recog 3.0.2 → 3.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (22) hide show
  1. checksums.yaml +4 -4
  2. checksums.yaml.gz.sig +1 -2
  3. data/README.md +45 -2
  4. data/lib/recog/fingerprint.rb +9 -2
  5. data/lib/recog/version.rb +1 -1
  6. data/recog/xml/dhcp_vendor_class.xml +753 -2
  7. data/recog/xml/dns_versionbind.xml +3 -3
  8. data/recog/xml/favicons.xml +289 -49
  9. data/recog/xml/ftp_banners.xml +34 -9
  10. data/recog/xml/html_title.xml +256 -25
  11. data/recog/xml/http_cookies.xml +89 -2
  12. data/recog/xml/http_servers.xml +335 -9
  13. data/recog/xml/http_wwwauth.xml +21 -1
  14. data/recog/xml/imap_banners.xml +19 -8
  15. data/recog/xml/smb_native_os.xml +1 -1
  16. data/recog/xml/smtp_banners.xml +7 -7
  17. data/recog/xml/snmp_sysdescr.xml +26 -5
  18. data/recog/xml/ssh_banners.xml +2 -2
  19. data/recog/xml/tls_jarm.xml +6 -6
  20. data.tar.gz.sig +0 -0
  21. metadata +2 -2
  22. metadata.gz.sig +0 -0
data/recog/xml/ftp_banners.xml CHANGED
@@ -1277,17 +1277,19 @@ more text</example>
1277
1277
  </fingerprint>
1278
1278
 
1279
1279
  <fingerprint pattern="^(ZBR-\d+) Version (\S+) ready\.?$">
1280
- <description>ZebraNet Print Server FTP</description>
1281
- <example os.product="ZBR-46686" os.version="7.02" hw.product="ZBR-46686">ZBR-46686 Version 7.02 ready.</example>
1282
- <example os.version="V56.17.5Z" os.product="ZBR-79071" hw.product="ZBR-79071">ZBR-79071 Version V56.17.5Z ready.</example>
1283
- <example os.version="7.02" os.product="ZBR-46687" hw.product="ZBR-46687">ZBR-46687 Version 7.02 ready.</example>
1284
- <param pos="0" name="os.vendor" value="ZebraNet"/>
1285
- <param pos="0" name="os.device" value="Print Server"/>
1286
- <param pos="1" name="os.product"/>
1280
+ <description>Zebra ZebraNet Print Server FTP</description>
1281
+ <example hw.product="ZBR-46686" os.version="7.02">ZBR-46686 Version 7.02 ready.</example>
1282
+ <example hw.product="ZBR-79071" os.version="V56.17.5Z">ZBR-79071 Version V56.17.5Z ready.</example>
1283
+ <example hw.product="ZBR-46687" os.version="7.02">ZBR-46687 Version 7.02 ready.</example>
1284
+ <param pos="0" name="os.vendor" value="Zebra"/>
1285
+ <param pos="0" name="os.family" value="ZebraNet"/>
1286
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
1287
1287
  <param pos="2" name="os.version"/>
1288
- <param pos="0" name="hw.vendor" value="ZebraNet"/>
1289
- <param pos="0" name="hw.device" value="Print Server"/>
1288
+ <param pos="0" name="os.device" value="Print Server"/>
1289
+ <param pos="0" name="hw.vendor" value="Zebra"/>
1290
+ <param pos="0" name="hw.family" value="ZebraNet"/>
1290
1291
  <param pos="1" name="hw.product"/>
1292
+ <param pos="0" name="hw.device" value="Print Server"/>
1291
1293
  </fingerprint>
1292
1294
 
1293
1295
  <fingerprint pattern="^(ET(\S{1,32})) Dell (\S+ Laser Printer) FTP Server">
@@ -1792,6 +1794,18 @@ more text</example>
1792
1794
  <param pos="0" name="hw.device" value="Power Device"/>
1793
1795
  </fingerprint>
1794
1796
 
1797
+ <fingerprint pattern="^(Sentry Switched (?:PDU|CDU)) v(\d+(?:\.\d+)*[a-z](?:-[a-z][0-9])*) FTP server ready\.">
1798
+ <description>Server Technology Sentry Switched Device</description>
1799
+ <example hw.product="Sentry Switched PDU" os.product="Sentry Switched PDU Firmware" os.version="8.0w">Sentry Switched PDU v8.0w FTP server ready.</example>
1800
+ <example hw.product="Sentry Switched CDU" os.product="Sentry Switched CDU Firmware" os.version="7.1e-d1">Sentry Switched CDU v7.1e-d1 FTP server ready.</example>
1801
+ <param pos="0" name="os.vendor" value="Server Technology"/>
1802
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
1803
+ <param pos="2" name="os.version"/>
1804
+ <param pos="0" name="hw.vendor" value="Server Technology"/>
1805
+ <param pos="1" name="hw.product"/>
1806
+ <param pos="0" name="hw.device" value="Power Device"/>
1807
+ </fingerprint>
1808
+
1795
1809
  <fingerprint pattern="^Printer's ftp server (?:\d+) Please login with USER and PASS\.$">
1796
1810
  <description>Weidmüller Printer</description>
1797
1811
  <example>Printer's ftp server 530 Please login with USER and PASS.</example>
@@ -1799,4 +1813,15 @@ more text</example>
1799
1813
  <param pos="0" name="hw.device" value="Printer"/>
1800
1814
  </fingerprint>
1801
1815
 
1816
+ <fingerprint pattern="^(\S{1,512})?\s*FTP server \(Medusa Async V(\d+(?:\.\d+)*) \[experimental\]\) ready\.$">
1817
+ <description>Medusa - extensible Internet server framework for Python</description>
1818
+ <example host.name="foo.bar" service.version="2.43">foo.bar FTP server (Medusa Async V2.43 [experimental]) ready.</example>
1819
+ <example host.name="10.10.10.10" service.version="41297">10.10.10.10 FTP server (Medusa Async V41297 [experimental]) ready.</example>
1820
+ <example service.version="24763"> FTP server (Medusa Async V24763 [experimental]) ready.</example>
1821
+ <param pos="0" name="service.vendor" value="Nightmare Software"/>
1822
+ <param pos="0" name="service.product" value="Medusa"/>
1823
+ <param pos="1" name="host.name"/>
1824
+ <param pos="2" name="service.version"/>
1825
+ </fingerprint>
1826
+
1802
1827
  </fingerprints>
data/recog/xml/html_title.xml CHANGED
@@ -333,7 +333,7 @@
333
333
  <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
334
334
  </fingerprint>
335
335
 
336
- <fingerprint pattern="^NETIASPOT Management Console|Konsola zarzdzania NETIASPOT$">
336
+ <fingerprint pattern="^(?:NETIASPOT Management Console|Konsola zarzdzania NETIASPOT)$">
337
337
  <description>Netia Spot wireless router</description>
338
338
  <example>Konsola zarzdzania NETIASPOT</example>
339
339
  <example>NETIASPOT Management Console</example>
@@ -576,7 +576,7 @@
576
576
  <param pos="0" name="service.cpe23" value="cpe:/a:ui:unifi_video:-"/>
577
577
  </fingerprint>
578
578
 
579
- <fingerprint pattern="^UniFi NVR: Software Portal|airVision: \[NVR\] - Software Portal$">
579
+ <fingerprint pattern="^(?:UniFi NVR: Software Portal|airVision: \[NVR\] - Software Portal)$">
580
580
  <description>UniFi NVR for recording from UniFi video cameras</description>
581
581
  <example>UniFi NVR: Software Portal</example>
582
582
  <example>airVision: [NVR] - Software Portal</example>
@@ -682,7 +682,7 @@
682
682
  <param pos="0" name="hw.device" value="Switch"/>
683
683
  </fingerprint>
684
684
 
685
- <fingerprint pattern="^Welcome to nginx!|Test Page for the Nginx HTTP Server$">
685
+ <fingerprint pattern="^(?:Welcome to nginx!|Test Page for the Nginx HTTP Server)$">
686
686
  <description>Default OS-agnostic nginx</description>
687
687
  <example>Welcome to nginx!</example>
688
688
  <example>Test Page for the Nginx HTTP Server</example>
@@ -921,11 +921,13 @@
921
921
  </fingerprint>
922
922
 
923
923
  <fingerprint pattern="^Sentry Switched CDU$">
924
- <description>Sentry Switched CDU</description>
924
+ <description>Server Technology Sentry Switched CDU</description>
925
925
  <example>Sentry Switched CDU</example>
926
- <param pos="0" name="hw.vendor" value="ServerTech"/>
927
- <param pos="0" name="hw.device" value="Power Device"/>
926
+ <param pos="0" name="os.vendor" value="Server Technology"/>
927
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
928
+ <param pos="0" name="hw.vendor" value="Server Technology"/>
928
929
  <param pos="0" name="hw.product" value="Sentry Switched CDU"/>
930
+ <param pos="0" name="hw.device" value="Power Device"/>
929
931
  </fingerprint>
930
932
 
931
933
  <fingerprint pattern="^Emerson Network Power Rack PDU Card$">
@@ -2026,14 +2028,86 @@
2026
2028
  <param pos="0" name="service.cpe23" value="cpe:/a:manageengine:desktop_central:-"/>
2027
2029
  </fingerprint>
2028
2030
 
2029
- <fingerprint pattern="^ManageEngine ADAudit Plus$">
2030
- <description>ManageEngineADAudit Plus</description>
2031
- <example>ManageEngine ADAudit Plus</example>
2031
+ <fingerprint pattern="^ADAudit Plus$">
2032
+ <description>ManageEngine ADAudit Plus</description>
2033
+ <example>ADAudit Plus</example>
2032
2034
  <param pos="0" name="service.vendor" value="ManageEngine"/>
2033
2035
  <param pos="0" name="service.product" value="ADAudit Plus"/>
2034
2036
  <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_adaudit_plus:-"/>
2035
2037
  </fingerprint>
2036
2038
 
2039
+ <fingerprint pattern="^ManageEngine - ADManager Plus$">
2040
+ <description>ManageEngine ADManager Plus</description>
2041
+ <example>ManageEngine - ADManager Plus</example>
2042
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2043
+ <param pos="0" name="service.product" value="ADManager Plus"/>
2044
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_admanager_plus:-"/>
2045
+ </fingerprint>
2046
+
2047
+ <fingerprint pattern="^ManageEngine AssetExplorer$">
2048
+ <description>ManageEngine AssetExplorer</description>
2049
+ <example>ManageEngine AssetExplorer</example>
2050
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2051
+ <param pos="0" name="service.product" value="AssetExplorer"/>
2052
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_assetexplorer:-"/>
2053
+ </fingerprint>
2054
+
2055
+ <fingerprint pattern="^ManageEngine Endpoint Central$">
2056
+ <description>ManageEngine Endpoint Central (formerly Desktop Central)</description>
2057
+ <example>ManageEngine Endpoint Central</example>
2058
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2059
+ <param pos="0" name="service.product" value="Endpoint Central"/>
2060
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_desktop_central:-"/>
2061
+ </fingerprint>
2062
+
2063
+ <fingerprint pattern="^ManageEngine PAM360$">
2064
+ <description>ManageEngine PAM360</description>
2065
+ <example>ManageEngine PAM360</example>
2066
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2067
+ <param pos="0" name="service.product" value="PAM360"/>
2068
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_pam360:-"/>
2069
+ </fingerprint>
2070
+
2071
+ <fingerprint pattern="^ManageEngine PasswordManager Pro$">
2072
+ <description>ManageEngine Password Manager Pro</description>
2073
+ <example>ManageEngine PasswordManager Pro</example>
2074
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2075
+ <param pos="0" name="service.product" value="ManageEngine Password Manager Pro"/>
2076
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_password_manager_pro:-"/>
2077
+ </fingerprint>
2078
+
2079
+ <fingerprint pattern="^ManageEngine Access Manager Plus$">
2080
+ <description>ManageEngine Access Manager Plus</description>
2081
+ <example>ManageEngine Access Manager Plus</example>
2082
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2083
+ <param pos="0" name="service.product" value="Access Manager Plus"/>
2084
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_access_manager_plus:-"/>
2085
+ </fingerprint>
2086
+
2087
+ <fingerprint pattern="^ManageEngine ServiceDesk Plus$">
2088
+ <description>ManageEngine ServiceDesk Plus</description>
2089
+ <example>ManageEngine ServiceDesk Plus</example>
2090
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2091
+ <param pos="0" name="service.product" value="ManageEngine ServiceDesk Plus"/>
2092
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_servicedesk_plus:-"/>
2093
+ </fingerprint>
2094
+
2095
+ <fingerprint pattern="^ManageEngine ServiceDesk Plus - MSP$">
2096
+ <description>ManageEngine ServiceDesk Plus MSP</description>
2097
+ <example>ManageEngine ServiceDesk Plus - MSP</example>
2098
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2099
+ <param pos="0" name="service.product" value="ServiceDesk Plus MSP"/>
2100
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_servicedesk_plus_msp:-"/>
2101
+ </fingerprint>
2102
+
2103
+ <fingerprint pattern="^ManageEngine SupportCenter Plus$">
2104
+ <description>ManageEngine SupportCenter Plus</description>
2105
+ <example>ManageEngine SupportCenter Plus</example>
2106
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
2107
+ <param pos="0" name="service.product" value="SupportCenter Plus"/>
2108
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_supportcenter_plus:-"/>
2109
+ </fingerprint>
2110
+
2037
2111
  <fingerprint pattern="^(ScanFront \d.+)Web Menu$">
2038
2112
  <!-- no space between the product model and "Web Menu" in the title -->
2039
2113
 
@@ -2387,7 +2461,7 @@
2387
2461
  <param pos="0" name="hw.product" value="Network Node"/>
2388
2462
  </fingerprint>
2389
2463
 
2390
- <fingerprint pattern="^S2 Netbox Login|Home - NetBox$">
2464
+ <fingerprint pattern="^(?:S2 Netbox Login|Home - NetBox)$">
2391
2465
  <description>S2 Netbox Appliance</description>
2392
2466
  <example>S2 Netbox Login</example>
2393
2467
  <example>Home - NetBox</example>
@@ -2439,7 +2513,7 @@
2439
2513
  <param pos="0" name="service.cpe23" value="cpe:/a:ibm:tivoli_storage_flashcopy_manager:-"/>
2440
2514
  </fingerprint>
2441
2515
 
2442
- <fingerprint pattern="^Jupyter Notebook|JupyterLab|Home Page - Select or create a notebook$">
2516
+ <fingerprint pattern="^(?:Jupyter Notebook|JupyterLab|Home Page - Select or create a notebook)$">
2443
2517
  <description>Jupyter Notebook Server</description>
2444
2518
  <example>Jupyter Notebook</example>
2445
2519
  <example>JupyterLab</example>
@@ -2500,7 +2574,7 @@
2500
2574
  <param pos="0" name="service.product" value="Network Monitor"/>
2501
2575
  </fingerprint>
2502
2576
 
2503
- <fingerprint pattern="^BrightSign&amp;reg;|BrightSign Applications|Diagnostics Web Server$">
2577
+ <fingerprint pattern="^(?:BrightSign&amp;reg;|BrightSign Applications|Diagnostics Web Server)$">
2504
2578
  <description>BrightSign Controller</description>
2505
2579
  <example>BrightSign&amp;reg;</example>
2506
2580
  <example>BrightSign Applications</example>
@@ -2521,7 +2595,7 @@
2521
2595
  <param pos="0" name="hw.device" value="WAP"/>
2522
2596
  </fingerprint>
2523
2597
 
2524
- <fingerprint pattern="^DD System Manager|System Manager$">
2598
+ <fingerprint pattern="^(?:DD System Manager|System Manager)$">
2525
2599
  <description>Data Domain System Manager</description>
2526
2600
  <example>DD System Manager</example>
2527
2601
  <example>System Manager</example>
@@ -2574,7 +2648,7 @@
2574
2648
  <param pos="0" name="service.cpe23" value="cpe:/a:influxdata:influxdb:2.0"/>
2575
2649
  </fingerprint>
2576
2650
 
2577
- <fingerprint pattern="^Sign in . GitLab|GitLab|GitLab is not responding$">
2651
+ <fingerprint pattern="^(?:Sign in . GitLab|GitLab|GitLab is not responding)$">
2578
2652
  <description>GitLab</description>
2579
2653
  <example>Sign in · GitLab</example>
2580
2654
  <example>GitLab is not responding</example>
@@ -2585,7 +2659,7 @@
2585
2659
  <param pos="0" name="service.cpe23" value="cpe:/a:gitlab:gitlab:-"/>
2586
2660
  </fingerprint>
2587
2661
 
2588
- <fingerprint pattern="^GitHub Enterprise|Setup GitHub Enterprise|GitHub Enterprise preflight check$">
2662
+ <fingerprint pattern="^(?:GitHub Enterprise|Setup GitHub Enterprise|GitHub Enterprise preflight check)$">
2589
2663
  <description>GitHub Enterprise</description>
2590
2664
  <example>GitHub Enterprise</example>
2591
2665
  <example>Setup GitHub Enterprise</example>
@@ -2594,7 +2668,7 @@
2594
2668
  <param pos="0" name="service.product" value="Enterprise"/>
2595
2669
  </fingerprint>
2596
2670
 
2597
- <fingerprint pattern="^SAP NetWeaver Application Server Java|SAP&amp;#x20;NetWeaver&amp;#x20;Portal|Loading Portal\.\.\.$">
2671
+ <fingerprint pattern="^(?:SAP NetWeaver Application Server Java|SAP&amp;#x20;NetWeaver&amp;#x20;Portal|Loading Portal\.\.\.)$">
2598
2672
  <description>SAP NetWeaver Portal</description>
2599
2673
  <example>SAP NetWeaver Application Server Java</example>
2600
2674
  <example>SAP&amp;#x20;NetWeaver&amp;#x20;Portal</example>
@@ -2613,7 +2687,7 @@
2613
2687
  <param pos="0" name="service.cpe23" value="cpe:/a:lansweeper:lansweeper:-"/>
2614
2688
  </fingerprint>
2615
2689
 
2616
- <fingerprint pattern="^Celery Flower|Flower$">
2690
+ <fingerprint pattern="^(?:Celery Flower|Flower)$">
2617
2691
  <description>Celery Flower Dashboard</description>
2618
2692
  <example>Celery Flower</example>
2619
2693
  <example>Flower</example>
@@ -2753,7 +2827,7 @@
2753
2827
  <param pos="0" name="service.cpe23" value="cpe:/a:apache:flink:-"/>
2754
2828
  </fingerprint>
2755
2829
 
2756
- <fingerprint pattern="^Twonky|Twonky Server|TwonkyMedia|TwonkyMedia server media browser$">
2830
+ <fingerprint pattern="^(?:Twonky|Twonky Server|TwonkyMedia|TwonkyMedia server media browser)$">
2757
2831
  <description>Twonky Server</description>
2758
2832
  <example>Twonky</example>
2759
2833
  <example>Twonky Server</example>
@@ -2798,7 +2872,7 @@
2798
2872
  <param pos="0" name="service.cpe23" value="cpe:/a:sabnzbd:sabnzbd:-"/>
2799
2873
  </fingerprint>
2800
2874
 
2801
- <fingerprint pattern="^Zabbix|.*: Zabbix$">
2875
+ <fingerprint pattern="^(?:Zabbix|.*: Zabbix)$">
2802
2876
  <description>Zabbix</description>
2803
2877
  <example>Zabbix</example>
2804
2878
  <example>appliance: Zabbix</example>
@@ -2820,7 +2894,7 @@
2820
2894
  <param pos="0" name="os.cpe23" value="cpe:/o:dd-wrt:dd-wrt:{os.version}"/>
2821
2895
  </fingerprint>
2822
2896
 
2823
- <fingerprint pattern="^Apache Druid|Druid Console|Legacy Coordinator Console$">
2897
+ <fingerprint pattern="^(?:Apache Druid|Druid Console|Legacy Coordinator Console)$">
2824
2898
  <description>Apache Druid</description>
2825
2899
  <example>Apache Druid</example>
2826
2900
  <example>Legacy Coordinator Console</example>
@@ -3030,7 +3104,7 @@
3030
3104
  <param pos="0" name="service.cpe23" value="cpe:/a:solarwinds:virtualization_manager:-"/>
3031
3105
  </fingerprint>
3032
3106
 
3033
- <fingerprint pattern="^Gitea: .*|LocalRepo|TurnKey Gitea$">
3107
+ <fingerprint pattern="^(?:Gitea: .*|LocalRepo|TurnKey Gitea)$">
3034
3108
  <description>Gitea</description>
3035
3109
  <example>Gitea: Git with a cup of tea</example>
3036
3110
  <example>TurnKey Gitea</example>
@@ -3118,7 +3192,7 @@
3118
3192
  <param pos="0" name="service.cpe23" value="cpe:/a:rstudio:connect:-"/>
3119
3193
  </fingerprint>
3120
3194
 
3121
- <fingerprint pattern="^TurnKey Moodle|New Site$">
3195
+ <fingerprint pattern="^(?:TurnKey Moodle|New Site)$">
3122
3196
  <description>Moodle</description>
3123
3197
  <example>TurnKey Moodle</example>
3124
3198
  <example>New Site</example>
@@ -3157,7 +3231,15 @@
3157
3231
  <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:jira:-"/>
3158
3232
  </fingerprint>
3159
3233
 
3160
- <fingerprint pattern="^Welcome to XAMPP|XAMPP for Linux">
3234
+ <fingerprint pattern="^Log in - Bitbucket$">
3235
+ <description>Atlassian Bitbucket</description>
3236
+ <example>Log in - Bitbucket</example>
3237
+ <param pos="0" name="service.vendor" value="Atlassian"/>
3238
+ <param pos="0" name="service.product" value="Bitbucket"/>
3239
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:bitbucket:-"/>
3240
+ </fingerprint>
3241
+
3242
+ <fingerprint pattern="^(?:Welcome to XAMPP|XAMPP for Linux)">
3161
3243
  <description>XAMPP Server</description>
3162
3244
  <example>Welcome to XAMPP</example>
3163
3245
  <example>XAMPP for Linux</example>
@@ -3182,7 +3264,7 @@
3182
3264
  <param pos="0" name="service.cpe23" value="cpe:/a:kodi:kodi:-"/>
3183
3265
  </fingerprint>
3184
3266
 
3185
- <fingerprint pattern="^Drupal|TurnKey Drupal\d+|Select an installation profile$">
3267
+ <fingerprint pattern="^(?:Drupal|TurnKey Drupal\d+|Select an installation profile)$">
3186
3268
  <description>Drupal CMS</description>
3187
3269
  <example>Drupal</example>
3188
3270
  <example>TurnKey Drupal8</example>
@@ -3859,7 +3941,7 @@
3859
3941
  <param pos="0" name="hw.family" value="Vigor"/>
3860
3942
  </fingerprint>
3861
3943
 
3862
- <fingerprint pattern="^WSO2 API Manager|\[Publisher Portal\]WSO2 APIM$">
3944
+ <fingerprint pattern="^(?:WSO2 API Manager|\[Publisher Portal\]WSO2 APIM)$">
3863
3945
  <description>WSO2 API Manager</description>
3864
3946
  <example>WSO2 API Manager</example>
3865
3947
  <example>[Publisher Portal]WSO2 APIM</example>
@@ -3910,6 +3992,155 @@
3910
3992
  <param pos="0" name="service.cpe23" value="cpe:/a:zimbra:collaboration:-"/>
3911
3993
  </fingerprint>
3912
3994
 
3995
+ <fingerprint pattern="^OpenKM$">
3996
+ <description>OpenKM - Open Source Document Management System</description>
3997
+ <example>OpenKM</example>
3998
+ <param pos="0" name="service.vendor" value="OpenKM"/>
3999
+ <param pos="0" name="service.product" value="OpenKM"/>
4000
+ <param pos="0" name="service.cpe23" value="cpe:/a:openkm:openkm:-"/>
4001
+ </fingerprint>
4002
+
4003
+ <fingerprint pattern="^\s*(?:\S)*\s*::\s*Mayan EDMS\s*$">
4004
+ <description>Mayan EDMS - open-source document management system</description>
4005
+ <example>:: Mayan EDMS</example>
4006
+ <example>Home :: Mayan EDMS</example>
4007
+ <param pos="0" name="service.vendor" value="Mayan-EDMS"/>
4008
+ <param pos="0" name="service.product" value="Mayan EDMS"/>
4009
+ <param pos="0" name="service.cpe23" value="cpe:/a:mayan-edms:mayan_edms:-"/>
4010
+ </fingerprint>
4011
+
4012
+ <fingerprint pattern="^Papermerge \| Log in$">
4013
+ <description>Papermerge - open-source document management system</description>
4014
+ <example>Papermerge | Log in</example>
4015
+ <param pos="0" name="service.vendor" value="Papermerge"/>
4016
+ <param pos="0" name="service.product" value="Papermerge"/>
4017
+ <param pos="0" name="service.cpe23" value="cpe:/a:papermerge:papermerge:-"/>
4018
+ </fingerprint>
4019
+
4020
+ <fingerprint pattern="^(?:FileRun :: (?:Login|Installation))|(?:(?:\S)* :: Login \(powered by FileRun\))$">
4021
+ <description>FileRun - self-hosted Google Drive alternative</description>
4022
+ <example>FileRun :: Login</example>
4023
+ <example>FileRun :: Installation</example>
4024
+ <example>FileRun :: Login (powered by FileRun)</example>
4025
+ <example>App Title :: Login (powered by FileRun)</example>
4026
+ <param pos="0" name="service.vendor" value="FileRun"/>
4027
+ <param pos="0" name="service.product" value="FileRun"/>
4028
+ <param pos="0" name="service.cpe23" value="cpe:/a:filerun:filerun:-"/>
4029
+ </fingerprint>
4030
+
4031
+ <fingerprint pattern="^SuiteCRM$">
4032
+ <description>SuiteCRM</description>
4033
+ <example>SuiteCRM</example>
4034
+ <param pos="0" name="service.vendor" value="SalesAgility"/>
4035
+ <param pos="0" name="service.product" value="SuiteCRM"/>
4036
+ <param pos="0" name="service.cpe23" value="cpe:/a:salesagility:suitecrm:-"/>
4037
+ </fingerprint>
4038
+
4039
+ <fingerprint pattern="^OpenSearch Dashboards$">
4040
+ <description>OpenSearch Dashboards</description>
4041
+ <example>OpenSearch Dashboards</example>
4042
+ <param pos="0" name="service.vendor" value="Amazon"/>
4043
+ <param pos="0" name="service.product" value="OpenSearch"/>
4044
+ <param pos="0" name="service.cpe23" value="cpe:/a:amazon:opensearch:-"/>
4045
+ </fingerprint>
4046
+
4047
+ <fingerprint pattern="^Supervisor Status$">
4048
+ <description>Supervisor - web interface</description>
4049
+ <example>Supervisor Status</example>
4050
+ <param pos="0" name="service.vendor" value="Supervisord"/>
4051
+ <param pos="0" name="service.product" value="Supervisor"/>
4052
+ <param pos="0" name="service.cpe23" value="cpe:/a:supervisord:supervisor:-"/>
4053
+ </fingerprint>
4054
+
4055
+ <fingerprint pattern="^qdPM (?:\| Login|(\d+(?:\.\d+)*)(?: BETA)? Installation)$">
4056
+ <description>qdPM - project management tool</description>
4057
+ <example>qdPM | Login</example>
4058
+ <example service.version="9.1">qdPM 9.1 Installation</example>
4059
+ <example service.version="9.0">qdPM 9.0 BETA Installation</example>
4060
+ <param pos="0" name="service.vendor" value="qdPM"/>
4061
+ <param pos="0" name="service.product" value="qdPM"/>
4062
+ <param pos="1" name="service.version"/>
4063
+ <param pos="0" name="service.cpe23" value="cpe:/a:qdpm:qdpm:{service.version}"/>
4064
+ </fingerprint>
4065
+
4066
+ <fingerprint pattern="^ZAP API UI$">
4067
+ <description>OWASP Zed Attack Proxy (ZAP) - API Web UI</description>
4068
+ <example>ZAP API UI</example>
4069
+ <param pos="0" name="service.vendor" value="OWASP"/>
4070
+ <param pos="0" name="service.product" value="Zed Attack Proxy"/>
4071
+ <param pos="0" name="service.cpe23" value="cpe:/a:owasp:zed_attack_proxy:-"/>
4072
+ </fingerprint>
4073
+
4074
+ <fingerprint pattern="^CloudPanel \| Log In$">
4075
+ <description>CloudPanel - server control panel</description>
4076
+ <example>CloudPanel | Log In</example>
4077
+ <param pos="0" name="service.vendor" value="MGT-COMMERCE GmbH"/>
4078
+ <param pos="0" name="service.product" value="CloudPanel"/>
4079
+ </fingerprint>
4080
+
4081
+ <fingerprint pattern="^(?:Login \| Control WebPanel|CWP \| User)$">
4082
+ <description>Control Web Panel (CWP) (formerly CentOS Web Panel) - web hosting control panel</description>
4083
+ <example>Login | Control WebPanel</example>
4084
+ <example>CWP | User</example>
4085
+ <param pos="0" name="service.vendor" value="Control Web Panel"/>
4086
+ <param pos="0" name="service.product" value="Control Web Panel"/>
4087
+ <param pos="0" name="service.cpe23" value="cpe:/a:control-webpanel:webpanel:-"/>
4088
+ <param pos="0" name="os.family" value="Linux"/>
4089
+ <param pos="0" name="os.product" value="Linux"/>
4090
+ </fingerprint>
4091
+
4092
+ <fingerprint pattern="^Graphs \(darkstat [^)]+\)$">
4093
+ <description>darkstat - network statistics gatherer</description>
4094
+ <example>Graphs (darkstat eth0)</example>
4095
+ <example>Graphs (darkstat lagg0.4091, lagg0.21, lagg0.101, lagg0.102, lagg0.4001, lagg0.4081)</example>
4096
+ <param pos="0" name="service.vendor" value="darkstat Project"/>
4097
+ <param pos="0" name="service.product" value="darkstat"/>
4098
+ </fingerprint>
4099
+
4100
+ <fingerprint pattern="^Login to Cacti$">
4101
+ <description>Cacti - network graphing solution</description>
4102
+ <example>Login to Cacti</example>
4103
+ <param pos="0" name="service.vendor" value="Cacti"/>
4104
+ <param pos="0" name="service.product" value="Cacti"/>
4105
+ <param pos="0" name="service.cpe23" value="cpe:/a:cacti:cacti:-"/>
4106
+ </fingerprint>
4107
+
4108
+ <fingerprint pattern="^Bitwarden Web Vault$">
4109
+ <description>Bitwarden Server</description>
4110
+ <example>Bitwarden Web Vault</example>
4111
+ <param pos="0" name="service.vendor" value="Bitwarden"/>
4112
+ <param pos="0" name="service.product" value="Server"/>
4113
+ <param pos="0" name="service.cpe23" value="cpe:/a:bitwarden:server:-"/>
4114
+ </fingerprint>
4115
+
4116
+ <fingerprint pattern="^Vaultwarden Web Vault$">
4117
+ <description>Vaultwarden - unofficial Bitwarden compatible server</description>
4118
+ <example>Vaultwarden Web Vault</example>
4119
+ <param pos="0" name="service.vendor" value="Vaultwarden"/>
4120
+ <param pos="0" name="service.product" value="Vaultwarden"/>
4121
+ </fingerprint>
4122
+
4123
+ <fingerprint pattern="^(?:GoAnywhere (\d+(?:\.\d+)*)(?: - \S{1,512})?|GoAnywhere Web Client - Login)$">
4124
+ <description>Fortra GoAnywhere MFT - managed file transfer</description>
4125
+ <example service.version="7.0.3">GoAnywhere 7.0.3</example>
4126
+ <example service.version="6.8.6">GoAnywhere 6.8.6 - Production</example>
4127
+ <example>GoAnywhere Web Client - Login</example>
4128
+ <param pos="0" name="service.vendor" value="Fortra"/>
4129
+ <param pos="0" name="service.product" value="GoAnywhere MFT"/>
4130
+ <param pos="1" name="service.version"/>
4131
+ <param pos="0" name="service.cpe23" value="cpe:/a:helpsystems:goanywhere_managed_file_transfer:{service.version}"/>
4132
+ </fingerprint>
4133
+
4134
+ <fingerprint pattern="^Server Backup Manager SE\s*(?:- .{1,512})?$">
4135
+ <description>ConnectWise R1Soft Server Backup Manager (SBM)</description>
4136
+ <example>Server Backup Manager SE</example>
4137
+ <example>Server Backup Manager SE </example>
4138
+ <example>Server Backup Manager SE - foo.bar</example>
4139
+ <example>Server Backup Manager SE - [1234] FooBar</example>
4140
+ <param pos="0" name="service.vendor" value="ConnectWise"/>
4141
+ <param pos="0" name="service.product" value="R1Soft Server Backup Manager"/>
4142
+ </fingerprint>
4143
+
3913
4144
  <!-- Specific Eltex fingerprints to enable CPE generation -->
3914
4145
 
3915
4146
  <fingerprint pattern="^Eltex - NTP-RG-1402G$">
data/recog/xml/http_cookies.xml CHANGED
@@ -277,6 +277,14 @@
277
277
  <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:fisheye:-"/>
278
278
  </fingerprint>
279
279
 
280
+ <fingerprint pattern="^BITBUCKETSESSIONID=">
281
+ <description>Atlassian Bitbucket</description>
282
+ <example>BITBUCKETSESSIONID=49D9B4A9C574CFA312E671F3453CEAC5; Max-Age=1209600; Expires=Tue, 04-Oct-2022 22:16:45 GMT; Path=/; HttpOnly</example>
283
+ <param pos="0" name="service.vendor" value="Atlassian"/>
284
+ <param pos="0" name="service.product" value="Bitbucket"/>
285
+ <param pos="0" name="service.cpe23" value="cpe:/a:atlassian:bitbucket:-"/>
286
+ </fingerprint>
287
+
280
288
  <fingerprint pattern="(?i)^(BIGipServer([^=]+))=">
281
289
  <description>F5 BIG-IP LTM - Server variant</description>
282
290
  <example loadbalancer.poolname="CustomerRP" cookie="BigIpServerCustomerRP">BigIpServerCustomerRP=5a; path=/; domain=.foo.bar; secure; HttpOnly</example>
@@ -673,6 +681,14 @@
673
681
  <param pos="0" name="service.certainty" value="0.5"/>
674
682
  </fingerprint>
675
683
 
684
+ <fingerprint pattern="^laravel_session=">
685
+ <description>Laravel PHP web application framework</description>
686
+ <example>laravel_session=eyJpdiI6IjZmcXM4SXZqNVQxY2U2UDVEb1V0SFE9PSIsInZhbHVlIjoiQlRUYXk2WEsxUkZmVU5lRXpBTlZkUURkUnphR0RGMTdaRDkxWHFLVGhtaUZwM0plaWR2aVMyeVQ5MmFzNlVFczVQUExpeDdhUUZveVlCOVUxMVA4dHp6ZUQrK0t3KzBUaVlxb2o4WUxleE1rb29GTlozZWF6cXpUUTRnNFpJTHUiLCJtYWMiOiI3ZGNhNzhmOGRmMWFmZmE5ZjFiYjQ5ODBlNGEwMjgzZWNiZGI2ZTI4ZjFmYWJkMmIxZTgwYzM2NjA1OThlNGNlIn0%3D; expires=Mon, 13-Mar-2023 18:21:13 GMT; Max-Age=7200; path=/; httponly; samesite=lax</example>
687
+ <param pos="0" name="service.vendor" value="Laravel"/>
688
+ <param pos="0" name="service.product" value="Laravel"/>
689
+ <param pos="0" name="service.cpe23" value="cpe:/a:laravel:laravel:-"/>
690
+ </fingerprint>
691
+
676
692
  <fingerprint pattern="^phpMyAdmin=">
677
693
  <description>phpMyAdmin web interface for MySQL and MariaDB</description>
678
694
  <example>phpMyAdmin=28600e9ff9772c871dacec70f9c5edaa; path=/; HttpOnly</example>
@@ -699,14 +715,52 @@
699
715
  <param pos="0" name="service.cpe23" value="cpe:/a:mongo-express_project:mongo-express:-"/>
700
716
  </fingerprint>
701
717
 
702
- <fingerprint pattern="^adscsrf=">
718
+ <fingerprint pattern="^(JSESSIONIDADMP|admpcsrf)=">
719
+ <description>ManageEngine ADManager Plus</description>
720
+ <example cookie="JSESSIONIDADMP">JSESSIONIDADMP=3A92A25349FECF56B7D7D6FF915545B5; Path=/; HttpOnly</example>
721
+ <example cookie="admpcsrf">admpcsrf=f5fe4a87-0365-4d04-a8e2-87b3c640092e;path=/;priority=high</example>
722
+ <param pos="1" name="cookie"/>
723
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
724
+ <param pos="0" name="service.product" value="ADManager Plus"/>
725
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_admanager_plus:-"/>
726
+ </fingerprint>
727
+
728
+ <fingerprint pattern="^(JSESSIONIDADAP|adapcsrf)=">
729
+ <description>ManageEngine ADAudit Plus</description>
730
+ <example cookie="JSESSIONIDADAP">JSESSIONIDADAP=BB472B7AD767571D913190056ED594CB; Path=/; HttpOnly</example>
731
+ <example cookie="adapcsrf">adapcsrf=97fcd4a1-078f-487b-bd73-ca492ef05121;path=/;priority=high</example>
732
+ <param pos="1" name="cookie"/>
733
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
734
+ <param pos="0" name="service.product" value="ADAudit Plus"/>
735
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_adaudit_plus:-"/>
736
+ </fingerprint>
737
+
738
+ <fingerprint pattern="^(JSESSIONIDADSSP|adscsrf)=">
703
739
  <description>ManageEngine ADSelfService Plus</description>
704
- <example>adscsrf=cffff6b5-bd68-4c35-92ef-e45127e68289;path=/;priority=high</example>
740
+ <example cookie="JSESSIONIDADSSP">JSESSIONIDADSSP=A7FECBD71C67184E929AF80715C29C20; Path=/; Secure; HttpOnly</example>
741
+ <example cookie="adscsrf">adscsrf=cffff6b5-bd68-4c35-92ef-e45127e68289;path=/;priority=high</example>
742
+ <param pos="1" name="cookie"/>
705
743
  <param pos="0" name="service.vendor" value="ManageEngine"/>
706
744
  <param pos="0" name="service.product" value="ADSelfService Plus"/>
707
745
  <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_adselfservice_plus:-"/>
708
746
  </fingerprint>
709
747
 
748
+ <fingerprint pattern="^ad360csrf=">
749
+ <description>ManageEngine Active Directory 360 (AD360)</description>
750
+ <example>ad360csrf=03c99789-515c-4aa9-8823-7e2e8e8b3026;path=/;SameSite=None;Secure;priority=high</example>
751
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
752
+ <param pos="0" name="service.product" value="AD360"/>
753
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_ad360:-"/>
754
+ </fingerprint>
755
+
756
+ <fingerprint pattern="^ZROPJSESSIONID=">
757
+ <description>ManageEngine Analytics Plus</description>
758
+ <example>ZROPJSESSIONID=FECE4724AC1990DBCC45DD3DA6CB3002; Path=/; Secure; HttpOnly</example>
759
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
760
+ <param pos="0" name="service.product" value="Analytics Plus"/>
761
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_analytics_plus:-"/>
762
+ </fingerprint>
763
+
710
764
  <fingerprint pattern="^(dmid|opvc|sitevisitscookie)=">
711
765
  <description>dotCMS Content Management Platform</description>
712
766
  <example cookie="dmid">dmid=dcd46b93-54ab-4a43-a023-99154f879c3e; Max-Age=153792000; Expires=Thu, 18-Mar-2027 21:28:37 GMT; Path=/; HttpOnly; SameSite=Strict</example>
@@ -718,6 +772,39 @@
718
772
  <param pos="0" name="service.cpe23" value="cpe:/a:dotcms:dotcms:-"/>
719
773
  </fingerprint>
720
774
 
775
+ <fingerprint pattern="^qdPM8=">
776
+ <description>qdPM - project management tool</description>
777
+ <example>qdPM8=57d23588bfe525e24760bf4c73b10759; path=/</example>
778
+ <param pos="0" name="service.vendor" value="qdPM"/>
779
+ <param pos="0" name="service.product" value="qdPM"/>
780
+ <param pos="0" name="service.cpe23" value="cpe:/a:qdpm:qdpm:-"/>
781
+ </fingerprint>
782
+
783
+ <fingerprint pattern="^cloudpanel=">
784
+ <description>CloudPanel - server control panel</description>
785
+ <example>cloudpanel=9rs2cohqs9bfq5fch54j2m5eje; path=/; secure; httponly; samesite=lax</example>
786
+ <param pos="0" name="service.vendor" value="MGT-COMMERCE GmbH"/>
787
+ <param pos="0" name="service.product" value="CloudPanel"/>
788
+ </fingerprint>
789
+
790
+ <fingerprint pattern="^cwpsrv-[0-9a-f]{32}=">
791
+ <description>Control Web Panel (CWP) (formerly CentOS Web Panel) - web hosting control panel</description>
792
+ <example>cwpsrv-5df9a64aa14f59216453d6f07164a7f1=aq0jsl5muvuli7cif5p9ut7dtm; path=/</example>
793
+ <param pos="0" name="service.vendor" value="Control Web Panel"/>
794
+ <param pos="0" name="service.product" value="Control Web Panel"/>
795
+ <param pos="0" name="service.cpe23" value="cpe:/a:control-webpanel:webpanel:-"/>
796
+ <param pos="0" name="os.family" value="Linux"/>
797
+ <param pos="0" name="os.product" value="Linux"/>
798
+ </fingerprint>
799
+
800
+ <fingerprint pattern="^FileRunSID=">
801
+ <description>FileRun - self-hosted Google Drive alternative</description>
802
+ <example>FileRunSID=966e9a0441b5fea1a72af53b1a6adc8f; path=/; HttpOnly</example>
803
+ <param pos="0" name="service.vendor" value="FileRun"/>
804
+ <param pos="0" name="service.product" value="FileRun"/>
805
+ <param pos="0" name="service.cpe23" value="cpe:/a:filerun:filerun:-"/>
806
+ </fingerprint>
807
+
721
808
  <!--
722
809
  Ignore various cookies that are very generic cookies for session IDs
723
810
  that are not necessarily indicative of any particular