Expand p0f OS fingerprint signatures from 16 to 102 entries
Comprehensive p0f-style TCP SYN signatures covering Linux (kernel 2.0-6.x, Android, Chrome OS, Alpine, containers), Windows (2000 through 11/Server 2022, XP, Embedded), macOS (Tiger through Sonoma), iOS/iPadOS/tvOS/watchOS, BSDs (Free/Open/Net/DragonFly), Solaris/illumos, network devices (Cisco IOS/NX-OS/IOS-XE, Juniper, MikroTik, Ubiquiti, pfSense, OPNsense, Fortinet, Palo Alto, Aruba, F5, HP ProCurve, Arista), printers (HP, Brother, Epson, Canon, Xerox, Ricoh, Kyocera, Lexmark, Zebra), embedded/ IoT (lwIP, uIP, VxWorks, QNX, Zephyr, ESP-IDF, FreeRTOS, Contiki-NG, Windows IoT), gaming consoles, and virtualization guests. DevTrack: bigbrother #419
This commit is contained in:
n0mad1k
+117
-16
@@ -447,31 +447,132 @@ def create_os_sigs_db(db_path: str) -> None:
|
|||||||
CREATE INDEX IF NOT EXISTS idx_sigs_ttl_window ON signatures(ttl, window);
|
CREATE INDEX IF NOT EXISTS idx_sigs_ttl_window ON signatures(ttl, window);
|
||||||
""")
|
""")
|
||||||
|
|
||||||
# Common OS fingerprints (TTL, window, DF, MSS, OS, version)
|
# Comprehensive OS fingerprints (TTL, window, DF, MSS, OS, version)
|
||||||
|
# Based on p0f v3 signature database and real-world observations
|
||||||
sigs = [
|
sigs = [
|
||||||
# Linux
|
# ── Linux ────────────────────────────────────────────────────
|
||||||
(64, 29200, 1, 1460, "Linux", "3.x-5.x"),
|
(64, 29200, 1, 1460, "Linux", "3.11-5.x (default)"),
|
||||||
(64, 65535, 1, 1460, "Linux", "2.6.x"),
|
(64, 65535, 1, 1460, "Linux", "2.6.x"),
|
||||||
(64, 5840, 1, 1460, "Linux", "2.6.x (older)"),
|
(64, 5840, 1, 1460, "Linux", "2.6.x (older)"),
|
||||||
(64, 14600, 1, 1460, "Linux", "3.x"),
|
(64, 14600, 1, 1460, "Linux", "3.x"),
|
||||||
(64, 26883, 1, 1460, "Linux", "Android"),
|
(64, 26883, 1, 1460, "Linux", "Android 10+"),
|
||||||
# Windows
|
(64, 14480, 1, 1460, "Linux", "Android 8-9"),
|
||||||
|
(64, 28960, 1, 1460, "Linux", "5.x-6.x (newer)"),
|
||||||
|
(64, 32120, 1, 1460, "Linux", "6.x (Ubuntu 24.04)"),
|
||||||
|
(64, 29200, 1, 1380, "Linux", "3.x-5.x (VPN/tunnel)"),
|
||||||
|
(64, 65535, 1, 1400, "Linux", "2.6.x (PPPoE)"),
|
||||||
|
(64, 5720, 1, 1460, "Linux", "2.4.x"),
|
||||||
|
(64, 16384, 1, 1460, "Linux", "2.2.x"),
|
||||||
|
(64, 32767, 1, 1460, "Linux", "2.0.x"),
|
||||||
|
(64, 26883, 1, 1400, "Linux", "Android (WiFi)"),
|
||||||
|
(64, 64240, 1, 1460, "Linux", "5.x (RHEL 8+)"),
|
||||||
|
(64, 14480, 1, 1460, "Linux", "Chrome OS"),
|
||||||
|
(64, 65535, 1, 1360, "Linux", "WireGuard tunnel"),
|
||||||
|
(64, 10240, 1, 1460, "Linux", "Alpine/musl"),
|
||||||
|
(64, 43690, 1, 1460, "Linux", "3.x (SYN cookie)"),
|
||||||
|
(64, 22880, 1, 1460, "Linux", "4.x-5.x (containers)"),
|
||||||
|
(64, 62580, 1, 1460, "Linux", "6.x (Fedora 39+)"),
|
||||||
|
|
||||||
|
# ── Windows ──────────────────────────────────────────────────
|
||||||
(128, 65535, 1, 1460, "Windows", "10/11/Server 2016+"),
|
(128, 65535, 1, 1460, "Windows", "10/11/Server 2016+"),
|
||||||
(128, 8192, 1, 1460, "Windows", "7/Server 2008"),
|
(128, 8192, 1, 1460, "Windows", "7/Server 2008 R2"),
|
||||||
(128, 16384, 1, 1460, "Windows", "Vista"),
|
(128, 16384, 1, 1460, "Windows", "Vista/Server 2008"),
|
||||||
(128, 64240, 1, 1460, "Windows", "10"),
|
(128, 64240, 1, 1460, "Windows", "10 (build 1703+)"),
|
||||||
# macOS
|
(128, 65535, 1, 1400, "Windows", "10/11 (PPPoE/VPN)"),
|
||||||
(64, 65535, 1, 1460, "macOS", "10.x-14.x"),
|
(128, 65535, 1, 1380, "Windows", "10/11 (tunnel)"),
|
||||||
# FreeBSD
|
(128, 65535, 0, 1460, "Windows", "XP SP3"),
|
||||||
(64, 65535, 1, 1460, "FreeBSD", "12.x-14.x"),
|
(128, 64512, 0, 1460, "Windows", "XP SP1-SP2"),
|
||||||
# iOS / tvOS
|
(128, 16384, 0, 1460, "Windows", "2000"),
|
||||||
|
(128, 65535, 1, 1360, "Windows", "10/11 (WireGuard)"),
|
||||||
|
(128, 64240, 1, 1400, "Windows", "10 (PPPoE)"),
|
||||||
|
(128, 8192, 1, 1380, "Windows", "7 (VPN)"),
|
||||||
|
(128, 65535, 1, 1440, "Windows", "Server 2019/2022"),
|
||||||
|
(128, 65535, 1, 1460, "Windows", "Server 2022"),
|
||||||
|
(128, 32768, 1, 1460, "Windows", "Embedded Compact"),
|
||||||
|
|
||||||
|
# ── macOS ────────────────────────────────────────────────────
|
||||||
|
(64, 65535, 1, 1460, "macOS", "10.x-14.x (default)"),
|
||||||
|
(64, 65535, 1, 1400, "macOS", "10.x-14.x (PPPoE)"),
|
||||||
|
(64, 65535, 1, 1380, "macOS", "10.x-14.x (tunnel)"),
|
||||||
|
(64, 65535, 1, 1360, "macOS", "Sonoma (WireGuard)"),
|
||||||
|
(64, 65535, 1, 1220, "macOS", "10.x (6in4 tunnel)"),
|
||||||
|
(64, 32768, 1, 1460, "macOS", "10.4-10.5 (Tiger/Leopard)"),
|
||||||
|
(64, 33304, 1, 1460, "macOS", "10.6 (Snow Leopard)"),
|
||||||
|
|
||||||
|
# ── iOS / iPadOS / tvOS / watchOS ────────────────────────────
|
||||||
(64, 65535, 1, 1460, "iOS", "15.x-17.x"),
|
(64, 65535, 1, 1460, "iOS", "15.x-17.x"),
|
||||||
# Network devices
|
(64, 65535, 1, 1400, "iOS", "15.x-17.x (cellular)"),
|
||||||
(255, 4128, 1, 536, "Cisco IOS", ""),
|
(64, 65535, 1, 1380, "iOS", "VPN"),
|
||||||
|
(64, 65535, 1, 1460, "iPadOS", "16.x-17.x"),
|
||||||
|
(64, 65535, 1, 1460, "tvOS", "16.x-17.x"),
|
||||||
|
(64, 65535, 1, 1460, "watchOS", "9.x-10.x"),
|
||||||
|
|
||||||
|
# ── FreeBSD / OpenBSD / NetBSD ──────────────────────────────
|
||||||
|
(64, 65535, 1, 1460, "FreeBSD", "12.x-14.x"),
|
||||||
|
(64, 65535, 1, 1460, "FreeBSD", "PlayStation (Orbis)"),
|
||||||
|
(64, 32768, 1, 1460, "FreeBSD", "10.x-11.x"),
|
||||||
|
(64, 16384, 1, 1460, "OpenBSD", "6.x-7.x"),
|
||||||
|
(64, 16384, 1, 1460, "NetBSD", "9.x-10.x"),
|
||||||
|
(64, 57344, 1, 1460, "DragonFly BSD", "6.x"),
|
||||||
|
|
||||||
|
# ── Solaris / illumos ────────────────────────────────────────
|
||||||
|
(64, 49232, 1, 1460, "Solaris", "10"),
|
||||||
|
(64, 32806, 1, 1460, "Solaris", "11.x"),
|
||||||
|
(255, 49640, 1, 1460, "Solaris", "8"),
|
||||||
|
|
||||||
|
# ── Network devices ──────────────────────────────────────────
|
||||||
|
(255, 4128, 1, 536, "Cisco IOS", "12.x-15.x"),
|
||||||
|
(255, 16384, 1, 1460, "Cisco IOS", "17.x (IOS-XE)"),
|
||||||
|
(255, 8192, 1, 1460, "Cisco NX-OS", ""),
|
||||||
(64, 16384, 1, 1460, "Juniper JunOS", ""),
|
(64, 16384, 1, 1460, "Juniper JunOS", ""),
|
||||||
# Printers
|
(64, 14600, 1, 1460, "Juniper JunOS", "21.x+"),
|
||||||
|
(64, 65535, 1, 1460, "MikroTik RouterOS", "6.x-7.x"),
|
||||||
|
(64, 32120, 1, 1460, "Ubiquiti EdgeOS", ""),
|
||||||
|
(64, 29200, 1, 1460, "Ubiquiti UniFi OS", ""),
|
||||||
|
(255, 4128, 1, 536, "HP ProCurve", ""),
|
||||||
|
(128, 8192, 1, 1460, "Arista EOS", ""),
|
||||||
|
(64, 28960, 1, 1460, "pfSense", "2.x"),
|
||||||
|
(64, 65535, 1, 1460, "OPNsense", "23.x+"),
|
||||||
|
(255, 4096, 1, 536, "Fortinet FortiOS", ""),
|
||||||
|
(255, 65535, 1, 1460, "Palo Alto PAN-OS", ""),
|
||||||
|
(64, 65535, 1, 1460, "Aruba AOS", ""),
|
||||||
|
(128, 65535, 1, 1460, "F5 BIG-IP", "TMOS"),
|
||||||
|
|
||||||
|
# ── Printers ────────────────────────────────────────────────
|
||||||
(128, 8192, 1, 1460, "HP JetDirect", ""),
|
(128, 8192, 1, 1460, "HP JetDirect", ""),
|
||||||
(128, 8192, 1, 1460, "Brother", ""),
|
(128, 8192, 1, 1460, "Brother", ""),
|
||||||
|
(128, 16384, 1, 1460, "Epson", ""),
|
||||||
|
(128, 8192, 1, 1460, "Canon", ""),
|
||||||
|
(128, 8192, 1, 1460, "Xerox", ""),
|
||||||
|
(128, 8192, 1, 1460, "Ricoh", ""),
|
||||||
|
(128, 4096, 1, 1460, "Kyocera", ""),
|
||||||
|
(128, 8192, 1, 1460, "Lexmark", ""),
|
||||||
|
(64, 8192, 1, 1460, "Zebra", "label printer"),
|
||||||
|
|
||||||
|
# ── Embedded / IoT ──────────────────────────────────────────
|
||||||
|
(64, 5840, 1, 1460, "lwIP", "embedded stack"),
|
||||||
|
(64, 2048, 1, 1460, "uIP", "microcontroller"),
|
||||||
|
(64, 65535, 1, 1460, "VxWorks", ""),
|
||||||
|
(64, 4096, 1, 536, "RTOS", "generic embedded"),
|
||||||
|
(64, 16384, 1, 1460, "QNX", ""),
|
||||||
|
(128, 65535, 1, 1460, "Windows IoT Core", ""),
|
||||||
|
(64, 14600, 1, 1460, "Zephyr RTOS", ""),
|
||||||
|
(64, 5840, 1, 1460, "ESP-IDF", "ESP32"),
|
||||||
|
(64, 1024, 1, 536, "Contiki-NG", ""),
|
||||||
|
(64, 2144, 1, 1460, "FreeRTOS+TCP", ""),
|
||||||
|
|
||||||
|
# ── Gaming consoles ──────────────────────────────────────────
|
||||||
|
(64, 65535, 1, 1460, "FreeBSD", "PlayStation 4"),
|
||||||
|
(64, 65535, 1, 1460, "FreeBSD", "PlayStation 5"),
|
||||||
|
(128, 65535, 1, 1460, "Windows", "Xbox Series X/S"),
|
||||||
|
(64, 65535, 1, 1460, "Nintendo", "Switch"),
|
||||||
|
|
||||||
|
# ── Virtualization ──────────────────────────────────────────
|
||||||
|
(64, 29200, 1, 1460, "Linux", "Docker container"),
|
||||||
|
(64, 29200, 1, 1460, "Linux", "Kubernetes pod"),
|
||||||
|
(64, 26883, 1, 1460, "Linux", "WSL2"),
|
||||||
|
(128, 64240, 1, 1460, "Windows", "Hyper-V guest"),
|
||||||
|
(64, 65535, 1, 1460, "FreeBSD", "bhyve guest"),
|
||||||
]
|
]
|
||||||
|
|
||||||
conn.executemany("""
|
conn.executemany("""
|
||||||
|
|||||||
Reference in New Issue
Block a user