
10
 
11
+ <!--
12
+ The following 'assert nothing' block is intended to handle banners so simple
13
+ that they cannot be attributed to a product or vendor. They are at the
14
+ beginning of the file as a performance tweak given how frequenty they occur.
12
15
  -->
16
+
17
+ <fingerprint pattern="^$">
18
+ <description>empty string -- assert nothing.</description>
19
+ <example/>
20
+ <param pos="0" name="service.certainty" value="0.0"/>
21
+ </fingerprint>
22
+
23
+ <fingerprint pattern="^none$">
24
+ <description>bare 'none' -- assert nothing.</description>
25
+ <example>none</example>
26
+ <param pos="0" name="service.certainty" value="0.0"/>
27
+ </fingerprint>
28
+
29
+ <fingerprint pattern="^null$">
30
+ <description>bare 'null' -- assert nothing.</description>
31
+ <example>null</example>
32
+ <param pos="0" name="service.certainty" value="0.0"/>
33
+ </fingerprint>
34
+
35
+ <fingerprint pattern="(?i)^unknown$">
36
+ <description>bare 'unknown' -- assert nothing.</description>
37
+ <example>unknown</example>
38
+ <param pos="0" name="service.certainty" value="0.0"/>
39
+ </fingerprint>
40
+
41
+ <fingerprint pattern="^no version$">
42
+ <description>bare 'no version' -- assert nothing.</description>
43
+ <example>no version</example>
44
+ <param pos="0" name="service.certainty" value="0.0"/>
45
+ </fingerprint>
46
+
13
47
  <!-- Red Hat package naming:
14
48
  https://fedoraproject.org/wiki/Packaging:DistTag
15
49
  https://fedoraproject.org/wiki/Packaging:Versioning
16
-
17
50
  Enterprise linux release dates:
18
51
  https://access.redhat.com/articles/3078
19
52
  -->
53
+
20
54
  <fingerprint pattern="^(9.[^-]+(?:-rpz\d?[+.]rl[\d.]+)?(?:-[SP]\d)?)-RedHat-[\d.]+[-.][\w.]+el([\d]+)_?(\d*)(?:.[\w.]+)?$">
21
55
  <description>ISC BIND: Red Hat Enterprise Linux</description>
22
56
  <example service.version="9.8.2rc1" os.version="6" os.version.version="9">9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2</example>
@@ -38,10 +72,12 @@
38
72
  <param pos="3" name="os.version.version"/>
39
73
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:enterprise_linux:{os.version}"/>
40
74
  </fingerprint>
75
+
41
76
  <fingerprint pattern="^(9.[^-]+(?:-rl[.\d]+)?(?:-[SP]\d)?)-RedHat-[\d.]+-[\w.]+fc([\d]+)$">
42
77
  <description>ISC BIND: Fedora</description>
43
78
  <example service.version="9.10.4-P8">9.10.4-P8-RedHat-9.10.4-4.P8.fc25</example>
44
79
  <!-- The '-rl' in the example below indicates a rate limiting patch -->
80
+
45
81
  <example service.version="9.9.3-rl.13207.22-P2">9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19</example>
46
82
  <example os.version="10">9.5.2-RedHat-9.5.2-1.fc10</example>
47
83
  <param pos="0" name="service.vendor" value="ISC"/>
@@ -55,6 +91,7 @@
55
91
  <param pos="2" name="os.version"/>
56
92
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:{os.version}"/>
57
93
  </fingerprint>
94
+
58
95
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-RedHat-[\w.-]+amzn1$">
59
96
  <description>ISC BIND: Red Hat - Amazon hosted</description>
60
97
  <example service.version="9.8.2rc1">9.8.2rc1-RedHat-9.8.2-0.37.rc1.45.amzn1</example>
@@ -67,6 +104,7 @@
67
104
  <param pos="0" name="os.vendor" value="Red Hat"/>
68
105
  <param pos="0" name="os.family" value="Linux"/>
69
106
  </fingerprint>
107
+
70
108
  <fingerprint pattern="(9.[^-]+(?:-[SP]\d)?)-RedHat-[\w.-]+alios([\d\.]+)$">
71
109
  <description>ISC BIND: Red Hat - Alibaba Customized EL</description>
72
110
  <example service.version="9.9.9-P3" os.version="6">9.9.9-P3-RedHat-9.9.9-2.1.alios6</example>
@@ -82,6 +120,7 @@
82
120
  <param pos="2" name="os.version"/>
83
121
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:enterprise_linux:{os.version}"/>
84
122
  </fingerprint>
123
+
85
124
  <fingerprint pattern="^(9.[^-]+(?:rc\d)?(?:-[SP]\d)?)-RedHat-[\d.-]+(?:[-\.][SP]\d)?(?:rc[\d\.]+)?$">
86
125
  <description>ISC BIND: Red Hat nonspecific platform</description>
87
126
  <example service.version="9.9.10-P2">9.9.10-P2-RedHat-9.9.10-P2</example>
@@ -97,6 +136,7 @@
97
136
  <param pos="0" name="os.product" value="Linux"/>
98
137
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:-"/>
99
138
  </fingerprint>
139
+
100
140
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-[\d.]+ubuntu[\d.]+-Ubuntu$">
101
141
  <description>ISC BIND: Ubuntu</description>
102
142
  <example service.version="9.9.5">9.9.5-11ubuntu1.1-Ubuntu</example>
@@ -111,6 +151,7 @@
111
151
  <param pos="0" name="os.product" value="Linux"/>
112
152
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
113
153
  </fingerprint>
154
+
114
155
  <fingerprint pattern="^(9.[^-]+-rpz\d?[+.]rl[\d.]+(?:-[SP]\d)?)-Ubuntu-[\d\.:]+[\w\.]+(?:-[SP]\d)?-\d?ubuntu[\d\.]+$">
115
156
  <description>ISC BIND: Ubuntu with Response Policy Zone and Request Limiting patches</description>
116
157
  <example service.version="9.9.3-rpz2+rl.13214.22-P2">9.9.3-rpz2+rl.13214.22-P2-Ubuntu-1:9.9.3.dfsg.P2-4ubuntu1.1</example>
@@ -124,6 +165,7 @@
124
165
  <param pos="0" name="os.product" value="Linux"/>
125
166
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
126
167
  </fingerprint>
168
+
127
169
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)(?:-[\d\.]+)?-Ubuntu$">
128
170
  <description>ISC BIND: Ubuntu short</description>
129
171
  <example service.version="9.10.3-P4">9.10.3-P4-Ubuntu</example>
@@ -139,6 +181,7 @@
139
181
  <param pos="0" name="os.product" value="Linux"/>
140
182
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
141
183
  </fingerprint>
184
+
142
185
  <fingerprint pattern="^(9.[\d\.]+(?:[+-]rpz\d?[+.]rl[\d.]+)?(?:-[SP]\d)?).*[+-]zentyal\d*">
143
186
  <description>ISC BIND: Ubuntu Zentyal custom distribution</description>
144
187
  <example service.version="9.9.5">9.9.5-3+zentyal-Ubuntu</example>
@@ -153,8 +196,24 @@
153
196
  <param pos="0" name="os.family" value="Linux"/>
154
197
  <param pos="0" name="os.product" value="Zentyal"/>
155
198
  </fingerprint>
199
+
200
+ <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)(?:-[\d\.]+)?\+deb10[\w~\.]+-Debian$">
201
+ <description>ISC BIND: Debian 10.0 (buster)</description>
202
+ <example service.version="9.11.5-P4">9.11.5-P4-5.1+deb10u1-Debian</example>
203
+ <param pos="0" name="service.vendor" value="ISC"/>
204
+ <param pos="0" name="service.family" value="BIND"/>
205
+ <param pos="0" name="service.product" value="BIND"/>
206
+ <param pos="1" name="service.version"/>
207
+ <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
208
+ <param pos="0" name="os.vendor" value="Debian"/>
209
+ <param pos="0" name="os.family" value="Linux"/>
210
+ <param pos="0" name="os.product" value="Linux"/>
211
+ <param pos="0" name="os.version" value="10.0"/>
212
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.0"/>
213
+ </fingerprint>
214
+
156
215
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-9\+deb8u[\w~\.]+-Debian$">
157
- <description>ISC BIND: Debian Jessie</description>
216
+ <description>ISC BIND: Debian 8.0 (jessie)</description>
158
217
  <example service.version="9.9.5">9.9.5-9+deb8u11-Debian</example>
159
218
  <example service.version="9.9.5">9.9.5-9+deb8u6A~4.2.0.201702281603-Debian</example>
160
219
  <param pos="0" name="service.vendor" value="ISC"/>
@@ -168,8 +227,9 @@
168
227
  <param pos="0" name="os.version" value="8.0"/>
169
228
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
170
229
  </fingerprint>
230
+
171
231
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-9wheezy\w+-Debian$">
172
- <description>ISC BIND: Debian Wheezy</description>
232
+ <description>ISC BIND: Debian 7.0 (wheezy)</description>
173
233
  <example service.version="9.9.5">9.9.5-9wheezy1-Debian</example>
174
234
  <param pos="0" name="service.vendor" value="ISC"/>
175
235
  <param pos="0" name="service.family" value="BIND"/>
@@ -182,6 +242,7 @@
182
242
  <param pos="0" name="os.version" value="7.0"/>
183
243
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
184
244
  </fingerprint>
245
+
185
246
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-(?:[\d\.]+-)?Debian$">
186
247
  <description>ISC BIND: Debian no version simple</description>
187
248
  <example service.version="9.10.3-P4">9.10.3-P4-Debian</example>
@@ -197,6 +258,7 @@
197
258
  <param pos="0" name="os.product" value="Linux"/>
198
259
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
199
260
  </fingerprint>
261
+
200
262
  <fingerprint pattern="^(9\.\d{1,2}\.\d{1,2}-rpz\d?[+.]rl[\d.]+(?:-[SPW]\d+)?)$">
201
263
  <description>ISC BIND: Response Policy Zone and Request Limiting patches</description>
202
264
  <example service.version="9.8.4-rpz2+rl005.12-P1">9.8.4-rpz2+rl005.12-P1</example>
@@ -207,6 +269,7 @@
207
269
  <param pos="1" name="service.version"/>
208
270
  <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
209
271
  </fingerprint>
272
+
210
273
  <fingerprint pattern="^DNS Server BIND (9\.\d{1,2}-ESV(?:-R\d+)?(?:-[SPW]\d+)?)$">
211
274
  <description>ISC BIND: ESV</description>
212
275
  <example service.version="9.6-ESV-R7-P2">DNS Server BIND 9.6-ESV-R7-P2</example>
@@ -216,10 +279,12 @@
216
279
  <param pos="1" name="service.version"/>
217
280
  <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
218
281
  </fingerprint>
282
+
219
283
  <!--
220
284
  FP below might be overly specific, trying to avoid false positive when
221
285
  matching cross-service/protocol.
222
286
  -->
287
+
223
288
  <fingerprint pattern="^(?:BIND )?([89]\.[\d\.]+(?:[ab]\d+)?(?:-ESV(?:-R\d+)?)?(?:-[SPW][\d\.]+)?(?:-REL)?(?:-[W]\d+)?(?:rc\d)?)(?:-NOESW)?$">
224
289
  <description>ISC BIND: bare release number - ESV REL NOESW</description>
225
290
  <example service.version="9.7.0-P1">9.7.0-P1</example>
@@ -242,6 +307,7 @@
242
307
  <param pos="1" name="service.version"/>
243
308
  <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
244
309
  </fingerprint>
310
+
245
311
  <fingerprint pattern="^dnsmasq-(\d.[\w\.]+)$">
246
312
  <description>dnsmasq: simple</description>
247
313
  <example service.version="2.40">dnsmasq-2.40</example>
@@ -254,6 +320,7 @@
254
320
  <param pos="1" name="service.version"/>
255
321
  <param pos="0" name="service.cpe23" value="cpe:/a:thekelleys:dnsmasq:{service.version}"/>
256
322
  </fingerprint>
323
+
257
324
  <fingerprint pattern="^dnsmasq-(\d.[\w]+-\d)-ubnt\d$">
258
325
  <description>dnsmasq: Ubiquiti</description>
259
326
  <example service.version="2.76-1">dnsmasq-2.76-1-ubnt2</example>
@@ -266,7 +333,9 @@
266
333
  <!-- Not including more info at this time as I'm not sure this doesn't
267
334
  run on products other than EdgeRouter.
268
335
  -->
336
+
269
337
  </fingerprint>
338
+
270
339
  <fingerprint pattern="^dnsmasq-(\d.[\w]+)-OpenDNS-\d$">
271
340
  <description>dnsmasq: OpenDNS variant</description>
272
341
  <example service.version="2.15">dnsmasq-2.15-OpenDNS-1</example>
@@ -278,7 +347,9 @@
278
347
  <!-- Seems to correlate with OpenWRT and Netgear but I haven't been able
279
348
  to verify that it isn't used elsewhere.
280
349
  -->
350
+
281
351
  </fingerprint>
352
+
282
353
  <fingerprint pattern="^dnsmasq-?(?:UNKNOWN)?$">
283
354
  <description>dnsmasq: no version</description>
284
355
  <example>dnsmasq-UNKNOWN</example>
@@ -289,6 +360,7 @@
289
360
  <param pos="0" name="service.product" value="Dnsmasq"/>
290
361
  <param pos="0" name="service.cpe23" value="cpe:/a:thekelleys:dnsmasq:-"/>
291
362
  </fingerprint>
363
+
292
364
  <fingerprint pattern="^PowerDNS Recursor (\d\.[\d.]+(?:-\w+)?) \(\w+@[\w.]+ built \d+ \w+@[\w.-]*\)$">
293
365
  <description>PowerDNS Recursor</description>
294
366
  <example service.version="3.6.2">PowerDNS Recursor 3.6.2 (jenkins@autotest.powerdns.com built 20141031140810 mockbuild@)</example>
@@ -299,6 +371,7 @@
299
371
  <param pos="1" name="service.version"/>
300
372
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:recursor:{service.version}"/>
301
373
  </fingerprint>
374
+
302
375
  <fingerprint pattern="^PowerDNS Recursor (\d\.[\d.]+) \(built [\w\s:]+ by [\w]+\@[\w.-]*\)$">
303
376
  <description>PowerDNS Recursor: format 2</description>
304
377
  <example service.version="4.0.4">PowerDNS Recursor 4.0.4 (built Apr 13 2017 09:59:06 by root@oof-e.baz.foo.bar)</example>
@@ -308,6 +381,7 @@
308
381
  <param pos="1" name="service.version"/>
309
382
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:recursor:{service.version}"/>
310
383
  </fingerprint>
384
+
311
385
  <fingerprint pattern="^PowerDNS Recursor (\d\.[\d.]+(?:-\w+)?)$">
312
386
  <description>PowerDNS Recursor: version only</description>
313
387
  <example service.version="4.0.4">PowerDNS Recursor 4.0.4</example>
@@ -318,6 +392,7 @@
318
392
  <param pos="1" name="service.version"/>
319
393
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:recursor:{service.version}"/>
320
394
  </fingerprint>
395
+
321
396
  <fingerprint pattern="^PowerDNS Recursor (\d\.[\d.]+) \$Id[^$]*\$$">
322
397
  <description>PowerDNS Recursor: ID format</description>
323
398
  <example service.version="3.5.3">PowerDNS Recursor 3.5.3 $Id$</example>
@@ -328,6 +403,7 @@
328
403
  <param pos="1" name="service.version"/>
329
404
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:recursor:{service.version}"/>
330
405
  </fingerprint>
406
+
331
407
  <fingerprint pattern="^PowerDNS Recursor$">
332
408
  <description>PowerDNS Recursor: no version</description>
333
409
  <example>PowerDNS Recursor</example>
@@ -336,6 +412,7 @@
336
412
  <param pos="0" name="service.product" value="Recursor"/>
337
413
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:recursor:-"/>
338
414
  </fingerprint>
415
+
339
416
  <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\d.]+(?:-rc\d)?) \(\w+@[\w.]+ built [\d\s]+\w*@[\w.-]*\)$">
340
417
  <description>PowerDNS Authoritative Server</description>
341
418
  <example service.version="3.4.19">PowerDNS Authoritative Server 3.4.19 (jenkins@autotest.powerdns.com built 20160102220341 root@)</example>
@@ -349,19 +426,22 @@
349
426
  <param pos="1" name="service.version"/>
350
427
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:authoritative_server:{service.version}"/>
351
428
  </fingerprint>
352
- <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
429
+
430
+ <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?[^ ]*) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
353
431
  <description>PowerDNS Authoritative Server: format 2</description>
354
432
  <example service.version="4.0.4">PowerDNS Authoritative Server 4.0.4 (built Jul 26 2017 15:04:27 by root@FreeBSD:11:amd64-default-job-03)</example>
355
433
  <example service.version="4.0.0-rc2">PowerDNS Authoritative Server 4.0.0-rc2 (built Jul 4 2016 15:44:39 by root@foo-bar.baz)</example>
356
434
  <example service.version="4.0.0-alpha2">PowerDNS Authoritative Server 4.0.0-alpha2 (built Feb 01 2016 00:12:05 by buildbot@baz)</example>
357
435
  <example service.version="4.0.0-beta1">PowerDNS Authoritative Server 4.0.0-beta1 (built Feb 01 2016 00:00:00 by buildbot@baz)</example>
358
436
  <example service.version="0.0.g56d692a">PowerDNS Authoritative Server 0.0.g56d692a (built Feb 25 2017 13:10:19 by root@foo-bar.baz)</example>
437
+ <example service.version="4.2.0-rc2.995.master.g8cc411dc4">PowerDNS Authoritative Server 4.2.0-rc2.995.master.g8cc411dc4 (built Nov 6 2019 11:48:12 by root@foo-bar.baz)</example>
359
438
  <param pos="0" name="service.vendor" value="PowerDNS"/>
360
439
  <param pos="0" name="service.family" value="PowerDNS"/>
361
440
  <param pos="0" name="service.product" value="Authoritative Server"/>
362
441
  <param pos="1" name="service.version"/>
363
442
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:authoritative_server:{service.version}"/>
364
443
  </fingerprint>
444
+
365
445
  <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\d.]+(?:-\w+)?)$">
366
446
  <description>PowerDNS Authoritative Server: version only</description>
367
447
  <example service.version="4.0.0">PowerDNS Authoritative Server 4.0.0</example>
@@ -372,12 +452,14 @@
372
452
  <param pos="1" name="service.version"/>
373
453
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:authoritative_server:{service.version}"/>
374
454
  </fingerprint>
455
+
375
456
  <!-- PowerDNS returns 'Served by ...' when the 'version-string' configuration
376
457
  value / arguement is set to 'powerdns'. If this value is set to
377
458
  'anonymous' then PowerDNS will return a ServFail DNS response
378
459
  The matches below are *probably* Authoritative Server but we can't be
379
460
  sure.
380
461
  -->
462
+
381
463
  <fingerprint pattern="^Served by POWERDNS (\d\.[\d.]+) \$Id[^$]*\$$">
382
464
  <description>PowerDNS: Served by format with version</description>
383
465
  <example service.version="2.9.22">Served by POWERDNS 2.9.22 $Id: packethandler.cc 1321 2008-12-06 19:44:36Z ahu $</example>
@@ -385,6 +467,7 @@
385
467
  <param pos="0" name="service.family" value="PowerDNS"/>
386
468
  <param pos="1" name="service.version"/>
387
469
  </fingerprint>
470
+
388
471
  <fingerprint pattern="^Served by PowerDNS - https?:\/\/www.powerdns.com\/?$">
389
472
  <description>PowerDNS: Served by format without version</description>
390
473
  <example>Served by PowerDNS - https://www.powerdns.com/</example>
@@ -392,6 +475,7 @@
392
475
  <param pos="0" name="service.vendor" value="PowerDNS"/>
393
476
  <param pos="0" name="service.family" value="PowerDNS"/>
394
477
  </fingerprint>
478
+
395
479
  <fingerprint pattern="^Nominum Vantio(?: CacheServe)? ([\d.]+)$">
396
480
  <description>Nominum Vantio CacheServe</description>
397
481
  <example service.version="4.3.0.2">Nominum Vantio 4.3.0.2</example>
@@ -401,15 +485,17 @@
401
485
  <param pos="0" name="service.product" value="CacheServe"/>
402
486
  <param pos="1" name="service.version"/>
403
487
  </fingerprint>
488
+
404
489
  <fingerprint pattern="^Nominum Vantio ([\d.]+) \(build (\d+)\)$">
405
490
  <description>Nominum Vantio CacheServe, with build</description>
406
- <example service.version.version="114872">Nominum Vantio 5.4.5.1 (build 114872)</example>
491
+ <example service.version="5.4.5.1" service.version.version="114872">Nominum Vantio 5.4.5.1 (build 114872)</example>
407
492
  <param pos="0" name="service.vendor" value="Nominum"/>
408
493
  <param pos="0" name="service.family" value="Vantio"/>
409
494
  <param pos="0" name="service.product" value="CacheServe"/>
410
495
  <param pos="1" name="service.version"/>
411
496
  <param pos="2" name="service.version.version"/>
412
497
  </fingerprint>
498
+
413
499
  <fingerprint pattern="^Nominum ANS(?:Premier)? ([\d\.]+)$">
414
500
  <description>Nominum Vantio AuthServ</description>
415
501
  <example service.version="5.4.0.0">Nominum ANS 5.4.0.0</example>
@@ -419,6 +505,7 @@
419
505
  <param pos="0" name="service.product" value="AuthServ"/>
420
506
  <param pos="1" name="service.version"/>
421
507
  </fingerprint>
508
+
422
509
  <fingerprint pattern="^NSD ([\d.]*(?:b\d+)?)$">
423
510
  <description>NLnet Labs Name Server Daemon</description>
424
511
  <example service.version="3.2.18">NSD 3.2.18</example>
@@ -429,7 +516,9 @@
429
516
  <param pos="0" name="service.family" value="NSD"/>
430
517
  <param pos="0" name="service.product" value="dnsd"/>
431
518
  <param pos="1" name="service.version"/>
519
+ <param pos="0" name="service.cpe23" value="cpe:/a:nlnetlabs:name_server_daemon:{service.version}"/>
432
520
  </fingerprint>
521
+
433
522
  <fingerprint pattern="^unbound ([\d.]+)$">
434
523
  <description>NLnet Labs Unbound</description>
435
524
  <example service.version="1.4.22">unbound 1.4.22</example>
@@ -437,14 +526,32 @@
437
526
  <param pos="0" name="service.family" value="Unbound"/>
438
527
  <param pos="0" name="service.product" value="unbound"/>
439
528
  <param pos="1" name="service.version"/>
529
+ <param pos="0" name="service.cpe23" value="cpe:/a:nlnetlabs:unbound:{service.version}"/>
440
530
  </fingerprint>
531
+
441
532
  <fingerprint pattern="^(?i:unbound)$">
442
533
  <description>NLnet Labs Unbound no version string</description>
443
534
  <example>unbound</example>
444
535
  <param pos="0" name="service.vendor" value="NLnet Labs"/>
445
536
  <param pos="0" name="service.family" value="Unbound"/>
446
537
  <param pos="0" name="service.product" value="unbound"/>
538
+ <param pos="0" name="service.cpe23" value="cpe:/a:nlnetlabs:unbound:-"/>
447
539
  </fingerprint>
540
+
541
+ <fingerprint pattern="^(?:BIND )?(9.[^-]+(?:-[SP]\d)?)(?:-[\d\.]+)?\+deb10u\d+-Raspbian$">
542
+ <description>ISC BIND: Raspbian based on Debian Buster</description>
543
+ <example service.version="9.11.5-P4">9.11.5-P4-5.1+deb10u1-Raspbian</example>
544
+ <param pos="0" name="service.vendor" value="ISC"/>
545
+ <param pos="0" name="service.family" value="BIND"/>
546
+ <param pos="0" name="service.product" value="BIND"/>
547
+ <param pos="1" name="service.version"/>
548
+ <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
549
+ <param pos="0" name="os.vendor" value="Raspbian"/>
550
+ <param pos="0" name="os.family" value="Linux"/>
551
+ <param pos="0" name="os.product" value="Linux"/>
552
+ <param pos="0" name="os.version" value="10.0"/>
553
+ </fingerprint>
554
+
448
555
  <fingerprint pattern="^(?:BIND )?(9.[^-]+(?:-[SP]\d)?)-9\+deb8u\d+-Raspbian$">
449
556
  <description>ISC BIND: Raspbian based on Debian Jessie</description>
450
557
  <example service.version="9.9.5">9.9.5-9+deb8u7-Raspbian</example>
@@ -459,6 +566,7 @@
459
566
  <param pos="0" name="os.product" value="Linux"/>
460
567
  <param pos="0" name="os.version" value="8.0"/>
461
568
  </fingerprint>
569
+
462
570
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-(?:\d-)?Raspbian$">
463
571
  <description>ISC BIND: Raspbian based on Debian Jessie no version simple</description>
464
572
  <example service.version="9.10.3-P4">9.10.3-P4-Raspbian</example>
@@ -471,15 +579,18 @@
471
579
  <param pos="0" name="os.family" value="Linux"/>
472
580
  <param pos="0" name="os.product" value="Linux"/>
473
581
  </fingerprint>
582
+
474
583
  <fingerprint pattern="^Knot DNS ([\d.]+(?:-dev)?)$">
475
584
  <description>Knot DNS</description>
476
585
  <example service.version="1.6.0">Knot DNS 1.6.0</example>
477
586
  <example service.version="2.5.0-dev">Knot DNS 2.5.0-dev</example>
478
587
  <param pos="0" name="service.vendor" value="cz.nic"/>
479
588
  <param pos="0" name="service.family" value="Knot"/>
480
- <param pos="0" name="service.product" value="DNS"/>
589
+ <param pos="0" name="service.product" value="Knot DNS"/>
481
590
  <param pos="1" name="service.version"/>
591
+ <param pos="0" name="service.cpe23" value="cpe:/a:knot-dns:knot_dns:{service.version}"/>
482
592
  </fingerprint>
593
+
483
594
  <fingerprint pattern="^UltraDNS Resolver$">
484
595
  <description>Neustar UltraDNS Resolver</description>
485
596
  <example>UltraDNS Resolver</example>
@@ -487,6 +598,7 @@
487
598
  <param pos="0" name="service.family" value="UltraDNS"/>
488
599
  <param pos="0" name="service.product" value="Resolver"/>
489
600
  </fingerprint>
601
+
490
602
  <fingerprint pattern="^UltraDNS TLD Platform - www\.ultradns\.com$">
491
603
  <description>Neustar UltraDNS TLD Platform</description>
492
604
  <example>UltraDNS TLD Platform - www.ultradns.com</example>
@@ -494,24 +606,25 @@
494
606
  <param pos="0" name="service.family" value="UltraDNS"/>
495
607
  <param pos="0" name="service.product" value="Resolver"/>
496
608
  </fingerprint>
609
+
497
610
  <!-- For Microsoft OSes the build number applies to the family. For example,
498
611
  6.3.9600 is used by Windows 8.1 Update 1 as well as Windows 2012 R2. We
499
612
  are assuming that the server version of the OS is what we are
500
613
  fingerprinting since installation of the DNS service on the workstation
501
614
  class OS would be unlikely and difficult if possible at all.
502
-
503
615
  DNS version response is disabled by default on modern Windows versions
504
616
  and the detail in the response is controlled via the EnableVersionQuery
505
617
  setting.
506
-
507
618
  The to enable version response on modern versions is:
508
619
  dnscmd /config /EnableVersionQuery 1
509
620
  -->
621
+
510
622
  <fingerprint pattern="^Microsoft DNS (10.0.\d+)(?: \(\w+\))?$">
511
623
  <description>Microsoft DNS on Windows 2016: GA</description>
512
624
  <!-- Windows 10 / 2016 moved towards a rolling release so capturing build
513
625
  is required unlike other Windows versions where we use a fixed string.
514
626
  -->
627
+
515
628
  <example service.version="10.0.14393" os.build="10.0.14393">Microsoft DNS 10.0.14393 (383900CE)</example>
516
629
  <param pos="0" name="service.vendor" value="Microsoft"/>
517
630
  <param pos="0" name="service.family" value="DNS"/>
@@ -523,6 +636,7 @@
523
636
  <param pos="1" name="os.build"/>
524
637
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
525
638
  </fingerprint>
639
+
526
640
  <fingerprint pattern="^Microsoft DNS 6.3.9600(?: \(\w+\))?$">
527
641
  <description>Microsoft DNS on Windows 2012 R2</description>
528
642
  <example>Microsoft DNS 6.3.9600 (25804825)</example>
@@ -536,6 +650,7 @@
536
650
  <param pos="0" name="os.build" value="6.3.9600"/>
537
651
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
538
652
  </fingerprint>
653
+
539
654
  <fingerprint pattern="^Microsoft DNS 6.2.9200(?: \(\w+\))?$">
540
655
  <description>Microsoft DNS on Windows 2012</description>
541
656
  <example>Microsoft DNS 6.2.9200 (23F04000)</example>
@@ -549,6 +664,7 @@
549
664
  <param pos="0" name="os.build" value="6.2.9200"/>
550
665
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2012:-"/>
551
666
  </fingerprint>
667
+
552
668
  <fingerprint pattern="^Microsoft DNS 6.1.7601(?: \(\w+\))?$">
553
669
  <description>Microsoft DNS on Windows 2008 R2 Service Pack 1</description>
554
670
  <example>Microsoft DNS 6.1.7601 (1DB15CD4)</example>
@@ -564,6 +680,7 @@
564
680
  <param pos="0" name="os.build" value="6.1.7601"/>
565
681
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:Service Pack 1"/>
566
682
  </fingerprint>
683
+
567
684
  <fingerprint pattern="^Microsoft DNS 6.1.7600(?: \(\w+\))?$">
568
685
  <description>Microsoft DNS on Windows 2008 R2</description>
569
686
  <example>Microsoft DNS 6.1.7600 (1DB04228)</example>
@@ -577,6 +694,35 @@
577
694
  <param pos="0" name="os.build" value="6.1.7600"/>
578
695
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
579
696
  </fingerprint>
697
+
698
+ <!-- This value is a spoofed value. There isn't a publicly available version
699
+ of Windows with build 6.0.6100 and this explicit string is used in an
700
+ example of how to change your version on BIND. We tested servers reporting
701
+ this string and NONE of them were Windows DNS.
702
+ This fingerprint serves to prevent someone who doesn't know from creating
703
+ one and stops further pattern matching efforts.
704
+ -->
705
+
706
+ <fingerprint pattern="^Microsoft DNS 6.0.6100 \(2AEF76E\)$">
707
+ <description>SPOOFED - Microsoft DNS on Windows 2008 SP something</description>
708
+ <example>Microsoft DNS 6.0.6100 (2AEF76E)</example>
709
+ </fingerprint>
710
+
711
+ <fingerprint pattern="^Microsoft DNS 6.0.6003(?: \(\w+\))?$">
712
+ <description>Microsoft DNS on Windows 2008 Service Pack 2 - Preview Rollup KB4489887 and later</description>
713
+ <example>Microsoft DNS 6.0.6003 (1773501D)</example>
714
+ <param pos="0" name="service.vendor" value="Microsoft"/>
715
+ <param pos="0" name="service.family" value="DNS"/>
716
+ <param pos="0" name="service.product" value="DNS"/>
717
+ <param pos="0" name="service.version" value="6.0.6003"/>
718
+ <param pos="0" name="os.vendor" value="Microsoft"/>
719
+ <param pos="0" name="os.family" value="Windows"/>
720
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
721
+ <param pos="0" name="os.version" value="Service Pack 2"/>
722
+ <param pos="0" name="os.build" value="6.0.6003"/>
723
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:Service Pack 2"/>
724
+ </fingerprint>
725
+
580
726
  <fingerprint pattern="^Microsoft DNS 6.0.6002(?: \(\w+\))?$">
581
727
  <description>Microsoft DNS on Windows 2008 Service Pack 2</description>
582
728
  <example>Microsoft DNS 6.0.6002 (17724D35)</example>
@@ -591,6 +737,7 @@
591
737
  <param pos="0" name="os.build" value="6.0.6002"/>
592
738
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:Service Pack 2"/>
593
739
  </fingerprint>
740
+
594
741
  <fingerprint pattern="^Microsoft DNS 6.0.6001(?: \(\w+\))?$">
595
742
  <description>Microsoft DNS on Windows 2008 Service Pack 1</description>
596
743
  <example>Microsoft DNS 6.0.6001 (17714726)</example>
@@ -605,12 +752,14 @@
605
752
  <param pos="0" name="os.build" value="6.0.6001"/>
606
753
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:Service Pack 1"/>
607
754
  </fingerprint>
755
+
608
756
  <fingerprint pattern="^DNSServer$">
609
757
  <description>Synology DNS service</description>
610
758
  <example>DNSServer</example>
611
759
  <param pos="0" name="service.vendor" value="Synology"/>
612
760
  <param pos="0" name="service.family" value="DSM"/>
613
- <param pos="0" name="service.product" value="DNS"/>
761
+ <param pos="0" name="service.product" value="DNS Server"/>
762
+ <param pos="0" name="service.cpe23" value="cpe:/a:synology:dns_server:-"/>
614
763
  <param pos="0" name="os.device" value="NAS"/>
615
764
  <param pos="0" name="os.family" value="Linux"/>
616
765
  <param pos="0" name="os.product" value="DSM"/>
@@ -618,6 +767,7 @@
618
767
  <param pos="0" name="hw.vendor" value="Synology"/>
619
768
  <param pos="0" name="hw.device" value="NAS"/>
620
769
  </fingerprint>
770
+
621
771
  <fingerprint pattern="^Incognito DNS Service ([\d\.]+) \(built">
622
772
  <description>Incognito DNS Service</description>
623
773
  <example service.version="6.4.4.2">Incognito DNS Service 6.4.4.2 (built Aug 10 2015) [up=15d30902s, ser=9876]</example>
@@ -626,6 +776,7 @@
626
776
  <param pos="0" name="service.product" value="DNS"/>
627
777
  <param pos="1" name="service.version"/>
628
778
  </fingerprint>
779
+
629
780
  <fingerprint pattern="^(?i:djbdns)[\s-](\d.\d+)$">
630
781
  <description>djbdns</description>
631
782
  <example service.version="1.05">djbdns 1.05</example>
@@ -636,6 +787,7 @@
636
787
  <param pos="0" name="service.product" value="djbdns"/>
637
788
  <param pos="1" name="service.version"/>
638
789
  </fingerprint>
790
+
639
791
  <fingerprint pattern="^(?i:djbdns)$">
640
792
  <description>djbdns: no version</description>
641
793
  <example>DJBDNS</example>
@@ -644,6 +796,7 @@
644
796
  <param pos="0" name="service.family" value="djbdns"/>
645
797
  <param pos="0" name="service.product" value="djbdns"/>
646
798
  </fingerprint>
799
+
647
800
  <fingerprint pattern="^rbldnsd (\d[\.\w\/-]+) \(\d\d \w\w\w \d\d\d\d\)$">
648
801
  <description>rbldnsd</description>
649
802
  <example service.version="0.997a">rbldnsd 0.997a (23 Jul 2013)</example>
@@ -654,6 +807,7 @@
654
807
  <param pos="0" name="service.product" value="rbldnsd"/>
655
808
  <param pos="1" name="service.version"/>
656
809
  </fingerprint>
810
+
657
811
  <fingerprint pattern="^ALU DNS ([\d\.]+) Build (\d+)$">
658
812
  <description>ALU (Alcatel Lucent?) DNS</description>
659
813
  <example service.version="6.2">ALU DNS 6.2 Build 22</example>
@@ -664,6 +818,7 @@
664
818
  <param pos="1" name="service.version"/>
665
819
  <param pos="2" name="service.version.version"/>
666
820
  </fingerprint>
821
+
667
822
  <fingerprint pattern="^DraytekDNS-v([\d\.]+)$">
668
823
  <description>DrayTek DNS</description>
669
824
  <example service.version="1.2.3006">DraytekDNS-v1.2.3006</example>
@@ -673,15 +828,18 @@
673
828
  <param pos="1" name="service.version"/>
674
829
  <param pos="0" name="hw.vendor" value="DrayTek"/>
675
830
  </fingerprint>
831
+
676
832
  <fingerprint pattern="^Atlas Anchor ([\d\.]+)$">
677
833
  <description>Ripe ATLAS Anchor</description>
678
834
  <!-- https://atlas.ripe.net/docs/anchors/ -->
835
+
679
836
  <example service.version="0.1">Atlas Anchor 0.1</example>
680
837
  <param pos="0" name="service.vendor" value="RIPE"/>
681
838
  <param pos="0" name="service.family" value="Atlas Anchor"/>
682
839
  <param pos="0" name="service.product" value="DNS"/>
683
840
  <param pos="1" name="service.version"/>
684
841
  </fingerprint>
842
+
685
843
  <fingerprint pattern="^ZyWALL DNS$">
686
844
  <description>ZyWALL DNS</description>
687
845
  <example>ZyWALL DNS</example>
@@ -690,6 +848,7 @@
690
848
  <param pos="0" name="service.product" value="DNS"/>
691
849
  <param pos="0" name="hw.vendor" value="Zyxel"/>
692
850
  </fingerprint>
851
+
693
852
  <fingerprint pattern="^Array SmartDNS$">
694
853
  <description>Array Networks SmartDNS</description>
695
854
  <example>Array SmartDNS</example>
@@ -697,13 +856,16 @@
697
856
  <param pos="0" name="service.family" value="APV"/>
698
857
  <param pos="0" name="service.product" value="SmartDNS"/>
699
858
  </fingerprint>
859
+
700
860
  <fingerprint pattern="^gdnsd$">
701
861
  <description>gdnsd</description>
702
862
  <example>gdnsd</example>
703
- <param pos="0" name="service.vendor" value="Brandon Black"/>
863
+ <param pos="0" name="service.vendor" value="gdnsd"/>
704
864
  <param pos="0" name="service.family" value="gdnsd"/>
705
865
  <param pos="0" name="service.product" value="gdnsd"/>
866
+ <param pos="0" name="service.cpe23" value="cpe:/a:gdnsd:gdnsd:-"/>
706
867
  </fingerprint>
868
+
707
869
  <fingerprint pattern="^Hi: [\w\.: =]+\d{4}$">
708
870
  <description>OzymanDNS DNS tunnel</description>
709
871
  <example>Hi: Thu Aug 17 23:29:10 2017</example>
@@ -712,6 +874,7 @@
712
874
  <param pos="0" name="service.family" value="OzymanDNS"/>
713
875
  <param pos="0" name="service.product" value="OzymanDNS"/>
714
876
  </fingerprint>
877
+
715
878
  <fingerprint pattern="^Meta IP[\s\/]DNS (?:V[\d\.]+ )?- BIND V([\d\.]+(?:-REL)?) \(Build (\d+)\s?\)$">
716
879
  <description>Check Point Meta IP</description>
717
880
  <example service.version="8.2.7-REL">Meta IP DNS - BIND V8.2.7-REL (Build 31)</example>
@@ -722,40 +885,51 @@
722
885
  <param pos="1" name="service.version"/>
723
886
  <param pos="2" name="service.version.version"/>
724
887
  </fingerprint>
888
+
725
889
  <fingerprint pattern="^CleanBrowsing v([^ ]+) - (.*)">
726
890
  <description>CleanBrowsing DNS Server</description>
727
- <example service.vendor="CleanBrowsing" service.family="CleanBrowsing" service.version="1.5a" service.node="dns-edge-usa-west-sunnyvale-p">CleanBrowsing v1.5a - dns-edge-usa-west-sunnyvale-p</example>
728
- <example service.vendor="CleanBrowsing" service.family="CleanBrowsing" service.version="1.4a" service.node="dns-edge-usa-west-sunnyvale.cleanbrowsing.org">CleanBrowsing v1.4a - dns-edge-usa-west-sunnyvale.cleanbrowsing.org</example>
891
+ <example service.version="1.5a" service.node="dns-edge-usa-west-sunnyvale-p">CleanBrowsing v1.5a - dns-edge-usa-west-sunnyvale-p</example>
892
+ <example service.version="1.4a" service.node="dns-edge-usa-west-sunnyvale.cleanbrowsing.org">CleanBrowsing v1.4a - dns-edge-usa-west-sunnyvale.cleanbrowsing.org</example>
729
893
  <param pos="0" name="service.vendor" value="CleanBrowsing"/>
730
894
  <param pos="0" name="service.family" value="CleanBrowsing"/>
731
895
  <param pos="0" name="service.product" value="DNS"/>
732
896
  <param pos="1" name="service.version"/>
733
897
  <param pos="2" name="service.node"/>
734
898
  </fingerprint>
899
+
735
900
  <fingerprint pattern="^dnsmasq-pi-hole-(.*)$">
736
901
  <description>dnsmasq: pi-hole</description>
737
- <example os.vendor="Pi-hole" service.vendor="Thekelleys" service.family="Dnsmasq" service.product="Dnsmasq" os.version="2.80" os.cpe23="cpe:/a:pi-hole:pi-hole:2.80" service.cpe23="cpe:/a:thekelleys:dnsmasq:-">dnsmasq-pi-hole-2.80</example>
738
- <param pos="0" name="os.vendor" value="Pi-hole"/>
739
- <param pos="0" name="service.vendor" value="Thekelleys"/>
740
- <param pos="0" name="service.family" value="Dnsmasq"/>
741
- <param pos="0" name="service.product" value="Dnsmasq"/>
742
- <param pos="1" name="os.version"/>
743
- <param pos="0" name="os.cpe23" value="cpe:/a:pi-hole:pi-hole:{os.version}"/>
744
- <param pos="0" name="service.cpe23" value="cpe:/a:thekelleys:dnsmasq:-"/>
902
+ <example service.version="2.80">dnsmasq-pi-hole-2.80</example>
903
+ <param pos="0" name="service.vendor" value="Pi-hole"/>
904
+ <param pos="0" name="service.family" value="Pi-hole"/>
905
+ <param pos="0" name="service.product" value="Pi-hole"/>
906
+ <param pos="1" name="service.version"/>
907
+ <param pos="0" name="service.cpe23" value="cpe:/a:pi-hole:pi-hole:{service.version}"/>
745
908
  </fingerprint>
909
+
746
910
  <fingerprint pattern="^Q9-[^\-]-(.*)$">
747
911
  <description>Quad9 Resolver</description>
748
- <example service.vendor="IBM" service.family="Quad9" service.product="DNS" service.version="6.0">Q9-P-6.0</example>
912
+ <example service.version="6.0">Q9-P-6.0</example>
749
913
  <param pos="0" name="service.vendor" value="IBM"/>
750
914
  <param pos="0" name="service.family" value="Quad9"/>
751
915
  <param pos="0" name="service.product" value="DNS"/>
752
916
  <param pos="1" name="service.version"/>
753
917
  </fingerprint>
918
+
754
919
  <fingerprint pattern="^keweonDNS v\.(.*)$">
755
920
  <description>Keweon DNS</description>
756
- <example service.vendor="Keweon" service.product="DNS" service.version="9.63.7201">keweonDNS v.9.63.7201</example>
921
+ <example service.version="9.63.7201">keweonDNS v.9.63.7201</example>
757
922
  <param pos="0" name="service.vendor" value="Keweon"/>
758
923
  <param pos="0" name="service.product" value="DNS"/>
759
924
  <param pos="1" name="service.version"/>
760
925
  </fingerprint>
761
- </fingerprints>
926
+
927
+ <fingerprint pattern="^Version: recursive-main/(\d+)$">
928
+ <description>Akamai AnswerX DNS server</description>
929
+ <example service.version="22386077">Version: recursive-main/22386077</example>
930
+ <param pos="0" name="service.vendor" value="Akamai"/>
931
+ <param pos="0" name="service.product" value="AnswerX"/>
932
+ <param pos="1" name="service.version"/>
933
+ </fingerprint>
934
+
935
+ </fingerprints>