recog 2.3.8 → 2.3.9
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +6 -0
- data/CONTRIBUTING.md +136 -37
- data/README.md +18 -16
- data/bin/recog_cleanup +16 -0
- data/bin/recog_standardize +30 -6
- data/identifiers/README.md +9 -0
- data/identifiers/hw_device.txt +77 -0
- data/identifiers/hw_family.txt +96 -0
- data/identifiers/hw_product.txt +328 -0
- data/identifiers/os_architecture.txt +6 -6
- data/identifiers/os_device.txt +45 -3
- data/identifiers/os_family.txt +206 -41
- data/identifiers/os_product.txt +238 -17
- data/identifiers/service_family.txt +144 -57
- data/identifiers/service_product.txt +384 -83
- data/identifiers/vendor.txt +553 -68
- data/lib/recog/version.rb +1 -1
- data/requirements.txt +1 -1
- data/xml/apache_modules.xml +292 -5
- data/xml/apache_os.xml +41 -2
- data/xml/architecture.xml +11 -3
- data/xml/dns_versionbind.xml +76 -8
- data/xml/favicons.xml +1700 -0
- data/xml/ftp_banners.xml +178 -8
- data/xml/h323_callresp.xml +112 -12
- data/xml/hp_pjl_id.xml +47 -5
- data/xml/html_title.xml +1258 -25
- data/xml/http_cookies.xml +64 -9
- data/xml/http_servers.xml +667 -37
- data/xml/http_wwwauth.xml +141 -26
- data/xml/imap_banners.xml +19 -13
- data/xml/ldap_searchresult.xml +81 -9
- data/xml/mdns_device-info_txt.xml +175 -2
- data/xml/mdns_workstation_txt.xml +4 -2
- data/xml/mysql_banners.xml +134 -7
- data/xml/mysql_error.xml +113 -6
- data/xml/nntp_banners.xml +10 -2
- data/xml/ntp_banners.xml +80 -4
- data/xml/operating_system.xml +89 -3
- data/xml/pop_banners.xml +30 -31
- data/xml/rsh_resp.xml +11 -2
- data/xml/rtsp_servers.xml +22 -2
- data/xml/sip_banners.xml +35 -4
- data/xml/sip_user_agents.xml +29 -2
- data/xml/smb_native_lm.xml +10 -2
- data/xml/smb_native_os.xml +79 -2
- data/xml/smtp_banners.xml +146 -7
- data/xml/smtp_debug.xml +6 -4
- data/xml/smtp_ehlo.xml +7 -5
- data/xml/smtp_expn.xml +13 -4
- data/xml/smtp_help.xml +23 -4
- data/xml/smtp_mailfrom.xml +5 -2
- data/xml/smtp_noop.xml +6 -5
- data/xml/smtp_quit.xml +5 -4
- data/xml/smtp_rcptto.xml +5 -2
- data/xml/smtp_rset.xml +4 -4
- data/xml/smtp_turn.xml +4 -4
- data/xml/smtp_vrfy.xml +14 -4
- data/xml/snmp_sysdescr.xml +731 -24
- data/xml/snmp_sysobjid.xml +47 -2
- data/xml/ssh_banners.xml +175 -5
- data/xml/telnet_banners.xml +266 -15
- data/xml/x11_banners.xml +26 -3
- data/xml/x509_issuers.xml +30 -6
- data/xml/x509_subjects.xml +200 -31
- metadata +8 -2
data/xml/telnet_banners.xml
CHANGED
@@ -1,53 +1,63 @@
|
|
1
|
-
<?xml version=
|
1
|
+
<?xml version='1.0' encoding='UTF-8'?>
|
2
2
|
<fingerprints protocol="telnet" database_type="service" preference=".80">
|
3
3
|
<!--
|
4
4
|
TELNET banners with CR/LF/whitespace trimmed from either end.
|
5
5
|
Examples with CR, LF, etc must be base64 encoded in order to past tests.
|
6
6
|
Please follow the style established below.
|
7
7
|
-->
|
8
|
+
|
8
9
|
<!--
|
9
10
|
The following 'assert nothing' block is intended to handle banners so simple
|
10
11
|
that they cannot be attributed to a product or vendor. They are at the
|
11
12
|
beginning of the file as a performance tweak given how frequenty they occur.
|
12
|
-
|
13
13
|
NOTE:
|
14
14
|
Due to the multi-line nature of TELNET banners the regex are leveraging \A
|
15
15
|
instead of ^ to prevent matching in the beginning of a 'line' (^) instead of
|
16
16
|
at the beginning of the string (\A). This has been verified to work with
|
17
17
|
Ruby, Python, Java, and Golang.
|
18
18
|
-->
|
19
|
+
|
19
20
|
<fingerprint pattern="\A(?i)(?:\r|\n)*login:\s*$">
|
20
21
|
<description>bare 'login:' -- assert nothing.</description>
|
21
22
|
<example>login:</example>
|
22
23
|
</fingerprint>
|
24
|
+
|
23
25
|
<fingerprint pattern="\A(?i)(?:\r|\n)*User(?:name)?\s*:\s*$">
|
24
26
|
<description>bare 'Username:' -- assert nothing.</description>
|
25
27
|
<example>Username:</example>
|
26
28
|
<example>User:</example>
|
27
29
|
</fingerprint>
|
30
|
+
|
28
31
|
<fingerprint pattern="\A(?i)(?:\r|\n)*Password:\s*$">
|
29
32
|
<description>bare 'Password:' -- assert nothing.</description>
|
30
33
|
<example>Password:</example>
|
31
34
|
</fingerprint>
|
35
|
+
|
32
36
|
<fingerprint pattern="\A(?i)(?:\r|\n)*Account:\s*$">
|
33
37
|
<description>bare 'Account:' -- assert nothing.</description>
|
34
38
|
<example>Account:</example>
|
35
39
|
</fingerprint>
|
40
|
+
|
36
41
|
<fingerprint pattern="\A(?i)Connection refused(?:\r|\n)*$">
|
37
42
|
<description>bare 'Connection refused' -- assert nothing.</description>
|
38
43
|
<example>Connection refused</example>
|
39
44
|
</fingerprint>
|
45
|
+
|
40
46
|
<!-- end of assert nothing block -->
|
47
|
+
|
41
48
|
<fingerprint pattern="^(?:\r|\n)*User Access Verification(?:\r|\n)+(?:Username|Password):\s*$">
|
42
49
|
<description>Cisco switch or router - user access variant</description>
|
43
50
|
<!-- User Access Verification\r\n\r\nUsername: -->
|
51
|
+
|
44
52
|
<example _encoding="base64">VXNlciBBY2Nlc3MgVmVyaWZpY2F0aW9uDQoNClVzZXJuYW1lOgo=</example>
|
45
53
|
<!-- User Access Verification\r\n\r\nPassword: -->
|
54
|
+
|
46
55
|
<example _encoding="base64">VXNlciBBY2Nlc3MgVmVyaWZpY2F0aW9uDQoNClBhc3N3b3JkOgo=</example>
|
47
56
|
<param pos="0" name="service.vendor" value="Cisco"/>
|
48
57
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
49
58
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
50
59
|
</fingerprint>
|
60
|
+
|
51
61
|
<fingerprint pattern="^(?:\r|\n)*Password required, but none set(?:\r|\n)*$">
|
52
62
|
<description>Cisco switch or router - password not set variant</description>
|
53
63
|
<example>Password required, but none set</example>
|
@@ -55,15 +65,20 @@
|
|
55
65
|
<param pos="0" name="os.vendor" value="Cisco"/>
|
56
66
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
57
67
|
</fingerprint>
|
68
|
+
|
58
69
|
<fingerprint pattern="^(?:\r|\n)*MikroTik v([\w.]+)(?: \(\w+\))?(?:\r|\n)+Login:\s*$">
|
59
70
|
<description>MikroTik RouterOS</description>
|
60
71
|
<!-- MikroTik v5.2\r\nLogin: -->
|
72
|
+
|
61
73
|
<example _encoding="base64" os.version="5.2">TWlrcm9UaWsgdjUuMg0KTG9naW46Cg==</example>
|
62
74
|
<!-- MikroTik v6.42.3 (stable)\r\nLogin: -->
|
75
|
+
|
63
76
|
<example _encoding="base64" os.version="6.42.3">TWlrcm9UaWsgdjYuNDIuMyAoc3RhYmxlKQ0KTG9naW46Cg==</example>
|
64
77
|
<!-- MikroTik v6.40.8 (bugfix)\r\nLogin: -->
|
78
|
+
|
65
79
|
<example _encoding="base64" os.version="6.40.8">TWlrcm9UaWsgdjYuNDAuOCAoYnVnZml4KQ0KTG9naW46Cg==</example>
|
66
80
|
<!-- MikroTik v6.36rc12 (testing)\r\nLogin: -->
|
81
|
+
|
67
82
|
<example _encoding="base64" os.version="6.36rc12">TWlrcm9UaWsgdjYuMzZyYzEyICh0ZXN0aW5nKQ0KTG9naW46Cg==</example>
|
68
83
|
<param pos="0" name="os.vendor" value="MikroTik"/>
|
69
84
|
<param pos="0" name="os.device" value="Router"/>
|
@@ -73,13 +88,17 @@
|
|
73
88
|
<param pos="0" name="hw.vendor" value="MikroTik"/>
|
74
89
|
<param pos="0" name="hw.device" value="Router"/>
|
75
90
|
</fingerprint>
|
91
|
+
|
76
92
|
<fingerprint pattern="^(?:\r|\n)?ZXHN (\w+)(?: V([\d.]+))?(?:\r|\n)*Login:\s*$">
|
77
93
|
<description>ZTE ZXHN router</description>
|
78
94
|
<!-- ZXHN H108N\r\nLogin: -->
|
95
|
+
|
79
96
|
<example _encoding="base64" hw.product="H108N">WlhITiBIMTA4Tg0KTG9naW46Cg==</example>
|
80
97
|
<!-- ZXHN H298A V1.1\r\nLogin: -->
|
98
|
+
|
81
99
|
<example _encoding="base64" hw.product="H298A" hw.version="1.1">WlhITiBIMjk4QSBWMS4xDQpMb2dpbjoK</example>
|
82
100
|
<!-- ZXHN H367N\r\n\rLogin: -->
|
101
|
+
|
83
102
|
<example _encoding="base64" hw.product="H367N">WlhITiBIMzY3Tg0KDUxvZ2luOgo=</example>
|
84
103
|
<param pos="0" name="hw.vendor" value="ZTE"/>
|
85
104
|
<param pos="0" name="hw.device" value="Router"/>
|
@@ -87,24 +106,30 @@
|
|
87
106
|
<param pos="1" name="hw.product"/>
|
88
107
|
<param pos="2" name="hw.version"/>
|
89
108
|
</fingerprint>
|
109
|
+
|
90
110
|
<fingerprint pattern="^(F6\d+\w?)\r\n\rLogin:\s*$">
|
91
111
|
<description>ZTE F6xx series GPON router</description>
|
92
112
|
<!-- F668\r\n\rLogin: -->
|
113
|
+
|
93
114
|
<example _encoding="base64" hw.product="F668">RjY2OA0KDUxvZ2luOgo=</example>
|
94
115
|
<!-- F612W\r\n\rLogin: -->
|
116
|
+
|
95
117
|
<example _encoding="base64" hw.product="F612W">RjYxMlcNCg1Mb2dpbjoK</example>
|
96
118
|
<param pos="0" name="hw.vendor" value="ZTE"/>
|
97
119
|
<param pos="0" name="hw.device" value="Router"/>
|
98
120
|
<param pos="1" name="hw.product"/>
|
99
121
|
</fingerprint>
|
122
|
+
|
100
123
|
<fingerprint pattern="^(?:\r|\n)*DD-WRT v([\d.]+)(?:-(\w+))? ([\w-]+) \(c\) \d{4} NewMedia-NET GmbH(?:\r|\n)+Release: \d+\/\d+\/\d+ \(SVN revision: ([:\w]+)\)(?:\r|\n)+.* login:\s*$">
|
101
124
|
<description>DD-WRT - 24 family</description>
|
102
125
|
<!-- DD-WRT v24-sp2 mini (c) 2013 NewMedia-NET GmbH\r\nRelease: 05/27/13 (SVN revision: 21676)\r\n\r\nDD-WRT login: -->
|
126
|
+
|
103
127
|
<example _encoding="base64" os.version="24" os.version.version="sp2" os.edition="mini" os.build="21676">
|
104
128
|
REQtV1JUIHYyNC1zcDIgbWluaSAoYykgMjAxMyBOZXdNZWRpYS1ORVQgR21iSA0KUmVsZWFzZ
|
105
129
|
TogMDUvMjcvMTMgKFNWTiByZXZpc2lvbjogMjE2NzYpDQoNCkRELVdSVCBsb2dpbjoK
|
106
130
|
</example>
|
107
131
|
<!-- DD-WRT v24 micro (c) 2010 NewMedia-NET GmbH\r\nRelease: 08/07/10 (SVN revision: 14896)\r\n\r\nProliant DL980R07 X6550 8-core 4P SAS login: -->
|
132
|
+
|
108
133
|
<example _encoding="base64" os.version="24" os.edition="micro" os.build="14896">
|
109
134
|
REQtV1JUIHYyNCBtaWNybyAoYykgMjAxMCBOZXdNZWRpYS1ORVQgR21iSA0KUmVsZWFzZTogM
|
110
135
|
DgvMDcvMTAgKFNWTiByZXZpc2lvbjogMTQ4OTYpDQoNClByb2xpYW50IERMOTgwUjA3IFg2NT
|
@@ -120,9 +145,11 @@
|
|
120
145
|
<param pos="0" name="os.cpe23" value="cpe:/o:dd-wrt:dd-wrt:{os.version}"/>
|
121
146
|
<param pos="0" name="hw.device" value="Router"/>
|
122
147
|
</fingerprint>
|
148
|
+
|
123
149
|
<fingerprint pattern="^(?:\r|\n)*DD-WRT v(3.\d)-(r([\w]+)) ([\w-]+) \(c\) \d{4} NewMedia-NET GmbH(?:\r|\n)+Release: \d+\/\d+\/\d+(?:\r|\n)+.* login:\s*$">
|
124
150
|
<description>DD-WRT - 3.0 family</description>
|
125
151
|
<!-- DD-WRT v3.0-r34886M std (c) 2018 NewMedia-NET GmbH\r\nRelease: 02/10/18\r\n\r\nwibrate login: -->
|
152
|
+
|
126
153
|
<example _encoding="base64" os.version="3.0" os.version.version="r34886M" os.edition="std" os.build="34886M">
|
127
154
|
REQtV1JUIHYzLjAtcjM0ODg2TSBzdGQgKGMpIDIwMTggTmV3TWVkaWEtTkVUIEdtYkgNClJlb
|
128
155
|
GVhc2U6IDAyLzEwLzE4DQoNCndpYnJhdGUgbG9naW46Cg==
|
@@ -137,33 +164,40 @@
|
|
137
164
|
<param pos="0" name="os.cpe23" value="cpe:/o:dd-wrt:dd-wrt:{os.version}"/>
|
138
165
|
<param pos="0" name="hw.device" value="Router"/>
|
139
166
|
</fingerprint>
|
167
|
+
|
140
168
|
<fingerprint pattern="^(TD-\w+) [\d.]+ DSL Modem Router(?:\r|\n)+Authorization failed after trying \d+ times!!!\.(?:\r|\n)+Please login after \d+ seconds!\s*$">
|
141
169
|
<description>TP-LINK TD Family DSL Modem/Router</description>
|
142
170
|
<!-- TD-W8960N 5.0 DSL Modem Router\r\nAuthorization failed after trying 5 times!!!.\r\nPlease login after 416 seconds! -->
|
171
|
+
|
143
172
|
<example _encoding="base64" hw.product="TD-W8960N">
|
144
173
|
VEQtVzg5NjBOIDUuMCBEU0wgTW9kZW0gUm91dGVyDQpBdXRob3JpemF0aW9uIGZhaWxlZCBhZ
|
145
174
|
nRlciB0cnlpbmcgNSB0aW1lcyEhIS4NClBsZWFzZSBsb2dpbiBhZnRlciA0MTYgc2Vjb25kcy
|
146
175
|
E=
|
147
176
|
</example>
|
148
|
-
<param pos="0" name="hw.vendor" value="TP-
|
177
|
+
<param pos="0" name="hw.vendor" value="TP-LINK"/>
|
149
178
|
<param pos="1" name="hw.product"/>
|
150
179
|
<param pos="0" name="hw.device" value="Router"/>
|
151
180
|
</fingerprint>
|
181
|
+
|
152
182
|
<fingerprint pattern="^(?:\r|\n)*ZyXEL login:$">
|
153
183
|
<description>ZyXEL simple</description>
|
154
184
|
<example>ZyXEL login:</example>
|
155
|
-
<param pos="0" name="hw.vendor" value="
|
185
|
+
<param pos="0" name="hw.vendor" value="Zyxel"/>
|
156
186
|
</fingerprint>
|
187
|
+
|
157
188
|
<fingerprint pattern="^ZyXEL \w?DSL Router\r\nLogin:$">
|
158
189
|
<description>ZyXEL Router - simple</description>
|
159
190
|
<!-- ZyXEL VDSL Router\r\nLogin: -->
|
191
|
+
|
160
192
|
<example _encoding="base64">WnlYRUwgVkRTTCBSb3V0ZXINCkxvZ2luOgo=</example>
|
161
|
-
<param pos="0" name="hw.vendor" value="
|
193
|
+
<param pos="0" name="hw.vendor" value="Zyxel"/>
|
162
194
|
<param pos="0" name="hw.device" value="Router"/>
|
163
195
|
</fingerprint>
|
196
|
+
|
164
197
|
<fingerprint pattern="^Debian GNU\/Linux 9(?:\r|\n)+([\w.-]+) login:\s*$">
|
165
198
|
<description>Debian 9.0 (stretch)</description>
|
166
199
|
<!-- Debian GNU/Linux 9\r\nserver-01.2 login: -->
|
200
|
+
|
167
201
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA5DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
|
168
202
|
<param pos="0" name="os.vendor" value="Debian"/>
|
169
203
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -172,9 +206,11 @@
|
|
172
206
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:9.0"/>
|
173
207
|
<param pos="1" name="host.name"/>
|
174
208
|
</fingerprint>
|
209
|
+
|
175
210
|
<fingerprint pattern="^Debian GNU\/Linux 8(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
176
211
|
<description>Debian 8.0 (jessie)</description>
|
177
212
|
<!-- Debian GNU/Linux 8\r\nserver-01.2 login: -->
|
213
|
+
|
178
214
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA4DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
|
179
215
|
<param pos="0" name="os.vendor" value="Debian"/>
|
180
216
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -183,9 +219,11 @@
|
|
183
219
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
|
184
220
|
<param pos="1" name="host.name"/>
|
185
221
|
</fingerprint>
|
222
|
+
|
186
223
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 7(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
187
224
|
<description>Debian 7.0 (wheezy)</description>
|
188
225
|
<!-- Debian GNU/Linux 7\r\nserver-01.2 login: -->
|
226
|
+
|
189
227
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA3DQpzZXJ2ZXItMDEuMiBsb2dpbjoK</example>
|
190
228
|
<param pos="0" name="os.vendor" value="Debian"/>
|
191
229
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -194,9 +232,11 @@
|
|
194
232
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
|
195
233
|
<param pos="1" name="host.name"/>
|
196
234
|
</fingerprint>
|
235
|
+
|
197
236
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 6(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
198
237
|
<description>Debian 6.0 (sqeeze)</description>
|
199
238
|
<!-- Debian GNU/Linux 6.0\r\nserver-01.2 login: -->
|
239
|
+
|
200
240
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA2LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
|
201
241
|
<param pos="0" name="os.vendor" value="Debian"/>
|
202
242
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -205,9 +245,11 @@
|
|
205
245
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:6.0"/>
|
206
246
|
<param pos="1" name="host.name"/>
|
207
247
|
</fingerprint>
|
248
|
+
|
208
249
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 5(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
209
250
|
<description>Debian 5.0 (lenny)</description>
|
210
251
|
<!-- Debian GNU/Linux 5.0\r\nserver-01.2 login: -->
|
252
|
+
|
211
253
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA1LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
|
212
254
|
<param pos="0" name="os.vendor" value="Debian"/>
|
213
255
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -216,9 +258,11 @@
|
|
216
258
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:5.0"/>
|
217
259
|
<param pos="1" name="host.name"/>
|
218
260
|
</fingerprint>
|
261
|
+
|
219
262
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux 4(?:.0)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
220
263
|
<description>Debian 4.0 (etch)</description>
|
221
264
|
<!-- Debian GNU/Linux 4.0\r\nserver-01.2 login: -->
|
265
|
+
|
222
266
|
<example _encoding="base64" host.name="server-01.2">RGViaWFuIEdOVS9MaW51eCA0LjANCnNlcnZlci0wMS4yIGxvZ2luOgo=</example>
|
223
267
|
<param pos="0" name="os.vendor" value="Debian"/>
|
224
268
|
<param pos="0" name="os.family" value="Linux"/>
|
@@ -227,9 +271,11 @@
|
|
227
271
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:4.0"/>
|
228
272
|
<param pos="1" name="host.name"/>
|
229
273
|
</fingerprint>
|
274
|
+
|
230
275
|
<fingerprint pattern="^(?:\r|\n)*Debian GNU\/Linux (3.\d)(?: [\w.-]+)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
231
276
|
<description>Debian 3.x (woody/sarge)</description>
|
232
277
|
<!-- Debian GNU/Linux 3.1\r\nserver-01.2 login: -->
|
278
|
+
|
233
279
|
<example _encoding="base64" os.version="3.1" host.name="server-01.2">
|
234
280
|
RGViaWFuIEdOVS9MaW51eCAzLjENCnNlcnZlci0wMS4yIGxvZ2luOgo=
|
235
281
|
</example>
|
@@ -240,13 +286,16 @@
|
|
240
286
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:{os.version}"/>
|
241
287
|
<param pos="2" name="host.name"/>
|
242
288
|
</fingerprint>
|
289
|
+
|
243
290
|
<fingerprint pattern="^(?:\r|\n)*Ubuntu ([\d.]+)(?: LTS)?(?:\r|\n)+([\w.-]+) login:\s*$">
|
244
291
|
<description>Ubuntu - most versions</description>
|
245
292
|
<!-- Ubuntu 16.04.4 LTS\r\nserver-01.2 login: -->
|
293
|
+
|
246
294
|
<example _encoding="base64" os.version="16.04.4" host.name="server-01.2">
|
247
295
|
VWJ1bnR1IDE2LjA0LjQgTFRTDQpzZXJ2ZXItMDEuMiBsb2dpbjoK
|
248
296
|
</example>
|
249
297
|
<!-- Ubuntu 17.04\r\nnginx login: -->
|
298
|
+
|
250
299
|
<example _encoding="base64" os.version="17.04" host.name="nginx">
|
251
300
|
VWJ1bnR1IDE3LjA0DQpuZ2lueCBsb2dpbjoK
|
252
301
|
</example>
|
@@ -257,13 +306,16 @@
|
|
257
306
|
<param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:{os.version}"/>
|
258
307
|
<param pos="2" name="host.name"/>
|
259
308
|
</fingerprint>
|
309
|
+
|
260
310
|
<fingerprint pattern="(?:\r|\n)*Debian GNU\/Linux (2.\d)(?: [\w.-]+)?(?:\r|\n)+([\w.-]+) login:\s*">
|
261
311
|
<description>Debian 2.x (hamm/slink/potato)</description>
|
262
312
|
<!-- Debian GNU/Linux 2.2\r\nserver-01.2 login: -->
|
313
|
+
|
263
314
|
<example _encoding="base64" os.version="2.2" host.name="server-01.2">
|
264
315
|
RGViaWFuIEdOVS9MaW51eCAyLjINCnNlcnZlci0wMS4yIGxvZ2luOgo=
|
265
316
|
</example>
|
266
317
|
<!-- Debian GNU/Linux 2.2 localhost.localdomain\r\nmoon login: -->
|
318
|
+
|
267
319
|
<example _encoding="base64" os.version="2.2" host.name="moon">
|
268
320
|
RGViaWFuIEdOVS9MaW51eCAyLjIgbG9jYWxob3N0LmxvY2FsZG9tYWluDQptb29uIGxvZ2luOgo=
|
269
321
|
</example>
|
@@ -274,14 +326,17 @@
|
|
274
326
|
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:{os.version}"/>
|
275
327
|
<param pos="2" name="host.name"/>
|
276
328
|
</fingerprint>
|
329
|
+
|
277
330
|
<fingerprint pattern="^CentOS release ([\d.]+) \(Final\)(?:\r|\n)+Kernel ([\w.-]+) on an (\w+)(?:\r|\n)+(?:([\w.-]+) )?login:\s*$">
|
278
331
|
<description>CentOS</description>
|
279
332
|
<!-- CentOS release 5.9 (Final)\r\nKernel 2.6.18-348.6.1.el5 on an i686\r\nlogin: -->
|
333
|
+
|
280
334
|
<example _encoding="base64" os.version="5.9" linux.kernel.version="2.6.18-348.6.1.el5" os.arch="i686">
|
281
335
|
Q2VudE9TIHJlbGVhc2UgNS45IChGaW5hbCkNCktlcm5lbCAyLjYuMTgtMzQ4LjYuMS5lbDUgb
|
282
336
|
24gYW4gaTY4Ng0KbG9naW46Cg==
|
283
337
|
</example>
|
284
338
|
<!-- CentOS release 6.10 (Final)\r\nKernel 2.6.32-754.2.1.el6.x86_64 on an x86_64\r\nserver-01.2 login: -->
|
339
|
+
|
285
340
|
<example _encoding="base64" os.version="6.10" linux.kernel.version="2.6.32-754.2.1.el6.x86_64" os.arch="x86_64" host.name="server-01.2">
|
286
341
|
Q2VudE9TIHJlbGVhc2UgNi4xMCAoRmluYWwpDQpLZXJuZWwgMi42LjMyLTc1NC4yLjEuZWw2L
|
287
342
|
ng4Nl82NCBvbiBhbiB4ODZfNjQNCnNlcnZlci0wMS4yIGxvZ2luOgo=
|
@@ -295,6 +350,7 @@
|
|
295
350
|
<param pos="0" name="os.cpe23" value="cpe:/o:centos:centos:{os.version}"/>
|
296
351
|
<param pos="4" name="host.name"/>
|
297
352
|
</fingerprint>
|
353
|
+
|
298
354
|
<fingerprint pattern="^(?:\r|\n)*(RT-AC\d\d\w) login:\s*$">
|
299
355
|
<description>Asus Wireless Access Point/Router - RT-AC prefix</description>
|
300
356
|
<example hw.product="RT-AC54U">RT-AC54U login:</example>
|
@@ -305,6 +361,7 @@
|
|
305
361
|
<param pos="0" name="hw.device" value="WAP"/>
|
306
362
|
<param pos="1" name="hw.product"/>
|
307
363
|
</fingerprint>
|
364
|
+
|
308
365
|
<fingerprint pattern="^(?:\r|\n)*(AC\d\d00) login:\s*$">
|
309
366
|
<description>Asus Wireless Access Point/Router - AC prefix</description>
|
310
367
|
<example hw.product="AC1000">AC1000 login:</example>
|
@@ -315,6 +372,7 @@
|
|
315
372
|
<param pos="0" name="hw.device" value="WAP"/>
|
316
373
|
<param pos="1" name="hw.product"/>
|
317
374
|
</fingerprint>
|
375
|
+
|
318
376
|
<fingerprint pattern="^(?:\r|\n)*(Air5\d+\w{0,2}) login:\s*$">
|
319
377
|
<description>Airties</description>
|
320
378
|
<example hw.product="Air5650">Air5650 login:</example>
|
@@ -323,9 +381,11 @@
|
|
323
381
|
<param pos="0" name="hw.device" value="WAP"/>
|
324
382
|
<param pos="1" name="hw.product"/>
|
325
383
|
</fingerprint>
|
384
|
+
|
326
385
|
<fingerprint pattern="^Amazon Linux AMI release ([\d.]+)(?:\r|\n)+Kernel ([\w.-]+) on an (\w+)(?:\r|\n)+(?:([\w.-]+) )?login:\s*$">
|
327
386
|
<description>Amazon Linux AMI</description>
|
328
387
|
<!-- Amazon Linux AMI release 2013.09\r\nKernel 3.4.68-59.97.amzn1.x86_64 on an x86_64\r\nserver-01.2 login: -->
|
388
|
+
|
329
389
|
<example _encoding="base64" os.version="2013.09" linux.kernel.version="3.4.68-59.97.amzn1.x86_64" os.arch="x86_64" host.name="server-01.2">
|
330
390
|
QW1hem9uIExpbnV4IEFNSSByZWxlYXNlIDIwMTMuMDkNCktlcm5lbCAzLjQuNjgtNTkuOTcuY
|
331
391
|
W16bjEueDg2XzY0IG9uIGFuIHg4Nl82NA0Kc2VydmVyLTAxLjIgbG9naW46Cg==
|
@@ -338,9 +398,11 @@
|
|
338
398
|
<param pos="3" name="os.arch"/>
|
339
399
|
<param pos="4" name="host.name"/>
|
340
400
|
</fingerprint>
|
401
|
+
|
341
402
|
<fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)/([\w]+) ALCATEL (SR [\S]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
|
342
403
|
<description>ALCATEL Service Router running TiMOS</description>
|
343
404
|
<!-- TiMOS-C-12.0.R12 cpm/hops64 ALCATEL SR 7750 Copyright (c) 2000-2015 Alcatel-Lucent.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
405
|
+
|
344
406
|
<example _encoding="base64" os.version="12.0.R12" hw.product="SR 7750" os.arch="hops64">
|
345
407
|
VGlNT1MtQy0xMi4wLlIxMiBjcG0vaG9wczY0IEFMQ0FURUwgU1IgNzc1MCBDb3B5cmlnaHQgK
|
346
408
|
GMpIDIwMDAtMjAxNSBBbGNhdGVsLUx1Y2VudC4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQ
|
@@ -356,16 +418,20 @@
|
|
356
418
|
<param pos="0" name="hw.device" value="Router"/>
|
357
419
|
<param pos="3" name="hw.product"/>
|
358
420
|
</fingerprint>
|
421
|
+
|
359
422
|
<!-- Nokia purchased Alcatel Lucent, finalized in Nov 2016 -->
|
423
|
+
|
360
424
|
<fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia ([\S]+ [SRX]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
|
361
425
|
<description>Nokia Service Router running TiMOS</description>
|
362
426
|
<!-- TiMOS-C-14.0.R5 cpm/hops64 Nokia 7750 SR Copyright (c) 2000-2016 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
427
|
+
|
363
428
|
<example _encoding="base64" os.version="14.0.R5" os.arch="hops64" hw.product="7750 SR">
|
364
429
|
VGlNT1MtQy0xNC4wLlI1IGNwbS9ob3BzNjQgTm9raWEgNzc1MCBTUiBDb3B5cmlnaHQgKGMpI
|
365
430
|
DIwMDAtMjAxNiBOb2tpYS4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQpCcmV2aXR5DQpMb2
|
366
431
|
dpbjoK
|
367
432
|
</example>
|
368
433
|
<!-- TiMOS-C-14.0.R10 cpm/hops64 Nokia 7950 XRS Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
434
|
+
|
369
435
|
<example _encoding="base64" os.version="14.0.R10" os.arch="hops64" hw.product="7950 XRS">
|
370
436
|
VGlNT1MtQy0xNC4wLlIxMCBjcG0vaG9wczY0IE5va2lhIDc5NTAgWFJTIENvcHlyaWdodCAoY
|
371
437
|
ykgMjAwMC0yMDE3IE5va2lhLg0NCkJhbm5lciBTaG9ydGVuZWQgRm9yIA0NCkJyZXZpdHkNCk
|
@@ -381,15 +447,18 @@
|
|
381
447
|
<param pos="0" name="hw.device" value="Router"/>
|
382
448
|
<param pos="3" name="hw.product"/>
|
383
449
|
</fingerprint>
|
450
|
+
|
384
451
|
<fingerprint pattern="^(?m)TiMOS-[CB]-([\S]+) (?:both|cpm)\/([\w]+) Nokia (SAS[+\w\s-]+) Copyright.*Login:\s*$" flags="REG_MULTILINE">
|
385
452
|
<description>Nokia Service Access Switch running TiMOS</description>
|
386
453
|
<!-- TiMOS-B-8.0.R12 both/hops Nokia SAS-Mxp 22F2C 4SFP+ 7210 Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
454
|
+
|
387
455
|
<example _encoding="base64" os.version="8.0.R12" os.arch="hops" hw.product="SAS-Mxp 22F2C 4SFP+ 7210">
|
388
456
|
VGlNT1MtQi04LjAuUjEyIGJvdGgvaG9wcyBOb2tpYSBTQVMtTXhwIDIyRjJDIDRTRlArIDcyM
|
389
457
|
TAgQ29weXJpZ2h0IChjKSAyMDAwLTIwMTcgTm9raWEuDQ0KQmFubmVyIFNob3J0ZW5lZCBGb3
|
390
458
|
IgDQ0KQnJldml0eQ0KTG9naW46Cg==
|
391
459
|
</example>
|
392
460
|
<!-- TiMOS-B-9.0.R9 both/mpc Nokia SAS-M 24F 2XFP 7210 Copyright (c) 2000-2017 Nokia.\r\r\nBanner Shortened For \r\r\nBrevity\r\nLogin: -->
|
461
|
+
|
393
462
|
<example _encoding="base64" os.version="9.0.R9" os.arch="mpc" hw.product="SAS-M 24F 2XFP 7210">
|
394
463
|
VGlNT1MtQi05LjAuUjkgYm90aC9tcGMgTm9raWEgU0FTLU0gMjRGIDJYRlAgNzIxMCBDb3B5c
|
395
464
|
mlnaHQgKGMpIDIwMDAtMjAxNyBOb2tpYS4NDQpCYW5uZXIgU2hvcnRlbmVkIEZvciANDQpCcm
|
@@ -405,14 +474,17 @@
|
|
405
474
|
<param pos="0" name="hw.device" value="Switch"/>
|
406
475
|
<param pos="3" name="hw.product"/>
|
407
476
|
</fingerprint>
|
477
|
+
|
408
478
|
<fingerprint pattern="^(?:\r|\n)*Grandstream (HT[\d-]+)\s+(?:V\d\.\d\w?\s+)?Command Shell Copyright \d\d\d\d-\d\d\d\d(?:\r|\n)+Password:\s*$">
|
409
479
|
<description>Grandstream HandyTone Analog Telephone Adapters</description>
|
410
480
|
<!-- Grandstream HT812 Command Shell Copyright 2006-2017\r\nPassword: -->
|
481
|
+
|
411
482
|
<example _encoding="base64" hw.product="HT812">
|
412
483
|
R3JhbmRzdHJlYW0gSFQ4MTIgQ29tbWFuZCBTaGVsbCBDb3B5cmlnaHQgMjAwNi0yMDE3DQpQY
|
413
484
|
XNzd29yZDoK
|
414
485
|
</example>
|
415
486
|
<!-- Grandstream HT-502 V2.0A Command Shell Copyright 2006-2014\r\nPassword: -->
|
487
|
+
|
416
488
|
<example _encoding="base64" hw.product="HT-502">
|
417
489
|
R3JhbmRzdHJlYW0gSFQtNTAyICBWMi4wQSBDb21tYW5kIFNoZWxsIENvcHlyaWdodCAyMDA2L
|
418
490
|
TIwMTQNClBhc3N3b3JkOgo=
|
@@ -422,14 +494,17 @@
|
|
422
494
|
<param pos="0" name="hw.device" value="VoIP"/>
|
423
495
|
<param pos="1" name="hw.product"/>
|
424
496
|
</fingerprint>
|
497
|
+
|
425
498
|
<fingerprint pattern="^(?:\r|\n)*Grandstream (GXW[\d-]+)\s+(?:V\d\.\d\w?\s+)?Command Shell Copyright \d\d\d\d(?:-\d\d\d\d)?(?:\r|\n)+Password:\s*$">
|
426
499
|
<description>Grandstream Analog VoIP Gateways</description>
|
427
500
|
<!-- Grandstream GXW-4008 V1.5A Command Shell Copyright 2006-2015\r\nPassword: -->
|
501
|
+
|
428
502
|
<example _encoding="base64" hw.product="GXW-4008">
|
429
503
|
R3JhbmRzdHJlYW0gR1hXLTQwMDggIFYxLjVBIENvbW1hbmQgU2hlbGwgQ29weXJpZ2h0IDIwM
|
430
504
|
DYtMjAxNQ0KUGFzc3dvcmQ6Cg==
|
431
505
|
</example>
|
432
506
|
<!-- Grandstream GXW4216 V2.3B Command Shell Copyright 2015\r\nPassword: -->
|
507
|
+
|
433
508
|
<example _encoding="base64" hw.product="GXW4216">
|
434
509
|
R3JhbmRzdHJlYW0gR1hXNDIxNiAgVjIuM0IgQ29tbWFuZCBTaGVsbCBDb3B5cmlnaHQgMjAxN
|
435
510
|
Q0KUGFzc3dvcmQ6Cg==
|
@@ -439,9 +514,11 @@
|
|
439
514
|
<param pos="0" name="hw.device" value="VoIP"/>
|
440
515
|
<param pos="1" name="hw.product"/>
|
441
516
|
</fingerprint>
|
517
|
+
|
442
518
|
<fingerprint pattern="^(?:\r|\n|\s)*Grandstream (GXV[\w-]+)\s+(?:V\d\.\d\w?\s+)?Shell Command.Copyight \d\d\d\d-\d\d\d\d(?:\r|\n)+Username:\s*$">
|
443
519
|
<description>Grandstream IP Cameras</description>
|
444
520
|
<!-- Grandstream GXV3674_FHD_VF Shell Command.Copyight 2011-2014\r\nUsername: -->
|
521
|
+
|
445
522
|
<example _encoding="base64" hw.product="GXV3674_FHD_VF">
|
446
523
|
R3JhbmRzdHJlYW0gR1hWMzY3NF9GSERfVkYgICAgU2hlbGwgQ29tbWFuZC5Db3B5aWdodCAyM
|
447
524
|
DExLTIwMTQNClVzZXJuYW1lOgo=
|
@@ -451,14 +528,17 @@
|
|
451
528
|
<param pos="0" name="hw.device" value="Web cam"/>
|
452
529
|
<param pos="1" name="hw.product"/>
|
453
530
|
</fingerprint>
|
531
|
+
|
454
532
|
<fingerprint pattern="^(?:\r|\n)*Welcome to Polycom RMX\s*(\w+) \(COP\) Console Utility(?:\r|\n)+Copyright \(C\) \d\d\d\d-\d\d\d\d POLYCOM(?:\r|\n)+Password:\s*$">
|
455
533
|
<description>Polycom Real Time Media Conferencing</description>
|
456
534
|
<!-- Welcome to Polycom RMX 500 (COP) Console Utility\r\n\rCopyright (C) 2008-2010 POLYCOM\r\n\r\r\n\rPassword: -->
|
535
|
+
|
457
536
|
<example _encoding="base64" hw.product="500">
|
458
537
|
V2VsY29tZSB0byBQb2x5Y29tIFJNWCA1MDAgKENPUCkgQ29uc29sZSBVdGlsaXR5DQoNQ29we
|
459
538
|
XJpZ2h0IChDKSAyMDA4LTIwMTAgUE9MWUNPTQ0KDQ0KDVBhc3N3b3JkOgo=
|
460
539
|
</example>
|
461
540
|
<!-- Welcome to Polycom RMX 1000C (COP) Console Utility\r\n\rCopyright (C) 2008-2012 POLYCOM\r\n\r\r\n\rPassword: -->
|
541
|
+
|
462
542
|
<example _encoding="base64" hw.product="1000C">
|
463
543
|
V2VsY29tZSB0byBQb2x5Y29tIFJNWCAxMDAwQyAoQ09QKSBDb25zb2xlIFV0aWxpdHkNCg1Db
|
464
544
|
3B5cmlnaHQgKEMpIDIwMDgtMjAxMiBQT0xZQ09NDQoNDQoNUGFzc3dvcmQ6Cg==
|
@@ -468,9 +548,11 @@
|
|
468
548
|
<param pos="0" name="hw.device" value="Video Conferencing"/>
|
469
549
|
<param pos="1" name="hw.product"/>
|
470
550
|
</fingerprint>
|
551
|
+
|
471
552
|
<fingerprint pattern="^(?:\r|\n)*Hi, my name is :\s+[\w.\s-]+(?:\r|\n)+Here is what I know about myself:(?:\r|\n)+Model:\s+VSX (\w+)(?:\r|\n)+Serial Number:\s+(\w+)(?:\r|\n)+Software Version:\s+Release ([\d.-]+)\s">
|
472
553
|
<description>Polycom Video Conferencing - VSX Family</description>
|
473
554
|
<!-- Hi, my name is : Something Pity\r\nHere is what I know about myself:\r\nModel: VSX 6000A\r\nSerial Number: 00070906FC34F6\r\nSoftware Version: Release 9.0.6.2-103 - 04Sep2011 21:27\r\nBuild Information: ecomman -->
|
555
|
+
|
474
556
|
<example _encoding="base64" hw.product="6000A" host.id="00070906FC34F6" os.version="9.0.6.2-103">
|
475
557
|
SGksIG15IG5hbWUgaXMgOiAgICAgU29tZXRoaW5nIFBpdHkNCkhlcmUgaXMgd2hhdCBJIGtub
|
476
558
|
3cgYWJvdXQgbXlzZWxmOg0KTW9kZWw6ICAgICAgICAgICAgICAgVlNYIDYwMDBBDQpTZXJpYW
|
@@ -485,9 +567,11 @@
|
|
485
567
|
<param pos="2" name="host.id"/>
|
486
568
|
<param pos="3" name="os.version"/>
|
487
569
|
</fingerprint>
|
570
|
+
|
488
571
|
<fingerprint pattern="Polycom Command Shell(?:\r|\n)+XCOM host:\s+localhost port: \d+">
|
489
572
|
<description>Polycom Diagnotic Service</description>
|
490
573
|
<!-- Polycom Command Shell\r\r\nXCOM host: localhost port: 4121\r\r\nTTY name: /dev/pts/0\r\r\nSession type: telnet\r\r\nNCF\r\nNCF\r\n2018-08-15 18:03:10 DEBUG -->
|
574
|
+
|
491
575
|
<example _encoding="base64">
|
492
576
|
UG9seWNvbSBDb21tYW5kIFNoZWxsDQ0KWENPTSBob3N0OiAgICBsb2NhbGhvc3QgcG9ydDogN
|
493
577
|
DEyMQ0NClRUWSBuYW1lOiAgICAgL2Rldi9wdHMvMA0NClNlc3Npb24gdHlwZTogdGVsbmV0DQ
|
@@ -496,9 +580,11 @@
|
|
496
580
|
<param pos="0" name="hw.vendor" value="Polycom"/>
|
497
581
|
<param pos="0" name="hw.device" value="Video Conferencing"/>
|
498
582
|
</fingerprint>
|
583
|
+
|
499
584
|
<fingerprint pattern="^Welcome to the Windows CE Telnet Service on (WEBBOX[\w.-]+)(?:\r|\n)+login:\s*$">
|
500
585
|
<description>Sunny WebBox Windows CE</description>
|
501
586
|
<!-- Welcome to the Windows CE Telnet Service on WEBBOX150000000\r\n\r\nlogin: -->
|
587
|
+
|
502
588
|
<example _encoding="base64" host.name="WEBBOX150000000">
|
503
589
|
V2VsY29tZSB0byB0aGUgV2luZG93cyBDRSBUZWxuZXQgU2VydmljZSBvbiBXRUJCT1gxNTAwM
|
504
590
|
DAwMDANCg0KbG9naW46Cg==
|
@@ -513,9 +599,11 @@
|
|
513
599
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_ce:-"/>
|
514
600
|
<param pos="1" name="host.name"/>
|
515
601
|
</fingerprint>
|
602
|
+
|
516
603
|
<fingerprint pattern="^Welcome to the Windows CE Telnet Service on ([\w.-]+)(?:\r|\n)+login:\s*$">
|
517
604
|
<description>Windows CE</description>
|
518
605
|
<!-- Welcome to the Windows CE Telnet Service on MY-CE-DEVICE\r\n\r\nlogin: -->
|
606
|
+
|
519
607
|
<example _encoding="base64" host.name="MY-CE-DEVICE">
|
520
608
|
V2VsY29tZSB0byB0aGUgV2luZG93cyBDRSBUZWxuZXQgU2VydmljZSBvbiBNWS1DRS1ERVZJQ
|
521
609
|
0UNCg0KbG9naW46Cg==
|
@@ -526,15 +614,18 @@
|
|
526
614
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_ce:-"/>
|
527
615
|
<param pos="1" name="host.name"/>
|
528
616
|
</fingerprint>
|
617
|
+
|
529
618
|
<fingerprint pattern="^(?:\r|\n)*HP JetDirect(?:\r|\n)+$">
|
530
619
|
<description>HP Printer - Jet Direct</description>
|
531
620
|
<!-- HP JetDirect\r\nPassword is not set\r\n\r\nPlease type "menu" for the MENU system, \r\nor "?" for help, or "/" for current settings.\r\n> -->
|
621
|
+
|
532
622
|
<example _encoding="base64">
|
533
623
|
SFAgSmV0RGlyZWN0DQpQYXNzd29yZCBpcyBub3Qgc2V0DQoNClBsZWFzZSB0eXBlICJtZW51I
|
534
624
|
iBmb3IgdGhlIE1FTlUgc3lzdGVtLCANCm9yICI/IiBmb3IgaGVscCwgb3IgIi8iIGZvciBjdX
|
535
625
|
JyZW50IHNldHRpbmdzLg0KPgo=
|
536
626
|
</example>
|
537
627
|
<!-- HP JetDirect\r\n\r\nEnter username: -->
|
628
|
+
|
538
629
|
<example _encoding="base64">SFAgSmV0RGlyZWN0DQoNCkVudGVyIHVzZXJuYW1lOgo=</example>
|
539
630
|
<param pos="0" name="service.vendor" value="HP"/>
|
540
631
|
<param pos="0" name="service.product" value="JetDirect"/>
|
@@ -548,16 +639,20 @@
|
|
548
639
|
<param pos="0" name="hw.product" value="JetDirect"/>
|
549
640
|
<param pos="0" name="hw.device" value="Printer"/>
|
550
641
|
</fingerprint>
|
642
|
+
|
551
643
|
<fingerprint pattern="^(?:\r|\n)*%connection closed by remote host!(?:\x00)?$">
|
552
644
|
<description>HP switch blocking connection using network ACL</description>
|
553
645
|
<!-- %connection closed by remote host! -->
|
646
|
+
|
554
647
|
<example _encoding="base64">JWNvbm5lY3Rpb24gY2xvc2VkIGJ5IHJlbW90ZSBob3N0IQ==</example>
|
555
648
|
<param pos="0" name="hw.vendor" value="HP"/>
|
556
649
|
<param pos="0" name="hw.device" value="Switch"/>
|
557
650
|
</fingerprint>
|
651
|
+
|
558
652
|
<fingerprint pattern="^(?:\r|\n)*Welcome Visiting Huawei Home Gateway\r\nCopyright by Huawei Technologies Co., Ltd.\r\n\r\nLogin:$">
|
559
653
|
<description>Huawei HG series Home Gateway routers</description>
|
560
654
|
<!-- Welcome Visiting Huawei Home Gateway\r\nCopyright by Huawei Technologies Co., Ltd.\r\n\r\nLogin: -->
|
655
|
+
|
561
656
|
<example _encoding="base64">
|
562
657
|
V2VsY29tZSBWaXNpdGluZyBIdWF3ZWkgSG9tZSBHYXRld2F5DQpDb3B5cmlnaHQgYnkgSHVhd
|
563
658
|
2VpIFRlY2hub2xvZ2llcyBDby4sIEx0ZC4NCg0KTG9naW46Cg==
|
@@ -565,9 +660,11 @@
|
|
565
660
|
<param pos="0" name="hw.vendor" value="Huawei"/>
|
566
661
|
<param pos="0" name="hw.device" value="Router"/>
|
567
662
|
</fingerprint>
|
663
|
+
|
568
664
|
<fingerprint pattern="^(?:\r|\n)*Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.(?:(?:\r|\n)+Login authentication)?(?:\r|\n)+Username:$">
|
569
665
|
<description>Huawei Router</description>
|
570
666
|
<!-- Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.\r\n\r\nLogin authentication\r\n\r\n\r\nUsername: -->
|
667
|
+
|
571
668
|
<example _encoding="base64">
|
572
669
|
V2FybmluZzogVGVsbmV0IGlzIG5vdCBhIHNlY3VyZSBwcm90b2NvbCwgYW5kIGl0IGlzIHJlY
|
573
670
|
29tbWVuZGVkIHRvIHVzZSBTdGVsbmV0Lg0KDQpMb2dpbiBhdXRoZW50aWNhdGlvbg0KDQoNCl
|
@@ -576,10 +673,13 @@
|
|
576
673
|
<param pos="0" name="hw.vendor" value="Huawei"/>
|
577
674
|
<param pos="0" name="hw.device" value="Router"/>
|
578
675
|
</fingerprint>
|
676
|
+
|
579
677
|
<fingerprint pattern="^(?:\r|\n)*(?:% Password expiration warning.\r\n)?-+\r\nCisco Configuration Professional \(Cisco CP\) is installed on this device. \r\nThis feature requires the one-time use of the username">
|
580
678
|
<description>Cisco router - Cisco Configuration Pro variant</description>
|
581
679
|
<!-- There are are roughly 69 dash characters before the CRLF in the banner below but can't be included in XML comments. -->
|
680
|
+
|
582
681
|
<!-- \r\nCisco Configuration Professional (Cisco CP) is installed on this device. \r\nThis feature requires the one-time use of the username -->
|
682
|
+
|
583
683
|
<example _encoding="base64">
|
584
684
|
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
|
585
685
|
S0tLS0tLS0tLS0tLS0tLS0NCkNpc2NvIENvbmZpZ3VyYXRpb24gUHJvZmVzc2lvbmFsIChDaX
|
@@ -595,10 +695,13 @@
|
|
595
695
|
<param pos="0" name="hw.vendor" value="Cisco"/>
|
596
696
|
<param pos="0" name="hw.device" value="Router"/>
|
597
697
|
</fingerprint>
|
698
|
+
|
598
699
|
<fingerprint pattern="^(?m)(?:\r|\n)*Catalyst 1900 Management Console(?:\r|\n)+.*Ethernet Address:\s+([\w-]+)(?:\r|\n)+.*Model Number:\s+([\w-]+)(?:\r|\n)+System Serial Number:\s+(\w+)(?:\r|\n)+Power Supply" flags="REG_MULTILINE">
|
599
700
|
<description>Cisco Catalyst 1900</description>
|
600
701
|
<!-- Catalyst 1900, unlike other Catalyst models, didn't run CatOS or IOS -->
|
702
|
+
|
601
703
|
<!-- Catalyst 1900 Management Console\r\nCopyright (c) Cisco Systems, Inc. 1993-1998\r\nAll rights reserved.\r\nEnterprise Edition Software\r\nEthernet Address: 00-AA-19-38-AA-00\r\n\r\nPCA Number: 73-31AA-AA\r\nPCA Serial Number: FAB033AAAAA\r\nModel Number: WS-C1924-EN\r\nSystem Serial Number: FAB0341AAAA\r\nPower Supply S/N: -->
|
704
|
+
|
602
705
|
<example _encoding="base64" host.mac="00-AA-19-38-AA-00" hw.model="WS-C1924-EN" host.id="FAB0341AAAA">
|
603
706
|
Q2F0YWx5c3QgMTkwMCBNYW5hZ2VtZW50IENvbnNvbGUNCkNvcHlyaWdodCAoYykgQ2lzY28gU
|
604
707
|
3lzdGVtcywgSW5jLiAgMTk5My0xOTk4DQpBbGwgcmlnaHRzIHJlc2VydmVkLg0KRW50ZXJwcm
|
@@ -618,15 +721,18 @@
|
|
618
721
|
<param pos="2" name="hw.model"/>
|
619
722
|
<param pos="3" name="host.id"/>
|
620
723
|
</fingerprint>
|
724
|
+
|
621
725
|
<fingerprint pattern="^192.0.0.64 login:\s*$">
|
622
726
|
<description>Hikvision cameras and NVRs (multiple)</description>
|
623
727
|
<example>192.0.0.64 login:</example>
|
624
728
|
<param pos="0" name="os.vendor" value="Hikvision"/>
|
625
729
|
<param pos="0" name="hw.vendor" value="Hikvision"/>
|
626
730
|
</fingerprint>
|
731
|
+
|
627
732
|
<fingerprint pattern="^Remote Management Console\r\nlogin:\s*$">
|
628
733
|
<description>Juniper Netscreen</description>
|
629
734
|
<!-- Remote Management Console\r\nlogin: -->
|
735
|
+
|
630
736
|
<example _encoding="base64">UmVtb3RlIE1hbmFnZW1lbnQgQ29uc29sZQ0KbG9naW46Cg==</example>
|
631
737
|
<param pos="0" name="os.vendor" value="Juniper"/>
|
632
738
|
<param pos="0" name="os.device" value="Firewall"/>
|
@@ -637,6 +743,7 @@
|
|
637
743
|
<param pos="0" name="hw.device" value="Firewall"/>
|
638
744
|
<param pos="0" name="hw.product" value="NetScreen"/>
|
639
745
|
</fingerprint>
|
746
|
+
|
640
747
|
<fingerprint pattern="^(?:\r|\n)*(FGT\w{13}) login:\s*$">
|
641
748
|
<description>Fortinet FortiGate - w/ autogenerated hostname</description>
|
642
749
|
<example host.name="FGT60C3G13001111">FGT60C3G13001111 login:</example>
|
@@ -650,6 +757,7 @@
|
|
650
757
|
<param pos="0" name="hw.device" value="Firewall"/>
|
651
758
|
<param pos="1" name="host.name"/>
|
652
759
|
</fingerprint>
|
760
|
+
|
653
761
|
<fingerprint pattern="^(?:\r|\n)*KWS-1043N login:\s*$">
|
654
762
|
<description>Clipcomm KWS router</description>
|
655
763
|
<example hw.product="KWS-1043N">KWS-1043N login:</example>
|
@@ -657,6 +765,7 @@
|
|
657
765
|
<param pos="0" name="hw.device" value="Router"/>
|
658
766
|
<param pos="0" name="hw.product" value="KWS-1043N"/>
|
659
767
|
</fingerprint>
|
768
|
+
|
660
769
|
<fingerprint pattern="^(?:\r|\n)*(SMCD3\w+-\w\w\w) login:\s*$">
|
661
770
|
<description>SMC Cable Modem</description>
|
662
771
|
<example hw.product="SMCD3GN2-BIZ">SMCD3GN2-BIZ login:</example>
|
@@ -664,6 +773,7 @@
|
|
664
773
|
<param pos="0" name="hw.device" value="Cable Modem"/>
|
665
774
|
<param pos="1" name="hw.product"/>
|
666
775
|
</fingerprint>
|
776
|
+
|
667
777
|
<fingerprint pattern="^(?:\r|\n)*ADB-4820CD login:\s*$">
|
668
778
|
<description>ADB ADB-4820CD DVR</description>
|
669
779
|
<example>ADB-4820CD login:</example>
|
@@ -671,6 +781,7 @@
|
|
671
781
|
<param pos="0" name="hw.device" value="DVR"/>
|
672
782
|
<param pos="0" name="hw.product" value="ADB-4820CD"/>
|
673
783
|
</fingerprint>
|
784
|
+
|
674
785
|
<fingerprint pattern="^(?:\r|\n)*IMDVRS login:\s*$">
|
675
786
|
<description>Rifatron IMDVRS DVR</description>
|
676
787
|
<example>IMDVRS login:</example>
|
@@ -678,41 +789,51 @@
|
|
678
789
|
<param pos="0" name="hw.family" value="IMDVR"/>
|
679
790
|
<param pos="0" name="hw.device" value="DVR"/>
|
680
791
|
</fingerprint>
|
792
|
+
|
681
793
|
<fingerprint pattern="^(?:\r|\n)*Ruijie login:\s*$">
|
682
794
|
<description>Ruijie device (likely router/switch)</description>
|
683
795
|
<example>Ruijie login:</example>
|
684
796
|
<param pos="0" name="hw.vendor" value="Ruijie"/>
|
685
797
|
</fingerprint>
|
798
|
+
|
686
799
|
<fingerprint pattern="^Welcome to Microsoft Telnet Service \r\n\n\rlogin:\s*$">
|
687
800
|
<description>Microsoft Windows</description>
|
688
801
|
<!-- Welcome to Microsoft Telnet Service \r\n\n\rlogin: -->
|
802
|
+
|
689
803
|
<example _encoding="base64">V2VsY29tZSB0byBNaWNyb3NvZnQgVGVsbmV0IFNlcnZpY2UgDQoKDWxvZ2luOgo=</example>
|
690
804
|
<param pos="0" name="os.vendor" value="Microsoft"/>
|
691
805
|
<param pos="0" name="os.family" value="Windows"/>
|
692
806
|
<param pos="0" name="os.product" value="Windows"/>
|
693
807
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
694
808
|
</fingerprint>
|
809
|
+
|
695
810
|
<!-- The following fingerprints are for generic Broadcom hardware where the
|
696
811
|
vendor has left the default banner in place. These could be rebadged by
|
697
812
|
ZTE, CenturyLink, Sky, Huawei, etc.
|
698
813
|
-->
|
814
|
+
|
699
815
|
<fingerprint pattern="^(BCM\d+) (?:Broadband|ADSL|xDSL|DSL) Router\r\nLogin:\s*">
|
700
816
|
<description>OEM'd Broadcom Router</description>
|
701
817
|
<!-- BCM963268 Broadband Router\r\nLogin: -->
|
818
|
+
|
702
819
|
<example _encoding="base64" hw.product="BCM963268">QkNNOTYzMjY4IEJyb2FkYmFuZCBSb3V0ZXINCkxvZ2luOgo=</example>
|
703
820
|
<param pos="0" name="hw.device" value="Router"/>
|
704
821
|
<param pos="1" name="hw.product"/>
|
705
822
|
</fingerprint>
|
823
|
+
|
706
824
|
<fingerprint pattern="^(BCM\d+) Broadband Router\r\nTelnet is Disabled in WAN Side$">
|
707
825
|
<description>OEM'd Broadcom Router - telnet disabled on WAN side</description>
|
708
826
|
<!-- BCM963268 Broadband Router\r\nTelnet is Disabled in WAN Side -->
|
827
|
+
|
709
828
|
<example _encoding="base64" hw.product="BCM963268">QkNNOTYzMjY4IEJyb2FkYmFuZCBSb3V0ZXINClRlbG5ldCBpcyBEaXNhYmxlZCBpbiBXQU4gU2lkZQo=</example>
|
710
829
|
<param pos="0" name="hw.device" value="Router"/>
|
711
830
|
<param pos="1" name="hw.product"/>
|
712
831
|
</fingerprint>
|
832
|
+
|
713
833
|
<fingerprint pattern="^(?m)(BCM\d+) Broadband Router\r\n.*Please input the verification code:$" flags="REG_MULTILINE">
|
714
834
|
<description>OEM'd Broadcom Router - input validation code</description>
|
715
835
|
<!-- BCM96318 Broadband Router\r\n====================================================\r\n * * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * \r\n * * * * * \r\n * * * * * \r\n * * * * * * * * * * * * * * * * \r\n====================================================\r\nPlease input the verification code: -->
|
836
|
+
|
716
837
|
<example _encoding="base64" hw.product="BCM96318">
|
717
838
|
QkNNOTYzMTggQnJvYWRiYW5kIFJvdXRlcg0KPT09PT09PT09PT09PT09PT09PT09PT09PT09P
|
718
839
|
T09PT09PT09PT09PT09PT09PT09PT09PQ0KICAgICogKiAgICAgICAgICogKiAqICogICAgIC
|
@@ -728,9 +849,11 @@
|
|
728
849
|
<param pos="0" name="hw.device" value="Router"/>
|
729
850
|
<param pos="1" name="hw.product"/>
|
730
851
|
</fingerprint>
|
852
|
+
|
731
853
|
<fingerprint pattern="^(BCM\d+) Broadband Router\r\nMaximum number of incorrect account entries exceeded.">
|
732
854
|
<description>OEM'd Broadcom Router - Max incorrect tries - variant 1</description>
|
733
855
|
<!-- BCM96328 Broadband Router\r\nMaximum number of incorrect account entries exceeded. -->
|
856
|
+
|
734
857
|
<example _encoding="base64" hw.product="BCM96328">
|
735
858
|
QkNNOTYzMjggQnJvYWRiYW5kIFJvdXRlcg0KTWF4aW11bSBudW1iZXIgb2YgaW5jb3JyZWN0I
|
736
859
|
GFjY291bnQgZW50cmllcyBleGNlZWRlZC4K
|
@@ -738,9 +861,11 @@
|
|
738
861
|
<param pos="0" name="hw.device" value="Router"/>
|
739
862
|
<param pos="1" name="hw.product"/>
|
740
863
|
</fingerprint>
|
864
|
+
|
741
865
|
<fingerprint pattern="^(BCM\d+) Broadband Router\r\nSorry, you need to wait for \d+ second before next login attempt.(?:\r|\n)*">
|
742
866
|
<description>OEM'd Broadcom Router - Max incorrect tries - variant 2</description>
|
743
867
|
<!-- BCM96816 Broadband Router\r\nSorry, you need to wait for 119 second before next login attempt. -->
|
868
|
+
|
744
869
|
<example _encoding="base64" hw.product="BCM96816">
|
745
870
|
QkNNOTY4MTYgQnJvYWRiYW5kIFJvdXRlcg0KU29ycnksIHlvdSBuZWVkIHRvIHdhaXQgZm9yI
|
746
871
|
DExOSBzZWNvbmQgYmVmb3JlIG5leHQgbG9naW4gYXR0ZW1wdC4K
|
@@ -748,10 +873,13 @@
|
|
748
873
|
<param pos="0" name="hw.device" value="Router"/>
|
749
874
|
<param pos="1" name="hw.product"/>
|
750
875
|
</fingerprint>
|
876
|
+
|
751
877
|
<!-- Moxa Industrial Solutions-->
|
878
|
+
|
752
879
|
<fingerprint pattern="^(?:\r|\n)*NPort (NP6[\w-]+)(?:\r|\n|\x00)+Console terminal type">
|
753
880
|
<description>Moxa NPort Terminal Server - 6xxx Series</description>
|
754
881
|
<!-- NPort NP6610-32\r\u0000\nConsole terminal type (1: ansi/vt100, 2: vt52) : 1 -->
|
882
|
+
|
755
883
|
<example _encoding="base64" hw.product="NP6610-32">
|
756
884
|
TlBvcnQgTlA2NjEwLTMyDQAKQ29uc29sZSB0ZXJtaW5hbCB0eXBlICgxOiBhbnNpL3Z0MTAwLC
|
757
885
|
AyOiB2dDUyKSA6IDE=
|
@@ -761,9 +889,11 @@
|
|
761
889
|
<param pos="0" name="hw.device" value="Device Server"/>
|
762
890
|
<param pos="1" name="hw.product"/>
|
763
891
|
</fingerprint>
|
892
|
+
|
764
893
|
<fingerprint pattern="^Model name\s+: NPort (IA-\d+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+System uptime">
|
765
894
|
<description>Moxa NPort Device Server - IA Series</description>
|
766
895
|
<!-- Model name : NPort IA-5250\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 281\r\u0000\nFirmware version : 1.6 Build 17060616\r\u0000\nSystem uptime : 31 days, 06h:03m:45s\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
896
|
+
|
767
897
|
<example _encoding="base64" hw.product="IA-5250" host.mac="00:90:E8:AA:AA:AA" host.id="281" os.version="1.6" os.version.version="17060616">
|
768
898
|
TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IElBLTUyNTANAApNQUMgYWRkcmVzcyAgICAgIDogM
|
769
899
|
DA6OTA6RTg6QUE6QUE6QUENAApTZXJpYWwgTm8uICAgICAgIDogMjgxDQAKRmlybXdhcmUgdm
|
@@ -779,10 +909,13 @@
|
|
779
909
|
<param pos="4" name="os.version"/>
|
780
910
|
<param pos="5" name="os.version.version"/>
|
781
911
|
</fingerprint>
|
912
|
+
|
782
913
|
<fingerprint pattern="^(?:\r|\n|\x00|-)*Model name\s+: NPort (5[\w-]+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
|
783
914
|
<description>Moxa NPort Device Server - 5xxx Series</description>
|
784
915
|
<!-- Some versions of the banner below have a line full of dashes which cannot be included in the example comment -->
|
916
|
+
|
785
917
|
<!-- Model name : NPort 5610-8-DT\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9522\r\u0000\nFirmware version : 2.2 Build 11090613\r\u0000\nSystem uptime : 8 days, 02h:11m:44s\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
918
|
+
|
786
919
|
<example _encoding="base64" hw.product="5610-8-DT" host.mac="00:90:E8:AA:AA:AA" host.id="9522" os.version="2.2" os.version.version="11090613">
|
787
920
|
TW9kZWwgbmFtZSAgICAgICA6IE5Qb3J0IDU2MTAtOC1EVA0ACk1BQyBhZGRyZXNzICAgICAgO
|
788
921
|
iAwMDo5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NTIyDQAKRmlybXdhcm
|
@@ -798,9 +931,11 @@
|
|
798
931
|
<param pos="4" name="os.version"/>
|
799
932
|
<param pos="5" name="os.version.version"/>
|
800
933
|
</fingerprint>
|
934
|
+
|
801
935
|
<fingerprint pattern="^Model name\s+: MGate (MB3[\w-]+)(?:\r|\n|\x00|)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version : ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
|
802
936
|
<description>Moxa MGate Modbus Gateway</description>
|
803
937
|
<!-- Model name : MGate MB3180\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No. : 9474\r\u0000\nFirmware version : 1.2 Build 09101913\r\u0000\nSystem uptime : 15 days, 16h:37m:48s\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
938
|
+
|
804
939
|
<example _encoding="base64" hw.product="MB3180" host.mac="00:90:E8:AA:AA:AA" host.id="9474" os.version="1.2" os.version.version="09101913">
|
805
940
|
TW9kZWwgbmFtZSAgICAgICA6IE1HYXRlIE1CMzE4MA0ACk1BQyBhZGRyZXNzICAgICAgOiAwM
|
806
941
|
Do5MDpFODpBQTpBQTpBQQ0AClNlcmlhbCBOby4gICAgICAgOiA5NDc0DQAKRmlybXdhcmUgdm
|
@@ -816,9 +951,11 @@
|
|
816
951
|
<param pos="4" name="os.version"/>
|
817
952
|
<param pos="5" name="os.version.version"/>
|
818
953
|
</fingerprint>
|
954
|
+
|
819
955
|
<fingerprint pattern="^Model name\s+: (NE[\w-]+)(?:\r|\n|\x00)+MAC address\s+: ([\w:]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+">
|
820
956
|
<description>Moxa NE Series Embedded device server</description>
|
821
957
|
<!-- Model name : NE-4110S\r\u0000\nMAC address : 00:90:E8:AA:AA:AA\r\u0000\nSerial No : 3616\r\u0000\nFirmware version : 4.1 Build 07061517\r\u0000\n\r\u0000\nPlease keyin your password: -->
|
958
|
+
|
822
959
|
<example _encoding="base64" hw.product="NE-4110S" host.mac="00:90:E8:AA:AA:AA" host.id="3616" os.version="4.1" os.version.version="07061517">
|
823
960
|
TW9kZWwgbmFtZSAgICAgICA6IE5FLTQxMTBTDQAKTUFDIGFkZHJlc3MgICAgICA6IDAwOjkwO
|
824
961
|
kU4OkFBOkFBOkFBDQAKU2VyaWFsIE5vICAgICAgICA6IDM2MTYNAApGaXJtd2FyZSB2ZXJzaW
|
@@ -833,25 +970,29 @@
|
|
833
970
|
<param pos="4" name="os.version"/>
|
834
971
|
<param pos="5" name="os.version.version"/>
|
835
972
|
</fingerprint>
|
973
|
+
|
836
974
|
<fingerprint pattern="^Red Hat Linux release ([^\\s]+)\\s*.*$">
|
837
975
|
<description>RedHat general purpose linux</description>
|
838
976
|
<!-- Red Hat Linux release 9 (Shrike)\nKernel 2.4.20-8 on an i686\nlogin: -->
|
977
|
+
|
839
978
|
<example _encoding="base64" os.version="9 (Shrike)">
|
840
979
|
UmVkIEhhdCBMaW51eCByZWxlYXNlIDkgKFNocmlrZSlcbktlcm5lbCAyLjQuMjAtOCBvbiBhbiBpNjg2XG5sb2dpbjo=
|
841
980
|
</example>
|
842
|
-
<param pos="0" name="os.vendor" value="
|
981
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
843
982
|
<param pos="0" name="os.family" value="Linux"/>
|
844
983
|
<param pos="0" name="os.device" value="Linux"/>
|
845
984
|
<param pos="1" name="os.version"/>
|
846
985
|
</fingerprint>
|
986
|
+
|
847
987
|
<fingerprint pattern="^(?m)Red Hat Enterprise Linux ES release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
|
848
988
|
<description>RedHat Enterprise Linux ES</description>
|
849
989
|
<!-- Red Hat Enterprise Linux ES release 3 (Taroon Update 9\nKernel 2.4.21-47.EL on an x86_64\nlogin: -->
|
990
|
+
|
850
991
|
<example _encoding="base64" os.version="3" linux.kernel.version="2.4.21-47.EL" os.arch="x86_64">
|
851
992
|
UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IEVTIHJlbGVhc2UgMyAoVGFyb29uIFVwZGF0ZSA5KQpLZXJuZWwgMi40LjIxLTQ3Lk
|
852
993
|
VMIG9uIGFuIHg4Nl82NApsb2dpbjo=
|
853
994
|
</example>
|
854
|
-
<param pos="0" name="os.vendor" value="
|
995
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
855
996
|
<param pos="0" name="os.family" value="Linux"/>
|
856
997
|
<param pos="0" name="os.product" value="Linux"/>
|
857
998
|
<param pos="1" name="os.version"/>
|
@@ -859,41 +1000,47 @@
|
|
859
1000
|
<param pos="3" name="os.arch"/>
|
860
1001
|
<param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:{os.version}"/>
|
861
1002
|
</fingerprint>
|
1003
|
+
|
862
1004
|
<fingerprint pattern="^(?m)Red Hat Enterprise Linux AS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d)" flags="REG_MULTILINE">
|
863
1005
|
<description>RedHat Enterprise Linux AS</description>
|
864
1006
|
<!-- Red Hat Enterprise Linux AS release 5.8 (Tikanga)\nKernel 2.6.18-308.11.1.el5 on an x86_64\nlogin: -->
|
1007
|
+
|
865
1008
|
<example _encoding="base64" os.version="5.8" linux.kernel.version="2.6.18-308.11.1.el5" os.arch="x86_64">
|
866
1009
|
UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IEFTIHJlbGVhc2UgNS44IChUaWthbmdhKQpLZXJuZWwgM
|
867
1010
|
i42LjE4LTMwOC4xMS4xLmVsNSBvbiBhbiB4ODZfNjQKbG9naW46
|
868
1011
|
</example>
|
869
|
-
<param pos="0" name="os.vendor" value="
|
1012
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
870
1013
|
<param pos="0" name="os.family" value="Linux"/>
|
871
1014
|
<param pos="0" name="os.product" value="RedHat Enterprise AS"/>
|
872
1015
|
<param pos="1" name="os.version"/>
|
873
1016
|
<param pos="2" name="linux.kernel.version"/>
|
874
1017
|
<param pos="3" name="os.arch"/>
|
875
1018
|
</fingerprint>
|
1019
|
+
|
876
1020
|
<fingerprint pattern="^(?m)Red Hat Enterprise Linux WS release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*)" flags="REG_MULTILINE">
|
877
1021
|
<description>RedHat Enterprise Linux WS</description>
|
878
1022
|
<!--Red Hat Enterprise Linux WS release 2.1 (Tampa) \nKernel 2.4.9-e.40smp on an i686 \nlogin: -->
|
1023
|
+
|
879
1024
|
<example _encoding="base64" os.version="2.1" linux.kernel.version="2.4.9-e.40smp" os.arch="i686">
|
880
1025
|
UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IFdTIHJlbGVhc2UgMi4xIChUYW1wY
|
881
1026
|
SkgCktlcm5lbCAyLjQuOS1lLjQwc21wIG9uIGFuIGk2ODYgCmxvZ2luOiA=
|
882
1027
|
</example>
|
883
|
-
<param pos="0" name="os.vendor" value="
|
1028
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
884
1029
|
<param pos="0" name="os.family" value="Linux"/>
|
885
1030
|
<param pos="0" name="os.product" value="RedHat Enterprise WS"/>
|
886
1031
|
<param pos="1" name="os.version"/>
|
887
1032
|
<param pos="2" name="linux.kernel.version"/>
|
888
1033
|
<param pos="3" name="os.arch"/>
|
889
1034
|
</fingerprint>
|
1035
|
+
|
890
1036
|
<fingerprint pattern="^(?m)Fedora Core.release (.*) \(.*\).*Kernel (.*) on a[^ ]* ([^ ]*\d).*$" flags="REG_MULTILINE">
|
891
1037
|
<description>Fedora Core Release</description>
|
892
1038
|
<!-- Fedora Core release 1 (Yarrow)\nKernel 2.4.20-13.9ensim-3.5.0-13 on an i686\nlogin:-->
|
1039
|
+
|
893
1040
|
<example _encoding="base64" os.version="1" linux.kernel.version="2.4.20-13.9ensim-3.5.0-13" os.arch="i686">
|
894
1041
|
RmVkb3JhIENvcmUgcmVsZWFzZSAxIChZYXJyb3cpCktlcm5lbCAyLjQuMjAtMTMuOWVuc2ltLTMuNS4wLTEzIG9uIGFuIGk2ODYKbG9naW46
|
895
1042
|
</example>
|
896
|
-
<param pos="0" name="os.vendor" value="
|
1043
|
+
<param pos="0" name="os.vendor" value="Red Hat"/>
|
897
1044
|
<param pos="0" name="os.family" value="Linux"/>
|
898
1045
|
<param pos="0" name="os.product" value="Fedora"/>
|
899
1046
|
<param pos="1" name="os.version"/>
|
@@ -901,9 +1048,11 @@
|
|
901
1048
|
<param pos="3" name="os.arch"/>
|
902
1049
|
<param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora:{os.version}"/>
|
903
1050
|
</fingerprint>
|
1051
|
+
|
904
1052
|
<fingerprint pattern="^(?m)Welcome to SuSE Linux (.*) \(([^\)]+)\) - Kernel (.*) .*">
|
905
1053
|
<description>SuSE Linux</description>
|
906
1054
|
<!-- Welcome to SuSE Linux 7.0 (i386) - Kernel 2.2.16-RAID (0). 2VG029037\n\nlogin: -->
|
1055
|
+
|
907
1056
|
<example _encoding="base64" os.version="7.0" os.arch="i386" linux.kernel.version="2.2.16-RAID (0). 2VG029037">
|
908
1057
|
V2VsY29tZSB0byBTdVNFIExpbnV4IDcuMCAoaTM4NikgLSBLZXJuZWwgMi4yLjE2LVJBSUQgKDApLiAyVkcwMjkwMzcgCgpsb2dpbjo=
|
909
1058
|
</example>
|
@@ -915,9 +1064,11 @@
|
|
915
1064
|
<param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:{os.version}"/>
|
916
1065
|
<param pos="3" name="linux.kernel.version"/>
|
917
1066
|
</fingerprint>
|
1067
|
+
|
918
1068
|
<fingerprint pattern="^Turbolinux ApplianceServer (\d+\.\d+).*">
|
919
1069
|
<description>Turbolinux ApplianceServer</description>
|
920
1070
|
<!--Turbolinux ApplianceServer 4.0 (Atlas2) Linux 2.6.32-431.23.3.el6.x86_64 on a x86_64\n(senyo191x89.digitalink.ne.jp) TTY: 12:15 on Tuesday, 02 October 2018 login: -->
|
1071
|
+
|
921
1072
|
<example _encoding="base64" os.version="4.0">
|
922
1073
|
VHVyYm9saW51eCBBcHBsaWFuY2VTZXJ2ZXIgNC4wIChBdGxhczIpIExpbnV4IDIuNi4zMi00MzEuMjMuMy5lbDYueDg
|
923
1074
|
2XzY0IG9uIGEgeDg2XzY0IChzZW55bzE5MXg4OS5kaWdpdGFsaW5rLm5lLmpwKSBUVFk6IDEyOjE1IG9uIFR1ZXNkYX
|
@@ -928,9 +1079,11 @@
|
|
928
1079
|
<param pos="0" name="os.product" value="Linux"/>
|
929
1080
|
<param pos="1" name="os.version"/>
|
930
1081
|
</fingerprint>
|
1082
|
+
|
931
1083
|
<fingerprint pattern="^UnixWare ([^ ]+).*$">
|
932
1084
|
<description>UnixWare</description>
|
933
1085
|
<!-- UnixWare 2.1.3 (profil) (pts/3)\n\n\nlogin: -->
|
1086
|
+
|
934
1087
|
<example _encoding="base64" os.version="2.1.3">
|
935
1088
|
VW5peFdhcmUgMi4xLjMgKHByb2ZpbCkgKHB0cy8zKQoKCgpsb2dpbjog
|
936
1089
|
</example>
|
@@ -940,9 +1093,11 @@
|
|
940
1093
|
<param pos="0" name="os.product" value="UnixWare"/>
|
941
1094
|
<param pos="1" name="os.version"/>
|
942
1095
|
</fingerprint>
|
1096
|
+
|
943
1097
|
<fingerprint pattern="^Telnet Server Build (5.*)">
|
944
1098
|
<description>Windows 2000</description>
|
945
1099
|
<!--Microsoft (R) Windows NT (TM) Version 4.00 (Build 1381)\nWelcome to Microsoft Telnet Service \nTelnet Server Build 5.00.99034.1\nlogin: -->
|
1100
|
+
|
946
1101
|
<example _encoding="base64" os.version="5.00.99034.1">
|
947
1102
|
TWljcm9zb2Z0IChSKSBXaW5kb3dzIE5UIChUTSkgVmVyc2lvbiA0LjAwIChCdWlsZCAxMzgxKQpXZWxj
|
948
1103
|
b21lIHRvIE1pY3Jvc29mdCBUZWxuZXQgU2VydmljZSAKVGVsbmV0IFNlcnZlciBCdWlsZCA1LjAwLjk5MDM0LjEKCmxvZ2luOiA=
|
@@ -953,9 +1108,11 @@
|
|
953
1108
|
<param pos="1" name="os.version"/>
|
954
1109
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_2000:{os.version}"/>
|
955
1110
|
</fingerprint>
|
1111
|
+
|
956
1112
|
<fingerprint pattern="^Welcome. Type return, enter password at # prompt">
|
957
1113
|
<description>Brother Printer</description>
|
958
1114
|
<!-- Welcome. Type return, enter password at # prompt -->
|
1115
|
+
|
959
1116
|
<example _encoding="base64">
|
960
1117
|
V2VsY29tZS4gVHlwZSByZXR1cm4sIGVudGVyIHBhc3N3b3JkIGF0ICMgcHJvbXB0Cg==
|
961
1118
|
</example>
|
@@ -964,9 +1121,11 @@
|
|
964
1121
|
<param pos="0" name="os.device" value="Printer"/>
|
965
1122
|
<param pos="0" name="os.product" value="Brother Printer"/>
|
966
1123
|
</fingerprint>
|
1124
|
+
|
967
1125
|
<fingerprint pattern="^(.*) Copyright by ARESCOM">
|
968
1126
|
<description>Arescom System</description>
|
969
1127
|
<!--NDS1260HE-TLI Copyright by ARESCOM 2002\n\n\nPassword: -->
|
1128
|
+
|
970
1129
|
<example _encoding="base64" os.model="NDS1260HE-TLI">
|
971
1130
|
TkRTMTI2MEhFLVRMSSBDb3B5cmlnaHQgYnkgQVJFU0NPTSAyMDAyCgoKClBhc3N3b3JkOgo=
|
972
1131
|
</example>
|
@@ -974,30 +1133,36 @@
|
|
974
1133
|
<param pos="0" name="os.device" value="WAP"/>
|
975
1134
|
<param pos="1" name="os.model"/>
|
976
1135
|
</fingerprint>
|
1136
|
+
|
977
1137
|
<fingerprint pattern="^Welcome to ViewStation">
|
978
1138
|
<description>Polycom ViewStation Video Vonference System</description>
|
979
1139
|
<!-- Welcome to ViewStation\nPassword: -->
|
1140
|
+
|
980
1141
|
<example _encoding="base64">
|
981
1142
|
V2VsY29tZSB0byBWaWV3U3RhdGlvbgoKUGFzc3dvcmQ6
|
982
1143
|
</example>
|
983
1144
|
<param pos="0" name="os.vendor" value="Polycom"/>
|
984
1145
|
<param pos="0" name="os.device" value="ViewStation"/>
|
985
1146
|
</fingerprint>
|
1147
|
+
|
986
1148
|
<fingerprint pattern="^FlowPoint\/(.*) SDSL \[ATM\] Router .*v(.*) Ready">
|
987
1149
|
<!--FlowPoint/2200 SDSL [ATM] Router fp2200-12 v3.0.2 Ready\nLogin: -->
|
1150
|
+
|
988
1151
|
<description>FlowPoint 2200 DSL router</description>
|
989
1152
|
<example _encoding="base64" hw.model="2200" os.version="3.0.2">
|
990
1153
|
Rmxvd1BvaW50LzIyMDAgU0RTTCBbQVRNXSBSb3V0ZXIgZnAyMjAwLTEyIHYzLjAuMiBSZWFkeQpMb2dpbjog
|
991
1154
|
</example>
|
992
|
-
<param pos="0" name="os.vendor" value="
|
1155
|
+
<param pos="0" name="os.vendor" value="FlowPoint"/>
|
993
1156
|
<param pos="0" name="hw.device" value="Broadband router"/>
|
994
1157
|
<param pos="0" name="hw.product" value="DSL Router"/>
|
995
1158
|
<param pos="1" name="hw.model"/>
|
996
1159
|
<param pos="2" name="os.version"/>
|
997
1160
|
</fingerprint>
|
1161
|
+
|
998
1162
|
<fingerprint pattern="^GlobespanVirata Inc\., Software Release (.*)">
|
999
1163
|
<description>GlobespanVirata broadband router</description>
|
1000
1164
|
<!--GlobespanVirata Inc., Software Release 2.1.040407a3_u_e_A\nCopyright (c) 2001-2003 by GlobespanVirata, Inc.\n\nlogin: -->
|
1165
|
+
|
1001
1166
|
<example _encoding="base64" os.version="2.1.040407a3_u_e_A">
|
1002
1167
|
R2xvYmVzcGFuVmlyYXRhIEluYy4sIFNvZnR3YXJlIFJlbGVhc2UgMi4xLjA0MDQwN2EzX3VfZV9BCgpDb3B5cmlnaHQgKG
|
1003
1168
|
MpIDIwMDEtMjAwMyBieSBHbG9iZXNwYW5WaXJhdGEsIEluYy4KCgpsb2dpbjog
|
@@ -1006,14 +1171,17 @@
|
|
1006
1171
|
<param pos="0" name="hw.device" value="Broadband router"/>
|
1007
1172
|
<param pos="1" name="os.version"/>
|
1008
1173
|
</fingerprint>
|
1174
|
+
|
1009
1175
|
<fingerprint pattern="^VxWorks login:">
|
1010
1176
|
<description>VxWorks embedded device</description>
|
1011
1177
|
<example>VxWorks login: </example>
|
1012
1178
|
<param pos="0" name="os.family" value="VxWorks"/>
|
1013
1179
|
</fingerprint>
|
1180
|
+
|
1014
1181
|
<fingerprint pattern=".*Nortel.*Passport ([^ ]*) .*Software Release ([^ ]*).*">
|
1015
1182
|
<description>Nortel Passport</description>
|
1016
1183
|
<!-- *********************************************\n\n\n* Copyright (c) 2003 Nortel Networks, Inc. *\n\n\n* All Rights Reserved *\n\n\n* Passport 8010 *\n\n\n* Software Release 3.5.0.0 *\n\n\n*********************************************\n\n\n\n\nLogin: -->
|
1184
|
+
|
1017
1185
|
<example _encoding="base64" os.product="8010" os.version="3.5.0.0">
|
1018
1186
|
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG5cblxuKiBDb3B5cmlnaHQgKG
|
1019
1187
|
MpIDIwMDMgTm9ydGVsIE5ldHdvcmtzLCBJbmMuICAqXG5cblxuKiBBbGwgUmlnaHRzIFJlc2VydmVkICAgICAg
|
@@ -1026,9 +1194,11 @@
|
|
1026
1194
|
<param pos="1" name="os.product"/>
|
1027
1195
|
<param pos="2" name="os.version"/>
|
1028
1196
|
</fingerprint>
|
1197
|
+
|
1029
1198
|
<fingerprint pattern="^IPSO.* \((.*)\) \(tty.*\)">
|
1030
1199
|
<description>Checkpoint Firewall-1 running on a Nokia IPSO appliance</description>
|
1031
1200
|
<!-- IPSO/i386 (BJ-IDC-FW2) (ttyp7)\n\n\nThis system is for authorized use only.\n\n\n\n\n\n\nlogin: -->
|
1201
|
+
|
1032
1202
|
<example _encoding="base64" host.name="BJ-IDC-FW2">
|
1033
1203
|
SVBTTy9pMzg2IChCSi1JREMtRlcyKSAodHR5cDcpCgoKClRoaXMgc3lzdGVtIGlzIGZvciBhdXRob3Jpem
|
1034
1204
|
VkIHVzZSBvbmx5LgoKCgoKCgoKbG9naW46IA==
|
@@ -1039,10 +1209,13 @@
|
|
1039
1209
|
<param pos="0" name="os.product" value="IPSO"/>
|
1040
1210
|
<param pos="1" name="host.name"/>
|
1041
1211
|
</fingerprint>
|
1212
|
+
|
1042
1213
|
<fingerprint pattern="Tasman Networks Inc.*Telnet Login">
|
1043
1214
|
<description>Tasman Networks Login</description>
|
1044
1215
|
<!-- #\n# Tasman Networks Inc. Telnet Login\n#Escape character is '^]'\n\n\n\nlogin: -->
|
1216
|
+
|
1045
1217
|
<!-- Dashes removed from example banner due to xml issue -->
|
1218
|
+
|
1046
1219
|
<example _encoding="base64" os.vendor="Tasman Networks">
|
1047
1220
|
Iy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0
|
1048
1221
|
tLS0tLS0tCiMgVGFzbWFuIE5ldHdvcmtzIEluYy4gVGVsbmV0IExvZ2luCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS
|
@@ -1053,9 +1226,11 @@
|
|
1053
1226
|
<param pos="0" name="os.device" value="Router"/>
|
1054
1227
|
<param pos="0" name="os.product" value="Tasman Networks router"/>
|
1055
1228
|
</fingerprint>
|
1229
|
+
|
1056
1230
|
<fingerprint pattern="Pragma Systems">
|
1057
1231
|
<description>MS Windows running Pragma TelnetD server</description>
|
1058
1232
|
<!-- Welcome to Gemadept Logistics RF Server\n(C) Copyright 1994-2012 Pragma Systems, Inc.\nlogin name: -->
|
1233
|
+
|
1059
1234
|
<example _encoding="base64">
|
1060
1235
|
V2VsY29tZSB0byBHZW1hZGVwdCBMb2dpc3RpY3MgUkYgU2VydmVyCihDKSBDb3B5cmlnaHQgMTk5NC0yMDEyIFB
|
1061
1236
|
yYWdtYSBTeXN0ZW1zLCBJbmMuCgpsb2dpbiBuYW1lOiA=
|
@@ -1065,9 +1240,11 @@
|
|
1065
1240
|
<param pos="0" name="os.product" value="Windows"/>
|
1066
1241
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1067
1242
|
</fingerprint>
|
1243
|
+
|
1068
1244
|
<fingerprint pattern="^Application Required. No Installation Default">
|
1069
1245
|
<description>probably IBM AS/400 running TN3270 or 5250 emulation server</description>
|
1070
1246
|
<!-- Application Required. No Installation Default\nEnter Application Name: -->
|
1247
|
+
|
1071
1248
|
<example _encoding="base64">
|
1072
1249
|
QXBwbGljYXRpb24gUmVxdWlyZWQuIE5vIEluc3RhbGxhdGlvbiBEZWZhdWx0ICAgICAgICA
|
1073
1250
|
gICAgICAgICAgICAgICAgICAgICAgICAgIApFbnRlciBBcHBsaWNhdGlvbiBOYW1lOg==
|
@@ -1077,9 +1254,11 @@
|
|
1077
1254
|
<param pos="0" name="os.product" value="OS/400"/>
|
1078
1255
|
<param pos="0" name="os.cpe23" value="cpe:/o:ibm:os_400:-"/>
|
1079
1256
|
</fingerprint>
|
1257
|
+
|
1080
1258
|
<fingerprint pattern="^This copy of the Ataman TCP Remote Logon Services">
|
1081
1259
|
<description>Windows NT/2k/2k3 running Ataman telnet server</description>
|
1082
1260
|
<!-- This copy of the Ataman TCP Remote Logon Services is registered as licensed to:\nECI2/DDMS\nAccount Name: -->
|
1261
|
+
|
1083
1262
|
<example _encoding="base64">
|
1084
1263
|
VGhpcyBjb3B5IG9mIHRoZSBBdGFtYW4gVENQIFJlbW90ZSBMb2dvbiBTZXJ2aWNlcyBpcyByZWdpc3RlcmVkIG
|
1085
1264
|
FzIGxpY2Vuc2VkIHRvOgoJRUNJMi9ERE1TCgpBY2NvdW50IE5hbWU6IA==
|
@@ -1089,9 +1268,11 @@
|
|
1089
1268
|
<param pos="0" name="os.product" value="Windows"/>
|
1090
1269
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1091
1270
|
</fingerprint>
|
1271
|
+
|
1092
1272
|
<fingerprint pattern="Cobalt Linux release\W(.*)\W\(.*">
|
1093
1273
|
<description>Cobalt Linux</description>
|
1094
1274
|
<!-- Cobalt Linux release 6.0 (Shinkansen)\nKernel 2.2.16C37_III on an i586\nlogin: -->
|
1275
|
+
|
1095
1276
|
<example _encoding="base64" os.version="6.0">
|
1096
1277
|
Q29iYWx0IExpbnV4IHJlbGVhc2UgNi4wIChTaGlua2Fuc2VuKQpLZXJuZWwgMi4yLjE2QzM3X0lJSSBvbiBhbiBpNTg2CmxvZ2luOiA=
|
1097
1278
|
</example>
|
@@ -1100,9 +1281,11 @@
|
|
1100
1281
|
<param pos="0" name="os.product" value="Linux"/>
|
1101
1282
|
<param pos="1" name="os.version"/>
|
1102
1283
|
</fingerprint>
|
1284
|
+
|
1103
1285
|
<fingerprint pattern="^Check Point FireWall-1 authenticated Telnet server running on (.*)">
|
1104
1286
|
<description>Check Point Firewall-1</description>
|
1105
1287
|
<!-- Check Point FireWall-1 authenticated Telnet server running on gaatdrf2\nUser: -->
|
1288
|
+
|
1106
1289
|
<example _encoding="base64" host.name="gaatdrf2">
|
1107
1290
|
Q2hlY2sgUG9pbnQgRmlyZVdhbGwtMSBhdXRoZW50aWNhdGVkIFRlbG5ldCBzZXJ2ZXIgcnVubmluZyBvbiBnYWF0ZHJmMgoKVXNlcjog
|
1108
1291
|
</example>
|
@@ -1112,9 +1295,11 @@
|
|
1112
1295
|
<param pos="0" name="os.product" value="Checkpoint FW1"/>
|
1113
1296
|
<param pos="1" name="host.name"/>
|
1114
1297
|
</fingerprint>
|
1298
|
+
|
1115
1299
|
<fingerprint pattern="^Raptor Firewall">
|
1116
1300
|
<description>Raptor Firewall</description>
|
1117
1301
|
<!-- Raptor Firewall Secure Gateway.\nHostname: -->
|
1302
|
+
|
1118
1303
|
<example _encoding="base64">
|
1119
1304
|
UmFwdG9yIEZpcmV3YWxsIFNlY3VyZSBHYXRld2F5LgoKSG9zdG5hbWU6IA==
|
1120
1305
|
</example>
|
@@ -1123,9 +1308,11 @@
|
|
1123
1308
|
<param pos="0" name="os.device" value="Firewall"/>
|
1124
1309
|
<param pos="0" name="os.product" value="Raptor"/>
|
1125
1310
|
</fingerprint>
|
1311
|
+
|
1126
1312
|
<fingerprint pattern="UNIX\(r\) System V Release (\d*.\d*)">
|
1127
1313
|
<description>SunOS (Solaris)</description>
|
1128
1314
|
<!-- Raptor Firewall Secure Gateway.\nHostname: -->
|
1315
|
+
|
1129
1316
|
<example _encoding="base64" os.version="4.0">
|
1130
1317
|
VU5JWChyKSBTeXN0ZW0gViBSZWxlYXNlIDQuMCAoVGhlLVNlcnZlcikKCgoKbG9naW46IA==
|
1131
1318
|
</example>
|
@@ -1135,9 +1322,11 @@
|
|
1135
1322
|
<param pos="1" name="os.version"/>
|
1136
1323
|
<param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
|
1137
1324
|
</fingerprint>
|
1325
|
+
|
1138
1326
|
<fingerprint pattern="Solaris (.*)">
|
1139
1327
|
<description>Solaris</description>
|
1140
1328
|
<!-- Seattle Community Network Sun Solaris 1.1.1.B\nPlease login as 'visitor' if you are a visitorn\n\nSunOS UNIX (scn)\n\n\nlogin:-->
|
1329
|
+
|
1141
1330
|
<example _encoding="base64" os.version="1.1.1.B">
|
1142
1331
|
U2VhdHRsZSBDb21tdW5pdHkgTmV0d29yayBTdW4gU29sYXJpcyAxLjEuMS5CClBsZWFzZSBsb2dpbiBhcyAndml
|
1143
1332
|
zaXRvcicgaWYgeW91IGFyZSBhIHZpc2l0b3IKCgpTdW5PUyBVTklYIChzY24pCgoKCmxvZ2luOg==
|
@@ -1148,9 +1337,11 @@
|
|
1148
1337
|
<param pos="1" name="os.version"/>
|
1149
1338
|
<param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:{os.version}"/>
|
1150
1339
|
</fingerprint>
|
1340
|
+
|
1151
1341
|
<fingerprint pattern="^Digital UNIX \(([^)]+).*">
|
1152
1342
|
<description>Digital Unix</description>
|
1153
1343
|
<!-- Digital UNIX (journal) (ttyp2)\n\n\nlogin: -->
|
1344
|
+
|
1154
1345
|
<example _encoding="base64" host.name="journal">
|
1155
1346
|
RGlnaXRhbCBVTklYIChqb3VybmFsKSAodHR5cDIpCgoKCmxvZ2luOiA=
|
1156
1347
|
</example>
|
@@ -1159,9 +1350,11 @@
|
|
1159
1350
|
<param pos="0" name="os.product" value="Digital Unix"/>
|
1160
1351
|
<param pos="1" name="host.name"/>
|
1161
1352
|
</fingerprint>
|
1353
|
+
|
1162
1354
|
<fingerprint pattern="^(?m)Compaq Tru64 UNIX V(.*) \(Rev. (.*\d)\) .*">
|
1163
1355
|
<description>Compaq Tru64 UNIX V</description>
|
1164
1356
|
<!-- Compaq Tru64 UNIX V5.1B (Rev. 2650) (docalpha) (pts/11)\n\n\n\n\nlogin: -->
|
1357
|
+
|
1165
1358
|
<example _encoding="base64" os.version="5.1B" os.rev="2650">
|
1166
1359
|
Q29tcGFxIFRydTY0IFVOSVggVjUuMUIgKFJldi4gMjY1MCkgKGRvY2FscGhhKSAocHRzLzExKQoKCgoKCmxvZ2luOg==
|
1167
1360
|
</example>
|
@@ -1172,9 +1365,11 @@
|
|
1172
1365
|
<param pos="2" name="os.rev"/>
|
1173
1366
|
<param pos="0" name="os.cpe23" value="cpe:/o:hp:tru64:{os.version}"/>
|
1174
1367
|
</fingerprint>
|
1368
|
+
|
1175
1369
|
<fingerprint pattern="HP-UX ([^ ]+) [A-Z]\.([^ ]+) ([^ ]+) ([^ ]+)\s([^ ]+\)).*$">
|
1176
1370
|
<description>System HP-UX</description>
|
1177
1371
|
<!-- HP-UX ctout B.11.11 U 9000/800 (tc)\nlogin: -->
|
1372
|
+
|
1178
1373
|
<example _encoding="base64" host.name="ctout" os.version="11.11" hw.series="9000/800" hw.model="(tc)">
|
1179
1374
|
SFAtVVggY3RvdXQgQi4xMS4xMSBVIDkwMDAvODAwICh0YykKCmxvZ2luOiA=
|
1180
1375
|
</example>
|
@@ -1188,18 +1383,22 @@
|
|
1188
1383
|
<param pos="4" name="hw.series"/>
|
1189
1384
|
<param pos="5" name="hw.model"/>
|
1190
1385
|
</fingerprint>
|
1386
|
+
|
1191
1387
|
<fingerprint pattern="^Data ONTAP">
|
1192
1388
|
<description>A NetApp apliance</description>
|
1193
1389
|
<!-- Data ONTAP (s500.)\nlogin: -->
|
1390
|
+
|
1194
1391
|
<example _encoding="base64">RGF0YSBPTlRBUCAoczUwMC4pCmxvZ2luOiA=</example>
|
1195
1392
|
<param pos="0" name="os.vendor" value="NetApp"/>
|
1196
1393
|
<param pos="0" name="os.family" value="Data ONTAP"/>
|
1197
1394
|
<param pos="0" name="os.product" value="Data ONTAP"/>
|
1198
1395
|
<param pos="0" name="os.cpe23" value="cpe:/o:netapp:data_ontap:-"/>
|
1199
1396
|
</fingerprint>
|
1397
|
+
|
1200
1398
|
<fingerprint pattern="OpenVMS.*Version\sV([^\s]+).*">
|
1201
1399
|
<description>OpenVMS</description>
|
1202
1400
|
<!-- Welcome to OpenVMS (TM) Alpha Operating System, Version V8.4 - NOT70\n\nUsername: -->
|
1401
|
+
|
1203
1402
|
<example _encoding="base64" os.version="8.4">
|
1204
1403
|
IFdlbGNvbWUgdG8gT3BlblZNUyAoVE0pIEFscGhhIE9wZXJhdGluZyBTeXN0Z
|
1205
1404
|
W0sIFZlcnNpb24gVjguNCAgICAgLSBOT1Q3MAoKClVzZXJuYW1lOiA=
|
@@ -1209,9 +1408,11 @@
|
|
1209
1408
|
<param pos="0" name="os.product" value="VMS"/>
|
1210
1409
|
<param pos="1" name="os.version"/>
|
1211
1410
|
</fingerprint>
|
1411
|
+
|
1212
1412
|
<fingerprint pattern="^(?m)SCO OpenServer\(TM\) Release ([^ ]+).*$">
|
1213
1413
|
<description>SCO OpenServer</description>
|
1214
1414
|
<!-- SCO OpenServer(TM) Release 5 (bomdia.co.za) (ttyp6)\nlogin: -->
|
1415
|
+
|
1215
1416
|
<example _encoding="base64" os.version="5">
|
1216
1417
|
U0NPIE9wZW5TZXJ2ZXIoVE0pIFJlbGVhc2UgNSAoYm9tZGlhLmNvLnphKSAodHR5cDYpCgpsb2dpbjo=
|
1217
1418
|
</example>
|
@@ -1220,9 +1421,11 @@
|
|
1220
1421
|
<param pos="0" name="os.product" value="OpenServer"/>
|
1221
1422
|
<param pos="1" name="os.version"/>
|
1222
1423
|
</fingerprint>
|
1424
|
+
|
1223
1425
|
<fingerprint pattern="^% Username: timeout expired!">
|
1224
1426
|
<description>Some kind of Cisco device</description>
|
1225
1427
|
<!-- % Username: timeout expired!-->
|
1428
|
+
|
1226
1429
|
<example _encoding="base64">
|
1227
1430
|
JSBVc2VybmFtZTogIHRpbWVvdXQgZXhwaXJlZCE=
|
1228
1431
|
</example>
|
@@ -1231,6 +1434,7 @@
|
|
1231
1434
|
<param pos="0" name="os.product" value="IOS"/>
|
1232
1435
|
<param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:-"/>
|
1233
1436
|
</fingerprint>
|
1437
|
+
|
1234
1438
|
<fingerprint pattern="^Welcome to MKS Telnet Server Version">
|
1235
1439
|
<description>Windows running MKS Telnet Server</description>
|
1236
1440
|
<example _encoding="base64">
|
@@ -1241,15 +1445,18 @@
|
|
1241
1445
|
<param pos="0" name="os.product" value="Windows"/>
|
1242
1446
|
<param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
|
1243
1447
|
</fingerprint>
|
1448
|
+
|
1244
1449
|
<fingerprint pattern="^Sorry, this system is engaged\.">
|
1245
1450
|
<description>an embedded print server</description>
|
1246
1451
|
<example>Sorry, this system is engaged.</example>
|
1247
1452
|
<param pos="0" name="os.vendor" value="Epson"/>
|
1248
1453
|
<param pos="0" name="os.device" value="Printer"/>
|
1249
1454
|
</fingerprint>
|
1455
|
+
|
1250
1456
|
<fingerprint pattern="^TELNET session now in ESTABLISHED state">
|
1251
1457
|
<description>an Allied Telesyn router</description>
|
1252
1458
|
<!-- TELNET session now in ESTABLISHED state\n\nGEO-003 login: -->
|
1459
|
+
|
1253
1460
|
<example _encoding="base64">
|
1254
1461
|
VEVMTkVUIHNlc3Npb24gbm93IGluIEVTVEFCTElTSEVEIHN0YXRlCgpHRU8tMDAzIGxvZ2luOiA=
|
1255
1462
|
</example>
|
@@ -1257,9 +1464,11 @@
|
|
1257
1464
|
<param pos="0" name="os.device" value="Router"/>
|
1258
1465
|
<param pos="0" name="os.product" value="Allied Telesyn router"/>
|
1259
1466
|
</fingerprint>
|
1467
|
+
|
1260
1468
|
<fingerprint pattern="^CONEXANT SYSTEMS.*ACCESS RUNNER ADSL">
|
1261
1469
|
<description>a Conexant ADSL router</description>
|
1262
1470
|
<!-- CONEXANT SYSTEMS, INC. ACCESS RUNNER ADSL CONSOLE PORT>>>LOGON PASSWORD>3.27****** -->
|
1471
|
+
|
1263
1472
|
<example _encoding="base64">
|
1264
1473
|
Q09ORVhBTlQgU1lTVEVNUywgSU5DLiBBQ0NFU1MgUlVOTkVSIEFEU0wgQ09OU09MRSBQ
|
1265
1474
|
T1JUPj4+TE9HT04gUEFTU1dPUkQ+My4yNyoqKioqKg==
|
@@ -1268,9 +1477,11 @@
|
|
1268
1477
|
<param pos="0" name="os.device" value="Broadband router"/>
|
1269
1478
|
<param pos="0" name="os.product" value="AccessRunner ADSL router"/>
|
1270
1479
|
</fingerprint>
|
1480
|
+
|
1271
1481
|
<fingerprint pattern="^System administrator is connecting from">
|
1272
1482
|
<description>a DrayTek Vigor SOHO Router</description>
|
1273
1483
|
<!-- System administrator is connecting from 54.39.173.86\n\nReject the connection request !!! -->
|
1484
|
+
|
1274
1485
|
<example _encoding="base64">
|
1275
1486
|
U3lzdGVtIGFkbWluaXN0cmF0b3IgaXMgY29ubmVjdGluZyBmcm9tIDU0LjM5LjE3My44NgoKUmVqZWN0IH
|
1276
1487
|
RoZSBjb25uZWN0aW9uIHJlcXVlc3QgISEh
|
@@ -1279,9 +1490,11 @@
|
|
1279
1490
|
<param pos="0" name="hw.device" value="Broadband router"/>
|
1280
1491
|
<param pos="0" name="hw.product" value="Vigor"/>
|
1281
1492
|
</fingerprint>
|
1493
|
+
|
1282
1494
|
<fingerprint pattern=".*Version\s(\d*.\d*)\/OpenBSD.*">
|
1283
1495
|
<description>OpenBSD</description>
|
1284
1496
|
<!-- 220 killer09 FTP server (Version 6.4/OpenBSD/Linux-ftpd-0.17) ready. -->
|
1497
|
+
|
1285
1498
|
<example _encoding="base64" os.version="6.4">
|
1286
1499
|
MjIwIGtpbGxlcjA5IEZUUCBzZXJ2ZXIgKFZlcnNpb24gNi40L09wZW5CU0QvTGludXgtZnRwZC0wLjE3KSByZWFkeS4K
|
1287
1500
|
</example>
|
@@ -1291,9 +1504,11 @@
|
|
1291
1504
|
<param pos="1" name="os.version"/>
|
1292
1505
|
<param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:{os.version}"/>
|
1293
1506
|
</fingerprint>
|
1507
|
+
|
1294
1508
|
<fingerprint pattern="^FreeBSD\/([^\\s]+)\s+\(([^\s]+)\)">
|
1295
1509
|
<description>a FreeBSD</description>
|
1296
1510
|
<!-- FreeBSD/amd64 (ms.gymspgs.cz) (pts/0)\n\n\n\nlogin: -->
|
1511
|
+
|
1297
1512
|
<example _encoding="base64" os.arch="amd64" host.name="ms.gymspgs.cz">
|
1298
1513
|
RnJlZUJTRC9hbWQ2NCAobXMuZ3ltc3Bncy5jeikgKHB0cy8wKQoKCgpsb2dpbjo=
|
1299
1514
|
</example>
|
@@ -1304,9 +1519,11 @@
|
|
1304
1519
|
<param pos="0" name="os.cpe23" value="cpe:/o:freebsd:freebsd:-"/>
|
1305
1520
|
<param pos="2" name="host.name"/>
|
1306
1521
|
</fingerprint>
|
1522
|
+
|
1307
1523
|
<fingerprint pattern="^NetBSD">
|
1308
1524
|
<description>NetBSD</description>
|
1309
1525
|
<!-- NetBSD/evbsh3 (Fukuyama.Host_AKS_0555_WL-v2.60d) (ttyp1) -->
|
1526
|
+
|
1310
1527
|
<example _encoding="base64">
|
1311
1528
|
TmV0QlNEL21lc3NpbWlwcyAoKSAodHR5cDMpCgpsb2dpbjog
|
1312
1529
|
</example>
|
@@ -1315,9 +1532,11 @@
|
|
1315
1532
|
<param pos="0" name="os.product" value="NetBSD"/>
|
1316
1533
|
<param pos="0" name="os.cpe23" value="cpe:/o:netbsd:netbsd:-"/>
|
1317
1534
|
</fingerprint>
|
1535
|
+
|
1318
1536
|
<fingerprint pattern="^IRIX\W\((.*)\)">
|
1319
1537
|
<description>SGI IRIX</description>
|
1320
1538
|
<!-- IRIX (artemis.biol.uoa.gr)\n\n\n\nlogin: -->
|
1539
|
+
|
1321
1540
|
<example _encoding="base64" host.name="artemis.biol.uoa.gr">
|
1322
1541
|
SVJJWCAoYXJ0ZW1pcy5iaW9sLnVvYS5ncikKCgoKbG9naW46IA==
|
1323
1542
|
</example>
|
@@ -1327,12 +1546,15 @@
|
|
1327
1546
|
<param pos="0" name="os.cpe23" value="cpe:/o:sgi:irix:-"/>
|
1328
1547
|
<param pos="1" name="host.name"/>
|
1329
1548
|
</fingerprint>
|
1549
|
+
|
1330
1550
|
<fingerprint pattern="(?m)(ES|RS)\s([^\s]+) System Software, Version ([^\s]+).*Riverstone Networks" flags="REG_MULTILINE">
|
1331
1551
|
<description>a Riverstone router</description>
|
1332
1552
|
<!-- Using '+' instead of '-' due to xml issue -->
|
1553
|
+
|
1333
1554
|
<!-- ++++++++++++++++++++++++++++++++++\nES 10170 System Software, Version 9.3.0.4\n
|
1334
1555
|
Riverstone Networks, Inc., Copyright (c) 2000-2003. All rights reserved.\nSystem started on 2018-09-06 15:58:\n
|
1335
1556
|
+++++++++++++++++++++++++++++++++++++++ -->
|
1557
|
+
|
1336
1558
|
<example _encoding="base64" os.product="10170" os.version="9.3.0.4" os.family="ES">
|
1337
1559
|
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
|
1338
1560
|
S0tLS0tLQpFUyAxMDE3MCBTeXN0ZW0gU29mdHdhcmUsIFZlcnNpb24gOS4zLjAuNApSaXZlcnN0b25lIE5ldH
|
@@ -1343,6 +1565,7 @@
|
|
1343
1565
|
<!-- +++++++++++++++++++++++++++++++++++++++\nRS 10170 System Software, Version 9.3.0.5\n
|
1344
1566
|
Riverstone Networks, Inc., Copyright (c) 2000-2003. All rights reserved.\nSystem started on 2018-09-06 15:58:\n
|
1345
1567
|
+++++++++++++++++++++++++++++++++++++++ -->
|
1568
|
+
|
1346
1569
|
<example _encoding="base64" os.product="8000" os.version="9.3.0.5" os.family="RS">
|
1347
1570
|
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
|
1348
1571
|
S0tLS0tLQpSUyA4MDAwIFN5c3RlbSBTb2Z0d2FyZSwgVmVyc2lvbiA5LjMuMC41ClJpdmVyc3RvbmUgTmV0d2
|
@@ -1356,6 +1579,7 @@
|
|
1356
1579
|
<param pos="2" name="os.product"/>
|
1357
1580
|
<param pos="3" name="os.version"/>
|
1358
1581
|
</fingerprint>
|
1582
|
+
|
1359
1583
|
<fingerprint pattern="^HP ([^\s]+) ProCurve Switch">
|
1360
1584
|
<description>HP ProCurve Switch</description>
|
1361
1585
|
<!-- ==============================================================================\nHP J4121A ProCurve Switch 4000M\n
|
@@ -1366,6 +1590,7 @@
|
|
1366
1590
|
Software feature updates\n* New product announcements\n* Special events\n\n\nPlease register your
|
1367
1591
|
products now at: www.ProCurve.com\n==============================================================================\n
|
1368
1592
|
\n\nUsername: -->
|
1593
|
+
|
1369
1594
|
<example _encoding="base64" os.product="J4121A">
|
1370
1595
|
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09P
|
1371
1596
|
T09PT09PT09PT09PT09PT09PT09PT09CkhQIEo0MTIxQSBQcm9DdXJ2ZSBTd2l0Y2ggNDAwME
|
@@ -1389,11 +1614,13 @@
|
|
1389
1614
|
<param pos="0" name="os.device" value="Switch"/>
|
1390
1615
|
<param pos="1" name="os.product"/>
|
1391
1616
|
</fingerprint>
|
1617
|
+
|
1392
1618
|
<fingerprint pattern="^(?m).*ConnectUPS">
|
1393
1619
|
<description>PowerWare ConnectUPS</description>
|
1394
1620
|
<!-- +============================================================================+\n| [ ConnectUPS Web/SNMP
|
1395
1621
|
Card Configuration Utility ] |\n+============================================================================+\n
|
1396
1622
|
\nEnter Password: -->
|
1623
|
+
|
1397
1624
|
<example _encoding="base64">
|
1398
1625
|
Kz09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0
|
1399
1626
|
9PT09PT09PT09PT09PT0rCnwgICAgICAgICAgICBbIENvbm5lY3RVUFMgV2ViL1NOTVAgQ2FyZCBDb25maW
|
@@ -1406,9 +1633,11 @@
|
|
1406
1633
|
<param pos="0" name="os.device" value="UPS"/>
|
1407
1634
|
<param pos="0" name="os.product" value="ConnectUPS"/>
|
1408
1635
|
</fingerprint>
|
1636
|
+
|
1409
1637
|
<fingerprint pattern="^Imagistics.*im">
|
1410
1638
|
<description>an Imagistics device</description>
|
1411
1639
|
<!-- Imagistics im3511/im4511 Ver 01.00.20 TELNET server.\nCopyright(c) 2001-2005, silex technology, Inc.\nlogin: -->
|
1640
|
+
|
1412
1641
|
<example _encoding="base64">
|
1413
1642
|
SW1hZ2lzdGljcyBpbTM1MTEvaW00NTExIFZlciAwMS4wMC4yMCBURUxORVQgc2VydmVyLgpDb3B5cmlnaH
|
1414
1643
|
QoYykgMjAwMS0yMDA1LCBzaWxleCB0ZWNobm9sb2d5LCBJbmMuCmxvZ2luOiA=
|
@@ -1418,9 +1647,11 @@
|
|
1418
1647
|
<param pos="0" name="os.device" value="Multifunction Device"/>
|
1419
1648
|
<param pos="0" name="os.product" value="im"/>
|
1420
1649
|
</fingerprint>
|
1650
|
+
|
1421
1651
|
<fingerprint pattern="^NRG Maintenance Shell">
|
1422
1652
|
<description>a Ricoh NRG device</description>
|
1423
1653
|
<!-- NRG Maintenance Shell. \nUser access verification.\nlogin: -->
|
1654
|
+
|
1424
1655
|
<example _encoding="base64">
|
1425
1656
|
TlJHIE1haW50ZW5hbmNlIFNoZWxsLiAgIAoKVXNlciBhY2Nlc3MgdmVyaWZpY2F0aW9uLgoKbG9naW46
|
1426
1657
|
</example>
|
@@ -1428,9 +1659,11 @@
|
|
1428
1659
|
<param pos="0" name="os.device" value="Printer"/>
|
1429
1660
|
<param pos="0" name="os.product" value="NRG Printer"/>
|
1430
1661
|
</fingerprint>
|
1662
|
+
|
1431
1663
|
<fingerprint pattern="^SHARP (AR-[^\\s]+) Ver ([^\\s]+) TELNET server">
|
1432
1664
|
<description>SHARP AR Series multifunction device</description>
|
1433
1665
|
<!-- SHARP AR-M351U Ver 01.00.18 TELNET server.\nCopyright(c) 2001-2005, silex technology, Inc.\nlogin: -->
|
1666
|
+
|
1434
1667
|
<example _encoding="base64" os.product="AR-M351U" os.version="01.00.18">
|
1435
1668
|
U0hBUlAgQVItTTM1MVUgVmVyIDAxLjAwLjE4IFRFTE5FVCBzZXJ2ZXIuCkNvcHlyaWdodChjKSAyMDAx
|
1436
1669
|
LTIwMDUsIHNpbGV4IHRlY2hub2xvZ3ksIEluYy4KbG9naW46IA==
|
@@ -1441,10 +1674,12 @@
|
|
1441
1674
|
<param pos="1" name="os.product"/>
|
1442
1675
|
<param pos="2" name="os.version"/>
|
1443
1676
|
</fingerprint>
|
1677
|
+
|
1444
1678
|
<fingerprint pattern="^SHARP (MX-[^\\s]+) Ver ([^\\s]+) TELNET server">
|
1445
1679
|
<description>SHARP MX Series multifunction device</description>
|
1446
1680
|
<!-- SHARP MX-3610N Ver 01.05.00.0o.18 TELNET server.\nCopyright(C) 2005- SHARP CORPORATION\nCopyright(C) 2005-
|
1447
1681
|
silex technology, Inc.\nlogin: -->
|
1682
|
+
|
1448
1683
|
<example _encoding="base64" os.product="MX-3610N" os.version="01.05.00.0o.18">
|
1449
1684
|
U0hBUlAgTVgtMzYxME4gVmVyIDAxLjA1LjAwLjBvLjE4IFRFTE5FVCBzZXJ2ZXIuCkNvcHlyaWdodC
|
1450
1685
|
hDKSAyMDA1LSAgICAgU0hBUlAgQ09SUE9SQVRJT04KQ29weXJpZ2h0KEMpIDIwMDUtICAgICBzaWxl
|
@@ -1456,11 +1691,13 @@
|
|
1456
1691
|
<param pos="1" name="os.product"/>
|
1457
1692
|
<param pos="2" name="os.version"/>
|
1458
1693
|
</fingerprint>
|
1694
|
+
|
1459
1695
|
<fingerprint pattern="^(?m).*Welcome to MELCO Print Server.*Server Name *: *([^ ]*)\W.*Server Model *: *([^ ]*).*F \/ W Version *: *([^ ]*).*MAC Address *: *(.. .. .. .. .. ..).*$">
|
1460
1696
|
<description>System is a Buffalo/MELCO Embedded Print Server</description>
|
1461
1697
|
<!-- ***********************************\n* Welcome to MELCO Print Server *\n* Telnet Console *\n***********************************
|
1462
1698
|
\n \nServer Name: PS-B04E8E\nServer Model: LPV 2 - TX 1\nF / W Version: 2.00 J \nMAC Address: AE 32 EA 21 BB E3\n
|
1463
1699
|
Uptime: 0 days, 00: 00: 12\n \nPlease Enter Password:"-->
|
1700
|
+
|
1464
1701
|
<example _encoding="base64" os.version="2.00" host.id="PS-B04E8E" os.model="LPV" os.address="AE 32 EA 21 BB E3">
|
1465
1702
|
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiogV2VsY29tZSB0byBNRUxDTyBQc
|
1466
1703
|
mludCBTZXJ2ZXIgKlxuKiBUZWxuZXQgQ29uc29sZSAqXG4qKioqKioqKioqKioqKioqKioqKioqKi
|
@@ -1477,9 +1714,11 @@
|
|
1477
1714
|
<param pos="3" name="os.version"/>
|
1478
1715
|
<param pos="4" name="os.address"/>
|
1479
1716
|
</fingerprint>
|
1717
|
+
|
1480
1718
|
<fingerprint pattern="^(?m)AIX Version\W(\d).*">
|
1481
1719
|
<description>System is IBM AIX v</description>
|
1482
1720
|
<!-- AIX Version 6\nCopyright IBM Corporation, 1982, 2007.\nlogin: -->
|
1721
|
+
|
1483
1722
|
<example _encoding="base64" os.version="6">
|
1484
1723
|
QUlYIFZlcnNpb24gNgpDb3B5cmlnaHQgSUJNIENvcnBvcmF0aW9uLCAxOTgyLCAyMDA3Lgpsb2dpbjogCg==
|
1485
1724
|
</example>
|
@@ -1489,9 +1728,11 @@
|
|
1489
1728
|
<param pos="1" name="os.version"/>
|
1490
1729
|
<param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
|
1491
1730
|
</fingerprint>
|
1731
|
+
|
1492
1732
|
<fingerprint pattern="^(?m)CIMC Debug Firmware Utility Shell\W([^\s]+).*">
|
1493
1733
|
<description>System is Cisco UCS Device</description>
|
1494
1734
|
<!-- CIMC Debug Firmware Utility Shell\nfake-ucs-device-3-1-p login: -->
|
1735
|
+
|
1495
1736
|
<example _encoding="base64" host.name="fake-ucs-device-3-1-p">
|
1496
1737
|
Q0lNQyBEZWJ1ZyBGaXJtd2FyZSBVdGlsaXR5IFNoZWxsCmZha2UtdWNzLWRldmljZS0zLTEtcCBsb2dpbjogCg==
|
1497
1738
|
</example>
|
@@ -1501,6 +1742,7 @@
|
|
1501
1742
|
<param pos="0" name="os.product" value="UCS Device"/>
|
1502
1743
|
<param pos="1" name="host.name"/>
|
1503
1744
|
</fingerprint>
|
1745
|
+
|
1504
1746
|
<fingerprint pattern="^(?m)HP ProLiant.*v(\d+.\d+)">
|
1505
1747
|
<description>Sytem is HP ProLiant server</description>
|
1506
1748
|
<!-- HP ProLiant BL e-Class Integrated Administrator v2.00
|
@@ -1509,6 +1751,7 @@
|
|
1509
1751
|
authorized user. Any authorized or unauthorized access and use may be moni-
|
1510
1752
|
tored and can result in criminal or civil prosecution under applicable law.
|
1511
1753
|
IA-00508BEBAA59 login: -->
|
1754
|
+
|
1512
1755
|
<example _encoding="base64" os.version="2.00">
|
1513
1756
|
SFAgUHJvTGlhbnQgQkwgZS1DbGFzcyBJbnRlZ3JhdGVkIEFkbWluaXN0cmF0b3IgdjIuMDAKICAgICAgI
|
1514
1757
|
CAgQ29weXJpZ2h0IDIwMDUgSGV3bGV0dC1QYWNrYXJkIERldmVsb3BtZW50IEdyb3VwLCBMLlAuCgogIC
|
@@ -1526,11 +1769,12 @@
|
|
1526
1769
|
<param pos="0" name="os.product" value="ProLiant"/>
|
1527
1770
|
<param pos="1" name="os.version"/>
|
1528
1771
|
</fingerprint>
|
1772
|
+
|
1529
1773
|
<fingerprint pattern="^Power Measurement Ltd. Meter ION ([[:alnum:]]+)">
|
1530
1774
|
<!-- Power Measurement Ltd. Meter ION 7330V271 ETH ETH7330V272
|
1531
1775
|
Serial#: PB-0204A058-11
|
1532
|
-
|
1533
1776
|
login: -->
|
1777
|
+
|
1534
1778
|
<description>Power Measurement ION Power Meter</description>
|
1535
1779
|
<example _encoding="base64" hw.vendor="Power Measurement Ltd." hw.family="ION" hw.version="7330V271">
|
1536
1780
|
UG93ZXIgTWVhc3VyZW1lbnQgTHRkLiBNZXRlciBJT04gNzMzMFYyNzEgRVRIIEVUSDczMzBWMjcyCg1TZ
|
@@ -1540,10 +1784,12 @@
|
|
1540
1784
|
<param pos="0" name="hw.family" value="ION"/>
|
1541
1785
|
<param pos="1" name="hw.version"/>
|
1542
1786
|
</fingerprint>
|
1787
|
+
|
1543
1788
|
<fingerprint pattern="^GW25 v([[:digit:]\.]+) - Intelligent Power Meters GPRS Gateway[[:space:]]+Developed by Satelitech">
|
1544
1789
|
<!-- GW25 v1.2.1 - Intelligent Power Meters GPRS Gateway
|
1545
1790
|
Developed by Satelitech S.A for ESG Dilec
|
1546
1791
|
Enter password: -->
|
1792
|
+
|
1547
1793
|
<description>Satelitech Power Meter</description>
|
1548
1794
|
<example _encoding="base64" hw.vendor="Satelitech" hw.family="GW25" hw.version="1.2.1">
|
1549
1795
|
R1cyNSB2MS4yLjEgLSBJbnRlbGxpZ2VudCBQb3dlciBNZXRlcnMgR1BSUyBHYXRld2F5Cg1EZXZlbG9wZ
|
@@ -1553,10 +1799,11 @@
|
|
1553
1799
|
<param pos="0" name="hw.family" value="GW25"/>
|
1554
1800
|
<param pos="1" name="hw.version"/>
|
1555
1801
|
</fingerprint>
|
1802
|
+
|
1556
1803
|
<fingerprint pattern="^RDK \(A Yocto Project based Distro\) ([^ ]+) Docsis-Gateway">
|
1557
1804
|
<!-- RDK (A Yocto Project based Distro) 2.0 Docsis-Gateway
|
1558
|
-
|
1559
1805
|
Docsis-Gateway login: -->
|
1806
|
+
|
1560
1807
|
<description>DOCSIS Cable Modem Running RDK</description>
|
1561
1808
|
<example _encoding="base64" hw.device="DOCSIS Cable Modem" os.vendor="Yocto" os.product="RDK" os.version="2.0">
|
1562
1809
|
UkRLIChBIFlvY3RvIFByb2plY3QgYmFzZWQgRGlzdHJvKSAyLjAgRG9jc2lzLUdhdGV3YXkNCg0NCg1Eb
|
@@ -1567,24 +1814,27 @@
|
|
1567
1814
|
<param pos="0" name="os.product" value="RDK"/>
|
1568
1815
|
<param pos="1" name="os.version"/>
|
1569
1816
|
</fingerprint>
|
1817
|
+
|
1570
1818
|
<fingerprint pattern="^RICOH Maintenance Shell">
|
1571
1819
|
<description>a Ricoh device</description>
|
1572
1820
|
<!-- RICOH Maintenance Shell.
|
1573
1821
|
User access verification.
|
1574
1822
|
login:-->
|
1823
|
+
|
1575
1824
|
<example _encoding="base64">
|
1576
1825
|
UklDT0ggTWFpbnRlbmFuY2UgU2hlbGwuICAgCg1Vc2VyIGFjY2VzcyB2ZXJpZmljYXRpb24uCg1sb2dpbjo=
|
1577
1826
|
</example>
|
1578
1827
|
<param pos="0" name="os.vendor" value="Ricoh"/>
|
1579
1828
|
<param pos="0" name="os.device" value="Printer"/>
|
1580
1829
|
</fingerprint>
|
1830
|
+
|
1581
1831
|
<fingerprint pattern="Precise/RTCS v([\d\.]+) Telnet server">
|
1582
1832
|
<description>Liebert UPS</description>
|
1583
1833
|
<!-- Precise/RTCS v2.90.00 Telnet server
|
1584
1834
|
Service Port Manager Active
|
1585
|
-
|
1586
1835
|
<Esc> Ends Session
|
1587
1836
|
-->
|
1837
|
+
|
1588
1838
|
<example _encoding="base64" os.version="2.90.00">
|
1589
1839
|
UHJlY2lzZS9SVENTIHYyLjkwLjAwIFRlbG5ldCBzZXJ2ZXIKCgpTZXJ2aWNlIFBvcnQgTWFuYWdlciBBY3RpdmUKCjxFc2M+IEVuZHMgU2Vzc2lvbgoKroot
|
1590
1840
|
</example>
|
@@ -1594,4 +1844,5 @@
|
|
1594
1844
|
<param pos="0" name="os.vendor" value="Liebert"/>
|
1595
1845
|
<param pos="1" name="os.version"/>
|
1596
1846
|
</fingerprint>
|
1597
|
-
|
1847
|
+
|
1848
|
+
</fingerprints>
|