Re: [ANNOUNCEMENT] Umit 0.8.2-testing release

[Fyodor <fyodor () insecure org>]

Hi Adriano.  I've been playing with your latest release and I find
that, when it works, Umit beats the pants off NmapFE!  I would like to
replace NmapFE with UMIT if we can resolve some of the issues.  I'll
first describe my Linux testing as that was the most successful.

I downloaded umit-0.8.2.tar.bz2 and was glad to see that it was only
971K.  I was also pleased to see a README file in the tarball giving
installation instructions.

The README has "Default (source) Installation" which involves running
umit.pyw and "GNU/Linux Installation" which involves running setup.py.
I first tried running umit.py.  It didn't have the execute bit set and
so I had to chmod 755 it first.  But even after that, umit.py failed
with the message "ImportError: No module named pysqlite2".  Indeed I
don't have such a package installed on my updated Fedora Core 5 system,
but I do have "python-sqlite-1.1.7-1.2".

Next I tried running setup.py.  It installed a bunch of stuff to
/usr/bin and other /usr paths.  It would be nice for the README to
explain how to select the installation directory.  Nmap can be
installed in an unprivileged user's home directory, and UMIT should be
able to support the same.

Anyway, I then ran /usr/bin/umit.pyw and up popped UMIT!  It did say
"ERROR - 2006-08-13 20:09:04,086 - RUNNING WITHOUT PSYCO!", whatever
that means.  I filled out the target "scanme.nmap.org" and pressed
"Start Scan".  Everything else was left as is.  Unfortunately, nothing
happened in the GUI.  On the terminal in which UMIT started I saw the
error "sh: -oX: command not found".  This sort of error should
probably pop up a dialogue since people may not see terminal window
errors (especially if they start the app through a window manager
menu).

Guessing that the problem may have been the blank-by-default profile
field, I changed it to "Quick Scan".  This time the "command" field
was populated and the scan commenced successfully as soon as I hit the
start button.  Yay!  There should probably be a default profile, or at
least an error message if you try to start a scan without selecting
one.

I repeated the scan in the same window and it worked again.  Then I
started new scans in separate tabs and those seemed to be successful
too.  Looking good!

But once I began dealing with multiple tabs, I accidently closed a tab
when I was trying to just switch to that tab.  Argh!  The "close tab"
X icon placement is really bad.  Is there an easy way to put the
"close" button on the right side of the panel like it is on FireFox?
Or some other alternative to having it inside the "switch to this tab"
area?  If there is no other option for moving the "close tab" button,
I'd like to have a confirm dialogue when you close a tab.

I started a moderately long scan and Nmap (not surprisingly) just
sat there for a while.  Is there any way to see progress reporting?
I guess a start would be including "-v" in more of the default
profiles.

I then tried the "compare results" option.  I can see this generic text
diff potentially being useful, but we may want to consider making it
understand Nmap output later so that it can directly tell you about
new/missing hosts, newly open/closed ports, etc.

I tried resizing the application and that was totally graceful!  Too
many GUIs (and web pages) fail that test.  Good job!

I really like the way you can flip through the target hosts on the
left-menu and see them displayed in the "Open Ports", "Host Details",
or "Scan Details" panes.  But what do you think about also letting you
flip through them while reading the "Nmap Output" pane?  Selecting a
host on the left would cause the "Nmap Output" pane to be positioned
at the "Interesting ports on ..." line for that host.

The "Profile editor" is great.  But is it possible to do a UDP scan
with this?  Also, the "Special scans" pull-down on the "scans" pane
seems to overlap with the checkboxes on the "special" pane.  You can
probably just remove the Special pane entirely.  I really like the way
you can see the command-line as it is constructed.

Those were my first runtime reactions to UMIT on Linux.  I will do
further testing and send more comments on your future versions.

Before Linux, I actually tried your Windows installer.  The 18MB size
is rather unfortunate.  That makes the Nmap GUI Windows installer
almost 20 times as large as the Windows installer for Nmap itself!
Can you think of any ways to slim it down without hampering
functionality too much?

Running the installer was a bit of work as well.  Separate installers
for Python, PyGTK, PySqlite, and PyCairo all popped up.  I think
installers for Nmap and GTK itself were run too, but in silent mode.
Is there a way to make that easier?

Once installation was finished, I was glad to see UMIT added to the
start menu.  It would be nice to give an option to add it to the
Windows desktop as well.

So I clicked on the new UMIT start menu item and nothing happened :(.
I cruised on over to c:\nmap\umit-0.8.2 in Windows explorer and saw
that umit.pyw was apparently properly registered to Python (it had a
green snake icon).  I clicked and got a "busy" icon for about 5
seconds before the hourglass disappeared and nothing pops up.  What
would you like me to run to debug this?

UMIT definitely has a lot of potential, but I would to get the most
serious of the issues above resolved before we do a mainstream release
much beyond nmap-dev.  But you might want to start announcing releases
on freshmeat.net, as that can be a good way to get users.

I hope this helps!
-Fyodor

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org