bmenrigh
0c937eec65
Updated the slow ser2net match that we had with the original
...
fingerprint submission. The service was telnet and so the protocol
has been changed to telnet and ser2net has been put into the product
field.
2009-06-09 20:09:09 +00:00
bmenrigh
635f464a7c
I updated our 5 slowest match lines with slightly more efficient
...
matching strategies. It is really great that we have so few match
lines that really need any performance attention. As long as a match
has an anchor (though ^ seems better than $ with PRCE) it should be
fast enough. We also want to avoid things like
"m|^whatever.*something.*" but we got rid of all of those in a
previous review.
The only "bad" match we have now is:
match ser2net m|\r\nser2net port \d+ device (/dev/[-\w_]+) ...snip...
I think this match should be commented out so that we can get a better
submission. With a big release coming up so soon though I don't want
to remove any useful features. I've left a comment about it's
performance and maybe myself, Doug, or somebody else will think about
the match more at a later date.
2009-06-09 00:00:51 +00:00
david
753679d84c
Enhance the ncat-chat service match line so it works with IPv6 addresses
...
(ncat --chat -l -6).
2009-05-26 21:49:36 +00:00
david
7184ce9646
Add an nmap-service-probes match for ncat --chat.
2009-05-26 21:39:46 +00:00
fyodor
a420fe3d4f
o Improved the Oracle DB version detection signatures. [Tom Sellers]
2009-05-14 04:32:50 +00:00
bmenrigh
3164ea7a20
I ran into a case where Hummingbird Exceed X11 reported slightly
...
different bytes in a few X11 fields. I've made the match more
generic. I have a feeling that the X11 fields might contain useful
information that we could include in i// but I don't know enough about
X11 to do that myself.
2009-04-14 22:06:31 +00:00
bmenrigh
ae9def6d85
Handled all of our stray uses of .*\r\n.* and variations like .*\n.*\n
...
by collapsing them to a single .* and making sure that the DOTALL
(PCRE s modifier) is set on the match. This should dramatically cut
down on cases where MATCHLIMIT is returned. See
http://seclists.org/nmap-dev/2009/q2/0086.html for a discussion. I
chose to only use .* in this patch even though .*? will be faster in
some cases. I felt the speed benefit of .*? did not outweigh the
relative obscurity of lazy quantifiers. I have some ideas on how
audit matches for performance and some ideas on optimizations that can
be done. .*? and friends will have wait.
2009-04-07 21:51:36 +00:00
bmenrigh
c01e0c56e3
Added match by Tom Sellers for Service Pack 3 of Microsoft SQL Server 2005.
2009-04-03 00:15:38 +00:00
david
8fef386595
Add a new generic match line for SSLv3-only servers to
...
nmap-service-probes. This replaces an incomplete set of specific match
lines, though a few of those have been retained where they might give
information on the OS or SSL implementation. There is also a new probe
that works against SSLv2-only servers. The patch is from Kristof
Boeynaems.
2009-03-31 16:14:14 +00:00
fyodor
c2fc8af1ba
Add the MochiWeb Erlang HTTP library
2009-03-10 05:53:57 +00:00
fyodor
83b83ee36c
comment out idps signature for now, since Brandon and Tom are still figuring out the best way to do this
2009-02-27 04:40:21 +00:00
fyodor
9a5ce9bfcc
A few version detection sigs contributed by Tom Sellers
2009-02-27 04:35:30 +00:00
doug
190f7ff6c4
Oops. Should have used a different character from =. # might
...
be OK but I usually don't use cause I was scared of interference
from comment character #.
Ended up using %
2009-02-26 01:50:56 +00:00
doug
994317f13d
Fix for assertion failure problem. Thanks to Brandon and David for finding this.
2009-02-26 01:45:02 +00:00
david
209601b44a
Device type canonicalization. Put some videoconferencing system is "webcam",
...
not "telecom-misc". Put some temperature sensors in "specialized".
2009-02-25 23:34:37 +00:00
doug
85f4cb66e2
Fixed issue with RPM Print Manager match line
2009-02-25 01:44:41 +00:00
david
1273142341
FIx a typo in nmap-service-probes, adjust some categorizations in nmap-os-db.
2009-02-21 00:34:33 +00:00
david
1ca5e5b637
Canonicalize a device type in nmap-service-probes: "media-device" ->
...
"media device".
2009-02-20 19:36:49 +00:00
doug
531e2b7c22
MSSQL updates from Tom Sellers
2009-02-20 01:33:55 +00:00
doug
e13283b01e
Finished nmapsubmit-svfp-020309.mbx
2009-02-19 22:17:24 +00:00
doug
e087884f2c
Another batch of misc from nmapsubmit-svfp-020309.mbx (almost done)
2009-02-18 23:57:43 +00:00
doug
7b862ddd1e
Another batch of misc from nmapsubmit-svfp-020309.mbx (hah - gopher)
2009-02-16 22:27:30 +00:00
doug
91129a3830
Lots more misc services from nmapsubmit-svfp-020309.mbx
2009-02-15 03:00:02 +00:00
doug
bae386daa4
* Lots of misc fingerprints from nmapsubmit-svfp-020309.mbx
...
* Update to socks5 probe. Big thanks to Brandon for letting me test his machines!
2009-02-14 21:31:36 +00:00
doug
7d6ead8b39
Last of the HTTP fingerprints from nmapsubmit-svfp-020309.mbx. 710 out of 1746 remaining FPs
2009-02-12 21:13:29 +00:00
doug
e47bff465c
Some more http from nmapsubmit-svfp-020309.mbx
2009-02-11 22:32:47 +00:00
doug
0ccb796e34
* Another batch of HTTP from nmapsubmit-svfp-020309.mbx (almost 2/3 done the HTTP ones now)
...
* Found and deleted/fixed a few garbage http match lines
2009-02-10 18:03:08 +00:00
doug
bc378dc626
* Another batch of HTTP from nmapsubmit-svfp-020309.mbx
...
* Moved lighttpd match lines from HTTPOptions to GetRequest (HTTPOptions falls back to GetRequest).
2009-02-10 06:45:32 +00:00
doug
06f5b7e8db
Next batch of HTTP fingerprints from nmapsubmit-svfp-020309.mbx
2009-02-08 20:30:41 +00:00
doug
8d75390c9b
First batch of http/http-proxy submissions from nmapsubmit-svfp-020309.mbx
2009-02-07 03:35:31 +00:00
doug
1491180c50
IRC, SIP and jabber from nmapsubmit-svfp-020309.mbx
2009-02-06 03:41:17 +00:00
doug
e73920016e
* Remaining telnet submissions from nmapsubmit-svfp-020309.mbx
...
* Normalized cable modem match lines to be "broadband router" not "router"
2009-02-06 02:35:18 +00:00
doug
cedc80699d
About 2/3 of the telnet match lines from nmapsubmit-svfp-020309.mbx
2009-02-05 22:53:27 +00:00
doug
7a1470fde5
* SQL submissions from nmapsubmit-svfp-020309.mbx
...
* Refined PostgreSQL and MySQL match lines
2009-02-05 03:04:35 +00:00
doug
25379845ec
* POP3 and IMAP submissions from nmapsubmit-svfp-020309.mbx
...
* Normalized some old IMAP match line output to be more like newer ones
2009-02-05 02:19:23 +00:00
doug
230691bfdd
FTP updates from nmapsubmit-svfp-020309.mbx
2009-02-05 01:38:47 +00:00
doug
4b23bb9bb2
On Tue, Feb 03, 2009 at 08:02:30PM -0800 or thereabouts, Fyodor wrote:
...
> Looking at our current nmap-service-probes, the first real probe for a
> TCP service on port 25 will be the "Hello" (which didn't exist at the
> time of the fingerprint above). So my suggestion would be to move the
> OpenBSD spamd signature to the bottom of the HelLo probe SMTP
> signatures.
2009-02-04 07:04:09 +00:00
doug
8d44d28023
smtp submissions from nmapsubmit-svfp-020309.mbx and some services that were mislabeled as smtp
2009-02-04 03:45:54 +00:00
doug
cd3d4eb3dd
New SSH submissions from nmapsubmit-svfp-020309.mbx
...
Made some of the OpenSSH lines more general to cover more of the combinations of patchsets distros use
2009-02-04 02:10:53 +00:00
doug
3a420809e9
* Merged HP-UX and AIX ftpd match lines. credit: Tom Sellers
...
* Added better comments to a few of the correction updates from previous commit
2009-02-04 00:25:48 +00:00
doug
787c854946
Applied corrections from nmapsubmit-svcorr-020309.mbx
2009-02-03 23:46:50 +00:00
fyodor
046586774e
add dlswpn match from Tom Sellers
2009-01-31 21:55:20 +00:00
fyodor
1038096cd0
Some improvements to the Lotus Domino signatures - sent in by Tom Sellers
2009-01-31 21:25:47 +00:00
fyodor
b1544ec5b5
removed p/Windows XP identd/ due to report from Brandon Enright to nmap-dev that there is no native Windows XP identd and plus backdoors commonly trigger this signature. Those are Windows backdoors, so we'll keep o/Windows/ unless we see this matching other systems
2009-01-30 23:14:41 +00:00
david
1a922e8ae7
Change one device type "remote-management" to "remote management" in
...
nmap-service-probes to match the other signatures.
2009-01-19 19:22:16 +00:00
david
58eaf1aed3
Fix a typo in nmap-service-probes: Max OS X -> Mac OS X.
2009-01-08 20:13:29 +00:00
bmenrigh
7922c3edb5
Added/fixed a few RICOH/LANIER printer FTP/HTTP matches
2008-12-17 01:34:51 +00:00
sven
1444e02a86
apply Matt Selsky's patch for ssh version detection signatures to properly detect daemons only supporting protocol version 2
2008-10-01 21:05:03 +00:00
sven
0b0bdc14b4
adjust zero one tech printserver matchline to match more models
2008-09-21 13:33:15 +00:00
sven
2688e3413c
add matchline for 3-port zero one tech printserver http config
2008-09-21 09:31:23 +00:00
