Skip to content

Name CPE-derived technologies by product and retain the CPE - #3535

Open
liquidsec wants to merge 1 commit into
devfrom
technology-cpe-names
Open

liquidsec wants to merge 1 commit into
devfrom
technology-cpe-names

Conversation

@liquidsec

Copy link
Copy Markdown
Contributor

shodan_idb, shodan_enterprise and censys_ip emit raw CPE strings as the technology name, e.g. cpe:/a:cloudflare:cloudflare or cpe:2.3:a:apache:tomcat:9.0.50:*:*:*:*:*:*:*. These don't match how any other module names technologies, so they can't be correlated or filtered. They also never trigger technology-driven modules: trajan matches jenkins/artifactory, and gitlab_onprem matches names starting with gitlab.

Changes

  • New cpe_product() helper that returns the product name from a CPE 2.2 URI or 2.3 formatted string (lowercased; None for */- or non-CPE input; handles 2.3's escaped colons).
  • TECHNOLOGY events get an optional cpe field.
  • shodan_idb: cpe:/a:jquery:jquery:3.5.1 becomes technology: jquery, cpe: cpe:/a:jquery:jquery:3.5.1.
  • shodan_enterprise: previously emitted each technology up to three times (from cpe, cpe23 and product). It now uses the CPE product names (preferring cpe23), and falls back to Shodan's product field only when a service has no CPE.
  • censys_ip: uses the CPE product name, falling back to product as before.
  • shodan_enterprise no longer passes a port field on TECHNOLOGY events. It wasn't in the event schema, so it was already being dropped.

Behavior change
Technology names from these modules change format, e.g. cpe:/a:microsoft:internet_information_services becomes internet_information_services. Anything filtering on the old CPE strings should use the new cpe field instead.

Tests

  • New test_cpe_product.
  • shodan_idb, shodan_enterprise and censys_ip tests updated to expect product names and the retained CPE, and shodan_enterprise checks that no technology name starts with cpe:.

@codecov

codecov Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 95.55556% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 91%. Comparing base (484cfb6) to head (f527d67).

Files with missing lines Patch % Lines
bbot/modules/shodan_idb.py 50% 2 Missing ⚠️
Additional details and impacted files
@@          Coverage Diff          @@
##             dev   #3535   +/-   ##
=====================================
+ Coverage     91%     91%   +1%     
=====================================
  Files        463     463           
  Lines      49758   49791   +33     
=====================================
+ Hits       44890   44929   +39     
+ Misses      4868    4862    -6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions

Copy link
Copy Markdown
Contributor

📊 Performance Benchmark Report

Comparing dev (baseline) vs technology-cpe-names (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name 📏 Base 📏 Current 📈 Change 🎯 Status
Bloom Filter Dns Mutation Tracking Performance 3.81ms 3.83ms +0.3% ⚪ ✅
Bloom Filter Large Scale Dns Brute Force 15.35ms 15.87ms +3.4% ⚪ ✅
Large Closest Match Lookup 357.84ms 363.37ms +1.5% ⚪ ✅
Realistic Closest Match Workload 201.70ms 195.26ms -3.2% ⚪ ✅
Event Memory Medium Scan 1402 B/event 1408 B/event +0.4% ⚪ ✅
Event Memory Large Scan 1527 B/event 1527 B/event +0.0% ⚪ ✅
Event Validation Full Scan Startup Small Batch 436.44ms 436.35ms -0.0% ⚪ ✅
Event Validation Full Scan Startup Large Batch 581.33ms 581.44ms +0.0% ⚪ ✅
Make Event Autodetection Small 27.72ms 27.57ms -0.6% ⚪ ✅
Make Event Autodetection Large 278.08ms 278.27ms +0.1% ⚪ ✅
Make Event Explicit Types 12.08ms 12.19ms +0.9% ⚪ ✅
Excavate Single Thread Small 4.419s 4.381s -0.9% ⚪ ✅
Excavate Single Thread Large 10.910s 10.700s -1.9% ⚪ ✅
Excavate Parallel Tasks Small 4.641s 4.629s -0.3% ⚪ ✅
Excavate Parallel Tasks Large 7.426s 6.980s -6.0% ⚪ ✅
Intercept Throughput Small 921.06ms 933.85ms +1.4% ⚪ ✅
Intercept Throughput Medium 913.04ms 923.76ms +1.2% ⚪ ✅
Dns Throughput Quiet 2.850s 2.875s +0.8% ⚪ ✅
Dns Throughput Loaded 1.918s 1.906s -0.6% ⚪ ✅
Dns Throughput Inherited 2.464s 2.658s +7.9% ⚪ ✅
Is Ip Performance 2.34ms 2.34ms -0.2% ⚪ ✅
Make Ip Type Performance 268.77µs 245.74µs -8.6% ⚪ ✅
Mixed Ip Operations 2.43ms 2.46ms +1.4% ⚪ ✅
Memory Use Web Crawl 1.2 MB 1.2 MB +0.0% ⚪ ✅
Memory Use Subdomain Enum 28.3 MB 28.3 MB +0.0% ⚪ ✅
Memory Use Deep Chain 5.0 MB 5.0 MB +0.0% ⚪ ✅
Memory Use Parallel Chains 12.9 MB 14.4 MB +11.7% 🟡🟡 ⚠️
Scan Throughput 100 3.216s 3.051s -5.1% ⚪ ✅
Scan Throughput 1000 23.305s 22.214s -4.7% ⚪ ✅
Typical Queue Shuffle 5.52µs 5.58µs +1.1% ⚪ ✅
Priority Queue Shuffle 25.80µs 26.02µs +0.8% ⚪ ✅

🎯 Performance Summary

! 1 regression ⚠️
  30 unchanged ✅

🔍 Significant Changes (>10%)

  • Memory Use Parallel Chains: 11.7% 🐌 more memory

🐍 Python Version 3.11.17

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant