Re: Nmap comprehensive scan problem via Armitage

[Fyodor <fyodor () insecure org>]

On Fri, Jun 17, 2011 at 12:41:57AM -0700, David Fifield wrote:
> On Fri, Jun 17, 2011 at 10:12:08AM +0300, Shinnok wrote:
>
> We already undocumented --script=all. I think the plan is just to remove
> it because it's basically useless, for the reasons you cite.

I'm glad we undocumented it.  We might keep it for the rare times it
is useful.  For example "--script-help all" or "--script 'all and not
intrusive'".  I think the latter could be reduced to just "not
intrusive", but some users intuitively use the more verbose version.

> It looks like Armitage got the command line from our "Slow comprehensive
> scan" Zenmap profile:
>
> command = nmap -sS -sU -T4 -A -v -PE -PS80,443 -PA3389 -PP -PU40125 -PY --source-port 53 --script all
>
> We should change that. What do you think, maybe "discovery and safe"?

Great point!  As Shinook noted, there are some default scripts which
don't match this query.  So maybe "default or (discovery and safe)"
would be better.  Thee are default scripts which aren't in both discovery
and safe categories:

auth-owners.nse:categories = {"default", "safe"}
dns-recursion.nse:categories = {"default", "safe"}
ftp-anon.nse:categories = {"default", "auth", "safe"}
ftp-bounce.nse:categories = {"default", "safe"}
http-auth.nse:categories = {"default", "auth", "safe"}
http-methods.nse:categories = {"default", "safe"}
http-vmware-path-vuln.nse:categories = {"vuln", "safe", "default"}
imap-capabilities.nse:categories = {"default", "safe"}
p2p-conficker.nse:categories = {"default","safe"}
realvnc-auth-bypass.nse:categories = {"auth", "default", "vuln", "safe"}
smbv2-enabled.nse:categories = {"default", "safe"}
sshv1.nse:categories = {"default", "safe"}
sslv2.nse:categories = {"default", "safe"}
wdb-version.nse:categories = {"default", "version", "discovery"}
x11-access.nse:categories = {"default", "safe", "auth"}

Admittedly some of these should probably be added to discovery.

Cheers,
Fyodor
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/