Improve Epson printer detection

Vulnerability Tests
1

We have some Epson printers which weren’t detected by gb_epson_printer_http_detect.nasl (OID: 1.3.6.1.4.1.25623.1.0.146411).

HTTP Server type and version (OID: 1.3.6.1.4.1.25623.1.0.10107) reports the following:

The remote HTTP Server banner is:

Server: EPSON-HTTP/1.0

My suggestion is to change line 120 of gb_epson_printer_http_detect.nasl from the following value:
if (concl = egrep(pattern: "(^SERVER\s*:\s*(EPSON_Linux|EPSON HTTP Server|EPSON-HTTP)|Epson UPnP SDK)", string: banner, icase: TRUE)) {

to:

if (concl = egrep(pattern: "(^SERVER\s*:\s*(EPSON_Linux|EPSON HTTP Server|EPSON-HTTP)|Epson UPnP SDK|EPSON-HTTP\/1.0)", string: banner, icase: TRUE)) {

I’ve added |EPSON-HTTP\/1.0 so the regex matches the server banner. This change improves the Epson HTTP detection.

2

Thanks a lot for you suggestion / posting.

But currently not sure if this is really required because if you check the existing regex it already includes / covering the Server: EPSON-HTTP/1.0 string as shown below.

3

When I try this regex, it doesn’t validate. This issue came up for me when an Epson printer crashed. I saw the Epson Printer detection NVT wasn’t triggered/matched. Then I tried to match the regex and it didn’t.

You can try it out here: https://regex101.com/

Screenshot 2022-05-23 at 12.14.44
Screenshot 2022-05-23 at 12.14.44973×161 15.4 KB

Versus my change:

Screenshot 2022-05-23 at 12.15.15
Screenshot 2022-05-23 at 12.15.15982×163 16.4 KB

4

Ah, i see. In your example you need to add the i regex flag (for case insensitivity) because that is what’s also used in the NASL side egrep() call via icase: TRUE.

1 Like
5

Thank you, didn’t see that :). In that case the regex is valid. There seems to be another reason why the printer wasn’t detected. I’ll troubleshoot some more.

1 Like
6

This regex could a bit more shrinked: RegExr: Learn, Build, & Test RegEx

7

I’ll troubleshoot some more.

:+1: If you need any additional help / pointer feel free to ask here

This regex could a bit more shrinked

We’re usually not doing such things as it makes the regex more hard to read, more difficult to extend and more error prone for mistakes introduced later.

2 Likes