Re: Blocking a connect based on a port being available

On Sun, Oct 14, 2007 at 12:11:30PM -0500, andrew thornton wrote:
> Is it possible to block a connect based on if a port is available on
> the client's host? Has anyone done anything like this before, or have
> any links to any pages that would talk about modifying the scanner to
> do something like this? I appreciate your help.

It's possible but it's a very bad idea. For example there are lots of
programs that will choose a random port to listen on and this could
easily collide with the port you're trying to block.

If there is a specific string that the protocol can return that is a
better method. In this case you can add a protocol in libopm that
sends the needed string (you can even get away without adding a
protocol if you don't need to send anything) and set up a scanner in
the config file that matches on the desired target string.

David