PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

More service fingerprints

Browse Source
This commit is contained in:
dmiller
2024-04-16 17:12:29 +00:00
parent 4201b294a8
commit bedb59247f
1 changed files with 129 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

180
nmap-service-probes
View File

@@ -1572,6 +1572,7 @@ match http-proxy m|^HTTP/1\.0 400 Bad Request\r\nContent-Type: text/html\r\nPrag
match http-proxy m|^HTTP/HTTP/0\.0 408 Timeout\r\nServer: tinyproxy/([\w._-]+)\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n| p/tinyproxy http proxy/ v/$1/ cpe:/a:banu:tinyproxy:$1/
match http-proxy m|^HTTP/1\.0 408 Timeout\r\nServer: tinyproxy/([\w._-]+)\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n| p/tinyproxy http proxy/ v/$1/ cpe:/a:banu:tinyproxy:$1/
match http-proxy m|^<HEAD><TITLE>Invalid HTTP Request</TITLE></HEAD>\n<BODY BGCOLOR=\"white\" FGCOLOR=\"black\"><H1>Invalid HTTP Request</H1><HR>\n<FONT FACE=\"Helvetica,Arial\"><B>\nDescription: Bad request syntax</B></FONT>\n<HR>\n<!-- default \"Invalid HTTP Request\" response \(400\) -->\n</BODY>\n {400}\0| p/unknown transparent proxy/
match http-proxy m|^HTTP/1\.1 400 Bad request\r\ncontent-length: 90\r\ncache-control: no-cache\r\ncontent-type: text/html\r\nconnection: close\r\n\r\n<html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request\.\n</body></html>\n| p/HAProxy http proxy/ cpe:/a:haproxy:haproxy/
match hp-gsg m|^220 JetDirect GGW server \(version (\d[\d.]+)\) ready\r\n| p/HP JetDirect Generic Scan Gateway/ v/$1/ d/printer/
match hp-gsg m|^220 HP GGW server \(version ([\w._-]+)\) ready\r\n\0| p/HP Generic Scan Gateway/ v/$1/ d/printer/
@@ -3490,6 +3491,7 @@ match smtp-proxy m|^220 smtp\.postman\.i2p ESMTP I2PNet Mailservice\r\n| p/I2P T
match smtp-proxy m|^220 XMail ESMTP service ready; [SMTWF][uoehra][neduit], \d\d [JFMASOND][aepueco][nbrylgptvc] \d\d\d\d \d\d:\d\d:\d\d ([-+]\d\d\d\d)\r\n| p/XMail smtpd/ i/IBM Lotus Protector; time zone: $1/ cpe:/a:davide_librenzi:xmail/ cpe:/a:ibm:lotus_protector_for_mail_security/
match smtp-proxy m|^421 concurrent connection limit in avast! exceeded\(pass:0, processes:([\w._-]+)\[\d+\]\)\r\n| p/Avast! anti-virus smtp proxy/ i/connection limit exceeded by $1/ o/Windows/ cpe:/a:avast:antivirus/ cpe:/o:microsoft:windows/
match smtp-proxy m|^421 Cannot connect to SMTP server ([\w._-]+) \([^)]*\), connect error \d+\r\n| p/Avast! anti-virus smtp proxy/ i/cannot connect to $1/ o/Windows/ cpe:/a:avast:antivirus/ cpe:/o:microsoft:windows/
match smtp-proxy m|^(?:452 syntax error \(connecting\)\r\n)+$| p/ISP SMTP block/
match fw1-topology m|^[QY]\0\0\0$| p/Check Point FireWall-1 Topology/ d/firewall/ cpe:/a:checkpoint:firewall-1/
match fw1-pslogon m|^\0\0\0\x02\0\0\0\x02$| p/Check Point FireWall-1 Policy Server logon/ d/firewall/ cpe:/a:checkpoint:firewall-1/
@@ -5300,6 +5302,21 @@ match http m|^HTTP/1\.1 400 Illegal character .*\r\nContent-Type: text/html;char
match http m|^HTTP/1\.1 [45]0[05] .*\r\nContent-Type: text/html;charset=iso-8859-1\r\nContent-Length: \d+\r\nConnection: close\r\n\r\n<h1>Bad Message [45]\d\d</h1><pre>reason:| p/Jetty/ cpe:/a:eclipse:jetty/
# Fallback (often 2nd probe varies because of port number)
match http m|^HTTP/1\.1 \d\d\d.*\r\nContent-Type: text/html(?:; charset=us-ascii)?\r\nServer: Microsoft-HTTPAPI/([\d.]+)\r\n| p/Microsoft HTTPAPI httpd/ v/$1/ i|SSDP/UPnP| o/Windows/ cpe:/o:microsoft:windows/a
# Fallback: RTSPRequest, SIPOptions, HELP, SSLSessionReq, etc.
match http m%^<head>\n<title>Error response</title>\n</head>\n<body>\n<h1>Error response</h1>\n<p>Error code 400\.\n<p>Message: Bad request (?:version|syntax) \('[^']*'\)\.\n<p>Error code explanation: 400 = Bad request syntax or unsupported method\.\n</body>\n% p/Python BaseHTTPServer http.server/ v/2 or 3.0 - 3.1/ cpe:/a:python:python/
# 3.1.4
match http m%^<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4\.01//EN"\n "http://www\.w3\.org/TR/html4/strict\.dtd">\n <head>\n <meta http-equiv="Content-Type" content="text/html;charset=utf-8">\n <title>Error response</title>\n </head>\n <body>\n <h1>Error response</h1>\n <p>Error code: 400</p>\n <p>Message: Bad request (?:version|syntax) \('[^']*'\)\.</p>\n <p>Error code explanation: 400 - Bad request syntax or unsupported method\.</p>\n </body>\n</html>\n% p/Python http.server/ v/3.2/ cpe:/a:python:python:3.2/
# 3.3.0
match http m%^<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4\.01//EN"\n "http://www\.w3\.org/TR/html4/strict\.dtd">\n<html>\n <head>\n <meta http-equiv="Content-Type" content="text/html;charset=utf-8">\n <title>Error response</title>\n </head>\n <body>\n <h1>Error response</h1>\n <p>Error code: 400</p>\n <p>Message: Bad request (?:version|syntax) \('[^']*'\)\.</p>\n <p>Error code explanation: 400 - Bad request syntax or unsupported method\.</p>\n </body>\n</html>\n% p/Python http.server/ v/3.3 - 3.4/ cpe:/a:python:python:3/
# 3.5.0
match http m%^<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4\.01//EN"\n "http://www\.w3\.org/TR/html4/strict\.dtd">\n<html>\n <head>\n <meta http-equiv="Content-Type" content="text/html;charset=utf-8">\n <title>Error response</title>\n </head>\n <body>\n <h1>Error response</h1>\n <p>Error code: 400</p>\n <p>Message: Bad request (?:version|syntax) \('[^']*'\)\.</p>\n <p>Error code explanation: HTTPStatus\.BAD_REQUEST - Bad request syntax or unsupported method\.</p>\n </body>\n</html>\n% p/Python http.server/ v/3.5 - 3.10/ cpe:/a:python:python:3/
# 3.11.0
match http m%^<!DOCTYPE HTML>\n<html lang="en">\n <head>\n <meta charset="utf-8">\n <title>Error response</title>\n </head>\n <body>\n <h1>Error response</h1>\n <p>Error code: 400</p>\n <p>Message: Bad request (?:version|syntax) \('[^']*'\)\.</p>\n <p>Error code explanation: HTTPStatus\.BAD_REQUEST - Bad request syntax or unsupported method\.</p>\n </body>\n</html>\n% p/Python http.server/ v/3.11 or later/ cpe:/a:python:python:3/
# More complete match including API version under FourOhFourRequest
softmatch http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain(?:; charset=utf-8)?\r\nConnection: close\r\n\r\n400 Bad Request| p|Golang net/http server| cpe:/a:golang:go/
# Specific vendor telnet options that should be matched more accurately by prompt, etc.
# Source: https://github.com/nmap/nmap/pull/1083
@@ -5803,8 +5820,6 @@ softmatch http m|^HTTP/1\.1 405 Method Not Allowed\r\nContent-Length: 0\r\nConne
# full match including appliance model number under GetRequest
softmatch http m|^UNKNOWN 400 Bad Request\r\nServer: Check Point SVN foundation\r\n| p/Check Point SVN foundation/
# More complete match including API version under FourOhFourRequest
softmatch http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\n400 Bad Request| p|Golang net/http server| cpe:/a:golang:go/
# version available with GetRequest
softmatch http m|^HTTP/1\.0 400 Bad Request\r\nContent-Length: 40\r\nContent-Type: text/plain; charset=UTF-8\r\nDate: .*\r\n\r\nMultiple leading empty lines not allowed| p/Calibre Content Server httpd/ cpe:/a:kovid_goyal:calibre/
@@ -7712,6 +7727,7 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nConnection: close\r\nContent-Type: text/htm
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Indy/([\d.]+)\r\nWWW-Authenticate: Basic realm=\"Please enter your login for PRTG(\d)\"\r\n|s p/Indy httpd/ v/$1/ i/Paessler PRTG SNMP $2 bandwidth monitor/ o/Windows/ cpe:/a:indy:httpd:$1/ cpe:/o:microsoft:windows/a
match http m|^HTTP/1\.1 301 Moved Permanently\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 56\r\nExpires: 0\r\nCache-Control: no-cache\r\nServer: Indy/([\w._-]+)\r\nLocation: /login\.htm\r\n\r\n<HTML><BODY><B>301 Moved Permanently</B></BODY></HTML>\r\n| p/Indy httpd/ v/$1/ i/Paessler PRTG bandwidth monitor/ o/Windows/ cpe:/a:indy:httpd:$1/ cpe:/o:microsoft:windows/a
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: PRTG/([\w._-]+)\r\n|s p/Indy httpd/ v/$1/ i/Paessler PRTG bandwidth monitor/ o/Windows/ cpe:/a:indy:httpd:$1/ cpe:/o:microsoft:windows/a
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: PRTG\r\n|s p/Indy httpd/ i/Paessler PRTG bandwidth monitor/ o/Windows/ cpe:/a:indy:httpd/ cpe:/o:microsoft:windows/a
match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: _httpd\r\nDate: .*\r\nWWW-Authenticate: Basic realm=\"\.\"\r\nContent-type: text/html\r\nConnection: close\r\n\r\n<HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD>\n<BODY BGCOLOR=\"#cc9999\"><H4>401 Unauthorized</H4>\nAuthorization required\.\n</BODY></HTML>\n| p/Kaspersky AntiVirus http admin/ v/4.X/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Indy/([\d.]+)\r\n.*\r\n<title>Server Monitor Lite</title>\r\n|s p/Indy httpd/ v/$1/ i/Pure Networking Server Monitor Lite http interface/ cpe:/a:indy:httpd:$1/
match http m|^HTTP/1\.0 .*\r\nConnection: close\r\nDate: .*\r\nServer: JavaOpServer\r\n| p/JavaOp httpd/
@@ -9803,8 +9819,13 @@ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/html;
match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nAccess-Control-Allow-Origin: \*\r\nCache-Control: no-cache\r\nContent-type: text/html; charset=utf-8\r\nDate: .*\r\n\r\n<html>\r\n<head><title>JointSpace</title>| p/jointSPACE TV application framework/ d/media device/
match http m|^HTTP/1\.1 200 OK\r.*\nlibAbsinthe: (r[\d.]+)\r\n|s p/Legify Absinthe/ v/$1/
match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Web Server\r\nContent-Type: text/html\r\n(?:[^\r\n]+\r\n)*?\r\n \r\n<!DOCTYPE HTML PUBLIC.*<TITLE>NETGEAR ([^<]+)</TITLE>|s p/Netgear $1 http config/ d/switch/ cpe:/h:netgear:$1/a
match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Length: 0\r\nWWW-Authenticate: Basic realm=\"Domoticz\.com\"\r\n\r\n|s p/Domoticz home automation httpd/
match http m|^HTTP/1\.1 200 OK\r\nLast-Modified: .*\r\nContent-Length: \d+\r\nContent-Type: text/html;charset=UTF-8\r\nAccess-Control-Allow-Origin: \*\r\n\r\n<!DOCTYPE html>\n<html manifest="html5\.appcache">\n<head>\n\t\t<meta charset="utf-8">\n\t\t<title>Domoticz</title>| p/Domoticz home automation httpd/
match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Length: 0\r\nWWW-Authenticate: Basic realm=\"Domoticz\.com\"\r\n\r\n|s p/Domoticz home automation httpd/ cpe:/a:domoticz:domoticz/
match http m|^HTTP/1\.1 200 OK\r\nLast-Modified: .*\r\nContent-Length: \d+\r\nContent-Type: text/html;charset=UTF-8\r\nAccess-Control-Allow-Origin: \*\r\n\r\n<!DOCTYPE html>\n<html(?: manifest="html5\.appcache2?")?>\n<head>\n\t\t<meta charset="utf-8">\n\t\t<title>Domoticz</title>| p/Domoticz home automation httpd/ v/2.2563 - 3.8153/ cpe:/a:domoticz:domoticz/
# X-Content-Type-Options added
match http m|^HTTP/1\.1 200 OK\r\nLast-Modified: .*\r\nContent-Length: \d+\r\nContent-Type: text/html;charset=UTF-8\r\nAccess-Control-Allow-Origin: \*\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\n\r\n<!DOCTYPE html>\n<html(?: manifest="html5\.appcache2?")?>\n<head>\n\t\t<meta charset="utf-8">\n\t\t<title>Domoticz</title>| p/Domoticz home automation httpd/ v/4.9700 - 2021.1/ cpe:/a:domoticz:domoticz/
# Content-Type and Content-Length switched
match http m|^HTTP/1\.1 200 OK\r\nLast-Modified: .*\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\nAccess-Control-Allow-Origin: \*\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\n\r\n<!DOCTYPE html>\n<html(?: manifest="html5\.appcache2?")?>\n<head>\n\t\t<meta charset="utf-8">\n\t\t<title>Domoticz</title>| p/Domoticz home automation httpd/ v/2022.1 or 2022.2/ cpe:/a:domoticz:domoticz/
match http m|^HTTP/1\.1 200 OK\r\nLast-Modified: .*\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\nAccess-Control-Allow-Origin: \*\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: frame-ancestors 'self'\r\n\r\n<!DOCTYPE html>\n<html(?: manifest="html5\.appcache2?")?>\n<head>\n\t\t<meta charset="utf-8">\n\t\t<title>Domoticz</title>| p/Domoticz home automation httpd/ v/2023.1 or later/ cpe:/a:domoticz:domoticz/
match http m|^HTTP/1\.0 302 Redirect\r\nSet-Cookie: mainServerInstance=; path=/\r\nSet-Cookie: CrushAuth=| p/CrushFTP web interface/ cpe:/a:crushftp:crushftp/
match http m|^HTTP/1\.1 401 Unauthorized\r\nSet-Cookie: mainServerInstance=; path=/\r\nSet-Cookie: CrushAuth=| p/CrushFTP web interface/ cpe:/a:crushftp:crushftp/
match http m|^HTTP/1\.1 200 OK\r\nServer: pyTivo/([\d.]+)\r\n| p/pyTivo http interface/ v/$1/ d/media device/
@@ -9822,12 +9843,19 @@ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: qHTTPs\r\n| p/AEG Powersol
match http m|^HTTP/1\.1 200 OK\r\nSet-Cookie: sid=[^;]+; path=/; httponly\r\nSet-Cookie: sid\.sig=[^;]+; path=/; httponly\r\nDate: .*\r\nConnection: close\r\n\r\n<!DOCTYPE HTML>.*<h1>Webhook Deployer v([\w._-]+)|s p/Node.js/ i/Webhook Deployer v$1/ cpe:/a:nodejs:node.js/
match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=ISO-8859-1\r\nContent-Length: \d+\r\nServer: SIMP LIGHT\r\n\r\n<head><title>SIMP Light web server \[ver\. ([\w._-]+)\]</title>| p/SIMP Light SCADA httpd/ v/$1/
match http m|^HTTP/1\.[01] 401 Unauthorized\r\nContent-Length: \d+\r\nContent-Type: text/html\r\n(?:Connection: close\r\n)?X-Plex-Protocol: 1\.0\r\n| p/Plex Media Server httpd/ cpe:/a:plex:plex_media_server/
match http m|^HTTP/1\.1 401 Unauthorized\r\nX-Plex-Protocol: 1\.0\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nConnection: close\r\nCache-Control: no-cache\r\nDate: .* GMT\r\n\r\n| p/Plex Media Server httpd/ cpe:/a:plex:plex_media_server/
match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"Linux\" platformVersion=\"(((?:2\.)?\d\.\d+)[^"]+)\" [^>]*version=\"([^"]+)| p/Plex Media Server httpd/ v/$4/ i/friendlyName: $1; OS version $2/ o/Linux $3/ cpe:/a:plex:plex_media_server:$4/ cpe:/o:linux:linux_kernel:$3/
match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"([^"]+)\" platformVersion=\"([^"]+)\" [^>]*version=\"([^"]+)| p/Plex Media Server httpd/ v/$4/ i/friendlyName: $1; OS version $3/ o/$2/ cpe:/a:plex:plex_media_server:$4/
# Sometimes the version is too far down the page :(
match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"Linux\" platformVersion=\"(((?:2\.)?\d\.\d+)[^"]+)\"| p/Plex Media Server httpd/ i/friendlyName: $1; OS version $2/ o/Linux $3/ cpe:/a:plex:plex_media_server/ cpe:/o:linux:linux_kernel:$3/
match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"([^"]+)\" platformVersion=\"([^"]+)\"| p/Plex Media Server httpd/ i/friendlyName: $1; OS version $3/ o/$2/ cpe:/a:plex:plex_media_server/
match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\"| p/Plex Media Server httpd/ i/friendlyName: $1/ cpe:/a:plex:plex_media_server/
match http m|^HTTP/1\.[01] 200 OK\r\nX-Plex-Protocol: 1\.0\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"Linux\" platformVersion=\"(((?:2\.)?\d\.\d+)[^"]+)\" [^>]*version=\"([^"]+)| p/Plex Media Server httpd/ v/$4/ i/friendlyName: $1; OS version $2/ o/Linux $3/ cpe:/a:plex:plex_media_server:$4/ cpe:/o:linux:linux_kernel:$3/
match http m|^HTTP/1\.[01] 200 OK\r\nX-Plex-Protocol: 1\.0\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"([^"]+)\" platformVersion=\"([^"]+)\" [^>]*version=\"([^"]+)| p/Plex Media Server httpd/ v/$4/ i/friendlyName: $1; OS version $3/ o/$2/ cpe:/a:plex:plex_media_server:$4/
# Sometimes the version is too far doX-Plex-Protocol: 1\.0\r\nwn the page :(
match http m|^HTTP/1\.[01] 200 OK\r\nX-Plex-Protocol: 1\.0\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"Linux\" platformVersion=\"(((?:2\.)?\d\.\d+)[^"]+)\"| p/Plex Media Server httpd/ i/friendlyName: $1; OS version $2/ o/Linux $3/ cpe:/a:plex:plex_media_server/ cpe:/o:linux:linux_kernel:$3/
match http m|^HTTP/1\.[01] 200 OK\r\nX-Plex-Protocol: 1\.0\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\" [^>]*platform=\"([^"]+)\" platformVersion=\"([^"]+)\"| p/Plex Media Server httpd/ i/friendlyName: $1; OS version $3/ o/$2/ cpe:/a:plex:plex_media_server/
match http m|^HTTP/1\.[01] 200 OK\r\nX-Plex-Protocol: 1\.0\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n<MediaContainer size=\"\d+\" [^>]*friendlyName=\"([^"]*)\"| p/Plex Media Server httpd/ i/friendlyName: $1/ cpe:/a:plex:plex_media_server/
match http m|^HTTP/1\.0 302 Moved Temporarily\r\nContent-Type: text/html\r\nSet-Cookie: cookie_session_id_0=\d+; path=/;\r\nCache-Control: public\r\nPragma: cache\r\nExpires: .*\r\nDate: .*\r\nLast-Modified: Thu, 01 Jan 1970 00:00:00 GMT\r\nAccept-Ranges: bytes\r\nConnection: close\r\nLocation: https?://[\w._-]+:\d+/index\.cgi\?active%5fpage=9091&req%5fmode=0\r\n\r\n| p/OpenRT httpd/ o/OpenRT/
match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"(iRMC S\d)@iRMC([0-9A-F]{6})\", qop=\"auth\", nonce=\"[0-9a-f-]+\", opaque=\"[0-9a-f]+\", stale=\"FALSE\" \r\n(?:Connection: close\r\n)?Cache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\n\r\n296\r\n| p/Fujitsu $1 httpd/ i/Host ID (MAC) $2/ d/remote management/
match http m|^HTTP/1\.1 400 Bad Request\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html; charset=utf-8\r\nProxy-Connection: close\r\nConnection: close\r\nContent-Length: 727\r\n\r\n<HTML><HEAD>\r\n<TITLE>Request Error</TITLE>\r\n</HEAD>\r\n<BODY>\r\n<FONT face=\"Helvetica\">\r\n<big><strong></strong></big><BR>| p/ISPConfig http control panel/
@@ -10093,8 +10121,13 @@ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Router\r\nConnection: close\
match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nContent-Type: text/html; charset=utf-8\r\n\r\n<!DOCTYPE html>\n<html ng-app=\"ts3soundboard-bot\" ng-controller=\"base\">| p/TS3 Soundboard-Plugin/ cpe:/a:michael_friese:ts3sb/
# ePO 5.0.0.2620 missing X-FRAME-OPTIONS
match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n(?:X-FRAME-OPTIONS: SAMEORIGIN\r\n)?Content-Disposition: \r\n\r\n<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<script src=\"js/AgentLog\.js\">| p/McAfee ePolicy Orchestrator Agent Activity Log httpd/ cpe:/a:mcafee:epolicy_orchestrator_agent/
match http m%^HTTP/1\.0 200 OK\r\nConnection: close\r\nETag: "[a-f\d-]+"\r\nLast-Modified: .* GMT\r\nDate: .* GMT\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n<\?xml version="1\.0" encoding="utf-8"\?>\n<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1\.1//EN" "http://www\.w3\.org/TR/xhtml11/DTD/xhtml11\.dtd">\n<html xmlns="http://www\.w3\.org/1999/xhtml">\n<head>\n<meta http-equiv="refresh" content="0; URL=/webpages/(?:login|index)\.html" />\n</head>\n</html>\n% p/OpenWrt uHTTPd/ i/TP-LINK router http config/ d/broadband router/ o/Linux/ cpe:/a:openwrt:uhttpd/ cpe:/o:linux:linux_kernel/a
# Fallback
match http m|^HTTP/1\.1 405 Method Not Allowed\r\nConnection: close\r\nContent-Type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n12\r\nMethod Not Allowed\r\n0\r\n\r\n| p/OpenWrt uHTTPd/ d/WAP/ o/Linux/ cpe:/a:openwrt:uhttpd/ cpe:/o:linux:linux_kernel/a
match http m|^HTTP/1\.0 400 Bad Request\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=20\r\nContent-Type: text/html\r\n\r\n<h1>Bad Request</h1>| p/OpenWrt uHTTPd/ d/WAP/ o/Linux/ cpe:/a:openwrt:uhttpd/ cpe:/o:linux:linux_kernel/a
match http m|^HTTP/1\.0 404 Not Found\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<h1>Not Found</h1>The requested URL /[^ ]* was not found on this server\.| p/OpenWrt uHTTPd/ d/WAP/ o/Linux/ cpe:/a:openwrt:uhttpd/ cpe:/o:linux:linux_kernel/a
match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nETag: "[\da-f]+-[\da-f]+-[\da-f]+"\r\nLast-Modified: .* GMT\r\nDate: .* GMT\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n| p/OpenWrt uHTTPd/ d/WAP/ o/Linux/ cpe:/a:openwrt:uhttpd/ cpe:/o:linux:linux_kernel/a
match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: \d+\r\nCache-Control: max-age=0, no-store, no-cache\r\nx-enc: Ext1, Basic\r\nServer: Samsung ([\w ]+) Series, sn=([\dA-Z]+)\r\n\r\n| p/Samsung SyncThru Web Service/ i/$1 series; SN: $2/ d/printer/ cpe:/a:samsung:syncthru_web_service/
match http m|^HTTP/1\.1 200 OK\r\nContent-type: text/html\r\nExpires: .*\r\nConnection: close\r\nPragma: no-cache\r\nCache-Control: no-store, no-cache, must-revalidate\r\nContent-Length: \d+\r\n\r\n<html>\n\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">\n<script>product=\"HOTBOX\"| p/Hot Hotbox router admin httpd/ d/broadband router/ cpe:/h:hot:hotbox/
match http m|^HTTP/1\.1 500 Internal Server Error\r\nContent-Type: text/plain\r\nContent-Length: 56\r\nDate: .*\r\nConnection: close\r\n\r\nTypeError: Object #<ServerResponse> has no method 'send'| p/Tizen Multiscreen SDK httpd/ d/media device/
@@ -10189,7 +10222,7 @@ match http m|^HTTP/1\.1 401 Not Authorized\r\nServer: WSTL CPE 1\.0\r\nDate: .*
match http m|^HTTP/1\.1 202 Accepted\r\nContent-Type: text/html;charset=UTF-8\r\nDate: .*\r\nConnection: close\r\nContent-Length: \d+\r\n\r\n<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1\.0 Strict//EN" "http://www\.w3\.org/TR/xhtml1/DTD/xhtml1-strict\.dtd">\n<html xmlns="http://www\.w3\.org/1999/xhtml" xml:lang="en" lang="en">\n<head>\n<!--\n\n DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER\.\n\n Copyright \(c\) [12]\d\d\d Oracle and/or its affiliates\.| p/Oracle Glassfish Application Server/ cpe:/a:oracle:glassfish_application_server/
match http m|^HTTP/1\.0 302 Found\r\nLocation: .*?/user/login\r\nSet-Cookie: lang=(..)-(..); Path=/[^;]*; Max-Age=2147483647\r\nSet-Cookie: i_like_gogits=[a-f\d]{16}; Path=/[^;]*; HttpOnly\r\n| p/Gogs git httpd/ i/lang: $1-$2/ cpe:/a:gogs:gogs::::$1/
match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html; charset=UTF-8\r\nSet-Cookie: lang=(..)-(..); Path=/[^;]*; Max-Age=2147483647\r\nSet-Cookie: i_like_gogits=[a-f\d]{16}; Path=/[^;]*; HttpOnly\r\n| p/Gogs git httpd/ i/lang: $1-$2/ cpe:/a:gogs:gogs::::$1/
match http m|^HTTP/1\.0 302 Found\r\nLocation: .*?/login\r\nSet-Cookie: grafana_sess=[a-f\d]{16}; Path=/; HttpOnly\r\n| p/Grafana/ cpe:/a:xn--torkel_degaard-1pb:grafana/
match http m|^HTTP/1\.0 302 Found\r\nLocation: .*?/login\r\nSet-Cookie: grafana_sess=[a-f\d]{16}; Path=/; HttpOnly\r\n| p/Grafana http/ cpe:/a:grafana:grafana/
match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<!---CAS:0003--><HTML><HEAD>\n<SCRIPT LANGUAGE=JAVASCRIPT><!--\nvar a=window\.open\("/menu\.htm", "Login", "width=505,height=250,screenX=200,screenY=300,resizable=1,scrollbars=0,dependent=1"\);\na\.focus\(\);\n//--></SCRIPT>\n</HEAD>\n\nPlease Login First\.\n\n</HTML>| p/D-Link DI-524 WAP http config/ d/WAP/ cpe:/h:dlink:di-524/a
match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: HTTPD\r\nDate: .* GMT\r\nWWW-Authenticate: Basic realm="USER LOGIN"\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD>\n<BODY BGCOLOR="#cc9999"><H4>401 Unauthorized</H4>\nAuthorization required\.\n</BODY></HTML>\n| p/LimitlessLED smart lightbulb bridge httpd/ d/specialized/
match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\n\r\n<HTML>\n<HEAD>\n<script type="text/javascript" src="/WebLanguage\.js"></script>\n<script>\nd=document;\nd\.write\("<title>"\+Login0104\+"</title>"\);\n</script>\n<link rel="icon" href="/dlink\.ico" type="image/x-icon" />| p/D-Link DES-1100 switch http config/ d/switch/ cpe:/h:dlink:des-1100/a
@@ -10584,7 +10617,7 @@ match http m|^HTTP/1\.1 505 HTTP Version Not Supported\r\nTransfer-Encoding: chu
match http m|^HTTP/1\.1 500 Internal Server Error\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n22\r\nHTTP/1\.0 clients are not supported\r\n0\r\n\r\n| p/MXChip IoT DevKit httpd/
match http m|^HTTP/1\.1 303 See Other\r\nLocation: https://block\.malwarebytes\.com\?lic=(\w+)&cat=\w*&lang=([a-z]{2})&prod=MBAM-C&ver=([\d.]+)&cpv=[\d.]+&upv=[\d.]+&tdr=\d*\r\nConnection: close\r\n\r\n| p/Malwarebytes Anti-Malware block page/ v/$3/ i/license: $1; language: $2/ cpe:/a:malwarebytes:malwarebytes:$3:::$2/
match http m|^HTTP/1\.0 \d\d\d .*\r\nserver: ttyd/([-\da-f.]+) \(libwebsockets/([\d.]+)\)\r\ncontent-type: text/html\r\ncontent-length: \d+\r\n\r\n| p/ttyd/ v/$1/ i/libwebsockets $2/ cpe:/a:lws-team:libwebsockets:$2/ cpe:/a:tsl0922:ttyd:$1/
match http m|^HTTP/1\.0 \d\d\d .*\r\nserver: ttyd/([-\da-f.]+) \(libwebsockets/([\w.-]+)\)\r\ncontent-type: text/html\r\ncontent-length: \d+\r\n\r\n| p/ttyd/ v/$1/ i/libwebsockets $2/ cpe:/a:lws-team:libwebsockets:$2/ cpe:/a:tsl0922:ttyd:$1/
match http m|^HTTP/1\.0 200 OK\r\nServer: lwIP/([\d.]+) \(http://savannah\.nongnu\.org/projects/lwip\)\r\n| p/lwIP/ v/$1/ cpe:/a:lwip_project:lwip:$1/
match http m|^HTTP/1\.1 [45]\d\d .*\r\nContent-Type: text/html;charset=iso-8859-1\r\nContent-Length: \d+\r\nConnection: close\r\n\r\n<h1>Bad Message [45]\d\d</h1><pre>reason:| p/Jetty/ cpe:/a:eclipse:jetty/
match http m|^HTTP/1\.0 404 Not Found\r\nServer: PBPS-SessionManager\r\nContent-Type: application/json\r\nContent-Length: 2\r\n\r\n\{\}| p/BeyondTrust Password Safe session manager JSON API/ cpe:/a:beyondtrust:password_safe/
@@ -10593,17 +10626,50 @@ match http m|^HTTP/1\.1 \d\d\d \r\n(?:Cache-Control: private\r\n)?Content-Type:
match http m|^HTTP/1\.0 302 Found\r\nContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'self'\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=15768000\r\nX-Download-Options: noopen\r\nX-XSS-Protection: 1; mode=block\r\nX-FRAME-OPTIONS: SAMEORIGIN\r\nlocation: /SecureConnectGateway/resx/\r\ncontent-length: 0\r\n\r\n| p/Dell SecureConnect Gateway/
match http m|^HTTP/1\.0 200 OK\r\nAccept-Ranges: bytes\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nDate: .* GMT\r\nEtag: "[0-9a-f-]*"\r\nLast-Modified: .* GMT\r\nServer: BlueXP Connector\r\n| p/NetApp BlueXP/ cpe:/a:netapp:bluexp/
match http m|^HTTP/1\.1 301 Moved Permanently\r\nLocation: /sapmc/sapmc\.html\?SID=([A-Z][\dA-Z][\dA-Z])&NR=(\d\d)&HOST=([\w.-]+)\r\nServer: SAP Host Agent\r\n| p/SAP Host Agent/ i/SID: $1; instance: $2/ h/$3/ cpe:/a:sap:host_agent/
match http m|^HTTP/1\.1 \d\d\d .*\r\ndate: .* GMT\r\nserver: uvicorn\r\ncontent-length: \d+\r\ncontent-type:| p/Uvicorn/ cpe:/a:encode:uvicorn/
match http m|^HTTP/1\.1 \d\d\d .*\r\ndate: .* GMT\r\nserver: uvicorn\r\ncontent-| p/Uvicorn/ cpe:/a:encode:uvicorn/
match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm="OpenSearch Security"\r\ncontent-type: text/plain; charset=UTF-8\r\ncontent-length: 12\r\n\r\nUnauthorized| p/Amazon OpenSearch REST API/ i/Basic auth/ cpe:/a:amazon:opensearch/
match http m|^HTTP/1\.0 405 Method Not Allowed\r\nAllow: POST\r\ncontent-type: application/json; charset=UTF-8\r\ncontent-length: \d+\r\n\r\n\{"error":"Incorrect HTTP method for uri \[[^]]*\] and method \[GET\], allowed: \[POST\]","status":405\}| p/Elasticsearch REST API/ cpe:/a:elasticsearch:elasticsearch/
match http m|^HTTP/1\.1 200 \r\n(?:Strict-Transport-Security: max-age=31536000;includeSubDomains\r\n)?(?:X-Frame-Options: SAMEORIGIN\r\n)?X-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nSet-Cookie: JSESSIONID=[\dA-F]{32}; Path=/; (?:Secure; )?HttpOnly\r\nContent-Type: text/html;charset=ISO-8859-1\r\nContent-Length: \d+\r\nDate: .* GMT\r\nConnection: close\r\nServer: (?:Commvault WebServer)?\r\n\r\n<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<meta http-equiv[^>]*>\r\n\r\n\r\n\r\n <title>Redirecting\.\.</title>\r\n<!-- this can be customized using "customDefaultApp" setting in Webconsole -->| p/Commvault/ cpe:/a:commvault:commvault/
match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html; charset=UTF-8\r\nDate: [^\r\n]* GMT\r\nContent-Length: \d+\r\n\r\n<html lang="en">\n <head>\n <meta charset="UTF-8">\n <meta name="viewport" content="width=device-width, initial-scale=1\.0">\n <title>([^<]+)</title>.*</h2>\n <div>Version: \(version=([\d.]+),|s p/Prometheus exporter $1/ v/$2/ cpe:/a:prometheus:$SUBST(1," ","_"):$2/
match http m|^HTTP/1\.0 200 OK\r\nDate: .* GMT\r\nContent-Length: \d+\r\nContent-Type: text/html; charset=utf-8\r\n\r\n<html>\n<head><title>(\w+)</title></head>\n<body>\n<h1>[^<]*</h1>\n<p><a href="/metrics">Metrics</a></p>\n<p><i>\(version=([\d.]+),| p/Prometheus exporter $1/ v/$2/ cpe:/a:prometheus:$1:$2/
match http m|^HTTP/1\.0 302 Found\r\nCache-Control: no-store\r\nContent-Type: text/html; charset=utf-8\r\nLocation: /login\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: deny\r\nX-Xss-Protection: 1; mode=block\r\nDate: .* GMT\r\nContent-Length: 29\r\n\r\n<a href="/login">Found</a>\.\n\n| p/Prometheus Grafana interface/ i/login required/ cpe:/a:prometheus:prometheus/
match http m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nContent-Type: text/html; charset=UTF-8\r\nExpires: -1\r\nPragma: no-cache\r\nX-Content-Type-Options: nosniff\r\nX-Xss-Protection: 1; mode=block\r\nDate: .* GMT\r\n\r\n<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/><meta name="viewport" content="width=device-width"/><meta name="theme-color" content="#000"/><title>Grafana</title>| p/Prometheus Grafana interface/ cpe:/a:prometheus:prometheus/
match http m|^HTTP/1\.1 200 \r\nCache-Control: private\r\nSet-Cookie: JSESSIONID=[\dA-F]{64}; Path=/; (?:Secure; )?HttpOnly\r\nContent-Security-Policy: .*;\r\nX-Content-Security-Policy: .*;\r\nX-Frame-Options: DENY\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\nDate: .* GMT\r\nConnection: close\r\nServer: Cloud Connector\r\n\r\n| p/SAP Cloud Connector/ cpe:/a:sap:cloud_connector/
match http m|^HTTP/1\.1 302 Found\r\nDate: .* GMT\r\n(?:Strict-Transport-Security: max-age=31536000; includeSubDomains\r\n)?X-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: no-referrer-when-downgrade\r\nContent-Security-Policy: default-src 'self' \*\.splunk\.com img-src 'self' 'unsafe-inline' 'unsafe-eval' data: https: style-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nLocation: https://localhost/ui\r\n| p/Splunk/
match http m%^HTTP/1\.0 302 Found\r\nCache-Control: no-(?:cache|store)\r\nContent-Type: text/html; charset=utf-8\r\n(?:Expires: -1\r\n)?Location: /login\r\n(?:Pragma: no-cache\r\nSet-Cookie: redirect_to=[^;]*; Path=/; HttpOnly; SameSite=Lax\r\n)?X-Content-Type-Options: nosniff\r\nX-Frame-Options: deny\r\nX-Xss-Protection: 1; mode=block\r\nDate: .* GMT\r\nContent-Length: 29\r\n\r\n<a href="/login">Found</a>\.\n\n% p/Grafana http/ cpe:/a:grafana:grafana/
match http m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nContent-Type: text/html; charset=UTF-8\r\nExpires: -1\r\nPragma: no-cache\r\nX-Content-Type-Options: nosniff\r\nX-Xss-Protection: 1; mode=block\r\nDate: .* GMT\r\n\r\n<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/><meta name="viewport" content="width=device-width"/><meta name="theme-color" content="#000"/><title>Grafana</title>| p/Prometheus Grafana interface/ cpe:/a:prometheus:prometheus/
match http m|^HTTP/1\.1 200 \r\nCache-Control: private\r\n(?:Expires: Thu, 01 Jan 1970 00:00:00 GMT\r\n)?Set-Cookie: JSESSIONID=[\dA-F]{64}; Path=/; (?:Secure; )?HttpOnly\r\nContent-Security-Policy: .*;\r\nX-Content-Security-Policy: .*;\r\nX-Frame-Options: DENY\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\nDate: .* GMT\r\nConnection: close\r\nServer: Cloud Connector\r\n\r\n| p/SAP Cloud Connector/ cpe:/a:sap:cloud_connector/
match http m|^HTTP/1\.1 302 Found\r\nDate: .* GMT\r\n(?:Strict-Transport-Security: max-age=31536000; includeSubDomains\r\n)?X-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: no-referrer-when-downgrade\r\nContent-Security-Policy: default-src 'self' \*\.splunk\.com img-src 'self' 'unsafe-inline' 'unsafe-eval' data: https: style-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nLocation: https://localhost/ui\r\n| p/Splunk/
match http m|^HTTP/1\.0 200 OK\r\nDate: .* GMT\r\nServer: [Ww]eb(?:s(?:erver)?)?\r\n(?:X-Frame-Options: SAMEORIGIN\r\n(?:X-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1;mode=block\r\n)?)?(?:ETag: "[^"]+"\r\n)?Content-Length: \d+\r\nContent-Type: text/html\r\nConnection: close\r\nLast-Modified: .* GMT\r\n\r\n\xef\xbb\xbf<!doctype html>\r\n<html>| p/HikVision NVR or camera http config/ d/webcam/
match http m%^HTTP/1\.0 40\d .*\r\nDate: .* GMT\r\nServer: [Ww]eb(?:s(?:erver)?)?\r\n(?:X-Frame-Options: SAMEORIGIN\r\n(?:X-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1;mode=block\r\n)?)?Cache-Control: no-(?:cache|store)?\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<!DOCTYPE html>\r\n<html>% p/HikVision NVR or camera http config/ d/webcam/
match http m|^HTTP/1\.0 200 OK\r\nVary: Accept-Encoding\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Type: text/html\r\nX-Content-Type-Options: nosniff\r\nDate: .* GMT\r\nETag: \d+\r\nContent-Length: \d+\r\nX-XSS-Protection: 1; mode=block\r\nLast-Modified: .* GMT\r\nConnection: close\r\nAccept-Ranges: bytes\r\n\r\n\xef\xbb\xbf<!doctype html>\r\n<html>\r\n<head>\r\n\t<title></title>| p/HikVision NVR or camera http config/ d/webcam/
match http m=^HTTP/1\.1 (?:301 Moved Permanently|403 Forbidden|400 Bad Request|503 Service Temporarily Unavailable)\r\nServer: awselb/2\.0\r\n= p/AWS Elastic Load Balancing/
match http m|^HTTP/1\.1 415 Unsupported Media Type\r\nDate: .* GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 1\r\nConnection: close\r\nServer: imunify360-webshield/([\d.]+)\r\n\r\n\n| p/Imunify360 WebShield/ v/$1/ cpe:/a:cloudlinux:imunify360:$1/
match http m|^HTTP/1\.1 [45]\d\d .*\r\n(?:[^\r\n]+\r\n)*\r\n<html>\r\n<head><title>[45]\d\d [^<]+</title></head>\r\n<body(?: bgcolor="white")?>\r\n<center><h1>[45]\d\d [^<]+</h1></center>\r\n<hr><center>openresty\/([\w.-]+)</center>\r\n</body>\r\n</html>\r\n| p/OpenResty web app server/ v/$1/ cpe:/a:openresty:ngx_openresty:$1/
match http m|^HTTP/1\.1 [45]\d\d .*\r\n(?:[^\r\n]+\r\n)*\r\n<html>\r\n<head><title>[45]\d\d [^<]+</title></head>\r\n<body(?: bgcolor="white")?>\r\n<center><h1>[45]\d\d [^<]+</h1></center>\r\n<hr><center>openresty</center>\r\n</body>\r\n</html>\r\n| p/OpenResty web app server/ cpe:/a:openresty:ngx_openresty/
match http m|^HTTP/1\.1 [45]\d\d .*\r\nDate: .* GMT\r\nContent-Type: text/html\r\nContent-Length: 1\d\d\r\nConnection: close\r\n\r\n<html>\r\n<head><title>[45]\d\d [^<]+</title></head>\r\n<body bgcolor="white">\r\n<center><h1>[45]\d\d [^<]+</h1></center>\r\n<hr><center>nginx/([\w._-]+)</center>\r\n</body>\r\n</html>\r\n| p/nginx/ v/$1/ cpe:/a:igor_sysoev:nginx:$1/
match http m|^HTTP/1\.1 [45]\d\d .*\r\nDate: .* GMT\r\nContent-Type: text/html\r\nContent-Length: 1\d\d\r\nConnection: close\r\n\r\n<html>\r\n<head><title>[45]\d\d [^<]+</title></head>\r\n<body bgcolor="white">\r\n<center><h1>[45]\d\d [^<]+</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n| p/nginx/ cpe:/a:igor_sysoev:nginx/
match http m|^HTTP/1\.0 200 OK\r\nServer: CloudStack Password Server 4\.x\r\nDate: .* GMT\r\nContent-type: text/plain\r\nServer: CloudStack Password Server\r\n\r\nHTTP/1\.0 400 Bad Request\r\n| p/Apache CloudStack Password Server/ v/4/ i/Python BaseHTTPRequestHandler/ cpe:/a:apache:cloudstack:4/
match http m|^HTTP/1\.1 404 Not Found\r\nserver: imageio/([\d.]+)\r\ndate: .* GMT\r\ncontent-length: 19\r\ncontent-type: text/plain; charset=UTF-8\r\n\r\nNo handler for '/'\n| p/oVirt imageio/ v/$1/ cpe:/a:ovirt:imageio:$1/
match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nDate: .* GMT\r\n\r\n<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name="theme-color" content="#3f51b5"><link rel="manifest" href="\./manifest\.json"><title>Gotify</title| p/Gotify WebUI/ cpe:/a:gotify:gotify/
match http m|^HTTP/1\.0 200 OK\r\nAccept-Ranges: bytes\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nLast-Modified: .* GMT\r\nServer: MinIO Console\r\n(?:Vary: Accept-Encoding\r\n)?X-Content-Type-Options: nosniff\r\nX-Frame-Options: DENY\r\nX-Xss-Protection: 1; mode=block\r\nDate: .* GMT\r\n\r\n| p/MinIO Console/ cpe:/a:minio:console/
match http m|^HTTP/1\.0 403 Forbidden\r\nAccept-Ranges: bytes\r\nContent-Length: \d+\r\nContent-Security-Policy: block-all-mixed-content\r\nContent-Type: application/xml\r\nServer: MinIO/([\w.-]+)\r\n| p/MinIO S3-compatible object store/ v/$1/ cpe:/a:minio:minio:$1/
match http m|^HTTP/1\.0 403 Forbidden\r\nAccept-Ranges: bytes\r\nContent-Length: \d+\r\nContent-Security-Policy: block-all-mixed-content\r\nContent-Type: application/xml\r\nServer: MinIO\r\n| p/MinIO S3-compatible object store/ cpe:/a:minio:minio/
match http m|^HTTP/1\.0 400 Bad Request\r\nAccept-Ranges: bytes\r\nContent-Length: \d+\r\nContent-Type: application/xml\r\nServer: MinIO\r\nVary: Origin\r\nDate: .* GMT\r\n\r\n| p/MinIO S3-compatible object store/ cpe:/a:minio:minio/
match http m|^HTTP/1\.1 404 \r\nX-Download-Options: noopen\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nContent-Length: 0\r\n\r\n| p/Huawei router http admin/ d/router/
match http m|^HTTP/1\.[01] 200 OK\r\nSet-Cookie: SessionID(?:_R3)?=[\w+/]+; path=/; (?:secure=true; )?HttpOnly;\r\nCache-Control: no-cache(?:, no-store, max-age=0, must-revalidate\r\nPragma: no-cache\r\nContent-Type: text/html)?\r\nX-Download-Options: noopen\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\n| p/Huawei router http admin/ d/router/
match http m|^HTTP/1\.1 200 OK\r\nSet-Cookie: SessionID_R3=[\w+/]+; path=/; (?:secure=true; )?HttpOnly;\r\nCache-Control: no-cache(?:, no-store, max-age=0, must-revalidate)?\r\nDate: .* GMT\r\nConnection: Keep-Alive\r\nContent-Type: text/html| p/Huawei router http admin/ d/router/
match http m|^HTTP/1\.1 404 \r\nContent-Type: text/plain\r\nX-Download-Options: noopen\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nContent-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'\r\nX-Content-Type-Options: nosniff\r\n(?:Strict-Transport-Security: max-age=31536000\r\n)?Content-Length: 0\r\n\r\n$| p/Huawei router http admin/ d/router/
match http m|^HTTP/1\.1 307 \r\nLOCATION: https://\(null\)/\r\nContent-Length: 0\r\n\r\n$| p/Huawei router http admin/ d/router/
match http m|^HTTP/1\.1 405 \r\nContent-Length: 0\r\n\r\n$| p/Huawei router http admin/ d/router/
match upnp m|^HTTP/1\.1 404 \r\nContent-Type: text/xml; charset="utf-8"\r\nServer: Linux UPnP/1\.0 Huawei-ATP-IGD\r\nDate: .* GMT\r\nConnection: Close\r\nContent-Length: 0\r\n\r\n| p/Huawei ATP gateway upnpd/ d/firewall/
match http m|^HTTP/1\.1 [34]0\d .*\r\nServer: Microsoft-Azure-Application-Gateway/(v\d+)\r\nDate: .* GMT\r\nContent-Type: text/html\r\nContent-Length: \d\d\d\r\nConnection: close\r\n| p/Microsoft Azure Application Gateway/ v/$1/
match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\nConnection: close\r\nCache-control: no-cache\r\n\r\n(?:\xef\xbb\xbf)?<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1\.0 Transitional//EN" "http://www\.w3\.org/TR/xhtml1/DTD/xhtml1-transitional\.dtd">\r?\n<html xmlns="http://www\.w3\.org/1999/xhtml">\r?\n(?:\n<!--\[if lte IE 9\]>\n<meta http-equiv="refresh" content="0; url=common/error\.htm"/>\n<!\[endif\]-->\n\n)?<head>\r?\n\t<title>((?:TL-)?[A-Z\d]+)</title>| p/TP-LINK $1 http config/ cpe:/h:tp-link:$1/
match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\nConnection: close\r\nCache-control: no-cache\r\n\r\n<!DOCTYPE html><html xmlns="http://www\.w3\.org/1999/xhtml"><head>| p/TP-LINK router http config/
match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: 0\r\nConnection: close\r\nCache-control: no-cache\r\n\r\n$| p/TP-LINK router http config/
match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: \d+\r\nSet-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly\r\nConnection: keep-alive\r\n\r\n(?:\xef\xbb\xbf)?<!DOCTYPE html| p/TP-LINK WAP http config/ d/WAP/
match http m|^HTTP/1\.1 40\d .*\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: \d+\r\nSet-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly\r\nConnection: close\r\n\r\n<html>| p/TP-LINK WAP http config/ d/WAP/
match http m%^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4\.01 Transitional//EN" "http://www\.w3\.org/TR/html4/loose\.dtd">\r\n<html>\r\n<head>\r\n<meta http-equiv='Content-Type' content='text/html; charset=UTF-8'>\r\n<meta name='Author' content='Flexense HTTP Server v([\d.]+)'>\r\n<meta name='GENERATOR' content='Flexense HTTP v[\d.]+'>\r\n<title>(DiskBoss|Sync Breeze|Dup Scout)(?: Enterprise)? @ ([^< ]+)% p/Flexense $2/ v/$1/ h/$3/ cpe:/a:flexense:$SUBST(2," ",""):$1/
#(insert http)
@@ -10672,7 +10738,7 @@ match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: GoAhead-Webs\r\n| p/GoAhead WebS
match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: GoAhead/([0-2][\d.]+)\r\n| p/GoAhead WebServer/ v/$1/ cpe:/a:goahead:goahead_webserver:$1/
match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: GoAhead/([\d.]+)\r\n| p/GoAhead WebServer/ v/$1/ cpe:/a:embedthis:goahead_webserver:$1/
match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: GoAhead-http\r\n| p/GoAhead WebServer/ cpe:/a:embedthis:goahead_webserver/
match http m|^HTTP/1\.0 200 OK\r\nServer: SimpleHTTP/([\d.]+) Python/([\d.]+)\r\n| p/SimpleHTTPServer/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/ cpe:/a:python:simplehttpserver:$1/
match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: SimpleHTTP/([\d.]+) Python/([\d.]+)\r\n| p/SimpleHTTPServer/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/ cpe:/a:python:simplehttpserver:$1/
match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Mbedthis-App[Ww]eb/([\d.]+)\r\n|s p/Mbedthis-Appweb/ v/$1/ cpe:/a:mbedthis:appweb:$1/
match http m|^UnknownMethod 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: Mbedthis-Appweb/([\w._-]+)\r\n|s p/Mbedthis-Appweb/ v/$1/ cpe:/a:mbedthis:appweb:$1/
match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Tntnet/([\w._-]+)\r\n|s p/Tntnet/ v/$1/ cpe:/a:tntnet:tntnet:$1/
@@ -10723,7 +10789,7 @@ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: TornadoServe
match http m|^HTTP/1\.1 200 OK\r.*\nServer: Node v([\d.]+)\r\n|s p/Node.js httpd/ v/$1/ cpe:/a:nodejs:node.js:$1/
match http m|^HTTP/1\.1 200 OK\r.*\nServer: GHC\r\n|s p/Gemius Hit Counter/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Pegasus/Plan9\r\n|s p/Pegasus httpd/ o/Plan 9/ cpe:/o:belllabs:plan_9/a
match http m|^HTTP/1\.0 \d\d\d [A-Z ]*\r.*\nServer: Werkzeug/([\w._-]+) Python/([\w._-]+)\r\n|s p/Werkzeug httpd/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/
match http m|^HTTP/1\.[01] \d\d\d [A-Z ]*\r\n(?:[^\r\n]*\r\n(?!\r\n))*?Server: Werkzeug/([\w._-]+) Python/([\w._-]+)\r\n|s p/Werkzeug httpd/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/
match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Webduino/([\w._-]+)\r\n| p/Webduino httpd/ v/$1/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Restlet-Framework/([\w._-]+)\r\n|s p/Restlet Java web framework/ v/$1/ cpe:/a:restlet:restlet:$1/
# version is always 1.0. QUIP is configurable
@@ -10758,13 +10824,13 @@ match http m|^HTTP/1\.0 400 Bad Request\r\nPragma: no-cache\r\nCache-Control: no
match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nContent-Length: \d+\r\n\r\n.*<!--\nCopyright 2004-20\d\d H2 Group\.\n.*Sorry, remote connections \('webAllowOthers'\) are disabled on this server\.|s p/H2 Database console/ i/remote connections disabled/ cpe:/a:h2group:h2database/
match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nContent-Length: \d+\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.01 Transitional//EN\" \"http://www\.w3\.org/TR/html4/loose\.dtd\">\n<!--\nCopyright 2004-20\d\d H2 Group\.| p/H2 database http console/
match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Karrigell ([\w._-]+)\r\nDate: |s p/Karrigell web framework httpd/ v/$1/ cpe:/a:karrigell:karrigell:$1/
match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .* GMT\r\nServer: WSGIServer/([\w._-]+) C?Python/([\w._+-]+)\r\n| p/WSGIServer/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/ cpe:/a:python:wsgiref:$1/
match http m|^HTTP/1\.[01] \d\d\d .*\r\nDate: .* GMT\r\nServer: WSGIServer/([\w._-]+) C?Python/([\w._+-]+)\r\n| p/WSGIServer/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/ cpe:/a:python:wsgiref:$1/
match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: MX4J-HTTPD/1\.0\r\n\r\n|s p/MX4J HTTP Adaptor/
match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: ExtremeWare/([\d.]+)\r\n|s p/Exreme Networks switch admin httpd/ i/ExtremeWare XOS $1/ o/XOS/ cpe:/o:extremenetworks:extremeware_xos:$1/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: ngx_openresty/([\w._-]+)\r\n|s p/OpenResty web app server/ v/$1/ cpe:/a:openresty:ngx_openresty:$1/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: ngx_openresty\r\n|s p/OpenResty web app server/ v/1.9.7.2 or earlier/ cpe:/a:openresty:ngx_openresty/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: openresty/([\w._-]+)\r\n|s p/OpenResty web app server/ v/$1/ cpe:/a:openresty:ngx_openresty:$1/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: openresty\r\n|s p/OpenResty web app server/ cpe:/a:openresty:ngx_openresty/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?[Ss]erver: openresty/([\w._-]+)\r\n|s p/OpenResty web app server/ v/$1/ cpe:/a:openresty:ngx_openresty:$1/
match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?[Ss]erver: openresty\r\n|s p/OpenResty web app server/ cpe:/a:openresty:ngx_openresty/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: IntelliJ IDEA (\d[\w._-]*)\r\n|s p/IntelliJ IDEA/ v/$1/ cpe:/a:jetbrains:intellij_idea:$1/
match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?server: Cowboy\r\n|s p/Cowboy httpd/ cpe:/a:ninenines:cowboy/
match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Cowboy\r\nDate: .*\r\nContent-Length: \d+\r\n\r\n| p/Cowboy httpd/ cpe:/a:ninenines:cowboy/
@@ -10818,6 +10884,7 @@ match http m|^HTTP/1\.[01] \d\d\d [^\r\n]+\r\nServer: Digiweb\r\n(?:[^\r\n]+\r\n
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Wakanda/\d+ build ([.\d]+) WAF ([\d.]+) build ([\d-]+) \((\w+)-(\w+)\)\r\n|s p/Wakanda httpd/ v/$1/ i/Wakanda Application Framework $2 build $3; arch: $5/ o/$4/ cpe:/a:wakanda:wakanda_application_framework:$2/ cpe:/a:wakanda:wakanda_server:$1/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Wakanda/\d+ build ([.\d]+) \((\w+)-(\w+)\)\r\n|s p/Wakanda httpd/ v/$1/ i/arch: $3/ o/$2/ cpe:/a:wakanda:wakanda_server:$1/
match http m|^HTTP/1\.[01] (?:[^\r\n]*\r\n(?!\r\n))*?Server: gunicorn/([\w._-]+)\r\n|s p/Gunicorn/ v/$1/ cpe:/a:gunicorn:gunicorn:$1/
match http m|^HTTP/1\.[01] (?:[^\r\n]*\r\n(?!\r\n))*?Server: gunicorn\r\n|s p/Gunicorn/ cpe:/a:gunicorn:gunicorn/
match http m|^HTTP/1\.1 \d\d\d .*\nDate: .*\r\nConnection: close\r\nServer: Clearswift\r\n\r\n|s p/Clearswift Secure Web Gateway/ d/security-misc/
match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?X-Influxdb-Version: v?([\d.]+)\r\n|s p/InfluxDB http admin/ v/$1/ cpe:/a:influxdata:influxdb:$1/
match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?X-Influxdb-Version: v([\d.]+)\+SNAPSHOT\.(\w+)\r\n|s p/InfluxDB http admin/ v/$1/ i/snapshot: $2/ cpe:/a:influxdata:influxdb:$1/
@@ -10826,7 +10893,8 @@ match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: KFWebServer/([\
match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Huawei-BMC\r\n| p/Huawei BMC httpd/ d/remote management/
match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Seattle Lab HTTP Server/([\d.]+)\r\n| p/Seattle Lab httpd/ v/$1/
match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: WindRiver-WebServer/([\d.]+)\r\n| p/Wind River Web Server/ v/$1/ cpe:/a:windriver:web_server:$1/
match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Python/([\d.]+) aiohttp/([\d.]+)\r\n|s p/aiohttp/ v/$2/ i/Python $1/ cpe:/a:aiohttp:aiohttp:$2/ cpe:/a:python:python:$1/
match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Python/([\d.]+) aiohttp/([\w.]+)\r\n|s p/aiohttp/ v/$2/ i/Python $1/ cpe:/a:aiohttp:aiohttp:$2/ cpe:/a:python:python:$1/
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Python/([\d.]+) websockets/([\w.]+)\r\n|s p/websockets/ v/$2/ i/Python $1/ cpe:/a:aymeric_augustin:websockets:$2/ cpe:/a:python:python:$1/
match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Cassini/([\d.]+)\r\nDate: .*\r\nX-AspNet-Version: ([\d.]+)\r\n| p/Microsoft Cassini httpd/ v/$1/ i/ASP.NET $2/ o/Windows/ cpe:/a:microsoft:asp.net:$2/ cpe:/a:microsoft:cassini:$1/ cpe:/o:microsoft:windows/a
match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Cassini/([\d.]+)\r\nDate: .*\r\n| p/Microsoft Cassini httpd/ v/$1/ o/Windows/ cpe:/a:microsoft:cassini:$1/ cpe:/o:microsoft:windows/a
match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: HTTP::Server::PSGI\r\n| p/Plack HTTP::Server::PSGI httpd/ cpe:/a:tatsuhiko_miyagawa:plack/
@@ -10846,6 +10914,8 @@ match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Date: [^\r\n]+\r\nConne
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: nzbget-([\w._-]+)\r\n\r\n| p/NZBGet httpd/ v/$1/ cpe:/a:nzbget:nzbget:$1/
match http m|^HTTP/1\.1 [45]\d\d .*\r\nContent-Length: 0\r\nConnection: close\r\nDate: .* GMT\r\nServer: Kestrel\r\n\r\n$| p/Microsoft Kestrel httpd/ cpe:/a:microsoft:kestrel/
match http m|^HTTP/1\.1 200 OK\r\n(?:Content-Length: \d+\r\n)?Connection: close\r\nContent-Type: text/html\r\nDate: .* GMT\r\nServer: Kestrel\r\n| p/Microsoft Kestrel httpd/ cpe:/a:microsoft:kestrel/
match http m|^HTTP/1\.1 302 Found\r\nConnection: close\r\nDate: .* GMT\r\nServer: Kestrel\r\n| p/Microsoft Kestrel httpd/ cpe:/a:microsoft:kestrel/
match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .* GMT\r\nContent-Type: (?:[^\r\n]*\r\n(?!\r\n))*?Server: XCC Web Server\r\n| p/Lenovo XClarity Controller/ cpe:/a:lenovo:xclarity_controller/
# Put this at the end because it's not a server, but a backend.
match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?X-Powered-By: Servlet/([\w._-]+) JSP/([\w._-]+)\r\n|s p/Java Servlet/ v/$1/ i/JSP $2/ cpe:/a:oracle:jsp:$2/
@@ -11056,47 +11126,48 @@ match http-proxy m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nConnection: c
# http://git.haproxy.org/?p=haproxy.git;a=blob;f=src/proto_http.c
# Only statuses 200, 403, and 503 are likely to result from from GetRequest;
# other probes can match via fallbacks.
match http-proxy m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>200 OK</h1>\nHAProxy: service ready\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.5.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 400 Bad request\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n<html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 408 Request Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n<html><body><h1>408 Request Time-out</h1>\nYour browser didn't send a complete request in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 500 Server Error\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n<html><body><h1>500 Server Error</h1>\nAn internal server error occured\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 502 Bad Gateway\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n<html><body><h1>502 Bad Gateway</h1>\nThe server returned an invalid or incomplete response\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 504 Gateway Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n<html><body><h1>504 Gateway Time-out</h1>\nThe server didn't respond in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1.0 401 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nWWW-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>401 Unauthorized</h1>\nYou need a valid user and password to access this content.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
# Statuses 400, 401, 403, 408, 500, 502, 503, and 504 gained "Content-Type: text/html" in v1.3.1.
match http-proxy m|^HTTP/1\.0 200 OK\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>200 OK</h1>\nHAProxy: service ready\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.5.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 400 Bad request\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n\r\n<html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 403 Forbidden\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n\r\n<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 408 Request Time-out\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n\r\n<html><body><h1>408 Request Time-out</h1>\nYour browser didn't send a complete request in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 500 Server Error\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n\r\n<html><body><h1>500 Server Error</h1>\nAn internal server error occured\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 502 Bad Gateway\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n\r\n<html><body><h1>502 Bad Gateway</h1>\nThe server returned an invalid or incomplete response\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n\r\n<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 504 Gateway Time-out\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n\r\n<html><body><h1>504 Gateway Time-out</h1>\nThe server didn't respond in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1.0 401 Unauthorized\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\nWWW-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>401 Unauthorized</h1>\nYou need a valid user and password to access this content.\n</body></html>\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/
# Statuses 400, 401, 403, 408, 500, 502, 503, and 504 gained "Content-[Tt]ype: text/html" in v1.3.1.
# http://git.haproxy.org/?p=haproxy.git;a=commitdiff;h=791d66d3634dde12339d4294aff55a1aed7518e3;hp=b9e98b683612b29ef939c10d3d00be27de26534a
match http-proxy m|^HTTP/1\.0 400 Bad request\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 408 Request Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>408 Request Time-out</h1>\nYour browser didn't send a complete request in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 500 Server Error\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>500 Server Error</h1>\nAn internal server error occured\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 502 Bad Gateway\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>502 Bad Gateway</h1>\nThe server returned an invalid or incomplete response\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 504 Gateway Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>504 Gateway Time-out</h1>\nThe server didn't respond in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1.0 401 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\nWWW-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>401 Unauthorized</h1>\nYou need a valid user and password to access this content.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 400 Bad request\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 403 Forbidden\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 408 Request Time-out\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>408 Request Time-out</h1>\nYour browser didn't send a complete request in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 500 Server Error\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>500 Server Error</h1>\nAn internal server error occured\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 502 Bad Gateway\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>502 Bad Gateway</h1>\nThe server returned an invalid or incomplete response\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 504 Gateway Time-out\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>504 Gateway Time-out</h1>\nThe server didn't respond in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1.0 401 Unauthorized\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\nWWW-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>401 Unauthorized</h1>\nYou need a valid user and password to access this content.\n</body></html>\n$| p/HAProxy http proxy/ v/1.3.1 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
# HTTP_407_fmt was added in v1.4-rc1.
# http://git.haproxy.org/?p=haproxy-1.4.git;a=commitdiff;h=844a7e76d2557364e6d34d00027f2fa514b9d855;hp=8c8bd4593c95f54cbe42bf204b943a159810a74e
match http-proxy m|^HTTP/1.0 407 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\nProxy-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>401 Unauthorized</h1>\nYou need a valid user and password to access this content.\n</body></html>\n$| p/HAProxy http proxy/ v/1.4.0 - 1.5.10/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1.0 407 Unauthorized\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\nProxy-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>401 Unauthorized</h1>\nYou need a valid user and password to access this content.\n</body></html>\n$| p/HAProxy http proxy/ v/1.4.0 - 1.5.10/ d/load balancer/ cpe:/a:haproxy:haproxy/
# 200 changed in v1.5-dev7.
# http://git.haproxy.org/?p=haproxy-1.5.git;a=commitdiff;h=027a85bb03c5524e62c50e228412d9be403d7f98;hp=7c51a732f701f7d147e7b79d828f80612a0bfcbc
match http-proxy m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>200 OK</h1>\nService ready\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.5.0 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 200 OK\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>200 OK</h1>\nService ready\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.5.0 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
# 405 and 429 were added in v1.6-dev2.
# http://git.haproxy.org/?p=haproxy-1.6.git;a=commitdiff;h=108b1dd69d4e26312af465237487bdb855b0de60
match http-proxy m|^HTTP/1\.0 405 Method Not Allowed\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>405 Method Not Allowed</h1>\nA request was made of a resource using a request method not supported by that resource\n</body></html>\n$| p/HAProxy http proxy/ v/1.6.0 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 429 Too Many Requests\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>429 Too Many Requests</h1>\nYou have sent too many requests in a given amount of time\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.6.0 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 405 Method Not Allowed\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>405 Method Not Allowed</h1>\nA request was made of a resource using a request method not supported by that resource\n</body></html>\n$| p/HAProxy http proxy/ v/1.6.0 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 429 Too Many Requests\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>429 Too Many Requests</h1>\nYou have sent too many requests in a given amount of time\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.6.0 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
# HTTP_407_fmt changed in v1.5.10.
# http://git.haproxy.org/?p=haproxy-1.5.git;a=commitdiff;h=b301654e237c358e892db32c4ac449b42550d79b;hp=211c2e901d0b83b6792d5ebdf207f8e70a299361
match http-proxy m|^HTTP/1\.0 407 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\nProxy-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>407 Unauthorized</h1>\nYou need a valid user and password to access this content\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.5.10 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 407 Unauthorized\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\nProxy-Authenticate: Basic realm=".*"\r\n\r\n<html><body><h1>407 Unauthorized</h1>\nYou need a valid user and password to access this content\.\n</body></html>\n$| p/HAProxy http proxy/ v/1.5.10 - 1.9.0/ d/load balancer/ cpe:/a:haproxy:haproxy/
# 2.0.0 made error pages HTTP 1.1
match http-proxy m|^HTTP/1\.1 400 Bad request\r\nContent-length: 90\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 403 Forbidden\r\nContent-length: 93\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 400 Bad request\r\n[Cc]ontent-length: 90\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>400 Bad request</h1>\nYour browser sent an invalid request\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 403 Forbidden\r\n[Cc]ontent-length: 93\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
#match http-proxy m|^HTTP/1\.1 403 Forbidden\r\ncontent-length: 93\r\ncache-control: no-cache\r\ncontent-type: text/html\r\nconnection: close\r\n\r\n<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules\.\n</body></html>\n| p/HAProxy http proxy/ v/2.0.0 or later/
match http-proxy m|^HTTP/1\.1 408 Request Time-out\r\nContent-length: 110\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>408 Request Time-out</h1>\nYour browser didn't send a complete request in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 500 Server Error\r\nContent-length: 96\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>500 Server Error</h1>\nAn internal server error occured\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 502 Bad Gateway\r\nContent-length: 107\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>502 Bad Gateway</h1>\nThe server returned an invalid or incomplete response\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 503 Service Unavailable\r\nContent-length: 107\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 504 Gateway Time-out\r\nContent-length: 92\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><body><h1>504 Gateway Time-out</h1>\nThe server didn't respond in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 408 Request Time-out\r\n[Cc]ontent-length: 110\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>408 Request Time-out</h1>\nYour browser didn't send a complete request in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 500 Server Error\r\n[Cc]ontent-length: 96\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>500 Server Error</h1>\nAn internal server error occured\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 502 Bad Gateway\r\n[Cc]ontent-length: 107\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>502 Bad Gateway</h1>\nThe server returned an invalid or incomplete response\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 503 Service Unavailable\r\n[Cc]ontent-length: 107\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 504 Gateway Time-out\r\n[Cc]ontent-length: 92\r\n[Cc]ache-[Cc]ontrol: no-cache\r\n[Cc]onnection: close\r\n[Cc]ontent-[Tt]ype: text/html\r\n\r\n<html><body><h1>504 Gateway Time-out</h1>\nThe server didn't respond in time\.\n</body></html>\n$| p/HAProxy http proxy/ v/2.0.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.1 503 Service Unavailable\r\ncontent-length: 107\r\ncache-control: no-cache\r\ncontent-type: text/html\r\nconnection: close\r\n\r\n<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request\.\n</body></html>\n| p/HAProxy http proxy/ cpe:/a:haproxy:haproxy/
match http-proxy m|^HTTP/1\.0 400\r\nContent-Type: text/html\r\n\r\n<html><head><title>Error</title></head><body>\r\n<h2>ERROR: 400</h2>\r\n<br>\r\n</body></html>\r\n$| p/Citrix Application Firewall/ d/firewall/
match http-proxy m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 3366\r\nPragma: no-cache\r\n\r\n.*<style>\r\n\r\nh1, p, a, body {font-family: Arial;}\r\n\r\nh2\r\n{\r\n\ttext-align: center; \r\n\tfont: bold 20px Verdana, sans-serif; \r\n\tcolor: #00F; \r\n}|s p/Integard filtering http proxy management interface/ d/proxy server/
match http-proxy m|^HTTP/1\.0 502 Bad gateway\r\n\r\nBurp proxy error: invalid client request received: first line of request did not contain an absolute URL - try enabling invisible proxy support\r\n$| p/Burp Suite Pro http proxy/
@@ -11112,6 +11183,7 @@ match http-proxy m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: ATS\r\n|s
match http-proxy m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Via: http/1\.1 ([\w._-]+) \([^\)]+ \[c[M ]s[S ]f \]\)\r\nServer: [^/]+/([\d.]+)\r\n|s p/Apache Traffic Server/ v/$2/ h/$1/ cpe:/a:apache:traffic_server:$2/
match http-proxy m|^HTTP/1\.0 200 OK\r\nACCEPT-RANGES: none\r\n\r\n<html><head><Title>SecTitan&#153; Reverse Proxy</title></head><body><center><h1>Error 107</h1>Invalid Request!<br><b>SecTitan&#153; Reverse Proxy ([\w._-]+)</b><br>Copyright &copy; \d+ Bestellen Software, LLC All rights reserved\.</center></body></html>| p/Bestellen SecTitan reverse http proxy/ v/$1/
match http-proxy m|^HTTP/1\.1 \d\d\d .*\r\nServer: Varnish\r\n| p/Varnish/ cpe:/a:varnish-cache:varnish/
match http-proxy m|^HTTP/1\.1 \d\d\d .*\r\nConnection: close\r\nContent-Length: \d+\r\nServer: Varnish\r\n| p/Varnish/ cpe:/a:varnish-cache:varnish/
match http-proxy m|^HTTP/1\.0 503 Internal Error\r\nServer: awarrenhttp/([\w._-]+)\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<HTML><HEAD>\n<TITLE>ERROR: The requested URL could not be retrieved</TITLE>\n</HEAD><BODY>\n<H1>ERROR</H1>\n<H2>The requested URL could not be retrieved</H2>| p/awarrenhttp http proxy/ v/$1/
match http-proxy m|^HTTP/1\.0 404 No service found\r\nDate: .*\r\nServer: ACE XML Gateway\r\nContent-Type: text/plain\r\nConnection: close\r\nContent-Length: 30\r\n\r\nNo service matched the request| p/Cisco Application Control Engine XML gateway/ d/load balancer/ cpe:/a:cisco:application_control_engine_software/
match http-proxy m|^HTTP/1\.0 403 Request error by HTTP PROXY\r\nContent-Type: text/html\r\nProxy-Connection: close\r\nConnection: close\r\n\r\n<html><head><meta http-equiv=\"Content-Language\" content=\"en-us\"><title>Cisco ([\w._-]+)</title>| p/Cisco $1 http proxy/ d/firewall/
@@ -11131,7 +11203,6 @@ match http-proxy m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Via: 1\.1 varnish
match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nDate: .*\r\nServer: Microdasys-SCIP\r\nContent-Type: text/html\r\nContent-Length: 240\r\nConnection: close\r\n\r\n<HTML>.*<ADDRESS><A HREF=\"http://www\.websense\.com/\">Websense Content Gateway Proxy v([\w._-]+)</A>| p/Websense Content Gateway http proxy/ v/$1/ i/Microdasys SCIP ssl proxy/ cpe:/a:websense:websense_content_content_gateway:$1/
match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nDate: .*\r\nServer: Microdasys-SCIP\r\n| p/Microdasys SCIP ssl proxy/
match http-proxy m|^HTTP/1\.1 400 Bad Request\r\nServer: mitmproxy ([\w._-]+)\r\nContent-type: text/html\r\nContent-Length: \d+\r\n| p/mitmproxy/ v/$1/
match http-proxy m|^HTTP/1\.1 302 Found\r\nDate: .*\r\nServer: xxxx\r\nX-Frame-Options: SAMEORIGIN\r\nStrict-Transport-Security: max-age=31536000\r\nLocation: https:///webconsole/webpages/login\.jsp\r\n|
match http-proxy m|^HTTP/1\.1 302 Found\r\nDate: .*\r\nServer: xxxx\r\n(?:X-Frame-Options: SAMEORIGIN\r\n(?:Strict-Transport-Security: max-age=\d+\r\n)?)?Location: https?://[^\r\n]+?/webpages/(?:myaccount/)?login\.jsp\r\nCache-Control: max-age=2592000\r\nExpires: .*\r\n(?:Vary: Accept-Encoding\r\n)?Content-Length: \d+\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n| p/Cyberoam captive portal/
match http-proxy m=^HTTP/1\.1 200 OK\r\nConnection: close\r\nCache-control: no-cache\r\nPragma: no-cache\r\nCache-control: no-store\r\n(?:X-Frame-Options: DENY\r\n)?\r\n<html><head><title>Burp Suite (Professional|Free Edition)</title>= p/Burp Suite $1 http proxy/ cpe:/a:portswigger:burp_suite:::$1/
match http-proxy m%^HTTP/1\.1 200 OK\r\nConnection: close\r\nCache-control: no-cache, no-store\r\nPragma: no-cache\r\nX-Frame-Options: DENY\r\nContent-Type: text/html; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\n\r\n<html><head><title>Burp Suite (Professional|Free Edition)% p/Burp Suite $1 http proxy/ cpe:/a:portswigger:burp_suite:::$1/
@@ -11168,6 +11239,9 @@ match http-proxy m|^HTTP/1\.0 501 Not Implemented\r\nContent-Type: text/html\r\n
match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nConnection: close\r\nContent-Length: 51\r\nContent-type: text/html\r\n\r\nAccess denied: authentication configuration missing| p/Smoothwall http proxy/ d/firewall/ cpe:/o:smoothwall:smoothwall/
match http-proxy m|^HTTP/1\.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm="Hola Unblocker"\r\nDate: .*\r\nConnection: close\r\n\r\n| p/Hola Unblocker http proxy/
match http-proxy m|^HTTP/1\.1 400 Bad Request\r\nContent-Length: 21\r\nContent-Type: text/html; charset=utf-8\r\nVia: 1\.1 ([\w.-]+)\r\nDate: .*\r\n\r\nBad Request to URI: /| p/LittleProxy http proxy/ h/$1/ cpe:/a:adamfisk:littleproxy/
match http-proxy m|^HTTP/1\.1 302 Found\r\nLocation: https://[\w.-]*:8015/\r\nConnection: close\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: frame-ancestors 'self'\r\n\r\n| p/FortiGuard Web Filtering/
match http-proxy m|^HTTP/1\.1 200 OK\r\nContent-Length: [45]\d\d\d\r\nConnection: [Cc]lose\r\nCache-Control: no-cache\r\nContent-Type: text/html(?:; charset=utf-8)?\r\nX-Frame-Options: SAMEORIGIN\r\n(?:X-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: frame-ancestors 'self'\r\n)?\r\n<!DOCTYPE html>\n<html lang="en">\n| p/FortiGuard Web Filtering/
match http-proxy m|^HTTP/1\.1 403 Forbidden\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: frame-ancestors 'self'\r\nContent-Type: text/html; charset="utf-8"\r\nContent-Length: [45]\d\d\d\r\nConnection: Close\r\n\r\n<!DOCTYPE html>\n<html lang="en">\n| p/FortiGuard Web Filtering/
match http-proxy m|^HTTP/1\.0 200 OK\r\n\r\n$| p/sslstrip/
@@ -12318,8 +12392,10 @@ match http m|^HTTP/1\.1 505 HTTP Version Not Supported\r\nContent-Length: 0\r\n\
match http m|^HTTP/1\.0 200 OK\r\nPragma: no-cache\r\nCache-Control: no-store\r\nContent-Type: text/html\r\nContent-Length: 229\r\n\r\n<html>\r\n<head>\r\n<title> Error </title>\r\n</head>\r\n<body>\r\n<!-- user defined strings -->\r\nAccess denied due to security policy violation<br><br><!-- reject ID -->\r\nReject ID: [0-9a-f-]+\r\n<br>\r\n<br>\r\n</body>\r\n</html>$| p/Check Point R65 firewall http config/ d/firewall/ cpe:/h:checkpoint:r65/a
match http m|^HTTP/1\.1 406 Not Acceptable\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: 616\r\n\r\n<HTML><HEAD>\n<TITLE>Request Error</TITLE>| p/Blue Coat proxy server/ d/proxy server/
match http m|^<html>\r\n<head><title>400 Bad Request</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>400 Bad Request</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n$| p/nginx/ cpe:/a:igor_sysoev:nginx/
match http m|^<html>\r\n<head><title>400 Bad Request</title></head>\r\n<body(?: bgcolor=\"white\")?>\r\n<center><h1>400 Bad Request</h1></center>\r\n<hr><center>openresty</center>\r\n</body>\r\n</html>\r\n$| p/OpenResty web app server/ cpe:/a:openresty:ngx_openresty/
match http m|^<html>\r\n<head><title>400 Bad Request</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>400 Bad Request</h1></center>\r\n<hr><center>nginx/([\w._-]+)</center>\r\n</body>\r\n</html>\r\n$| p/nginx/ v/$1/ cpe:/a:igor_sysoev:nginx:$1/
match http m|^<html>\r\n<head><title>400 Bad Request</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>400 Bad Request</h1></center>\r\n<hr><center>cloudflare-nginx</center>\r\n</body>\r\n</html>\r\n$| p/cloudflare-nginx/
match http m|^<html>\r\n<head><title>400 Bad Request</title></head>\r\n<body>\r\n<center><h1>400 Bad Request</h1></center>\r\n</body>\r\n</html>\r\n$| p/nginx/ cpe:/a:igor_sysoev:nginx/
match http m|^<head><title>400 Bad Request</title></head>\r\n<h1>400 Bad Request</h1>\r\n\r\n| p/nginx/ cpe:/a:igor_sysoev:nginx/
# Counting on this 404 being unique enough here in RTSPRequest.
match http m|^HTTP/1\.0 404 Not Found\r\n\r\n$| p/XBT BitTorrent tracker http interface/
@@ -12331,12 +12407,12 @@ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain\r\nConnectio
match http m|^HTTP/1\.1 505 HTTP Version Not Supported\r\nDate: .*\r\nConnection: close\r\nServer: Apache\r\n\r\n| p/Apache Tomcat httpd/ cpe:/a:apache:tomcat/
match http m|^HTTP/1\.1 400 Bad Request\r\nDate: .*\r\nContent-Length: 0\r\n\r\n400 Bad Request\r\n| p/Cisco Wireless LAN Controller httpd/ d/remote management/ cpe:/o:cisco:wireless_lan_controller_software/
match http m|^HTTP/1\.1 505 HTTP Version Not Supported\r\nContent-Type: text/html\r\nContent-Length: 166\r\n\r\n<html><head><title>505 HTTP Version Not Supported</title></head><body><h1>HTTP Version Not Supported</h1><p>HTTP versions 1\.0 and 1\.1 are supported\.</p></body></html>| p/Mitel SIP DEC VoIP phone http config/ d/VoIP phone/
#match http m|^<head>\n<title>Error response</title>\n</head>\n<body>\n<h1>Error response</h1>\n<p>Error code 400\.\n<p>Message: Bad request version \('RTSP/1\.0'\)\.\n<p>Error code explanation: 400 = Bad request syntax or unsupported method\.\n</body>\n| p/BaseHTTPServer/ cpe:/a:python:basehttpserver/a
match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 59\r\nConnection: close\r\n\r\nError 400: Bad Request\nCannot parse HTTP request: \[OPTIONS\]$| p/Mongoose httpd/ cpe:/a:cesanta:mongoose/
match http m|^HTTP/1\.1 505 HTTP Version not supported\r\nContent-Length: 0\r\nDate: .* GMT\r\nConnection: close\r\n\r\n| p/Konica Minolta bizhub C452 OpenAPI/ d/printer/ cpe:/h:konicaminolta:bizhub_c452/
match http m|^HTTP/1\.0 500\r\nContent-Type: text/html; charset=UTF-8\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nExpires: 0\r\nConnection: close\r\n\r\n<!DOCTYPE html>\n<html>\n<head>\n <title>Application Firewall Error</title>\n <style type="text/css" media="screen">\n body \{ font-family: Arial, Garamond, sans-serif; padding: 40px; background-color: #333333; \}\n| p/Imperva WAF/
match http m|^HTTP/1\.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html; charset=UTF-8\r\nCache-Control: no-cache\r\nDate: .*\r\n\r\n<HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD>\r\n<BODY><H1>400 Bad Request</H1>\r\n</BODY></HTML>\r\n| p/Trend Micro OfficeScan/ cpe:/a:trend_micro:officescan/
match http m|^<html>\r\n<head><title>400 Bad Request</title></head>\r\n<body bgcolor="white">\r\n<center><h1>400 Bad Request</h1></center>\r\n<hr><center></center>\r\n</body>\r\n</html>\r\n| p/Palo Alto GlobalProtect Gateway httpd/ cpe:/a:paloaltonetworks:globalprotect/
match http m|^<html>\r\n<head><title>400 Bad Request</title></head>\r\n<body>\r\n<center><h1>400 Bad Request</h1></center>\r\n<hr><center>Microsoft-Azure-Application-Gateway/(v\d+)</center>\r\n</body>\r\n</html>\r\n| p/Microsoft Azure Application Gateway/ v/$1/
match http-proxy m|^HTTP/1\.1 503 Service Unavailable\r\ndate: .*\r\nconnection: close\r\n\r\n<html><body><pre><h1>Service unavailable</h1></pre></body></html>\n| p/HTTP Replicator proxy/
match http-proxy m|^HTTP/1\.0 400 Bad Request\r\nContent-Length: 103\r\nConnection: close\r\n\r\n<html><body> <h2>Mikrotik HttpProxy</h2>\n\r<hr>\n\r<h2>\n\rError: 400 Bad Request\r\n\r\n</h2>\n\r</body></html>\n\r$| p/MikroTik HttpProxy/ d/router/
@@ -13230,8 +13306,6 @@ match acpc m|^Usage: Valid commands are\nLIST\nCLEAR\nSTATUS\nKILL\nNEW\nCONFIG\
match aleph m|^96\r$| p/Aleph Integrated Library System/
match bitkeeper m|^@SERVER INFO@\nPROTOCOL=([\d.]+)\nVERSION=bk-([\w._-]+)\nUTC=\d+\nTIME_T=\d+\nROOT=([^\n]+)\nUSER=(?:[^\n]+)\nHOST=(?:[^\n]+)\nREALUSER=(?:[^\n]+)\nREALHOST=([^\n]+)\nPLATFORM=([^\n]+)\n| p/BitKeeper distributed VCS/ v/$2/ i/protocol $1; root $3; $5/ h/$4/ cpe:/a:bitmover:bitkeeper:$2/
match caldav m|^<head>\n<title>Error response</title>\n</head>\n<body>\n<h1>Error response</h1>\n<p>Error code 400\.\n<p>Message: Bad request syntax \('HELP'\)\.\n<p>Error code explanation: 400 = Bad request syntax or unsupported method\.\n</body>\n| p/Radicale calendar and contacts server/ i/Python BaseHTTPServer/ cpe:/a:kozea:radicale/ cpe:/a:python:python/
match chat m|^\r\n>STATUS\tset status\r\nINVISIBLE\tset invisible mode\r\nMAINWINDOW\tshow/hide main window\r\n| p/Simple Instant Messenger control plugin/
# CVSD (cvs chrooting service for pserver) cvsd 0.9.18
@@ -13956,6 +14030,7 @@ match greenplum m|^E\0\0\0\x83SFATAL\0C0A000\0Munsupported frontend protocol 392
match h2 m|^\x52\x00\x00\x00\x08\x00\x00\x00\x03$| p/H2 database/
match hik-connect m|^\0\0\0\x10\0\0\0\r\0\0\0\r\0\0\0\0$| p/HikVision camera control/ d/webcam/
match honeywell-hscodbcn m|^\0\0\0\x02\0\x03$| p/Honeywell hscodbcn power management server/
match http m|^HTTP/1\.0 503 OK\r\nContent-Type: text/html\r\n\r\nBusy$| p/D-Link DI-524 WAP http config/ d/WAP/ cpe:/h:dlink:di-524/
@@ -14623,6 +14698,9 @@ match upnp m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: FreeBSD/([\w._-
match upnp m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Linux/([\w._-]+), UPnP/1\.0, FUPPES/([\w._-]+)\r\n\r\n|s p/Free UPnP Entertainment Service/ v/$2/ i/Linux $1/ o/Linux/ cpe:/a:ulrich_voelkel:fuppes:$2/ cpe:/o:linux:linux_kernel:$1/
match upnp m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: (\w+)/([\w._-]+), UPnP/1\.0, FUPPES/([\w._-]+)\r\n\r\n|s p/Free UPnP Entertainment Service/ v/$3/ o/$1 $2/ cpe:/a:ulrich_voelkel:fuppes:$3/
match upnp m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?SERVER: Linux/(([\d.]+)-[\d.]+) UPnP/([\d.]+) Evolution Media Server DLNADOC/([\d.]+)\r\n|s p/Cisco Evolution Media Server upnpd/ i/UPnP $3; DLNADOC $4; Linux $1/ d/media device/ o/Linux $2/ cpe:/a:cisco:evolution_media_server/ cpe:/o:linux:linux_kernel:$1/a
match upnp m|^HTTP/1\.0 401 Unauthorized\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: [23]\d\d\r\nConnection: close\r\nCache-control: no-cache\r\n\r\n00007\r\n00004\r\n00000\r\n| p/TP-LINK router upnpd/
match vnc-http m|^HTTP/1\.0 404 Not Found\r?\n\r?\n<HTML>\n <HEAD><TITLE>404 Not Found</TITLE></HEAD>\n <BODY>\n <H1>Not Found</H1>\n The requested file could not be found\.\n </BODY>\n</HTML>\n| p/TightVNC/ cpe:/a:tightvnc:tightvnc/a