From 4a0fa6a5cd7ec7eafb2b5ee0a945ae41577c2b95 Mon Sep 17 00:00:00 2001
From: Matthew Kienow <matthew_kienow@rapid7.com>
Date: Mon, 26 Jun 2023 18:30:58 -0400
Subject: [PATCH] Add Roundcube Webmail

---
 identifiers/service_product.txt |  1 +
 identifiers/vendor.txt          |  1 +
 xml/favicons.xml                | 14 ++++++++++++++
 xml/html_title.xml              |  8 ++++++++
 xml/http_cookies.xml            |  8 ++++++++
 5 files changed, 32 insertions(+)

diff --git a/identifiers/service_product.txt b/identifiers/service_product.txt
index 936fbae4..7be198c6 100644
--- a/identifiers/service_product.txt
+++ b/identifiers/service_product.txt
@@ -605,6 +605,7 @@ WebSocket++
 WebSphere
 WebSphere Load Balancer
 WebTrends
+Webmail
 Webmin
 Webserver
 Werkzeug
diff --git a/identifiers/vendor.txt b/identifiers/vendor.txt
index 9684938b..283ab8b5 100644
--- a/identifiers/vendor.txt
+++ b/identifiers/vendor.txt
@@ -638,6 +638,7 @@ Rockliffe
 Rockwell Automation
 Rohde & Schwarz
 Roku
+Roundcube
 Roxen
 Ruby-Lang
 Ruckus
diff --git a/xml/favicons.xml b/xml/favicons.xml
index f7f2162c..2aeda220 100644
--- a/xml/favicons.xml
+++ b/xml/favicons.xml
@@ -2464,4 +2464,18 @@
     <param pos="0" name="service.product" value="frp"/>
   </fingerprint>
 
+  <fingerprint pattern="^(?:924a68d347c80d0e502157e83812bb23|f1ac749564d5ba793550ec6bdc472e7c|ef9c0362bf20a086bb7c2e8ea346b9f0)$">
+    <description>Roundcube Webmail</description>
+    <!-- favicon.ico from Roundcube Webmail version 1.5.0+ -->
+
+    <example>924a68d347c80d0e502157e83812bb23</example>
+    <!-- favicon.ico from Roundcube Webmail up to version 1.4.13 -->
+
+    <example>f1ac749564d5ba793550ec6bdc472e7c</example>
+    <example>ef9c0362bf20a086bb7c2e8ea346b9f0</example>
+    <param pos="0" name="service.vendor" value="Roundcube"/>
+    <param pos="0" name="service.product" value="Webmail"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:roundcube:webmail:-"/>
+  </fingerprint>
+
 </fingerprints>
\ No newline at end of file
diff --git a/xml/html_title.xml b/xml/html_title.xml
index 2c7d0e85..1afea6f3 100644
--- a/xml/html_title.xml
+++ b/xml/html_title.xml
@@ -4217,6 +4217,14 @@
     <param pos="0" name="service.product" value="frp"/>
   </fingerprint>
 
+  <fingerprint pattern="^Roundcube Webmail :: Welcome to Roundcube Webmail$">
+    <description>Roundcube Webmail</description>
+    <example>Roundcube Webmail :: Welcome to Roundcube Webmail</example>
+    <param pos="0" name="service.vendor" value="Roundcube"/>
+    <param pos="0" name="service.product" value="Webmail"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:roundcube:webmail:-"/>
+  </fingerprint>
+
   <!-- Specific Eltex fingerprints to enable CPE generation -->
 
   <fingerprint pattern="^Eltex - NTP-RG-1402G$">
diff --git a/xml/http_cookies.xml b/xml/http_cookies.xml
index 968e589b..e9064a3a 100644
--- a/xml/http_cookies.xml
+++ b/xml/http_cookies.xml
@@ -815,6 +815,14 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:progress:moveit_transfer:-"/>
   </fingerprint>
 
+  <fingerprint pattern="^roundcube_sessid=">
+    <description>Roundcube Webmail</description>
+    <example>roundcube_sessid=bdd66fb23fa3ce907a1e792475273145; path=/; HttpOnly</example>
+    <param pos="0" name="service.vendor" value="Roundcube"/>
+    <param pos="0" name="service.product" value="Webmail"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:roundcube:webmail:-"/>
+  </fingerprint>
+
   <!--
         Ignore various cookies that are very generic cookies for session IDs
         that are not necessarily indicative of any particular