Skip to content

Commit 94c2576

Browse files
tsellers-r7tsellers-r7
authored
fingerprints, regex tweaks (#359)
1 parent c79463e commit 94c2576

5 files changed

+54
-3
lines changed

‎cpe-remap.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ mappings:
4343
apic: application_policy_infrastructure_controller
4444
pix: pix_firewall_software
4545
telepresence: telepresence_video_communication_server_software
46+
cpanel:
47+
products:
48+
cpanel_service_daemon: cpanel
4649
crushftp:
4750
products:
4851
crushftp_web_interface: crushftp

‎xml/dns_versionbind.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -427,7 +427,7 @@
427427
<param pos="0" name="service.cpe23" value="cpe:/a:powerdns:authoritative_server:{service.version}"/>
428428
</fingerprint>
429429

430-
<fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?[^ ]*) \(built [\w\s:]+ by [\w]+\@[\w.-:-]*\)$">
430+
<fingerprint pattern="^PowerDNS Authoritative Server (\d\.[\w.]+(?:-rc\d)?(?:-alpha\d)?(?:-beta\d)?[^ ]*) \(built [\w\s:]+ by [\w]+\@[\w.:-]*\)$">
431431
<description>PowerDNS Authoritative Server: format 2</description>
432432
<example service.version="4.0.4">PowerDNS Authoritative Server 4.0.4 (built Jul 26 2017 15:04:27 by root@FreeBSD:11:amd64-default-job-03)</example>
433433
<example service.version="4.0.0-rc2">PowerDNS Authoritative Server 4.0.0-rc2 (built Jul 4 2016 15:44:39 by root@foo-bar.baz)</example>

‎xml/html_title.xml

+28-1
Original file line numberDiff line numberDiff line change
@@ -136,16 +136,43 @@
136136
<param pos="0" name="service.cpe23" value="cpe:/a:apache:tomcat:-"/>
137137
</fingerprint>
138138

139-
<fingerprint pattern="^Apache Tomcat/(\S+)$">
139+
<fingerprint pattern="^Apache Tomcat/(\S+)(?: - Error report)?$">
140140
<description>Apache tomcat with minimal version information</description>
141141
<example service.version="8.0.32">Apache Tomcat/8.0.32</example>
142+
<example service.version="5.5.29">Apache Tomcat/5.5.29 - Error report</example>
142143
<param pos="0" name="service.vendor" value="Apache"/>
143144
<param pos="0" name="service.product" value="Tomcat"/>
144145
<param pos="0" name="service.family" value="Tomcat"/>
145146
<param pos="1" name="service.version"/>
146147
<param pos="0" name="service.cpe23" value="cpe:/a:apache:tomcat:{service.version}"/>
147148
</fingerprint>
148149

150+
<fingerprint pattern="^Apache Tomcat/(\S+) \(Ubuntu\) - Error report$">
151+
<description>Apache Tomcat - Error report on Ubuntu</description>
152+
<example service.version="8.0.32">Apache Tomcat/8.0.32 (Ubuntu) - Error report</example>
153+
<param pos="0" name="service.vendor" value="Apache"/>
154+
<param pos="0" name="service.product" value="Tomcat"/>
155+
<param pos="0" name="service.family" value="Tomcat"/>
156+
<param pos="1" name="service.version"/>
157+
<param pos="0" name="service.cpe23" value="cpe:/a:apache:tomcat:{service.version}"/>
158+
<param pos="0" name="os.vendor" value="Ubuntu"/>
159+
<param pos="0" name="os.product" value="Linux"/>
160+
<param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
161+
</fingerprint>
162+
163+
<fingerprint pattern="^Apache Tomcat/(\S+) \(Debian\) - Error report$">
164+
<description>Apache Tomcat - Error report on Debian</description>
165+
<example service.version="7.0.56">Apache Tomcat/7.0.56 (Debian) - Error report</example>
166+
<param pos="0" name="service.vendor" value="Apache"/>
167+
<param pos="0" name="service.product" value="Tomcat"/>
168+
<param pos="0" name="service.family" value="Tomcat"/>
169+
<param pos="1" name="service.version"/>
170+
<param pos="0" name="service.cpe23" value="cpe:/a:apache:tomcat:{service.version}"/>
171+
<param pos="0" name="os.vendor" value="Debian"/>
172+
<param pos="0" name="os.product" value="Linux"/>
173+
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
174+
</fingerprint>
175+
149176
<fingerprint pattern="^AiCloud">
150177
<description>ASUS AiCloud</description>
151178
<example>AiCloud</example>

‎xml/http_servers.xml

+21
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,15 @@
9797
<param pos="0" name="service.vendor" value="cPanel"/>
9898
<param pos="0" name="service.product" value="cPanel Service Daemon"/>
9999
<param pos="1" name="service.version"/>
100+
<param pos="0" name="service.cpe23" value="cpe:/a:cpanel:cpanel:{service.version}"/>
101+
</fingerprint>
102+
103+
<fingerprint pattern="^sw-cp-server$">
104+
<description>Plesk Control Panel Server</description>
105+
<example>sw-cp-server</example>
106+
<param pos="0" name="service.vendor" value="Parallels"/>
107+
<param pos="0" name="service.product" value="Plesk"/>
108+
<param pos="0" name="service.cpe23" value="cpe:/a:parallels:parallels_plesk_panel:-"/>
100109
</fingerprint>
101110

102111
<!-- CentOS Web Panel is not part of the CentOS project and runs on CentOS,
@@ -2712,6 +2721,18 @@
27122721
<param pos="0" name="service.cpe23" value="cpe:/a:twistedmatrix:twistedweb:{service.version}"/>
27132722
</fingerprint>
27142723

2724+
<fingerprint pattern="^Twisted/([\d.]+) TwistedWeb/([\d.]+)$">
2725+
<description>Twisted Matrix Labs - TwistedWeb - verbose variant</description>
2726+
<example service.version="13.0.0">Twisted/13.0.0 TwistedWeb/9.0.0</example>
2727+
<example service.version.version="9.0.0">Twisted/17.9.0 TwistedWeb/9.0.0</example>
2728+
<param pos="0" name="service.vendor" value="TwistedMatrix"/>
2729+
<param pos="0" name="service.product" value="Twisted Web"/>
2730+
<param pos="0" name="service.family" value="Twisted Web"/>
2731+
<param pos="1" name="service.version"/>
2732+
<param pos="2" name="service.version.version"/>
2733+
<param pos="0" name="service.cpe23" value="cpe:/a:twistedmatrix:twistedweb:{service.version}"/>
2734+
</fingerprint>
2735+
27152736
<fingerprint pattern="^mini_httpd/((?:\d+\.)*\d+) \S*$">
27162737
<description>ACME mini_httpd with version and date</description>
27172738
<example>mini_httpd/1.14 23jun2000</example>

‎xml/telnet_banners.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1018,7 +1018,7 @@
10181018
<param pos="5" name="os.version.version"/>
10191019
</fingerprint>
10201020

1021-
<fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:-_\&amp;]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
1021+
<fingerprint pattern="^Model name\s+: (MiiNePort [\w-]+)(?:\r|\n|\x00)+Serial No.\s+: (\d+)(?:\r|\n|\x00)+Device name\s+: [\w:\&amp;-]+(?:\r|\n|\x00)+Firmware version\s+: ([\d.]+) Build (\d+)(?:\r|\n|\x00)+Ethernet MAC address: ([\w:]+)(?:\r|\n|\x00)+">
10221022
<description>Moxa MiiNePort Series Embedded device server</description>
10231023
<!-- Model name : MiiNePort E2\r\nSerial No. : 9999\r\nDevice name : MiiNePort_E2_4064\r\nFirmware version : 1.3.36 Build 15031615\r\nEthernet MAC address: 00:90:E8:5A:92:FF\r\n\r\nPlease keyin your password: -->
10241024

0 commit comments

Comments
 (0)