search

runZeroInc / recog-go

Recog-Go: Pattern Recognition using Rapid7 Recog
Other
101 stars 30 forks source link

Ensure 'service.cpe23' contains '-' for no version #13

Closed pbarry25 closed 2 years ago

pbarry25 commented 2 years ago

If service.version is not present/known for a fingerprint, use a dash ('-') when filling out service.cpe23 for the version field, which matches the CPE interpolation behavior of the ruby logic in the recog project.

Results of a match with and without service version using this PR'd code:

$ echo "cpsrvd/11.44.3.0" | cmd/recog_match/recog_match pkg/nition/recog/xml
{"fp.certainty":"0.85","service.cpe23":"cpe:/a:cpanel:cpanel:11.44.3.0","service.product":"cPanel Service Daemon","service.vendor":"cPanel","service.version":"11.44.3.0"}

$ echo "cpsrvd" | cmd/recog_match/recog_match pkg/nition/recog/xml
{"fp.certainty":"0.85","service.cpe23":"cpe:/a:cpanel:cpanel:-","service.product":"cPanel Service Daemon","service.vendor":"cPanel","service.version":""}

Fixes #12