Service match for Ubicom embedded HTTP server

[Tomás García-Merás <tomas () rockmusic org>]

Hello again...
 here's another match: (in response to the "TCP GenericLines" probe):


# Ubicom embedded ( http://www.ubicom.com/home.htm )
match http m|^HTTP/1\.1 400 Bad Request\r\nCache-control: 
no-cache\r\nServer: Ubicom/(\d[-.\w ]+)\r\n| v/Ubicom/$1//


The banner the server returns when pressing enter (on a telnet to port 
80) is:


HTTP/1.1 400 Bad Request
Cache-control: no-cache
Server: Ubicom/1.1
Content-Length: 15

400 Bad Request


I've tested it with nmap 3.78 and the Ubicom 1.1 found on the SMC 
SMC2870W Wireless Ethernet Bridge (802.11g firmware = 1.0.4.3,
Bridge firmware = 5.4.0).

I think it's cleaner to match the "GenericLines" probe instead of the 
"TCP GetRequest", even being an HTTP server...

And just one question... Are the probes/matches I'm posting here usefull 
to anyone? I do not want to annoy nobody on the board with useless posts...

Regards: Tomas


---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org