Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix examples in architecture.xml, ftp_banners.xml, and ssh_banners.xml #406

Merged
merged 4 commits into from
Feb 1, 2022
Merged

Fix examples in architecture.xml, ftp_banners.xml, and ssh_banners.xml #406

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dff0ab4
Fix examples in architecture.xml and ftp_banners.xml
dabdine Feb 1, 2022
537c001
Add example for Netscreen SSH
dabdine Feb 1, 2022
cb82f49
Simplify regular expression for Encoder/Encoder Blade
dabdine Feb 1, 2022
375f641
Remediate all remaining SSH banners
dabdine Feb 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion xml/architecture.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,28 +16,42 @@
<param pos="0" name="os.arch" value="x86"/>
</fingerprint>

<fingerprint pattern="PowerPC|PPC|POWER|ppc">
<fingerprint pattern="PowerPC|PPC|POWER" flags="REG_ICASE">
<description>PowerPC</description>
<example>PowerPC</example>
<example>PPC</example>
<example>POWER</example>
<example>ppc</example>
<param pos="0" name="os.arch" value="PowerPC"/>
</fingerprint>

<fingerprint pattern="SPARC" flags="REG_ICASE">
<description>SPARC</description>
<example>SPARC</example>
<example>sparc</example>
<param pos="0" name="os.arch" value="Sparc"/>
</fingerprint>

<fingerprint pattern="mips" flags="REG_ICASE">
<description>MIPS</description>
<example>MIPS</example>
<example>mips</example>
<param pos="0" name="os.arch" value="MIPS"/>
</fingerprint>

<fingerprint pattern="arm64|aarch64" flags="REG_ICASE">
<description>ARM64 (aarch64)</description>
<example>arm64</example>
<example>ARM64</example>
<example>aarch64</example>
<example>AARCH64</example>
<param pos="0" name="os.arch" value="ARM64"/>
</fingerprint>

<fingerprint pattern="arm" flags="REG_ICASE">
<description>ARM</description>
<example>arm</example>
<example>ARM</example>
<param pos="0" name="os.arch" value="ARM"/>
</fingerprint>

Expand Down
22 changes: 6 additions & 16 deletions xml/ftp_banners.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>

<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(W.+)\) \[(.+)\]$">
<description>ProFTPD on a Linksys Wireless Access Point/Router</description>
<example service.version="1.3.0rc2" os.product="WRT350N" host.name="host">ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
<example service.version="1.3.0rc2" os.product="WRT350N" hw.product="WRT350N" host.name="host">ProFTPD 1.3.0rc2 Server (LinksysWRT350N) [host]</example>
<param pos="0" name="service.family" value="ProFTPD"/>
<param pos="0" name="service.vendor" value="ProFTPD Project"/>
<param pos="0" name="service.product" value="ProFTPD"/>
Expand All @@ -211,6 +211,8 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
<param pos="0" name="os.vendor" value="Linksys"/>
<param pos="0" name="os.device" value="WAP"/>
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is os.device a thing? I thought this was hw.device, but I see os.device everywhere.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is a thing but it is used incorrectly more often than not. Also, in almost every case it should be paired with hw.device

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

any suggestions on what to do with this? You marked a few hw.device etc. in #400 that need to be corrected. We probably just need to audit the file specifically for all of those.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd add hw.device to this FP but honestly we need to perform an audit and fix them so either way is fine.

<param pos="2" name="os.product"/>
<param pos="0" name="hw.vendor" value="Linksys"/>
<param pos="2" name="hw.product"/>
<param pos="3" name="host.name"/>
</fingerprint>

Expand Down Expand Up @@ -241,19 +243,6 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
<param pos="1" name="host.name"/>
</fingerprint>

<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \(Linksys(.*)\) \[(.+)\]$">
Copy link
Contributor Author

@dabdine dabdine Feb 1, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like a duplicate of what's above. All the examples I've found start with W (WRTxxx). Also, it fails if I keep it since the example in this one was matching the earlier fingerprint and causing bundle exec rake tests to fail.

Copy link
Contributor

@tsellers-r7 tsellers-r7 Feb 1, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex in both of the fingerprints remains unchanged since the initial commit 8 years ago. As you mentioned the only real difference is the W in the regex.

I've checked some of our datasets (all ports, going back years) and I do NOT see any matches for this fingerprint in them.
I DO see matches for the W variant.

++ to seeing this FP removed.

<description>ProFTPD on a wired Linksys device</description>
<param pos="0" name="service.family" value="ProFTPD"/>
<param pos="0" name="service.vendor" value="ProFTPD Project"/>
<param pos="0" name="service.product" value="ProFTPD"/>
<param pos="1" name="service.version"/>
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
<param pos="0" name="os.vendor" value="Linksys"/>
<param pos="0" name="os.device" value="Router"/>
<param pos="2" name="os.product"/>
<param pos="3" name="host.name"/>
</fingerprint>

<fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[(.+)\]$">
<description>ProFTPD with version info but no obvious OS info</description>
<example service.version="1.2.10" proftpd.server.name="Main FTP Server" host.name="host">ProFTPD 1.2.10 Server (Main FTP Server) [host]</example>
Expand Down Expand Up @@ -611,6 +600,7 @@ more text</example>

<fingerprint pattern="^---freeFTPd 1.0---warFTPd 1.65---$">
<description>Nepenthes honeypot</description>
<example>---freeFTPd 1.0---warFTPd 1.65---</example>
<param pos="0" name="service.family" value="Nepenthes"/>
<param pos="0" name="service.product" value="Nepenthes"/>
</fingerprint>
Expand Down Expand Up @@ -693,9 +683,9 @@ more text</example>
<param pos="0" name="os.device" value="IP Camera"/>
</fingerprint>

<fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?Video) (?:Encoder|Encoder Blade|Module|Server|Decoder) (\S+)">
<fingerprint pattern="(?i)^AXIS (\S+) (?:(?:Mk II )?Video) (?:Encoder(?: Blade)?|Module|Server|Decoder) (\S+)">
<description>Axis Video encoders/servers</description>
<example hw.product="Q7406" hw.version="Blade">AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
<example hw.product="Q7406" hw.version="5.01">AXIS Q7406 Video Encoder Blade 5.01 (Aug 01 2008) ready.</example>
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @tsellers-r7
#400 (comment)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, unexpected capture due to optional string ordering. That's an interesting catch, thanks!

<example hw.product="241Q" hw.version="4.47.2">AXIS 241Q Video Server 4.47.2 (Dec 11 2008) ready.</example>
<example hw.version="5.07.2" hw.product="P7701">AXIS P7701 Video Decoder 5.07.2 (Apr 20 2010) ready.</example>
<example hw.product="Q7401" hw.version="5.01">AXIS Q7401 Video Encoder 5.01 (Aug 01 2008) ready.</example>
Expand Down
4 changes: 4 additions & 0 deletions xml/ssh_banners.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1732,6 +1732,7 @@

<fingerprint pattern="^SSH Protocol Compatible Server SCS (.*)$">
<description>Netscreen with version</description>
<example service.version="2.0">SSH Protocol Compatible Server SCS 2.0</example>
<param pos="1" name="service.version"/>
<param pos="0" name="service.vendor" value="Juniper"/>
<param pos="0" name="service.family" value="NetScreen"/>
Expand Down Expand Up @@ -1859,6 +1860,7 @@

<fingerprint pattern="^([\d.]{1,8}) sshlib: MOVEit DMZ SSH (.*)$">
<description>MOVEit DMZ (which uses Bitvise sshlib)</description>
<example service.component.version="1.29" service.version="3.0.5.0">1.29 sshlib: MOVEit DMZ SSH 3.0.5.0</example>
<param pos="1" name="service.component.version"/>
<param pos="2" name="service.version"/>
<param pos="0" name="service.component.vendor" value="Bitvise"/>
Expand Down Expand Up @@ -1886,6 +1888,7 @@

<fingerprint pattern="^Pragma SecureShell\s*(.*)$">
<description>Pragma SecureShell</description>
<example service.version="3.0">Pragma SecureShell 3.0</example>
<param pos="1" name="service.version"/>
<param pos="0" name="service.vendor" value="Pragma Systems"/>
<param pos="0" name="service.family" value="FortressSSH Server"/>
Expand Down Expand Up @@ -2047,6 +2050,7 @@

<fingerprint pattern="MultiNet">
<description>Process Software MultiNet is a suite of network apps for OpenVMS</description>
<example>Process Software SSH 6.1.5.0 MultiNet</example>
<param pos="0" name="service.vendor" value="Process Software"/>
<param pos="0" name="service.family" value="MultiNet"/>
<param pos="0" name="service.product" value="MultiNet"/>
Expand Down