CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-28 04:25:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Move some script ideas to SecWiki.

Browse source
This commit is contained in:
david 2011-06-22 07:36:47 +00:00
parent f33e078d39
commit 24fcb630e0
1 changed files with 38 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

69
todo/nmap.txt
View file

@ -76,37 +76,6 @@ o Script review:
http://seclists.org/nmap-dev/2011/q2/307.
- Outlook web address. http://seclists.org/nmap-dev/2011/q2/296.
o Move these prerule/postrule script ideas to secwiki script idea page
if appropriate (with a bit more details):
o AS Number to IP ranges: http://seclists.org/nmap-dev/2010/q2/101
o DNS service discovery (Bonjour): http://en.wikipedia.org/wiki/Bonjour_%28software%29
o Netbios Name Service
o DHCP broadcast requests
o Postrules could be created which give final reports/statistics or
other useful output. Like a reverse-index, which shows all the open
port numbers individually and the hosts which had that port open
(e.g. so you can see all the ssh servers at once, etc.)
Admittedly you can do that pretty easy with Zenmap instead.
o We could have a prerule sniffer script which uses pcap to sniff
traffic for some short configurable amount of time and then adds the
discovered hosts to the target list.
o We could have a script which takes traceroute results and adds them to the target list.
o [NSE] Add these ideas to secwiki script ideas page if appropriate
(with a bit more details):
o Windows system logs (like sysinternals' psloglist)
o Services (like sysinternals' psservice)
o A script (or modification to smb-check-vulns) to
detect this MSRPC vulnerability:
http://seclists.org/fulldisclosure/2010/Aug/122
o BasicHTML/XML parser library? For example, Sven Klemm wrote a script
which uses libxml2: http://seclists.org/nmap-dev/2008/q3/0462.html.
And here is one by Duart Silva using Expat:
http://seclists.org/nmap-dev/2009/q3/1093.
o Add detection of duplicate machines via IP.ID technique.
Maybe I should use uptime timestamps too. Oh, and MAC addresses
too. Our SSH host key script is useful for this as well.
o Add IPv6 subnet/pattern support like we offer for IPv4.
o Obviously we can't go scanning a /48 in IPv6, but small subnets do
@ -702,6 +671,44 @@ o random tip database
DONE:
o Move these prerule/postrule script ideas to secwiki script idea page
if appropriate (with a bit more details):
o AS Number to IP ranges: http://seclists.org/nmap-dev/2010/q2/101
In progress.
o DNS service discovery (Bonjour): http://en.wikipedia.org/wiki/Bonjour_%28software%29
Present as dns-service-discovery.nse.
o Netbios Name Service
Already present as broadcast-netbios-master-browser.nse?
o DHCP broadcast requests
Present as dhcp-discover.nse.
o Postrules could be created which give final reports/statistics or
other useful output. Like a reverse-index, which shows all the open
port numbers individually and the hosts which had that port open
(e.g. so you can see all the ssh servers at once, etc.)
Admittedly you can do that pretty easy with Zenmap instead.
Have a few of these: ssh-hostkey and upcoming creds-summary.
o We could have a prerule sniffer script which uses pcap to sniff
traffic for some short configurable amount of time and then adds the
discovered hosts to the target list.
Already present as targets-sniffer.nse.
o We could have a script which takes traceroute results and adds them to the target list.
Already present as targets-traceroute.nse.
o [NSE] Add these ideas to secwiki script ideas page if appropriate
(with a bit more details):
o Windows system logs (like sysinternals' psloglist)
o Services (like sysinternals' psservice)
o A script (or modification to smb-check-vulns) to
detect this MSRPC vulnerability:
http://seclists.org/fulldisclosure/2010/Aug/122
o BasicHTML/XML parser library? For example, Sven Klemm wrote a script
which uses libxml2: http://seclists.org/nmap-dev/2008/q3/0462.html.
And here is one by Duart Silva using Expat:
http://seclists.org/nmap-dev/2009/q3/1093.
o Add detection of duplicate machines via IP.ID technique.
Maybe I should use uptime timestamps too. Oh, and MAC addresses
too. Our SSH host key script is useful for this as well.
o Look into iplog ( http://ojnk.sourceforge.net/ ) -z option which is
supposed to fool OS detection.
o The software is no longer maintained, so we're not going to worry