recog 2.3.9 → 2.3.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 8f5780c5e203e7c8dc3133a5b85c3637ea810f26711eef8811b3a473edb8b062
4
- data.tar.gz: c72b22caa6baf5718c06b8be97442056c3b892af439cc5e1757c71e88dcd72ce
3
+ metadata.gz: c46efafef760f2701e6eeee565e715ac04544300ebfb08f0083db856e4c81603
4
+ data.tar.gz: 4e66bbd5ec6364325c9c7130aeb7434ab20242def9d7200d0e7d8e588f577c40
5
5
  SHA512:
6
- metadata.gz: 3b4ebdc3592c3e4e7dbaa0e567b9528a521b23b1c509340429719438146cc2ff61c939928b4ef0ae84c59f9089b22317fd16797f1cf80556294ed5966ef21e51
7
- data.tar.gz: d93f5cbb5a8bc591888c2d6e26b80787cc9984d0b9a5d5435dfc5aee2172f39bb9905a029c34fd3235d1a33b3f444c425aad2a74db96895b95b6b69a6df934b4
6
+ metadata.gz: 61ca19b2266100f66d6c220459941ddbc0aa795cbcd2bc52c6782cd66feeb6787a3d1657486ff2af99c196592b5cdabcb2c4d9b33e7efe136f175d2bf5c12bbc
7
+ data.tar.gz: dd5718510eb4780815fda18496c37afcbb4971246d2b9c6e439ca4697ac17ca1f9e70d3f634b04b5b9be7374e4fc15a346d3177ac5cf827c50e9136f48169009
File without changes
@@ -16,10 +16,16 @@ mappings:
16
16
  weblogic: weblogic_server
17
17
  blue_coat:
18
18
  vendor: bluecoat
19
+ carnegie_mellon_university:
20
+ vendor: cmu
21
+ products:
22
+ cyrus_imap: cyrus_imap_server
19
23
  centos:
20
24
  vendor: centos
21
25
  products:
22
26
  linux: centos
27
+ centos_webpanel:
28
+ vendor: centos-webpanel
23
29
  check_point:
24
30
  vendor: checkpoint
25
31
  cisco:
@@ -32,6 +38,9 @@ mappings:
32
38
  vendor: debian
33
39
  products:
34
40
  linux: debian_linux
41
+ embedthis:
42
+ products:
43
+ goahead_webserver: goahead
35
44
  f5:
36
45
  vendor: f5
37
46
  products:
@@ -41,14 +50,13 @@ mappings:
41
50
  vendor: hp
42
51
  products:
43
52
  ilo: integrated_lights_out
44
- lotus_domino: lotus_domino_server
45
53
  tru64_unix: tru64
46
54
  ibm:
47
55
  vendor: ibm
48
56
  products:
49
57
  lotus_domino: lotus_domino_server
58
+ ibm_domino: lotus_domino
50
59
  os/400: os_400
51
- z/os: z\/os
52
60
  jamf:
53
61
  products:
54
62
  jamf_pro: jamf
@@ -58,6 +66,10 @@ mappings:
58
66
  junos_os: junos
59
67
  kibana:
60
68
  vendor: elasticsearch
69
+ cz.nic:
70
+ vendor: knot-dns
71
+ litespeed_technologies:
72
+ vendor: litespeedtech
61
73
  linux:
62
74
  vendor: linux
63
75
  products:
@@ -95,6 +107,10 @@ mappings:
95
107
  vendor: modwsgi
96
108
  mort_bay:
97
109
  vendor: mortbay
110
+ nlnet_labs:
111
+ vendor: nlnetlabs
112
+ products:
113
+ dnsd: name_server_daemon
98
114
  net-snmp:
99
115
  vendor: net-snmp
100
116
  products:
@@ -421,6 +421,7 @@ Symantec Endpoint Protection Manager
421
421
  Symantec Mail Security for SMTP
422
422
  Symantec Messaging Gateway
423
423
  TBS FTP Server
424
+ TCP/IP
424
425
  TCPIP POP server
425
426
  TUX Web Server
426
427
  TeamCity
@@ -782,6 +782,7 @@ Tomato
782
782
  TornadoWeb
783
783
  Toshiba
784
784
  Trancell
785
+ Treck
785
786
  Trend Micro
786
787
  Tridium
787
788
  Troy
@@ -1,3 +1,3 @@
1
1
  module Recog
2
- VERSION = '2.3.9'
2
+ VERSION = '2.3.14'
3
3
  end
@@ -24,6 +24,7 @@ def parse_cpe_vp_map(file):
24
24
  vp_map[cpe_type] = {}
25
25
  if not vendor in vp_map[cpe_type]:
26
26
  vp_map[cpe_type][vendor] = set()
27
+ product = product.replace('%2f', '/')
27
28
  vp_map[cpe_type][vendor].add(product)
28
29
  else:
29
30
  logging.error("Unexpected CPE %s", cpe_name)
@@ -160,6 +161,8 @@ def update_cpes(xml_file, cpe_vp_map, r7_vp_map):
160
161
  continue
161
162
 
162
163
  # building the CPE string
164
+ # Last minute escaping of '/'
165
+ product = product.replace('/', '\/')
163
166
  cpe_value = 'cpe:/{}:{}:{}'.format(cpe_type, vendor, product)
164
167
 
165
168
  if version:
@@ -8,6 +8,42 @@
8
8
  dnsmasq-2.76-1-ubnt2
9
9
  -->
10
10
 
11
+ <!--
12
+ The following 'assert nothing' block is intended to handle banners so simple
13
+ that they cannot be attributed to a product or vendor. They are at the
14
+ beginning of the file as a performance tweak given how frequenty they occur.
15
+ -->
16
+
17
+ <fingerprint pattern="^$">
18
+ <description>empty string -- assert nothing.</description>
19
+ <example/>
20
+ <param pos="0" name="service.certainty" value="0.0"/>
21
+ </fingerprint>
22
+
23
+ <fingerprint pattern="^none$">
24
+ <description>bare 'none' -- assert nothing.</description>
25
+ <example>none</example>
26
+ <param pos="0" name="service.certainty" value="0.0"/>
27
+ </fingerprint>
28
+
29
+ <fingerprint pattern="^null$">
30
+ <description>bare 'null' -- assert nothing.</description>
31
+ <example>null</example>
32
+ <param pos="0" name="service.certainty" value="0.0"/>
33
+ </fingerprint>
34
+
35
+ <fingerprint pattern="(?i)^unknown$">
36
+ <description>bare 'unknown' -- assert nothing.</description>
37
+ <example>unknown</example>
38
+ <param pos="0" name="service.certainty" value="0.0"/>
39
+ </fingerprint>
40
+
41
+ <fingerprint pattern="^no version$">
42
+ <description>bare 'no version' -- assert nothing.</description>
43
+ <example>no version</example>
44
+ <param pos="0" name="service.certainty" value="0.0"/>
45
+ </fingerprint>
46
+
11
47
  <!-- Red Hat package naming:
12
48
  https://fedoraproject.org/wiki/Packaging:DistTag
13
49
  https://fedoraproject.org/wiki/Packaging:Versioning
@@ -161,6 +197,21 @@
161
197
  <param pos="0" name="os.product" value="Zentyal"/>
162
198
  </fingerprint>
163
199
 
200
+ <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)(?:-[\d\.]+)?\+deb10[\w~\.]+-Debian$">
201
+ <description>ISC BIND: Debian 10.0 (buster)</description>
202
+ <example service.version="9.11.5-P4">9.11.5-P4-5.1+deb10u1-Debian</example>
203
+ <param pos="0" name="service.vendor" value="ISC"/>
204
+ <param pos="0" name="service.family" value="BIND"/>
205
+ <param pos="0" name="service.product" value="BIND"/>
206
+ <param pos="1" name="service.version"/>
207
+ <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
208
+ <param pos="0" name="os.vendor" value="Debian"/>
209
+ <param pos="0" name="os.family" value="Linux"/>
210
+ <param pos="0" name="os.product" value="Linux"/>
211
+ <param pos="0" name="os.version" value="10.0"/>
212
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.0"/>
213
+ </fingerprint>
214
+
164
215
  <fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-9\+deb8u[\w~\.]+-Debian$">
165
216
  <description>ISC BIND: Debian 8.0 (jessie)</description>
166
217
  <example service.version="9.9.5">9.9.5-9+deb8u11-Debian</example>
@@ -376,13 +427,14 @@
376
427
  <param pos="0" name="service.cpe23" value="cpe:/a:powerdns:authoritative_server:{service.version}"/>
377
428
  </fingerprint>
378
429
 
379
- <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
430
+ <fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?[^ ]*) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
380
431
  <description>PowerDNS Authoritative Server: format 2</description>
381
432
  <example service.version="4.0.4">PowerDNS Authoritative Server 4.0.4 (built Jul 26 2017 15:04:27 by root@FreeBSD:11:amd64-default-job-03)</example>
382
433
  <example service.version="4.0.0-rc2">PowerDNS Authoritative Server 4.0.0-rc2 (built Jul 4 2016 15:44:39 by root@foo-bar.baz)</example>
383
434
  <example service.version="4.0.0-alpha2">PowerDNS Authoritative Server 4.0.0-alpha2 (built Feb 01 2016 00:12:05 by buildbot@baz)</example>
384
435
  <example service.version="4.0.0-beta1">PowerDNS Authoritative Server 4.0.0-beta1 (built Feb 01 2016 00:00:00 by buildbot@baz)</example>
385
436
  <example service.version="0.0.g56d692a">PowerDNS Authoritative Server 0.0.g56d692a (built Feb 25 2017 13:10:19 by root@foo-bar.baz)</example>
437
+ <example service.version="4.2.0-rc2.995.master.g8cc411dc4">PowerDNS Authoritative Server 4.2.0-rc2.995.master.g8cc411dc4 (built Nov 6 2019 11:48:12 by root@foo-bar.baz)</example>
386
438
  <param pos="0" name="service.vendor" value="PowerDNS"/>
387
439
  <param pos="0" name="service.family" value="PowerDNS"/>
388
440
  <param pos="0" name="service.product" value="Authoritative Server"/>
@@ -464,6 +516,7 @@
464
516
  <param pos="0" name="service.family" value="NSD"/>
465
517
  <param pos="0" name="service.product" value="dnsd"/>
466
518
  <param pos="1" name="service.version"/>
519
+ <param pos="0" name="service.cpe23" value="cpe:/a:nlnetlabs:name_server_daemon:{service.version}"/>
467
520
  </fingerprint>
468
521
 
469
522
  <fingerprint pattern="^unbound ([\d.]+)$">
@@ -473,6 +526,7 @@
473
526
  <param pos="0" name="service.family" value="Unbound"/>
474
527
  <param pos="0" name="service.product" value="unbound"/>
475
528
  <param pos="1" name="service.version"/>
529
+ <param pos="0" name="service.cpe23" value="cpe:/a:nlnetlabs:unbound:{service.version}"/>
476
530
  </fingerprint>
477
531
 
478
532
  <fingerprint pattern="^(?i:unbound)$">
@@ -481,6 +535,21 @@
481
535
  <param pos="0" name="service.vendor" value="NLnet Labs"/>
482
536
  <param pos="0" name="service.family" value="Unbound"/>
483
537
  <param pos="0" name="service.product" value="unbound"/>
538
+ <param pos="0" name="service.cpe23" value="cpe:/a:nlnetlabs:unbound:-"/>
539
+ </fingerprint>
540
+
541
+ <fingerprint pattern="^(?:BIND )?(9.[^-]+(?:-[SP]\d)?)(?:-[\d\.]+)?\+deb10u\d+-Raspbian$">
542
+ <description>ISC BIND: Raspbian based on Debian Buster</description>
543
+ <example service.version="9.11.5-P4">9.11.5-P4-5.1+deb10u1-Raspbian</example>
544
+ <param pos="0" name="service.vendor" value="ISC"/>
545
+ <param pos="0" name="service.family" value="BIND"/>
546
+ <param pos="0" name="service.product" value="BIND"/>
547
+ <param pos="1" name="service.version"/>
548
+ <param pos="0" name="service.cpe23" value="cpe:/a:isc:bind:{service.version}"/>
549
+ <param pos="0" name="os.vendor" value="Raspbian"/>
550
+ <param pos="0" name="os.family" value="Linux"/>
551
+ <param pos="0" name="os.product" value="Linux"/>
552
+ <param pos="0" name="os.version" value="10.0"/>
484
553
  </fingerprint>
485
554
 
486
555
  <fingerprint pattern="^(?:BIND )?(9.[^-]+(?:-[SP]\d)?)-9\+deb8u\d+-Raspbian$">
@@ -517,8 +586,9 @@
517
586
  <example service.version="2.5.0-dev">Knot DNS 2.5.0-dev</example>
518
587
  <param pos="0" name="service.vendor" value="cz.nic"/>
519
588
  <param pos="0" name="service.family" value="Knot"/>
520
- <param pos="0" name="service.product" value="DNS"/>
589
+ <param pos="0" name="service.product" value="Knot DNS"/>
521
590
  <param pos="1" name="service.version"/>
591
+ <param pos="0" name="service.cpe23" value="cpe:/a:knot-dns:knot_dns:{service.version}"/>
522
592
  </fingerprint>
523
593
 
524
594
  <fingerprint pattern="^UltraDNS Resolver$">
@@ -625,6 +695,34 @@
625
695
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:-"/>
626
696
  </fingerprint>
627
697
 
698
+ <!-- This value is a spoofed value. There isn't a publicly available version
699
+ of Windows with build 6.0.6100 and this explicit string is used in an
700
+ example of how to change your version on BIND. We tested servers reporting
701
+ this string and NONE of them were Windows DNS.
702
+ This fingerprint serves to prevent someone who doesn't know from creating
703
+ one and stops further pattern matching efforts.
704
+ -->
705
+
706
+ <fingerprint pattern="^Microsoft DNS 6.0.6100 \(2AEF76E\)$">
707
+ <description>SPOOFED - Microsoft DNS on Windows 2008 SP something</description>
708
+ <example>Microsoft DNS 6.0.6100 (2AEF76E)</example>
709
+ </fingerprint>
710
+
711
+ <fingerprint pattern="^Microsoft DNS 6.0.6003(?: \(\w+\))?$">
712
+ <description>Microsoft DNS on Windows 2008 Service Pack 2 - Preview Rollup KB4489887 and later</description>
713
+ <example>Microsoft DNS 6.0.6003 (1773501D)</example>
714
+ <param pos="0" name="service.vendor" value="Microsoft"/>
715
+ <param pos="0" name="service.family" value="DNS"/>
716
+ <param pos="0" name="service.product" value="DNS"/>
717
+ <param pos="0" name="service.version" value="6.0.6003"/>
718
+ <param pos="0" name="os.vendor" value="Microsoft"/>
719
+ <param pos="0" name="os.family" value="Windows"/>
720
+ <param pos="0" name="os.product" value="Windows Server 2008"/>
721
+ <param pos="0" name="os.version" value="Service Pack 2"/>
722
+ <param pos="0" name="os.build" value="6.0.6003"/>
723
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2008:Service Pack 2"/>
724
+ </fingerprint>
725
+
628
726
  <fingerprint pattern="^Microsoft DNS 6.0.6002(?: \(\w+\))?$">
629
727
  <description>Microsoft DNS on Windows 2008 Service Pack 2</description>
630
728
  <example>Microsoft DNS 6.0.6002 (17724D35)</example>
@@ -660,7 +758,8 @@
660
758
  <example>DNSServer</example>
661
759
  <param pos="0" name="service.vendor" value="Synology"/>
662
760
  <param pos="0" name="service.family" value="DSM"/>
663
- <param pos="0" name="service.product" value="DNS"/>
761
+ <param pos="0" name="service.product" value="DNS Server"/>
762
+ <param pos="0" name="service.cpe23" value="cpe:/a:synology:dns_server:-"/>
664
763
  <param pos="0" name="os.device" value="NAS"/>
665
764
  <param pos="0" name="os.family" value="Linux"/>
666
765
  <param pos="0" name="os.product" value="DSM"/>
@@ -761,9 +860,10 @@
761
860
  <fingerprint pattern="^gdnsd$">
762
861
  <description>gdnsd</description>
763
862
  <example>gdnsd</example>
764
- <param pos="0" name="service.vendor" value="Brandon Black"/>
863
+ <param pos="0" name="service.vendor" value="gdnsd"/>
765
864
  <param pos="0" name="service.family" value="gdnsd"/>
766
865
  <param pos="0" name="service.product" value="gdnsd"/>
866
+ <param pos="0" name="service.cpe23" value="cpe:/a:gdnsd:gdnsd:-"/>
767
867
  </fingerprint>
768
868
 
769
869
  <fingerprint pattern="^Hi: [\w\.: =]+\d{4}$">
@@ -788,8 +888,8 @@
788
888
 
789
889
  <fingerprint pattern="^CleanBrowsing v([^ ]+) - (.*)">
790
890
  <description>CleanBrowsing DNS Server</description>
791
- <example service.vendor="CleanBrowsing" service.family="CleanBrowsing" service.version="1.5a" service.node="dns-edge-usa-west-sunnyvale-p">CleanBrowsing v1.5a - dns-edge-usa-west-sunnyvale-p</example>
792
- <example service.vendor="CleanBrowsing" service.family="CleanBrowsing" service.version="1.4a" service.node="dns-edge-usa-west-sunnyvale.cleanbrowsing.org">CleanBrowsing v1.4a - dns-edge-usa-west-sunnyvale.cleanbrowsing.org</example>
891
+ <example service.version="1.5a" service.node="dns-edge-usa-west-sunnyvale-p">CleanBrowsing v1.5a - dns-edge-usa-west-sunnyvale-p</example>
892
+ <example service.version="1.4a" service.node="dns-edge-usa-west-sunnyvale.cleanbrowsing.org">CleanBrowsing v1.4a - dns-edge-usa-west-sunnyvale.cleanbrowsing.org</example>
793
893
  <param pos="0" name="service.vendor" value="CleanBrowsing"/>
794
894
  <param pos="0" name="service.family" value="CleanBrowsing"/>
795
895
  <param pos="0" name="service.product" value="DNS"/>
@@ -809,7 +909,7 @@
809
909
 
810
910
  <fingerprint pattern="^Q9-[^\-]-(.*)$">
811
911
  <description>Quad9 Resolver</description>
812
- <example service.vendor="IBM" service.family="Quad9" service.product="DNS" service.version="6.0">Q9-P-6.0</example>
912
+ <example service.version="6.0">Q9-P-6.0</example>
813
913
  <param pos="0" name="service.vendor" value="IBM"/>
814
914
  <param pos="0" name="service.family" value="Quad9"/>
815
915
  <param pos="0" name="service.product" value="DNS"/>
@@ -818,10 +918,18 @@
818
918
 
819
919
  <fingerprint pattern="^keweonDNS v\.(.*)$">
820
920
  <description>Keweon DNS</description>
821
- <example service.vendor="Keweon" service.product="DNS" service.version="9.63.7201">keweonDNS v.9.63.7201</example>
921
+ <example service.version="9.63.7201">keweonDNS v.9.63.7201</example>
822
922
  <param pos="0" name="service.vendor" value="Keweon"/>
823
923
  <param pos="0" name="service.product" value="DNS"/>
824
924
  <param pos="1" name="service.version"/>
825
925
  </fingerprint>
826
926
 
927
+ <fingerprint pattern="^Version: recursive-main/(\d+)$">
928
+ <description>Akamai AnswerX DNS server</description>
929
+ <example service.version="22386077">Version: recursive-main/22386077</example>
930
+ <param pos="0" name="service.vendor" value="Akamai"/>
931
+ <param pos="0" name="service.product" value="AnswerX"/>
932
+ <param pos="1" name="service.version"/>
933
+ </fingerprint>
934
+
827
935
  </fingerprints>
@@ -362,11 +362,12 @@
362
362
  <param pos="0" name="service.cpe23" value="cpe:/a:jetbrains:teamcity:-"/>
363
363
  </fingerprint>
364
364
 
365
- <fingerprint pattern="^e48c482f8f5a8e5a6249b21a39f911e7$"><description>Cockroach DB Console</description>
365
+ <fingerprint pattern="^e48c482f8f5a8e5a6249b21a39f911e7$">
366
+ <description>Cockroach DB Console</description>
366
367
  <example>e48c482f8f5a8e5a6249b21a39f911e7</example>
367
368
  <param pos="0" name="service.vendor" value="Cockroach Labs"/>
368
369
  <param pos="0" name="service.product" value="CockroachDB"/>
369
- <param pos="0" name="service.certainty" value="0.5"/>
370
+ <param pos="0" name="service.certainty" value="0.5"/>
370
371
  </fingerprint>
371
372
 
372
373
  <fingerprint pattern="^(?:4f21edb50ae95a99bbd4aa0a956a179e|1531801cb9e3047e72034ed34da9d104)$">
@@ -360,6 +360,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
360
360
  <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-</example>
361
361
  <example service.version="1.0.11">=(&lt;*&gt;)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(&lt;*&gt;)=-&#13;
362
362
  more stuff</example>
363
+ <param pos="0" name="service.fvendor" value="PureFTPd"/>
363
364
  <param pos="0" name="service.family" value="Pure-FTPd"/>
364
365
  <param pos="0" name="service.product" value="Pure-FTPd"/>
365
366
  <param pos="1" name="service.version"/>
@@ -374,16 +375,20 @@ more stuff</example>
374
375
  <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;
375
376
  more text</example>
376
377
  <param pos="1" name="pureftpd.config"/>
378
+ <param pos="0" name="service.vendor" value="PureFTPd"/>
377
379
  <param pos="0" name="service.family" value="Pure-FTPd"/>
378
380
  <param pos="0" name="service.product" value="Pure-FTPd"/>
381
+ <param pos="0" name="service.cpe23" value="cpe:/a:pureftpd:pure-ftpd:-"/>
379
382
  </fingerprint>
380
383
 
381
384
  <fingerprint pattern="^(?:Welcome to )?Pure-FTPd\.?$">
382
385
  <description>Basic Pure-FTPd banner, no version</description>
383
386
  <example>Welcome to Pure-FTPd</example>
384
387
  <example>Pure-FTPd.</example>
388
+ <param pos="0" name="service.vendor" value="PureFTPd"/>
385
389
  <param pos="0" name="service.family" value="Pure-FTPd"/>
386
390
  <param pos="0" name="service.product" value="Pure-FTPd"/>
391
+ <param pos="0" name="service.cpe23" value="cpe:/a:pureftpd:pure-ftpd:-"/>
387
392
  </fingerprint>
388
393
 
389
394
  <fingerprint pattern="^=\(.\*.\)=-\.:\. \(\( Welcome to PureFTPd (\d+\..+) \)\) \.:\.-=\(.\*.\)=-" flags="REG_MULTILINE">
@@ -391,26 +396,56 @@ more text</example>
391
396
  <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-</example>
392
397
  <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-&#13;
393
398
  more text</example>
399
+ <param pos="0" name="service.vendor" value="PureFTPd"/>
394
400
  <param pos="0" name="service.family" value="Pure-FTPd"/>
395
401
  <param pos="0" name="service.product" value="Pure-FTPd"/>
396
402
  <param pos="1" name="service.version"/>
403
+ <param pos="0" name="service.cpe23" value="cpe:/a:pureftpd:pure-ftpd:{service.version}"/>
397
404
  </fingerprint>
398
405
 
399
- <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+)(?: for WinSock)? ready\.*$">
400
- <description>Serv-U (only runs on Windows)</description>
406
+ <!-- CPEs for Serv-U 15.x and above changed to SolarWinds -->
407
+
408
+ <fingerprint pattern="^Serv-U FTP Server v(15\.\S+) ready\.\.\.$">
409
+ <description>SolarWinds Serv-U with version </description>
410
+ <example service.version="15.1.3.25">Serv-U FTP Server v15.1.3.25 ready...</example>
411
+ <param pos="0" name="service.vendor" value="SolarWinds"/>
412
+ <param pos="0" name="service.product" value="Serv-U FTP Server"/>
413
+ <param pos="0" name="service.family" value="Serv-U"/>
414
+ <param pos="1" name="service.version"/>
415
+ <param pos="0" name="service.cpe23" value="cpe:/a:solarwinds:serv-u_ftp_server:{service.version}"/>
416
+ </fingerprint>
417
+
418
+ <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) for WinSock ready\.*$">
419
+ <description>Serv-U Serv-U with version on Windows</description>
401
420
  <example service.version="2.5n">Serv-U FTP-Server v2.5n for WinSock ready...</example>
402
421
  <example service.version="6.0">Serv-U FTP Server v6.0 for WinSock ready</example>
403
- <example service.version="7.2">Serv-U FTP Server v7.2 ready...</example>
404
- <param pos="0" name="service.vendor" value="Rhino Software"/>
422
+ <param pos="0" name="service.vendor" value="Serv-U"/>
405
423
  <param pos="0" name="service.product" value="Serv-U"/>
406
424
  <param pos="0" name="service.family" value="Serv-U"/>
407
425
  <param pos="1" name="service.version"/>
426
+ <param pos="0" name="service.cpe23" value="cpe:/a:serv-u:serv-u:{service.version}"/>
408
427
  <param pos="0" name="os.vendor" value="Microsoft"/>
409
428
  <param pos="0" name="os.family" value="Windows"/>
410
429
  <param pos="0" name="os.product" value="Windows"/>
411
430
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
412
431
  </fingerprint>
413
432
 
433
+ <fingerprint pattern="^Serv-U FTP[ -]Server v(\d+\.\S+) ready\.*$">
434
+ <description>Serv-U Serv-U with version </description>
435
+ <example service.version="7.2">Serv-U FTP Server v7.2 ready...</example>
436
+ <example service.version="14.0">Serv-U FTP Server v14.0 ready...</example>
437
+ <param pos="0" name="service.vendor" value="Serv-U"/>
438
+ <param pos="0" name="service.product" value="Serv-U"/>
439
+ <param pos="0" name="service.family" value="Serv-U"/>
440
+ <param pos="1" name="service.version"/>
441
+ <param pos="0" name="service.cpe23" value="cpe:/a:serv-u:serv-u:{service.version}"/>
442
+ </fingerprint>
443
+
444
+ <fingerprint pattern="^Welcom to Serv-U FTP Server$">
445
+ <description>Common FTP banner modification to look like Serv-U -- assert nothing.</description>
446
+ <example>Welcom to Serv-U FTP Server</example>
447
+ </fingerprint>
448
+
414
449
  <fingerprint pattern="^zFTPServer v?(\S+), .*ready\.$" flags="REG_ICASE">
415
450
  <description>zftpserver (only runs on Windows)</description>
416
451
  <example service.version="4.0">zFTPServer v4.0, build 2008-12-24 01:41 ready.</example>
@@ -427,23 +462,28 @@ more text</example>
427
462
  <description>vsFTPd (Very Secure FTP Daemon)</description>
428
463
  <example service.version="1.1.3">(vsFTPd 1.1.3) host</example>
429
464
  <example service.version="2.0.5">(vsFTPd 2.0.5)</example>
465
+ <param pos="0" name="service.vendor" value="vsFTPd Project"/>
430
466
  <param pos="0" name="service.family" value="vsFTPd"/>
431
467
  <param pos="0" name="service.product" value="vsFTPd"/>
432
468
  <param pos="1" name="service.version"/>
469
+ <param pos="0" name="service.cpe23" value="cpe:/a:vsftpd_project:vsftpd:{service.version}"/>
433
470
  <param pos="2" name="host.name"/>
434
471
  </fingerprint>
435
472
 
436
473
  <fingerprint pattern="^ready, dude \(vsFTPd (\d+\..+): beat me, break me\)$">
437
474
  <description>vsFTPd (Very Secure FTP Daemon) - break me variant</description>
438
475
  <example service.version="1.1.0">ready, dude (vsFTPd 1.1.0: beat me, break me)</example>
476
+ <param pos="0" name="service.vendor" value="vsFTPd Project"/>
439
477
  <param pos="0" name="service.family" value="vsFTPd"/>
440
478
  <param pos="0" name="service.product" value="vsFTPd"/>
441
479
  <param pos="1" name="service.version"/>
480
+ <param pos="0" name="service.cpe23" value="cpe:/a:vsftpd_project:vsftpd:{service.version}"/>
442
481
  </fingerprint>
443
482
 
444
483
  <fingerprint pattern="^vsFTPd ([\d.]+\+ \(ext\.3\)) ready\.\.\.$">
445
484
  <description>vsFTPd (Very Secure FTP Daemon) extended build (vsftpd.devnet.ru)</description>
446
485
  <example service.version="2.0.4+ (ext.3)">vsFTPd 2.0.4+ (ext.3) ready...</example>
486
+ <param pos="0" name="service.vendor" value="vsFTPd Project"/>
447
487
  <param pos="0" name="service.family" value="vsFTPd"/>
448
488
  <param pos="0" name="service.product" value="vsFTPd Extended"/>
449
489
  <param pos="1" name="service.version"/>
@@ -453,8 +493,10 @@ more text</example>
453
493
  <description>vsFTPd (Very Secure FTP Daemon) error message</description>
454
494
  <example>OOPS: vsftpd: root is not mounted.</example>
455
495
  <example>OOPS: cannot read user list file:/etc/vsftpd.user_list</example>
496
+ <param pos="0" name="service.vendor" value="vsFTPd Project"/>
456
497
  <param pos="0" name="service.family" value="vsFTPd"/>
457
498
  <param pos="0" name="service.product" value="vsFTPd"/>
499
+ <param pos="0" name="service.cpe23" value="cpe:/a:vsftpd_project:vsftpd:-"/>
458
500
  </fingerprint>
459
501
 
460
502
  <fingerprint pattern="^FileZilla Server(?: version)? (?:v)?(\d\.[\w.]+(?: beta)?).*$">
@@ -463,9 +505,15 @@ more text</example>
463
505
  <example service.version="0.9.13a beta">FileZilla Server version 0.9.13a beta</example>
464
506
  <example service.version="0.9.54 beta">FileZilla Server 0.9.54 beta</example>
465
507
  <example service.version="0.9.33 beta">FileZilla Server v0.9.33 beta</example>
466
- <param pos="0" name="service.family" value="FileZilla FTP Server"/>
467
- <param pos="0" name="service.product" value="FileZilla FTP Server"/>
508
+ <param pos="0" name="service.vendor" value="Filezilla-Project"/>
509
+ <param pos="0" name="service.family" value="FileZilla FTP"/>
510
+ <param pos="0" name="service.product" value="FileZilla Server"/>
468
511
  <param pos="1" name="service.version"/>
512
+ <param pos="0" name="service.cpe23" value="cpe:/a:filezilla-project:filezilla_server:{service.version}"/>
513
+ <param pos="0" name="os.vendor" value="Microsoft"/>
514
+ <param pos="0" name="os.family" value="Windows"/>
515
+ <param pos="0" name="os.product" value="Windows"/>
516
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
469
517
  </fingerprint>
470
518
 
471
519
  <fingerprint pattern="^\s*APC FTP server ready\.$">
@@ -574,6 +622,7 @@ more text</example>
574
622
  <param pos="0" name="os.family" value="z/OS"/>
575
623
  <param pos="0" name="os.device" value="Mainframe"/>
576
624
  <param pos="1" name="os.version"/>
625
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:z\/os:{os.version}"/>
577
626
  <param pos="2" name="host.name"/>
578
627
  </fingerprint>
579
628
 
@@ -1291,7 +1340,7 @@ more text</example>
1291
1340
  <param pos="0" name="os.product" value="Tru64 Unix"/>
1292
1341
  <param pos="1" name="host.name"/>
1293
1342
  <param pos="2" name="os.version"/>
1294
- <param pos="0" name="os.cpe23" value="cpe:/o:hp:tru64:{os.version}"/>
1343
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:tru64_unix:{os.version}"/>
1295
1344
  </fingerprint>
1296
1345
 
1297
1346
  <fingerprint pattern="^(\S+) FTP server \(Digital UNIX Version (\S+)\) ready\.?$">
@@ -1314,9 +1363,11 @@ more text</example>
1314
1363
  <param pos="0" name="os.cpe23" value="cpe:/o:mikrotik:routeros:{os.version}"/>
1315
1364
  </fingerprint>
1316
1365
 
1317
- <fingerprint pattern="^MikroTik FTP server \(MikroTik ([\w.]+)\) ready\.?$">
1318
- <description>MikroTik w/o hostname</description>
1319
- <example os.version="6.0rc14">MikroTik FTP server (MikroTik 6.0rc14) ready</example>
1366
+ <fingerprint pattern="^.* FTP server \(MikroTik (\d\.[\w\.]+)\) ready\.?$">
1367
+ <description>MikroTik with description</description>
1368
+ <example os.version="6.43.16">Super Thing_Place- FTP server (MikroTik 6.43.16) ready</example>
1369
+ <example os.version="6.43.16beta2">Super Thing_Place- FTP server (MikroTik 6.43.16beta2) ready</example>
1370
+ <example os.version="6.43.16rc56">Super Thing_Place- FTP server (MikroTik 6.43.16rc56) ready</example>
1320
1371
  <param pos="0" name="os.vendor" value="MikroTik"/>
1321
1372
  <param pos="0" name="os.product" value="RouterOS"/>
1322
1373
  <param pos="1" name="os.version"/>
@@ -1721,4 +1772,15 @@ more text</example>
1721
1772
  <param pos="0" name="os.device" value="Printer"/>
1722
1773
  </fingerprint>
1723
1774
 
1775
+ <fingerprint pattern="^SurgeFTP ([\S]+) \(Version ([a-f\d.]+)\)$">
1776
+ <description>NetWin SurgeFTP</description>
1777
+ <example service.version="2.3a12">SurgeFTP 192.168.0.0 (Version 2.3a12)</example>
1778
+ <example host.name="foo.bar.baz">SurgeFTP foo.bar.baz (Version 2.2f9)</example>
1779
+ <param pos="0" name="service.vendor" value="NetWin"/>
1780
+ <param pos="0" name="service.product" value="SurgeFTP"/>
1781
+ <param pos="2" name="service.version"/>
1782
+ <param pos="0" name="service.cpe23" value="cpe:/a:netwin:surgeftp:{service.version}"/>
1783
+ <param pos="1" name="host.name"/>
1784
+ </fingerprint>
1785
+
1724
1786
  </fingerprints>