recog 2.3.8 → 2.3.13
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +6 -0
- data/CONTRIBUTING.md +136 -37
- data/README.md +18 -16
- data/bin/recog_cleanup +16 -0
- data/bin/recog_standardize +30 -6
- data/cpe-remap.yaml +18 -2
- data/identifiers/README.md +9 -0
- data/identifiers/hw_device.txt +77 -0
- data/identifiers/hw_family.txt +96 -0
- data/identifiers/hw_product.txt +328 -0
- data/identifiers/os_architecture.txt +6 -6
- data/identifiers/os_device.txt +45 -3
- data/identifiers/os_family.txt +206 -41
- data/identifiers/os_product.txt +238 -17
- data/identifiers/service_family.txt +144 -57
- data/identifiers/service_product.txt +385 -83
- data/identifiers/vendor.txt +554 -68
- data/lib/recog/version.rb +1 -1
- data/requirements.txt +1 -1
- data/update_cpes.py +3 -0
- data/xml/apache_modules.xml +292 -5
- data/xml/apache_os.xml +41 -2
- data/xml/architecture.xml +11 -3
- data/xml/dns_versionbind.xml +191 -15
- data/xml/favicons.xml +1701 -0
- data/xml/ftp_banners.xml +250 -18
- data/xml/h323_callresp.xml +112 -12
- data/xml/hp_pjl_id.xml +47 -5
- data/xml/html_title.xml +1278 -25
- data/xml/http_cookies.xml +64 -9
- data/xml/http_servers.xml +1013 -96
- data/xml/http_wwwauth.xml +141 -26
- data/xml/imap_banners.xml +62 -13
- data/xml/ldap_searchresult.xml +81 -9
- data/xml/mdns_device-info_txt.xml +175 -2
- data/xml/mdns_workstation_txt.xml +4 -2
- data/xml/mysql_banners.xml +134 -7
- data/xml/mysql_error.xml +113 -6
- data/xml/nntp_banners.xml +10 -2
- data/xml/ntp_banners.xml +80 -4
- data/xml/operating_system.xml +89 -3
- data/xml/pop_banners.xml +87 -33
- data/xml/rsh_resp.xml +11 -2
- data/xml/rtsp_servers.xml +22 -2
- data/xml/sip_banners.xml +35 -4
- data/xml/sip_user_agents.xml +29 -2
- data/xml/smb_native_lm.xml +10 -2
- data/xml/smb_native_os.xml +79 -2
- data/xml/smtp_banners.xml +230 -9
- data/xml/smtp_debug.xml +6 -4
- data/xml/smtp_ehlo.xml +7 -5
- data/xml/smtp_expn.xml +13 -4
- data/xml/smtp_help.xml +23 -4
- data/xml/smtp_mailfrom.xml +5 -2
- data/xml/smtp_noop.xml +6 -5
- data/xml/smtp_quit.xml +5 -4
- data/xml/smtp_rcptto.xml +5 -2
- data/xml/smtp_rset.xml +4 -4
- data/xml/smtp_turn.xml +4 -4
- data/xml/smtp_vrfy.xml +14 -4
- data/xml/snmp_sysdescr.xml +733 -25
- data/xml/snmp_sysobjid.xml +47 -2
- data/xml/ssh_banners.xml +182 -8
- data/xml/telnet_banners.xml +493 -22
- data/xml/x11_banners.xml +26 -3
- data/xml/x509_issuers.xml +30 -6
- data/xml/x509_subjects.xml +200 -31
- metadata +8 -2
data/xml/ftp_banners.xml
CHANGED
@@ -1,9 +1,10 @@
|
|
1
|
-
<?xml version=
|
1
|
+
<?xml version='1.0' encoding='UTF-8'?>
|
2
2
|
<fingerprints matches="ftp.banner" protocol="ftp" database_type="service" preference="0.90">
|
3
3
|
<!--
|
4
4
|
FTP greeting messages (part of the banner after the response code) are matched
|
5
5
|
against these patterns to fingerprint FTP servers.
|
6
6
|
-->
|
7
|
+
|
7
8
|
<fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version ([1234]\.\d+)\)\.$">
|
8
9
|
<description>Microsoft FTP Server on Windows NT</description>
|
9
10
|
<example>xx Microsoft FTP Service (Version 3.0).</example>
|
@@ -18,6 +19,7 @@
|
|
18
19
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_nt:-"/>
|
19
20
|
<param pos="1" name="host.name"/>
|
20
21
|
</fingerprint>
|
22
|
+
|
21
23
|
<fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.0\)\.$">
|
22
24
|
<description>Microsoft FTP Server on Windows 2000</description>
|
23
25
|
<example>xxx Microsoft FTP Service (Version 5.0).</example>
|
@@ -32,6 +34,7 @@
|
|
32
34
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:-"/>
|
33
35
|
<param pos="1" name="host.name"/>
|
34
36
|
</fingerprint>
|
37
|
+
|
35
38
|
<fingerprint pattern="^([^ ]+) Microsoft FTP Service \(Version 5.1\)\.$">
|
36
39
|
<description>Microsoft FTP Server on Windows XP, 2003 or later versions of 2000</description>
|
37
40
|
<example>xxx Microsoft FTP Service (Version 5.1).</example>
|
@@ -45,6 +48,7 @@
|
|
45
48
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
46
49
|
<param pos="1" name="host.name"/>
|
47
50
|
</fingerprint>
|
51
|
+
|
48
52
|
<fingerprint pattern="^([^ ]+) Microsoft FTP Service$">
|
49
53
|
<description>Microsoft FTP Server on Windows XP, 2003 or later without version</description>
|
50
54
|
<example>hostname Microsoft FTP Service</example>
|
@@ -58,6 +62,7 @@
|
|
58
62
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
59
63
|
<param pos="1" name="host.name"/>
|
60
64
|
</fingerprint>
|
65
|
+
|
61
66
|
<fingerprint pattern="^Microsoft FTP Service$">
|
62
67
|
<description>Microsoft FTP Server on Windows XP, 2003 or later without version or hostname</description>
|
63
68
|
<example>Microsoft FTP Service</example>
|
@@ -70,6 +75,7 @@
|
|
70
75
|
<param pos="0" name="os.product" value="Windows"/>
|
71
76
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
72
77
|
</fingerprint>
|
78
|
+
|
73
79
|
<fingerprint pattern="^([^ ]+) +FTP +Server \(Version ([^\(]+)\(PHNE_\d+\) [^\)]+\) ready.?$" flags="REG_ICASE">
|
74
80
|
<description>FTP on HPUX with a PHNE (HP Networking patch) installed</description>
|
75
81
|
<example>example.com FTP server (Version 1.1.214.4(PHNE_38458) Mon Feb 15 06:03:12 GMT 2010) ready.</example>
|
@@ -82,6 +88,7 @@
|
|
82
88
|
<param pos="1" name="host.name"/>
|
83
89
|
<param pos="2" name="service.version"/>
|
84
90
|
</fingerprint>
|
91
|
+
|
85
92
|
<fingerprint pattern="^([^ ]+) +FTP +Server \(Revision \S+ Version wuftpd-([^\(]+)\(PHNE_\d+\) [^\)]+\) ready.?$" flags="REG_ICASE">
|
86
93
|
<description>WU-FTPD on HPUX with a PHNE (HP Networking patch) installed</description>
|
87
94
|
<example>example.com FTP server (Revision 1.1 Version wuftpd-2.6.1(PHNE_38578) Fri Sep 5 12:10:54 GMT 2008) ready.</example>
|
@@ -94,6 +101,7 @@
|
|
94
101
|
<param pos="1" name="host.name"/>
|
95
102
|
<param pos="2" name="service.version"/>
|
96
103
|
</fingerprint>
|
104
|
+
|
97
105
|
<fingerprint pattern="^(\S+)(?: \S+)? FTP Server \((?:Revision [\d\.]+ )?Version wu(?:ftpd)?-([\d\.]+).*\) ready.?$" flags="REG_ICASE">
|
98
106
|
<description>WU-FTPD on various OS</description>
|
99
107
|
<example host.name="example.com" service.version="2.6.2">example.com FTP server (Version wu-2.6.2(1) Sat Jul 19 16:21:30 UTC 2008) ready.</example>
|
@@ -105,6 +113,7 @@
|
|
105
113
|
<param pos="1" name="host.name"/>
|
106
114
|
<param pos="2" name="service.version"/>
|
107
115
|
</fingerprint>
|
116
|
+
|
108
117
|
<fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\s+([\d\.]+).*\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
|
109
118
|
<description>FTPD on Mac OS X Server with a version</description>
|
110
119
|
<example host.name="example.com" os.version="10.3">example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</example>
|
@@ -119,6 +128,7 @@ example.com FTP server (Version: Mac OS X Server 10.3 - +GSSAPI) ready.</exampl
|
|
119
128
|
<param pos="2" name="os.version"/>
|
120
129
|
<param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x_server:{os.version}"/>
|
121
130
|
</fingerprint>
|
131
|
+
|
122
132
|
<fingerprint pattern="^(\S+)\s+FTP Server \(Version:\s+Mac OS X Server\) ready\.?" flags="REG_ICASE,REG_MULTILINE">
|
123
133
|
<description>FTPD on Mac OS X Server without a version</description>
|
124
134
|
<example host.name="example.com">example.com FTP server (Version: Mac OS X Server) ready.</example>
|
@@ -132,6 +142,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
132
142
|
<param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x_server:-"/>
|
133
143
|
<param pos="1" name="host.name"/>
|
134
144
|
</fingerprint>
|
145
|
+
|
135
146
|
<fingerprint pattern="^(\S+)\s+FTP Server \(tnftpd (.*)\) ready\.?$" flags="REG_ICASE">
|
136
147
|
<description>Simple tnftpd banner with a version</description>
|
137
148
|
<example host.name="example.com" service.version="20061217">example.com FTP server (tnftpd 20061217) ready.</example>
|
@@ -139,6 +150,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
139
150
|
<param pos="2" name="service.version"/>
|
140
151
|
<param pos="1" name="host.name"/>
|
141
152
|
</fingerprint>
|
153
|
+
|
142
154
|
<fingerprint pattern="^(\S+) FTP Server \(SunOS 5.(1[1-9])\) ready\.?$" flags="REG_ICASE">
|
143
155
|
<description>SunOS/Solaris</description>
|
144
156
|
<example host.name="example.com" os.version="11">example.com FTP server (SunOS 5.11) ready.</example>
|
@@ -149,6 +161,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
149
161
|
<param pos="2" name="os.version"/>
|
150
162
|
<param pos="0" name="os.cpe23" value="cpe:/o:oracle:solaris:{os.version}"/>
|
151
163
|
</fingerprint>
|
164
|
+
|
152
165
|
<fingerprint pattern="^(\S+) FTP Server \(SunOS 5.([789]|10)\) ready\.?$" flags="REG_ICASE">
|
153
166
|
<description>SunOS/Solaris 5.7-5.10</description>
|
154
167
|
<example host.name="example.com" os.version="7">example.com FTP server (SunOS 5.7) ready.</example>
|
@@ -160,6 +173,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
160
173
|
<param pos="2" name="os.version"/>
|
161
174
|
<param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
|
162
175
|
</fingerprint>
|
176
|
+
|
163
177
|
<fingerprint pattern="^(\S+) FTP Server \(SunOS 5.6\) ready\." flags="REG_ICASE">
|
164
178
|
<description>SunOS 5.6 (Solaris 2.6)</description>
|
165
179
|
<example host.name="example.com">example.com FTP Server (SunOS 5.6) ready.</example>
|
@@ -170,6 +184,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
170
184
|
<param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:2.6"/>
|
171
185
|
<param pos="1" name="host.name"/>
|
172
186
|
</fingerprint>
|
187
|
+
|
173
188
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Debian\) \[(.+)\]$">
|
174
189
|
<description>ProFTPD on Debian Linux</description>
|
175
190
|
<example>ProFTPD 1.3.0rc2 Server (Debian) [host]</example>
|
@@ -184,6 +199,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
184
199
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
|
185
200
|
<param pos="2" name="host.name"/>
|
186
201
|
</fingerprint>
|
202
|
+
|
187
203
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(W.+)\) \[(.+)\]$">
|
188
204
|
<description>ProFTPD on a Linksys Wireless Access Point/Router</description>
|
189
205
|
<example>ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
|
@@ -197,6 +213,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
197
213
|
<param pos="2" name="os.product"/>
|
198
214
|
<param pos="3" name="host.name"/>
|
199
215
|
</fingerprint>
|
216
|
+
|
200
217
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(NETGEAR ReadyNAS\) \[(.+)\]$">
|
201
218
|
<description>ProFTPD on a Netgear ReadyNAS with a version and IP</description>
|
202
219
|
<example service.version="1.3.3g" host.ip="192.168.1.10">ProFTPD 1.3.3g Server (NETGEAR ReadyNAS) [192.168.1.10]</example>
|
@@ -210,6 +227,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
210
227
|
<param pos="0" name="hw.product" value="ReadyNAS"/>
|
211
228
|
<param pos="2" name="host.ip"/>
|
212
229
|
</fingerprint>
|
230
|
+
|
213
231
|
<fingerprint pattern="^ProFTPD Server \(NETGEAR ReadyNAS\) \[(.+)\]$">
|
214
232
|
<description>ProFTPD on a Netgear ReadyNAS with a hostname</description>
|
215
233
|
<example host.name="test">ProFTPD Server (NETGEAR ReadyNAS) [test]</example>
|
@@ -222,6 +240,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
222
240
|
<param pos="0" name="hw.product" value="ReadyNAS"/>
|
223
241
|
<param pos="1" name="host.name"/>
|
224
242
|
</fingerprint>
|
243
|
+
|
225
244
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(.*)\) \[(.+)\]$">
|
226
245
|
<description>ProFTPD on a wired Linksys device</description>
|
227
246
|
<param pos="0" name="service.family" value="ProFTPD"/>
|
@@ -234,6 +253,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
234
253
|
<param pos="2" name="os.product"/>
|
235
254
|
<param pos="3" name="host.name"/>
|
236
255
|
</fingerprint>
|
256
|
+
|
237
257
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[(.+)\]$">
|
238
258
|
<description>ProFTPD with version info but no obvious OS info</description>
|
239
259
|
<example service.version="1.2.10">ProFTPD 1.2.10 Server (Main FTP Server) [host]</example>
|
@@ -247,6 +267,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
247
267
|
<param pos="2" name="proftpd.server.name"/>
|
248
268
|
<param pos="3" name="host.name"/>
|
249
269
|
</fingerprint>
|
270
|
+
|
250
271
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server ready\.$">
|
251
272
|
<description>ProFTPD with only version info</description>
|
252
273
|
<example service.version="1.3.0rc2">ProFTPD 1.3.0rc2 Server ready.</example>
|
@@ -256,6 +277,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
256
277
|
<param pos="1" name="service.version"/>
|
257
278
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
|
258
279
|
</fingerprint>
|
280
|
+
|
259
281
|
<fingerprint pattern="^ProFTPD (?:FTP )?Server ready\.$">
|
260
282
|
<description>ProFTPD with no version info</description>
|
261
283
|
<example>ProFTPD FTP Server ready.</example>
|
@@ -265,6 +287,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
265
287
|
<param pos="0" name="service.product" value="ProFTPD"/>
|
266
288
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:-"/>
|
267
289
|
</fingerprint>
|
290
|
+
|
268
291
|
<fingerprint pattern="^ProFTPD Server \(.*\) \[([a-f\d.:]+)\]$">
|
269
292
|
<description>ProFTPD with no version info, parenthetical form</description>
|
270
293
|
<example host.ip="1.2.3.4">ProFTPD Server (ProFTPD) [1.2.3.4]</example>
|
@@ -277,6 +300,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
277
300
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:-"/>
|
278
301
|
<param pos="1" name="host.ip"/>
|
279
302
|
</fingerprint>
|
303
|
+
|
280
304
|
<fingerprint pattern="^ProFTPD Server$">
|
281
305
|
<description>ProFTPD with no version info, short form</description>
|
282
306
|
<example>ProFTPD Server</example>
|
@@ -285,6 +309,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
285
309
|
<param pos="0" name="service.product" value="ProFTPD"/>
|
286
310
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:-"/>
|
287
311
|
</fingerprint>
|
312
|
+
|
288
313
|
<fingerprint pattern="^ProFTPD\s*$">
|
289
314
|
<description>ProFTPD with no version info, super short form</description>
|
290
315
|
<example>ProFTPD</example>
|
@@ -294,6 +319,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
294
319
|
<param pos="0" name="service.product" value="ProFTPD"/>
|
295
320
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:-"/>
|
296
321
|
</fingerprint>
|
322
|
+
|
297
323
|
<fingerprint pattern="^(?:\d{4}\-\d\d\-\d\d \d\d:\d\d:\d\d,\d\d\d )?(\S+) proftpd\[\d+\]: error: no valid servers configured">
|
298
324
|
<description>ProFTPD no valid servers configured</description>
|
299
325
|
<example host.name="ftp.host.com">ftp.host.com proftpd[40312]: error: no valid servers configured\n</example>
|
@@ -304,6 +330,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
304
330
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:-"/>
|
305
331
|
<param pos="1" name="host.name"/>
|
306
332
|
</fingerprint>
|
333
|
+
|
307
334
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[[a-f\d.:\]]*$">
|
308
335
|
<description>ProFTPD with version info - truncated</description>
|
309
336
|
<example service.version="1.3.2c">ProFTPD 1.3.2c Server (ProFTPD Default Installation) [</example>
|
@@ -316,6 +343,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
316
343
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
|
317
344
|
<param pos="2" name="proftpd.server.name"/>
|
318
345
|
</fingerprint>
|
346
|
+
|
319
347
|
<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server ([\w.-]+)$">
|
320
348
|
<description>ProFTPD with version info but no obvious OS info, take 2</description>
|
321
349
|
<example service.version="1.3.2d" host.name="localhost">ProFTPD 1.3.2d Server localhost</example>
|
@@ -326,15 +354,18 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
|
|
326
354
|
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
|
327
355
|
<param pos="2" name="host.name"/>
|
328
356
|
</fingerprint>
|
357
|
+
|
329
358
|
<fingerprint pattern="^=\(<\*>\)=-\.:\. \(\( Welcome to Pure-FTPd ([\d.]+) \)\) \.:\.-=\(<\*>\)=-" flags="REG_MULTILINE">
|
330
359
|
<description>Pure-FTPd versions <= 1.0.13 (at least as far back as 1.0.11)</description>
|
331
360
|
<example service.version="1.0.11">=(<*>)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(<*>)=-</example>
|
332
361
|
<example service.version="1.0.11">=(<*>)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(<*>)=-
|
333
362
|
more stuff</example>
|
363
|
+
<param pos="0" name="service.fvendor" value="PureFTPd"/>
|
334
364
|
<param pos="0" name="service.family" value="Pure-FTPd"/>
|
335
365
|
<param pos="0" name="service.product" value="Pure-FTPd"/>
|
336
366
|
<param pos="1" name="service.version"/>
|
337
367
|
</fingerprint>
|
368
|
+
|
338
369
|
<fingerprint pattern="^-{9,10}(?:.*)\s+Pure-FTPd\s+(.*)-{9,10}">
|
339
370
|
<description>Pure-FTPd versions >= 1.0.14 - Config data can be zero or more of: [privsep] [TLS]</description>
|
340
371
|
<example>---------- Welcome to Pure-FTPd ----------</example>
|
@@ -344,39 +375,77 @@ more stuff</example>
|
|
344
375
|
<example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------
|
345
376
|
more text</example>
|
346
377
|
<param pos="1" name="pureftpd.config"/>
|
378
|
+
<param pos="0" name="service.vendor" value="PureFTPd"/>
|
347
379
|
<param pos="0" name="service.family" value="Pure-FTPd"/>
|
348
380
|
<param pos="0" name="service.product" value="Pure-FTPd"/>
|
381
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:pureftpd:pure-ftpd:-"/>
|
349
382
|
</fingerprint>
|
383
|
+
|
350
384
|
<fingerprint pattern="^(?:Welcome to )?Pure-FTPd\.?$">
|
351
385
|
<description>Basic Pure-FTPd banner, no version</description>
|
352
386
|
<example>Welcome to Pure-FTPd</example>
|
353
387
|
<example>Pure-FTPd.</example>
|
388
|
+
<param pos="0" name="service.vendor" value="PureFTPd"/>
|
354
389
|
<param pos="0" name="service.family" value="Pure-FTPd"/>
|
355
390
|
<param pos="0" name="service.product" value="Pure-FTPd"/>
|
391
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:pureftpd:pure-ftpd:-"/>
|
356
392
|
</fingerprint>
|
393
|
+
|
357
394
|
<fingerprint pattern="^=\(.\*.\)=-\.:\. \(\( Welcome to PureFTPd (\d+\..+) \)\) \.:\.-=\(.\*.\)=-" flags="REG_MULTILINE">
|
358
395
|
<description>Older Pure-FTPd versions</description>
|
359
396
|
<example service.version="1.1.0">=(<*>)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(<*>)=-</example>
|
360
397
|
<example service.version="1.1.0">=(<*>)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(<*>)=-
|
361
398
|
more text</example>
|
399
|
+
<param pos="0" name="service.vendor" value="PureFTPd"/>
|
362
400
|
<param pos="0" name="service.family" value="Pure-FTPd"/>
|
363
401
|
<param pos="0" name="service.product" value="Pure-FTPd"/>
|
364
402
|
<param pos="1" name="service.version"/>
|
403
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:pureftpd:pure-ftpd:{service.version}"/>
|
404
|
+
</fingerprint>
|
405
|
+
|
406
|
+
<!-- CPEs for Serv-U 15.x and above changed to SolarWinds -->
|
407
|
+
|
408
|
+
<fingerprint pattern="^Serv-U FTP Server v(15\.\S+) ready\.\.\.$">
|
409
|
+
<description>SolarWinds Serv-U with version </description>
|
410
|
+
<example service.version="15.1.3.25">Serv-U FTP Server v15.1.3.25 ready...</example>
|
411
|
+
<param pos="0" name="service.vendor" value="SolarWinds"/>
|
412
|
+
<param pos="0" name="service.product" value="Serv-U FTP Server"/>
|
413
|
+
<param pos="0" name="service.family" value="Serv-U"/>
|
414
|
+
<param pos="1" name="service.version"/>
|
415
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:solarwinds:serv-u_ftp_server:{service.version}"/>
|
365
416
|
</fingerprint>
|
366
|
-
|
367
|
-
|
417
|
+
|
418
|
+
<fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) for WinSock ready\.*$">
|
419
|
+
<description>Serv-U Serv-U with version on Windows</description>
|
368
420
|
<example service.version="2.5n">Serv-U FTP-Server v2.5n for WinSock ready...</example>
|
369
421
|
<example service.version="6.0">Serv-U FTP Server v6.0 for WinSock ready</example>
|
370
|
-
<
|
371
|
-
<param pos="0" name="service.vendor" value="Rhino Software"/>
|
422
|
+
<param pos="0" name="service.vendor" value="Serv-U"/>
|
372
423
|
<param pos="0" name="service.product" value="Serv-U"/>
|
373
424
|
<param pos="0" name="service.family" value="Serv-U"/>
|
374
425
|
<param pos="1" name="service.version"/>
|
426
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:serv-u:serv-u:{service.version}"/>
|
375
427
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
376
428
|
<param pos="0" name="os.family" value="Windows"/>
|
377
429
|
<param pos="0" name="os.product" value="Windows"/>
|
378
430
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
379
431
|
</fingerprint>
|
432
|
+
|
433
|
+
<fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) ready\.*$">
|
434
|
+
<description>Serv-U Serv-U with version </description>
|
435
|
+
<example service.version="7.2">Serv-U FTP Server v7.2 ready...</example>
|
436
|
+
<example service.version="14.0">Serv-U FTP Server v14.0 ready...</example>
|
437
|
+
<param pos="0" name="service.vendor" value="Serv-U"/>
|
438
|
+
<param pos="0" name="service.product" value="Serv-U"/>
|
439
|
+
<param pos="0" name="service.family" value="Serv-U"/>
|
440
|
+
<param pos="1" name="service.version"/>
|
441
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:serv-u:serv-u:{service.version}"/>
|
442
|
+
</fingerprint>
|
443
|
+
|
444
|
+
<fingerprint pattern="^Welcom to Serv-U FTP Server$">
|
445
|
+
<description>Common FTP banner modification to look like Serv-U -- assert nothing.</description>
|
446
|
+
<example>Welcom to Serv-U FTP Server</example>
|
447
|
+
</fingerprint>
|
448
|
+
|
380
449
|
<fingerprint pattern="^zFTPServer v?(\S+), .*ready\.$" flags="REG_ICASE">
|
381
450
|
<description>zftpserver (only runs on Windows)</description>
|
382
451
|
<example service.version="4.0">zFTPServer v4.0, build 2008-12-24 01:41 ready.</example>
|
@@ -388,46 +457,65 @@ more text</example>
|
|
388
457
|
<param pos="0" name="os.product" value="Windows"/>
|
389
458
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
390
459
|
</fingerprint>
|
460
|
+
|
391
461
|
<fingerprint pattern="^\(vsFTPd (\d+\..+)\)(?: (.+))?$">
|
392
462
|
<description>vsFTPd (Very Secure FTP Daemon)</description>
|
393
463
|
<example service.version="1.1.3">(vsFTPd 1.1.3) host</example>
|
394
464
|
<example service.version="2.0.5">(vsFTPd 2.0.5)</example>
|
465
|
+
<param pos="0" name="service.vendor" value="vsFTPd Project"/>
|
395
466
|
<param pos="0" name="service.family" value="vsFTPd"/>
|
396
467
|
<param pos="0" name="service.product" value="vsFTPd"/>
|
397
468
|
<param pos="1" name="service.version"/>
|
469
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:vsftpd_project:vsftpd:{service.version}"/>
|
398
470
|
<param pos="2" name="host.name"/>
|
399
471
|
</fingerprint>
|
472
|
+
|
400
473
|
<fingerprint pattern="^ready, dude \(vsFTPd (\d+\..+): beat me, break me\)$">
|
401
474
|
<description>vsFTPd (Very Secure FTP Daemon) - break me variant</description>
|
402
475
|
<example service.version="1.1.0">ready, dude (vsFTPd 1.1.0: beat me, break me)</example>
|
476
|
+
<param pos="0" name="service.vendor" value="vsFTPd Project"/>
|
403
477
|
<param pos="0" name="service.family" value="vsFTPd"/>
|
404
478
|
<param pos="0" name="service.product" value="vsFTPd"/>
|
405
479
|
<param pos="1" name="service.version"/>
|
480
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:vsftpd_project:vsftpd:{service.version}"/>
|
406
481
|
</fingerprint>
|
482
|
+
|
407
483
|
<fingerprint pattern="^vsFTPd ([\d.]+\+ \(ext\.3\)) ready\.\.\.$">
|
408
484
|
<description>vsFTPd (Very Secure FTP Daemon) extended build (vsftpd.devnet.ru)</description>
|
409
485
|
<example service.version="2.0.4+ (ext.3)">vsFTPd 2.0.4+ (ext.3) ready...</example>
|
486
|
+
<param pos="0" name="service.vendor" value="vsFTPd Project"/>
|
410
487
|
<param pos="0" name="service.family" value="vsFTPd"/>
|
411
488
|
<param pos="0" name="service.product" value="vsFTPd Extended"/>
|
412
489
|
<param pos="1" name="service.version"/>
|
413
490
|
</fingerprint>
|
491
|
+
|
414
492
|
<fingerprint pattern="^OOPS: .*vsftp.*$">
|
415
493
|
<description>vsFTPd (Very Secure FTP Daemon) error message</description>
|
416
494
|
<example>OOPS: vsftpd: root is not mounted.</example>
|
417
495
|
<example>OOPS: cannot read user list file:/etc/vsftpd.user_list</example>
|
496
|
+
<param pos="0" name="service.vendor" value="vsFTPd Project"/>
|
418
497
|
<param pos="0" name="service.family" value="vsFTPd"/>
|
419
498
|
<param pos="0" name="service.product" value="vsFTPd"/>
|
499
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:vsftpd_project:vsftpd:-"/>
|
420
500
|
</fingerprint>
|
501
|
+
|
421
502
|
<fingerprint pattern="^FileZilla Server(?: version)? (?:v)?(\d\.[\w.]+(?: beta)?).*$">
|
422
503
|
<description>FileZilla FTP Server</description>
|
423
504
|
<example service.version="0.9.2 beta">FileZilla Server version 0.9.2 beta</example>
|
424
505
|
<example service.version="0.9.13a beta">FileZilla Server version 0.9.13a beta</example>
|
425
506
|
<example service.version="0.9.54 beta">FileZilla Server 0.9.54 beta</example>
|
426
507
|
<example service.version="0.9.33 beta">FileZilla Server v0.9.33 beta</example>
|
427
|
-
<param pos="0" name="service.
|
428
|
-
<param pos="0" name="service.
|
508
|
+
<param pos="0" name="service.vendor" value="Filezilla-Project"/>
|
509
|
+
<param pos="0" name="service.family" value="FileZilla FTP"/>
|
510
|
+
<param pos="0" name="service.product" value="FileZilla Server"/>
|
429
511
|
<param pos="1" name="service.version"/>
|
512
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:filezilla-project:filezilla_server:{service.version}"/>
|
513
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
514
|
+
<param pos="0" name="os.family" value="Windows"/>
|
515
|
+
<param pos="0" name="os.product" value="Windows"/>
|
516
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
430
517
|
</fingerprint>
|
518
|
+
|
431
519
|
<fingerprint pattern="^\s*APC FTP server ready\.$">
|
432
520
|
<description>APC device</description>
|
433
521
|
<example>APC FTP server ready.</example>
|
@@ -438,6 +526,7 @@ more text</example>
|
|
438
526
|
<param pos="0" name="hw.vendor" value="APC"/>
|
439
527
|
<param pos="0" name="hw.device" value="Power device"/>
|
440
528
|
</fingerprint>
|
529
|
+
|
441
530
|
<fingerprint pattern="^(\S+) Network Management Card AOS v(\d+\..+) FTP server ready\.$">
|
442
531
|
<description>APC power/cooling device</description>
|
443
532
|
<example service.version="3.3.4">AP7932 Network Management Card AOS v3.3.4 FTP server ready.</example>
|
@@ -454,6 +543,7 @@ more text</example>
|
|
454
543
|
<param pos="0" name="hw.vendor" value="APC"/>
|
455
544
|
<param pos="0" name="hw.device" value="Power device"/>
|
456
545
|
</fingerprint>
|
546
|
+
|
457
547
|
<fingerprint pattern="^(\S+) FTP server \(EMC-SNAS: ([^\)]+)\)(?: \S+)?$">
|
458
548
|
<description>EMC Celerra</description>
|
459
549
|
<example service.version="5.6.47.11">foo2 FTP server (EMC-SNAS: 5.6.47.11)</example>
|
@@ -471,6 +561,7 @@ more text</example>
|
|
471
561
|
<param pos="0" name="hw.device" value="Storage"/>
|
472
562
|
<param pos="0" name="hw.product" value="Celerra"/>
|
473
563
|
</fingerprint>
|
564
|
+
|
474
565
|
<fingerprint pattern="^JD FTP Server Ready.*$">
|
475
566
|
<description>HP JetDirect printer</description>
|
476
567
|
<example>JD FTP Server Ready</example>
|
@@ -487,6 +578,7 @@ more text</example>
|
|
487
578
|
<param pos="0" name="hw.family" value="JetDirect"/>
|
488
579
|
<param pos="0" name="hw.product" value="JetDirect"/>
|
489
580
|
</fingerprint>
|
581
|
+
|
490
582
|
<fingerprint pattern="^Check Point FireWall-1 Secure FTP server running on (.+)$">
|
491
583
|
<description>Check Point FireWall-1</description>
|
492
584
|
<example host.name="host">Check Point FireWall-1 Secure FTP server running on host</example>
|
@@ -504,6 +596,7 @@ more text</example>
|
|
504
596
|
<param pos="0" name="hw.family" value="Firewall-1"/>
|
505
597
|
<param pos="1" name="host.name"/>
|
506
598
|
</fingerprint>
|
599
|
+
|
507
600
|
<fingerprint pattern="^Blue Coat FTP Service$">
|
508
601
|
<description>Blue Coat security appliances</description>
|
509
602
|
<example>Blue Coat FTP Service</example>
|
@@ -512,11 +605,13 @@ more text</example>
|
|
512
605
|
<param pos="0" name="os.vendor" value="Blue Coat"/>
|
513
606
|
<param pos="0" name="os.device" value="Web proxy"/>
|
514
607
|
</fingerprint>
|
608
|
+
|
515
609
|
<fingerprint pattern="^---freeFTPd 1.0---warFTPd 1.65---$">
|
516
610
|
<description>Nepenthes honeypot</description>
|
517
611
|
<param pos="0" name="service.family" value="Nepenthes"/>
|
518
612
|
<param pos="0" name="service.product" value="Nepenthes"/>
|
519
613
|
</fingerprint>
|
614
|
+
|
520
615
|
<fingerprint pattern="^[^ ]+ IBM FTP CS (V1R\d+) at ([^,]*),.*">
|
521
616
|
<description>IBM z/OS FTP Service</description>
|
522
617
|
<example>SFTPD1 IBM FTP CS V1R4 at x.y.z, 21:02:19 on 2007-12-15.</example>
|
@@ -527,8 +622,10 @@ more text</example>
|
|
527
622
|
<param pos="0" name="os.family" value="z/OS"/>
|
528
623
|
<param pos="0" name="os.device" value="Mainframe"/>
|
529
624
|
<param pos="1" name="os.version"/>
|
625
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:ibm:z\/os:{os.version}"/>
|
530
626
|
<param pos="2" name="host.name"/>
|
531
627
|
</fingerprint>
|
628
|
+
|
532
629
|
<fingerprint pattern="^FTP server \(IBM 4690 TCP/IP FTP Version 1\.0\) ready\.">
|
533
630
|
<description>IBM 4690 FTP Service</description>
|
534
631
|
<example>FTP server (IBM 4690 TCP/IP FTP Version 1.0) ready.</example>
|
@@ -539,6 +636,7 @@ more text</example>
|
|
539
636
|
<param pos="0" name="os.family" value="4690"/>
|
540
637
|
<param pos="0" name="os.device" value="Point of sale"/>
|
541
638
|
</fingerprint>
|
639
|
+
|
542
640
|
<fingerprint pattern="^([^ ]+) NcFTPd Server \(licensed copy\) ready\.$">
|
543
641
|
<description>NcFTPd Server
|
544
642
|
http://www.ncftp.com/ncftpd/</description>
|
@@ -547,6 +645,7 @@ more text</example>
|
|
547
645
|
<param pos="0" name="service.product" value="NcFTPd Server"/>
|
548
646
|
<param pos="1" name="host.name"/>
|
549
647
|
</fingerprint>
|
648
|
+
|
550
649
|
<fingerprint pattern="^(\S+) DCS-2100 FTP server ready\.$">
|
551
650
|
<description>D-Link DCS-2100 wireless internet camera</description>
|
552
651
|
<example>hostname DCS-2100 FTP server ready.</example>
|
@@ -555,6 +654,7 @@ more text</example>
|
|
555
654
|
<param pos="0" name="os.device" value="Web cam"/>
|
556
655
|
<param pos="1" name="host.name"/>
|
557
656
|
</fingerprint>
|
657
|
+
|
558
658
|
<fingerprint pattern="^Secure Gateway FTP server ready\.$">
|
559
659
|
<description>Raptor firewall</description>
|
560
660
|
<example>Secure Gateway FTP server ready.</example>
|
@@ -563,6 +663,7 @@ more text</example>
|
|
563
663
|
<param pos="0" name="os.product" value="Raptor"/>
|
564
664
|
<param pos="0" name="os.device" value="Firewall"/>
|
565
665
|
</fingerprint>
|
666
|
+
|
566
667
|
<fingerprint pattern="^SUN StorEdge (\S+) RAID FTP server ready\.$">
|
567
668
|
<description>Sun StorEdge disk array</description>
|
568
669
|
<example>SUN StorEdge 3511 RAID FTP server ready.</example>
|
@@ -571,6 +672,7 @@ more text</example>
|
|
571
672
|
<param pos="1" name="os.product"/>
|
572
673
|
<param pos="0" name="os.device" value="Storage"/>
|
573
674
|
</fingerprint>
|
675
|
+
|
574
676
|
<fingerprint pattern="(?i)^AXIS (\S+) .* Camera(?:\s+version)?\s+(\S+) .*">
|
575
677
|
<description>Axis Network Camera</description>
|
576
678
|
<example hw.product="2100" hw.version="2.43">Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
|
@@ -587,27 +689,43 @@ more text</example>
|
|
587
689
|
<param pos="0" name="os.family" value="Linux"/>
|
588
690
|
<param pos="0" name="os.device" value="Web cam"/>
|
589
691
|
</fingerprint>
|
590
|
-
|
591
|
-
|
692
|
+
|
693
|
+
<fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?Video) (?:Encoder|Encoder Blade|Module|Server|Decoder) (\S+) .*">
|
694
|
+
<description>Axis Video encoders/servers</description>
|
592
695
|
<example hw.product="Q7406">AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
|
593
696
|
<example hw.product="241Q">AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
|
594
697
|
<example hw.version="5.07.2">AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
|
595
698
|
<example hw.product="Q7401" hw.version="5.01">AXIS Q7401 Video Encoder 5.01 (Aug 01 2008) ready.</example>
|
596
699
|
<example hw.product="Q7401" hw.version="5.50.2_cst_412205_1">AXIS Q7401 Video Encoder 5.50.2_cst_412205_1 (2013)</example>
|
597
700
|
<example hw.product="Q7424-R" hw.version="5.51.3.1">AXIS Q7424-R Mk II Video Encoder 5.51.3.1 (2016) ready.</example>
|
701
|
+
<param pos="0" name="hw.vendor" value="Axis"/>
|
702
|
+
<param pos="1" name="hw.product"/>
|
703
|
+
<param pos="2" name="hw.version"/>
|
704
|
+
<param pos="0" name="hw.device" value="Video Encoder"/>
|
705
|
+
<param pos="0" name="os.vendor" value="AXIS"/>
|
706
|
+
<param pos="0" name="os.family" value="Linux"/>
|
707
|
+
</fingerprint>
|
708
|
+
|
709
|
+
<fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?IO Audio) (?:Encoder|Encoder Blade|Module|Server|Decoder) (\S+) .*">
|
710
|
+
<description>Axis Audio encoders/servers</description>
|
598
711
|
<example hw.product="P8221" hw.version="5.10.2">AXIS P8221 IO Audio Module 5.10.2 (Nov 07 2011) ready.</example>
|
599
712
|
<param pos="0" name="hw.vendor" value="Axis"/>
|
600
713
|
<param pos="1" name="hw.product"/>
|
601
714
|
<param pos="2" name="hw.version"/>
|
715
|
+
<param pos="0" name="hw.device" value="Audio Encoder"/>
|
716
|
+
<param pos="0" name="os.vendor" value="AXIS"/>
|
717
|
+
<param pos="0" name="os.family" value="Linux"/>
|
602
718
|
</fingerprint>
|
719
|
+
|
603
720
|
<fingerprint pattern="(?i)^AXIS (\S+) Network Door Controller (\S+) .* ready\.?$">
|
604
721
|
<description>Axis Door Controllers</description>
|
605
722
|
<example hw.product="A1001" hw.version="1.65.1.1">AXIS A1001 Network Door Controller 1.65.1.1 (2018) ready.</example>
|
606
723
|
<param pos="0" name="hw.vendor" value="Axis"/>
|
607
|
-
<param pos="0" name="hw.device" value="Access
|
724
|
+
<param pos="0" name="hw.device" value="Access Control"/>
|
608
725
|
<param pos="1" name="hw.product"/>
|
609
726
|
<param pos="2" name="hw.version"/>
|
610
727
|
</fingerprint>
|
728
|
+
|
611
729
|
<fingerprint pattern="^AXIS (\S+) .*FTP Network Print Server V?([\d\.]+\S+) .* ready\.?$" flags="REG_ICASE">
|
612
730
|
<description>Axis print servers</description>
|
613
731
|
<example hw.product="5600+">AXIS 5600+ (rev 3) FTP Network Print Server V7.00 Sep 10 2004 ready.</example>
|
@@ -618,6 +736,7 @@ more text</example>
|
|
618
736
|
<param pos="1" name="hw.product"/>
|
619
737
|
<param pos="2" name="hw.version"/>
|
620
738
|
</fingerprint>
|
739
|
+
|
621
740
|
<fingerprint pattern="^RICOH Aficio ((?:[MS]P )?\S+) FTP server \(([0-9\.a-zA-Z]+)\) ready.?$" flags="REG_ICASE">
|
622
741
|
<description>Ricoh Aficio multifunction device</description>
|
623
742
|
<example os.product="2045e">RICOH Aficio 2045e FTP server (4.12) ready.</example>
|
@@ -633,6 +752,7 @@ more text</example>
|
|
633
752
|
<param pos="1" name="os.product"/>
|
634
753
|
<param pos="2" name="os.version"/>
|
635
754
|
</fingerprint>
|
755
|
+
|
636
756
|
<fingerprint pattern="^NRG ((?:[MS]P )?\S+) FTP server \(([0-9\.a-zA-Z]+)\) ready.?$" flags="REG_ICASE">
|
637
757
|
<description>Ricoh NRG multifunction device</description>
|
638
758
|
<example>NRG MP C2800 FTP server (8.25) ready.</example>
|
@@ -651,6 +771,7 @@ more text</example>
|
|
651
771
|
<param pos="0" name="hw.device" value="Multifunction Device"/>
|
652
772
|
<param pos="1" name="hw.product"/>
|
653
773
|
</fingerprint>
|
774
|
+
|
654
775
|
<fingerprint pattern="^Xerox WorkCentre ([A-Za-z0-9]+).*$" certainty="1.0">
|
655
776
|
<description>Xerox WorkCentre</description>
|
656
777
|
<example hw.product="6605DN">Xerox WorkCentre 6605DN</example>
|
@@ -665,6 +786,7 @@ more text</example>
|
|
665
786
|
<param pos="0" name="hw.device" value="Printer"/>
|
666
787
|
<param pos="1" name="hw.product"/>
|
667
788
|
</fingerprint>
|
789
|
+
|
668
790
|
<fingerprint pattern="^Xerox Phaser (\S+)$" certainty="1.0">
|
669
791
|
<description>Xerox Phaser Laser Printer</description>
|
670
792
|
<example>Xerox Phaser 6130N</example>
|
@@ -678,6 +800,7 @@ more text</example>
|
|
678
800
|
<param pos="0" name="hw.device" value="Printer"/>
|
679
801
|
<param pos="1" name="hw.product"/>
|
680
802
|
</fingerprint>
|
803
|
+
|
681
804
|
<fingerprint pattern="^XEROX (\d+) Wide Format .*$" certainty="1.0">
|
682
805
|
<description>Xerox Wide Format Series of Printers</description>
|
683
806
|
<example>XEROX 6204 Wide Format FTP server ready</example>
|
@@ -690,6 +813,7 @@ more text</example>
|
|
690
813
|
<param pos="0" name="hw.device" value="Printer"/>
|
691
814
|
<param pos="1" name="hw.product"/>
|
692
815
|
</fingerprint>
|
816
|
+
|
693
817
|
<fingerprint pattern="^FUJI XEROX DocuPrint (.*)$" certainty="1.0">
|
694
818
|
<description>FUJI XEROX DocuPrint Series of Printers</description>
|
695
819
|
<example>FUJI XEROX DocuPrint 3055</example>
|
@@ -700,6 +824,7 @@ more text</example>
|
|
700
824
|
<param pos="0" name="os.device" value="Printer"/>
|
701
825
|
<param pos="1" name="os.product"/>
|
702
826
|
</fingerprint>
|
827
|
+
|
703
828
|
<fingerprint pattern="^ET(\S{12}) Lexmark (\S+) FTP Server (\S+) ready\.?$" certainty="1.0" flags="REG_ICASE">
|
704
829
|
<description>Lexmark printer with MAC address</description>
|
705
830
|
<example host.mac="000400CEA560" hw.product="T640" os.version="NS.NP.N219">ET000400CEA560 Lexmark T640 FTP Server NS.NP.N219 ready.</example>
|
@@ -711,6 +836,7 @@ more text</example>
|
|
711
836
|
<param pos="0" name="hw.device" value="Printer"/>
|
712
837
|
<param pos="2" name="hw.product"/>
|
713
838
|
</fingerprint>
|
839
|
+
|
714
840
|
<fingerprint pattern="^.*Lexmark (\S+) FTP Server (\S+) ready\.?$" certainty="1.0" flags="REG_ICASE">
|
715
841
|
<description>Lexmark printer with OS version</description>
|
716
842
|
<example hw.product="T654" os.version="NR.APS.F368">ET0021718 Lexmark T654 FTP Server NR.APS.F368 ready.</example>
|
@@ -721,6 +847,7 @@ more text</example>
|
|
721
847
|
<param pos="0" name="hw.device" value="Printer"/>
|
722
848
|
<param pos="1" name="hw.product"/>
|
723
849
|
</fingerprint>
|
850
|
+
|
724
851
|
<fingerprint pattern="^.*Lexmark (\S+) FTP Server ready\.?$" certainty="1.0" flags="REG_ICASE">
|
725
852
|
<description>Lexmark printer</description>
|
726
853
|
<example hw.product="X500">Lexmark X500 FTP server ready</example>
|
@@ -730,6 +857,7 @@ more text</example>
|
|
730
857
|
<param pos="0" name="hw.device" value="Printer"/>
|
731
858
|
<param pos="1" name="hw.product"/>
|
732
859
|
</fingerprint>
|
860
|
+
|
733
861
|
<fingerprint pattern="^220 ECOSYS ([^\s]+) FTP server$">
|
734
862
|
<description>Kyocera Multifunction Device</description>
|
735
863
|
<example hw.product="P2135dn">220 ECOSYS P2135dn FTP server</example>
|
@@ -739,6 +867,7 @@ more text</example>
|
|
739
867
|
<param pos="0" name="hw.device" value="Multifunction Device"/>
|
740
868
|
<param pos="1" name="hw.product"/>
|
741
869
|
</fingerprint>
|
870
|
+
|
742
871
|
<fingerprint pattern="^(?:Tornado-)?VxWorks \((?:VxWorks)?([^\)]+)\) FTP server(?: ready)?\.?$" flags="REG_ICASE">
|
743
872
|
<description>VxWorks with version information</description>
|
744
873
|
<example os.version="5.3.1">VxWorks (5.3.1) FTP server ready</example>
|
@@ -750,6 +879,7 @@ more text</example>
|
|
750
879
|
<param pos="1" name="os.version"/>
|
751
880
|
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
|
752
881
|
</fingerprint>
|
882
|
+
|
753
883
|
<fingerprint pattern="^Tornado-vxWorks FTP server ready$" flags="REG_ICASE">
|
754
884
|
<description>VxWorks without version information</description>
|
755
885
|
<example>Tornado-vxWorks FTP server ready</example>
|
@@ -757,6 +887,7 @@ more text</example>
|
|
757
887
|
<param pos="0" name="os.product" value="VxWorks"/>
|
758
888
|
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:-"/>
|
759
889
|
</fingerprint>
|
890
|
+
|
760
891
|
<fingerprint pattern="^[\w\-\.]* FTP server \((?:VxWorks\s?)+([\d\.]+)\) ready.$" flags="REG_ICASE">
|
761
892
|
<description>VxWorks 6 with version information</description>
|
762
893
|
<example os.version="6.6">NanoDAC FTP server (VxWorks VxWorks 6.6) ready.</example>
|
@@ -766,6 +897,7 @@ more text</example>
|
|
766
897
|
<param pos="1" name="os.version"/>
|
767
898
|
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
|
768
899
|
</fingerprint>
|
900
|
+
|
769
901
|
<fingerprint pattern="^[\w<>]+\s*Tenor Multipath Switch FTP server \(Version VxWorks([\d\.]+)\) ready\.$" flags="REG_ICASE">
|
770
902
|
<description>VxWorks on Tenor MultiPath with version information</description>
|
771
903
|
<example os.version="5.4.2"><38785ca0> Tenor Multipath Switch FTP server (Version VxWorks5.4.2) ready.</example>
|
@@ -774,6 +906,7 @@ more text</example>
|
|
774
906
|
<param pos="1" name="os.version"/>
|
775
907
|
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
|
776
908
|
</fingerprint>
|
909
|
+
|
777
910
|
<fingerprint pattern="^VxWorks FTP server \(VxWorks ([\d\.]+) - Secure NetLinx version \([\d\.]+\)\) ready.$">
|
778
911
|
<description>VxWorks with Secure NetLinx</description>
|
779
912
|
<example os.version="5.3.1">VxWorks FTP server (VxWorks 5.3.1 - Secure NetLinx version (1.0)) ready.</example>
|
@@ -782,6 +915,7 @@ more text</example>
|
|
782
915
|
<param pos="1" name="os.version"/>
|
783
916
|
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
|
784
917
|
</fingerprint>
|
918
|
+
|
785
919
|
<fingerprint pattern="^ADC iScale$">
|
786
920
|
<description>ADC iScale</description>
|
787
921
|
<example>ADC iScale</example>
|
@@ -790,6 +924,7 @@ more text</example>
|
|
790
924
|
<param pos="0" name="os.vendor" value="ADC"/>
|
791
925
|
<param pos="0" name="os.product" value="iScale"/>
|
792
926
|
</fingerprint>
|
927
|
+
|
793
928
|
<fingerprint pattern="^TASKalfa (\d+c?i) FTP server" certainty="1.0">
|
794
929
|
<description>Taskalfa Series of Printers</description>
|
795
930
|
<example>TASKalfa 300ci FTP server</example>
|
@@ -803,6 +938,7 @@ more text</example>
|
|
803
938
|
<param pos="0" name="hw.device" value="Multifunction Device"/>
|
804
939
|
<param pos="1" name="hw.product"/>
|
805
940
|
</fingerprint>
|
941
|
+
|
806
942
|
<fingerprint pattern="^SAVIN (\S+) FTP server \((.*)\) ready.$" certainty="1.0">
|
807
943
|
<description>SAVIN Printer FTP Server</description>
|
808
944
|
<example os.product="4075">SAVIN 4075 FTP server (4.08) ready.</example>
|
@@ -823,6 +959,7 @@ more text</example>
|
|
823
959
|
<param pos="0" name="hw.device" value="Printer"/>
|
824
960
|
<param pos="1" name="hw.product"/>
|
825
961
|
</fingerprint>
|
962
|
+
|
826
963
|
<fingerprint pattern="^Oce (im\d+) Ver (\S+) FTP server\.$" certainty="1.0">
|
827
964
|
<description>OCE IM series Printer</description>
|
828
965
|
<example>Oce im4512 Ver 01.04.00.0c FTP server.</example>
|
@@ -833,6 +970,7 @@ more text</example>
|
|
833
970
|
<param pos="1" name="os.product"/>
|
834
971
|
<param pos="2" name="os.version"/>
|
835
972
|
</fingerprint>
|
973
|
+
|
836
974
|
<fingerprint pattern="^Oce (Plotwave\d+) FTP Service \(Version (\S+)\)\.$" certainty="1.0">
|
837
975
|
<description>OCE Printer</description>
|
838
976
|
<example>Oce Plotwave300 FTP Service (Version 4.5.7).</example>
|
@@ -842,6 +980,7 @@ more text</example>
|
|
842
980
|
<param pos="1" name="os.product"/>
|
843
981
|
<param pos="2" name="os.version"/>
|
844
982
|
</fingerprint>
|
983
|
+
|
845
984
|
<fingerprint pattern="^LinkCom Xpress (.*) FTP version ([\d\.]+) ready$" certainty="1.0">
|
846
985
|
<description>MPI Technologies Linkcom Express FTP Server with os version</description>
|
847
986
|
<example hw.product="10/100 +IPDS" os.version="1.0">LinkCom Xpress 10/100 +IPDS FTP version 1.0 ready</example>
|
@@ -851,6 +990,7 @@ more text</example>
|
|
851
990
|
<param pos="1" name="hw.product"/>
|
852
991
|
<param pos="2" name="os.version"/>
|
853
992
|
</fingerprint>
|
993
|
+
|
854
994
|
<fingerprint pattern="^LinkCom Xpress (.*)$" certainty="1.0">
|
855
995
|
<description>MPI Technologies Linkcom Express FTP Server</description>
|
856
996
|
<example hw.product="EIO PRO 10">LinkCom Xpress EIO PRO 10</example>
|
@@ -859,6 +999,7 @@ more text</example>
|
|
859
999
|
<param pos="0" name="hw.device" value="Print server"/>
|
860
1000
|
<param pos="1" name="hw.product"/>
|
861
1001
|
</fingerprint>
|
1002
|
+
|
862
1003
|
<fingerprint pattern="^LXKE\S+ IBM Infoprint (\d+) FTP Server (\d+\.\d+\.\d+) ready.$" certainty="1.0">
|
863
1004
|
<description>IBM Infoprint FTP</description>
|
864
1005
|
<example>LXKE82124 IBM Infoprint 1332 FTP Server 55.10.21 ready.</example>
|
@@ -871,6 +1012,7 @@ more text</example>
|
|
871
1012
|
<param pos="1" name="os.product"/>
|
872
1013
|
<param pos="2" name="os.version"/>
|
873
1014
|
</fingerprint>
|
1015
|
+
|
874
1016
|
<fingerprint pattern="^(Gestetner \S+(?: \S+)?) FTP server \((.*)\)" certainty="1.0">
|
875
1017
|
<description>Gestetner Printer FTP</description>
|
876
1018
|
<example os.product="Gestetner MP5500/DSm755" os.version="5.11c">Gestetner MP5500/DSm755 FTP server (5.11c) ready.</example>
|
@@ -883,6 +1025,7 @@ more text</example>
|
|
883
1025
|
<param pos="1" name="os.product"/>
|
884
1026
|
<param pos="2" name="os.version"/>
|
885
1027
|
</fingerprint>
|
1028
|
+
|
886
1029
|
<fingerprint pattern="^(Gestetner \S+)$" certainty="1.0">
|
887
1030
|
<description>Gestetner Printer FTP - short banner</description>
|
888
1031
|
<example>Gestetner MPC2500</example>
|
@@ -890,6 +1033,7 @@ more text</example>
|
|
890
1033
|
<param pos="0" name="os.device" value="Multifunction Device"/>
|
891
1034
|
<param pos="1" name="os.product"/>
|
892
1035
|
</fingerprint>
|
1036
|
+
|
893
1037
|
<fingerprint pattern="^EUFSALE MarkNet (\S+) FTP Server (\d+\.\d+\.\d+) ready.$" certainty="1.0">
|
894
1038
|
<description>Lexmark Marknet Printers FTP</description>
|
895
1039
|
<example>EUFSALE MarkNet X2011e FTP Server 4.20.21 ready.</example>
|
@@ -899,6 +1043,7 @@ more text</example>
|
|
899
1043
|
<param pos="1" name="os.product"/>
|
900
1044
|
<param pos="2" name="os.version"/>
|
901
1045
|
</fingerprint>
|
1046
|
+
|
902
1047
|
<fingerprint pattern="^ET(\S+) Source Technologies (ST-96\S+) FTP Server (\S+) ready\.?$">
|
903
1048
|
<description>Source Technologies ST9600 Series Secure Printer</description>
|
904
1049
|
<example>ET0021B730F70E Source Technologies ST-9620 FTP Server NJ.APS.N254e ready.</example>
|
@@ -911,6 +1056,7 @@ more text</example>
|
|
911
1056
|
<param pos="2" name="os.product"/>
|
912
1057
|
<param pos="3" name="os.version"/>
|
913
1058
|
</fingerprint>
|
1059
|
+
|
914
1060
|
<fingerprint pattern="^ET(\S+) (Pro\d+) Series FTP Server ready\.$" certainty="1.0">
|
915
1061
|
<description>Lexmark ProXXX Series of Printers</description>
|
916
1062
|
<example host.mac="0020007E4D2A" hw.product="Pro700">ET0020007E4D2A Pro700 Series FTP Server ready.</example>
|
@@ -923,6 +1069,7 @@ more text</example>
|
|
923
1069
|
<param pos="0" name="hw.device" value="Printer"/>
|
924
1070
|
<param pos="2" name="hw.product"/>
|
925
1071
|
</fingerprint>
|
1072
|
+
|
926
1073
|
<fingerprint pattern="^ET(\S+) Lexmark Forms Printer (\d+) Ethernet FTP Server (\S+) ready\.$" certainty="1.0">
|
927
1074
|
<description>Lexmark Forms Printer</description>
|
928
1075
|
<example os.product="2590">ET0020004F54EE Lexmark Forms Printer 2590 Ethernet FTP Server LCL.CU.P012c ready.</example>
|
@@ -937,6 +1084,7 @@ more text</example>
|
|
937
1084
|
<param pos="0" name="hw.device" value="Printer"/>
|
938
1085
|
<param pos="2" name="hw.product"/>
|
939
1086
|
</fingerprint>
|
1087
|
+
|
940
1088
|
<fingerprint pattern="^ET(\S+) TOSHIBA e-STUDIO500S FTP Server (\S+) ready\.$" certainty="1.0">
|
941
1089
|
<description>Toshiba e-STUDIO Printer with MAC address</description>
|
942
1090
|
<example os.version="NC2.NPS.N221">ET0004001E9C00 TOSHIBA e-STUDIO500S FTP Server NC2.NPS.N221 ready.</example>
|
@@ -950,6 +1098,7 @@ more text</example>
|
|
950
1098
|
<param pos="0" name="hw.device" value="Multifunction Device"/>
|
951
1099
|
<param pos="0" name="hw.product" value="e-STUDIO"/>
|
952
1100
|
</fingerprint>
|
1101
|
+
|
953
1102
|
<fingerprint pattern="^\S+ TOSHIBA e-STUDIO500S FTP Server (\S+) ready\.$" certainty="1.0">
|
954
1103
|
<description>Toshiba e-STUDIO Printer</description>
|
955
1104
|
<example os.version="NC2.NPS.N211">JHBPRN13 TOSHIBA e-STUDIO500S FTP Server NC2.NPS.N211 ready.</example>
|
@@ -961,6 +1110,7 @@ more text</example>
|
|
961
1110
|
<param pos="0" name="hw.device" value="Multifunction Device"/>
|
962
1111
|
<param pos="0" name="hw.product" value="e-STUDIO"/>
|
963
1112
|
</fingerprint>
|
1113
|
+
|
964
1114
|
<fingerprint pattern="^.*Lexmark Optra (\S+) FTP Server (\S+) ready\.$" certainty="1.0">
|
965
1115
|
<description>Lexmark Optra Printer</description>
|
966
1116
|
<example os.product="T612">lex142785470853 Lexmark Optra T612 FTP Server 3.20.30 ready.</example>
|
@@ -975,6 +1125,7 @@ more text</example>
|
|
975
1125
|
<param pos="0" name="hw.device" value="Printer"/>
|
976
1126
|
<param pos="1" name="hw.product"/>
|
977
1127
|
</fingerprint>
|
1128
|
+
|
978
1129
|
<fingerprint pattern="^SHARP (MX-\S+) Ver (\S+) FTP server\.$" certainty="1.0">
|
979
1130
|
<description>Sharp Printer/Copier/Scanne</description>
|
980
1131
|
<example os.product="MX-6200N" os.version="01.02.00.0e">SHARP MX-6200N Ver 01.02.00.0e FTP server.</example>
|
@@ -996,6 +1147,7 @@ more text</example>
|
|
996
1147
|
<param pos="0" name="hw.family" value="MX Series"/>
|
997
1148
|
<param pos="1" name="hw.product"/>
|
998
1149
|
</fingerprint>
|
1150
|
+
|
999
1151
|
<fingerprint pattern="^(FS-\S+MFP\S*?) FTP server\.?$" certainty="1.0">
|
1000
1152
|
<description>Kyocera Printer with version string</description>
|
1001
1153
|
<example os.product="FS-C2126MFP">FS-C2126MFP FTP server</example>
|
@@ -1008,6 +1160,7 @@ more text</example>
|
|
1008
1160
|
<param pos="0" name="hw.device" value="Multifunction Device"/>
|
1009
1161
|
<param pos="1" name="hw.product"/>
|
1010
1162
|
</fingerprint>
|
1163
|
+
|
1011
1164
|
<fingerprint pattern="^(FS-\S+(?:DN|D|N)) FTP server\.?$" certainty="1.0">
|
1012
1165
|
<description>Kyocera Printer</description>
|
1013
1166
|
<example os.product="FS-1370DN">FS-1370DN FTP server</example>
|
@@ -1021,6 +1174,7 @@ more text</example>
|
|
1021
1174
|
<param pos="0" name="hw.family" value="FS"/>
|
1022
1175
|
<param pos="1" name="hw.product"/>
|
1023
1176
|
</fingerprint>
|
1177
|
+
|
1024
1178
|
<fingerprint pattern="^(ESI-\S+) Version (\S+) ready\.$" certainty="1.0">
|
1025
1179
|
<description>Extended Systems ExtendNet Print Server</description>
|
1026
1180
|
<example os.product="ESI-2941B">ESI-2941B Version 6.34 ready.</example>
|
@@ -1042,6 +1196,7 @@ more text</example>
|
|
1042
1196
|
<param pos="0" name="hw.device" value="Print server"/>
|
1043
1197
|
<param pos="1" name="hw.product"/>
|
1044
1198
|
</fingerprint>
|
1199
|
+
|
1045
1200
|
<fingerprint pattern="^SATO SATO PRINTER Ver (\S+) FTP server\.$" certainty="1.0">
|
1046
1201
|
<description>SATO Printer</description>
|
1047
1202
|
<example os.version="A1.2.3">SATO SATO PRINTER Ver A1.2.3 FTP server.</example>
|
@@ -1052,6 +1207,7 @@ more text</example>
|
|
1052
1207
|
<param pos="0" name="hw.vendor" value="SATO"/>
|
1053
1208
|
<param pos="0" name="hw.device" value="Printer"/>
|
1054
1209
|
</fingerprint>
|
1210
|
+
|
1055
1211
|
<fingerprint pattern="^Printer FTP (\d+\.\d+\.\d+) ready at (\w{3} \d{2} \d{2}:\d{2}:\d{2})$" certainty="1.0">
|
1056
1212
|
<description>AMTDatasouth Fastmark M5</description>
|
1057
1213
|
<example os.version="4.8.7">Printer FTP 4.8.7 ready at Apr 30 20:13:23</example>
|
@@ -1069,6 +1225,7 @@ more text</example>
|
|
1069
1225
|
<param pos="0" name="hw.product" value="Fastmark M5"/>
|
1070
1226
|
<param pos="0" name="hw.device" value="Printer"/>
|
1071
1227
|
</fingerprint>
|
1228
|
+
|
1072
1229
|
<fingerprint pattern="^EFI FTP Print server ready\.$" certainty="0.8">
|
1073
1230
|
<description>EFI FTP Print Server</description>
|
1074
1231
|
<example>EFI FTP Print server ready.</example>
|
@@ -1078,7 +1235,9 @@ more text</example>
|
|
1078
1235
|
<param pos="0" name="os.product" value="Fiery Print Server"/>
|
1079
1236
|
<param pos="0" name="os.device" value="Print server"/>
|
1080
1237
|
</fingerprint>
|
1238
|
+
|
1081
1239
|
<!-- Conjectured based on known MX FTP fingerprints -->
|
1240
|
+
|
1082
1241
|
<fingerprint pattern="^SHARP (AR-\S+) Ver (\S+) FTP server">
|
1083
1242
|
<description>Sharp AR Series multifunction device</description>
|
1084
1243
|
<example os.product="AR-M450">SHARP AR-M450 Ver 01.05.00.0k FTP server.</example>
|
@@ -1092,6 +1251,7 @@ more text</example>
|
|
1092
1251
|
<param pos="0" name="hw.family" value="AR Series"/>
|
1093
1252
|
<param pos="1" name="hw.product"/>
|
1094
1253
|
</fingerprint>
|
1254
|
+
|
1095
1255
|
<fingerprint pattern="^KONICA MINOLTA FTP server ready\.?$">
|
1096
1256
|
<description>Konica Minolta FTP Server - w/o version</description>
|
1097
1257
|
<example>KONICA MINOLTA FTP server ready.</example>
|
@@ -1104,6 +1264,7 @@ more text</example>
|
|
1104
1264
|
<param pos="0" name="hw.vendor" value="Konica Minolta"/>
|
1105
1265
|
<param pos="0" name="hw.product" value="Printer"/>
|
1106
1266
|
</fingerprint>
|
1267
|
+
|
1107
1268
|
<fingerprint pattern="^(KM\S+) FTP server \(KM FTPD version (\d*(?:\.\d*))\) ready\.?$">
|
1108
1269
|
<description>Konica Minolta FTP Server</description>
|
1109
1270
|
<example os.product="KM23BC97" service.version="1.00">KM23BC97 FTP server (KM FTPD version 1.00) ready.</example>
|
@@ -1121,6 +1282,7 @@ more text</example>
|
|
1121
1282
|
<param pos="0" name="service.product" value="KM FTPD"/>
|
1122
1283
|
<param pos="2" name="service.version"/>
|
1123
1284
|
</fingerprint>
|
1285
|
+
|
1124
1286
|
<fingerprint pattern="^(ZBR-\d+) Version (\S+) ready\.?$">
|
1125
1287
|
<description>ZebraNet Print Server FTP</description>
|
1126
1288
|
<example os.product="ZBR-46686">ZBR-46686 Version 7.02 ready.</example>
|
@@ -1134,6 +1296,7 @@ more text</example>
|
|
1134
1296
|
<param pos="0" name="hw.device" value="Print server"/>
|
1135
1297
|
<param pos="1" name="hw.product"/>
|
1136
1298
|
</fingerprint>
|
1299
|
+
|
1137
1300
|
<fingerprint pattern="^(ET(\S+)) Dell (\S+ Laser Printer) FTP Server">
|
1138
1301
|
<description>Dell Laser Printer</description>
|
1139
1302
|
<example host.name="ET0021B71A1111" host.mac="0021B71A1111" hw.product="2350dn Laser Printer">ET0021B71A1111 Dell 2350dn Laser Printer FTP Server NR.APS.N449 ready.</example>
|
@@ -1145,12 +1308,14 @@ more text</example>
|
|
1145
1308
|
<param pos="2" name="host.mac"/>
|
1146
1309
|
<param pos="3" name="hw.product"/>
|
1147
1310
|
</fingerprint>
|
1311
|
+
|
1148
1312
|
<fingerprint pattern="^(\S+) FTP server \(Version \S+ \w+ \w+ \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} [A-Z]+ (?:1|2)\d{3}\) ready\.?$">
|
1149
1313
|
<description>Generic/unknown FTP Server found on HP-UX and AIX systems</description>
|
1150
1314
|
<example host.name="host.example.com">host.example.com FTP server (Version 4.1 Sat Sep 7 14:31:53 CDT 2002) ready.</example>
|
1151
1315
|
<example host.name="host.example.com">host.example.com FTP server (Version 5.3 Sat Jan 10 14:01:03 CDT 2012) ready</example>
|
1152
1316
|
<param pos="1" name="host.name"/>
|
1153
1317
|
</fingerprint>
|
1318
|
+
|
1154
1319
|
<fingerprint pattern="^Welcome to the (?:Cisco )?(?:TelePresence) ([a-zA-Z\s]*?) ((?:MSE )?\d+), version (\d+.\d+\(\d+.\d+\)).*?" flags="REG_ICASE">
|
1155
1320
|
<description>Cisco TelePresence</description>
|
1156
1321
|
<example hw.series="AM GW" os.version="1.1(1.34)" hw.model="3610">Welcome to the Cisco TelePresence AM GW 3610, version 1.1(1.34) </example>
|
@@ -1166,6 +1331,7 @@ more text</example>
|
|
1166
1331
|
<param pos="2" name="hw.model"/>
|
1167
1332
|
<param pos="3" name="os.version"/>
|
1168
1333
|
</fingerprint>
|
1334
|
+
|
1169
1335
|
<fingerprint pattern="^(\S+) FTP server \((?:HP|Compaq) Tru64 UNIX Version (\S+)\) ready\.?$">
|
1170
1336
|
<description>Digital/Compaq/HP Tru64 Unix</description>
|
1171
1337
|
<example host.name="example.com" os.version="5.60">example.com FTP server (Compaq Tru64 UNIX Version 5.60) ready.</example>
|
@@ -1174,8 +1340,9 @@ more text</example>
|
|
1174
1340
|
<param pos="0" name="os.product" value="Tru64 Unix"/>
|
1175
1341
|
<param pos="1" name="host.name"/>
|
1176
1342
|
<param pos="2" name="os.version"/>
|
1177
|
-
<param pos="0" name="os.cpe23" value="cpe:/o:hp:
|
1343
|
+
<param pos="0" name="os.cpe23" value="cpe:/o:hp:tru64_unix:{os.version}"/>
|
1178
1344
|
</fingerprint>
|
1345
|
+
|
1179
1346
|
<fingerprint pattern="^(\S+) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
|
1180
1347
|
<description>Digital/Compaq/HP Tru64 Unix w/o branding</description>
|
1181
1348
|
<example host.name="example.com" os.version="5.60">example.com FTP server (Digital UNIX Version 5.60) ready.</example>
|
@@ -1185,6 +1352,7 @@ more text</example>
|
|
1185
1352
|
<param pos="1" name="host.name"/>
|
1186
1353
|
<param pos="2" name="os.version"/>
|
1187
1354
|
</fingerprint>
|
1355
|
+
|
1188
1356
|
<fingerprint pattern="^(\S+) FTP server \(MikroTik ([\d\.]+)\) ready\.?$">
|
1189
1357
|
<description>MikroTik</description>
|
1190
1358
|
<example host.name="example.com" os.version="6.18">example.com FTP server (MikroTik 6.18) ready</example>
|
@@ -1194,14 +1362,18 @@ more text</example>
|
|
1194
1362
|
<param pos="2" name="os.version"/>
|
1195
1363
|
<param pos="0" name="os.cpe23" value="cpe:/o:mikrotik:routeros:{os.version}"/>
|
1196
1364
|
</fingerprint>
|
1197
|
-
|
1198
|
-
|
1199
|
-
<
|
1365
|
+
|
1366
|
+
<fingerprint pattern="^.* FTP server \(MikroTik (\d\.[\w\.]+)\) ready\.?$">
|
1367
|
+
<description>MikroTik with description</description>
|
1368
|
+
<example os.version="6.43.16">Super Thing_Place- FTP server (MikroTik 6.43.16) ready</example>
|
1369
|
+
<example os.version="6.43.16beta2">Super Thing_Place- FTP server (MikroTik 6.43.16beta2) ready</example>
|
1370
|
+
<example os.version="6.43.16rc56">Super Thing_Place- FTP server (MikroTik 6.43.16rc56) ready</example>
|
1200
1371
|
<param pos="0" name="os.vendor" value="MikroTik"/>
|
1201
1372
|
<param pos="0" name="os.product" value="RouterOS"/>
|
1202
1373
|
<param pos="1" name="os.version"/>
|
1203
1374
|
<param pos="0" name="os.cpe23" value="cpe:/o:mikrotik:routeros:{os.version}"/>
|
1204
1375
|
</fingerprint>
|
1376
|
+
|
1205
1377
|
<fingerprint pattern="^Welcome to ASUS (B?RT-[\w.-]+) FTP service\.$">
|
1206
1378
|
<description>FTPD on an Asus Wireless Access Point/Router</description>
|
1207
1379
|
<example hw.product="RT-AC68U">Welcome to ASUS RT-AC68U FTP service.</example>
|
@@ -1213,6 +1385,7 @@ more text</example>
|
|
1213
1385
|
<param pos="0" name="hw.device" value="WAP"/>
|
1214
1386
|
<param pos="1" name="hw.product"/>
|
1215
1387
|
</fingerprint>
|
1388
|
+
|
1216
1389
|
<fingerprint pattern="^Welcome to ASUS (DSL-[\w.-]+) FTP service\.$">
|
1217
1390
|
<description>FTPD on a ADSL/VDSL Modem/Wireless Access Point/Router</description>
|
1218
1391
|
<example hw.product="DSL-AC68U">Welcome to ASUS DSL-AC68U FTP service.</example>
|
@@ -1223,6 +1396,7 @@ more text</example>
|
|
1223
1396
|
<param pos="0" name="hw.device" value="DSL Modem"/>
|
1224
1397
|
<param pos="1" name="hw.product"/>
|
1225
1398
|
</fingerprint>
|
1399
|
+
|
1226
1400
|
<fingerprint pattern="^Welcome to ASUS (TM-\w+) FTP service\.$">
|
1227
1401
|
<description>FTPD on a T-Mobile branded Asus Wireless Access Point/Router</description>
|
1228
1402
|
<example hw.product="TM-AC1900">Welcome to ASUS TM-AC1900 FTP service.</example>
|
@@ -1232,6 +1406,7 @@ more text</example>
|
|
1232
1406
|
<param pos="0" name="hw.device" value="WAP"/>
|
1233
1407
|
<param pos="1" name="hw.product"/>
|
1234
1408
|
</fingerprint>
|
1409
|
+
|
1235
1410
|
<fingerprint pattern="^(FRITZ!Box[\w()]+) FTP server ready\.$">
|
1236
1411
|
<description>FTPD on an AWM multifunction Modem/Wireless Access Point/Router/VoIP device</description>
|
1237
1412
|
<example hw.product="FRITZ!Box7490">FRITZ!Box7490 FTP server ready.</example>
|
@@ -1245,6 +1420,7 @@ more text</example>
|
|
1245
1420
|
<param pos="0" name="hw.family" value="FRITZ!Box"/>
|
1246
1421
|
<param pos="1" name="hw.product"/>
|
1247
1422
|
</fingerprint>
|
1423
|
+
|
1248
1424
|
<fingerprint pattern="^HES_CPE FTP server \(GNU inetutils ([\w.]+)\) ready\.$">
|
1249
1425
|
<description>FTPD on a ZyXEL (Huawei rebrand) WiMax WAP</description>
|
1250
1426
|
<example service.version="1.4.1">HES_CPE FTP server (GNU inetutils 1.4.1) ready.</example>
|
@@ -1252,10 +1428,11 @@ more text</example>
|
|
1252
1428
|
<param pos="0" name="service.product" value="inetutils ftpd"/>
|
1253
1429
|
<param pos="0" name="service.vendor" value="GNU"/>
|
1254
1430
|
<param pos="1" name="service.version"/>
|
1255
|
-
<param pos="0" name="hw.vendor" value="
|
1431
|
+
<param pos="0" name="hw.vendor" value="Zyxel"/>
|
1256
1432
|
<param pos="0" name="hw.family" value="WiMax"/>
|
1257
1433
|
<param pos="0" name="hw.device" value="WAP"/>
|
1258
1434
|
</fingerprint>
|
1435
|
+
|
1259
1436
|
<fingerprint pattern="^Speedport W ?(\S+) (?:Typ [A|B] )?FTP Server v([\d.]+) ready$$">
|
1260
1437
|
<description>FTPD on Speedport WLAN/ADSL routers (Deutsche Telekom mfg by misc)</description>
|
1261
1438
|
<example hw.product="723V" os.version="1.40.000">Speedport W 723V Typ B FTP Server v1.40.000 ready</example>
|
@@ -1267,6 +1444,7 @@ more text</example>
|
|
1267
1444
|
<param pos="1" name="hw.product"/>
|
1268
1445
|
<param pos="2" name="os.version"/>
|
1269
1446
|
</fingerprint>
|
1447
|
+
|
1270
1448
|
<fingerprint pattern="^DiskStation FTP server ready\.$">
|
1271
1449
|
<description>FTPD on a Synology DiskStation NAS</description>
|
1272
1450
|
<example>DiskStation FTP server ready.</example>
|
@@ -1279,6 +1457,7 @@ more text</example>
|
|
1279
1457
|
<param pos="0" name="hw.family" value="DiskStation"/>
|
1280
1458
|
<param pos="0" name="hw.device" value="NAS"/>
|
1281
1459
|
</fingerprint>
|
1460
|
+
|
1282
1461
|
<fingerprint pattern="^Synology FTP server ready\.$" flags="REG_ICASE">
|
1283
1462
|
<description>FTPD on a Synology device</description>
|
1284
1463
|
<example>Synology FTP server ready.</example>
|
@@ -1290,6 +1469,7 @@ more text</example>
|
|
1290
1469
|
<param pos="0" name="os.product" value="Linux"/>
|
1291
1470
|
<param pos="0" name="hw.vendor" value="Synology"/>
|
1292
1471
|
</fingerprint>
|
1472
|
+
|
1293
1473
|
<fingerprint pattern="^.Welcome to MyBookLive.$">
|
1294
1474
|
<description>FTPD on Western Digital My Book Live NAS</description>
|
1295
1475
|
<example>"Welcome to MyBookLive"</example>
|
@@ -1298,6 +1478,7 @@ more text</example>
|
|
1298
1478
|
<param pos="0" name="hw.product" value="My Book Live"/>
|
1299
1479
|
<param pos="0" name="hw.device" value="NAS"/>
|
1300
1480
|
</fingerprint>
|
1481
|
+
|
1301
1482
|
<fingerprint pattern="^Multicraft ([\w.-]+) FTP server$">
|
1302
1483
|
<description>Multicraft FTPD Server</description>
|
1303
1484
|
<example service.version="2.0.2">Multicraft 2.0.2 FTP server</example>
|
@@ -1307,6 +1488,7 @@ more text</example>
|
|
1307
1488
|
<param pos="0" name="service.vendor" value="Multicraft"/>
|
1308
1489
|
<param pos="1" name="service.version"/>
|
1309
1490
|
</fingerprint>
|
1491
|
+
|
1310
1492
|
<fingerprint pattern="^bftpd ([\d.]+) at ([a-f\d.:]+) ready\.$">
|
1311
1493
|
<description>Bftpd FTPD Server</description>
|
1312
1494
|
<example service.version="2.2.1" host.ip="192.168.0.1">bftpd 2.2.1 at 192.168.0.1 ready.</example>
|
@@ -1318,6 +1500,7 @@ more text</example>
|
|
1318
1500
|
<param pos="0" name="service.cpe23" value="cpe:/a:bftpd_project:bftpd:{service.version}"/>
|
1319
1501
|
<param pos="2" name="host.ip"/>
|
1320
1502
|
</fingerprint>
|
1503
|
+
|
1321
1504
|
<fingerprint pattern="^NASFTPD Turbo station (?:2.x )?([\w.]+) Server \(ProFTPD\)(?: \[([a-f\d.:]+)\])?$">
|
1322
1505
|
<description>ProFTPD on QNAP Turbo Station NAS</description>
|
1323
1506
|
<example service.version="1.3.5a" host.ip="192.168.1.100">NASFTPD Turbo station 1.3.5a Server (ProFTPD) [192.168.1.100]</example>
|
@@ -1333,6 +1516,7 @@ more text</example>
|
|
1333
1516
|
<param pos="0" name="hw.device" value="NAS"/>
|
1334
1517
|
<param pos="2" name="host.ip"/>
|
1335
1518
|
</fingerprint>
|
1519
|
+
|
1336
1520
|
<fingerprint pattern="^Twisted ([\w.]+) FTP Server$">
|
1337
1521
|
<description>Twisted (Python) FTP Server</description>
|
1338
1522
|
<example service.version="14.0.0">Twisted 14.0.0 FTP Server</example>
|
@@ -1342,6 +1526,7 @@ more text</example>
|
|
1342
1526
|
<param pos="0" name="service.vendor" value="Twisted Matrix Labs"/>
|
1343
1527
|
<param pos="1" name="service.version"/>
|
1344
1528
|
</fingerprint>
|
1529
|
+
|
1345
1530
|
<fingerprint pattern="^Gene6 FTP Server v(\d{1,2}\.\d{1,2}\.\d{1,2}\s{1,2}\(Build \d{1,2}\)) ready\.\.\.$">
|
1346
1531
|
<description>Gene6 FTP Server on Windows</description>
|
1347
1532
|
<example service.version="3.10.0 (Build 2)">Gene6 FTP Server v3.10.0 (Build 2) ready...</example>
|
@@ -1355,6 +1540,7 @@ more text</example>
|
|
1355
1540
|
<param pos="0" name="os.product" value="Windows"/>
|
1356
1541
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1357
1542
|
</fingerprint>
|
1543
|
+
|
1358
1544
|
<fingerprint pattern="^([\w.-]+) X2 WS_FTP Server ([\d.]{3,6}\s?\(\d+\))$">
|
1359
1545
|
<description>WS_FTP FTP Server on Windows - X2 variant</description>
|
1360
1546
|
<example service.version="7.7(50012467)" host.name="a.host.name.tld">a.host.name.tld X2 WS_FTP Server 7.7(50012467)</example>
|
@@ -1370,6 +1556,7 @@ more text</example>
|
|
1370
1556
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1371
1557
|
<param pos="1" name="host.name"/>
|
1372
1558
|
</fingerprint>
|
1559
|
+
|
1373
1560
|
<fingerprint pattern="^V2 WS_FTP Server ([\d.]{3,6}\s?\(\d+\))$">
|
1374
1561
|
<description>WS_FTP FTP Server on Windows - V2 variant</description>
|
1375
1562
|
<example service.version="6.1(05544322)">V2 WS_FTP Server 6.1(05544322)</example>
|
@@ -1383,24 +1570,27 @@ more text</example>
|
|
1383
1570
|
<param pos="0" name="os.product" value="Windows"/>
|
1384
1571
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1385
1572
|
</fingerprint>
|
1573
|
+
|
1386
1574
|
<fingerprint pattern="^FTP Server \(ZyWALL (USG\s?[\w-]+)\) \[([a-f\d:.]+)\]$">
|
1387
1575
|
<description>ZyXEL Unified Security Gateway</description>
|
1388
1576
|
<example hw.product="USG 20" host.ip="::ffff:192.168.0.2">FTP Server (ZyWALL USG 20) [::ffff:192.168.0.2]</example>
|
1389
1577
|
<example hw.product="USG100-PLUS" host.ip="::ffff:192.168.5.101">FTP Server (ZyWALL USG100-PLUS) [::ffff:192.168.5.101]</example>
|
1390
1578
|
<example hw.product="USG 20" host.ip="10.0.0.2">FTP Server (ZyWALL USG 20) [10.0.0.2]</example>
|
1391
|
-
<param pos="0" name="service.vendor" value="
|
1579
|
+
<param pos="0" name="service.vendor" value="Zyxel"/>
|
1392
1580
|
<param pos="0" name="service.family" value="Unified Security Gateway"/>
|
1393
1581
|
<param pos="0" name="service.product" value="FTPD"/>
|
1394
1582
|
<param pos="2" name="host.ip"/>
|
1395
|
-
<param pos="0" name="hw.vendor" value="
|
1583
|
+
<param pos="0" name="hw.vendor" value="Zyxel"/>
|
1396
1584
|
<param pos="0" name="hw.family" value="Unified Security Gateway"/>
|
1397
1585
|
<param pos="1" name="hw.product"/>
|
1398
1586
|
</fingerprint>
|
1587
|
+
|
1399
1588
|
<fingerprint pattern="^Welcome to TP-LINK FTP server$">
|
1400
1589
|
<description>FTPD on a TP-LINK device (no version/host info)</description>
|
1401
1590
|
<example>Welcome to TP-LINK FTP server</example>
|
1402
1591
|
<param pos="0" name="hw.vendor" value="TP-LINK"/>
|
1403
1592
|
</fingerprint>
|
1593
|
+
|
1404
1594
|
<fingerprint pattern="^TP-LINK FTP version ([\d\.]+)">
|
1405
1595
|
<description>FTPD on a TP-LINK device with version, but no host info</description>
|
1406
1596
|
<example service.version="1.0">TP-LINK FTP version 1.0 ready at Wed May 1 20:51:49 2019</example>
|
@@ -1408,6 +1598,7 @@ more text</example>
|
|
1408
1598
|
<param pos="0" name="service.product" value="FTPD"/>
|
1409
1599
|
<param pos="1" name="service.version"/>
|
1410
1600
|
</fingerprint>
|
1601
|
+
|
1411
1602
|
<fingerprint pattern="^ucftpd\((\w{3}\s+\d{1,2} \d{4}-\d\d:\d\d:\d\d)\) FTP server ready\.$">
|
1412
1603
|
<description>ucftpd with version</description>
|
1413
1604
|
<example service.version="Jul 2 2012-22:13:49">ucftpd(Jul 2 2012-22:13:49) FTP server ready.</example>
|
@@ -1416,18 +1607,21 @@ more text</example>
|
|
1416
1607
|
<param pos="0" name="service.product" value="ucftpd"/>
|
1417
1608
|
<param pos="1" name="service.version"/>
|
1418
1609
|
</fingerprint>
|
1610
|
+
|
1419
1611
|
<fingerprint pattern="^ucftpd FTP server ready\.$">
|
1420
1612
|
<description>ucftpd without version</description>
|
1421
1613
|
<example>ucftpd FTP server ready.</example>
|
1422
1614
|
<param pos="0" name="service.family" value="ucftpd"/>
|
1423
1615
|
<param pos="0" name="service.product" value="ucftpd"/>
|
1424
1616
|
</fingerprint>
|
1617
|
+
|
1425
1618
|
<fingerprint pattern="^Welcome to TBS FTP Server\.$">
|
1426
1619
|
<description>TBS FTP Server</description>
|
1427
1620
|
<example>Welcome to TBS FTP Server.</example>
|
1428
1621
|
<param pos="0" name="service.family" value="TBS FTP Server"/>
|
1429
1622
|
<param pos="0" name="service.product" value="TBS FTP Server"/>
|
1430
1623
|
</fingerprint>
|
1624
|
+
|
1431
1625
|
<fingerprint pattern="^Sofrel (S5[\w]+) SN ([\d-]+) ready. Time is (\d{2}:\d{2}:\d{2} \d{2}\/\d{2}\/\d{2})\.$">
|
1432
1626
|
<description>Sofrel Remote Terminal Unit</description>
|
1433
1627
|
<example hw.product="S500" host.id="01-499-00427" system.time="00:11:39 01/11/16">Sofrel S500 SN 01-499-00427 ready. Time is 00:11:39 01/11/16.</example>
|
@@ -1438,6 +1632,7 @@ more text</example>
|
|
1438
1632
|
<param pos="0" name="system.time.format" value="HH:mm:ss dd/MM/yy"/>
|
1439
1633
|
<param pos="3" name="system.time"/>
|
1440
1634
|
</fingerprint>
|
1635
|
+
|
1441
1636
|
<fingerprint pattern="^TiMOS-[CB]-([\S]+) cpm\/[\w]+ ALCATEL (SR [\S]+) Copyright .{1,4}$">
|
1442
1637
|
<description>ALCATEL Service Router running TiMOS</description>
|
1443
1638
|
<example os.version="13.0.R9">TiMOS-C-13.0.R9 cpm/hops64 ALCATEL SR 7750 Copyright (</example>
|
@@ -1448,11 +1643,13 @@ more text</example>
|
|
1448
1643
|
<param pos="0" name="hw.family" value="Service Router"/>
|
1449
1644
|
<param pos="2" name="hw.product"/>
|
1450
1645
|
</fingerprint>
|
1646
|
+
|
1451
1647
|
<fingerprint pattern="^(\S+) FTP server ready\.?$" flags="REG_ICASE">
|
1452
1648
|
<description>Generic FTP fingerprint with a hostname</description>
|
1453
1649
|
<example host.name="example.com">example.com FTP server ready.</example>
|
1454
1650
|
<param pos="1" name="host.name"/>
|
1455
1651
|
</fingerprint>
|
1652
|
+
|
1456
1653
|
<fingerprint pattern="^(\S+) FTP server \(Version (\d.*)\) ready\.?$" flags="REG_ICASE">
|
1457
1654
|
<description>Generic FTP fingerprint with a hostname and a version for a generic FTP implementation</description>
|
1458
1655
|
<example host.name="example.com" service.version="6.00LS">example.com FTP server (Version 6.00LS) ready.</example>
|
@@ -1460,6 +1657,7 @@ more text</example>
|
|
1460
1657
|
<param pos="1" name="host.name"/>
|
1461
1658
|
<param pos="2" name="service.version"/>
|
1462
1659
|
</fingerprint>
|
1660
|
+
|
1463
1661
|
<fingerprint pattern="(?i)^FTP[\- ]+(?:server|service)?(?:(?: is)? ready)?\.?$">
|
1464
1662
|
<description>Generic FTP fingerprint without a hostname</description>
|
1465
1663
|
<example>FTP server is ready.</example>
|
@@ -1469,12 +1667,14 @@ more text</example>
|
|
1469
1667
|
<example>FTP Server</example>
|
1470
1668
|
<example>FTP service ready.</example>
|
1471
1669
|
</fingerprint>
|
1670
|
+
|
1472
1671
|
<fingerprint pattern="^Welcom to ProRat Ftp Server$">
|
1473
1672
|
<description>The FTP server of the ProRat malware</description>
|
1474
1673
|
<example>Welcom to ProRat Ftp Server</example>
|
1475
1674
|
<param pos="0" name="service.vendor" value="Pro Group"/>
|
1476
1675
|
<param pos="0" name="service.product" value="ProRat"/>
|
1477
1676
|
</fingerprint>
|
1677
|
+
|
1478
1678
|
<fingerprint pattern="^(?:(\S+) )?FTP Server \(vftpd ([\d.]+)\) ready\.?$">
|
1479
1679
|
<description>Vermillion FTP Daemon</description>
|
1480
1680
|
<example host.name="srv.name" service.version="1.23">srv.name FTP Server (vftpd 1.23) ready.</example>
|
@@ -1488,6 +1688,7 @@ more text</example>
|
|
1488
1688
|
<param pos="2" name="service.version"/>
|
1489
1689
|
<param pos="1" name="host.name"/>
|
1490
1690
|
</fingerprint>
|
1691
|
+
|
1491
1692
|
<fingerprint pattern="^(?:(\S+) )?FTP server \(QVT\/Net ([\d.]+)\) ready\.?$">
|
1492
1693
|
<description>QVT/Net FTP Server</description>
|
1493
1694
|
<example host.name="siren" service.version="5.1">siren FTP server (QVT/Net 5.1) ready.</example>
|
@@ -1501,6 +1702,7 @@ more text</example>
|
|
1501
1702
|
<param pos="2" name="service.version"/>
|
1502
1703
|
<param pos="1" name="host.name"/>
|
1503
1704
|
</fingerprint>
|
1705
|
+
|
1504
1706
|
<fingerprint pattern="Amazon\sLinux\sAMI\srelease\s(\d+\.\d+)">
|
1505
1707
|
<description>Amazon Linux AMI</description>
|
1506
1708
|
<example os.version="2016.09">Amazon Linux AMI release 2016.09</example>
|
@@ -1509,8 +1711,10 @@ more text</example>
|
|
1509
1711
|
<param pos="0" name="os.product" value="Linux AMI"/>
|
1510
1712
|
<param pos="1" name="os.version"/>
|
1511
1713
|
</fingerprint>
|
1714
|
+
|
1512
1715
|
<!-- Below are banners for FTP service providers, not necessarily
|
1513
1716
|
specific FTP servers-->
|
1717
|
+
|
1514
1718
|
<fingerprint pattern="^Idea FTP Server ([\d\.]+) \((.*)\) \[(.+)\]$">
|
1515
1719
|
<description>Idea FTP Server</description>
|
1516
1720
|
<example service.version="0.83.213" host.name="localhost" host.ip="1.2.3.4">Idea FTP Server 0.83.213 (localhost) [1.2.3.4]</example>
|
@@ -1521,18 +1725,21 @@ more text</example>
|
|
1521
1725
|
<param pos="2" name="host.name"/>
|
1522
1726
|
<param pos="3" name="host.ip"/>
|
1523
1727
|
</fingerprint>
|
1728
|
+
|
1524
1729
|
<fingerprint pattern="^Amazon Ftp$">
|
1525
1730
|
<description>Amazon FTP endpoint</description>
|
1526
1731
|
<example>Amazon Ftp</example>
|
1527
1732
|
<param pos="0" name="service.vendor" value="Amazon"/>
|
1528
1733
|
<param pos="0" name="service.product" value="FTP Server"/>
|
1529
1734
|
</fingerprint>
|
1735
|
+
|
1530
1736
|
<fingerprint pattern="^Dreamhost FTP Server$">
|
1531
1737
|
<description>Dreamhost FTP endpoint</description>
|
1532
1738
|
<example>Dreamhost FTP Server</example>
|
1533
1739
|
<param pos="0" name="service.vendor" value="Dreamhost"/>
|
1534
1740
|
<param pos="0" name="service.product" value="FTP Server"/>
|
1535
1741
|
</fingerprint>
|
1742
|
+
|
1536
1743
|
<fingerprint pattern="^QTCP at ([a-zA-Z0-9\.\_\-]+)$">
|
1537
1744
|
<description>IBM iSeries FTP</description>
|
1538
1745
|
<example host.name="core.bank.local.">QTCP at core.bank.local.</example>
|
@@ -1542,6 +1749,7 @@ more text</example>
|
|
1542
1749
|
<param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:-"/>
|
1543
1750
|
<param pos="1" name="host.name"/>
|
1544
1751
|
</fingerprint>
|
1752
|
+
|
1545
1753
|
<fingerprint pattern="^HomeLogic FTP Server">
|
1546
1754
|
<description>ELAN Smart Home Controller</description>
|
1547
1755
|
<example>HomeLogic FTP Server Please Give User Name</example>
|
@@ -1551,4 +1759,28 @@ more text</example>
|
|
1551
1759
|
<param pos="0" name="os.vendor" value="ELAN"/>
|
1552
1760
|
<param pos="0" name="os.family" value="Linux"/>
|
1553
1761
|
</fingerprint>
|
1554
|
-
|
1762
|
+
|
1763
|
+
<fingerprint pattern="^Welcome to Honeywell Printer (PM\d+)\S+?$">
|
1764
|
+
<description>Honeywell Thermal Label Printer (Previously Intermec)</description>
|
1765
|
+
<example hw.product="Thermal Label Printer PM43">Welcome to Honeywell Printer PM43c</example>
|
1766
|
+
<param pos="0" name="hw.vendor" value="Honeywell"/>
|
1767
|
+
<param pos="1" name="hw.model"/>
|
1768
|
+
<param pos="0" name="hw.product" value="Thermal Label Printer {hw.model}"/>
|
1769
|
+
<param pos="0" name="hw.device" value="Printer"/>
|
1770
|
+
<param pos="0" name="os.vendor" value="Honeywell"/>
|
1771
|
+
<param pos="0" name="os.product" value="Thermal Label Printer {hw.model}"/>
|
1772
|
+
<param pos="0" name="os.device" value="Printer"/>
|
1773
|
+
</fingerprint>
|
1774
|
+
|
1775
|
+
<fingerprint pattern="^SurgeFTP ([\S]+) \(Version ([a-f\d.]+)\)$">
|
1776
|
+
<description>NetWin SurgeFTP</description>
|
1777
|
+
<example service.version="2.3a12">SurgeFTP 192.168.0.0 (Version 2.3a12)</example>
|
1778
|
+
<example host.name="foo.bar.baz">SurgeFTP foo.bar.baz (Version 2.2f9)</example>
|
1779
|
+
<param pos="0" name="service.vendor" value="NetWin"/>
|
1780
|
+
<param pos="0" name="service.product" value="SurgeFTP"/>
|
1781
|
+
<param pos="2" name="service.version"/>
|
1782
|
+
<param pos="0" name="service.cpe23" value="cpe:/a:netwin:surgeftp:{service.version}"/>
|
1783
|
+
<param pos="1" name="host.name"/>
|
1784
|
+
</fingerprint>
|
1785
|
+
|
1786
|
+
</fingerprints>
|