v.2.1.22 - 2018.09.04

• New fingerprint coverage: apache_modules.xml #174

  • Adds support for performing version detection of Apache modules in HTTP Server headers.
  • Client software calling Recog is expected to split an Apache banner based on spaces and toss the individual values at Recog.
  • This is a first pass, more work will be required to fully flesh this out.

• Improved coverage: http_servers.xml #175

  • Leveraging Project Sonar data from 2018.08.13 has resulted in significant (multiple millions) improvement of fingerprinting against that data set.
  • hw.* values added where possible

• Minor FTP tweaks

v.2.1.22 - 2018.08.29

• New capability: CPE 2.3 data #172

  • Added preliminary support for returning CPE 2.3 information via a new fingerprint param named service.cpe23 which can be literal strings or interpolated values.

    Example:
    <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:1"/>
    or
    <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:{service.version}"/>

  • Software, other than Ruby Recog, that leverage the XML directly will need to support interpolating the values in order to fully utilize this capability.

  • Future changes to enhance this capability and make creating interpolated results easier are expected in the near future.

  • See PR #172 for more details

• Misc fingerprint updates and changes, some of which were to support CPE changes.

  • Changed the use of 'F5 Labs' to 'F5' in multiple files #171
  • Change certain Cisco PIX fingerprints from 'service.' to 'os.' #170

v.2.1.20 - 2018.06.27

• Compatibility: Adjustments to the regex of multiple fingerprints to remove negative lookaheads and other contructs that Golang doesn't support. #162

v.2.1.19 - 2018.04.16

• Improved coverage: xml/smtp_banners.xml #160
  • Note: Due to effort to cleanup description lines (remove duplicates, remove multilines, provide context, standardize format) almost every value for <description> has changed. This will impact the value returned as matched with tools such as DAP.
  • Project Sonar SMTP survey data was used to enhance and improve the coverage. Full details and metrics can be found in #160
  • Improved the accuracy and/or flexibility of multiple fingerprints.
  • Changed ALL instances of flags="REG_ICASE" to an inline flag (?i:) in order to make the regex compatible with more languages.
  • Implemented fingerprint examples for those fingerprints where examples could be found.
  • This sometimes resulted in removing fingerprints that were actually duplicates or trivially different.
  • Reworked description values so as to remove examples and ensure that this field is unique within the file as the value of description serves as an identifier when processing fingerprints. Multiline descriptions were reduced to single line where possible. Many descriptions were modified.
  • Fixed multiple instances where captures where under/over capturing. For example, some fingerprints would have captured the examples but the examples were missing leading or ending spaces. Other fingerprints were over-broad in what they would capture leading to fall positives or misidentification.
  • Fixed multiple instances where the portion of the version banner that was captured was different between two products in the same family.
  • Removed various real and example hostnames from examples and standardized on 'foo.bar'
  • Corrected system.time.format so as to match timestamp provided by service
  • Reworked date regex for multiple matches to remove inadvertent requirement for two digit day value when the banner included a single digit day.

v.2.1.18 - 2018.02.22

• Improved coverage: ssh_banners.xml #159

  • Leveraged Project Sonar SSH survey data from 2017.11.30 to improve coverage, examples, and extractions. Metrics related to the match frequencies, etc. can be found in the PR.
  • Improved the accuracy and/or flexibility of multiple fingerprints.
  • Added examples to every fingerprint that was missing one if data was available in the data set.
  • Changes the single use of flags="REG_ICASE"in an inline flag (?i:) in order to make the regex compatible with more languages.
  • Removed fingerprint for 'honeypot' given the lack of an example of where this has value

• Add 'MariaDB MariaDB on Debian 8.0 (jessie)' to xml/mysql_banners.xml #161

v.2.1.17 - 2017.11.28

• Improved coverage: smtp_banners.xml #158
  • Leveraged Project Sonar data to improve coverage and testing
  • Significantly improved coverage of Exim, particularly against Ubuntu
  • Improved coverage and accuracy for Lotus Domino, Argosoft, and Checkpoint Firewall
  • Additional fingerprint examples which caught errors and duplication in the fingerprints

v2.0.6

Adds fingerprints for Windows 10 and improves fingerprints for SSH and FTP services. Includes PRS #68, #69, and #70.

For details, see this compare:

v2.0.5...v2.0.6

v2.0.5

Miscellaneous improvements to SNMP, FTP, SSH and HTTP fingerprints. Includes the merge of PR #64.

v2.0.4

Added OS X 10.8/10.9 NTP fingerprints, additional SMTP, SSH, FTP, SNMP, and HTTP fingerprints. Includes merges of PRs #56, #57, #58, #59, #60, #61, and #62.

v2.0.2

Adds SNMP fingerprints for H3C Comware and VMware vSphere Management Assistant, an NTP fingerprint for HP-UX, and improves an Axis camera FTP fingerprint.