Re: nmap..... via web

[don () mars dgrc crc ca (Donald McLachlan)]

> From: Lars Marowsky-Bree <lmb () teuto net>
>
> On 1999-02-19T12:13:31,
>    Lamont Granquist <lamontg () raven genome washington edu> said:
>
> > since so many people seem to be trying to use nmap for these kinds of
> > things maybe nmap needs these patches in the development tree...
>
> No. IMNSHO, these people need some common sense. Triggering an nmap scan via
> WWW ? Hello? *knock knock* Can you say DoS ? Can you say "exploit" ?

The legitimate use I can see is to test whether your firewall is really
doing what you think.  The best way is to test fron a foreign source address
(web server out on the Internet).

If the web page would only scan the single host the http connection is
from, and had "buttons" to select options for TCP/UDP/etc I think this
should be a fairly safe and useful tool.

Don