rapid7 / recog

Pattern recognition for hosts, services, and content
Other
662 stars 195 forks source link

Add missing IMAP CAPABILITY string #498

Closed mkienow-r7 closed 1 year ago

mkienow-r7 commented 1 year ago

Description

The xml/imap_banners.xml fingerprints were created assuming the * OK portion of the banner was removed, but some of the fingerprint patterns did not account for the possibility of the [CAPABILITY ...] string in the banner. This PR adds the missing IMAP CAPABILITY string to the pattern and provides examples. In addition, the "CMU Cyrus IMAP" fingerprint was enhanced to spport banners without v prepended to the version. The IMAP CAPABILITY string max match length of 645 was calculated using the longest CAPABILITY string found in the 2022-10-13-1665619548-imaps_993_stage2 Project Sonar study (658 characters) and subtracting the fixed portion of the regex [CAPABILITY ] (13 characters).

Motivation and Context

Improved coverage

How Has This Been Tested?

Types of changes

Checklist:

TomSellers commented 1 year ago

LGTM. Note that CMU Cyrus IMAP is ripe for a split into detection for various OSes.