Re: nse script development
Richard Lam <[email protected]> Thu, 29 Aug 2019 00:00:06 -0700
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <CAN-E8bjyx4sz_TxMYPmFR9LQ2nNTsFH4qgUR=8uzaQSBFFyK5Q@mail.gmail.com> |
--===============6366565768568753242== Content-Type: multipart/alternative; boundary="000000000000e0282105913c0ed5" --000000000000e0282105913c0ed5 Content-Type: text/plain; charset="UTF-8" Hi David, I have a preliminary working version of the script, only based Ubuntu SSH default banners, from 4.10 to 19.04. The OpenSSH version + portable number + build number uniquely identifies the Ubuntu distribution. In all cases, except one, the string "[uU]buntu" is embedded in the default SSH banner. My intention is to expand this service (OS) detection to FreeBSD, Debian, and possibly Raspbian, again only via SSH. Like Ubuntu, these distributions have their respective name embedded in the default SSH banner. The utilization of the Apache (httpd) service will become necessary for many other distributions, such as Redhat, CentOS, OpenBSD, where the default SSH banner does not identify the OS. This would become a future feature. The question is: How many different detected distributions is the threshold for potential acceptance to nmap? This deviates from the original requirement to use httpd service in conjunction with SSH; however, given that it's not necessary for all distributions... Thoughts? thanks, Richard On Thu, 22 Aug 2019 at 15:36, Richard Lam <[email protected]> wrote: > Awesome. Thank you for the information and quick response! > > Richard > > On Thu., Aug. 22, 2019, 15:34 David Fifield, <[email protected]> > wrote: > >> On Thu, Aug 22, 2019 at 03:20:37PM -0700, Richard Lam wrote: >> > I would like to make an attempt at writing a solution for the NSE scrip >> > service-os script, from the nmap/script ideas page. >> > >> > A few questions: >> > >> > 1) Is anyone already working on this? >> > 2) Are there additional suggestions for OS version detection other than >> > services from Apached (httpd) and OpenSSH? >> > 3) Any additional information I should consider? >> >> 1) No one is working on it, as far as I know. >> >> 2) I would suggest starting with those two ports, and seeing how far >> they can take you. >> >> 3) At packages.ubuntu.com (or packages.debian.org) you can see what >> version numbers are part of which distributions. So for example at >> https://packages.ubuntu.com/disco/apache2 you see in the header >> [xenial] [bionic] [cosmic] [disco] [eoan] >> and you can click on them to see what version number goes with each. >> There's also a changelog to see when other version numbers for the >> distribution may have been. >> >> You could test by running past live CDs in VMs. >> http://releases.ubuntu.com/ >> > --000000000000e0282105913c0ed5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Hi David,</div><div><br></div><div>I have a prelimina= ry working version of the script, only based Ubuntu SSH default banners, fr= om 4.10 to 19.04.=C2=A0 The OpenSSH version + portable number + build numbe= r uniquely identifies the Ubuntu distribution.=C2=A0 In all cases, except o= ne, the string "[uU]buntu" is embedded in the default SSH banner.= <br></div><div><br></div><div>My intention is to expand this service (OS) d= etection to FreeBSD, Debian, and possibly Raspbian, again only via SSH.=C2= =A0 Like Ubuntu, these distributions have their respective name embedded in= the default SSH banner.<br></div><div><br></div><div>The utilization of th= e Apache (httpd) service will become necessary for many other distributions= , such as Redhat, CentOS, OpenBSD, where the default SSH banner does not id= entify the OS.=C2=A0 This would become a future feature.<br></div><div><br>= </div><div>The question is:=C2=A0 How many different detected distributions= is the threshold for potential acceptance to nmap?=C2=A0 This deviates fro= m the original requirement to use httpd service in conjunction with SSH; ho= wever, given that it's not necessary for all distributions...=C2=A0 Tho= ughts?<br></div><div><br></div><div>thanks,</div><div>Richard<br></div><div= ><br></div><div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"= ltr" class=3D"gmail_attr">On Thu, 22 Aug 2019 at 15:36, Richard Lam <<a = href=3D"mailto:[email protected]">[email protected]</a>> wrote:<= br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e= x;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"auto= ">Awesome. Thank you for the information and quick=C2=A0response!<div dir= =3D"auto"><br></div><div dir=3D"auto">Richard</div></div><br><div class=3D"= gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu., Aug. 22, 2019, = 15:34 David Fifield, <<a href=3D"mailto:[email protected]" target=3D= "_blank">[email protected]</a>> wrote:<br></div><blockquote class=3D= "gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(2= 04,204,204);padding-left:1ex">On Thu, Aug 22, 2019 at 03:20:37PM -0700, Ric= hard Lam wrote:<br> > I would like to make an attempt at writing a solution for the NSE scri= p<br> > service-os script, from the nmap/script ideas page.<br> > <br> > A few questions:<br> > <br> > 1) Is anyone already working on this?<br> > 2) Are there additional suggestions for OS version detection other tha= n<br> > services from Apached (httpd) and OpenSSH?<br> > 3) Any additional information I should consider?<br> <br> 1) No one is working on it, as far as I know.<br> <br> 2) I would suggest starting with those two ports, and seeing how far<br> they can take you.<br> <br> 3) At <a href=3D"http://packages.ubuntu.com" rel=3D"noreferrer noreferrer" = target=3D"_blank">packages.ubuntu.com</a> (or <a href=3D"http://packages.de= bian.org" rel=3D"noreferrer noreferrer" target=3D"_blank">packages.debian.o= rg</a>) you can see what<br> version numbers are part of which distributions. So for example at<br> <a href=3D"https://packages.ubuntu.com/disco/apache2" rel=3D"noreferrer nor= eferrer" target=3D"_blank">https://packages.ubuntu.com/disco/apache2</a> yo= u see in the header<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 [xenial] [bionic] [cosmic] [disco] [eoan]<br> and you can click on them to see what version number goes with each.<br> There's also a changelog to see when other version numbers for the<br> distribution may have been.<br> <br> You could test by running past live CDs in VMs.<br> <a href=3D"http://releases.ubuntu.com/" rel=3D"noreferrer noreferrer" targe= t=3D"_blank">http://releases.ubuntu.com/</a><br> </blockquote></div> </blockquote></div> --000000000000e0282105913c0ed5-- --===============6366565768568753242== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/ --===============6366565768568753242==--