Re: Service probe for Hazelcast

[David Fifield <david () bamsoftware com>]

On Thu, Apr 11, 2013 at 08:51:03PM +0200, Pavel Kankovsky wrote:
> On Tue, 9 Apr 2013, David Fifield wrote:
>
> > Thanks for this. Can you get us a service fingerprint as well? [...]
> > You are looking for the block that starts with
> > ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
>
> I have renamed the probes to make the correspondence between probes
> and responses clearer:
>
> Probe TCP hazelcast-bin q|HZC|
> Probe TCP hazelcast-http q|GET /hazelcast/rest/cluster HTTP/1.0\r\n\r\n\r\n|
>
> > What's the reason for three \r\n in the first probe, rather than two?
>
> It does not respond until it gets at least three CRLFs (it remains
> silent when it receives GetRequest).
>
> BTW: I've found two identical memcached TCP probes in
> nmap-service-probes ($Id: nmap-service-probes 30313 2012-11-29
> 05:40:32Z david $ from 6.25)
>
> Probe TCP Memcache q|stats\r\n| at line 11352
> Probe TCP memcached q|stats\r\n| at line 11770

Thank you for these results. I chose the HTTP-based probe, made some
changes, and committed it in r30808.

David Fifield
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/