TODO changes from chat w/David

This commit is contained in:
fyodor 2009-07-28 22:33:40 +00:00
parent 15e2997e66
commit d29a3b7c36
3 changed files with 2472 additions and 1361 deletions

View file

@ -5,17 +5,6 @@ o Move nmap/docs/TODO into its own todo directory (probably nmap/todo)
to migrate theirs there. Unlike the status directory, /nmap/todo
would be readible by anyone. [Fyodor]
o Ncat SSLv2 issues. See
http://seclists.org/nmap-dev/2009/q1/0319.html. A big part of it is
done, which was enhanced version detection probes to detect more SSL
servers, The defect that remains is that Nsock can't connect to a
small fraction of servers (including some of the ones detected by
the new version probe). They are the servers that do only SSLv3 or
TLSv1 and don't respond to a SSLv2-compatible ClientHello. Even
though most servers don't support SSLv2, they usually respond to the
ClientHello and just don't offer any SSLv2 features. [David/Venkat
working on this]
o Device categorization improvements
o Examine Nmap's device categorization in nmap-os-deb and
nmap-service-probes. Decide if some small categories which have
@ -43,12 +32,9 @@ o After the new -sn and -PN options (added to SVN around 7/20, just
"disable portscan" than ping only. For example, you can also use
NSE, traceroute, etc. [David]
o [Zenmap] The Search dialogue is helpful for finding a certain scan
you've performed recently, but we should probably also offer a similar
function for searching for certain applications/hosts within a scan
(e.g. find all the hosts running Apache). This new functionality
might be a find option or some other mechanism rather than being
part of the Search dialogue proper.
o [Zenmap] When the inventory is changed, the current host/service selection is
forgotten and the Ports / Hosts tab is switched to hosts mode. It should
remember your current selection and not change the view.
o [NSE] Optimize NSE Performance--e.g. measure the current performance and
see what can be improved in terms of scheduling scan threads,
@ -64,10 +50,6 @@ o Seriously consider making --traceroute work even when we haven't
Even if the host is down or something, we usually get some useful
hop information.
o Ncat should give it's ethernet cat ASCII logo after
configure--similar to the way that Nmap, Ncrack, and Nping
do. [David/SoC]
o Ndiff man page should be built from XML source whenever a release is
done, as ncat/zenmap/nmap man pages are. [Fyodor]
@ -106,10 +88,8 @@ o Consider moving UDP ping/portscan payloads from payload.cc to a
o Some probes may have to come from a specific source port.
o TFTP sends its response from an ephemeral port, not port 69.
o Look at etc/payloads.conf in unicornscan-0.4.7 and see if they have
any which we don't have, but should, for our version detection.
They have a decent collection there. KX sent some other programs we
should look at too. [David]
o Consider what new UDP payloads we might want to add. David has many
ideas at: http://seclists.org/nmap-dev/2009/q3/0290.html
o [Ncat] This may sound rediculous, but I'm starting to think that
Ncat should offer a very simple built-in http server (e.g. for simply
@ -134,9 +114,9 @@ o [Web] Consider adding training/introduction videos to the Nmap site
o Here's an example product page with lots of videos (we may not go
that far): http://www.splunk.com/product
o [Ncat] In verbose mode, I'd like to see clock time and maybe in/out
traffic stats when a client connection ends. Maybe it could use a
format similar to what Nmap provides. [David/Venkat]
o [Ncat] In verbose mode, I'd like to see clock time (duration) and
maybe in/out traffic stats when a client connection ends. Maybe it
could use a format similar to what Nmap provides. [David/Venkat]
o Change Nsock to give an error if you try to FD_SET a fd larger than
FD_SETSIZE. [Brandon]
@ -313,12 +293,6 @@ o [NSE] Security Review
address the known risk of malicious scripts too.
o Consider that NSE runs scripts as root
o [Ncat] Support SCTP now that Nmap does.
- See client support patch by Daniel Roethlisberger:
http://seclists.org/nmap-dev/2009/q2/0609.html
- Server support?
- Daniel has a patch, David looking to apply once an nsock thing is fixed.
o Add Nmap web board.
o Create Nmap wiki
@ -432,6 +406,7 @@ o Consider rethinking Nmap's -s* syntax for specifing scan types
o libnmap organization for UNIX and Windows
o Then change Nmap and Zenmap to simply call this library
o It is interesting to look at: http://www.gnupg.org/gpgme.html
o Perhaps --traceroute should set currenths->distance because right
now, I do an -O scan against scanme.nmap.org, and it does not figure
@ -599,6 +574,39 @@ o random tip database
DONE:
o [Ncat] Support SCTP now that Nmap does.
- See client support patch by Daniel Roethlisberger:
http://seclists.org/nmap-dev/2009/q2/0609.html
- Server support?
- Daniel has a patch, David looking to apply once an nsock thing is fixed.
o Look at etc/payloads.conf in unicornscan-0.4.7 and see if they have
any which we don't have, but should, for our version detection.
They have a decent collection there. KX sent some other programs we
should look at too. [David]
o Ncat should give it's ethernet cat ASCII logo after
configure--similar to the way that Nmap, Ncrack, and Nping
do. [David/SoC]
o [Zenmap] The Search dialogue is helpful for finding a certain scan
you've performed recently, but we should probably also offer a similar
function for searching for certain applications/hosts within a scan
(e.g. find all the hosts running Apache). This new functionality
might be a find option or some other mechanism rather than being
part of the Search dialogue proper.
o Ncat SSLv2 issues. See
http://seclists.org/nmap-dev/2009/q1/0319.html. A big part of it is
done, which was enhanced version detection probes to detect more SSL
servers, The defect that remains is that Nsock can't connect to a
small fraction of servers (including some of the ones detected by
the new version probe). They are the servers that do only SSLv3 or
TLSv1 and don't respond to a SSLv2-compatible ClientHello. Even
though most servers don't support SSLv2, they usually respond to the
ClientHello and just don't offer any SSLv2 features. [David/Venkat
working on this]
o Deadlock identification and correction:
o Plan of action: implement freeing of script mutexes when scripts
exit without freeing them (done and in /nmap now). And then if it

File diff suppressed because it is too large Load diff

View file

@ -1,161 +1,13 @@
'\" t
.\" Title: zenmap
.\" Author: [see the "Authors" section]
.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
.\" Date: 06/13/2009
.\" Generator: DocBook XSL-NS Stylesheets v1.74.3 <http://docbook.sf.net/>
.\" Date: 07/24/2009
.\" Manual: Zenmap Reference Guide
.\" Source: Zenmap
.\" Language: English
.\"
.TH "ZENMAP" "1" "06/13/2009" "Zenmap" "Zenmap Reference Guide"
.\" -----------------------------------------------------------------
.\" * (re)Define some macros
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" toupper - uppercase a string (locale-aware)
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de toupper
.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
\\$*
.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" SH-xref - format a cross-reference to an SH section
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de SH-xref
.ie n \{\
.\}
.toupper \\$*
.el \{\
\\$*
.\}
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" SH - level-one heading that works better for non-TTY output
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de1 SH
.\" put an extra blank line of space above the head in non-TTY output
.if t \{\
.sp 1
.\}
.sp \\n[PD]u
.nr an-level 1
.set-an-margin
.nr an-prevailing-indent \\n[IN]
.fi
.in \\n[an-margin]u
.ti 0
.HTML-TAG ".NH \\n[an-level]"
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
\." make the size of the head bigger
.ps +3
.ft B
.ne (2v + 1u)
.ie n \{\
.\" if n (TTY output), use uppercase
.toupper \\$*
.\}
.el \{\
.nr an-break-flag 0
.\" if not n (not TTY), use normal case (not uppercase)
\\$1
.in \\n[an-margin]u
.ti 0
.\" if not n (not TTY), put a border/line under subheading
.sp -.6
\l'\n(.lu'
.\}
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" SS - level-two heading that works better for non-TTY output
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de1 SS
.sp \\n[PD]u
.nr an-level 1
.set-an-margin
.nr an-prevailing-indent \\n[IN]
.fi
.in \\n[IN]u
.ti \\n[SN]u
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.ps \\n[PS-SS]u
\." make the size of the head bigger
.ps +2
.ft B
.ne (2v + 1u)
.if \\n[.$] \&\\$*
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" BB/BE - put background/screen (filled box) around block of text
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de BB
.if t \{\
.sp -.5
.br
.in +2n
.ll -2n
.gcolor red
.di BX
.\}
..
.de EB
.if t \{\
.if "\\$2"adjust-for-leading-newline" \{\
.sp -1
.\}
.br
.di
.in
.ll
.gcolor
.nr BW \\n(.lu-\\n(.i
.nr BH \\n(dn+.5v
.ne \\n(BHu+.5v
.ie "\\$2"adjust-for-leading-newline" \{\
\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
.\}
.el \{\
\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
.\}
.in 0
.sp -.5v
.nf
.BX
.in
.sp .5v
.fi
.\}
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" BM/EM - put colored marker in margin next to block of text
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de BM
.if t \{\
.br
.ll -2n
.gcolor red
.di BX
.\}
..
.de EM
.if t \{\
.br
.di
.ll
.gcolor
.nr BH \\n(dn
.ne \\n(BHu
\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
.in 0
.nf
.BX
.in
.fi
.\}
..
.TH "ZENMAP" "1" "07/24/2009" "Zenmap" "Zenmap Reference Guide"
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
@ -166,36 +18,91 @@
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "Name"
.SH "NAME"
zenmap \- Graphical Nmap frontend and results viewer
.SH "Synopsis"
.fam C
.HP \w'\fBzenmap\fR\ 'u
\fBzenmap\fR [\fIoptions\fR] [\fIresults\ file\fR]
.fam
.SH "Description"
.SH "SYNOPSIS"
.HP \w'\fBzenmap\fR\ 'u
\fBzenmap\fR
[\fIoptions\fR]
[\fIresults\ file\fR]
.SH "DESCRIPTION"
<web>
.if n \{\
.sp
.\}
.RS 4
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
.PP
This document describes the very latest version of Zenmap available from
\m[blue]\fB\%http://nmap.org/download.html\fR\m[]\&. Please ensure you are using the latest version before reporting that a feature doesn\'t work as described\&.
.sp .5v
.RE
</web>
.PP
Zenmap is a multi\-platform graphical Nmap frontend and results viewer\&. Zenmap aims to make Nmap easy for beginners to use while giving experienced Nmap users advanced features\&. Frequently used scans can be saved as profiles to make them easy to run repeatedly\&. A command creator allows interactive creation of Nmap command lines\&. Scan results can be saved and viewed later\&. Saved scan results can be compared with one another to see how they differ\&. The results of recent scans are stored in a searchable database\&.
.PP
.PP
This man page only describes the few Zenmap command\-line options and some critical notes\&. A much more detailed Zenmap User\'s Guide is available at
\m[blue]\fB\%http://nmap.org/book/zenmap.html\fR\m[]\&. Other documentation and information is available from the Zenmap web page at
\m[blue]\fB\%http://nmap.org/zenmap/\fR\m[]\&.
.SH "Options Summary"
.PP
.SH "OPTIONS SUMMARY"
.PP
\fB\-f\fR, \fB\-\-file \fR\fB\fIresults file\fR\fR
.RS 4
Open the given results file for viewing\&. The results file may be an Nmap XML output file (\FC\&.xml\F[], as produced by
\fBnmap \-oX\fR) or a Umit scan results file (\FC\&.usr\F[])\&. This option may be given more than once\&.
.RE
.PP
Open the given results file for viewing\&. The results file may be an Nmap XML output file (\&.xml, as produced by
\fBnmap \-oX\fR) or a Umit scan results file (\&.usr)\&. This option may be given more than once\&.
.RE
.PP
\fB\-h\fR, \fB\-\-help\fR
.RS 4
Show a help message and exit\&.
.RE
.PP
Show a help message and exit\&.
.RE
.PP
\fB\-n\fR, \fB\-\-nmap \fR\fB\fINmap command line\fR\fR
.RS 4
Run the given Nmap command within the Zenmap interface\&. After
Run the given Nmap command within the Zenmap interface\&. After
\fB\-n\fR
or
\fB\-\-nmap\fR, every remaining command line argument is read as the command line to execute\&. This means that
@ -206,63 +113,133 @@ must be given last, after any other options\&. Note that the command line must i
\fBnmap\fR
executable name:
\fBzenmap \-n nmap \-sS target\fR\&.
.RE
.PP
.RE
.PP
\fB\-p\fR, \fB\-\-profile \fR\fB\fIprofile\fR\fR
.RS 4
Start with the given profile selected\&. The profile name is just a string:
\FC"Regular scan"\F[]\&. If combined with
Start with the given profile selected\&. The profile name is just a string:
"Regular scan"\&. If combined with
\fB\-t\fR, begin a scan with the given profile against the specified target\&.
.RE
.PP
.RE
.PP
\fB\-t\fR, \fB\-\-target \fR\fB\fItarget\fR\fR
.RS 4
Start with the given target\&. If combined with
Start with the given target\&. If combined with
\fB\-p\fR, begin a scan with the given profile against the specified target\&.
.RE
.PP
.RE
.PP
\fB\-v\fR, \fB\-\-verbose\fR
.RS 4
Increase verbosity (of Zenmap, not Nmap)\&. This option may be given multiple times to get even more verbosity\&.
.RE
.PP
Increase verbosity (of Zenmap, not Nmap)\&. This option may be given multiple times to get even more verbosity\&.
.RE
.PP
Any other arguments are taken to be the names of results files to open\&.
.SH "Environment Variables"
.PP
.SH "ENVIRONMENT VARIABLES"
.PP
\fBZENMAP_DEVELOPMENT\fR
.RS 4
Set
Set
\fBZENMAP_DEVELOPMENT\fR
to disable automatic crash reporting\&.
.RE
.SH "Bugs"
.PP
.RE
.SH "BUGS"
.PP
Like their authors, Nmap and Zenmap aren\(cqt perfect\&. But you can help make them better by sending bug reports or even writing patches\&. If Nmap or Zenmap doesn\(cqt behave the way you expect, first upgrade to the latest version available from
\m[blue]\fB\%http://nmap.org\fR\m[]\&. If the problem persists, do some research to determine whether it has already been discovered and addressed\&. Try Googling the error message or browsing the
nmap\-dev
archives at
\m[blue]\fB\%http://seclists.org/\fR\m[]\&. Read this full manual page as well\&. If nothing comes of this, mail a bug report to
\FCnmap\-dev@insecure\&.org\F[]\&. Please include everything you have learned about the problem, as well as what version of Zenmap you are running and what operating system version it is running on\&. Problem reports and Zenmap usage questions sent to nmap\-dev@insecure\&.org are far more likely to be answered than those sent to Fyodor directly\&.
.PP
nmap\-dev@insecure\&.org\&. Please include everything you have learned about the problem, as well as what version of Zenmap you are running and what operating system version it is running on\&. Problem reports and Zenmap usage questions sent to nmap\-dev@insecure\&.org are far more likely to be answered than those sent to Fyodor directly\&.
.PP
Code patches to fix bugs are even better than bug reports\&. Basic instructions for creating patch files with your changes are available at
\m[blue]\fB\%http://nmap.org/data/HACKING\fR\m[]\&. Patches may be sent to
nmap\-dev
(recommended) or to Fyodor directly\&.
.SH "History"
.PP
.SH "HISTORY"
.PP
Zenmap was originally derived from Umit, an Nmap GUI created during the Google\-sponsored Nmap Summer of Code in 2005 and 2006\&. The primary author of Umit was Adriano Monteiro Marques\&. When Umit was modified and integrated into Nmap in 2007, it was renamed Zenmap\&.
.SH "Authors"
.SS "Nmap"
.PP
.SH "AUTHORS"
.SS "Nmap"
.PP
Fyodor
\FCfyodor@insecure\&.org\F[]
fyodor@insecure\&.org
(\m[blue]\fB\%http://insecure.org\fR\m[])
.PP
.PP
Hundreds of people have made valuable contributions to Nmap over the years\&. These are detailed in the
\FCCHANGELOG\F[]
CHANGELOG
file which is distributed with Nmap and also available from
\m[blue]\fB\%http://nmap.org/changelog.html\fR\m[]\&.
.SS "Umit"
.PP
Zenmap is derived from the Umit Nmap frontend, which was started by Adriano Monteiro Marques as an Nmap/Google Summer of Code project (\FCpy\&.adriano@gmail\&.com\F[],
.SS "Umit"
.PP
Zenmap is derived from the Umit Nmap frontend, which was started by Adriano Monteiro Marques as an Nmap/Google Summer of Code project (py\&.adriano@gmail\&.com,
\m[blue]\fB\%http://www.umitproject.org\fR\m[])\&.