recog 2.3.7 → 2.3.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +3 -2
- data/.ruby-gemset +1 -0
- data/.ruby-version +1 -0
- data/.travis.yml +2 -4
- data/Gemfile +2 -5
- data/bin/recog_standardize +118 -0
- data/cpe-remap.yaml +21 -0
- data/features/match.feature +4 -0
- data/features/support/aruba.rb +3 -0
- data/features/verify.feature +5 -0
- data/identifiers/README.md +47 -0
- data/identifiers/os_architecture.txt +20 -0
- data/identifiers/os_device.txt +52 -0
- data/identifiers/os_family.txt +160 -0
- data/identifiers/os_product.txt +199 -0
- data/identifiers/service_family.txt +185 -0
- data/identifiers/service_product.txt +255 -0
- data/identifiers/software_class.txt +26 -0
- data/identifiers/software_family.txt +91 -0
- data/identifiers/software_product.txt +333 -0
- data/identifiers/vendor.txt +405 -0
- data/lib/recog/version.rb +1 -1
- data/spec/lib/fingerprint_self_test_spec.rb +1 -1
- data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +1 -1
- data/update_cpes.py +1 -1
- data/xml/apache_os.xml +9 -0
- data/xml/architecture.xml +9 -5
- data/xml/dns_versionbind.xml +9 -11
- data/xml/ftp_banners.xml +47 -5
- data/xml/html_title.xml +310 -196
- data/xml/http_cookies.xml +13 -1
- data/xml/http_servers.xml +145 -7
- data/xml/http_wwwauth.xml +13 -1
- data/xml/mdns_device-info_txt.xml +20 -16
- data/xml/mysql_banners.xml +420 -38
- data/xml/ntp_banners.xml +16 -8
- data/xml/operating_system.xml +1 -0
- data/xml/rtsp_servers.xml +21 -21
- data/xml/sip_banners.xml +5 -41
- data/xml/sip_user_agents.xml +40 -1
- data/xml/smb_native_os.xml +1 -0
- data/xml/smtp_banners.xml +3 -4
- data/xml/snmp_sysdescr.xml +44 -28
- data/xml/ssh_banners.xml +78 -73
- data/xml/telnet_banners.xml +30 -9
- data/xml/x11_banners.xml +1 -1
- data/xml/x509_issuers.xml +7 -7
- data/xml/x509_subjects.xml +329 -28
- metadata +23 -6
@@ -0,0 +1,405 @@
|
|
1
|
+
2Wire
|
2
|
+
3Com
|
3
|
+
4D
|
4
|
+
ACC
|
5
|
+
ACME Laboratories
|
6
|
+
Acorn
|
7
|
+
Actiontec
|
8
|
+
ActiveState
|
9
|
+
Adaptec
|
10
|
+
ADC
|
11
|
+
Adobe
|
12
|
+
Adtran
|
13
|
+
AIM
|
14
|
+
Aironet
|
15
|
+
Alcatel
|
16
|
+
Allegro Software
|
17
|
+
Allied Telesyn
|
18
|
+
Alpha Micro
|
19
|
+
Alpine
|
20
|
+
Alteon
|
21
|
+
Alt-N
|
22
|
+
Amazon
|
23
|
+
AMD
|
24
|
+
Amiga
|
25
|
+
AnalogX
|
26
|
+
Apache
|
27
|
+
APC
|
28
|
+
Apollo
|
29
|
+
Apple
|
30
|
+
Aprelium Technologies
|
31
|
+
Arescom
|
32
|
+
ArGoSoft
|
33
|
+
Arlan
|
34
|
+
ARM
|
35
|
+
ARRIS
|
36
|
+
Artifex Software Inc.
|
37
|
+
Asante
|
38
|
+
Ascend
|
39
|
+
Ascom
|
40
|
+
Asianux
|
41
|
+
Atari
|
42
|
+
ATG
|
43
|
+
AtheOS
|
44
|
+
Atrium Software
|
45
|
+
Attachmate
|
46
|
+
Auspex
|
47
|
+
Avaya
|
48
|
+
Avocent
|
49
|
+
Axent
|
50
|
+
Axis
|
51
|
+
Bay Networks
|
52
|
+
Be
|
53
|
+
BEA
|
54
|
+
Bell Labs
|
55
|
+
Bintec
|
56
|
+
Bitvise
|
57
|
+
Blue Coat
|
58
|
+
Borderware
|
59
|
+
Brix Networks
|
60
|
+
Brocade
|
61
|
+
Brother
|
62
|
+
BSDi
|
63
|
+
BT
|
64
|
+
Buffalo
|
65
|
+
Business Objects
|
66
|
+
Cabletron
|
67
|
+
Cacheflow
|
68
|
+
Canon
|
69
|
+
Canonical
|
70
|
+
Cantillion
|
71
|
+
Capellix
|
72
|
+
Castelle
|
73
|
+
CastleNet
|
74
|
+
Caucho
|
75
|
+
Cayman
|
76
|
+
CentOS
|
77
|
+
Chase
|
78
|
+
Check Point
|
79
|
+
CherryPy
|
80
|
+
Cisco
|
81
|
+
Citrix
|
82
|
+
Clearswift
|
83
|
+
CNET
|
84
|
+
CNT
|
85
|
+
Cobalt
|
86
|
+
Commodore
|
87
|
+
Compaq
|
88
|
+
Compatible Systems
|
89
|
+
Computer Associates
|
90
|
+
Computone
|
91
|
+
Conectiva
|
92
|
+
Conexant
|
93
|
+
Convex
|
94
|
+
Copper Mountain
|
95
|
+
Corega
|
96
|
+
Cray
|
97
|
+
Critical Path
|
98
|
+
CSM
|
99
|
+
CyberArk
|
100
|
+
CyberGuard
|
101
|
+
Cyclades
|
102
|
+
Data General
|
103
|
+
Datamax
|
104
|
+
DataVoice
|
105
|
+
Debian
|
106
|
+
DEC
|
107
|
+
Dell
|
108
|
+
Digital Link
|
109
|
+
Digital Networks
|
110
|
+
DigiTel
|
111
|
+
D-Link
|
112
|
+
Docker Inc.
|
113
|
+
DrayTek
|
114
|
+
EasyTel
|
115
|
+
Eaton
|
116
|
+
Edimax
|
117
|
+
Eicon
|
118
|
+
Ektron
|
119
|
+
ELSA
|
120
|
+
Embedthis
|
121
|
+
EMC
|
122
|
+
EMWAC
|
123
|
+
Enterasys
|
124
|
+
Epson
|
125
|
+
EqualLogic
|
126
|
+
Ericsson
|
127
|
+
Eudora
|
128
|
+
EUSSO
|
129
|
+
Exabyte
|
130
|
+
exim
|
131
|
+
ExtendNet
|
132
|
+
Extreme Networks
|
133
|
+
F5
|
134
|
+
FastComm
|
135
|
+
FatWire
|
136
|
+
FiberLine
|
137
|
+
Floosietek
|
138
|
+
FlowPoint
|
139
|
+
Fore
|
140
|
+
FortiNet
|
141
|
+
Foundry
|
142
|
+
Foxit Software Inc.
|
143
|
+
FreeBSD
|
144
|
+
FreeScale
|
145
|
+
FreeSCO
|
146
|
+
Fujitsu Siemens
|
147
|
+
GalactiComm
|
148
|
+
Gandalf
|
149
|
+
Gauntlet
|
150
|
+
Genius
|
151
|
+
Gentoo
|
152
|
+
Gigamon
|
153
|
+
Global Technology Associates
|
154
|
+
GlobalScape
|
155
|
+
GNet
|
156
|
+
GNU
|
157
|
+
Google
|
158
|
+
Gordano
|
159
|
+
Hawking
|
160
|
+
Hitachi
|
161
|
+
Hospira
|
162
|
+
HP
|
163
|
+
Huawei
|
164
|
+
Hydra
|
165
|
+
IBM
|
166
|
+
Imagistics
|
167
|
+
Innovaphone
|
168
|
+
Intel
|
169
|
+
Intergraph
|
170
|
+
IPCop
|
171
|
+
Ipswitch
|
172
|
+
Isolation
|
173
|
+
IXIA
|
174
|
+
Juniper
|
175
|
+
KA9Q
|
176
|
+
Kaspersky Lab
|
177
|
+
Kentrox
|
178
|
+
Kerio
|
179
|
+
Konica
|
180
|
+
Kronos
|
181
|
+
Kyocera
|
182
|
+
Labtam
|
183
|
+
LANCOM Systems
|
184
|
+
Lantronix
|
185
|
+
Leunig
|
186
|
+
Lexmark
|
187
|
+
LG Goldstream
|
188
|
+
Linksys
|
189
|
+
Linux
|
190
|
+
Linux Foundation
|
191
|
+
Livingston
|
192
|
+
LogMeIn
|
193
|
+
Lotus
|
194
|
+
Lucent
|
195
|
+
LWIP
|
196
|
+
Lyris
|
197
|
+
Macromedia
|
198
|
+
Madge
|
199
|
+
Magna
|
200
|
+
Mail-Max
|
201
|
+
Mandrake
|
202
|
+
Mandriva
|
203
|
+
Maxim IC
|
204
|
+
McAfee
|
205
|
+
Megabit
|
206
|
+
Merak
|
207
|
+
Meridian
|
208
|
+
MetaInfo
|
209
|
+
Microbase
|
210
|
+
Microplex
|
211
|
+
Microsoft
|
212
|
+
MikroTik
|
213
|
+
Minix
|
214
|
+
Minolta
|
215
|
+
Mirapoint
|
216
|
+
Mocana
|
217
|
+
Moodle
|
218
|
+
Mort Bay
|
219
|
+
Motorola
|
220
|
+
Mozilla
|
221
|
+
MRV Communications
|
222
|
+
MultiTech
|
223
|
+
MySQL
|
224
|
+
NAT
|
225
|
+
NCD
|
226
|
+
NcFTP Software
|
227
|
+
NCR
|
228
|
+
NEC
|
229
|
+
Neoware
|
230
|
+
NetApp
|
231
|
+
NetBSD
|
232
|
+
Netgear
|
233
|
+
NetJet
|
234
|
+
NetMatrix
|
235
|
+
Netopia
|
236
|
+
Netscape
|
237
|
+
NetScreen
|
238
|
+
NetSilicon
|
239
|
+
Network Systems
|
240
|
+
Nexland
|
241
|
+
NeXT
|
242
|
+
Nokia
|
243
|
+
Nortel
|
244
|
+
Norton
|
245
|
+
Novell
|
246
|
+
NSG
|
247
|
+
NTT
|
248
|
+
Oce
|
249
|
+
Okidata
|
250
|
+
Omron
|
251
|
+
OpenBSD
|
252
|
+
OpenJDK
|
253
|
+
OpenSUSE
|
254
|
+
Opera Software
|
255
|
+
Oracle
|
256
|
+
Overland
|
257
|
+
Oversee
|
258
|
+
ownCloud
|
259
|
+
Packet Engines
|
260
|
+
Packeteer
|
261
|
+
Palm
|
262
|
+
Palo Alto Networks
|
263
|
+
Panasonic
|
264
|
+
Paul Smith Computer Services
|
265
|
+
Philips
|
266
|
+
PHP
|
267
|
+
phpMyAdmin
|
268
|
+
Pigtail
|
269
|
+
Piriform
|
270
|
+
Pitney Bowes
|
271
|
+
Plain Black
|
272
|
+
Planet
|
273
|
+
PLD
|
274
|
+
Polycom
|
275
|
+
Postgres
|
276
|
+
PowerWare
|
277
|
+
Pragma Systems
|
278
|
+
PreEmptive Solutions
|
279
|
+
Process Software
|
280
|
+
Proteon
|
281
|
+
Proxim
|
282
|
+
qmail
|
283
|
+
QMS
|
284
|
+
QNX
|
285
|
+
Qualcomm
|
286
|
+
Quanterra
|
287
|
+
Quantum
|
288
|
+
Racal
|
289
|
+
Radionics
|
290
|
+
Rapid7
|
291
|
+
Raptor
|
292
|
+
Rarlab
|
293
|
+
RCA
|
294
|
+
RealMedia
|
295
|
+
Red Hat
|
296
|
+
Redback
|
297
|
+
Rhino Software
|
298
|
+
Ricoh
|
299
|
+
Ringdale
|
300
|
+
Riverbed Technology
|
301
|
+
Riverstone Networks
|
302
|
+
RoadLanner
|
303
|
+
Rockliffe
|
304
|
+
Rockwell
|
305
|
+
Roxen
|
306
|
+
rPath
|
307
|
+
SafeNet
|
308
|
+
SAP
|
309
|
+
SAR
|
310
|
+
Savin
|
311
|
+
SBLIM
|
312
|
+
Schneider Electric
|
313
|
+
SCO
|
314
|
+
Seattle Labs
|
315
|
+
Secure Computing
|
316
|
+
Sega
|
317
|
+
Sendmail
|
318
|
+
Sequent
|
319
|
+
SGI
|
320
|
+
Sharp
|
321
|
+
Shiva
|
322
|
+
Siebel
|
323
|
+
Siemens
|
324
|
+
Simon Tatham
|
325
|
+
Slackware
|
326
|
+
SMC
|
327
|
+
SmoothWall
|
328
|
+
SonicWALL
|
329
|
+
SonoSite
|
330
|
+
Sony
|
331
|
+
Sophos
|
332
|
+
Source Technologies
|
333
|
+
Sourcefire
|
334
|
+
SpeedStream
|
335
|
+
Sphera
|
336
|
+
SSH Communications Security
|
337
|
+
StackTools
|
338
|
+
Standard Networks
|
339
|
+
StartCom
|
340
|
+
Stratus
|
341
|
+
Sun
|
342
|
+
SUSE
|
343
|
+
Sybase
|
344
|
+
Symantec
|
345
|
+
Symbol
|
346
|
+
SysTech
|
347
|
+
Tahoe
|
348
|
+
Tally
|
349
|
+
Tandberg
|
350
|
+
Tandem
|
351
|
+
Tasman Networks
|
352
|
+
Tekelec
|
353
|
+
Tektonix
|
354
|
+
Telebit
|
355
|
+
Telindus
|
356
|
+
Telocity
|
357
|
+
Teltrend
|
358
|
+
Thomson
|
359
|
+
TIS
|
360
|
+
TOR
|
361
|
+
Toshiba
|
362
|
+
Trancell
|
363
|
+
Trend Micro
|
364
|
+
Truetime
|
365
|
+
Trustix
|
366
|
+
Turbolinux
|
367
|
+
Turtle Beach
|
368
|
+
Twisted Matrix Labs
|
369
|
+
TYPO3
|
370
|
+
Ubuntu
|
371
|
+
Unica
|
372
|
+
UnitedLinux
|
373
|
+
US Robotics
|
374
|
+
VanDyke Software
|
375
|
+
Vanguard
|
376
|
+
VersaNet
|
377
|
+
VideoLAN
|
378
|
+
Vignette
|
379
|
+
Vine
|
380
|
+
Vircom
|
381
|
+
Virtual Access
|
382
|
+
VMware
|
383
|
+
WatchGuard
|
384
|
+
Webmin
|
385
|
+
WebTrends
|
386
|
+
White Box
|
387
|
+
Wind River
|
388
|
+
Wireshark
|
389
|
+
Wordpress
|
390
|
+
WTI
|
391
|
+
XCD
|
392
|
+
Xerox
|
393
|
+
Xitami
|
394
|
+
XMach
|
395
|
+
XnSoft
|
396
|
+
Xylan
|
397
|
+
Xylogics
|
398
|
+
Xyplex
|
399
|
+
Yahoo
|
400
|
+
Yamaha
|
401
|
+
Zero One
|
402
|
+
ZMailer
|
403
|
+
Zoom
|
404
|
+
ZoomAir
|
405
|
+
Zyxel
|
data/lib/recog/version.rb
CHANGED
@@ -113,7 +113,7 @@ describe Recog::DB do
|
|
113
113
|
actual_capture_positions = []
|
114
114
|
capture_number = 1
|
115
115
|
Regexp::Scanner.scan(fp.regex).each do |token_parts|
|
116
|
-
if token_parts.first == :group && ![:close, :passive, :options].include?(token_parts[1])
|
116
|
+
if token_parts.first == :group && ![:close, :passive, :options, :options_switch].include?(token_parts[1])
|
117
117
|
actual_capture_positions << capture_number
|
118
118
|
capture_number += 1
|
119
119
|
end
|
@@ -26,7 +26,7 @@ describe Recog::Fingerprint::RegexpFactory do
|
|
26
26
|
subject { described_class.build_options(flags) }
|
27
27
|
|
28
28
|
let(:flags) { [ ] }
|
29
|
-
it { is_expected.to be_a(
|
29
|
+
it { is_expected.to be_a(Integer) }
|
30
30
|
|
31
31
|
context 'without any explicit flags' do
|
32
32
|
let(:flags) { [ ] }
|
data/update_cpes.py
CHANGED
@@ -67,7 +67,7 @@ def update_cpes(xml_file, cpe_vp_map, r7_vp_map):
|
|
67
67
|
if not fp_type in params:
|
68
68
|
params[fp_type] = {}
|
69
69
|
if name in params[fp_type]:
|
70
|
-
raise ValueError('Duplicated fingerprint named {} in {}'.format(name, fingerprint.attrib['pattern']))
|
70
|
+
raise ValueError('Duplicated fingerprint named {} in fingerprint {} in file {}'.format(name, fingerprint.attrib['pattern'], xml_file))
|
71
71
|
params[fp_type][name] = param
|
72
72
|
|
73
73
|
|
data/xml/apache_os.xml
CHANGED
@@ -10,6 +10,7 @@
|
|
10
10
|
<param pos="0" name="os.vendor" value="IBM"/>
|
11
11
|
<param pos="0" name="os.family" value="OS/400"/>
|
12
12
|
<param pos="0" name="os.product" value="OS/400"/>
|
13
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:-"/>
|
13
14
|
</fingerprint>
|
14
15
|
<fingerprint pattern=".*\(Mandrake Linux/\d+\.\d+\.92mdk\).*">
|
15
16
|
<description>Mandriva (formerly Mandrake) Linux 9.2</description>
|
@@ -144,6 +145,14 @@
|
|
144
145
|
<param pos="0" name="os.product" value="Linux"/>
|
145
146
|
<param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:-"/>
|
146
147
|
</fingerprint>
|
148
|
+
<fingerprint pattern=".*\(Red Hat Enterprise (?:Linux)?\).*">
|
149
|
+
<description>Apache OS: Red Hat Enterprise Linux</description>
|
150
|
+
<example os.vendor="Red Hat">Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips</example>
|
151
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
152
|
+
<param pos="0" name="os.family" value="Linux"/>
|
153
|
+
<param pos="0" name="os.product" value="Enterprise Linux"/>
|
154
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:redhat:enterprise_linux:-"/>
|
155
|
+
</fingerprint>
|
147
156
|
<fingerprint pattern=".*Debian(?:[/ ]GNU)?(?:/Linux)?.*">
|
148
157
|
<description>Debian Linux</description>
|
149
158
|
<param pos="0" name="os.vendor" value="Debian"/>
|