recog 3.0.2 → 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. checksums.yaml +4 -4
  2. checksums.yaml.gz.sig +1 -2
  3. data/README.md +45 -2
  4. data/lib/recog/fingerprint.rb +9 -2
  5. data/lib/recog/version.rb +1 -1
  6. data/recog/xml/dhcp_vendor_class.xml +753 -2
  7. data/recog/xml/dns_versionbind.xml +3 -3
  8. data/recog/xml/favicons.xml +289 -49
  9. data/recog/xml/ftp_banners.xml +34 -9
  10. data/recog/xml/html_title.xml +256 -25
  11. data/recog/xml/http_cookies.xml +89 -2
  12. data/recog/xml/http_servers.xml +335 -9
  13. data/recog/xml/http_wwwauth.xml +21 -1
  14. data/recog/xml/imap_banners.xml +19 -8
  15. data/recog/xml/smb_native_os.xml +1 -1
  16. data/recog/xml/smtp_banners.xml +7 -7
  17. data/recog/xml/snmp_sysdescr.xml +26 -5
  18. data/recog/xml/ssh_banners.xml +2 -2
  19. data/recog/xml/tls_jarm.xml +6 -6
  20. data.tar.gz.sig +0 -0
  21. metadata +2 -2
  22. metadata.gz.sig +0 -0
data/recog/xml/http_servers.xml CHANGED
@@ -113,11 +113,11 @@
113
113
  -->
114
114
 
115
115
  <fingerprint pattern="(?i)^cwpsrv$">
116
- <description>CentOS Web Panel</description>
116
+ <description>Control Web Panel (CWP) (formerly CentOS Web Panel) - web hosting control panel web server</description>
117
117
  <example>cwpsrv</example>
118
- <param pos="0" name="service.vendor" value="CentOS WebPanel"/>
119
- <param pos="0" name="service.product" value="CentOS Web Panel"/>
120
- <param pos="0" name="service.cpe23" value="cpe:/a:centos-webpanel:centos_web_panel:-"/>
118
+ <param pos="0" name="service.vendor" value="Control Web Panel"/>
119
+ <param pos="0" name="service.product" value="Control Web Panel"/>
120
+ <param pos="0" name="service.cpe23" value="cpe:/a:control-webpanel:webpanel:-"/>
121
121
  <param pos="0" name="os.family" value="Linux"/>
122
122
  <param pos="0" name="os.product" value="Linux"/>
123
123
  </fingerprint>
@@ -956,8 +956,8 @@
956
956
  <param pos="0" name="service.cpe23" value="cpe:/a:openresty:openresty:{service.version}"/>
957
957
  </fingerprint>
958
958
 
959
- <fingerprint pattern="^gunicorn\/([\d.]+)+$">
960
- <description>Gunicorn Gunicorn</description>
959
+ <fingerprint pattern="^gunicorn\/(\d+(?:\.\d+)*)$">
960
+ <description>Gunicorn with version</description>
961
961
  <example service.version="19.7.1">gunicorn/19.7.1</example>
962
962
  <param pos="0" name="service.vendor" value="Gunicorn"/>
963
963
  <param pos="0" name="service.product" value="Gunicorn"/>
@@ -965,6 +965,14 @@
965
965
  <param pos="0" name="service.cpe23" value="cpe:/a:gunicorn:gunicorn:{service.version}"/>
966
966
  </fingerprint>
967
967
 
968
+ <fingerprint pattern="^gunicorn$">
969
+ <description>Gunicorn with no version</description>
970
+ <example>gunicorn</example>
971
+ <param pos="0" name="service.vendor" value="Gunicorn"/>
972
+ <param pos="0" name="service.product" value="Gunicorn"/>
973
+ <param pos="0" name="service.cpe23" value="cpe:/a:gunicorn:gunicorn:-"/>
974
+ </fingerprint>
975
+
968
976
  <fingerprint pattern="^Serv-U\/([\d.]+)$">
969
977
  <description>Serv-U HTTP interface</description>
970
978
  <example service.version="15.1.6.31">Serv-U/15.1.6.31</example>
@@ -1256,7 +1264,7 @@
1256
1264
  <param pos="1" name="apache.variant.version"/>
1257
1265
  </fingerprint>
1258
1266
 
1259
- <fingerprint pattern="(?i)^IBM_HTTP_SERVER|IBM-HTTP-SERVER$">
1267
+ <fingerprint pattern="(?i)^(?:IBM_HTTP_SERVER|IBM-HTTP-SERVER)$">
1260
1268
  <description>IBM HTTP Server with no version info</description>
1261
1269
  <example>IBM_HTTP_SERVER</example>
1262
1270
  <example>IBM_HTTP_Server</example>
@@ -2018,7 +2026,7 @@
2018
2026
  <param pos="0" name="os.product" value="Appliance"/>
2019
2027
  </fingerprint>
2020
2028
 
2021
- <fingerprint pattern="^BigIP|BIG-IP$">
2029
+ <fingerprint pattern="^(?:BigIP|BIG-IP)$">
2022
2030
  <description>F5 BIG-IP</description>
2023
2031
  <param pos="0" name="service.vendor" value="F5"/>
2024
2032
  <param pos="0" name="service.product" value="BIG-IP LTM"/>
@@ -2593,6 +2601,17 @@
2593
2601
  <param pos="2" name="python.version"/>
2594
2602
  </fingerprint>
2595
2603
 
2604
+ <fingerprint pattern="(?i)^BaseHTTP/((?:\d+\.)*\d+)\s*Python/((?:\d+\.)*\d+)$">
2605
+ <description>BaseHTTPRequestHandler Python class must be subclassed to handle each request method.</description>
2606
+ <example service.version="0.3" python.version="2.7.18">BaseHTTP/0.3 Python/2.7.18</example>
2607
+ <example service.version="0.6" python.version="3.10.6">BaseHTTP/0.6 Python/3.10.6</example>
2608
+ <param pos="0" name="service.vendor" value="Python Software Foundation"/>
2609
+ <param pos="0" name="service.product" value="BaseHTTP"/>
2610
+ <param pos="0" name="service.family" value="Python"/>
2611
+ <param pos="1" name="service.version"/>
2612
+ <param pos="2" name="python.version"/>
2613
+ </fingerprint>
2614
+
2596
2615
  <fingerprint pattern="^Python/(\d\.[\d.]+) aiohttp/(\d[\w.]+)$">
2597
2616
  <description>AIOHTTP Project AIOHTTP</description>
2598
2617
  <example service.version="3.7.4.post0" python.version="3.8">Python/3.8 aiohttp/3.7.4.post0</example>
@@ -2612,6 +2631,26 @@
2612
2631
  <param pos="0" name="service.cpe23" value="cpe:/a:encode:uvicorn:-"/>
2613
2632
  </fingerprint>
2614
2633
 
2634
+ <fingerprint pattern="^WSGIServer/(\d+(?:\.\d+)*)\s*C?Python/(\d+(?:\.\d+)*)$">
2635
+ <description>WSGIServer (wsgiref.simple_server) – a simple WSGI HTTP server for Python</description>
2636
+ <example service.version="0.1" python.version="2.7.18">WSGIServer/0.1 Python/2.7.18</example>
2637
+ <example service.version="0.2" python.version="3.10.5">WSGIServer/0.2 CPython/3.10.5</example>
2638
+ <param pos="0" name="service.vendor" value="Python Software Foundation"/>
2639
+ <param pos="0" name="service.product" value="WSGIServer"/>
2640
+ <param pos="0" name="service.family" value="Python"/>
2641
+ <param pos="1" name="service.version"/>
2642
+ <param pos="2" name="python.version"/>
2643
+ </fingerprint>
2644
+
2645
+ <fingerprint pattern="^Medusa/(\d+(?:\.\d+)*)$">
2646
+ <description>Medusa - extensible Internet server framework for Python</description>
2647
+ <example service.version="3.41">Medusa/3.41</example>
2648
+ <example service.version="2118">Medusa/2118</example>
2649
+ <param pos="0" name="service.vendor" value="Nightmare Software"/>
2650
+ <param pos="0" name="service.product" value="Medusa"/>
2651
+ <param pos="1" name="service.version"/>
2652
+ </fingerprint>
2653
+
2615
2654
  <fingerprint pattern="^Grandstream (GXP[^\s]+) ([\d\.]+)$">
2616
2655
  <description>Grandstream IP Phone</description>
2617
2656
  <example hw.product="GXP2020" hw.version="1.2.5.3">Grandstream GXP2020 1.2.5.3</example>
@@ -3253,7 +3292,7 @@
3253
3292
  <param pos="0" name="service.cpe23" value="cpe:/a:intel:active_management_technology:{service.version}"/>
3254
3293
  </fingerprint>
3255
3294
 
3256
- <fingerprint pattern="^AMT|Intel\(R\) Active Management Technology$">
3295
+ <fingerprint pattern="^(?:AMT|Intel\(R\) Active Management Technology)$">
3257
3296
  <description>Intel(R) Active Management Technology (AMT) without a version</description>
3258
3297
  <example>AMT</example>
3259
3298
  <example>Intel(R) Active Management Technology</example>
@@ -4817,6 +4856,15 @@
4817
4856
  <param pos="0" name="service.cpe23" value="cpe:/a:ballerina:ballerina:{service.version}"/>
4818
4857
  </fingerprint>
4819
4858
 
4859
+ <fingerprint pattern="^Restlet-Framework/(\d+(?:\.\d+)*)$">
4860
+ <description>Restlet Framework - REST API framework for Java</description>
4861
+ <example service.version="2.4.3">Restlet-Framework/2.4.3</example>
4862
+ <param pos="0" name="service.vendor" value="Talend"/>
4863
+ <param pos="0" name="service.product" value="Restlet"/>
4864
+ <param pos="1" name="service.version"/>
4865
+ <param pos="0" name="service.cpe23" value="cpe:/a:talend:restlet:{service.version}"/>
4866
+ </fingerprint>
4867
+
4820
4868
  <fingerprint pattern="^((?:Mini|ZTE) web server) ([\d.]+) ZTE corp \d{4}\.$">
4821
4869
  <description>Assorted ZTE CPE device web server</description>
4822
4870
  <example service.product="Mini web server" service.version="1.0">Mini web server 1.0 ZTE corp 2005.</example>
@@ -4828,4 +4876,282 @@
4828
4876
  <param pos="0" name="hw.vendor" value="ZTE"/>
4829
4877
  </fingerprint>
4830
4878
 
4879
+ <fingerprint pattern="^PAM360$">
4880
+ <description>ManageEngine PAM360</description>
4881
+ <example>PAM360</example>
4882
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
4883
+ <param pos="0" name="service.product" value="PAM360"/>
4884
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_pam360:-"/>
4885
+ </fingerprint>
4886
+
4887
+ <fingerprint pattern="^PMP$">
4888
+ <description>ManageEngine Password Manager Pro</description>
4889
+ <example>PMP</example>
4890
+ <param pos="0" name="service.vendor" value="ManageEngine"/>
4891
+ <param pos="0" name="service.product" value="ManageEngine Password Manager Pro"/>
4892
+ <param pos="0" name="service.cpe23" value="cpe:/a:zohocorp:manageengine_password_manager_pro:-"/>
4893
+ </fingerprint>
4894
+
4895
+ <fingerprint pattern="^Crow/((?:\d+(?:\.\d+)*)|\S+)$">
4896
+ <description>Crow - C++ framework for web services</description>
4897
+ <example service.version="0.3">Crow/0.3</example>
4898
+ <example service.version="master">Crow/master</example>
4899
+ <param pos="0" name="service.vendor" value="CrowCPP"/>
4900
+ <param pos="0" name="service.product" value="Crow"/>
4901
+ <param pos="1" name="service.version"/>
4902
+ <param pos="0" name="service.cpe23" value="cpe:/a:crowcpp:crow:{service.version}"/>
4903
+ </fingerprint>
4904
+
4905
+ <fingerprint pattern="^darkstat/(\d+(?:\.\d+)*)$">
4906
+ <description>darkstat - network statistics gatherer</description>
4907
+ <example service.version="3.0.719">darkstat/3.0.719</example>
4908
+ <param pos="0" name="service.vendor" value="darkstat Project"/>
4909
+ <param pos="0" name="service.product" value="darkstat"/>
4910
+ <param pos="1" name="service.version"/>
4911
+ </fingerprint>
4912
+
4913
+ <fingerprint pattern="^darkhttpd/(\d+(?:\.\d+)*)(?:\.from\.git)?$">
4914
+ <description>darkhttpd - web server</description>
4915
+ <example service.version="1.12">darkhttpd/1.12</example>
4916
+ <example service.version="1.13">darkhttpd/1.13.from.git</example>
4917
+ <param pos="0" name="service.vendor" value="darkhttpd Project"/>
4918
+ <param pos="0" name="service.product" value="darkhttpd"/>
4919
+ <param pos="1" name="service.version"/>
4920
+ <param pos="0" name="service.cpe23" value="cpe:/a:darkhttpd_project:darkhttpd:{service.version}"/>
4921
+ </fingerprint>
4922
+
4923
+ <fingerprint pattern="^ServerTech-AWS/v(\d+(?:\.\d+)*[a-z](?:-[a-z][0-9])*)$">
4924
+ <description>Server Technology Advanced Web Server (AWS)</description>
4925
+ <example service.version="7.1g-b1">ServerTech-AWS/v7.1g-b1</example>
4926
+ <example service.version="8.0x">ServerTech-AWS/v8.0x</example>
4927
+ <param pos="0" name="service.vendor" value="Server Technology"/>
4928
+ <param pos="0" name="service.product" value="Advanced Web Server"/>
4929
+ <param pos="1" name="service.version"/>
4930
+ <param pos="0" name="os.vendor" value="Server Technology"/>
4931
+ <param pos="0" name="hw.vendor" value="Server Technology"/>
4932
+ </fingerprint>
4933
+
4934
+ <!-- ntopng -->
4935
+
4936
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[(?:FreeBSD |[\w-]+-freebsd)(\d+(?:\.\d+)*)(?:[a-z0-9-])* \[(\w+)\]\[[^\]]*\]\]$">
4937
+ <description>ntopng - web-based network traffic monitoring on FreeBSD</description>
4938
+ <example service.version="5.0.220112" os.version="12.3" os.arch="amd64">ntopng 5.0.220112 [FreeBSD 12.3 [amd64][FreeBSD 12.3]]</example>
4939
+ <example service.version="3.8.201001" os.version="11.3" os.arch="amd64">ntopng 3.8.201001 [amd64-unknown-freebsd11.3 [amd64][]]</example>
4940
+ <example service.version="3.4.0" os.version="12.2" os.arch="arm">ntopng 3.4.0 [armv7-unknown-freebsd12.2-gnueabihf [arm][]]</example>
4941
+ <param pos="0" name="service.vendor" value="ntop"/>
4942
+ <param pos="0" name="service.product" value="ntopng"/>
4943
+ <param pos="1" name="service.version"/>
4944
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
4945
+ <param pos="0" name="os.vendor" value="FreeBSD"/>
4946
+ <param pos="0" name="os.family" value="FreeBSD"/>
4947
+ <param pos="0" name="os.product" value="FreeBSD"/>
4948
+ <param pos="2" name="os.version"/>
4949
+ <param pos="3" name="os.arch"/>
4950
+ <param pos="0" name="os.cpe23" value="cpe:/o:freebsd:freebsd:{os.version}"/>
4951
+ </fingerprint>
4952
+
4953
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[(?:[\w-]+-linux-gnu)? \[(\w+)\]\[CentOS (?:Linux )?release (\d+(?:\.\d+)*)(?: \((?:Core|Final)\)\s*)?\]\]$">
4954
+ <description>ntopng - web-based network traffic monitoring on CentOS</description>
4955
+ <example service.version="3.2.171221" os.version="6.9" os.arch="x86_64">ntopng 3.2.171221 [x86_64-unknown-linux-gnu [x86_64][CentOS release 6.9 (Final)]]</example>
4956
+ <example service.version="3.4.210629" os.version="7.5.1804" os.arch="x86_64">ntopng 3.4.210629 [ [x86_64][CentOS Linux release 7.5.1804 (Core) ]]</example>
4957
+ <example service.version="3.6.181022" os.version="7.5.1804" os.arch="x86_64">ntopng 3.6.181022 [x86_64-unknown-linux-gnu [x86_64][CentOS Linux release 7.5.1804 (Core) ]]</example>
4958
+ <example service.version="4.3.211226" os.version="8.4.2105" os.arch="x86_64">ntopng 4.3.211226 [x86_64-unknown-linux-gnu [x86_64][CentOS Linux release 8.4.2105]]</example>
4959
+ <example service.version="5.4.221110" os.version="7.9.2009" os.arch="x86_64">ntopng 5.4.221110 [x86_64-unknown-linux-gnu [x86_64][CentOS Linux release 7.9.2009 (Core)]]</example>
4960
+ <param pos="0" name="service.vendor" value="ntop"/>
4961
+ <param pos="0" name="service.product" value="ntopng"/>
4962
+ <param pos="1" name="service.version"/>
4963
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
4964
+ <param pos="0" name="os.vendor" value="CentOS"/>
4965
+ <param pos="0" name="os.family" value="Linux"/>
4966
+ <param pos="0" name="os.product" value="Linux"/>
4967
+ <param pos="3" name="os.version"/>
4968
+ <param pos="2" name="os.arch"/>
4969
+ <param pos="0" name="os.cpe23" value="cpe:/o:centos:centos:{os.version}"/>
4970
+ </fingerprint>
4971
+
4972
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[[\w-]+-linux-gnu \[(\w+)\]\[[^\]]*\]\]$">
4973
+ <description>ntopng - web-based network traffic monitoring on Linux</description>
4974
+ <example service.version="4.2.201125" os.arch="x86_64">ntopng 4.2.201125 [x86_64-unknown-linux-gnu [x86_64][]]</example>
4975
+ <example service.version="3.8.220621" os.arch="i686">ntopng 3.8.220621 [i686-pc-linux-gnu [i686][]]</example>
4976
+ <param pos="0" name="service.vendor" value="ntop"/>
4977
+ <param pos="0" name="service.product" value="ntopng"/>
4978
+ <param pos="1" name="service.version"/>
4979
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
4980
+ <param pos="0" name="os.vendor" value="Linux"/>
4981
+ <param pos="0" name="os.family" value="Linux"/>
4982
+ <param pos="0" name="os.product" value="Linux"/>
4983
+ <param pos="2" name="os.arch"/>
4984
+ <param pos="0" name="os.cpe23" value="cpe:/o:linux:linux_kernel:-"/>
4985
+ </fingerprint>
4986
+
4987
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*)\s+\[[\w-]+-linux-gnu \((\w+)\)\]$">
4988
+ <description>ntopng - web-based network traffic monitoring on Linux (older ntopng)</description>
4989
+ <example service.version="2.0.150531" os.arch="x86_64">ntopng 2.0.150531 [x86_64-unknown-linux-gnu (x86_64)]</example>
4990
+ <param pos="0" name="service.vendor" value="ntop"/>
4991
+ <param pos="0" name="service.product" value="ntopng"/>
4992
+ <param pos="1" name="service.version"/>
4993
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
4994
+ <param pos="0" name="os.vendor" value="Linux"/>
4995
+ <param pos="0" name="os.family" value="Linux"/>
4996
+ <param pos="0" name="os.product" value="Linux"/>
4997
+ <param pos="2" name="os.arch"/>
4998
+ <param pos="0" name="os.cpe23" value="cpe:/o:linux:linux_kernel:-"/>
4999
+ </fingerprint>
5000
+
5001
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[Debian [\w/]+ \[(\w+)\]\[Ubuntu (\d+(?:\.\d+)*) LTS\]\]$">
5002
+ <description>ntopng - web-based network traffic monitoring on Ubuntu</description>
5003
+ <example service.version="4.2.210309" os.arch="x86_64" os.version="18.04.5">ntopng 4.2.210309 [Debian buster/sid [x86_64][Ubuntu 18.04.5 LTS]]</example>
5004
+ <example service.version="5.4.220721" os.arch="x86_64" os.version="20.04.4">ntopng 5.4.220721 [Debian bullseye/sid [x86_64][Ubuntu 20.04.4 LTS]]</example>
5005
+ <param pos="0" name="service.vendor" value="ntop"/>
5006
+ <param pos="0" name="service.product" value="ntopng"/>
5007
+ <param pos="1" name="service.version"/>
5008
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5009
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
5010
+ <param pos="0" name="os.family" value="Linux"/>
5011
+ <param pos="0" name="os.product" value="Linux"/>
5012
+ <param pos="3" name="os.version"/>
5013
+ <param pos="2" name="os.arch"/>
5014
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:{os.version}"/>
5015
+ </fingerprint>
5016
+
5017
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[Debian (\d+(?:\.\d+)*) \[(\w+)\]\[[^\]]*\]\]$">
5018
+ <description>ntopng - web-based network traffic monitoring on Debian</description>
5019
+ <example service.version="5.4.221124" os.version="11.0" os.arch="x86_64">ntopng 5.4.221124 [Debian 11.0 [x86_64][Debian GNU/Linux 11 (bullseye)]]</example>
5020
+ <example service.version="5.5.220724" os.version="11.1" os.arch="armv7l">ntopng 5.5.220724 [Debian 11.1 [armv7l][Raspbian GNU/Linux 11 (bullseye)]]</example>
5021
+ <example service.version="5.5.221127" os.version="11.4" os.arch="aarch64">ntopng 5.5.221127 [Debian 11.4 [aarch64][Debian GNU/Linux 11 (bullseye)]]</example>
5022
+ <example service.version="4.2.201206" os.version="10.6" os.arch="aarch64">ntopng 4.2.201206 [Debian 10.6 [aarch64][]]</example>
5023
+ <example service.version="5.5.221116" os.version="10.8" os.arch="x86_64">ntopng 5.5.221116 [Debian 10.8 [x86_64][Debian GNU/Linux 10 (buster)]]</example>
5024
+ <example service.version="5.5.221211" os.version="10.11" os.arch="armv7l">ntopng 5.5.221211 [Debian 10.11 [armv7l][Raspbian GNU/Linux 10 (buster)]]</example>
5025
+ <example service.version="4.3.210624" os.version="9.12" os.arch="x86_64">ntopng 4.3.210624 [Debian 9.12 [x86_64][Debian GNU/Linux 9.12 (stretch)]]</example>
5026
+ <example service.version="3.7.180907" os.version="9.1" os.arch="x86_64">ntopng 3.7.180907 [Debian 9.1 [x86_64][Debian GNU/Linux 9.1 (stretch)]]</example>
5027
+ <example service.version="3.9.200305" os.version="8.11" os.arch="x86_64">ntopng 3.9.200305 [Debian 8.11 [x86_64][Debian GNU/Linux 8.11 (jessie)]]</example>
5028
+ <example service.version="2.5.161119" os.version="7.11" os.arch="i686">ntopng 2.5.161119 [Debian 7.11 [i686][Debian GNU/Linux 7.11 (wheezy)]]</example>
5029
+ <example service.version="3.3.180306" os.version="7.10" os.arch="x86_64">ntopng 3.3.180306 [Debian 7.10 [x86_64][Debian GNU/Linux 7.10 (wheezy)]]</example>
5030
+ <param pos="0" name="service.vendor" value="ntop"/>
5031
+ <param pos="0" name="service.product" value="ntopng"/>
5032
+ <param pos="1" name="service.version"/>
5033
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5034
+ <param pos="0" name="os.vendor" value="Debian"/>
5035
+ <param pos="0" name="os.family" value="Linux"/>
5036
+ <param pos="0" name="os.product" value="Linux"/>
5037
+ <param pos="2" name="os.version"/>
5038
+ <param pos="3" name="os.arch"/>
5039
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:{os.version}"/>
5040
+ </fingerprint>
5041
+
5042
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[Debian bookworm/sid \[(\w+)\]\[[^\]]*\]\]$">
5043
+ <description>ntopng - web-based network traffic monitoring on Debian 12.0 (bookworm)</description>
5044
+ <example service.version="5.2.220414" os.arch="x86_64">ntopng 5.2.220414 [Debian bookworm/sid [x86_64][]]</example>
5045
+ <param pos="0" name="service.vendor" value="ntop"/>
5046
+ <param pos="0" name="service.product" value="ntopng"/>
5047
+ <param pos="1" name="service.version"/>
5048
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5049
+ <param pos="0" name="os.vendor" value="Debian"/>
5050
+ <param pos="0" name="os.family" value="Linux"/>
5051
+ <param pos="0" name="os.product" value="Linux"/>
5052
+ <param pos="0" name="os.version" value="12.0"/>
5053
+ <param pos="2" name="os.arch"/>
5054
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:12.0"/>
5055
+ </fingerprint>
5056
+
5057
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[Debian bullseye/sid \[(\w+)\]\[[^\]]*\]\]$">
5058
+ <description>ntopng - web-based network traffic monitoring on Debian 11.0 (bullseye)</description>
5059
+ <example service.version="3.8.200814" os.arch="x86_64">ntopng 3.8.200814 [Debian bullseye/sid [x86_64][]]</example>
5060
+ <param pos="0" name="service.vendor" value="ntop"/>
5061
+ <param pos="0" name="service.product" value="ntopng"/>
5062
+ <param pos="1" name="service.version"/>
5063
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5064
+ <param pos="0" name="os.vendor" value="Debian"/>
5065
+ <param pos="0" name="os.family" value="Linux"/>
5066
+ <param pos="0" name="os.product" value="Linux"/>
5067
+ <param pos="0" name="os.version" value="11.0"/>
5068
+ <param pos="2" name="os.arch"/>
5069
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:11.0"/>
5070
+ </fingerprint>
5071
+
5072
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[Debian buster/sid \[(\w+)\]\[[^\]]*\]\]$">
5073
+ <description>ntopng - web-based network traffic monitoring on Debian 10.0 (buster)</description>
5074
+ <example service.version="3.8.190204" os.arch="x86_64">ntopng 3.8.190204 [Debian buster/sid [x86_64][]]</example>
5075
+ <param pos="0" name="service.vendor" value="ntop"/>
5076
+ <param pos="0" name="service.product" value="ntopng"/>
5077
+ <param pos="1" name="service.version"/>
5078
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5079
+ <param pos="0" name="os.vendor" value="Debian"/>
5080
+ <param pos="0" name="os.family" value="Linux"/>
5081
+ <param pos="0" name="os.product" value="Linux"/>
5082
+ <param pos="0" name="os.version" value="10.0"/>
5083
+ <param pos="2" name="os.arch"/>
5084
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:10.0"/>
5085
+ </fingerprint>
5086
+
5087
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[Debian stretch/sid \((\w+)\)\]$">
5088
+ <description>ntopng - web-based network traffic monitoring on Debian 9.0 (stretch)</description>
5089
+ <example service.version="2.3.160415" os.arch="x86_64">ntopng 2.3.160415 [Debian stretch/sid (x86_64)]</example>
5090
+ <example service.version="2.3.160415" os.arch="i686">ntopng 2.3.160415 [Debian stretch/sid (i686)]</example>
5091
+ <param pos="0" name="service.vendor" value="ntop"/>
5092
+ <param pos="0" name="service.product" value="ntopng"/>
5093
+ <param pos="1" name="service.version"/>
5094
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5095
+ <param pos="0" name="os.vendor" value="Debian"/>
5096
+ <param pos="0" name="os.family" value="Linux"/>
5097
+ <param pos="0" name="os.product" value="Linux"/>
5098
+ <param pos="0" name="os.version" value="9.0"/>
5099
+ <param pos="2" name="os.arch"/>
5100
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:9.0"/>
5101
+ </fingerprint>
5102
+
5103
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[Debian wheezy/sid \((\w+)\)\]$">
5104
+ <description>ntopng - web-based network traffic monitoring on Debian 7.0 (wheezy)</description>
5105
+ <example service.version="2.2.160403" os.arch="x86_64">ntopng 2.2.160403 [Debian wheezy/sid (x86_64)]</example>
5106
+ <param pos="0" name="service.vendor" value="ntop"/>
5107
+ <param pos="0" name="service.product" value="ntopng"/>
5108
+ <param pos="1" name="service.version"/>
5109
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5110
+ <param pos="0" name="os.vendor" value="Debian"/>
5111
+ <param pos="0" name="os.family" value="Linux"/>
5112
+ <param pos="0" name="os.product" value="Linux"/>
5113
+ <param pos="0" name="os.version" value="7.0"/>
5114
+ <param pos="2" name="os.arch"/>
5115
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
5116
+ </fingerprint>
5117
+
5118
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[[\w-]+openbsd(\d+(?:\.\d+)*) \[(\w+)\]\[[^\]]*\]\]$">
5119
+ <description>ntopng - web-based network traffic monitoring on OpenBSD</description>
5120
+ <example service.version="3.8.201001" os.version="6.8" os.arch="amd64">ntopng 3.8.201001 [amd64-unknown-openbsd6.8 [amd64][]]</example>
5121
+ <param pos="0" name="service.vendor" value="ntop"/>
5122
+ <param pos="0" name="service.product" value="ntopng"/>
5123
+ <param pos="1" name="service.version"/>
5124
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5125
+ <param pos="0" name="os.vendor" value="OpenBSD"/>
5126
+ <param pos="0" name="os.family" value="OpenBSD"/>
5127
+ <param pos="0" name="os.product" value="OpenBSD"/>
5128
+ <param pos="2" name="os.version"/>
5129
+ <param pos="3" name="os.arch"/>
5130
+ <param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:{os.version}"/>
5131
+ </fingerprint>
5132
+
5133
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \[[^\]]* \[(\w+)\]\[Windows\]\]$">
5134
+ <description>ntopng - web-based network traffic monitoring on Windows</description>
5135
+ <example service.version="5.5.221014" os.arch="x64">ntopng 5.5.221014 [Win64 [x64][Windows]]</example>
5136
+ <param pos="0" name="service.vendor" value="ntop"/>
5137
+ <param pos="0" name="service.product" value="ntopng"/>
5138
+ <param pos="1" name="service.version"/>
5139
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5140
+ <param pos="0" name="os.vendor" value="Microsoft"/>
5141
+ <param pos="0" name="os.family" value="Windows"/>
5142
+ <param pos="0" name="os.product" value="Windows"/>
5143
+ <param pos="2" name="os.arch"/>
5144
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
5145
+ </fingerprint>
5146
+
5147
+ <fingerprint pattern="^ntopng (\d+(?:\.\d+)*) \((\w+)\)$">
5148
+ <description>ntopng - web-based network traffic monitoring on unknown OS</description>
5149
+ <example service.version="5.4.220905" os.arch="amd64">ntopng 5.4.220905 (amd64)</example>
5150
+ <param pos="0" name="service.vendor" value="ntop"/>
5151
+ <param pos="0" name="service.product" value="ntopng"/>
5152
+ <param pos="1" name="service.version"/>
5153
+ <param pos="0" name="service.cpe23" value="cpe:/a:ntop:ntopng:{service.version}"/>
5154
+ <param pos="2" name="os.arch"/>
5155
+ </fingerprint>
5156
+
4831
5157
  </fingerprints>
data/recog/xml/http_wwwauth.xml CHANGED
@@ -143,7 +143,7 @@
143
143
 
144
144
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
145
145
 
146
- <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?i:hikvision)&quot;">
146
+ <fingerprint pattern="(?i)^(?:Basic|Digest) realm=&quot;hikvision&quot;">
147
147
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
148
148
  <example>Basic realm="hikvision"</example>
149
149
  <param pos="0" name="service.vendor" value="Hikvision"/>
@@ -693,6 +693,26 @@
693
693
  <param pos="0" name="hw.device" value="Power Device"/>
694
694
  </fingerprint>
695
695
 
696
+ <fingerprint pattern="(?i)^Basic realm=&quot;OpenSearch Security&quot;">
697
+ <description>OpenSearch</description>
698
+ <example>Basic realm="OpenSearch Security"</example>
699
+ <param pos="0" name="service.vendor" value="Amazon"/>
700
+ <param pos="0" name="service.product" value="OpenSearch"/>
701
+ <param pos="0" name="service.cpe23" value="cpe:/a:amazon:opensearch:-"/>
702
+ </fingerprint>
703
+
704
+ <fingerprint pattern="(?i)^Basic realm=&quot;(Sentry Switched (?:CDU|(?:DC )*PDU))&quot;">
705
+ <description>Server Technology Sentry Switched Device</description>
706
+ <example hw.product="Sentry Switched CDU" os.product="Sentry Switched CDU Firmware">Basic realm="Sentry Switched CDU"</example>
707
+ <example hw.product="Sentry Switched PDU" os.product="Sentry Switched PDU Firmware">Basic realm="Sentry Switched PDU"</example>
708
+ <example hw.product="Sentry Switched DC PDU" os.product="Sentry Switched DC PDU Firmware">Basic realm="Sentry Switched DC PDU"</example>
709
+ <param pos="0" name="os.vendor" value="Server Technology"/>
710
+ <param pos="0" name="os.product" value="{hw.product} Firmware"/>
711
+ <param pos="0" name="hw.vendor" value="Server Technology"/>
712
+ <param pos="1" name="hw.product"/>
713
+ <param pos="0" name="hw.device" value="Power Device"/>
714
+ </fingerprint>
715
+
696
716
  <!-- a variety of headers we currently just ignore -->
697
717
 
698
718
  <fingerprint pattern="(?i)^NTLM$">
data/recog/xml/imap_banners.xml CHANGED
@@ -1,6 +1,9 @@
1
1
  <?xml version='1.0' encoding='UTF-8'?>
2
2
  <fingerprints matches="imap4.banner" protocol="imap" database_type="service" preference="0.90">
3
- <!-- IMAP banners are matched against these patterns to fingerprint IMAP servers. -->
3
+ <!--
4
+ IMAP banners are matched against these patterns to fingerprint IMAP servers.
5
+ The patterns expect the "* OK " part of the banner was removed.
6
+ -->
4
7
 
5
8
  <fingerprint pattern="^Microsoft Exchange IMAP4rev1 server version (5\.5\.\d{4}\.\d+) \((.*)\) ready$">
6
9
  <description>Microsoft Exchange Server 5.5</description>
@@ -109,19 +112,21 @@
109
112
  <param pos="2" name="host.time"/>
110
113
  </fingerprint>
111
114
 
112
- <fingerprint pattern="^[dD]ovecot (?:DA )?ready\.$">
115
+ <fingerprint pattern="^(?:\[CAPABILITY [^\]]{1,645}\] )?[dD]ovecot (?:DA )?ready\.$">
113
116
  <description>Dovecot Secure IMAP Server</description>
114
117
  <example>Dovecot ready.</example>
115
118
  <example>Dovecot DA ready.</example>
119
+ <example>[CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE NAMESPACE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot ready.</example>
116
120
  <param pos="0" name="service.vendor" value="Dovecot"/>
117
121
  <param pos="0" name="service.family" value="Dovecot"/>
118
122
  <param pos="0" name="service.product" value="Dovecot"/>
119
123
  <param pos="0" name="service.cpe23" value="cpe:/a:dovecot:dovecot:-"/>
120
124
  </fingerprint>
121
125
 
122
- <fingerprint pattern="^Dovecot \(Ubuntu\) ready\.$">
126
+ <fingerprint pattern="^(?:\[CAPABILITY [^\]]{1,645}\] )?Dovecot \(Ubuntu\) ready\.$">
123
127
  <description>Dovecot Secure IMAP Server - Ubuntu variant</description>
124
128
  <example>Dovecot (Ubuntu) ready.</example>
129
+ <example>[CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready.</example>
125
130
  <param pos="0" name="service.vendor" value="Dovecot"/>
126
131
  <param pos="0" name="service.family" value="Dovecot"/>
127
132
  <param pos="0" name="service.product" value="Dovecot"/>
@@ -132,9 +137,10 @@
132
137
  <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
133
138
  </fingerprint>
134
139
 
135
- <fingerprint pattern="^Dovecot \(Debian\) ready\.$">
140
+ <fingerprint pattern="^(?:\[CAPABILITY [^\]]{1,645}\] )?Dovecot \(Debian\) ready\.$">
136
141
  <description>Dovecot Secure IMAP Server - Debian variant</description>
137
142
  <example>Dovecot (Debian) ready.</example>
143
+ <example>[CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready.</example>
138
144
  <param pos="0" name="service.vendor" value="Dovecot"/>
139
145
  <param pos="0" name="service.family" value="Dovecot"/>
140
146
  <param pos="0" name="service.product" value="Dovecot"/>
@@ -145,9 +151,10 @@
145
151
  <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
146
152
  </fingerprint>
147
153
 
148
- <fingerprint pattern="^Dovecot \(Raspbian\) ready\.$">
154
+ <fingerprint pattern="^(?:\[CAPABILITY [^\]]{1,645}\] )?Dovecot \(Raspbian\) ready\.$">
149
155
  <description>Dovecot Secure IMAP Server - Raspbian variant</description>
150
156
  <example>Dovecot (Raspbian) ready.</example>
157
+ <example>[CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Raspbian) ready.</example>
151
158
  <param pos="0" name="service.vendor" value="Dovecot"/>
152
159
  <param pos="0" name="service.family" value="Dovecot"/>
153
160
  <param pos="0" name="service.product" value="Dovecot"/>
@@ -158,9 +165,10 @@
158
165
  <param pos="0" name="hw.product" value="Raspberry Pi"/>
159
166
  </fingerprint>
160
167
 
161
- <fingerprint pattern="^Courier-IMAP ready. Copyright \d+-\d+">
168
+ <fingerprint pattern="^(?:\[CAPABILITY [^\]]{1,645}\] )?Courier-IMAP ready. Copyright \d+-\d+">
162
169
  <description>Courier MTA IMAP</description>
163
170
  <example>Courier-IMAP ready. Copyright 1998-2002 Double Precision, Inc. See COPYING for distribution information.</example>
171
+ <example>[CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE AUTH=PLAIN ACL ACL2=UNION] Courier-IMAP ready. Copyright 1998-2005 Double Precision, Inc. See COPYING for distribution information.</example>
164
172
  <param pos="0" name="service.vendor" value="Double Precision"/>
165
173
  <param pos="0" name="service.family" value="Courier MTA"/>
166
174
  <param pos="0" name="service.product" value="Courier IMAP"/>
@@ -196,10 +204,11 @@
196
204
  <param pos="1" name="host.name"/>
197
205
  </fingerprint>
198
206
 
199
- <fingerprint pattern="^(\S{1,512}) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
207
+ <fingerprint pattern="^(?:\[CAPABILITY [^\]]{1,645}\] )?(\S{1,512}) Cyrus IMAP4 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready$">
200
208
  <description>CMU Cyrus IMAP on Mac OS X</description>
201
209
  <example host.name="example.com" service.version="2.2.12" os.version="10.4.0">example.com Cyrus IMAP4 v2.2.12-OS X 10.4.0 server ready</example>
202
210
  <example host.name="example.com" service.version="2.3.8" os.version="10.5">example.com Cyrus IMAP4 v2.3.8-OS X Server 10.5: 9A562 server ready</example>
211
+ <example host.name="foo.bar" service.version="2.3.8" os.version="10.5">[CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID AUTH=PLAIN AUTH=LOGIN AUTH=CRAM-MD5] foo.bar Cyrus IMAP4 v2.3.8-OS X Server 10.5:&#x9;9G7013y server ready</example>
203
212
  <param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
204
213
  <param pos="0" name="service.family" value="Cyrus MTA"/>
205
214
  <param pos="0" name="service.product" value="Cyrus IMAP"/>
@@ -213,10 +222,12 @@
213
222
  <param pos="1" name="host.name"/>
214
223
  </fingerprint>
215
224
 
216
- <fingerprint pattern="^(\S{1,512}) Cyrus IMAP4? (?:\S+ )?v(\d+\.\d+.*) server ready$">
225
+ <fingerprint pattern="^(?:\[CAPABILITY [^\]]{1,645}\] )?(\S{1,512}) Cyrus IMAP4? (?:\S+ )?v?(\d+\.\d+.*) server ready$">
217
226
  <description>CMU Cyrus IMAP</description>
218
227
  <example host.name="example.com" service.version="2.3.7">example.com Cyrus IMAP4 v2.3.7 server ready</example>
219
228
  <example host.name="example.com" service.version="2.4.8-Invoca-RPM-2.4.8-1">example.com Cyrus IMAP Murder v2.4.8-Invoca-RPM-2.4.8-1 server ready</example>
229
+ <example host.name="foo.bar" service.version="2.3.11-Fedora-RPM-2.3.11-1.fc9">[CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ID AUTH=PLAIN SASL-IR] foo.bar Cyrus IMAP4 v2.3.11-Fedora-RPM-2.3.11-1.fc9 server ready</example>
230
+ <example host.name="foo.bar" service.version="3.0.8-Debian-3.0.8-6+deb10u6">[CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE AUTH=PLAIN SASL-IR] foo.bar Cyrus IMAP 3.0.8-Debian-3.0.8-6+deb10u6 server ready</example>
220
231
  <param pos="0" name="service.vendor" value="Carnegie Mellon University"/>
221
232
  <param pos="0" name="service.family" value="Cyrus MTA"/>
222
233
  <param pos="0" name="service.product" value="Cyrus IMAP"/>
data/recog/xml/smb_native_os.xml CHANGED
@@ -855,7 +855,7 @@
855
855
  <param pos="1" name="service.version"/>
856
856
  </fingerprint>
857
857
 
858
- <fingerprint pattern="^(?i:unix)$">
858
+ <fingerprint pattern="(?i)^unix$">
859
859
  <description>Generally some Samba variant, which reports Unix</description>
860
860
  <example>Unix</example>
861
861
  <param pos="0" name="os.family" value="Unix"/>
data/recog/xml/smtp_banners.xml CHANGED
@@ -345,7 +345,7 @@
345
345
  <param pos="1" name="system.time"/>
346
346
  </fingerprint>
347
347
 
348
- <fingerprint pattern="^ ?([^, ]{1,512}),? +ESMTP \(?(?i:Exim) +(\d+\.[\d_.bdRC-]+)\)?(?: +#\d+)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d{3,4})?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
348
+ <fingerprint pattern="(?i)^ ?([^, ]{1,512}),? +ESMTP \(?Exim +(\d+\.[\d_.bdRC-]+)\)?(?: +#\d+)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d{3,4})?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
349
349
  <description>Exim - with version string and optional timestamp</description>
350
350
  <example service.version="4.91" host.name="foo.bar" system.time="Thu, 29 Apr 2021 05:41:36 +400">foo.bar ESMTP Exim 4.91 Thu, 29 Apr 2021 05:41:36 +400</example>
351
351
  <example service.version="4.89" host.name="foo.bar">foo.bar ESMTP Exim 4.89 "</example>
@@ -368,7 +368,7 @@
368
368
  <param pos="3" name="system.time"/>
369
369
  </fingerprint>
370
370
 
371
- <fingerprint pattern="^([^, ]{1,512}),? ESMTP (?i:Exim) +(\d+) ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
371
+ <fingerprint pattern="(?i)^([^, ]{1,512}),? ESMTP Exim +(\d+) ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
372
372
  <description>Exim - with digit only version string and optional timestamp</description>
373
373
  <example service.version="125302" host.name="foo.bar" system.time="Thu, 16 Nov 2017 04:55:11 -0500">foo.bar ESMTP Exim 125302 Thu, 16 Nov 2017 04:55:11 -0500 </example>
374
374
  <param pos="0" name="service.vendor" value="exim"/>
@@ -381,7 +381,7 @@
381
381
  <param pos="3" name="system.time"/>
382
382
  </fingerprint>
383
383
 
384
- <fingerprint pattern="^([^, ]{1,512}),? ESMTP (?i:Exim) +(\d+\.[\d_.]+)(?: +#\d)? Ubuntu ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
384
+ <fingerprint pattern="(?i)^([^, ]{1,512}),? ESMTP Exim +(\d+\.[\d_.]+)(?: +#\d)? Ubuntu ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
385
385
  <description>Exim - with version string and optional timestamp (Ubuntu)</description>
386
386
  <example service.version="4.82" system.time="Thu, 16 Nov 2017 11:30:44 +0300" host.name="foo.bar">foo.bar ESMTP Exim 4.82 Ubuntu Thu, 16 Nov 2017 11:30:44 +0300 </example>
387
387
  <param pos="0" name="os.vendor" value="Ubuntu"/>
@@ -398,7 +398,7 @@
398
398
  <param pos="3" name="system.time"/>
399
399
  </fingerprint>
400
400
 
401
- <fingerprint pattern="^([^, ]{1,512}),? ESMTP (?i:Exim)(?: +#\d)? *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
401
+ <fingerprint pattern="(?i)^([^, ]{1,512}),? ESMTP Exim(?: +#\d)? *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
402
402
  <description>Exim - without version string and with optional timestamp</description>
403
403
  <example host.name="foo.bar">foo.bar ESMTP Exim</example>
404
404
  <example host.name="foo.bar" system.time="Thu, 16 Nov 2017 01:11:30 -0800">foo.bar ESMTP Exim Thu, 16 Nov 2017 01:11:30 -0800 </example>
@@ -412,7 +412,7 @@
412
412
  <param pos="2" name="system.time"/>
413
413
  </fingerprint>
414
414
 
415
- <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
415
+ <fingerprint pattern="(?i)^ ?ESMTP Exim (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
416
416
  <description>Exim - without hostname</description>
417
417
  <example service.version="4.82" system.time="Thu, 16 Nov 2017 12:19:22 +0300">ESMTP Exim 4.82 Thu, 16 Nov 2017 12:19:22 +0300 </example>
418
418
  <example service.version="4.82" system.time="Thu, 16 Nov 2017 11:41:41 +0300"> ESMTP Exim 4.82 Thu, 16 Nov 2017 11:41:41 +0300 </example>
@@ -741,7 +741,7 @@
741
741
 
742
742
  <!-- example: 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700 -->
743
743
 
744
- <fingerprint pattern="^([^ ]{1,512}) +E?SMTP (?i:MERAK) ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
744
+ <fingerprint pattern="(?i)^([^ ]{1,512}) +E?SMTP MERAK ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
745
745
  <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)</description>
746
746
  <example host.name="foo.bar" service.version="8.0.3" system.time="Thu, 30 Nov 2017 20:01:41 +1000">foo.bar SMTP Merak 8.0.3; Thu, 30 Nov 2017 20:01:41 +1000</example>
747
747
  <example host.name="foo.bar" service.version="8.0.3" system.time="Thu, 30 Nov 2017 12:08:09 +0200">foo.bar ESMTP Merak 8.0.3; Thu, 30 Nov 2017 12:08:09 +0200</example>
@@ -1080,7 +1080,7 @@
1080
1080
  <param pos="1" name="host.name"/>
1081
1081
  </fingerprint>
1082
1082
 
1083
- <fingerprint pattern="^([^ ]{1,512}) ESMTP server \((?i:P)ost\.(?i:O)ffice v([^ ]+\.[^ ]+)(?: release)? (.+) ID# ([^ ]+)\) ready (.+) *$">
1083
+ <fingerprint pattern="^([^ ]{1,512}) ESMTP server \([Pp]ost\.[Oo]ffice v([^ ]+\.[^ ]+)(?: release)? (.+) ID# ([^ ]+)\) ready (.+) *$">
1084
1084
  <description>Post.Office</description>
1085
1085
  <example host.name="foo.bar" service.version="3.8.4" postoffice.build="116" postoffice.id="1001-65749U100L10S0V38" system.time="Thu, 30 Nov 2017 18:46:24 +0900">foo.bar ESMTP server (post.office v3.8.4 release 116 ID# 1001-65749U100L10S0V38) ready Thu, 30 Nov 2017 18:46:24 +0900</example>
1086
1086
  <example host.name="foo.bar" service.version="3.1" postoffice.build="PO205e" postoffice.id="0-42000U100L2S100" system.time="Tue, 6 Feb 2001 19:38:32 +0100">foo.bar ESMTP server (Post.Office v3.1 release PO205e ID# 0-42000U100L2S100) ready Tue, 6 Feb 2001 19:38:32 +0100</example>