recog 2.1.38 → 2.1.39

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8cacab2a771cb9870e735cdcc7e13c7f8ba33758
-  data.tar.gz: 3e470f60c74af7d5524469be446ba269bbf3efd1
+  metadata.gz: 5e17c7d1d1caa24d91f05d1f4946ff4ca9a301b8
+  data.tar.gz: 7a26baa5f8983d28c3ffcead5b7cc04ad5a773ab
 SHA512:
-  metadata.gz: 3bee02bafd7d9320229c98c2dd6c2860f4726dee3f9c424f6bd6665c9964e1d22d17733dd607fb44e3cb66afbd5cb82c4b669ae796f65adf4031ceff7d4d354f
-  data.tar.gz: 57ff151f8dcc21b392895a4328c0b82f4a98aaa1f889084702164725662cbd9c6191fdb069c60f8f512bcd923c2434da083c6ebb0bc5faa21064c878111f4f39
+  metadata.gz: 02b5816f77d7f1e35dead948071977c0991b78ff1a6984cb296f08cd76c15f72baedcc950d1d59540ebb367652569c4a0da6f491ec6bf9f3099b7697338a0d5f
+  data.tar.gz: ba482452db5b315a064bc869d41488b2c58603e1af8920d295c9cf76b09919d967de6faadfe291d01e27bdb437720bd60e1220fb405c6cdb150c0d2f1d752354

data/lib/recog/version.rb

@@ -1,3 +1,3 @@
 module Recog
-  VERSION = '2.1.38'
+  VERSION = '2.1.39'
 end

data/xml/ftp_banners.xml

@@ -201,6 +201,30 @@ example.com FTP server (Version:  Mac OS X Server) ready.</example>
     <param pos="2" name="os.product"/>
     <param pos="3" name="host.name"/>
   </fingerprint>
+  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(NETGEAR ReadyNAS\) \[(.+)\]$">
+    <description>ProFTPD on a Netgear ReadyNAS with a version and IP</description>
+    <example service.version="1.3.3g" host.ip="192.168.1.10">ProFTPD 1.3.3g Server (NETGEAR ReadyNAS) [192.168.1.10]</example>
+    <param pos="0" name="service.family" value="ProFTPD"/>
+    <param pos="0" name="service.vendor" value="ProFTPD Project"/>
+    <param pos="0" name="service.product" value="ProFTPD"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
+    <param pos="0" name="hw.vendor" value="Netgear"/>
+    <param pos="0" name="hw.device" value="NAS"/>
+    <param pos="0" name="hw.product" value="ReadyNAS"/>
+    <param pos="2" name="host.ip"/>
+  </fingerprint>
+  <fingerprint pattern="^ProFTPD Server \(NETGEAR ReadyNAS\) \[(.+)\]$">
+    <description>ProFTPD on a Netgear ReadyNAS with a hostname</description>
+    <example host.name="test">ProFTPD Server (NETGEAR ReadyNAS) [test]</example>
+    <param pos="0" name="service.family" value="ProFTPD"/>
+    <param pos="0" name="service.vendor" value="ProFTPD Project"/>
+    <param pos="0" name="service.product" value="ProFTPD"/>
+    <param pos="0" name="hw.vendor" value="Netgear"/>
+    <param pos="0" name="hw.device" value="NAS"/>
+    <param pos="0" name="hw.product" value="ReadyNAS"/>
+    <param pos="1" name="host.name"/>
+  </fingerprint>
   <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(.*)\) \[(.+)\]$">
     <description>ProFTPD on a wired Linksys device</description>
     <param pos="0" name="service.family" value="ProFTPD"/>
@@ -235,9 +259,10 @@ example.com FTP server (Version:  Mac OS X Server) ready.</example>
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
   </fingerprint>
-  <fingerprint pattern="^ProFTPD FTP Server ready\.$">
+  <fingerprint pattern="^ProFTPD (?:FTP )?Server ready\.$">
     <description>ProFTPD with no version info</description>
     <example>ProFTPD FTP Server ready.</example>
+    <example>ProFTPD Server ready.</example>
     <param pos="0" name="service.family" value="ProFTPD"/>
     <param pos="0" name="service.vendor" value="ProFTPD Project"/>
     <param pos="0" name="service.product" value="ProFTPD"/>
@@ -282,11 +307,13 @@ more stuff</example>
     <param pos="0" name="service.product" value="Pure-FTPd"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
-  <fingerprint pattern="^-{9,10} Welcome to Pure-FTPd (.*)-{9,10}" flags="REG_MULTILINE">
+  <fingerprint pattern="^-{9,10}(?:.*)\s+Pure-FTPd\s+(.*)-{9,10}">
     <description>Pure-FTPd versions &gt;= 1.0.14
       Config data can be zero or more of: [privsep] [TLS]
     </description>
     <example>---------- Welcome to Pure-FTPd ----------</example>
+    <example>--------- Bienvenido a Pure-FTPd [privsep] [TLS] ----------</example>
+    <example>---------  Pure-FTPd [privsep] ----------</example>
     <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------</example>
     <example>--------- Welcome to Pure-FTPd [privsep] [TLS] ----------&#13;
 more text</example>
@@ -294,6 +321,13 @@ more text</example>
     <param pos="0" name="service.family" value="Pure-FTPd"/>
     <param pos="0" name="service.product" value="Pure-FTPd"/>
   </fingerprint>
+  <fingerprint pattern="^(?:Welcome to )?Pure-FTPd\.?$">
+    <description>Basic Pure-FTPd banner, no version</description>
+    <example>Welcome to Pure-FTPd</example>
+    <example>Pure-FTPd.</example>
+    <param pos="0" name="service.family" value="Pure-FTPd"/>
+    <param pos="0" name="service.product" value="Pure-FTPd"/>
+  </fingerprint>
   <fingerprint pattern="^=\(.\*.\)=-\.:\. \(\( Welcome to PureFTPd (\d+\..+) \)\) \.:\.-=\(.\*.\)=-" flags="REG_MULTILINE">
     <description>Older Pure-FTPd versions</description>
     <example service.version="1.1.0">=(&lt;*&gt;)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(&lt;*&gt;)=-</example>
@@ -511,40 +545,49 @@ more text</example>
     <param pos="1" name="os.product"/>
     <param pos="0" name="os.device" value="Storage"/>
   </fingerprint>
-  <fingerprint pattern="^AXIS (\S+) (?:(?:Fixed Dome )?Network(?: Fixed Dome)? Camera) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
+  <fingerprint pattern="(?i)^AXIS (\S+) .* Camera(?:\s+version)?\s+(\S+) .*">
     <description>Axis Network Camera</description>
-    <example os.product="2100" os.version="2.43">Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
-    <example os.product="207" os.version="4.40.1">AXIS 207 Network Camera 4.40.1 (Apr 16 2007) ready.</example>
-    <example os.product="216FD" os.version="4.47">AXIS 216FD Network Fixed Dome Camera 4.47 (Mar 13 2008) ready.</example>
-    <example os.product="M3203" os.version="5.12.1">AXIS M3203 Fixed Dome Network Camera 5.12.1 (Feb 07 2011) ready.</example>
-    <param pos="0" name="os.vendor" value="Axis"/>
-    <param pos="0" name="os.device" value="Web cam"/>
-    <param pos="1" name="os.product"/>
-    <param pos="2" name="os.version"/>
+    <example hw.product="2100" hw.version="2.43">Axis 2100 Network Camera 2.43 Nov 04 2008 ready.</example>
+    <example hw.product="216FD" hw.version="4.47">AXIS 216FD Network Fixed Dome Camera 4.47 (Mar 13 2008) ready.</example>
+    <example hw.product="214" hw.version="4.49">AXIS 214 PTZ Network Camera 4.49 (Oct 05 2009) ready</example>
+    <example hw.product="205" hw.version="4.05">AXIS 205 Network Camera version 4.05 (Sep 27 2004) ready.</example>
+    <example hw.product="233D" hw.version="4.48.4">AXIS 233D Network Dome Camera 4.48.4 (Mar 23 2010) ready.</example>
+    <example hw.product="P1346" hw.version="5.50beta3">AXIS P1346 Network Camera 5.50beta3 (2014) ready</example>
+    <param pos="0" name="hw.vendor" value="Axis"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="2" name="hw.version"/>
   </fingerprint>
-  <fingerprint pattern="^AXIS (\S+) Video (?:Encoder Blade|Server|Decoder) ([\d\.]+) .* ready\.?$" flags="REG_ICASE">
-    <description>Axis Video encoders/servers</description>
+  <fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?Video|IO Audio) (?:Encoder|Encoder Blade|Module|Server|Decoder) (\S+) .*">
+    <description>Axis Audio/Video encoders/servers</description>
     <example hw.product="Q7406">AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
-    <example os.product="241Q">AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
-    <example os.version="5.07.2">AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
+    <example hw.product="241Q">AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
+    <example hw.version="5.07.2">AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
+    <example hw.product="Q7401" hw.version="5.01">AXIS Q7401 Video Encoder 5.01 (Aug 01 2008) ready.</example>
+    <example hw.product="Q7401" hw.version="5.50.2_cst_412205_1">AXIS Q7401 Video Encoder 5.50.2_cst_412205_1 (2013)</example>
+    <example hw.product="Q7424-R" hw.version="5.51.3.1">AXIS Q7424-R Mk II Video Encoder 5.51.3.1 (2016) ready.</example>
+    <example hw.product="P8221" hw.version="5.10.2">AXIS P8221 IO Audio Module 5.10.2 (Nov 07 2011) ready.</example>
     <param pos="0" name="hw.vendor" value="Axis"/>
     <param pos="1" name="hw.product"/>
-    <param pos="0" name="os.vendor" value="Axis"/>
-    <param pos="1" name="os.product"/>
-    <param pos="2" name="os.version"/>
+    <param pos="2" name="hw.version"/>
+  </fingerprint>
+  <fingerprint pattern="(?i)^AXIS (\S+) Network Door Controller (\S+) .* ready\.?$">
+    <description>Axis Door Controllers</description>
+    <example hw.product="A1001" hw.version="1.65.1.1">AXIS A1001 Network Door Controller 1.65.1.1 (2018) ready.</example>
+    <param pos="0" name="hw.vendor" value="Axis"/>
+    <param pos="0" name="hw.device" value="Building Automation"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="2" name="hw.version"/>
   </fingerprint>
   <fingerprint pattern="^AXIS (\S+) .*FTP Network Print Server V?([\d\.]+\S+) .* ready\.?$" flags="REG_ICASE">
     <description>Axis print servers</description>
     <example hw.product="5600+">AXIS 5600+ (rev 3) FTP Network Print Server V7.00 Sep 10 2004 ready.</example>
-    <example os.product="560">AXIS 560 FTP Network Print Server V6.00 Jul 7 1999 ready.</example>
-    <example os.version="6.30.beta2">AXIS 5470e FTP Network Print Server V6.30.beta2 Sep 25 2002 ready.</example>
+    <example hw.product="560">AXIS 560 FTP Network Print Server V6.00 Jul 7 1999 ready.</example>
+    <example hw.version="6.30.beta2">AXIS 5470e FTP Network Print Server V6.30.beta2 Sep 25 2002 ready.</example>
     <param pos="0" name="hw.vendor" value="Axis"/>
     <param pos="0" name="hw.device" value="Print server"/>
     <param pos="1" name="hw.product"/>
-    <param pos="0" name="os.vendor" value="Axis"/>
-    <param pos="0" name="os.device" value="Print server"/>
-    <param pos="1" name="os.product"/>
-    <param pos="2" name="os.version"/>
+    <param pos="2" name="hw.version"/>
   </fingerprint>
   <fingerprint pattern="^RICOH Aficio ((?:[MS]P )?\S+) FTP server \(([0-9\.a-zA-Z]+)\) ready.?$" flags="REG_ICASE">
     <description>Ricoh Aficio multifunction device</description>
@@ -1189,10 +1232,11 @@ more text</example>
     <param pos="0" name="service.cpe23" value="cpe:/a:bftpd_project:bftpd:{service.version}"/>
     <param pos="2" name="host.ip"/>
   </fingerprint>
-  <fingerprint pattern="^NASFTPD Turbo station (?:2.x )?([\w.]+) Server \(ProFTPD\) \[([[a-f\d].:]+)\]$">
+  <fingerprint pattern="^NASFTPD Turbo station (?:2.x )?([\w.]+) Server \(ProFTPD\)(?: \[([[a-f\d].:]+)\])?$">
     <description>ProFTPD on QNAP Turbo Station NAS</description>
     <example service.version="1.3.5a" host.ip="192.168.1.100">NASFTPD Turbo station 1.3.5a Server (ProFTPD) [192.168.1.100]</example>
     <example service.version="1.3.1rc2" host.ip="192.168.1.100">NASFTPD Turbo station 2.x 1.3.1rc2 Server (ProFTPD) [192.168.1.100]</example>
+    <example service.version="1.3.5a">NASFTPD Turbo station 1.3.5a Server (ProFTPD)</example>
     <param pos="0" name="service.family" value="ProFTPD"/>
     <param pos="0" name="service.vendor" value="ProFTPD Project"/>
     <param pos="0" name="service.product" value="ProFTPD"/>
@@ -1323,11 +1367,14 @@ more text</example>
     <param pos="1" name="host.name"/>
     <param pos="2" name="service.version"/>
   </fingerprint>
-  <fingerprint pattern="^FTP (?:server|service)?(?: is)? ready\.?$" flags="REG_ICASE">
+  <fingerprint pattern="(?i)^(?:FTP[\- ])?(?:server|service)?(?:(?: is)? ready)?\.?$">
     <description>Generic FTP fingerprint without a hostname</description>
     <example>FTP server is ready.</example>
     <example>FTP Server ready.</example>
     <example>FTP Server Ready</example>
+    <example>Server Ready</example>
+    <example>FTP-Server</example>
+    <example>FTP Server</example>
     <example>FTP service ready.</example>
   </fingerprint>
   <fingerprint pattern="^Welcom to ProRat Ftp Server$">

data/xml/http_servers.xml

@@ -738,13 +738,13 @@
     <example>ReeCam IP Camera</example>
     <param pos="0" name="hw.vendor" value="Shenzhen Reecam Tech. Ltd."/>
     <param pos="0" name="hw.product" value="ReeCam"/>
-    <param pos="0" name="hw.device" value="Camera"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
   </fingerprint>
   <fingerprint pattern="^Netwave IP Camera$">
     <description>Netwave cameras</description>
     <example>Netwave IP Camera</example>
     <param pos="0" name="hw.vendor" value="Netwave"/>
-    <param pos="0" name="hw.device" value="Camera"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
   </fingerprint>
   <fingerprint pattern="^Cougar/([0-9.]*)$">
     <description>Windows Media Services (older versions)</description>
@@ -783,7 +783,7 @@
     <example>camera</example>
     <example>IPCamera Login</example>
     <example>Mini Dome IP Camera</example>
-    <param pos="0" name="hw.device" value="Camera"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
   </fingerprint>
   <fingerprint pattern="^ASP.NET$">
     <description>Something written in ASP.NET</description>

data/xml/http_wwwauth.xml

@@ -131,14 +131,14 @@
     <example>Basic realm=&quot;camera&quot;</example>
     <example>Basic realm=&quot;IPCamera Login&quot;</example>
     <example>Basic realm=&quot;Mini Dome IP Camera&quot;</example>
-    <param pos="0" name="hw.device" value="Camera"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
   </fingerprint>
   <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(DCS-[^&quot;]+)&quot;.*$">
     <description>D-Link DCS IP Cameras</description>
     <example hw.product="DCS-5222LB1">Basic realm=&quot;DCS-5222LB1&quot;</example>
     <example hw.product="DCS-2530L">Basic realm=&quot;DCS-2530L&quot;</example>
     <param pos="0" name="hw.vendor" value="D-Link"/>
-    <param pos="0" name="hw.device" value="Camera"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
     <param pos="1" name="hw.product"/>
   </fingerprint>
   <fingerprint pattern="^(?:Basic|Digest) realm=&quot;GoAhead&quot;.*$">
@@ -288,7 +288,7 @@
     <description>TP-LINK IP-Cameras</description>
     <example>Basic realm=&quot;TP-LINK IP-Camera&quot;</example>
     <param pos="0" name="hw.vendor" value="TP-Link"/>
-    <param pos="0" name="hw.device" value="Camera"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
   </fingerprint>
   <fingerprint pattern="(?i)^(?:Basic|Digest) .*realm=&quot;Broadcom Management Service&quot;.*$">
     <description>Supposedly part of Broadcom Advanced Control Suite 3 (BACS3) or something similar</description>

data/xml/mysql_banners.xml

@@ -1204,10 +1204,10 @@
     <param pos="0" name="os.vendor" value="Debian"/>
     <param pos="0" name="os.family" value="Linux"/>
     <param pos="0" name="os.product" value="Linux"/>
-    <param pos="0" name="os.device" value="Storage"/>
+    <param pos="0" name="os.device" value="NAS"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
     <param pos="0" name="hw.vendor" value="Netgear"/>
-    <param pos="0" name="hw.device" value="Storage"/>
+    <param pos="0" name="hw.device" value="NAS"/>
     <param pos="0" name="hw.family" value="ReadyNAS"/>
     <param pos="0" name="hw.product" value="ReadyNAS"/>
   </fingerprint>

data/xml/sip_user_agents.xml

@@ -3,6 +3,24 @@
   <!--
   SIP User Agent header values are matched against these patterns to fingerprint SIP devices.
   -->
+  <!-- Axis devices -->
+  <fingerprint pattern="(?i)^AXIS (\S+) Network Video Door Station$">
+    <description>Axis Network Video Door stations, which have voice</description>
+    <example hw.product="A8105-E">AXIS A8105-E Network Video Door Station</example>
+    <param pos="0" name="hw.vendor" value="Axis"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
+    <param pos="0" name="hw.family" value="Network Video Door Station"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
+  <fingerprint pattern="(?i)^AXIS (\S+) Network (?:Audio Bridge|(?:Cabinet|Horn) Speaker)$">
+    <description>Axis Network audio devices</description>
+      <example hw.product="C3003-E">AXIS C3003-E Network Horn Speaker</example>
+      <example hw.product="C8033">AXIS C8033 Network Audio Bridge</example>
+      <example hw.product="C1004-E">AXIS C1004-E Network Cabinet Speaker</example>
+    <param pos="0" name="hw.vendor" value="Axis"/>
+    <param pos="0" name="hw.family" value="Network Audio"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
   <!-- Cisco Devices -->
   <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.x]+)$">
     <description>Cisco SIPGateway</description>

data/xml/snmp_sysdescr.xml

@@ -1185,7 +1185,7 @@
     <description>Canon Camera</description>
     <example>Canon Network Camera VB-C60</example>
     <param pos="0" name="os.vendor" value="Canon"/>
-    <param pos="0" name="os.device" value="Camera"/>
+    <param pos="0" name="os.device" value="Web cam"/>
     <param pos="1" name="os.product"/>
   </fingerprint>
   <fingerprint pattern="^Canon Network .* Board-(\S+)$">

data/xml/telnet_banners.xml

@@ -446,7 +446,7 @@
     </example>
     <param pos="0" name="hw.vendor" value="Grandstream"/>
     <param pos="0" name="hw.family" value="GXV"/>
-    <param pos="0" name="hw.device" value="Camera"/>
+    <param pos="0" name="hw.device" value="Web cam"/>
     <param pos="1" name="hw.product"/>
   </fingerprint>
   <fingerprint pattern="^(?:\r|\n)*Welcome to Polycom RMX\s*(\w+) \(COP\) Console Utility(?:\r|\n)+Copyright \(C\) \d\d\d\d-\d\d\d\d POLYCOM(?:\r|\n)+Password:\s*$">

data/xml/upnp_banners.xml

@@ -413,6 +413,10 @@
     <param pos="0" name="os.product" value="Linux"/>
     <param pos="1" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:linux:linux_kernel:{os.version}"/>
+    <param pos="0" name="hw.vendor" value="Netgear"/>
+    <param pos="0" name="hw.device" value="NAS"/>
+    <param pos="0" name="hw.family" value="ReadyNAS"/>
+    <param pos="0" name="hw.product" value="ReadyNAS"/>
   </fingerprint>
   <fingerprint pattern="^Linux/(\S+), UPnP/\S+, Free UPnP Entertainment Service/$">
     <description>Free UPnP Entertainment Service UPnP Server</description>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: recog
 version: !ruby/object:Gem::Version
-  version: 2.1.38
+  version: 2.1.39
 platform: ruby
 authors:
 - Rapid7 Research
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-12-21 00:00:00.000000000 Z
+date: 2018-12-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec