recog 2.3.8 → 2.3.13

Sign up to get free protection for your applications and to get access to all the features.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +6 -0
  3. data/CONTRIBUTING.md +136 -37
  4. data/README.md +18 -16
  5. data/bin/recog_cleanup +16 -0
  6. data/bin/recog_standardize +30 -6
  7. data/cpe-remap.yaml +18 -2
  8. data/identifiers/README.md +9 -0
  9. data/identifiers/hw_device.txt +77 -0
  10. data/identifiers/hw_family.txt +96 -0
  11. data/identifiers/hw_product.txt +328 -0
  12. data/identifiers/os_architecture.txt +6 -6
  13. data/identifiers/os_device.txt +45 -3
  14. data/identifiers/os_family.txt +206 -41
  15. data/identifiers/os_product.txt +238 -17
  16. data/identifiers/service_family.txt +144 -57
  17. data/identifiers/service_product.txt +385 -83
  18. data/identifiers/vendor.txt +554 -68
  19. data/lib/recog/version.rb +1 -1
  20. data/requirements.txt +1 -1
  21. data/update_cpes.py +3 -0
  22. data/xml/apache_modules.xml +292 -5
  23. data/xml/apache_os.xml +41 -2
  24. data/xml/architecture.xml +11 -3
  25. data/xml/dns_versionbind.xml +191 -15
  26. data/xml/favicons.xml +1701 -0
  27. data/xml/ftp_banners.xml +250 -18
  28. data/xml/h323_callresp.xml +112 -12
  29. data/xml/hp_pjl_id.xml +47 -5
  30. data/xml/html_title.xml +1278 -25
  31. data/xml/http_cookies.xml +64 -9
  32. data/xml/http_servers.xml +1013 -96
  33. data/xml/http_wwwauth.xml +141 -26
  34. data/xml/imap_banners.xml +62 -13
  35. data/xml/ldap_searchresult.xml +81 -9
  36. data/xml/mdns_device-info_txt.xml +175 -2
  37. data/xml/mdns_workstation_txt.xml +4 -2
  38. data/xml/mysql_banners.xml +134 -7
  39. data/xml/mysql_error.xml +113 -6
  40. data/xml/nntp_banners.xml +10 -2
  41. data/xml/ntp_banners.xml +80 -4
  42. data/xml/operating_system.xml +89 -3
  43. data/xml/pop_banners.xml +87 -33
  44. data/xml/rsh_resp.xml +11 -2
  45. data/xml/rtsp_servers.xml +22 -2
  46. data/xml/sip_banners.xml +35 -4
  47. data/xml/sip_user_agents.xml +29 -2
  48. data/xml/smb_native_lm.xml +10 -2
  49. data/xml/smb_native_os.xml +79 -2
  50. data/xml/smtp_banners.xml +230 -9
  51. data/xml/smtp_debug.xml +6 -4
  52. data/xml/smtp_ehlo.xml +7 -5
  53. data/xml/smtp_expn.xml +13 -4
  54. data/xml/smtp_help.xml +23 -4
  55. data/xml/smtp_mailfrom.xml +5 -2
  56. data/xml/smtp_noop.xml +6 -5
  57. data/xml/smtp_quit.xml +5 -4
  58. data/xml/smtp_rcptto.xml +5 -2
  59. data/xml/smtp_rset.xml +4 -4
  60. data/xml/smtp_turn.xml +4 -4
  61. data/xml/smtp_vrfy.xml +14 -4
  62. data/xml/snmp_sysdescr.xml +733 -25
  63. data/xml/snmp_sysobjid.xml +47 -2
  64. data/xml/ssh_banners.xml +182 -8
  65. data/xml/telnet_banners.xml +493 -22
  66. data/xml/x11_banners.xml +26 -3
  67. data/xml/x509_issuers.xml +30 -6
  68. data/xml/x509_subjects.xml +200 -31
  69. metadata +8 -2
data/xml/http_wwwauth.xml CHANGED
@@ -1,6 +1,7 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="http_header.wwwauth" protocol="http" database_type="service" preference="0.85">
3
3
  <!-- HTTP WWW-Authenticate headers are matched against these patterns to fingerprint HTTP servers. -->
4
+
4
5
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;access&quot;$">
5
6
  <description>Cisco IOS 11.x</description>
6
7
  <example>Basic realm="access"</example>
@@ -18,6 +19,7 @@
18
19
  <param pos="0" name="hw.vendor" value="Cisco"/>
19
20
  <param pos="0" name="hw.device" value="Router"/>
20
21
  </fingerprint>
22
+
21
23
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]15[ _]or[ _]view[ _]access&quot;$">
22
24
  <description>Cisco IOS 12.x - view access variant</description>
23
25
  <example>Basic realm="level_15 or view_access"</example>
@@ -36,6 +38,7 @@
36
38
  <param pos="0" name="hw.vendor" value="Cisco"/>
37
39
  <param pos="0" name="hw.device" value="Router"/>
38
40
  </fingerprint>
41
+
39
42
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;level[ _]\d\d?[ _]access&quot;$">
40
43
  <description>Cisco IOS 12.x</description>
41
44
  <example>Basic realm="level_15_access"</example>
@@ -54,6 +57,7 @@
54
57
  <param pos="0" name="hw.vendor" value="Cisco"/>
55
58
  <param pos="0" name="hw.device" value="Router"/>
56
59
  </fingerprint>
60
+
57
61
  <fingerprint pattern="^Basic realm=&quot;(NetVanta [^&quot;]+)&quot;$" certainty="1.0">
58
62
  <description>ADTRAN Netvanta Router</description>
59
63
  <example hw.product="NetVanta 1238 PoE">Basic realm="NetVanta 1238 PoE"</example>
@@ -65,11 +69,13 @@
65
69
  <param pos="0" name="hw.family" value="NetVanta"/>
66
70
  <param pos="1" name="hw.product"/>
67
71
  </fingerprint>
72
+
68
73
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Cisco_CCSP_CWMP_TCPCR&quot;.*$">
69
74
  <description>Generic Cisco CWMP/CPE equipment</description>
70
75
  <example>Basic realm="Cisco_CCSP_CWMP_TCPCR"</example>
71
76
  <param pos="0" name="hw.vendor" value="Cisco"/>
72
77
  </fingerprint>
78
+
73
79
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;FW-1. Reason: no user Server &quot;$">
74
80
  <description>Check Point FireWall-1</description>
75
81
  <example>Basic realm="FW-1. Reason: no user Server "</example>
@@ -82,6 +88,7 @@
82
88
  <param pos="0" name="os.family" value="Firewall-1"/>
83
89
  <param pos="0" name="os.product" value="Firewall-1"/>
84
90
  </fingerprint>
91
+
85
92
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpanel&quot;.*">
86
93
  <description>cPanel</description>
87
94
  <example>Basic realm="cPanel"</example>
@@ -89,6 +96,7 @@
89
96
  <param pos="0" name="service.product" value="cPanel"/>
90
97
  <param pos="0" name="service.cpe23" value="cpe:/a:cpanel:cpanel:-"/>
91
98
  </fingerprint>
99
+
92
100
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;APC Management Card&quot;$">
93
101
  <description>APC device</description>
94
102
  <example>Basic realm="APC Management Card"</example>
@@ -97,6 +105,7 @@
97
105
  <param pos="0" name="os.vendor" value="APC"/>
98
106
  <param pos="0" name="os.device" value="Power device"/>
99
107
  </fingerprint>
108
+
100
109
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ADSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
101
110
  <description>Generic ADSL modems/routers</description>
102
111
  <example>Basic realm="ADSL Modem"</example>
@@ -105,22 +114,27 @@
105
114
  <example>Basic realm="ADSL2+ Router"</example>
106
115
  <param pos="0" name="hw.device" value="ADSL Modem"/>
107
116
  </fingerprint>
117
+
108
118
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Broadband Router&quot;.*$">
109
119
  <description>Generic Broadband modems/routers</description>
110
120
  <example>Basic realm="Broadband Router"</example>
111
121
  <param pos="0" name="hw.device" value="Broadband router"/>
112
122
  </fingerprint>
123
+
113
124
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DSL\S* (?:Modem|Router|Modem/Router)&quot;.*$">
114
125
  <description>Generic DSL modems/routers</description>
115
126
  <example>Basic realm="DSL Modem"</example>
116
127
  <param pos="0" name="hw.device" value="DSL Modem"/>
117
128
  </fingerprint>
129
+
118
130
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;DVR&quot;.*$">
119
131
  <description>Generic DVR</description>
120
132
  <example>Basic realm="DVR"</example>
121
133
  <param pos="0" name="hw.device" value="DVR"/>
122
134
  </fingerprint>
135
+
123
136
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
137
+
124
138
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;.*$">
125
139
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
126
140
  <example>Basic realm="hikvision"</example>
@@ -128,19 +142,23 @@
128
142
  <param pos="0" name="service.product" value="Hikvision Web Server"/>
129
143
  <param pos="0" name="os.vendor" value="Hikvision"/>
130
144
  <param pos="0" name="os.device" value="DVR"/>
145
+ <param pos="0" name="hw.vendor" value="Hikvision"/>
131
146
  <param pos="0" name="hw.device" value="DVR"/>
132
147
  </fingerprint>
148
+
133
149
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Merit LILIN Ent\. Co\., Ltd.&quot;.*$">
134
150
  <description>Merit LILIN generic device</description>
135
151
  <example>Basic realm="Merit LILIN Ent. Co., Ltd,"</example>
136
152
  <example>Basic realm="Merit LILIN Ent. Co., Ltd."</example>
137
153
  <param pos="0" name="hw.vendor" value="Merit LILIN"/>
138
154
  </fingerprint>
155
+
139
156
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Wireless Access Point&quot;.*$">
140
157
  <description>Generic WAP</description>
141
158
  <example>Basic realm="Wireless Access Point"</example>
142
159
  <param pos="0" name="hw.device" value="WAP"/>
143
160
  </fingerprint>
161
+
144
162
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(?:(?:Cube|(?:Mini )?Dome|Day/Night|PAN/Tilt|POE|IR|HD|H.264|Surveillance|Wired|Wireless(?: N)?|Network|Internet|(?:IP(?:[\s_-])?)?Cameras?[\s_]*\d*) ?){1,4}?(?: Login)?&quot;.*$">
145
163
  <description>Generic IP Cameras</description>
146
164
  <example>Basic realm="camera"</example>
@@ -148,6 +166,7 @@
148
166
  <example>Basic realm="Mini Dome IP Camera"</example>
149
167
  <param pos="0" name="hw.device" value="Web cam"/>
150
168
  </fingerprint>
169
+
151
170
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
152
171
  <description>D-Link DCS IP Cameras</description>
153
172
  <example hw.product="DCS-5222LB1">Basic realm="DCS-5222LB1"</example>
@@ -156,6 +175,7 @@
156
175
  <param pos="0" name="hw.device" value="Web cam"/>
157
176
  <param pos="1" name="hw.product"/>
158
177
  </fingerprint>
178
+
159
179
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
160
180
  <description>GoAhead webserver</description>
161
181
  <example>Basic realm="GoAhead"</example>
@@ -163,25 +183,19 @@
163
183
  <param pos="0" name="service.product" value="GoAhead Webserver"/>
164
184
  <param pos="0" name="service.family" value="GoAhead Webserver"/>
165
185
  </fingerprint>
186
+
166
187
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;kubernetes-master&quot;.*$">
167
188
  <description>Kubernetes master nodes</description>
168
189
  <example>Basic realm="kubernetes-master"</example>
169
190
  <param pos="0" name="service.vendor" value="Kubernetes"/>
170
191
  </fingerprint>
171
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
172
- <description>Netgear Orbi</description>
173
- <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
174
- <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
175
- <param pos="0" name="hw.vendor" value="Netgear"/>
176
- <param pos="0" name="hw.device" value="WAP"/>
177
- <param pos="0" name="hw.family" value="Orbi"/>
178
- <param pos="1" name="hw.product"/>
179
- </fingerprint>
192
+
180
193
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;RUIJIE(?:-CPE)?&quot;.*$">
181
194
  <description>Ruijie Networks generic</description>
182
195
  <example>Digest realm="RUIJIE-CPE"</example>
183
196
  <param pos="0" name="hw.vendor" value="Ruijie"/>
184
197
  </fingerprint>
198
+
185
199
  <fingerprint pattern="^Basic realm=&quot;SpeedTouch&quot;$">
186
200
  <description>Thomson SpeedTouch xDSL router - short variant</description>
187
201
  <example>Basic realm="SpeedTouch"</example>
@@ -195,6 +209,7 @@
195
209
  <param pos="0" name="hw.family" value="SpeedTouch"/>
196
210
  <param pos="0" name="hw.device" value="Broadband router"/>
197
211
  </fingerprint>
212
+
198
213
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch \(([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2})\)&quot;$">
199
214
  <description>Thomson SpeedTouch xDSL router</description>
200
215
  <example host.mac="00-90-D0-F9-91-52">Basic realm="SpeedTouch (00-90-D0-F9-91-52)"</example>
@@ -210,10 +225,12 @@
210
225
  <param pos="0" name="hw.device" value="Broadband router"/>
211
226
  <param pos="1" name="host.mac"/>
212
227
  </fingerprint>
228
+
213
229
  <!--
214
230
  Really need some examples for the fingerprints below. The regex and params
215
231
  imply that the nonce inlcudes the MAC address.
216
232
  -->
233
+
217
234
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;SpeedTouch&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
218
235
  <description>Thomson SpeedTouch xDSL router - qop variant</description>
219
236
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -228,6 +245,7 @@
228
245
  <param pos="0" name="hw.device" value="Broadband router"/>
229
246
  <param pos="1" name="host.mac"/>
230
247
  </fingerprint>
248
+
231
249
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;ST (\d+) R 5.x Telecom Italia&quot;, nonce=&quot;[0-9A-Z]+:([0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}):\d+:\d+&quot;, qop=&quot;auth&quot;$">
232
250
  <description>Thomson SpeedTouch xDSL router - Telecom Italia</description>
233
251
  <param pos="0" name="service.vendor" value="Thomson"/>
@@ -242,6 +260,7 @@
242
260
  <param pos="1" name="os.product"/>
243
261
  <param pos="2" name="host.mac"/>
244
262
  </fingerprint>
263
+
245
264
  <fingerprint pattern="^(?:Basic|Digest).*realm=&quot;Thomson(?: Gateway)?&quot;.*$">
246
265
  <description>Thomson generic devices</description>
247
266
  <example>Digest realm="Thomson Gateway"</example>
@@ -249,6 +268,7 @@
249
268
  <param pos="0" name="hw.vendor" value="Thomson"/>
250
269
  <param pos="0" name="hw.device" value="Broadband router"/>
251
270
  </fingerprint>
271
+
252
272
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
253
273
  <description>Huawei xDSL routers</description>
254
274
  <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
@@ -264,6 +284,7 @@
264
284
  <param pos="0" name="hw.family" value="MT"/>
265
285
  <param pos="1" name="hw.product"/>
266
286
  </fingerprint>
287
+
267
288
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;HuaweiHomeGateway&quot;.*$">
268
289
  <description>Huawei Home Gateway Routers</description>
269
290
  <example>Basic realm="HuaweiHomeGateway"</example>
@@ -271,6 +292,7 @@
271
292
  <param pos="0" name="hw.device" value="Broadband router"/>
272
293
  <param pos="0" name="hw.product" value="Home Gateway"/>
273
294
  </fingerprint>
295
+
274
296
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;EchoLife .*&quot;.*$">
275
297
  <description>Huawei EchoLife Home Gateways</description>
276
298
  <example>Basic realm="EchoLife Portal de Inicio"</example>
@@ -279,6 +301,7 @@
279
301
  <param pos="0" name="hw.device" value="Broadband router"/>
280
302
  <param pos="0" name="hw.product" value="EchoLife Home Gateway"/>
281
303
  </fingerprint>
304
+
282
305
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
283
306
  <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
284
307
  <example hw.product="WRT54G">Basic realm="WRT54G"</example>
@@ -292,6 +315,7 @@
292
315
  <param pos="0" name="hw.device" value="WAP"/>
293
316
  <param pos="1" name="hw.product"/>
294
317
  </fingerprint>
318
+
295
319
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
296
320
  <description>TP-LINK SoHo Router - dash variant</description>
297
321
  <example>Basic realm="TD-W8901G"</example>
@@ -301,6 +325,7 @@
301
325
  <param pos="0" name="os.device" value="Router"/>
302
326
  <param pos="1" name="os.product"/>
303
327
  </fingerprint>
328
+
304
329
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
305
330
  <description>TP-LINK SoHo Router</description>
306
331
  <example>Basic realm="TD854W"</example>
@@ -311,6 +336,7 @@
311
336
  <param pos="0" name="os.device" value="Router"/>
312
337
  <param pos="1" name="os.product"/>
313
338
  </fingerprint>
339
+
314
340
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;.*$">
315
341
  <description>TP-LINK SoHo Router - verbose variant</description>
316
342
  <example>Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
@@ -333,27 +359,31 @@
333
359
  <param pos="0" name="os.device" value="WAP"/>
334
360
  <param pos="1" name="os.product"/>
335
361
  </fingerprint>
362
+
336
363
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;.*$">
337
364
  <description>TP-LINK Routers</description>
338
365
  <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
339
366
  <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
340
367
  <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
341
- <param pos="0" name="hw.vendor" value="TP-Link"/>
368
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
342
369
  <param pos="0" name="hw.device" value="Router"/>
343
370
  <param pos="1" name="hw.product"/>
344
371
  </fingerprint>
372
+
345
373
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK IP-Camera&quot;.*$">
346
374
  <description>TP-LINK IP-Cameras</description>
347
375
  <example>Basic realm="TP-LINK IP-Camera"</example>
348
- <param pos="0" name="hw.vendor" value="TP-Link"/>
376
+ <param pos="0" name="hw.vendor" value="TP-LINK"/>
349
377
  <param pos="0" name="hw.device" value="Web cam"/>
350
378
  </fingerprint>
379
+
351
380
  <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
352
381
  <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>
353
382
  <example>Digest qop="auth", realm="Broadcom Management Service", nonce="AAAAAAAAAAAAAP//DwHpMwYy1zc=", algorithm="MD5"</example>
354
383
  <param pos="0" name="service.vendor" value="Broadcom"/>
355
384
  <param pos="0" name="service.product" value="Management Service"/>
356
385
  </fingerprint>
386
+
357
387
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;SWAT&quot;.*$">
358
388
  <description>Samba Web Administration Tool (SWAT)</description>
359
389
  <example>Basic realm="SWAT"</example>
@@ -361,6 +391,7 @@
361
391
  <param pos="0" name="service.family" value="Samba"/>
362
392
  <param pos="0" name="service.product" value="SWAT"/>
363
393
  </fingerprint>
394
+
364
395
  <fingerprint pattern="^.*(?:Basic|Digest) realm=&quot;SPIP Configuration&quot;.*$">
365
396
  <description>SPIP publishing system (www.spip.net)</description>
366
397
  <example>Basic realm="SPIP Configuration", Digest realm="SPIP Configuration", nonce="116761147", algorithm="MD5"</example>
@@ -368,6 +399,7 @@
368
399
  <param pos="0" name="service.product" value="SPIP"/>
369
400
  <param pos="0" name="service.cpe23" value="cpe:/a:spip:spip:-"/>
370
401
  </fingerprint>
402
+
371
403
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;HP ISEE @ ([^&quot;]+)&quot;.*$">
372
404
  <description>HP Instant Support Enterprise Edition with a hostname</description>
373
405
  <example host.name="blah">Basic realm="HP ISEE @ blah"</example>
@@ -375,6 +407,7 @@
375
407
  <param pos="0" name="service.product" value="ISEE"/>
376
408
  <param pos="1" name="host.name"/>
377
409
  </fingerprint>
410
+
378
411
  <fingerprint pattern="^.*(?:Basic|Digest) .*realm=&quot;BIG-IP&quot;.*$">
379
412
  <description>Generic F5 Big-IP</description>
380
413
  <example>Basic realm="BIG-IP"</example>
@@ -383,7 +416,9 @@
383
416
  <param pos="0" name="service.product" value="BIG-IP LTM"/>
384
417
  <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
385
418
  </fingerprint>
419
+
386
420
  <!-- HP ProCurve -->
421
+
387
422
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[3]\d{3}A)&quot;$">
388
423
  <description>HP ProCurve Hubs</description>
389
424
  <example os.product="J3295A">Basic realm="HP J3295A"</example>
@@ -392,6 +427,7 @@
392
427
  <param pos="0" name="os.device" value="Hub"/>
393
428
  <param pos="1" name="os.product"/>
394
429
  </fingerprint>
430
+
395
431
  <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;(?:HP|ProCurve) (J[489]\d{3}A)&quot;$">
396
432
  <description>HP ProCurve Switches</description>
397
433
  <example os.product="J4110A">Basic realm="HP J4110A"</example>
@@ -403,11 +439,13 @@
403
439
  <param pos="0" name="os.device" value="Switch"/>
404
440
  <param pos="1" name="os.product"/>
405
441
  </fingerprint>
442
+
406
443
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;SERCOMM CPE Authentication&quot;.*$">
407
444
  <description>Assorted Sercomm CPE devices</description>
408
445
  <example>Digest realm="SERCOMM CPE Authentication"</example>
409
446
  <param pos="0" name="hw.vendor" value="Sercomm"/>
410
447
  </fingerprint>
448
+
411
449
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TiVo DVR&quot;.*$">
412
450
  <description>Tivo DVR</description>
413
451
  <example>Digest realm="TiVo DVR"</example>
@@ -415,12 +453,14 @@
415
453
  <param pos="0" name="hw.family" value="DVR"/>
416
454
  <param pos="0" name="hw.device" value="DVR"/>
417
455
  </fingerprint>
456
+
418
457
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;UBEE&quot;.*$">
419
458
  <description>Ubee Cable Modems</description>
420
459
  <example>Digest qop="auth", realm="Ubee", nonce="1544738973"</example>
421
460
  <param pos="0" name="hw.vendor" value="Ubee"/>
422
461
  <param pos="0" name="hw.device" value="Broadband router"/>
423
462
  </fingerprint>
463
+
424
464
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;XDB&quot;$">
425
465
  <description>Web server providing web services for Oracle's XML DB.</description>
426
466
  <example>Basic realm="XDB"</example>
@@ -428,11 +468,13 @@
428
468
  <param pos="0" name="service.product" value="XML DB"/>
429
469
  <param pos="0" name="service.family" value="Oracle"/>
430
470
  </fingerprint>
471
+
431
472
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;cpe@zte.com&quot;.*$">
432
473
  <description>Assorted ZTE CPE devices</description>
433
474
  <example>Digest realm="cpe@zte.com"</example>
434
475
  <param pos="0" name="hw.vendor" value="ZTE"/>
435
476
  </fingerprint>
477
+
436
478
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;.*$">
437
479
  <description>ZTE ZXHN router</description>
438
480
  <example>Basic realm="ZXHN H108L"</example>
@@ -441,6 +483,7 @@
441
483
  <param pos="0" name="hw.family" value="ZXHN"/>
442
484
  <param pos="1" name="hw.product"/>
443
485
  </fingerprint>
486
+
444
487
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;(ZXV\S* \S+)&quot;.*$">
445
488
  <description>ZTE ZXV router</description>
446
489
  <example hw.product="ZXV10 W300">Basic realm="ZXV10 W300"</example>
@@ -449,20 +492,98 @@
449
492
  <param pos="0" name="hw.family" value="ZXV"/>
450
493
  <param pos="1" name="hw.product"/>
451
494
  </fingerprint>
495
+
496
+ <fingerprint pattern="(?i)^(?:Basic|Digest)\s+realm=&quot;Siqura&quot;$">
497
+ <description>Siqura Video Encoder</description>
498
+ <example>Basic realm="Siqura"</example>
499
+ <param pos="0" name="os.vendor" value="Siqura"/>
500
+ <param pos="0" name="os.family" value="Linux"/>
501
+ <param pos="0" name="hw.vendor" value="Siqura"/>
502
+ <param pos="0" name="hw.device" value="Video Encoder"/>
503
+ </fingerprint>
504
+
505
+ <fingerprint pattern="^Digest realm=&quot;(Orbit-351)&quot;">
506
+ <description>Steinsvik Orbit 351 IP Camera (Truen TCAM Rebrand)</description>
507
+ <example hw.product="Orbit-351">Digest realm="Orbit-351", nonce="0000040dY892418598785d2a2304a74adf22f6098f2792", stale=FALSE</example>
508
+ <param pos="0" name="hw.vendor" value="Steinsvik"/>
509
+ <param pos="0" name="hw.device" value="Web cam"/>
510
+ <param pos="1" name="hw.product"/>
511
+ <param pos="0" name="os.vendor" value="Steinsvik"/>
512
+ <param pos="0" name="os.family" value="Linux"/>
513
+ <param pos="0" name="os.product" value="Linux"/>
514
+ </fingerprint>
515
+
516
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;NETGEAR (Orbi(?:-(?:micro|mini))?)&quot;.*$">
517
+ <description>Netgear Orbi</description>
518
+ <example hw.product="Orbi">Basic realm="NETGEAR Orbi"</example>
519
+ <example hw.product="Orbi-micro">Basic realm="NETGEAR Orbi-micro"</example>
520
+ <example hw.product="Orbi-mini">Basic realm="NETGEAR Orbi-mini"</example>
521
+ <param pos="0" name="hw.vendor" value="Netgear"/>
522
+ <param pos="0" name="hw.device" value="WAP"/>
523
+ <param pos="0" name="hw.family" value="Orbi"/>
524
+ <param pos="1" name="hw.product"/>
525
+ </fingerprint>
526
+
527
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;NETGEAR ([a-zA-Z0-9\-\+]+)\s*&quot;.*$">
528
+ <description>Netgear Routers</description>
529
+ <example hw.product="DG834">Basic realm="NETGEAR DG834 "</example>
530
+ <example hw.product="C7000v2">Basic realm="NETGEAR C7000v2"</example>
531
+ <example hw.product="R7000P">Basic realm="NETGEAR R7000P"</example>
532
+ <param pos="0" name="hw.vendor" value="Netgear"/>
533
+ <param pos="0" name="hw.device" value="Router"/>
534
+ <param pos="1" name="hw.product"/>
535
+ </fingerprint>
536
+
537
+ <!-- Fallback to the most generic Netgear match -->
538
+
539
+ <fingerprint pattern="(?:Basic|Digest) realm=&quot;Netgear&quot;.*$">
540
+ <description>Netgear Unspecified Router</description>
541
+ <example>Basic realm="Netgear"</example>
542
+ <param pos="0" name="hw.vendor" value="Netgear"/>
543
+ <param pos="0" name="hw.device" value="Router"/>
544
+ </fingerprint>
545
+
546
+ <!-- This fingerprint is suspect, as it's missing the Basic/Digest qualifier -->
547
+
548
+ <fingerprint pattern="^(?:NETGEAR|NetGear) Router ([a-zA-Z0-9\-\+]+)$">
549
+ <description>Netgear Routers w/o Authentication Type</description>
550
+ <example hw.product="WNR2000v4">NETGEAR Router WNR2000v4</example>
551
+ <example hw.product="R6100">NETGEAR Router R6100</example>
552
+ <param pos="0" name="hw.vendor" value="Netgear"/>
553
+ <param pos="0" name="hw.device" value="Router"/>
554
+ <param pos="1" name="hw.product"/>
555
+ </fingerprint>
556
+
557
+ <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
558
+ <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
559
+ <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
560
+ <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
561
+ <param pos="0" name="service.product" value="RemoteView"/>
562
+ <param pos="0" name="service.family" value="RemoteView"/>
563
+ <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
564
+ <param pos="0" name="hw.family" value="Primergy"/>
565
+ <param pos="0" name="hw.product" value="Primergy"/>
566
+ <param pos="1" name="host.name"/>
567
+ </fingerprint>
568
+
452
569
  <!-- a variety of headers we currently just ignore -->
570
+
453
571
  <fingerprint pattern="(?i)^NTLM$">
454
572
  <description>Ignore NTLM-only</description>
455
573
  <example>NTLM</example>
456
574
  <example>Ntlm</example>
457
575
  </fingerprint>
576
+
458
577
  <fingerprint pattern="^Negotiate$">
459
578
  <description>Ignore Negotiate-only</description>
460
579
  <example>Negotiate</example>
461
580
  </fingerprint>
581
+
462
582
  <!--
463
583
  Using a wildcard . instead of ['&quot;] in the following line will result in
464
584
  this fingerprint matching examples from other fingerprints.
465
585
  -->
586
+
466
587
  <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
467
588
  <description>Ignore null/empty/period/index.</description>
468
589
  <example>Basic realm="null"</example>
@@ -472,37 +593,30 @@
472
593
  <example>Basic realm='/'</example>
473
594
  <example>Basic realm="index.html"</example>
474
595
  </fingerprint>
596
+
475
597
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;.*$">
476
598
  <description>Ignore realms with an IPv4 address</description>
477
599
  <example>Basic realm="192.168.0.1"</example>
478
600
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
479
601
  </fingerprint>
602
+
480
603
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;.*$">
481
604
  <description>Ignore generic 'config' realms</description>
482
605
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
483
606
  </fingerprint>
484
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;[iI]RMC(?:@(IRMC[0-9a-fA-F]{6}))?&quot;.*$">
485
- <description>Fujitsu Siemens Primergy with BMC RemoteView on an iRMC card</description>
486
- <example host.name="IRMCA0EC88">Digest realm="iRMC@IRMCA0EC88", qop="auth", nonce="d569ace4-00029040", opaque="29040", stale="FALSE"</example>
487
- <param pos="0" name="service.vendor" value="Fujitsu Siemens"/>
488
- <param pos="0" name="service.product" value="RemoteView"/>
489
- <param pos="0" name="service.family" value="RemoteView"/>
490
- <param pos="0" name="hw.vendor" value="Fujitsu Siemens"/>
491
- <param pos="0" name="hw.family" value="Primergy"/>
492
- <param pos="0" name="hw.product" value="Primergy"/>
493
- <param pos="1" name="host.name"/>
494
- </fingerprint>
607
+
495
608
  <!--
496
609
  Temporarily disable this version-less fingerprint because it overrode the
497
610
  one in http_servers.xml (see NEX-1255).
498
-
499
611
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;Lyris ListManager: enter email address and password&quot;$">
500
612
  <description>Lyris ListManager</description>
501
613
  <example>Basic realm="Lyris ListManager: enter email address and password"</example>
502
614
  <param pos="0" name="service.vendor" value="Lyris"/>
503
615
  <param pos="0" name="service.product" value="ListManager"/>
504
616
  </fingerprint>
617
+
505
618
  -->
619
+
506
620
  <!--
507
621
  Basic realm= StarVoice
508
622
  Basic realm="802.11g Remote-Motion CCD Network Camera"
@@ -550,7 +664,6 @@ Basic realm="Login to Vigor 3300"
550
664
  Basic realm="Login"
551
665
  Basic realm="MR314"
552
666
  Basic realm="NetComm NB1300"
553
- Basic realm="NETGEAR DG834 "
554
667
  Basic realm="NetLinx"
555
668
  Basic realm="Netopia-2000"
556
669
  Basic realm="Netopia-3000"
@@ -590,7 +703,9 @@ Digest realm="HiPER", domain="222.66.99.209", qop="auth", nonce="aa81b6584c4716f
590
703
  Digest realm="i3micro VRG", nonce="1186428394", qop="auth", algorithm=MD5
591
704
  Digest realm="WatchGuard SOHO Configuration",qop="auth",nonce="7c8e98007db668881687bd538e6e8581"
592
705
  -->
706
+
593
707
  <!-- This is in various PHP coding examples, but is not a reliable FP source:
594
708
  Basic realm="User Login"
595
709
  -->
596
- </fingerprints>
710
+
711
+ </fingerprints>