new service probes (Re: Nmap 3.51-TEST3: MAC address lookup & display)

[Martin Mačok <martin.macok () underground cz>]

On Sun, Apr 18, 2004 at 07:32:37PM -0700, Fyodor wrote:

> for Nmap to print out the MAC addresses of scanned hosts on the same
> networks.  I agree that is a feature whose time has come, and I have
> added it for an nmap-3.51-TEST3 release.

My patch against nmap-service-probes 1.36 is at
http://Xtrmntr.org/ORBman/tmp/nmap-service-probes.patch

 * fixes:
   - missing \r in Kazaa HTTP match
   - missing d in pdnsd name
   - Kerio PF services names unified
   - webfs match generalized a bit

 * new matches:
   - HP-UX ftpd
   - Hummingbird FTP server
   - HellSoft FTP server for Netware
   - POP3 AnalogX Proxy
   - SMTP AnalogX Proxy
   - SGI Performance Co-Pilot
   - AIX rexecd
   - AIX rlogin
   - AIX rshd
   - another Lotus Notes POP3 match
   - another Postfix SMTP match (Mandrake Linux)
   - another Kerio PF services matches
   - another IBM HTTP Server (Apache) match
   - another two Oracle HTTP Server matches
   - another IBM Websphere Application server match
   - another JRun Webserver match
   - another pdnsd match

 * TODO:
   - fix broken ``$Revision X.Y$'' entries in the file (messing with CVS)
     (lines prepended with #FIXME - I don't know how exactly they
     should look like)
   - I have seen behaviour when sometimes GetRequest missed and
     HTTPOptions matched (with the same pattern), sometimes not ...
     probably the host was too slow ?
   - some probes are commented out to not slow down the scan in
     general case, but they're there if someone wants them (handy)
   - There are some entries with "(?)" string in their names. These
     are the ones I'm not 100% sure with them but still better than
     nothing? For example - have you ever seen HTTP server with
     Content-Location: http://[ip.address]/xy other than MS IIS? Some
     of them I'm not sure with (I have (almost :-) no control of the
     machine) but I saw them on many different hosts always on the same OS
     and same well-known port (MS DTC/ERROR case)...

Please, apply.

Martin Mačok
IT Security Consultant

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org