search

runZeroInc / recog-go

Recog-Go: Pattern Recognition using Rapid7 Recog
Other
101 stars 30 forks source link

BUG: nition/nizer MatchFirst database name drifts from ruby-based recog #1

Closed dabdine-r7 closed 5 years ago

dabdine-r7 commented 5 years ago

Ruby-based recog's Nizer::Match method references fingerprint databases by the matches attribute in the XML file content:

https://github.com/rapid7/recog/blob/998672b697e25325565e7b8230190e670e12ca9c/lib/recog/nizer.rb#L71

  # @param match_key [String] Fingerprint DB name, e.g. 'smb.native_os'
  # @param match_string [String] String to match
  # @return (see Fingerprint#match) or nil
  def self.match(match_key, match_string)

However, recog-go appears to reference the database based on the file name (dns_versionbind.xml).

For what it's worth, I believe java-based recog uses the file name as well.

dabdine-r7 commented 5 years ago

Just referencing a PR for godap that depends on the outcome of this ticket: https://github.com/rapid7/godap/pull/7

dabdine-r7 commented 5 years ago

If we agree it should be the matches field, and not the file name, I can throw a PR up for that...

hdm commented 5 years ago

Thanks! Either way works here, not much code to change. Another option is allowing for lookups by either the name or the matches field.

hdm commented 5 years ago

This was resolved in v0.0.15, now both the matches attribute and the file name can be used.