CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-03 22:29:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove the first-generation OS detection and nmap-os-fingerprints.

Browse source
This commit is contained in:
david 2007-11-03 01:31:02 +00:00
parent 9efe18921d
commit 50c4981934
18 changed files with 38 additions and 23056 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG
View file

@ -13,6 +13,8 @@ o There is no longer any artificial limit on the number of ports or
nmap -PAhttp,https target
nmap -PU'[-]' target
o Removed the first-generation OS detection.
4.22SOC8
o Removed the old massping() system, since the functionality has now

1
Makefile.in
View file

@ -183,7 +183,6 @@ install-nmap: $(TARGET)
$(INSTALL) -c -m 644 docs/nmap.dtd $(DESTDIR)$(nmapdatadir)/
$(INSTALL) -c -m 644 nmap-services $(DESTDIR)$(nmapdatadir)/
$(INSTALL) -c -m 644 nmap-rpc $(DESTDIR)$(nmapdatadir)/
$(INSTALL) -c -m 644 nmap-os-fingerprints $(DESTDIR)$(nmapdatadir)/
$(INSTALL) -c -m 644 nmap-os-db $(DESTDIR)$(nmapdatadir)/
$(INSTALL) -c -m 644 nmap-service-probes $(DESTDIR)$(nmapdatadir)/
$(INSTALL) -c -m 644 nmap-protocols $(DESTDIR)$(nmapdatadir)/

1
NmapOps.cc
View file

@ -203,7 +203,6 @@ void NmapOps::Initialize() {
interactivemode = 0;
ping_group_sz = PING_GROUP_SZ;
generate_random_ips = 0;
reference_FPs1 = NULL;
reference_FPs = NULL;
magic_port = 33000 + (get_random_uint() % 31000);
magic_port_set = 0;

1
NmapOps.h
View file

@ -185,7 +185,6 @@ class NmapOps {
int interactivemode;
int ping_group_sz;
int generate_random_ips; /* -iR option */
FingerPrintDB *reference_FPs1; /* Used in the old OS scan system. */
FingerPrintDB *reference_FPs; /* Used in the new OS scan system. */
u16 magic_port;
unsigned short magic_port_set; /* Was this set by user? */

4
docs/nmap.usage.txt
View file

@ -48,9 +48,7 @@ SCRIPT SCAN:
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
OS DETECTION:
-O: Enable OS detection (try 2nd generation w/fallback to 1st)
-O2: Only use the new OS detection system (no fallback)
-O1: Only use the old (1st generation) OS detection system
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:

54
docs/refguide.xml
View file

@ -1726,7 +1726,7 @@ way.</para>
in the responses. After performing dozens of tests such as TCP
ISN sampling, TCP options support and ordering, IP ID sampling, and
the initial window size check, Nmap compares the results to its
<filename>nmap-os-fingerprints</filename> database of more than 1500 known
<filename>nmap-os-db</filename> database of more than 800 known
OS fingerprints and prints out the OS details if there is a match.
Each fingerprint includes a freeform textual description of the
OS, and a classification which provides the vendor name
@ -1782,51 +1782,7 @@ way.</para>
<para>Enables OS detection, as discussed above.
Alternatively, you can use <option>-A</option> to enable
OS detection along with other things. 2nd generation OS
detection is tried first. If that fails, Nmap will either
print out the host fingerprint and ask you to submit it (if
you are certain about what the target host is running), or
Nmap will fall back to the 1st generation OS detection
system in case its larger database has a match.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>-O2</option> (2nd Generation OS Detection Only)
<indexterm><primary>-O2</primary></indexterm>
</term>
<listitem>
<para>Enables 2nd generation OS detection, but never falls
back to the old (1st generation) system, even if it fails to
find any match. This saves time and can reduce the number
of packets sent to each target.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>-O1</option> (1st Generation OS Detection Only)
<indexterm><primary>-O1</primary></indexterm>
</term>
<listitem>
<para>Tells Nmap to only use the old OS detection system.
If <option>-O2</option> just gives you a fingerprint to
submit, but you don't know what OS the target is running,
try <option>-O1</option>. But in that case, <emphasis
role="bold">don't submit the fingerprint</emphasis> as you
don't know for sure whether <option>-O1</option> guessed
correctly. If it was perfect, we wouldn't have bothered to
create <option>-O2</option>.</para>
<para>This option, and all other vestiges of the old OS
detection system, will likely be removed in 2007.</para>
OS detection along with other things.</para>
</listitem>
</varlistentry>
@ -1884,9 +1840,7 @@ way.</para>
may be set to allow even more retries when conditions are
favorable. This is rarely done, except to generate better
fingerprints for submission and integration into the Nmap OS
database. This option only affects second generation OS
detection (<option>-O2</option>, the default) and not the
old system (<option>-O1</option>).</para>
database.</para>
</listitem>
</varlistentry>
@ -3381,7 +3335,7 @@ overwhelming requests. Specify <option>--open</option> to only see
<filename>nmap-protocols</filename>,
<filename>nmap-rpc</filename>,
<filename>nmap-mac-prefixes</filename>, and
<filename>nmap-os-fingerprints</filename>. If the
<filename>nmap-os-db</filename>. If the
location of any of these files has been specified (using the
<option>--servicedb</option> or <option>--versiondb</option> options),
that location is used for that file. After that, Nmap

4
global_structures.h
View file

@ -191,14 +191,14 @@ typedef struct FingerTest {
char *OS_name;
struct OS_Classification OS_class[MAX_OS_CLASSIFICATIONS_PER_FP];
int num_OS_Classifications;
int line; /* For reference prints, the line # in nmap-os-fingerprints */
int line; /* For reference prints, the line # in nmap-os-db */
const char *name;
struct AVal *results;
struct FingerTest *next;
} FingerPrint;
/* This structure contains the important data from the fingerprint
database (nmap-os-db or nmap-os-fingerprints) */
database (nmap-os-db) */
typedef struct FingerPrintDB {
FingerPrint **prints;
FingerPrint *MatchPoints;

6
idle_scan.cc
View file

@ -105,7 +105,7 @@
#include "idle_scan.h"
#include "timing.h"
#include "osscan.h"
#include "osscan2.h"
#include "nmap.h"
#include "NmapOps.h"
#include "services.h"
@ -305,7 +305,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
struct ip *ip;
struct tcp_hdr *tcp;
int distance;
u16 ipids[NUM_IPID_PROBES];
int ipids[NUM_IPID_PROBES];
u8 probe_returned[NUM_IPID_PROBES];
struct route_nfo rnfo;
assert(proxy);
@ -504,7 +504,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
proxy->host.HostName(), proxy->host.targetipstr(),
proxy->probe_port);
proxy->seqclass = ipid_sequence(probes_returned, ipids, 0);
proxy->seqclass = get_ipid_sequence(probes_returned, ipids, 0);
switch(proxy->seqclass) {
case IPID_SEQ_INCR:
case IPID_SEQ_BROKEN_INCR:

2
mswin32/Makefile
View file

@ -21,7 +21,7 @@ winbuild:
$(MAKENSIS) winpcap/winpcap-nmap.nsi
rm -rf nmap-$(NMAP_VERSION)
mkdir nmap-$(NMAP_VERSION)
cd Release && cp -r ../../CHANGELOG ../../COPYING nmap-mac-prefixes nmap-os-fingerprints nmap-os-db nmap-protocols nmap-rpc nmap-service-probes nmap-services nmap.exe nmap.xsl ../nmap_performance.reg ../../README-WIN32 ../nmap-$(NMAP_VERSION)/
cd Release && cp -r ../../CHANGELOG ../../COPYING nmap-mac-prefixes nmap-os-db nmap-protocols nmap-rpc nmap-service-probes nmap-services nmap.exe nmap.xsl ../nmap_performance.reg ../../README-WIN32 ../nmap-$(NMAP_VERSION)/
mkdir nmap-$(NMAP_VERSION)/scripts
cd Release && cp -f $(NSE_FILES) ../nmap-$(NMAP_VERSION)/scripts/
mkdir nmap-$(NMAP_VERSION)/nselib

24
mswin32/nmap.vcproj
View file

@ -719,30 +719,6 @@
/>
</FileConfiguration>
</File>
<File
RelativePath="..\nmap-os-fingerprints"
>
<FileConfiguration
Name="Debug|Win32"
>
<Tool
Name="VCCustomBuildTool"
Description="Copying $(InputName) to output directory..."
CommandLine="copy /y &quot;$(InputPath)&quot; &quot;$(TargetDir)$(InputName)&quot; &gt; nul&#x0D;&#x0A;"
Outputs="$(TargetDir)$(InputName)"
/>
</FileConfiguration>
<FileConfiguration
Name="Release|Win32"
>
<Tool
Name="VCCustomBuildTool"
Description="Copying $(InputName) to output directory..."
CommandLine="copy /y &quot;$(InputPath)&quot; &quot;$(TargetDir)$(InputName)&quot; &gt; nul&#x0D;&#x0A;"
Outputs="$(TargetDir)$(InputName)"
/>
</FileConfiguration>
</File>
<File
RelativePath="..\nmap-protocols"
>

2
mswin32/nsis/Nmap.nsi
View file

@ -114,7 +114,6 @@ Section "Nmap Core Files" SecCore
File ..\..\CHANGELOG
File ..\..\COPYING
File ..\..\nmap-mac-prefixes
File ..\..\nmap-os-fingerprints
File ..\..\nmap-os-db
File ..\..\nmap-protocols
File ..\..\nmap-rpc
@ -207,7 +206,6 @@ Section "Uninstall"
Delete "$INSTDIR\CHANGELOG"
Delete "$INSTDIR\COPYING"
Delete "$INSTDIR\nmap-mac-prefixes"
Delete "$INSTDIR\nmap-os-fingerprints"
Delete "$INSTDIR\nmap-os-db"
Delete "$INSTDIR\nmap-protocols"
Delete "$INSTDIR\nmap-rpc"

21671
nmap-os-fingerprints
View file

File diff suppressed because it is too large Load diff

28
nmap.cc
View file

@ -264,9 +264,7 @@ printf("%s %s ( %s )\n"
" --script-updatedb: Update the script database.\n"
#endif
"OS DETECTION:\n"
" -O: Enable OS detection (try 2nd generation w/fallback to 1st)\n"
" -O2: Only use the new OS detection system (no fallback)\n"
" -O1: Only use the old (1st generation) OS detection system\n"
" -O: Enable OS detection\n"
" --osscan-limit: Limit OS detection to promising targets\n"
" --osscan-guess: Guess OS more aggressively\n"
"TIMING AND PERFORMANCE:\n"
@ -1002,15 +1000,12 @@ int nmap_main(int argc, char *argv[]) {
break;
case 'n': o.noresolve++; break;
case 'O':
if (!optarg)
o.osscan = OS_SCAN_DEFAULT;
if (!optarg || *optarg == '2')
o.osscan = OS_SCAN_DEFAULT;
else if (*optarg == '1')
o.osscan = OS_SCAN_SYS_1_ONLY;
else if (*optarg == '2')
o.osscan = OS_SCAN_SYS_2_ONLY;
else {
fatal("Use -O for new osscan engine, -O1 for old osscan engine.");
}
fatal("First-generation OS detection (-O1) is no longer supported. Use -O instead.");
else
fatal("Unknown argument to -O.");
break;
case 'o':
normalfilename = optarg;
@ -1221,9 +1216,7 @@ int nmap_main(int argc, char *argv[]) {
if (pre_host_timeout != -1) o.host_timeout = pre_host_timeout;
if (o.osscan == OS_SCAN_SYS_1_ONLY)
o.reference_FPs1 = parse_fingerprint_reference_file("nmap-os-fingerprints");
else if (o.osscan == OS_SCAN_DEFAULT || o.osscan == OS_SCAN_SYS_2_ONLY)
if (o.osscan == OS_SCAN_DEFAULT)
o.reference_FPs = parse_fingerprint_reference_file("nmap-os-db");
o.ValidateOptions();
@ -1736,7 +1729,7 @@ int nmap_main(int argc, char *argv[]) {
service_scan(Targets);
}
if (o.osscan == OS_SCAN_DEFAULT || o.osscan == OS_SCAN_SYS_2_ONLY)
if (o.osscan == OS_SCAN_DEFAULT)
os_scan2(Targets);
if(o.traceroute) {
@ -1753,11 +1746,6 @@ int nmap_main(int argc, char *argv[]) {
* host rather than port list the user specified.
*/
if (o.servicescan || o.rpcscan) pos_scan(currenths, NULL, 0, RPC_SCAN);
// Should be host parallelized. Though rarely takes a huge amt. of time.
if (o.osscan == OS_SCAN_SYS_1_ONLY) {
os_scan(currenths);
}
}
#ifndef NOLUA
if(o.script || o.scriptversion) {

2
nmap.h
View file

@ -350,8 +350,6 @@ void *realloc();
/* OS scan */
#define OS_SCAN_DEFAULT 9
#define OS_SCAN_SYS_1_ONLY 1
#define OS_SCAN_SYS_2_ONLY 2
/* How many syn packets do we send to TCP sequence a host? */
#define NUM_SEQ_SAMPLES 6

1248
osscan.cc
View file

File diff suppressed because it is too large Load diff

10
osscan.h
View file

@ -119,7 +119,6 @@
/* moved to global_structures.h */
/********************** PROTOTYPES ***********************************/
int os_scan(Target *target);
char *fp2ascii(FingerPrint *FP);
/* Parses a single fingerprint from the memory region given. If a
@ -159,14 +158,5 @@ void match_fingerprint(FingerPrint *FP, FingerPrintResults *FPR,
void freeFingerPrint(FingerPrint *FP);
char *mergeFPs(FingerPrint *FPs[], int numFPs, bool isGoodFP, const struct in_addr * const addr, int distance, const u8 *mac, int openTcpPort, int closedTcpPort, int closedUdpPort, bool wrapit);
/* This function takes an array of "numSamples" IP IDs and analyzes
them to determine their sequenceability classification. It returns
one of the IPID_SEQ_* classifications defined in nmap.h . If the
function cannot determine the sequence, IPID_SEQ_UNKNOWN is returned.
This islocalhost argument is a boolean specifying whether these
numbers were generated by scanning localhost. NOTE: the "ipids" argument
may be modified if localhost is set to true. */
int ipid_sequence(int numSamples, u16 *ipids, int islocalhost);
#endif /*OSSCAN_H*/

33
osscan2.cc
View file

@ -3124,6 +3124,13 @@ int get_initial_ttl_guess(u8 ttl) {
return 255;
}
/* This function takes an array of "numSamples" IP IDs and analyzes
them to determine their sequenceability classification. It returns
one of the IPID_SEQ_* classifications defined in nmap.h . If the
function cannot determine the sequence, IPID_SEQ_UNKNOWN is returned.
This islocalhost argument is a boolean specifying whether these
numbers were generated by scanning localhost. NOTE: the "ipids" argument
may be modified if localhost is set to true. */
int get_ipid_sequence(int numSamples, int *ipids, int islocalhost) {
u16 ipid_diffs[32];
int i;
@ -3752,24 +3759,6 @@ static void printFP(OsScanInfo *OSI) {
}
}
static void doOsScan1(OsScanInfo *OSI) {
list<HostOsScanInfo *>::iterator hostI;
if(!o.reference_FPs1)
o.reference_FPs1 = parse_fingerprint_reference_file("nmap-os-fingerprints");
for(hostI = OSI->incompleteHosts.begin();
hostI != OSI->incompleteHosts.end(); hostI++) {
/* If the fingerprint found was so good that we want the user to
submit it, don't do gen1 os scan because the results might bias
the user into a wrong submission (or make the user less likely
to actually submit */
if ((*hostI)->target->FPR->OmitSubmissionFP()) {
os_scan((*hostI)->target);
}
}
}
/* Goes through every unmatched host in OSI. If a host has completed
the maximum number of OS detection tries allowed for it without
matching, it is transferred to the passed in unMatchedHosts list.
@ -3875,14 +3864,6 @@ static int os_scan_2(vector<Target *> &Targets) {
Normally let output.cc to print the FP. */
if(o.debugging > 1)
printFP(OSI);
/*
* For the incomplete hosts, we fall back on the former os_scan engine which has
* a larger os-fingerprint db.
*/
if(o.osscan != OS_SCAN_SYS_2_ONLY) {
doOsScan1(OSI);
}
}
delete HOS;

1
scripts/script.db
View file

@ -38,6 +38,7 @@ Entry{ category = "demo", filename = "showSMTPVersion.nse" }
Entry{ category = "demo", filename = "showSSHVersion.nse" }
Entry{ category = "version", filename = "skype_v2-version.nse" }
Entry{ category = "backdoor", filename = "strangeSMTPport.nse" }
Entry{ category = "demo", filename = "test.nse" }
Entry{ category = "vulnerability", filename = "xamppDefaultPass.nse" }
Entry{ category = "intrusive", filename = "zoneTrans.nse" }
Entry{ category = "discovery", filename = "zoneTrans.nse" }