From 4033fb9e51bad106ddf82a2f43ef41bcdc2c5d1b Mon Sep 17 00:00:00 2001 From: dmiller Date: Tue, 28 Feb 2017 15:54:17 +0000 Subject: [PATCH] Softmatch for sip to extract User-Agent header. See #645 --- nmap-service-probes | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nmap-service-probes b/nmap-service-probes index cd5970fb5..349a7fe45 100644 --- a/nmap-service-probes +++ b/nmap-service-probes @@ -13774,6 +13774,7 @@ match zabbix m|^OK$| p/Zabbix Monitoring System/ cpe:/a:zabbix:zabbix/ match zeiss-axio m|^SIP/2\.0\rID: 50000\rTIONS\r| p/Zeiss Axio Imager microsocope/ softmatch sip m|^SIP/2\.0 ([-\w\s.]+)\r\n.*Server: ([-\w\s/_\.\(\)]+)\r\n|s p/$2/ i/Status: $1/ +softmatch sip m|^SIP/2\.0 ([-\w\s.]+)\r.*\nUser-[Aa]gent: ([-\w\s/_\.\(\)]+)\r\n|s p/$2/ i/Status: $1/ softmatch sip m|^SIP/2\.0 ([-\w\s.]+)\r\n| i/SIP end point; Status: $1/ ##############################NEXT PROBE############################## @@ -13820,6 +13821,7 @@ match sip-proxy m|^SIP/2\.0 404 Not Found\r\n.*Server: Asterisk PBX\r\n.*Allow: match sip-proxy m|^SIP/2\.0 .*\r\nServer: CommuniGatePro/([\w._-]+)\r\n|s p/CommuniGatePro VoIP Gateway/ v/$1/ cpe:/a:stalker:communigate_pro:$1/ softmatch sip m|^SIP/2\.0 ([-\w\s.]+)\r\n.*Server: ([-\w\s/_\.\(\)]+)\r\n|s p/$2/ i/Status: $1/ +softmatch sip m|^SIP/2\.0 ([-\w\s.]+)\r.*\nUser-[Aa]gent: ([-\w\s/_\.\(\)]+)\r\n|s p/$2/ i/Status: $1/ softmatch sip m|^SIP/2\.0 ([-\w\s.]+)\r\n| i/SIP end point; Status: $1/ # Supposed to be multicast, but apparently something answers unicast?