Product / version fingerprinting

What it is

A two-stage classifier that turns the deep-probe evidence into structured attributes the rest of the pipeline reads. Stage one is a curated rule set (headers, banners, body markers, favicon hashes); stage two is the entire nuclei http/technologies template tree running over the same response. A service can have multiple fingerprints layered (a WordPress install on nginx behind a CDN gets all three).

What it produces

Per service:

• product: e.g. Apache HTTPD, Jenkins, Confluence, PostgreSQL
• version: when extractable from a Server header / banner / body marker
• vendor: e.g. Apache Software Foundation
• category: web, database, mail, ics, remote, vpn, cms, cicd, etc.
• device_type: camera, router, printer, firewall, database, when applicable
• CPE: standards-compliant CPE 2.3 string for CVE matching
• OS hint: when the fingerprint reveals it (e.g. SSH banner ending Ubuntu-3ubuntu13)

Fingerprints land on the services table and the per-service service_products join. The second lets one service carry multiple products at once.

What to use it for

• The CVE matcher reads CPE; everything in CVE intelligence depends on this.
• Filtering: product:nginx version:1.18, category:database internal:true, etc.
• Picking which services the AI agent should validate first (compromised badges on cms:wordpress services are different signal than on category:database).

Why it matters

A scanner that says “80/tcp open” is a search query, not an inventory. Product + version is the difference between “you have 12 web servers” and “you have 12 web servers, 3 of which are Confluence 7.4, which has 6 critical CVEs including 2 KEVs.”

Why it’s valuable

• Curated + nuclei together. Curated rules catch the ICS / OT hardware nuclei doesn’t cover; nuclei catches the long-tail web stack curated rules would never enumerate.
• CPE-based, not banner-spoof-fragile. The CVE matcher reads CPE, not free-form text. A WAF that rewrites Server: nginx to Server: cdn doesn’t break the match if the body / favicon / cert tell us what we’re actually looking at.
• Multi-tech per service. A single host running WordPress on nginx with a CloudFront CDN in front shows all three.

How to use it

Runs automatically on every discovery scan. Inspect from the service detail drawer (Products tab) or filter inventory via SmartSearch:

product:jenkins                # any Jenkins
product:jenkins version:2.4    # specific version range
category:cms                   # all CMSes
category:database has_cve:true # databases with known CVEs