CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-06-24 18:18:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
nmap/scripts
History
david 5c85f224c0 Accuracy and speed improvements to irc-unrealircd-backdoor.nse. The main 
problem was that the timer was including the time taken by the server to
do reverse-DNS resolution and an ident lookup, before it handled the
magic "AB" sleep command. So if a server took 10 seconds to time out the
ident lookup, the time recorded would be 10 seconds greater than it
should have been. If the timeout was long enough, as server would be
reported as vulnerable even if not. To compensate for this, the delay
was set high, but false positives were still possible and this slowed
down the script.

First, remove the mutex that allowed only one instance of the script to
run at a time. The mutex was meant to provide more accurate timing, but
it wasn't really needed because scritp parallelism wasn't the cause of
inaccuracy.

Next, make sure the server is done sending its initialization messages
(and hence is done with its timeouts) before sending the magic "AB"
sleep command and starting the timer. This is done by sending an
innocuous TIME command immediately upon connection. This is partly
because comm.tryssl has to send something, and partly because we can
detect when the server has processed the TIME command by looking for a
message like ":hostname 451 TIME :You have not registered". Once this is
done, we start the timer and send the "AB" command. If we haven't gotten
a response to TIME in 60 seconds, go ahead and send the "AB" command
anyway.

Finally, reduce the delay to 8 seconds from 25. The delay only has to be
long enough to overcome any network delay, now that confounding timeouts
have been eliminated. In a test of around 600 hosts, the only times I
recorded were 0, 1, 8, and 9 seconds, so this looks like a good enough
safety margin.
2010-07-01 00:11:59 +00:00
..
afp-brute.nse Remove explicit timelimit checking from ms-sql-brute, pgsql-brute, 2010-04-16 02:11:12 +00:00
afp-path-vuln.nse Move some script description text out of the script output section and into the user summary 2010-05-24 03:21:49 +00:00
afp-serverinfo.nse o [NSE] Added the afp-serverinfo script that gets a hostname, IP 2010-03-30 19:26:23 +00:00
afp-showmount.nse o [NSE] Updated the AFP library to support several new AFP functions and added 2010-03-29 17:41:00 +00:00
asn-query.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
auth-owners.nse Use a looser match pattern for retrieving the owner out of the identd response. This patch was from Richard Sammet - http://seclists.org/nmap-dev/2009/q4/549 2009-11-30 05:58:01 +00:00
auth-spoof.nse Add an @output section to auth-spoof.nse contributed by Brandon Enright. 2010-04-13 02:36:56 +00:00
banner.nse canonicalize some license text that differed in whitespace or quote character or line-ending or (in a couple cases) the slightly older wording 2010-06-11 06:54:56 +00:00
citrix-brute-xml.nse Add the scripts 2009-12-14 07:30:38 +00:00
citrix-enum-apps-xml.nse Add the scripts 2009-12-14 07:30:38 +00:00
citrix-enum-apps.nse Another canonicalization fix (making the author line the same for scripts written by the same author -- among other minor benefits, makes it easy to count how many scripts each person has written) 2010-01-19 08:32:26 +00:00
citrix-enum-servers-xml.nse Add the scripts 2009-12-14 07:30:38 +00:00
citrix-enum-servers.nse Another canonicalization fix (making the author line the same for scripts written by the same author -- among other minor benefits, makes it easy to count how many scripts each person has written) 2010-01-19 08:32:26 +00:00
couchdb-databases.nse Fix NSEDoc. 2010-03-31 20:28:14 +00:00
couchdb-stats.nse Fix NSEDoc. 2010-03-31 20:28:14 +00:00
daap-get-library.nse Documented the daap_item_limit that limits the output of the daap-get-library script. Add changelog entries for r16568 2010-01-26 07:33:55 +00:00
daytime.nse Add @output sections to these scripts: 2010-03-31 21:45:21 +00:00
db2-brute.nse Fix some NSEDoc. 2010-06-24 17:01:55 +00:00
db2-das-info.nse Merge r18160:18278 from nmap-exp/djalal/nmap-nse/ to fix NSE not honoring the exclude directive bug. 2010-06-29 21:56:59 +00:00
db2-info.nse Merge r18160:18278 from nmap-exp/djalal/nmap-nse/ to fix NSE not honoring the exclude directive bug. 2010-06-29 21:56:59 +00:00
dhcp-discover.nse Fixed a bug in dhcp-discover -- the read_boolean() function appears to never have worked, but I didn't run into anything that returned a boolean value until Brandon tried running it. It now handles booleans properly, along with a lot of extra debug output (especially on -d2 and higher) 2010-04-07 21:47:22 +00:00
dns-cache-snoop.nse o [NSE] Added dns-cache-snoop.nse by Eugene Alexeev. This script does 2010-06-12 02:25:44 +00:00
dns-fuzz.nse Change these script arguments to use stdnse.parse_timespec: 2010-04-13 23:09:23 +00:00
dns-random-srcport.nse Moved some information from the license field of these two scripts to the description field. I felt this was a better place since the URL leads to a description of the service rather than license information 2010-06-11 06:49:15 +00:00
dns-random-txid.nse Moved some information from the license field of these two scripts to the description field. I felt this was a better place since the URL leads to a description of the service rather than license information 2010-06-11 06:49:15 +00:00
dns-recursion.nse Set the port state open when dns-resursion.nse gets a response. This 2010-05-03 15:20:25 +00:00
dns-service-discovery.nse Fixes crash when attempting to sort services that have no port. 2010-06-15 18:18:09 +00:00
dns-zone-transfer.nse canonicalize some license text that differed in whitespace or quote character or line-ending or (in a couple cases) the slightly older wording 2010-06-11 06:54:56 +00:00
finger.nse Add @output to finger.nse and telnet-brute.nse thanks to Gutek. 2010-03-31 23:25:39 +00:00
ftp-anon.nse Improved anonymous ftp detection. Now supports ACCT and has improved parsing of server responses. 2010-06-05 12:37:39 +00:00
ftp-bounce.nse canonicalize some license text that differed in whitespace or quote character or line-ending or (in a couple cases) the slightly older wording 2010-06-11 06:54:56 +00:00
ftp-brute.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
ftp-libopie.nse o [NSE] Added ftp-libopie.nse by Gutek. This script checks for an 2010-06-21 20:25:11 +00:00
html-title.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
http-auth.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
http-date.nse Move the format_difftime function out of http-date.nse and into 2010-01-06 20:43:24 +00:00
http-enum.nse Removed a duplicate require for stdnse. 2010-04-25 17:35:54 +00:00
http-favicon.nse Fix a typo in http-favicon.nse. 2010-02-01 04:05:44 +00:00
http-headers.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
http-iis-webdav-vuln.nse Use http.generic_request in http-iis-webdav-vuln.nse. 2010-02-19 05:03:00 +00:00
http-malware-host.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
http-methods.nse changed a URL to use %28 and %29 rather than ( and ) to fix an nsedoc parsing issue noted by Jason DePriest 2010-06-10 05:36:39 +00:00
http-open-proxy.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
http-passwd.nse Add Gutek's modifications to http-passwd.nse that enable it to check for 2010-06-23 02:29:24 +00:00
http-php-version.nse o Added http-php-version.nse from Gutek. This script retrieves 2010-06-18 22:12:17 +00:00
http-trace.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
http-userdir-enum.nse Fix file-level nsedoc block. 2010-03-31 22:08:16 +00:00
http-vmware-path-vuln.nse Added http-vmware-path-vuln.nse, a script that checks for a path-traversal vulnerability in VMWare (CVE-2009-3733) 2010-02-16 14:42:10 +00:00
iax2-version.nse Merge r18160:18278 from nmap-exp/djalal/nmap-nse/ to fix NSE not honoring the exclude directive bug. 2010-06-29 21:56:59 +00:00
imap-capabilities.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
ipidseq.nse Print a message (once) if ipidseq.nse doesn't run for lack of privileges 2010-03-19 16:55:01 +00:00
irc-info.nse Moved a bunch of scripts to the "safe" category, and some others to "intrusive" after 2009-10-01 19:07:16 +00:00
irc-unrealircd-backdoor.nse Accuracy and speed improvements to irc-unrealircd-backdoor.nse. The main 2010-07-01 00:11:59 +00:00
jdwp-version.nse Merge r18160:18278 from nmap-exp/djalal/nmap-nse/ to fix NSE not honoring the exclude directive bug. 2010-06-29 21:56:59 +00:00
ldap-brute.nse Remove explicit timelimit checking from ms-sql-brute, pgsql-brute, 2010-04-16 02:11:12 +00:00
ldap-rootdse.nse Added dependency for ldap-brute to ldap-rootdse.nse 2010-02-21 08:56:10 +00:00
ldap-search.nse Add ldap-search.nse 2010-03-04 19:10:48 +00:00
lexmark-config.nse Add lexmark-config.nse see 2010-01-29 21:04:25 +00:00
mongodb-databases.nse Fix NSEDoc. 2010-03-31 20:28:14 +00:00
mongodb-info.nse Fix NSEDoc. 2010-03-31 20:28:14 +00:00
ms-sql-brute.nse Remove explicit timelimit checking from ms-sql-brute, pgsql-brute, 2010-04-16 02:11:12 +00:00
ms-sql-config.nse Add or fix @output sections in ms-sql-config, oracle-sid-brute, 2010-04-08 06:09:39 +00:00
ms-sql-empty-password.nse o [NSE] Added a library for Microsoft SQL Server and 7 new scripts. The new 2010-04-04 10:11:54 +00:00
ms-sql-hasdbaccess.nse o [NSE] Added a library for Microsoft SQL Server and 7 new scripts. The new 2010-04-04 10:11:54 +00:00
ms-sql-info.nse Add @output sections to these scripts: 2010-03-31 21:45:21 +00:00
ms-sql-query.nse Fix NSEDoc comments in ms-sql-config and ms-sql-query. They need three 2010-04-06 21:42:17 +00:00
ms-sql-tables.nse o [NSE] Added a library for Microsoft SQL Server and 7 new scripts. The new 2010-04-04 10:11:54 +00:00
ms-sql-xp-cmdshell.nse o [NSE] Added a library for Microsoft SQL Server and 7 new scripts. The new 2010-04-04 10:11:54 +00:00
mysql-brute.nse Remove explicit timelimit checking from ms-sql-brute, pgsql-brute, 2010-04-16 02:11:12 +00:00
mysql-databases.nse o [NSE] Added checks for missing OpenSSL to MySQL scripts and library [Patrik] 2010-03-09 20:27:48 +00:00
mysql-empty-password.nse Add the scripts 2010-01-26 09:40:38 +00:00
mysql-info.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
mysql-users.nse o [NSE] Added checks for missing OpenSSL to MySQL scripts and library [Patrik] 2010-03-09 20:27:48 +00:00
mysql-variables.nse o [NSE] Added checks for missing OpenSSL to MySQL scripts and library [Patrik] 2010-03-09 20:27:48 +00:00
nbstat.nse Give datafiles.lua the ability to parse nmap-mac-prefixes, and use it in 2010-02-26 00:27:30 +00:00
nfs-acls.nse o [NSE] Improved error handling and reporting and re-designed communication 2010-04-22 20:25:38 +00:00
nfs-dirlist.nse o [NSE] Improved error handling and reporting and re-designed communication 2010-04-22 20:25:38 +00:00
nfs-ls.nse Merge r18144:18422 from nmap-exp/djalal/nse-nfs/scripts 2010-06-29 21:06:07 +00:00
nfs-showmount.nse o [NSE] Improved error handling and reporting and re-designed communication 2010-04-22 20:25:38 +00:00
nfs-statfs.nse o [NSE] Improved error handling and reporting and re-designed communication 2010-04-22 20:25:38 +00:00
ntp-info.nse Add a default timeout of 5000 ms to the ntp-info script, and don't try 2009-12-21 20:24:45 +00:00
ntp-monlist.nse Some improvements based on a review by David: comments, less convoluted code and 2010-06-04 10:05:32 +00:00
oracle-sid-brute.nse Add or fix @output sections in ms-sql-config, oracle-sid-brute, 2010-04-08 06:09:39 +00:00
p2p-conficker.nse Add @output sections to these scripts: 2010-03-31 21:45:21 +00:00
pgsql-brute.nse Remove explicit timelimit checking from ms-sql-brute, pgsql-brute, 2010-04-16 02:11:12 +00:00
pjl-ready-message.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
pop3-brute.nse Add or fix @output sections in ms-sql-config, oracle-sid-brute, 2010-04-08 06:09:39 +00:00
pop3-capabilities.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
pptp-version.nse Merge r18160:18278 from nmap-exp/djalal/nmap-nse/ to fix NSE not honoring the exclude directive bug. 2010-06-29 21:56:59 +00:00
qscan.nse Fix a bug in qscan.nse which kept a confidence level of 0.9995 from working; 2010-06-05 00:46:48 +00:00
realvnc-auth-bypass.nse Add @output sections to realvnc-auth-bypass.nse and sql-injection.nse 2010-04-02 15:31:24 +00:00
robots.txt.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
rpcinfo.nse Fixed a bug that would prevent the rpcinfo script from returning any results 2010-06-01 14:09:58 +00:00
script.db o [NSE] Added ftp-libopie.nse by Gutek. This script checks for an 2010-06-21 20:25:11 +00:00
skypev2-version.nse Merge r18160:18278 from nmap-exp/djalal/nmap-nse/ to fix NSE not honoring the exclude directive bug. 2010-06-29 21:56:59 +00:00
smb-brute.nse smb-brute now checks the hosts lockout policy before starting. If accounts can be locked out, it bails with an error message telling the user how to force it to run. 2010-01-23 16:31:40 +00:00
smb-check-vulns.nse Merge from /nmap-exp/drazen/nmap-msrpc. This adds checks for MS06-025 and MS07-029 to smb-check-vulns.nse. 2010-06-14 18:42:54 +00:00
smb-enum-domains.nse Add @output sections to these scripts: 2010-03-31 21:45:21 +00:00
smb-enum-groups.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
smb-enum-processes.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
smb-enum-sessions.nse Fixed a couple formatting bugs in the smb-* libraries that come up when debugging/verbose is disabled 2010-02-20 15:03:11 +00:00
smb-enum-shares.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
smb-enum-users.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
smb-os-discovery.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
smb-psexec.nse Break out the code in smb-psexec.nse that looks for nmap_service.exe, so 2010-03-03 22:27:51 +00:00
smb-security-mode.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
smb-server-stats.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
smb-system-info.nse Fixed a couple bugs in the smb-* scripts involving undeclared variables. These only cropped up if the guest/anonymous accounts were disabled, which I'd never seen before. 2010-04-18 13:43:27 +00:00
smbv2-enabled.nse Merged in my changes from nmap-smb. The primary changes are: 2009-11-08 21:31:06 +00:00
smtp-commands.nse Fix some NSEDoc. 2010-06-24 17:01:55 +00:00
smtp-enum-users.nse Fix NSEDoc. 2010-03-31 20:28:14 +00:00
smtp-open-relay.nse Fix NSEDoc. 2010-03-31 20:28:14 +00:00
smtp-strangeport.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
sniffer-detect.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
snmp-brute.nse Add @output sections to these scripts: 2010-03-31 21:45:21 +00:00
snmp-interfaces.nse o [NSE] Added snmpWalk function to SNMP library and updated scripts to use it 2010-04-12 10:30:24 +00:00
snmp-netstat.nse o [NSE] Added snmpWalk function to SNMP library and updated scripts to use it 2010-04-12 10:30:24 +00:00
snmp-processes.nse o [NSE] Added snmpWalk function to SNMP library and updated scripts to use it 2010-04-12 10:30:24 +00:00
snmp-sysdescr.nse Merge from Dependencies branch (nmap-exp/patrick/dependencies) 2009-12-30 02:34:05 +00:00
snmp-win32-services.nse o [NSE] Added snmpWalk function to SNMP library and updated scripts to use it 2010-04-12 10:30:24 +00:00
snmp-win32-shares.nse o [NSE] Added snmpWalk function to SNMP library and updated scripts to use it 2010-04-12 10:30:24 +00:00
snmp-win32-software.nse o [NSE] Added snmpWalk function to SNMP library and updated scripts to use it 2010-04-12 10:30:24 +00:00
snmp-win32-users.nse o [NSE] Added snmpWalk function to SNMP library and updated scripts to use it 2010-04-12 10:30:24 +00:00
socks-open-proxy.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
sql-injection.nse Add @output sections to realvnc-auth-bypass.nse and sql-injection.nse 2010-04-02 15:31:24 +00:00
ssh-hostkey.nse We generally put scripts in either safe or intrusive categories, but not both. So I removed intrusive. I also added discovery, as that seems to fit the ssh-hostkey script 2010-06-15 07:49:45 +00:00
sshv1.nse Add @output sections to these scripts: 2010-03-31 21:45:21 +00:00
ssl-cert.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
ssl-enum-ciphers.nse Changes to ssl-enum-ciphers from Mak Kolybabi. This goes back to a 2010-03-22 03:26:56 +00:00
sslv2.nse Change the term 'stolen from' in comments to 'inspired by', which sounds a little less felonious :) 2010-06-15 08:05:28 +00:00
telnet-brute.nse canonicalize some license text that differed in whitespace or quote character or line-ending or (in a couple cases) the slightly older wording 2010-06-11 06:54:56 +00:00
upnp-info.nse Remove email addresses from scripts as discussed in this thread: http://seclists.org/nmap-dev/2009/q4/466 2009-11-24 08:49:02 +00:00
whois.nse canonicalize some license text that differed in whitespace or quote character or line-ending or (in a couple cases) the slightly older wording 2010-06-11 06:54:56 +00:00
x11-access.nse Add @output sections to these scripts: 2010-03-31 21:45:21 +00:00