gossan-classify 0.3.3

Banner classification and service fingerprinting for Gossan
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

# gossan-classify

Banner classification and service fingerprinting for Gossan.

Takes raw TCP banner responses and classifies them into:
- Service type (HTTP, SSH, FTP, MySQL, Redis, etc.)
- Version extraction (Apache 2.4.52, OpenSSH 8.9, etc.)
- OS hints from protocol behavior
- Security posture signals (default creds, debug mode, info leaks)

## Usage

```rust
use gossan_classify::BannerClassifier;

let c = BannerClassifier::new();
let matches = c.classify("Server: nginx/1.25.3\r\n");
for m in matches {
    println!("{}: {} (confidence {:.0}%)", m.rule_id, m.service, m.confidence * 100.0);
}
```

## Extending

Built-in rules ship as Rust constants in `src/rules.rs`. Community rules
load from a TOML directory at runtime, see the per-rule contract in
`GOSSAN_DEPTH.md` Section B6 for the schema.

## License

MIT