Nmap Development mailing list archives

Re: dev Digest, Vol 148, Issue 6

From: Jason McQueen <jmcqueen0528 () gmail com>
Date: Wed, 5 Jul 2017 13:37:48 -0700

Unsubscribe

On Jul 5, 2017 12:00 PM, <dev-request () nmap org> wrote:

Send dev mailing list submissions to
        dev () nmap org

To subscribe or unsubscribe via the World Wide Web, visit
        https://nmap.org/mailman/listinfo/dev
or, via email, send a message with subject or body 'help' to
        dev-request () nmap org

You can reach the person managing the list at
        dev-owner () nmap org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of dev digest..."


Today's Topics:

   1. Range IP scan with option -sn show wrong result. (Willsz CS)
   2. Re: Password Profiling and Password Mangling Libraries
      (George Chatzisofroniou)


----------------------------------------------------------------------

Message: 1
Date: Wed, 5 Jul 2017 12:30:30 +0700
From: Willsz CS <willsznet () gmail com>
To: dev () nmap org
Subject: Range IP scan with option -sn show wrong result.
Message-ID:
        <CAMby-euTCAPrDiZ91F6VbSQ_LP8XGcq1Dh5X-PSbXR3t_+r2bQ@
mail.gmail.com>
Content-Type: text/plain; charset="utf-8"

Hi Folks,

I've some problem with scanning host with nmap using format:
192.168.100.70-71 or 192.168.100.70,71 or 192.168.100.70-71,100

root:~# uname -smr
FreeBSD 9.3-STABLE i386

root:~# nmap -v

Starting Nmap 7.40 ( https://nmap.org ) at 2017-07-05 12:18 WIB
Read data files from: /usr/local/share/nmap
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.10 seconds
           Raw packets sent: 0 (0B) | Rcvd: 0 (0B)

Here's an example I've done:

root:~# nmap -sn 192.168.100.70-71

Starting Nmap 7.40 ( https://nmap.org ) at 2017-07-05 12:23 WIB
Nmap scan report for ip.wifi-ap1.willsz.net (192.168.100.70)
Host is up (0.00021s latency).
MAC Address: 60:E3:27:BC:CC:76 (Tp-link Technologies)
Nmap done: 2 IP addresses (1 host up) scanned in 0.33 seconds

Output nmap only resulting 1 host UP, but actualy host .70 and .71 already
UP:

root:~# nmap -sn 192.168.100.70

Starting Nmap 7.40 ( https://nmap.org ) at 2017-07-05 12:23 WIB
Nmap scan report for ip.wifi-ap1.willsz.net (192.168.100.70)
Host is up (0.00016s latency).
MAC Address: 60:E3:27:BC:CC:76 (Tp-link Technologies)
Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

root:~# nmap -sn 192.168.100.71

Starting Nmap 7.40 ( https://nmap.org ) at 2017-07-05 12:23 WIB
Nmap scan report for ip.wifi-ap2.willsz.net (192.168.100.71)
Host is up (0.00025s latency).
MAC Address: 10:FE:ED:94:81:A9 (Tp-link Technologies)
Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

This problem same with other format too:

root:~# nmap -sn 192.168.100.70-71,100

Starting Nmap 7.40 ( https://nmap.org ) at 2017-07-05 12:26 WIB
Nmap scan report for pcbill.willsz.net (192.168.100.100)
Host is up (0.000091s latency).
MAC Address: 00:30:67:56:75:BF (Biostar Microtech Int'l)
Nmap done: 3 IP addresses (1 host up) scanned in 0.33 seconds

Would you give clue to fix this bug?

Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://nmap.org/mailman/private/dev/attachments/
20170705/48eae950/attachment.html>

------------------------------

Message: 2
Date: Wed, 5 Jul 2017 11:30:54 +0300
From: George Chatzisofroniou <sophron () latthi com>
To: Wong Wai Tuck <wongwaituck () gmail com>
Cc: "dev () nmap org" <dev () nmap org>
Subject: Re: Password Profiling and Password Mangling Libraries
Message-ID:
        <CACeRBzkDDTQVtf5iwxrKhaqfxE0Azt77ROvm08O=D2WasnozXg@mail.
gmail.com>
Content-Type: text/plain; charset="UTF-8"

On Mon, Jul 3, 2017 at 10:22 PM, Wong Wai Tuck <wongwaituck () gmail com>
wrote:

I wanted to separate the libraries to separate the responsibilities of

the

libraries - one took care of loading username/password from files (and
keeping them as two separate tables) and provides the interface for
iterating through them, and the other one (pwdprofile) just solely looks

at

storing interesting candidates (regardless of whether they are usernames

or

passwords) and keeps its own list. However, I am fine with integrating it
into unpwdb, since unpwdb isn't really that big!


Yes, unpwdb acts a generic username/password database library and
methods that include retrieving or inserting credentials (including
the profiling feature) belong there. There is no reason to separate it
to a different library as long as there is only one module taking
advantage of this functionality (unpwdb itself).

I was thinking from the perspective of httpspider, and how it might be
similar to CeWL. Many scripts use httpspider and I felt it didn't make

sense

to implement it in httpspider.lua (since logic of password profiling

would

then be in httpspider), and rather it would be best implemented in
pwdprofile (and we additionally provide a flag to activate it), and

letting

httpspider simply pass the response to pwdprofile for processing.


Profiling is not only about HTTP. The password profiling feature can
work in many different application-layer protocols and it doesn't make
sense to re-write parsers for all these.

It should probably be a separate script's responsibility to collect
special words in HTTP responses and print them back to the user. That
would be useful by itself if a user wants to quickly retrieve unique
words from a website (e.g. the company name). If the user also enables
the password profiling features, these words will be added as username
or password candidates.

George


------------------------------

Subject: Digest Footer

_______________________________________________
dev mailing list
dev () nmap org
https://nmap.org/mailman/listinfo/dev


------------------------------

End of dev Digest, Vol 148, Issue 6
***********************************

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/

Current thread:

Re: dev Digest, Vol 148, Issue 6 Jason McQueen (Jul 05)