From d1d910f13e6ec308ffe34f7fc3c112c0f8965bbc Mon Sep 17 00:00:00 2001
From: david <david@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Tue, 24 Nov 2009 17:28:21 +0000
Subject: [PATCH] Add a Citrix MetaFrame (icabrowser) service probe from Thomas
 Buchanan.

---
 nmap-service-probes | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nmap-service-probes b/nmap-service-probes
index 2418bb21f..c2e28a11c 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -7427,3 +7427,13 @@ match hp-pjl m|@PJL\x20INFO\x20ID\r?\n\r?\n| d/printer/
 
 # We don't want to send a bunch more probes that will be printed
 softmatch hp-pjl m|^| i/hp-pdl probe got something back/
+
+##############################NEXT PROBE##############################
+# Citrix MetaFrame application discovery service
+# http://sh0dan.org/oldfiles/hackingcitrix.html
+Probe UDP Citrix q|\x1e\0\x01\x30\x02\xfd\xa8\xe3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|
+rarity 5
+ports 1604
+
+# Citrix MetaFrame
+match icabrowser m|^\x30\0\x02\x31\x02\xfd\xa8\xe3\x02\0\x06\x44\xc0\xa8| p/Citrix MetaFrame/