recog 1.0.3 → 1.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. checksums.yaml +4 -4
  2. data/bin/recog_verify.rb +10 -7
  3. data/lib/recog/fingerprint.rb +26 -3
  4. data/lib/recog/version.rb +1 -1
  5. data/spec/lib/fingerprint_self_test_spec.rb +3 -8
  6. data/xml/ftp_banners.xml +6 -3
  7. data/xml/http_servers.xml +14 -10
  8. data/xml/ntp_banners.xml +10 -9
  9. data/xml/rsh_resp.xml +1 -1
  10. data/xml/smb_native_os.xml +1 -1
  11. data/xml/smtp_expn.xml +1 -2
  12. data/xml/smtp_mailfrom.xml +3 -6
  13. data/xml/snmp_sysdescr.xml +35 -31
  14. data/xml/snmp_sysobjid.xml +11 -11
  15. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 1068e270c672aa9dd8c71a5e8fb476c14cacf85a
4
- data.tar.gz: f07af0de32f1d6472e2c9e965dc959ea9e65f6e4
3
+ metadata.gz: 796c259c3ef2b6768e453d45c6eafecea0d3307e
4
+ data.tar.gz: 18619b2bc105b2c9f8a607aa42b8a74cd2226416
5
5
  SHA512:
6
- metadata.gz: 8c10dd6f2c687f34097cd0d437fccd5f72d68b944203d532b7cd2cde8eac463bf192e7a6e776ba6d73dfeedda33c9fe2dde7bb98622ddf4b1278c3a4d2de9a0f
7
- data.tar.gz: d36667a29f1920331406a429925fa79043288ae5807fd18397164fed0e783e0c4aa80754c5e8bfdb55da99de22ca3f3667d9e9957c3664760a2324749d6c10e2
6
+ metadata.gz: 262b8c5243d2700fef9809eac70e68400fb4a40a21f305e9ada37eb48faf2fe2189127d27904b8ea3f1d416c5c786adf1f2604735ed81d42be59f64710ad9316
7
+ data.tar.gz: 4cbfa966c8268210113965387576182ea7aa4a98267af5bac81b9194db89fac554882a6421b37f2c96cde466b0589ed2165fd9faf9228421214bb49834fb6a5e
data/bin/recog_verify.rb CHANGED
@@ -9,7 +9,7 @@ require 'recog/verifier_factory'
9
9
  options = OpenStruct.new(color: false, detail: false)
10
10
 
11
11
  option_parser = OptionParser.new do |opts|
12
- opts.banner = "Usage: #{$0} [options] XML_FINGERPRINTS_FILE"
12
+ opts.banner = "Usage: #{$0} [options] XML_FINGERPRINT_FILE1 ..."
13
13
  opts.separator "Verifies that each fingerprint passes its internal tests."
14
14
  opts.separator ""
15
15
  opts.separator "Options"
@@ -34,12 +34,15 @@ option_parser = OptionParser.new do |opts|
34
34
  end
35
35
  option_parser.parse!(ARGV)
36
36
 
37
- if ARGV.count != 1
37
+ if ARGV.empty?
38
+ $stderr.puts 'Missing XML fingerprint files'
38
39
  puts option_parser
39
- exit
40
+ exit(1)
40
41
  end
41
42
 
42
- ndb = Recog::DB.new(ARGV.shift)
43
- options.fingerprints = ndb.fingerprints
44
- verifier = Recog::VerifierFactory.build(options)
45
- verifier.verify_tests
43
+ ARGV.each do |file|
44
+ ndb = Recog::DB.new(file)
45
+ options.fingerprints = ndb.fingerprints
46
+ verifier = Recog::VerifierFactory.build(options)
47
+ verifier.verify_tests
48
+ end
data/lib/recog/fingerprint.rb CHANGED
@@ -45,13 +45,36 @@ class Fingerprint
45
45
  match_data = @regex.match(match_string)
46
46
  return if match_data.nil?
47
47
 
48
+ # sanity check any positional extractions
49
+ positions = @params.values.map(&:first).map(&:to_i)
50
+ captures_size = match_data.captures.size
51
+ if @params.empty? && captures_size > 0
52
+ raise "Non-asserting fingerprint with regex #{@regex} captures #{captures_size} time(s); 0 are needed"
53
+ else
54
+ if captures_size > 0
55
+ max_pos = positions.max
56
+ # if it is actually looking to extract, ensure that there is enough to extract
57
+ if max_pos > 0 && captures_size < max_pos
58
+ raise "Regex #{@regex} only has #{captures_size} captures; cannot extract from position #{max_pos}"
59
+ end
60
+ # if there is not extraction but capturing is happening, fail since this is a waste
61
+ if captures_size > max_pos
62
+ raise "Regex #{@regex} captures #{captures_size - max_pos} too many (#{captures_size} vs #{max_pos})"
63
+ end
64
+ end
65
+ end
66
+
67
+ # now do extraction
48
68
  result = { 'matched' => @name }
49
69
  @params.each_pair do |k,v|
50
- if v[0] == 0
70
+ pos = v[0]
71
+ if pos == 0
51
72
  # A match offset of 0 means this param has a hardcoded value
52
73
  result[k] = v[1]
53
74
  else
54
- result[k] = match_data[ v[0] ]
75
+ # A match offset other than 0 means the value should come from
76
+ # the corresponding match result index
77
+ result[k] = match_data[ pos ]
55
78
  end
56
79
  end
57
80
  return result
@@ -105,7 +128,7 @@ class Fingerprint
105
128
  # @return [String] Contents of the source XML's `description` tag
106
129
  def parse_description(xml)
107
130
  element = xml.xpath('description')
108
- element.empty? ? '' : element.first.content
131
+ element.empty? ? '' : element.first.content.gsub(/[\r\n]+/, ' ').gsub(/\s{3,}/, ' ').strip
109
132
  end
110
133
 
111
134
  # @param xml [Nokogiri::XML::Element]
data/lib/recog/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Recog
2
- VERSION = "1.0.3"
2
+ VERSION = "1.0.4"
3
3
  end
data/spec/lib/fingerprint_self_test_spec.rb CHANGED
@@ -17,16 +17,11 @@ describe Recog::DB do
17
17
 
18
18
  context "#{fp.regex}" do
19
19
 
20
- if fp.name.nil? || fp.name.empty?
21
- skip "has a name"
20
+ it "has a name" do
21
+ expect(fp.name).not_to be_nil
22
+ expect(fp.name).not_to be_empty
22
23
  end
23
24
 
24
- # Not yet enforced
25
- # it "has a name" do
26
- # expect(fp.name).not_to be_nil
27
- # expect(fp.name).not_to be_empty
28
- # end
29
-
30
25
  it "has a regex" do
31
26
  expect(fp.regex).not_to be_nil
32
27
  expect(fp.regex.class).to be ::Regexp
data/xml/ftp_banners.xml CHANGED
@@ -268,7 +268,7 @@ against these patterns to fingerprint FTP servers.
268
268
  <param pos="1" name="os.product"/>
269
269
  <param pos="2" name="os.version"/>
270
270
  </fingerprint>
271
- <fingerprint pattern="^(\S+) FTP server \(EMC-SNAS: ([^\)]+)\)(:? \S+)?$">
271
+ <fingerprint pattern="^(\S+) FTP server \(EMC-SNAS: ([^\)]+)\)(?: \S+)?$">
272
272
  <example>foo2 FTP server (EMC-SNAS: 5.6.47.11)</example>
273
273
  <example>foo2 FTP server (EMC-SNAS: 5.6.50.203) ready.</example>
274
274
  <example>foo4 FTP server (EMC-SNAS: 5.5.31.6) r</example>
@@ -304,6 +304,7 @@ against these patterns to fingerprint FTP servers.
304
304
  <param pos="0" name="os.device" value="Firewall"/>
305
305
  <param pos="0" name="os.family" value="Firewall-1"/>
306
306
  <param pos="0" name="os.product" value="Firewall-1"/>
307
+ <param pos="1" name="host.name"/>
307
308
  </fingerprint>
308
309
  <fingerprint pattern="^Blue Coat FTP Service$">
309
310
  <example>Blue Coat FTP Service</example>
@@ -355,6 +356,7 @@ against these patterns to fingerprint FTP servers.
355
356
  <param pos="0" name="os.vendor" value="D-Link"/>
356
357
  <param pos="0" name="os.product" value="DCS-2100"/>
357
358
  <param pos="0" name="os.device" value="Web cam"/>
359
+ <param pos="1" name="host.name"/>
358
360
  </fingerprint>
359
361
  <fingerprint pattern="^Secure Gateway FTP server ready\.$">
360
362
  <example>Secure Gateway FTP server ready.</example>
@@ -372,8 +374,8 @@ against these patterns to fingerprint FTP servers.
372
374
  <param pos="1" name="os.product"/>
373
375
  <param pos="0" name="os.device" value="Storage"/>
374
376
  </fingerprint>
375
- <fingerprint pattern="^AXIS (\S+) (?:Network( Fixed Dome)? Camera) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
376
- <example>Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
377
+ <fingerprint pattern="^AXIS (\S+) (?:Network(?: Fixed Dome)? Camera) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
378
+ <example os.product="2100" os.version="2.43">Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
377
379
  <example>AXIS 207 Network Camera 4.40.1 (Apr 16 2007) ready.</example>
378
380
  <example>AXIS 216FD Network Fixed Dome Camera 4.47 (Mar 13 2008) ready.</example>
379
381
  <description>Axis Network Camera</description>
@@ -556,6 +558,7 @@ against these patterns to fingerprint FTP servers.
556
558
  <param pos="0" name="os.family" value="LinkCom Xpress"/>
557
559
  <param pos="0" name="os.device" value="Print server"/>
558
560
  <param pos="1" name="os.product"/>
561
+ <param pos="2" name="os.version"/>
559
562
  </fingerprint>
560
563
  <fingerprint pattern="^LinkCom Xpress (.*)$" certainty="1.0">
561
564
  <description>MPI Technologies Linkcom Express FTP Server</description>
data/xml/http_servers.xml CHANGED
@@ -1728,7 +1728,7 @@
1728
1728
  <param pos="1" name="service.version"/>
1729
1729
  </fingerprint>
1730
1730
 
1731
- <fingerprint pattern="^Apache Tomcat/(\d\.[\d.]+)(-LE-jdk14)? \(HTTP/1.1 Connector\)$">
1731
+ <fingerprint pattern="^Apache Tomcat/(\d\.[\d.]+)(?:-LE-jdk14)? \(HTTP/1.1 Connector\)$">
1732
1732
  <example>Apache Tomcat/4.0.6 (HTTP/1.1 Connector)</example>
1733
1733
  <example>Apache Tomcat/4.1.12 (HTTP/1.1 Connector)</example>
1734
1734
  <example>Apache Tomcat/4.1.27-LE-jdk14 (HTTP/1.1 Connector)</example>
@@ -2009,6 +2009,7 @@
2009
2009
  <param pos="0" name="os.device" value="General"/>
2010
2010
  <param pos="0" name="os.family" value="OS/400"/>
2011
2011
  <param pos="0" name="os.product" value="OS/400"/>
2012
+ <param pos="1" name="os.version"/>
2012
2013
  </fingerprint>
2013
2014
 
2014
2015
  <fingerprint pattern="^(?:IBM_HTTP_Server|IBM_HTTP_SERVER)/([\w.-]+)\s+Apache/([12][\d.]+)\s*(.*)$">
@@ -2116,7 +2117,7 @@
2116
2117
  <param pos="1" name="service.version"/>
2117
2118
  </fingerprint>
2118
2119
 
2119
- <fingerprint pattern="^(?:Sun-Java-System-Web-Server|Sun-ONE-Web-Server)/(\d\.[\d_]+)$">
2120
+ <fingerprint pattern="^(?:Sun-Java-System-Web-Server|Sun-ONE-Web-Server)/(?:\d\.[\d_]+)$">
2120
2121
  <example>Sun-Java-System-Web-Server/7.0</example>
2121
2122
  <example>Sun-ONE-Web-Server/6.1</example>
2122
2123
  <description>Sun Java System Web Server (formerly Netscape Enterprise Server, iPlanet Web
@@ -2174,7 +2175,7 @@
2174
2175
  <param pos="1" name="service.version"/>
2175
2176
  </fingerprint>
2176
2177
 
2177
- <fingerprint pattern="^Sun-Java-System-Web-Proxy-Server/(4\.\d+)$">
2178
+ <fingerprint pattern="^Sun-Java-System-Web-Proxy-Server/(?:4\.\d+)$">
2178
2179
  <!-- Some 4.x versions only return a partial version number (4.x instead of 4.x.x). -->
2179
2180
  <example>Sun-Java-System-Web-Proxy-Server/4.0</example>
2180
2181
  <description>Sun Java System Web Proxy Server (formerly iPlanet WebProxy Server,
@@ -2185,7 +2186,7 @@
2185
2186
  <!-- don't specify the version as it is only partially known -->
2186
2187
  </fingerprint>
2187
2188
 
2188
- <fingerprint pattern="^Sun-ILOM-Web-Server/(\d\.[\d._]+)$">
2189
+ <fingerprint pattern="^Sun-ILOM-Web-Server/(?:\d\.[\d._]+)$">
2189
2190
  <example>Sun-ILOM-Web-Server/1.0</example>
2190
2191
  <description>Sun Integrated Lights Out Manager (ILOM) usually
2191
2192
  bundled with Sun Fire servers</description>
@@ -2322,7 +2323,7 @@
2322
2323
  <param pos="0" name="service.family" value="Lotus Domino"/>
2323
2324
  </fingerprint>
2324
2325
 
2325
- <fingerprint pattern="^Lotus(?:-Domino)?/(?:Release-?)?([4-7][\d.]+)\s*(.*)$">
2326
+ <fingerprint pattern="^Lotus(?:-Domino)?/(?:Release-?)?([4-7][\d.]+)\s*(?:.*)$">
2326
2327
  <example>Lotus-Domino/5.0.8</example>
2327
2328
  <example>Lotus-Domino/Release-4.6.7(Intl)</example>
2328
2329
  <description>IBM Lotus Notes/Domino with version info</description>
@@ -2332,7 +2333,7 @@
2332
2333
  <param pos="1" name="service.version"/>
2333
2334
  </fingerprint>
2334
2335
 
2335
- <fingerprint pattern="^WebLogic (?:WebLogic )?Server (\d+\.\d+(\s+SP\d+)?)\s+.*$">
2336
+ <fingerprint pattern="^WebLogic (?:WebLogic )?Server (\d+\.\d+(?:\s+SP\d+)?)\s+.*$">
2336
2337
  <example>WebLogic Server 8.1 SP3 Tue Jun 29 23:11:19 PDT 2004 404973</example>
2337
2338
  <example>WebLogic Server 7.0 SP4 Tue Aug 12 11:22:26 PDT 2003</example>
2338
2339
  <example>WebLogic WebLogic Server 6.1 SP4 11/08/2002 21:50:43 #221641</example>
@@ -2379,7 +2380,7 @@
2379
2380
  <param pos="0" name="os.product" value="Windows"/>
2380
2381
  </fingerprint>
2381
2382
 
2382
- <fingerprint pattern="^Abyss/(\d\.[\d.]+)-X1-Win32 AbyssLib/(\d\.[\d.]+)$">
2383
+ <fingerprint pattern="^Abyss/(\d\.[\d.]+)-X1-Win32 AbyssLib/(?:\d\.[\d.]+)$">
2383
2384
  <example>Abyss/2.0.0.20-X1-Win32 AbyssLib/2.0.0.20</example>
2384
2385
  <example>Abyss/2.3.2-X1-Win32 AbyssLib/2.3.2</example>
2385
2386
  <description>Aprelium Technologies Abyss Web Server X1
@@ -2608,6 +2609,7 @@
2608
2609
  <param pos="0" name="service.vendor" value="HP"/>
2609
2610
  <param pos="0" name="service.product" value="JetDirect"/>
2610
2611
  <param pos="0" name="service.family" value="JetDirect"/>
2612
+ <param pos="1" name="service.version"/>
2611
2613
  <param pos="0" name="os.vendor" value="HP"/>
2612
2614
  <param pos="0" name="os.device" value="Printer"/>
2613
2615
  <param pos="0" name="os.family" value="JetDirect"/>
@@ -2794,6 +2796,7 @@
2794
2796
  <param pos="0" name="os.family" value="Raptor"/>
2795
2797
  <param pos="0" name="os.device" value="Firewall"/>
2796
2798
  <param pos="0" name="os.product" value="Raptor"/>
2799
+ <param pos="1" name="os.version"/>
2797
2800
  </fingerprint>
2798
2801
 
2799
2802
  <fingerprint pattern="^NS_(\d\.\d)$">
@@ -2873,7 +2876,7 @@
2873
2876
  <param pos="0" name="os.product" value="Linux"/>
2874
2877
  </fingerprint>
2875
2878
 
2876
- <fingerprint pattern="^RealVNC/(\S+)$">
2879
+ <fingerprint pattern="^RealVNC/(?:\S+)$">
2877
2880
  <description>RealVNC built-in webserver</description>
2878
2881
  <example>RealVNC/4.0</example>
2879
2882
  <param pos="0" name="service.vendor" value="RealVNC Ltd."/>
@@ -3266,7 +3269,7 @@
3266
3269
  </fingerprint>
3267
3270
 
3268
3271
  <!-- Hikvision is OEMd by a number of DVR manufacturers -->
3269
- <fingerprint pattern="^(Hikvision|DVRDVS)-Webs$">
3272
+ <fingerprint pattern="^(?:Hikvision|DVRDVS)-Webs$">
3270
3273
  <description>Web server found on DVR and webcam servers sourced from Hikvision</description>
3271
3274
  <example>Hikvision-Webs</example>
3272
3275
  <example>DVRDVS-Webs</example>
@@ -3282,6 +3285,7 @@
3282
3285
  <example>NET-DK 1.1</example>
3283
3286
  <param pos="0" name="service.vendor" value="ARRIS"/>
3284
3287
  <param pos="0" name="service.product" value="Net-DK Web Server"/>
3288
+ <param pos="1" name="service.version"/>
3285
3289
  <param pos="0" name="os.vendor" value="ARRIS"/>
3286
3290
  <param pos="0" name="os.device" value="Cable Modem"/>
3287
3291
  </fingerprint>
@@ -3302,7 +3306,7 @@
3302
3306
  assert nothing.</description>
3303
3307
  </fingerprint>
3304
3308
 
3305
- <fingerprint pattern="^Web-Server/((?:\d+\.)+\d+)$">
3309
+ <fingerprint pattern="^Web-Server/(?:\d+\.+\d+)$">
3306
3310
  <example>Web-Server/3.0</example>
3307
3311
  <!-- Hard to be sure with such a generic name, but I
3308
3312
  suspect this server has been obfuscated. -->
data/xml/ntp_banners.xml CHANGED
@@ -139,7 +139,7 @@ NTP "banners", taken from a readvar response
139
139
  </fingerprint>
140
140
  <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?6\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
141
141
  <description>ntpd running on Mac OSX 10.2/Jaguar</description>
142
- <example service.version="4.1.1@1.786" os.version="10.2" os.version.version="8">
142
+ <example service.version="4.1.1@1.786" os.version.version="8">
143
143
  version="ntpd 4.1.1@1.786 Tue Nov 12 09:30:41 PST 2002 (1)", processor="Power Macintosh", system="Darwin6.8",
144
144
  </example>
145
145
  <param pos="0" name="service.family" value="NTP"/>
@@ -224,7 +224,7 @@ NTP "banners", taken from a readvar response
224
224
  </fingerprint>
225
225
  <fingerprint pattern="^.*processor=&quot;([^&quot;]+)&quot;.*system=&quot;BSD/OS([\d.]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
226
226
  <description>BSD/OS with a version and arch</description>
227
- <example os.arch="i386" os.product="BSD/OS" os.version="4.3.1">
227
+ <example os.arch="i386" os.version="4.3.1">
228
228
  processor="i386", system="BSD/OS4.3.1", leap=0, stratum=2
229
229
  </example>
230
230
  <param pos="0" name="os.vendor" value="Berkeley Software Design Inc."/>
@@ -418,6 +418,7 @@ NTP "banners", taken from a readvar response
418
418
  <param pos="0" name="os.vendor" value="Sun"/>
419
419
  <param pos="0" name="os.family" value="Solaris"/>
420
420
  <param pos="0" name="os.product" value="Solaris"/>
421
+ <param pos="1" name="os.version"/>
421
422
  </fingerprint>
422
423
  <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;JUNOS/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
423
424
  <description>ntpd running on Juniper/Netscreen JunOS</description>
@@ -436,14 +437,14 @@ NTP "banners", taken from a readvar response
436
437
  </fingerprint>
437
438
  <fingerprint pattern="processor=&quot;([^ ]+)&quot;,.*system=&quot;JUNOS/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
438
439
  <description>Juniper/Netscreen JunOS NTP without a version</description>
439
- <example>processor="i386", system="JUNOS7.0R2.7", leap=0, stratum=3</example>
440
- <example>processor="i386", system="JUNOS6.4R1.6", leap=3, stratum=16</example>
441
- <example>processor="i386", system="JUNOS5.5R2.3", leap=0, stratum=3</example>
440
+ <example os.arch="i386" os.version="7.0R2.7">processor="i386", system="JUNOS7.0R2.7", leap=0, stratum=3</example>
441
+ <example os.arch="i386" os.version="6.4R1.6">processor="i386", system="JUNOS6.4R1.6", leap=3, stratum=16</example>
442
+ <example os.arch="i386" os.version="5.5R2.3">processor="i386", system="JUNOS5.5R2.3", leap=0, stratum=3</example>
442
443
  <param pos="0" name="os.vendor" value="Juniper"/>
443
444
  <param pos="0" name="os.family" value="Junos"/>
444
445
  <param pos="0" name="os.product" value="Junos OS"/>
445
- <param pos="2" name="os.arch"/>
446
- <param pos="3" name="os.version"/>
446
+ <param pos="1" name="os.arch"/>
447
+ <param pos="2" name="os.version"/>
447
448
  </fingerprint>
448
449
  <fingerprint pattern="^.*version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;Windows/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
449
450
  <description>ntpd running on Windows</description>
@@ -640,7 +641,7 @@ NTP "banners", taken from a readvar response
640
641
  <param pos="0" name="os.product" value="VxWorks"/>
641
642
  <param pos="0" name="os.arch" value="i386"/>
642
643
  </fingerprint>
643
- <fingerprint pattern="system=&quot;UNIX/(Unixware([^ ]+))&quot;" flags="REG_ICASE">
644
+ <fingerprint pattern="system=&quot;UNIX/Unixware([^ ]+)&quot;" flags="REG_ICASE">
644
645
  <description>SCO Unixware NTP</description>
645
646
  <example>
646
647
  system="UNIX/Unixware2", leap=3, stratum=16, rootdelay=0.00,
@@ -652,7 +653,7 @@ NTP "banners", taken from a readvar response
652
653
  <param pos="0" name="os.vendor" value="SCO"/>
653
654
  <param pos="1" name="os.product"/>
654
655
  </fingerprint>
655
- <fingerprint pattern="^.*processor=&quot;([^&quot;]+)&quot;, system=&quot;SCO_SV([\d\.]+)&quot;" flags="REG_ICASE">
656
+ <fingerprint pattern="^.*processor=&quot;([^&quot;]+)&quot;, system=&quot;SCO_SV([\d\.]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
656
657
  <description>SCO Unixware NTP</description>
657
658
  <example os.version="3.2" os.arch="i386">
658
659
  processor="i386", system="SCO_SV3.2", leap=0, stratum=2, precision=-18
data/xml/rsh_resp.xml CHANGED
@@ -75,7 +75,7 @@ Rservices responses to requests are matched against these patterns to fingerprin
75
75
  <param pos="0" name="os.product" value="AIX"/>
76
76
  </fingerprint>
77
77
 
78
- <fingerprint pattern="^.remshd: (getservbyname.+|Kerberos Authentication not enabled\..+|Error! Kerberos authentication failed)$" flags="REG_DOT_NEWLINE">
78
+ <fingerprint pattern="^.remshd: (?:getservbyname.+|Kerberos Authentication not enabled\..+|Error! Kerberos authentication failed)$" flags="REG_DOT_NEWLINE">
79
79
  <example>xremshd: getservbyname
80
80
  </example>
81
81
  <example>xremshd: Kerberos Authentication not enabled.
data/xml/smb_native_os.xml CHANGED
@@ -14,7 +14,7 @@
14
14
  <param pos="1" name="os.product"/>
15
15
  </fingerprint>
16
16
 
17
- <fingerprint pattern="^(Windows (95|98|ME))$">
17
+ <fingerprint pattern="^(Windows (?:95|98|ME))$">
18
18
  <description>Windows 95/98/ME</description>
19
19
  <example os.product="Windows 95">Windows 95</example>
20
20
  <example os.product="Windows 98">Windows 98</example>
data/xml/smtp_expn.xml CHANGED
@@ -38,8 +38,7 @@ See comment at the top of smtp_banners.xml for additional info.
38
38
  </fingerprint>
39
39
 
40
40
  <fingerprint pattern="^500[ -]Don't you wish! *$">
41
- <description>
42
- </description>
41
+ <description>GNAT box SMTP</description>
43
42
  <param pos="0" name="service.vendor" value="Global Technology Associates"/>
44
43
  <param pos="0" name="service.family" value="GNAT Box"/>
45
44
  <param pos="0" name="service.product" value="GNAT Box"/>
data/xml/smtp_mailfrom.xml CHANGED
@@ -5,18 +5,15 @@ This file is currently unused.
5
5
 
6
6
  <fingerprints>
7
7
  <fingerprint pattern="250 .* is syntactically correct *">
8
- <description>
9
- Exim
10
- example: 250 &lt;nosuchuser@rapid7.com&gt; is syntactically correct
11
- </description>
8
+ <description>exim</description>
9
+ <example>250 &lt;nosuchuser@rapid7.com&gt; is syntactically correct</example>
12
10
  <param pos="0" name="service.vendor" value="exim"/>
13
11
  <param pos="0" name="service.family" value="exim"/>
14
12
  <param pos="0" name="service.product" value="exim"/>
15
13
  </fingerprint>
16
14
 
17
15
  <fingerprint pattern="501[ -]System error\. *">
18
- <description>
19
- </description>
16
+ <description>GNAT Box SMTP</description>
20
17
  <param pos="0" name="service.vendor" value="Global Technology Associates"/>
21
18
  <param pos="0" name="service.family" value="GNAT Box"/>
22
19
  <param pos="0" name="service.product" value="GNAT Box"/>
data/xml/snmp_sysdescr.xml CHANGED
@@ -41,9 +41,9 @@
41
41
  <param pos="2" name="os.version"/>
42
42
  </fingerprint>
43
43
 
44
- <fingerprint pattern="^3COM: (AP\S+): .*11.*Access Point, Software v(\S+), Bootrom v(\S+), Hardware (\S+)$">
44
+ <fingerprint pattern="^3COM: (AP\S+): .*11.*Access Point, Software v(\S+), Bootrom v\S+, Hardware \S+$">
45
45
  <description>3COM WAP</description>
46
- <example>3COM: AP8760: Dual Radio 11a/b/g Access Point, Software v2.1.13b05_sh, Bootrom v1.2.1, Hardware R02</example>
46
+ <example os.product="AP8760" os.version="2.1.13b05_sh">3COM: AP8760: Dual Radio 11a/b/g Access Point, Software v2.1.13b05_sh, Bootrom v1.2.1, Hardware R02</example>
47
47
  <param pos="0" name="os.vendor" value="3Com"/>
48
48
  <param pos="0" name="os.family" value="Access Point"/>
49
49
  <param pos="0" name="os.device" value="WAP"/>
@@ -411,7 +411,7 @@
411
411
  <param pos="2" name="os.version"/>
412
412
  </fingerprint>
413
413
 
414
- <fingerprint pattern="^3Com (.*Switch.*) \d+-Port.*Software Version (\d\..*(Release|Feature).*)$">
414
+ <fingerprint pattern="^3Com (.*Switch.*) \d+-Port.*Software Version (\d\..*(?:Release|Feature).*)$">
415
415
  <description>3COM Switch</description>
416
416
  <example>3Com Switch 4210 18-Port Software Version 3.10 Release 2212P01</example>
417
417
  <example>3Com Switch 4210 26-Port Software Version 3.10 Release 2212</example>
@@ -461,7 +461,7 @@
461
461
  ADTRAN
462
462
  =======================================================================-->
463
463
 
464
- <fingerprint pattern="^ADTRAN (MX\d+( \S+)?( \S+)?)$" flags="REG_ICASE">
464
+ <fingerprint pattern="^ADTRAN (MX\d+(?: \S+)?(?: \S+)?)$" flags="REG_ICASE">
465
465
  <description>ADTRAN Multiplexer</description>
466
466
  <example>ADTRAN MX2820 Multiplexer</example>
467
467
  <example>ADTRAN MX2800 DS3 Multiplexer</example>
@@ -492,13 +492,11 @@
492
492
  <param pos="1" name="os.product"/>
493
493
  </fingerprint>
494
494
 
495
- <fingerprint pattern="^ADTRAN (TA\S+( \S+)?( \S+)?)$" flags="REG_ICASE">
495
+ <fingerprint pattern="^ADTRAN (TA\S+(?: \S+)?(?: \S+)?)$" flags="REG_ICASE">
496
496
  <description>ADTRAN TotalAccess</description>
497
- <example>ADTRAN TA1448S-CE</example>
498
- <example>Adtran TA1124</example>
499
- <example>Adtran TA1148</example>
500
- <example>Adtran TA1224</example>
501
- <example>Adtran TA1248</example>
497
+ <example os.product="TA1448S-CE">ADTRAN TA1448S-CE</example>
498
+ <example os.product="TA1124">Adtran TA1124</example>
499
+ <example os.product="TA1148">Adtran TA1148</example>
502
500
  <param pos="0" name="os.device" value="Media Gateway"/>
503
501
  <param pos="0" name="os.vendor" value="ADTRAN"/>
504
502
  <param pos="0" name="os.family" value="Total Access"/>
@@ -710,7 +708,7 @@
710
708
 
711
709
  <fingerprint pattern="^Apple Base Station V([^\s]+) Compatible$">
712
710
  <description>Apple Airport base station</description>
713
- <example>Apple Base Station V3.84 Compatible</example>
711
+ <example os.version="3.84">Apple Base Station V3.84 Compatible</example>
714
712
  <param pos="0" name="os.vendor" value="Apple"/>
715
713
  <param pos="0" name="os.family" value="Airport"/>
716
714
  <param pos="0" name="os.product" value="Base Station"/>
@@ -718,7 +716,7 @@
718
716
  <param pos="1" name="os.version"/>
719
717
  </fingerprint>
720
718
 
721
- <fingerprint pattern="^Apple AirPort - Apple (Inc\.|Computer).*$">
719
+ <fingerprint pattern="^Apple AirPort - Apple (?:Inc\.|Computer).*$">
722
720
  <description>Apple Airport Extreme</description>
723
721
  <example>Apple AirPort - Apple Inc., 2006-2009. All rights Reserved.</example>
724
722
  <example>Apple AirPort - Apple Computer, 2006. All rights Reserved</example>
@@ -1108,6 +1106,7 @@
1108
1106
  <param pos="0" name="os.vendor" value="Brother"/>
1109
1107
  <param pos="0" name="os.product" value="Unknown"/>
1110
1108
  <param pos="0" name="os.device" value="Printer"/>
1109
+ <param pos="1" name="os.version"/>
1111
1110
  </fingerprint>
1112
1111
 
1113
1112
  <fingerprint pattern="^Brother (NC-\d+\S+),\s*Firmware Ver\.\s?([^\s,]+).*">
@@ -1254,7 +1253,7 @@
1254
1253
  CANON
1255
1254
  =======================================================================-->
1256
1255
 
1257
- <fingerprint pattern="^Canon (iR ?\S+( [A-Z0-9]\S+)?)(?: /P)?(?: EEPROM \S+)?$">
1256
+ <fingerprint pattern="^Canon (iR ?\S+(?: [A-Z0-9]\S+)?)(?: /P)?(?: EEPROM \S+)?$">
1258
1257
  <description>Canon iR multifunction device</description>
1259
1258
  <example>Canon iR C3220-C1 /P</example>
1260
1259
  <example>Canon iR105PLUS-M3 /P</example>
@@ -1283,7 +1282,7 @@
1283
1282
  <param pos="1" name="os.product"/>
1284
1283
  </fingerprint>
1285
1284
 
1286
- <fingerprint pattern="^Canon (iPR ?\S+( [A-Z0-9]\S+)?)(?: /P)?(?: EEPROM \S+)?$">
1285
+ <fingerprint pattern="^Canon (iPR ?\S+(?: [A-Z0-9]\S+)?)(?: /P)?(?: EEPROM \S+)?$">
1287
1286
  <description>Canon iPR multifunction device</description>
1288
1287
  <example>Canon iPR C1 /P</example>
1289
1288
  <example>Canon iPR C1-Q1 /P</example>
@@ -1494,6 +1493,7 @@
1494
1493
  <param pos="0" name="os.device" value="Switch"/>
1495
1494
  <param pos="0" name="os.family" value="Packet-Optical"/>
1496
1495
  <param pos="1" name="os.product"/>
1496
+ <param pos="2" name="os.version"/>
1497
1497
  </fingerprint>
1498
1498
 
1499
1499
 
@@ -1828,7 +1828,7 @@ Copyright (c) 1995-2005 by Cisco Systems
1828
1828
  </fingerprint>
1829
1829
 
1830
1830
 
1831
- <fingerprint pattern="^Datamax (Printer|.*Print Server).*$">
1831
+ <fingerprint pattern="^Datamax (?:Printer|.*Print Server).*$">
1832
1832
  <description>Datamax printer</description>
1833
1833
  <example>Datamax DMXrfNet Print Server compatible with an HP JETDIRECT EX</example>
1834
1834
  <example>Datamax Printer</example>
@@ -1916,7 +1916,7 @@ Copyright (c) 1995-2005 by Cisco Systems
1916
1916
  <param pos="2" name="os.version"/>
1917
1917
  </fingerprint>
1918
1918
 
1919
- <fingerprint pattern="^Dell (\S+)(?: Mono)? Laser Printer(?:;| version) (\S+);?.*$">
1919
+ <fingerprint pattern="^Dell (\S+)(?: Mono)? Laser Printer(?:;| version) \S+;?.*$">
1920
1920
  <description>Dell Laser Printer</description>
1921
1921
  <example>Dell 2330dn Laser Printer version NR.APS.N449 kernel 2.6.18.5 All-N-1</example>
1922
1922
  <example>Dell 2350dn Laser Printer version NR.APS.N449 kernel 2.6.18.5 All-N-1</example>
@@ -2223,7 +2223,7 @@ Copyright (c) 1995-2005 by Cisco Systems
2223
2223
  <param pos="1" name="os.product"/>
2224
2224
  </fingerprint>
2225
2225
 
2226
- <fingerprint pattern="^EPSON (Internal .* Scanning Card|Network Image Express|Network Scanning Box)$">
2226
+ <fingerprint pattern="^EPSON (?:Internal .* Scanning Card|Network Image Express|Network Scanning Box)$">
2227
2227
  <description>Epson Network Scanner</description>
2228
2228
  <example>EPSON Internal 10Base-T/100Base-TX Scanning Card</example>
2229
2229
  <example>EPSON Network Image Express</example>
@@ -2233,7 +2233,7 @@ Copyright (c) 1995-2005 by Cisco Systems
2233
2233
  <param pos="0" name="os.product" value="Network Scanner"/>
2234
2234
  </fingerprint>
2235
2235
 
2236
- <fingerprint pattern="^EPSON UIB (\S+) Ethernet Interface Card$">
2236
+ <fingerprint pattern="^EPSON UIB \S+ Ethernet Interface Card$">
2237
2237
  <description>Epson Network Printer</description>
2238
2238
  <example>EPSON UIB 10/100Base-T Ethernet Interface Card</example>
2239
2239
  <example>EPSON UIB 10Base Ethernet Interface Card</example>
@@ -2410,7 +2410,7 @@ Copyright (c) 1995-2005 by Cisco Systems
2410
2410
  <param pos="2" name="os.version"/>
2411
2411
  </fingerprint>
2412
2412
 
2413
- <fingerprint pattern="^Foundry AP: (\S+) v(\S+)$">
2413
+ <fingerprint pattern="^Foundry AP: \S+ v(\S+)$">
2414
2414
  <description>Foundry Networks APs</description>
2415
2415
  <example>Foundry AP: 01.03.04Tw8 v2.0.0</example>
2416
2416
  <example>Foundry AP: 01.03.05Tw8 v3.0.4</example>
@@ -2576,12 +2576,9 @@ Copyright (c) 1995-2005 by Cisco Systems
2576
2576
  <param pos="2" name="os.version"/>
2577
2577
  </fingerprint>
2578
2578
 
2579
- <fingerprint pattern="^(\S+) (.*?) (HP|Compaq) Tru64 UNIX V(\S+) \(Rev\. ([^\)]+)\).*TCP/IP$">
2579
+ <fingerprint pattern="^(\S+) (.*?) (?:HP|Compaq) Tru64 UNIX V(\S+) \(Rev\. ([^\)]+)\).*TCP/IP$">
2580
2580
  <description>Digital/Compaq/HP Tru64 Unix</description>
2581
- <example>was1 AlphaServer DS10 466 MHz Compaq Tru64 UNIX V5.1B (Rev. 2650); Wed Feb 25 13:29:07 KST 2004 TCP/IP</example>
2582
- <example>wessex.eas.usdfa.ca COMPAQ AlphaServer DS10 617 MHz Compaq Tru64 UNIX V5.1A (Rev. 1885); Thu Nov 29 14:55:23 GMT 2001 TCP/IP</example>
2583
- <example>whizbang.geog.usdf.edu COMPAQ Professional Workstation XP1000 Compaq Tru64 UNIX V5.0A (Rev. 1094); Thu Sep 23 11:58:27 PDT 2004 TCP/IP</example>
2584
- <example>xian AlphaServer DS25 Compaq Tru64 UNIX V5.1B (Rev. 2650); Tue Mar 23 13:46:38 CST 2004 TCP/IP</example>
2581
+ <example host.name="was1" hw.product="AlphaServer DS10 466 MHz" os.version="5.1B" os.version.version="2650">was1 AlphaServer DS10 466 MHz Compaq Tru64 UNIX V5.1B (Rev. 2650); Wed Feb 25 13:29:07 KST 2004 TCP/IP</example>
2585
2582
  <param pos="0" name="os.vendor" value="HP"/>
2586
2583
  <param pos="0" name="os.family" value="Unix"/>
2587
2584
  <param pos="0" name="os.product" value="Tru64 Unix"/>
@@ -2680,7 +2677,7 @@ Copyright (c) 1995-2005 by Cisco Systems
2680
2677
 
2681
2678
  <fingerprint pattern="^HP Series Router (\S+) HP Comware Platform Software Comware Software Version ([^\s,]+)[,\s]\s*Release ([^,\s]+)?[,\s].*Copyright.*$">
2682
2679
  <description>HP Comware</description>
2683
- <example>HP Series Router A-MSR20-40 HP Comware Platform Software Comware Software Version 5.20, Release 2209P15, Standard Copyright(c) 2010-2012 Hewlett-Packard Development Company, L.P.</example>
2680
+ <example hw.product="A-MSR20-40" os.product="A-MSR20-40" os.version="5.20" os.version.version="2209P15">HP Series Router A-MSR20-40 HP Comware Platform Software Comware Software Version 5.20, Release 2209P15, Standard Copyright(c) 2010-2012 Hewlett-Packard Development Company, L.P.</example>
2684
2681
  <example>HP Series Router A-MSR30-20 HP Comware Platform Software Comware Software Version 5.20, Release 2207P41, Standard Copyright(c) 2010 Hewlett-Packard Development Company, L.P.</example>
2685
2682
  <example>HP Series Router A-MSR900 HP Comware Platform Software Comware Software Version 5.20, Release 2207P41 Copyright(c) 2010 Hewlett-Packard Development Company, L.P.</example>
2686
2683
  <param pos="0" name="os.vendor" value="HP"/>
@@ -2694,11 +2691,12 @@ Copyright (c) 1995-2005 by Cisco Systems
2694
2691
 
2695
2692
  <fingerprint pattern="^HP Series Router (\S+) HP Comware Platform Software Comware Software Version ([^,]+), (\S+) Copyright.*$">
2696
2693
  <description>HP Comware</description>
2697
- <example>HP Series Router A-MSR20-40 HP Comware Platform Software Comware Software Version 5.20, T2207L16 Copyright(c) 2010-2011 Hewlett-Packard Development Company, L.P.</example>
2694
+ <example os.product="A-MSR20-40" hw.product="A-MSR20-40" os.version="5.20" os.version.version="T2207L16">HP Series Router A-MSR20-40 HP Comware Platform Software Comware Software Version 5.20, T2207L16 Copyright(c) 2010-2011 Hewlett-Packard Development Company, L.P.</example>
2698
2695
  <param pos="0" name="os.vendor" value="HP"/>
2699
2696
  <param pos="0" name="os.device" value="Router"/>
2700
2697
  <param pos="0" name="os.family" value="Comware"/>
2701
2698
  <param pos="2" name="os.version"/>
2699
+ <param pos="3" name="os.version.version"/>
2702
2700
  <param pos="1" name="os.product"/>
2703
2701
  <param pos="1" name="hw.product"/>
2704
2702
  </fingerprint>
@@ -4324,6 +4322,7 @@ Copyright (c) 1995-2005 by Cisco Systems
4324
4322
  <param pos="0" name="os.device" value="Terminal Server"/>
4325
4323
  <param pos="1" name="os.product"/>
4326
4324
  <param pos="2" name="os.family"/>
4325
+ <param pos="3" name="os.version"/>
4327
4326
  </fingerprint>
4328
4327
 
4329
4328
  <fingerprint pattern="^Lantronix Inc\. - (Modbus Bridge)$">
@@ -5608,9 +5607,9 @@ Copyright (c) 1995-2005 by Cisco Systems
5608
5607
  <param pos="2" name="os.version.version.version"/>
5609
5608
  </fingerprint>
5610
5609
 
5611
- <fingerprint pattern="^Nortel Application Switch (\S+)(\s+\S+|)$">
5610
+ <fingerprint pattern="^Nortel Application Switch (\S+)(?:\s+\S+|)$">
5612
5611
  <description>Nortel Application switch</description>
5613
- <example>Nortel Application Switch 2424</example>
5612
+ <example os.product="2424">Nortel Application Switch 2424</example>
5614
5613
  <param pos="0" name="os.vendor" value="Nortel"/>
5615
5614
  <param pos="0" name="os.family" value="Application Switch"/>
5616
5615
  <param pos="0" name="os.device" value="Load balancer"/>
@@ -5918,7 +5917,7 @@ Copyright (c) 1995-2005 by Cisco Systems
5918
5917
  <param pos="0" name="os.device" value="Multifunction Device"/>
5919
5918
  </fingerprint>
5920
5919
 
5921
- <fingerprint pattern="^Oce, 3165 ([^,]+), Controller (\S+)$">
5920
+ <fingerprint pattern="^Oce, 3165 ([^,]+), Controller \S+$">
5922
5921
  <description>Oce 3165 multifunction device</description>
5923
5922
  <example>Oce, 3165 R8.2, Controller R10.2.8</example>
5924
5923
  <param pos="0" name="os.vendor" value="Oce"/>
@@ -6142,6 +6141,7 @@ Copyright (c) 1995-2005 by Cisco Systems
6142
6141
  <param pos="0" name="os.family" value="NEO"/>
6143
6142
  <param pos="0" name="os.product" value="NEO Tape Library"/>
6144
6143
  <param pos="0" name="os.device" value="Storage"/>
6144
+ <param pos="1" name="os.version"/>
6145
6145
  </fingerprint>
6146
6146
 
6147
6147
  <!--======================================================================
@@ -7054,7 +7054,7 @@ Copyright (c) 1995-2005 by Cisco Systems
7054
7054
  SCO
7055
7055
  =======================================================================-->
7056
7056
 
7057
- <fingerprint pattern="^SCO TCP/IP Runtime Release (\S+)$">
7057
+ <fingerprint pattern="^SCO TCP/IP Runtime Release \S+$">
7058
7058
  <description>SCO</description>
7059
7059
  <example>SCO TCP/IP Runtime Release 2.0.0</example>
7060
7060
  <param pos="0" name="os.vendor" value="SCO"/>
@@ -7660,6 +7660,7 @@ Copyright (c) 1995-2005 by Cisco Systems
7660
7660
  <param pos="0" name="os.device" value="General"/>
7661
7661
  <param pos="1" name="os.version"/>
7662
7662
  <param pos="2" name="os.arch"/>
7663
+ <param pos="3" name="hw.product"/>
7663
7664
  </fingerprint>
7664
7665
 
7665
7666
  <fingerprint pattern="^SunOS (\S+) 5\.(\S+) \S+ (\S+) \S+ SUNW,([^,]+).*$">
@@ -7669,7 +7670,7 @@ Copyright (c) 1995-2005 by Cisco Systems
7669
7670
  <example>SunOS magppg01 5.10 Generic_127127-11 sun4v sparc SUNW,T5240</example>
7670
7671
  <example>SunOS magppg02 5.10 Generic_127127-11 sun4v sparc SUNW,T5240</example>
7671
7672
  <example>SunOS rs1-s3 5.10 Generic_142900-09 sun4v sparc SUNW,Netra-CP3260</example>
7672
- <example>SunOS sn 5.10 Generic_118833-36 sun4v sparc SUNW,Sun-Fire-T200</example>
7673
+ <example hw.product="Sun-Fire-T200">SunOS sn 5.10 Generic_118833-36 sun4v sparc SUNW,Sun-Fire-T200</example>
7673
7674
  <param pos="0" name="os.vendor" value="Sun"/>
7674
7675
  <param pos="0" name="os.certainty" value="0.9"/>
7675
7676
  <param pos="0" name="os.family" value="Solaris"/>
@@ -7678,6 +7679,7 @@ Copyright (c) 1995-2005 by Cisco Systems
7678
7679
  <param pos="1" name="host.name"/>
7679
7680
  <param pos="2" name="os.version"/>
7680
7681
  <param pos="3" name="os.arch"/>
7682
+ <param pos="4" name="hw.product"/>
7681
7683
  </fingerprint>
7682
7684
 
7683
7685
  <fingerprint pattern="^SunOS 5\.(\S+) \S+ (\S+)$">
@@ -7828,6 +7830,7 @@ Copyright (c) 1995-2005 by Cisco Systems
7828
7830
  <param pos="0" name="os.vendor" value="Tandberg"/>
7829
7831
  <param pos="0" name="os.device" value="Web cam"/>
7830
7832
  <param pos="1" name="os.product"/>
7833
+ <param pos="2" name="os.version"/>
7831
7834
  </fingerprint>
7832
7835
 
7833
7836
  <!--======================================================================
@@ -7871,6 +7874,7 @@ Copyright (c) 1995-2005 by Cisco Systems
7871
7874
  <param pos="0" name="os.vendor" value="Unisys"/>
7872
7875
  <param pos="0" name="os.device" value="Printer"/>
7873
7876
  <param pos="1" name="os.product"/>
7877
+ <param pos="2" name="os.version"/>
7874
7878
  </fingerprint>
7875
7879
 
7876
7880
  <fingerprint pattern="^VxWorks SNMPv1/v2c Agent">
data/xml/snmp_sysobjid.xml CHANGED
@@ -116,7 +116,7 @@
116
116
  <param pos="0" name="os.arch" value="x86"/>
117
117
  </fingerprint>
118
118
 
119
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6001.*$">
119
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: \S+64.*Software: Windows Version 6\.0 \(Build 6001.*$">
120
120
  <description>Windows Server 2008 on x86_64</description>
121
121
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
122
122
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
@@ -127,7 +127,7 @@
127
127
  <param pos="0" name="os.arch" value="x86_64"/>
128
128
  </fingerprint>
129
129
 
130
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6001.*$">
130
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: \S+64.*Software: Windows Version 6\.0 \(Build 6001.*$">
131
131
  <description>Windows Server 2008 Datacenter on x86_64</description>
132
132
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
133
133
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6001 Multiprocessor Free)</example>
@@ -160,7 +160,7 @@
160
160
  <param pos="0" name="os.arch" value="x86"/>
161
161
  </fingerprint>
162
162
 
163
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6002.*$">
163
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: \S+64.*Software: Windows Version 6\.0 \(Build 6002.*$">
164
164
  <description>Windows Server 2008 SP2 on x86_64</description>
165
165
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
166
166
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
@@ -170,9 +170,9 @@
170
170
  <param pos="0" name="os.device" value="General"/>
171
171
  <param pos="0" name="os.version" value="SP2"/>
172
172
  <param pos="0" name="os.arch" value="x86_64"/>
173
- </fingerprint>
173
+ </fingerprint>
174
174
 
175
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.0 \(Build 6002.*$">
175
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: \S+64.*Software: Windows Version 6\.0 \(Build 6002.*$">
176
176
  <description>Windows Server 2008 Datacenter SP2 on x86_64</description>
177
177
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
178
178
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.0 (Build 6002 Multiprocessor Free)</example>
@@ -182,7 +182,7 @@
182
182
  <param pos="0" name="os.device" value="General"/>
183
183
  <param pos="0" name="os.version" value="SP2"/>
184
184
  <param pos="0" name="os.arch" value="x86_64"/>
185
- </fingerprint>
185
+ </fingerprint>
186
186
 
187
187
  <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: x86.*Software: Windows Version 6\.1 \(Build 7600.*$">
188
188
  <description>Windows Server 2008 R2 on x86</description>
@@ -204,7 +204,7 @@
204
204
  <param pos="0" name="os.arch" value="x86"/>
205
205
  </fingerprint>
206
206
 
207
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7600.*$">
207
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: \S+64.*Software: Windows Version 6\.1 \(Build 7600.*$">
208
208
  <description>Windows Server 2008 R2 on x86_64</description>
209
209
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
210
210
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
@@ -215,7 +215,7 @@
215
215
  <param pos="0" name="os.arch" value="x86_64"/>
216
216
  </fingerprint>
217
217
 
218
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7600.*$">
218
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: \S+64.*Software: Windows Version 6\.1 \(Build 7600.*$">
219
219
  <description>Windows Server 2008 Datacenter R2 on x86_64</description>
220
220
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
221
221
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7600 Multiprocessor Free)</example>
@@ -248,7 +248,7 @@
248
248
  <param pos="0" name="os.arch" value="x86"/>
249
249
  </fingerprint>
250
250
 
251
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7601.*$">
251
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: \S+64.*Software: Windows Version 6\.1 \(Build 7601.*$">
252
252
  <description>Windows Server 2008 R2 SP1 on x86_64</description>
253
253
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
254
254
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
@@ -260,7 +260,7 @@
260
260
  <param pos="0" name="os.arch" value="x86_64"/>
261
261
  </fingerprint>
262
262
 
263
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: (\S+64).*Software: Windows Version 6\.1 \(Build 7601.*$">
263
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.3 Hardware: \S+64.*Software: Windows Version 6\.1 \(Build 7601.*$">
264
264
  <description>Windows Server 2008 Datacenter R2 SP1 on x86_64</description>
265
265
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: AMD64 Family 16 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
266
266
  <example>1.3.6.1.4.1.311.1.1.3.1.3 Hardware: Intel64 Family 15 Model 2 Stepping 5 AT/AT COMPATIBLE - Software: Windows Version 6.1 (Build 7601 Multiprocessor Free)</example>
@@ -272,7 +272,7 @@
272
272
  <param pos="0" name="os.arch" value="x86_64"/>
273
273
  </fingerprint>
274
274
 
275
- <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: (\S+64).*Software: Windows Version 6\.2 \(Build 9200.*$">
275
+ <fingerprint pattern="^1\.3\.6\.1\.4\.1\.311\.1\.1\.3\.1\.2 Hardware: \S+64.*Software: Windows Version 6\.2 \(Build 9200.*$">
276
276
  <description>Windows Server 2012 on x86_64</description>
277
277
  <example>1.3.6.1.4.1.311.1.1.3.1.2 Hardware: Intel64 Family 6 Model 2 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version 6.2 (Build 9200 Multiprocessor Free)</example>
278
278
  <param pos="0" name="os.vendor" value="Microsoft"/>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: recog
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.0.3
4
+ version: 1.0.4
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rapid7 Research
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2014-10-09 00:00:00.000000000 Z
11
+ date: 2014-10-10 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rspec