PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-21 15:09:02 +00:00
Code Issues Projects Releases Wiki Activity

3.96BETA1 is just about ready for release

Browse Source
This commit is contained in:
fyodor
2005-12-30 04:40:16 +00:00
parent e2b19b36a3
commit 5e5ce3ece1
8 changed files with 206 additions and 182 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
CHANGELOG
View File

@@ -1,6 +1,6 @@
# Nmap Changelog ($Id$)
UNRELEASED
3.96BETA1
o Added --max_retries option for capping the maximum number of
retransmissions the port scan engine will do. The value may be as low
@@ -20,18 +20,10 @@ o Many of the Nmap low-level timing options take a value in
--min_rtt_timeout, --max_rtt_timeout, --initial_rtt_timeout,
--scan_delay, and --max_scan_delay options.
o Debian GNU/kFreeBSD is now supported thanks to a patch to libdnet's
configure.in by Petr Salinger (Petr.Salinger(a)t-systems.cz).
o Tried to update to the latest autoconf only to find that there
hasn't been a new version in more than two years :(. I was able to
find new config.sub and config.guess files at
http://cvs.savannah.gnu.org/viewcvs/config/config/ , so I updated to
those.
o Improved the NmapFE port to GTK2 so it better-conforms to the new
API and you don't get as many annoying messages in your terminal
window. Thanks to Priit Laes (amd(a)store20.com) for writing these
window. GTK2 is prettier and more functional too. Thanks to Priit
Laes (amd(a)store20.com) for writing these
excellent patches.
o Fixed a problem which led to the error message "Failed to determine
@@ -41,6 +33,15 @@ o Fixed a problem which led to the error message "Failed to determine
it should now give you a clearer error message than the "dst MAC
address" nonsense.
o Debian GNU/kFreeBSD is now supported thanks to a patch to libdnet's
configure.in by Petr Salinger (Petr.Salinger(a)t-systems.cz).
o Tried to update to the latest autoconf only to find that there
hasn't been a new version in more than two years :(. I was able to
find new config.sub and config.guess files at
http://cvs.savannah.gnu.org/viewcvs/config/config/ , so I updated to
those.
o Fixed a problem with the -e option when run on Windows (or UNIX with
--send_eth) when run on an ethernet network against an external
(routed) host. You would get the message "NmapArpCache() can only
@@ -66,7 +67,7 @@ o Changed INSTALL and README-WIN32 files to mostly just reference the
o Included docs/nmap-man.xml in the tarball distribution, which is the
DocBook XML source for the Nmap man page. Patches to Nmap that are
user-visible should include patches to the man page XML source rather
than the Nroff source.
than to the generated Nroff.
o Fixed Nmap so it doesn't crash when you ask it to resume a previous
scan, but pass in a bogus file rather than actual Nmap output. Thanks

41
docs/nmap.1
View File

@@ -2,7 +2,7 @@
.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
.\" Instead of manually editing it, you probably should edit the DocBook XML
.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
.TH "NMAP" "1" "12/19/2005" "" "Nmap Reference Guide"
.TH "NMAP" "1" "12/29/2005" "" "Nmap Reference Guide"
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
@@ -129,10 +129,11 @@ OS DETECTION:
\-\-osscan_guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
\-T[0\-5]: Set timing template (higher is faster)
\-\-min_hostgroup/max_hostgroup <msec>: Parallel host scan group sizes
\-\-min_hostgroup/max_hostgroup <size>: Parallel host scan group sizes
\-\-min_parallelism/max_parallelism <msec>: Probe parallelization
\-\-min_rtt_timeout/max_rtt_timeout/initial_rtt_timeout <msec>: Specifies
probe round trip time.
\-\-max_retries <tries>: Caps number of port scan probe retransmissions.
\-\-host_timeout <msec>: Give up on target after this long
\-\-scan_delay/\-\-max_scan_delay <msec>: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
@@ -747,7 +748,7 @@ and Nmap will try to keep group sizes above that level. Nmap may have to use sma
.sp
The primary use of these options is to specify a large minimum group size so that the full scan runs more quickly. A common choice is 256 to scan a network in Class C sized chunks. For a scan with many ports, exceeding that number is unlikely to help much. For scans of just a few port numbers, host group sizes of 2048 or more may be helpful.
.TP
\fB\-\-min_parallelism <milliseconds>\fR; \fB\-\-max_parallelism <milliseconds>\fR (Adjust probe parallelization)
\fB\-\-min_parallelism <numprobes>\fR; \fB\-\-max_parallelism <numprobes>\fR (Adjust probe parallelization)
These options control the total number of probes that may be outstanding for a host group. They are used for port scanning and host discovery. By default, Nmap calculates an ever\-changing ideal parallelism based on network performance. If packets are being dropped, Nmap slows down and allows fewer outstanding probes. The ideal probe number slowly rises as the network proves itself worthy. These options place minimum or maximum bounds on that variable. By default, the ideal parallelism can drop to 1 if the network proves unreliable and rise to several hundred in perfect conditions.
.sp
The most common usage is to set
@@ -760,10 +761,14 @@ option is sometimes set to one to prevent Nmap from sending more than one probe
\fB\-\-scan_delay\fR
(discussed later), although the latter usually serves the purpose well enough by itself.
.TP
\fB\-\-min_rtt_timeout <milliseconds>\fR, \fB\-\-max_rtt_timeout <milliseconds>\fR, \fB\-\-initial_rtt_timeout <milliseconds>\fR (Adjust probe timeouts)
\fB\-\-min_rtt_timeout <time>\fR, \fB\-\-max_rtt_timeout <time>\fR, \fB\-\-initial_rtt_timeout <time>\fR (Adjust probe timeouts)
Nmap maintains a running timeout value for determining how long it will wait for a probe response before giving up or retransmitting the probe. This is calculated based on the response times of previous probes. If the network latency shows itself to be significant and variable, this timeout can grow to several seconds. It also starts at a conservative (high) level and may stay that way for a while when Nmap scans unresponsive hosts.
.sp
These options take a value in milliseconds. Specifying a lower
These options take a value in milliseconds, or you can append
s,
m, or
h
to the argument to specify a time in seconds, minutes, or hours. Specifying a lower
\fB\-\-max_rtt_timeout\fR
and
\fB\-\-initial_rtt_timeout\fR
@@ -792,17 +797,33 @@ to a low value such as three. Such values can substantially speed scans of slow
\fB\-\-host_timeout\fR
expire and losing all information about the target.
.TP
\fB\-\-host_timeout <milliseconds>\fR (Give up on slow target hosts)
\fB\-\-host_timeout <time>\fR (Give up on slow target hosts)
Some hosts simply take a
\fIlong\fR
time to scan. This may be due to poorly performing or unreliable networking hardware or software, packet rate limiting, or a restrictive firewall. The slowest few percent of the scanned hosts can eat up a majority of the scan time. Sometimes it is best to cut your losses and skip those hosts initially. This can be done by specifying
\fB\-\-host_timeout\fR
with the number of milliseconds you are willing to wait. I often specify 1800000 to ensure that Nmap doesn't waste more than half an hour on a single host. Note that Nmap may be scanning other hosts at the same time during that half an hour as well, so it isn't a complete loss. A host that times out is skipped. No port table, OS detection, or version detection results are printed for that host.
with the number of milliseconds you are willing to wait. Alternatively, you can append
s,
m, or
h
to the argument to specify a timeout in seconds, minutes, or hours. I often specify
30m
to ensure that Nmap doesn't waste more than half an hour on a single host. Note that Nmap may be scanning other hosts at the same time during that half an hour as well, so it isn't a complete loss. A host that times out is skipped. No port table, OS detection, or version detection results are printed for that host.
.TP
\fB\-\-scan_delay <milliseconds>\fR; \fB\-\-max_scan_delay <milliseconds>\fR (Adjust delay between probes)
This option causes Nmap to wait at least the given number of milliseconds between each probe it sends to a given host. This is particularly useful in the case of rate limiting. Solaris machines (among many others) will usually respond to UDP scan probe packets with only one ICMP message per second. Any more than that sent by Nmap will be wasteful. A
\fB\-\-scan_delay <time>\fR; \fB\-\-max_scan_delay <time>\fR (Adjust delay between probes)
This option causes Nmap to wait at least the given number of milliseconds between each probe it sends to a given host. As with many other timing options, you can append
s,
m, or
h
to the argument to specify a delay in seconds, minutes, or hours instead. This is particularly useful in the case of rate limiting. Solaris machines (among many others) will usually respond to UDP scan probe packets with only one ICMP message per second. Any more than that sent by Nmap will be wasteful. A
\fB\-\-scan_delay\fR
of 1000 will keep Nmap at that slow rate. Nmap tries to detect rate limiting and adjust the scan delay accordingly, but it doesn't hurt to specify it explicitly if you already know what rate works best.
of
1s
will keep Nmap at that slow rate. Nmap tries to detect rate limiting and adjust the scan delay accordingly, but it doesn't hurt to specify it explicitly if you already know what rate works best.
.sp
When Nmap adjusts the scan delay upward to cope with rate limiting, the scan slows down dramatically. The
\fB\-\-max_scan_delay\fR
option specifies the largest delay that Nmap will allow. Setting this value too low can lead to wasteful packet retransmissions and possible missed ports when the target implements strict rate limiting.
.sp
Another use of
\fB\-\-scan_delay\fR

5
nmapfe/configure vendored
View File

@@ -2190,9 +2190,6 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
ac_compiler_gnu=$ac_cv_c_compiler_gnu
#AM_PATH_GTK(1.0.0,
# [LIBS="$LIBS $GTK_LIBS" CFLAGS="$CFLAGS $GTK_CFLAGS"],
# AC_MSG_ERROR(Cannot find GTK: Is gtk-config in path?))
# Check whether --enable-gtktest or --disable-gtktest was given.
if test "${enable_gtktest+set}" = set; then
@@ -2411,7 +2408,7 @@ fi
if test "x$no_gtk" = x ; then
echo "$as_me:$LINENO: result: yes (version $gtk_config_major_version.$gtk_config_minor_version.$gtk_config_micro_version)" >&5
echo "${ECHO_T}yes (version $gtk_config_major_version.$gtk_config_minor_version.$gtk_config_micro_version)" >&6
LIBS="$LIBS $GTK_LIBS" CFLAGS="$CFLAGS $GTK_CFLAGS -DGTK_ENABLE_BROKEN"
LIBS="$LIBS $GTK_LIBS" CFLAGS="$CFLAGS $GTK_CFLAGS"
else
echo "$as_me:$LINENO: result: no" >&5
echo "${ECHO_T}no" >&6

5
nmapfe/configure.ac
View File

@@ -6,11 +6,8 @@ AC_INIT(nmapfe.c)
AC_PROG_CC
#AM_PATH_GTK(1.0.0,
# [LIBS="$LIBS $GTK_LIBS" CFLAGS="$CFLAGS $GTK_CFLAGS"],
# AC_MSG_ERROR(Cannot find GTK: Is gtk-config in path?))
AM_PATH_GTK_2_0(2.0.0,
[LIBS="$LIBS $GTK_LIBS" CFLAGS="$CFLAGS $GTK_CFLAGS -DGTK_ENABLE_BROKEN"],
[LIBS="$LIBS $GTK_LIBS" CFLAGS="$CFLAGS $GTK_CFLAGS"],
AC_DEFINE(MISSING_GTK) \
AC_MSG_WARN(NMAPFE WILL NOT BE BUILT -- BUT NMAP SHOULD STILL WORK ))

38
nmapfe/nmapfe.c
View File

@@ -133,6 +133,7 @@
struct NmapFEoptions opt;
void openLog(char *);
void saveLog(char *);
static void LogOpen_callback (void);
static void LogSave_callback (void);
static void LogAppend_callback (void);
@@ -270,7 +271,7 @@ LogOpen_callback (void) {
static void
LogSave_callback (void) {
static char filename[FILENAME_MAX+1] = "";
gtk_widget_show(create_fileSelection("Save Log", filename, openLog, NULL));
gtk_widget_show(create_fileSelection("Save Log", filename, saveLog, NULL));
}
static void
Quit_callback (void) {
@@ -1324,15 +1325,38 @@ GtkAdjustment *adjust;
/* text widget with scroll bar */
{
GtkWidget *sw;
GtkWidget *view;
sw = gtk_scrolled_window_new(NULL, NULL);
gtk_box_pack_start(GTK_BOX(main_vbox), sw, TRUE, TRUE, 5);
opt.output = gtk_text_new(NULL, NULL);
gtk_container_add(GTK_CONTAINER(sw),opt.output);
gtk_text_set_word_wrap(GTK_TEXT(opt.output), 1);
gtk_widget_set_usize(opt.output, 500, 248);
gtk_widget_show(opt.output);
gtk_widget_realize(opt.output);
view = gtk_text_view_new();
opt.buffer = gtk_text_view_get_buffer(GTK_TEXT_VIEW(view));
/* Create tag definitions for text coloring */
gtk_text_buffer_create_tag(opt.buffer, "normal",
"family", "monospace", NULL);
gtk_text_buffer_create_tag(opt.buffer, "bold",
"family", "monospace",
"weight", PANGO_WEIGHT_BOLD, NULL);
gtk_text_buffer_create_tag(opt.buffer, "red",
"family", "monospace",
"weight", PANGO_WEIGHT_BOLD,
"foreground", "red", NULL);
gtk_text_buffer_create_tag(opt.buffer, "blue",
"family", "monospace",
"weight", PANGO_WEIGHT_BOLD,
"foreground", "blue", NULL);
gtk_text_buffer_create_tag(opt.buffer, "green",
"family", "monospace",
"weight", PANGO_WEIGHT_BOLD,
"foreground", "green", NULL);
gtk_container_add(GTK_CONTAINER(sw), view);
gtk_text_view_set_wrap_mode(GTK_TEXT_VIEW(view), GTK_WRAP_WORD);
gtk_widget_set_usize(view, 500, 248);
gtk_widget_show(view);
gtk_widget_realize(view);
gtk_widget_show(sw);
}

2
nmapfe/nmapfe.h
View File

@@ -234,7 +234,7 @@ enum {
struct NmapFEoptions {
GtkWidget *scanButton;
GtkWidget *output;
GtkTextBuffer *buffer;
GtkWidget *targetHost;
GtkWidget *commandEntry;
gboolean appendLog;

109
nmapfe/nmapfe_sig.c
View File

@@ -173,9 +173,12 @@ extern char **environ;
int main (int argc, char *argv[])
int
main (int argc,
char *argv[])
{
GtkWidget *main_win;
GtkTextIter iter;
gtk_set_locale();
gtk_init(&argc, &argv);
@@ -190,10 +193,12 @@ GtkWidget *main_win;
main_win = create_main_win();
gtk_widget_show(main_win);
gtk_text_insert(GTK_TEXT(opt.output), NULL, NULL, NULL,
gtk_text_buffer_get_end_iter (opt.buffer, &iter);
gtk_text_buffer_insert_with_tags_by_name (opt.buffer, &iter,
(opt.uid == 0)
? "You are root - All options granted."
: "You are *NOT* root - Some options aren't available.", -1);
: "You are *NOT* root - Some options aren't available.", -1,
"normal", NULL);
gtk_main();
return 0;
@@ -205,7 +210,7 @@ void scanButton_toggled_cb(GtkButton *button, void *ignored)
char *command = build_command();
if(!(opt.appendLog))
kill_output(NULL);
gtk_text_buffer_set_text (GTK_TEXT_BUFFER(opt.buffer), "\0", -1);
nmap_pid = execute(command);
}
@@ -214,23 +219,26 @@ void scanButton_toggled_cb(GtkButton *button, void *ignored)
static char string[256];
strcpy(string, "CANCELLED!\n\n");
print_line(GTK_TEXT(opt.output), string);
print_line(GTK_TEXT_BUFFER(opt.buffer), string);
}
}
}
void saveLog(char *filename)
void
saveLog (char *filename)
{
GtkTextIter start, end;
if (filename && *filename) {
FILE *file;
if ((file = fopen(filename, "w"))) {
char *text = gtk_editable_get_chars(GTK_EDITABLE(opt.output), 0, -1);
gtk_text_buffer_get_start_iter(opt.buffer, &start);
gtk_text_buffer_get_end_iter(opt.buffer, &end);
gchar *text = gtk_text_buffer_get_text(opt.buffer,
&start, &end, FALSE);
fputs(text, file);
fclose(file);
free(text);
}
}
@@ -243,17 +251,14 @@ void openLog(char *filename)
FILE *file;
if (!opt.appendLog)
kill_output(NULL);
gtk_text_buffer_set_text (GTK_TEXT_BUFFER(opt.buffer), "\0", -1);
if((file = fopen(filename, "r"))) {
char buf[BUFSIZ+1];
gtk_text_freeze(GTK_TEXT(opt.output));
while(fgets(buf, BUFSIZ, file) != NULL)
print_line(GTK_TEXT(opt.output), buf);
gtk_text_thaw(GTK_TEXT(opt.output));
while(fgets(buf, BUFSIZ, file) != NULL) {
print_line(GTK_TEXT_BUFFER(opt.buffer), buf);
}
fclose(file);
}
@@ -279,13 +284,6 @@ char *filename = gtk_object_get_data(GTK_OBJECT(window), "NmapFE_filename");
}
void kill_output()
{
gtk_text_backward_delete(GTK_TEXT(opt.output),
gtk_text_get_length(GTK_TEXT(opt.output)));
}
/* The idea of execute() is to create an Nmap process running in the background with its stdout
connected to a pipe we can poll many times per second to collect any new output. Admittedly
there are much more elegant ways to do this, but this is how it works now. The functions
@@ -1026,39 +1024,19 @@ char *next_token(char *buf, char *token, int tokensz)
}
void print_line(GtkText *gtktext, char *line)
void
print_line (GtkTextBuffer *buffer,
char *line)
{
/* Get fonts ready */
GdkFont *fixed = gdk_fontset_load ("-misc-fixed-medium-r-*-*-*-120-*-*-*-*-*-*");
GdkFont *bold = gdk_fontset_load("-misc-fixed-bold-r-normal-*-*-120-*-*-*-*-*-*");
GdkColormap *cmap = gdk_colormap_get_system();
GdkColor red, blue, green;
red.red = 0xffff;
red.green = 0;
red.blue = 0;
if (!gdk_color_alloc(cmap, &red))
g_error("couldn't allocate red");
blue.red = 0;
blue.green = 0;
blue.blue = 0xffff;
if (!gdk_color_alloc(cmap, &blue))
g_error("couldn't allocate blue");
green.red = 0x0000;
green.green = 0xffff;
green.blue = 0x0000;
if (!gdk_color_alloc(cmap, &green))
g_error("couldn't allocate green");
GtkTextIter iter;
gtk_text_buffer_get_end_iter (buffer, &iter);
if (opt.viewValue == 1) {
char token[BUFSIZ+1];
char *str;
while (((str = next_token(line, token, sizeof(token) / sizeof(*token))) != NULL) && (*str != '\0')) {
/********* CATCH STUFF ****************************/
/* Catch stuff */
if (strstr(str, "http://") ||
strstr(str, "PORT") ||
strstr(str, "PROTOCOL") ||
@@ -1068,8 +1046,9 @@ GdkColor red, blue, green;
strstr(str, "(RPC)") ||
strstr(str, "OWNER") ||
strstr(str, "fingerprint")) {
gtk_text_insert(gtktext, bold, NULL, NULL, str, -1);
/********* BEGIN PORT COLOR CODING ****************/
gtk_text_buffer_insert_with_tags_by_name (buffer, &iter, str, -1,
"bold", NULL);
/* Color the ports... */
} else if (strstr(str, "sftp") ||
strstr(str, "mftp") ||
strstr(str, "bftp") ||
@@ -1085,14 +1064,16 @@ GdkColor red, blue, green;
strstr(str, "exec") ||
strstr(str, "ssh") ||
strstr(str, "linuxconf")) {
gtk_text_insert(gtktext, bold, &red, NULL, str, -1);
gtk_text_buffer_insert_with_tags_by_name (buffer, &iter, str, -1,
"red", NULL);
} else if (strstr(str, "imap2") ||
strstr(str, "pop-3") ||
strstr(str, "imap3") ||
strstr(str, "smtps") ||
strstr(str, "smtp") ||
strstr(str, "pop-2")) {
gtk_text_insert(GTK_TEXT(opt.output), bold, &blue, NULL, str, -1);
gtk_text_buffer_insert_with_tags_by_name (buffer, &iter, str, -1,
"blue", NULL);
} else if (strstr(str, "systat") ||
strstr(str, "netstat") ||
strstr(str, "cfingerd") ||
@@ -1104,8 +1085,10 @@ GdkColor red, blue, green;
strstr(str, "kpasswds") ||
strstr(str, "https") ||
strstr(str, "http")) {
gtk_text_insert(gtktext, bold, NULL, NULL, str, -1);
gtk_text_buffer_insert_with_tags_by_name (buffer, &iter, str, -1,
"bold", NULL);
/******* BEGIN OS COLOR CODING *****************/
/* Color the Operating systems */
} else if (strstr(str, "Linux") ||
strstr(str, "FreeBSD") ||
strstr(str, "Win") ||
@@ -1113,15 +1096,17 @@ GdkColor red, blue, green;
strstr(str, "OpenBSD") ||
strstr(str, "IRIX") ||
strstr(str, "Windows")) {
gtk_text_insert(gtktext, bold, &green, NULL, str, -1);
gtk_text_buffer_insert_with_tags_by_name (buffer, &iter, str, -1,
"green", NULL);
} else {
gtk_text_insert(gtktext, fixed, NULL, NULL, str, -1);
gtk_text_buffer_insert_with_tags_by_name (buffer, &iter, str, -1,
"normal", NULL);
}
}
} /* END VIEW_TYPE == 1 IF */
else
gtk_text_insert(gtktext, fixed, NULL, NULL, line, -1);
} else {
gtk_text_buffer_insert_with_tags_by_name (buffer, &iter, line, -1,
"normal", NULL);
}
}
@@ -1155,7 +1140,7 @@ int count;
(str != buf) && (str != NULL);
str = next_line(buf, sizeof(buf) / sizeof(*buf), line)) {
buflen = strlen(buf);
print_line(GTK_TEXT(opt.output), str);
print_line(opt.buffer, str);
}
}
@@ -1166,7 +1151,7 @@ int count;
while ((str = next_line(buf, sizeof(buf) / sizeof(*buf), line)) != NULL) {
buflen = strlen(buf);
print_line(GTK_TEXT(opt.output), str);
print_line(opt.buffer, str);
if (str == buf)
break;
}

3
nmapfe/nmapfe_sig.h
View File

@@ -122,8 +122,7 @@
#include "nmapfe_error.h"
gboolean stop_scan();
void print_line(GtkText *gtktext, char *line);
void kill_output();
void print_line(GtkTextBuffer *gtktext, char *line);
gint read_data(gpointer data);
void entry_toggle_checkbox (GtkWidget *entry, GtkWidget *checkbox);