Comments (3)
Thanks! cc @TomSellers
from recog.
I dug into this a bit this morning. The data in the *.cpe23
fields is indeed CPE 2.3 but it is in the URI format. Jon called this out when he added CPE in PR #172
The 2.3 specification has 3 formats:
-
URI format, intended to be backwards compatible with 2.2 (Section 6.1 in the ref below)
cpe:/a:hp:insight_diagnostics:7.4.0.1570:-:~~online~win2003~x64~
-
Formatted String (Section 6.2 in the ref below)
cpe:2.3:a:hp:insight_diagnostics:7.4.0.1570:-:*:*:online:win2003:x64:*
-
WFN - well formatted name (Section 5 in the ref below)
wfn:[
part="a",
vendor="hp",
product="insight_diagnostics",
version="7\.4\.0\.1570",
update=NA,
sw_edition="online",
target_sw="win2003",
target_hw="x64"
]
We are currently emitting the URI variant as our cpe23
value. I can likely add a new field named cpe23_fs
that is more in line with what folks expect. Here's a rough explanation of the values.
part:vendor:product:version:update:edition:sw_edition:target_sw:target_hw:language:other
^ ^ ^ ^ ^
| | | | ---- x86, JVM, CLR, etc.
| | | |
| | | --- valid OS or software env
| | |
| | --- how tailored to market / class of users
| |
| --- deprecated in formatted string format
|
--- update, service pack, point release - vendor specific
Also, there are a couple things we are likely doing incorrectly.
-
CPE 2.3 as 4 new fields (
sw_edition
,target_sw
,target_hw
,language
) that don't exist in 2.2. In order to express them in a backwards compatible way they are "packed" into theedition
field (deprecated in 2.3) separated by the tilde~
character. -
We have't been providing these new fields when we know them. We also haven't been consistently handling the
update
field which comes after the version. -
The URI format also introduced percent encoding for certain characters. We're almost certainly doing that incorrectly or incompletely.
Proposal:
- Add a new
cpe23_fs
field to contain the 2.3 formatted string format - Add handling for the 4 new fields (
sw_edition
,target_sw
,target_hw
,language
) in both the URI and formatted string output. - Improve the documentation around CPEs, generation, etc. where appropriate.
Reference:
from recog.
Do we also want to deprecate the cpe23 field? Any reason to leave it this way instead of perhaps removing it later and, if kept, making a distinct cpe23_22compat field with its contents?
from recog.
Related Issues (20)
- documentation error - broken link in README.md HOT 3
- hw.vendor not set in SNMP signature HOT 4
- regex fail to work on example HOT 1
- wrong attribute name ? HOT 3
- Add jarm fingerprints for various C2
- Deprecated CPEs HOT 6
- [WIP]Discussion: x.509 Certificates - deterministic handling and fingerprinting.
- Proposal: migrate host.id to hw.serial_number for storing hardware serial numbers HOT 4
- New anti-DoS patterns break Go regexp support with: invalid repeat count: `{0,1024}` HOT 2
- recog_standard crashes when identifier files are missing. HOT 1
- Enable line numbers with recog_verify (and possibly other) warn/fail output HOT 1
- Enforce all fingerprints to require examples
- Add RuboCop (linter) workflow HOT 3
- How can we use it with Nmap ? HOT 3
- How can I match a fingerprint against HTML body? HOT 5
- Probable misclassification of ZebraNet fingerprints
- Correct fingerprint hardware parameters
- Request for Sentry Switched PDU fingerprint
- Add support for x-powered-by
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from recog.