$ ./nmap -Pn --script imap-capabilities imap.gmail.com -p imaps
PORT STATE SERVICE
993/tcp open imaps
|_imap-capabilities: all she XYZZY QUOTA X-GM-EXT-1 ID XLIST CHILDREN UNSELECT m1mb423345642pdn wrote SASL-IR IMAP4rev1 Thats NAMESPACE OK AUTH=PLAIN-CLIENTTOKEN AUTH=XOAUTH2 AUTH=PLAIN IDLE AUTH=XOAUTHA0001
o Add two new Script scan phases:
Script Pre-scanning phase: before any Nmap scan operation, activated by the new "prerule".
Script Post-scanning phase: after all Nmap scan operations, activated by the new "postrule".
o New environment variables:
SCRIPT_PATH
SCRIPT_NAME
SCRIPT_TYPE: the type of the rule that activated the script.
discussion on nmap-dev about how best to handle these. I also updated the docs and
am about to regenerate script.db. See this thread for more info:
http://seclists.org/nmap-dev/2009/q3/1008.html
The imap-capabilities script is mostly feature-complete but I could
see adding some analysis code to warn users of non-SSL'd IMAP servers
that offer STARTTLS without NOLOGIN.
The imap "library" is really a joke. It does the minimum required to
support getting capabilities and nothing more. IMAP requires each
command to use a unique identifier like 000, 001, 002, etc. Right now
the identifier is hardcoded to a001. To make a real imap library that
supports logging in, and other IMAP features a state variable will
have to be maintained to change the command uid. It would be nice to
see the library get updated so that IMAP brute-forcing could be
supported.
