Re: [NSE] All-Seeing Eye version detection and info

[Marin Maržić <marzic () gmail com>]

The All-Seeing Eye was an application that would track game servers, display their status, etc. for various games.
There is also the All-Seeing Eye protocol for querying game servers about their status, that various games had
implemented so they could be queried for their status in a "standardized" way.

The project and game server tracking program have been dead for a while, but game servers that had decided to use
the protocol still seem to be responding to status queries from anyone (including Nmap :)).

There were dozens of games that implemented ASE at the time, and the script has been tested on a few.

These resources (included in the script's doc) list a combined total of ~15 games that use it:
http://int64.org/docs/gamestat-protocols/
http://sourceforge.net/projects/gameq/ (relevant files: games.ini, packets.ini, ase.php)

I do doubt its usefulness myself. Sort of submitted it just for completeness, nostalgia, and because archiving stuff
is neat. Also because I didn't (still don't) really know how many different servers respond to ASE, and the idea of
covering them all with one script seemed attractive.

Wasn't aware scanning speed was a consideration for rarity 9 scans :S The poor rare and endangered services.

Peace out,
Marin

On 20.11.2013. 5:24, Fyodor wrote:
> On Tue, Nov 12, 2013 at 12:42 PM, Marin Maržić <marzic () gmail com <mailto:marzic () gmail com>> wrote:
>
>     Here's a version detection solution for All-Seeing Eye, an old-school
>     game server service that can (rarely) still be found lying around.
>
>
> Thanks Marin.  I noticed from the Wikipedia page for this game (http://en.wikipedia.org/wiki/The_All-Seeing_Eye) that 
> it was discontinued more than 5 years ago and supposedly the installer stopped working way back then too.  Do you 
> know if/how folks are still running it?    Adding version detection probes, payloads, and scripts can make certain 
> scans a bit slower, so we only want to do it if there is some reasonable chance of finding the service in the wild.  
> It doesn't need to be popular, but at least has to have some decent number of people (maybe at least a thousand) 
> still using it.  I don't know if ASE qualifies or not.
>
> Cheers,
> Fyodor
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/