Re: How do YOU use Nmap XML?

[Okan Demirmen <okan () demirmen com>]

On Mon 2004.11.15 at 22:48 -0800, Fyodor wrote:
> I am currently working on a chapter for the O'Reilly Nmap book which
> covers all of the Nmap output formats.  The normal, grepable, and even
> s|<riPt KidDi3 output formats are relatively straightforward.
> However, I believe that the XML output is under-utilized because many
> people fail to recognize the power of the format or don't understand
> all the tools for processing and transforming XML.  Even I'm in the
> latter category, though I'm working on it.
>
> Documenting Nmap XML well is a first step toward improving the
> situation.  So this is a call for suggestions to all you XML advocates
> out there.  In what ways do you use the Nmap XML output?  Do you parse
> it from within a higher level program, transform it to HTML with XSLT, use it to
> populate a database, use XPath to parse the results from the
> command-line in a way that is as easy as awk/sec/cut/etc. on the
> normal output, or something else entirely?  Any detailed description
> of how you use Nmap XML would be appreciated.  Sample code or
> command-lines would be handy as well.

I use the XML output exclusively these days. All the post-processing
is done in perl and depending on the type of scan run (automated,
targetted, or adhoc), the data eventually makes it into its appropiate
database/table. The raw XML files are kept around for safe keeping
all scan info, especially for data not pulled into reports today,
but possibly could be used in the future for historical reasons.

I've tried many of the Namp/XML parsing perl modules out there, and
the only one I liked so far was Nmap::Parser by Anthony G Persaud.
It's small and simple. However, I still have many other self-written
modules wrapping around Nmap::Parser.

People may ask (as seen earlier on the list) why use XML when
awk/sed/grep are readily avaliable. Well, I don't want to get into
that battle, however for my purposes the XML output is nicely
standardized, consistant and does give me a great deal of detail.
Is there more I'd like to see? Sure, but once I have time to submit
features/patches, I will. Until then, I'll use nmap/XML as is ;)

Thanks for nmap ;)

Okan

> Thanks,
> Fyodor
>
> ---------------------------------------------------------------------
> For help using this (nmap-dev) mailing list, send a blank email to 
> nmap-dev-help () insecure org . List archive: http://seclists.org

-- 
Okan Demirmen <okan () demirmen com>
PGP-Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB3670934
PGP-Fingerprint: 226D B4AE 78A9 7F4E CD2B 1B44 C281 AF18 B367 0934

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org