F5 Big-IP Location Field in Header

[DGplex-jordan]

Request for new fingerprint(s) for a product
The product is F5 BIG-IP Load Balancer

Provide details about the product
The HTTPS protocol can be used to fingerprint the device

**What information can be collected on each protocol? **
HTTP banner -> Location: /tmui/login.jsp

What request, command, and/or payload can be used to retrieve information on each protocol?

HTTP HEAD /
< HTTP/1.1 302 Found

< Date: Wed, 14 Jan 2026 03:56:50 GMT

< Server: Apache

< X-Frame-Options: SAMEORIGIN

< Strict-Transport-Security: max-age=16070400; includeSubDomains

< Location: /tmui/login.jsp

< Content-Length: 199

< Content-Type: text/html; charset=iso-8859-1

Example banner(s) with specific version info
There is no version information, but only F5 BIG-IP has this field in the HEADERS

Location: /tmui/login.jsp

Potential XML File
I have used the http_header.location tag expecting that Recog will have the extensibility to understand this and look for Location: values...just as http_header.server looks for Server:.

I also wasn't sure if I should use service.vendor or instead name="os.vendor" value ="F5" and name="os.product" value="BIG-IP". I will leave the decision up to you.

The reason is the service is most likely Apache as can be seen in the Server: field above, but additional footprinting of Location: discovers that the device is F5.

<?xml version="1.0"?>
<fingerprints matches="http_header.location" protocol="http" database_type="service" preference="0.85">
<!-- HTTP Location headers are matched against these patterns to fingerprint services/devices -->

<fingerprint pattern="^/tmui/login\.jsp(?:[/?#].*)?$">
  <description>F5 BIG-IP TMUI Login Page Redirect</description>
  <example>/tmui/login.jsp</example>
  <example>/tmui/login.jsp?lang=en</example>
  <param pos="0" name="service.vendor" value="F5"/>
  <param pos="0" name="service.product" value="BIG-IP"/>
  <param pos="0" name="service.device" value="Load Balancer"/>
  <param pos="0" name="service.function" value="Management Interface"/>
 <param pos="0" name="service.cpe23" value="cpe:/a:f5:big-ip_local_traffic_manager:-"/>
  <param pos="0" name="service.certainty" value="0.95"/>
</fingerprint>

</fingerprints>