From 863a3779e61e7c16c8f1b8e97c24b25f0e78ce7e Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 2 May 2013 18:55:59 +0000
Subject: [PATCH] New service probe and matchline for Minecraft servers

Lots of good info here. Idea, regex, and debugging provided by Eric
Davisson on IRC.
---
 CHANGELOG           |  2 ++
 nmap-service-probes | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 0466b782a..b57e6bc9e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,7 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o Added a service probe for Minecraft servers. [Eric Davisson]
+
 o [NSE] Updated hostmap-bfk to work with the latest version of their website. 
   [Paulino Calderon]
 
diff --git a/nmap-service-probes b/nmap-service-probes
index f39bab36d..b11e33884 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -11850,3 +11850,13 @@ ports 5701-5709
 # Sample:
 # |HTTP/1\.1 200 OK\r\nContent-Length: 114\r\n\r\nCluster \[2\] {\n\tMember \[127\.0\.0\.1\]:5701 this\n\tMember \[127\.0\.0\.1\]:5702\n}\n\nConnectionCount: 1\nAllConnectionCount: 95\n\r\n|
 match hazelcast m|^HTTP/1\.1 200 OK\r\nContent-Length: \d+\r\n\r\nCluster \[\d+\] {\n\tMember (.*?)}\n\nConnectionCount: (\d+)\nAllConnectionCount: (\d+)\n\r\n$|s p/Hazelcast/ i/ConnectionCount $2; AllConnectionCount $3; $SUBST(1,"\n\tMember",",")/ cpe:/a:hazelcast:hazelcast/
+
+
+##############################NEXT PROBE##############################
+# Minecraft Server List Ping http://mc.kev009.com/Server_List_Ping
+Probe TCP minecraft-ping q|\xFE\x01|
+rarity 8
+ports 25565
+
+# Fields are Protocol version, Software version, motd, current player count, max players
+match minecraft m|^\xff\x00.\x00\xa7\x00\x31\x00\x00(.+?)\x00\x00(.+?)\x00\x00(.+?)\x00\x00(.+?)\x00\x00(.+)|s p/Minecraft/ v/$P(2)/ i|Protocol: $P(1), Message: $P(3), Users: $P(4)/$P(5)|