Merge pull request #150 from fkie-cad/software_signatures

Software signatures added

src/plugins/analysis/software_components/signatures/http_server.yara

@@ -23,3 +23,16 @@ rule GoAhead
 	condition:
 		$a and no_text_file
 }
+
+rule nginx
+{
+	meta:
+		software_name = "nginx"
+		open_source = true
+		website = "https://www.nginx.com/"
+		description = "Web-Server"
+	strings:
+		$a = /nginx version: nginx\/\d+\.\d+\.\d+/ nocase ascii wide
+	condition:
+		$a and no_text_file
+}

src/plugins/analysis/software_components/signatures/lib.yara

@@ -0,0 +1,51 @@
+rule libFLAC
+{
+	meta:
+		software_name = "libFLAC"
+		open_source = true
+		website = "https://xiph.org/flac/"
+		description = "Free Lossless Audio Codec multimedia library."
+    strings:
+        $a = /libFLAC \d+\.\d+\.\d+/ nocase ascii wide
+    condition:
+        $a and no_text_file
+}
+
+rule libogg
+{
+	meta:
+		software_name = "libogg"
+		open_source = true
+		website = "https://xiph.org/ogg/"
+		description = "ogg multimedia file parsing library."
+    strings:
+        $a = /libogg-\d+\.\d+\.\d+/ nocase ascii wide
+    condition:
+        $a and no_text_file
+}
+
+rule libVorbis
+{
+	meta:
+		software_name = "libVorbis"
+		open_source = true
+		website = "https://xiph.org/vorbis/"
+		description = "ogg vorbis compressed audio format library."
+    strings:
+        $a = /libVorbis \d+\.\d+\.\d+/ nocase ascii wide
+    condition:
+        $a and no_text_file
+}
+
+rule PH7
+{
+	meta:
+		software_name = "PH7"
+		open_source = true
+		website = "http://ph7.symisc.net/"
+		description = "Byte code compiler and virtual machine for PHP"
+    strings:
+        $a = /PH7\/\d+\.\d+\.\d+/ nocase ascii wide
+    condition:
+        $a and no_text_file
+}

src/plugins/analysis/software_components/signatures/network.yara

@@ -208,6 +208,19 @@ rule OpenSSH
         $a and no_text_file
 }
 
+rule pptpClient
+{
+	meta:
+		software_name = "pptp-client"
+		open_source = true
+		website = "http://pptpclient.sourceforge.net/"
+		description = "PPTP Client is a Linux, FreeBSD, NetBSD and OpenBSD client for the proprietary Microsoft Point-to-Point Tunneling Protocol, PPTP."
+    strings:
+        $a = /pptp version \d+\.\d+\.\d/ nocase ascii wide
+    condition:
+        $a and no_text_file
+}
+
 rule ProFTPD
 {
 	meta:

src/plugins/analysis/software_components/signatures/vendor_specific_netgear.yara

@@ -0,0 +1,12 @@
+rule smart_wizzard
+{
+	meta:
+		software_name = "Netgear Smart Wizzard"
+		open_source = false
+		website = "https://www.netgear.com/"
+		description = "Setup assistent"
+	strings:
+		$a = /Netgear Smart Wizard \d+\.\d+/ nocase ascii wide
+	condition:
+		$a and no_text_file
+}

src/plugins/analysis/software_components/test/data/software_component_test_list.txt

@@ -46,3 +46,10 @@ EFI Shell Version 1.0
 Boot Agent CL v0.1.04
 SSLeay 0.8.2b
 Bash version 4.2.10
+nginx version: nginx/1.13.3
+Netgear Smart Wizard 3.0
+libogg-1.1.4
+libVorbis 1.2.3
+pptp version 1.7.0
+libFLAC 1.2.1
+PH7/2.1.4