recog 1.0.17 → 1.0.18

data/README.md

@@ -52,6 +52,8 @@ tests that `RomSShell_4.62` matches the provided regular expression and that the
 
 The `param` elements contain a `pos` attribute, which indicates what capture field from the `pattern` should be extracted, or `0` for a static string. The `name` attribute is the key that will be reported in the case of a successful match and the `value` will either be a static string for `pos` values of `0` or missing and taken from the captured field.
 
+### Testing
+
 Once a fingerprint has been added, the `example` entries can be tested by executing `bin/recog_verify` against the fingerprint file:
 
     $ bin/recog_verify xml/ssh_banners.xml
@@ -61,9 +63,7 @@ Matches can be tested on the command-line in a similar fashion:
     $ echo 'OpenSSH_6.6p1 Ubuntu-2ubuntu1' | bin/recog_match xml/ssh_banners.xml -
     MATCH: {"service.version"=>"6.6p1", "openssh.comment"=>"Ubuntu-2ubuntu1", "service.vendor"=>"OpenBSD", "service.family"=>"OpenSSH", "service.product"=>"OpenSSH", "data"=>"OpenSSH_6.6p1 Ubuntu-2ubuntu1"}
 
-
-
-
-
-
+### Best Practices
+* Create a single fingerprint for each product as long as the pattern remains clear and readable. If that is not possible, the pattern should be logically decomposed into additional fingerprints.
+* Create regular expressions that allow for flexible version number matching. This ensures greater probability of matching a product. For example, all known public releases of a product report either `major.minor` or `major.minor.build` format version numbers. If the fingerprint strictly matches this version number format, it would fail to match a modified build of the product that reports only a `major` version number format.
 

data/lib/recog/version.rb

@@ -1,3 +1,3 @@
 module Recog
-  VERSION = '1.0.17'
+  VERSION = '1.0.18'
 end

data/xml/http_servers.xml

@@ -1889,22 +1889,73 @@
       <param pos="0" name="os.certainty" value="0.75"/>
    </fingerprint>
 
-   <fingerprint pattern = "^com.hp.openview.Coda (\d\.\d.\d)$">
-      <description>HP Openview Coda</description>
-      <example>com.hp.openview.Coda 0.0.1</example>
+   <fingerprint pattern = "^(?:BBC \d+\.\d+\.\d+\.?\d*; )?(?:com.hp.openview.)?[c|C]oda (\d+\.\d+\.\d+\.?\d*)$">
+      <description>HP Openview Coda (Communications Daemon)</description>
+      <example service.component.version="0.0.1">com.hp.openview.Coda 0.0.1</example>
+      <example service.component.version="10.00.123">BBC 05.20.050; coda 10.00.123</example>
+      <example service.component.version="0.0.1">BBC 2.6.0.7; com.hp.openview.Coda 0.0.1</example>
       <param pos="0" name="service.vendor" value="HP"/>
       <param pos="0" name="service.family" value="OpenView"/>
-      <param pos="0" name="service.product" value="OpenView"/>
-      <param pos="1" name="service.version"/>
+      <param pos="0" name="service.component.vendor" value="HP"/>
+      <param pos="0" name="service.component.family" value="OpenView"/>
+      <param pos="0" name="service.component.product" value="CODA"/>
+      <param pos="1" name="service.component.version"/>
    </fingerprint>
 
-   <fingerprint pattern = "^com.hp.openview.bbc.LLBServer (\d\.\d.\d\.\d)$">
-      <description>HP Openview LLBServer</description>
-      <example>com.hp.openview.bbc.LLBServer 2.6.8.1</example>
+   <fingerprint pattern="^BBC \d+\.\d+\.\d+\.?\d*; ovbbcrcp (\d+\.\d+\.\d+\.?\d*)$">
+      <description>OpenView Reverse Channel Proxy (RCP)</description>
+      <example service.component.version="11.00.044">BBC 11.00.044; ovbbcrcp 11.00.044</example>
       <param pos="0" name="service.vendor" value="HP"/>
       <param pos="0" name="service.family" value="OpenView"/>
-      <param pos="0" name="service.product" value="OpenView"/>
-      <param pos="1" name="service.version"/>
+      <param pos="0" name="service.component.vendor" value="HP"/>
+      <param pos="0" name="service.component.family" value="OpenView"/>
+      <param pos="0" name="service.component.product" value="Reverse Channel Proxy"/>
+      <param pos="1" name="service.component.version"/>
+   </fingerprint>
+
+   <fingerprint pattern = "^(?:BBC \d+\.\d+\.\d+\.?\d*; )?com.hp.openview.bbc.LLBServer (\d+\.\d+\.\d+\.?\d*)$">
+      <description>HP Openview LLBServer (Local Location Broker)</description>
+      <example service.component.version="2.6.8.1">com.hp.openview.bbc.LLBServer 2.6.8.1</example>
+      <example service.component.version="2.6.0.7">BBC 2.6.0.7; com.hp.openview.bbc.LLBServer 2.6.0.7</example>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.family" value="OpenView"/>
+      <param pos="0" name="service.component.vendor" value="HP"/>
+      <param pos="0" name="service.component.family" value="OpenView"/>
+      <param pos="0" name="service.component.product" value="LLBServer"/>
+      <param pos="1" name="service.component.version"/>
+   </fingerprint>
+
+   <fingerprint pattern="^BBC \d+\.\d+\.\d+; ovbbccb (\d+\.\d+\.\d+)$">
+      <description>OpenView Communication Broker (ovbbccb)</description>
+      <example service.component.version="06.00.083">BBC 06.00.083; ovbbccb 06.00.083</example>
+      <example service.component.version="11.10.035">BBC 11.10.035; ovbbccb 11.10.035</example>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.family" value="OpenView"/>
+      <param pos="0" name="service.component.vendor" value="HP"/>
+      <param pos="0" name="service.component.family" value="OpenView"/>
+      <param pos="0" name="service.component.product" value="Communication Broker"/>
+      <param pos="1" name="service.component.version"/>
+   </fingerprint>
+
+	<fingerprint pattern="^BBC \d+\.\d+\.\d+; ovbbccb unknown version$">
+      <description>OpenView Communication Broker (ovbbccb) with no version</description>
+      <example>BBC 11.13.007; ovbbccb unknown version</example>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.family" value="OpenView"/>
+      <param pos="0" name="service.component.vendor" value="HP"/>
+      <param pos="0" name="service.component.family" value="OpenView"/>
+      <param pos="0" name="service.component.product" value="Communication Broker"/>
+   </fingerprint>
+
+   <fingerprint pattern="^UOS$">
+      <example>UOS</example>
+      <description>HTTP Server that appears unique to Managment Console on HP TippingPoint IPS Devices</description>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.product" value="HTTP"/>
+      <param pos="0" name="service.family" value="TippingPoint"/>
+      <param pos="0" name="os.vendor" value="HP"/>
+      <param pos="0" name="os.family" value="TippingPoint"/>
+      <param pos="0" name="os.device" value="IPS"/>
    </fingerprint>
 
    <fingerprint pattern="^Helix Server Version ([0-9.]*) \(win32\) \(RealServer compatible\)$">

metadata

@@ -1,111 +1,126 @@
 --- !ruby/object:Gem::Specification
 name: recog
 version: !ruby/object:Gem::Version
-  version: 1.0.17
+  version: 1.0.18
+  prerelease: 
 platform: ruby
 authors:
 - Rapid7 Research
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-19 00:00:00.000000000 Z
+date: 2015-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: yard
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: redcarpet
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: cucumber
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: aruba
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 description: Recog is a framework for identifying products, services, operating systems,
@@ -121,10 +136,10 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".travis.yml"
-- ".yardopts"
+- .gitignore
+- .rspec
+- .travis.yml
+- .yardopts
 - CONTRIBUTING.md
 - Gemfile
 - LICENSE
@@ -208,26 +223,27 @@ files:
 - xml/upnp_banners.xml
 homepage: https://www.github.com/rapid7/recog
 licenses: []
-metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.3
+rubygems_version: 1.8.23.2
 signing_key: 
-specification_version: 4
+specification_version: 3
 summary: Network service fingerprint database, classes, and utilities
 test_files: []
 has_rdoc: 

checksums.yaml

@@ -1,7 +0,0 @@
----
-SHA1:
-  metadata.gz: ba7d8b2d9765280fc41fea934102dbff6bff69b6
-  data.tar.gz: d86c1221b484f17a0d826de292648b6bf5737381
-SHA512:
-  metadata.gz: 56446fa6f827bdcf28976878dc4697333da0eb48be67884c875a8b848b6e0d44e429e675becb3a2e9556338bf9ab9af674d38dea77603f8f399a1be05adb4446
-  data.tar.gz: 7c1e4e4751dfbf8b8082aa9928340be690f98f3cdbf1141bd5570c3a35b57a2142dc64b604a35726f9443e520c4d53e27080fa4b07891c52d7cac59aa80356b7