Re: New script names

[Fyodor <fyodor () insecure org>]

On Wed, Nov 05, 2008 at 10:12:43PM -0700, David Fifield wrote:
> ircZombieTest => irc-zombie

The description on this one is:

"If port 113 responds before we ask it then something is fishy. Usually this
 means that the host is an IRC zombie."

Presumably spammers and privacy-included IRC users and other parties
use these sorts of fake identd applications.  So unless people really
believe that IRC zombies constitute 95%+ of the instances of this,
maybe this script should focus on fake identd aspect rather than
making the leap to IRC zombies.

So for now I've changed the name to 'auth-spoof' and the description
to:

"Tests whether an identd (auth) server responds with an answer before
we even send the query.  This sort of identd spoofing can be a sign of
malware infection though it can also be used for legitimate privacy
reasons."

I've also improved the output a bit.

Of course I'm always open to discussion if anyone proposes a better
name or description.

Cheers,
-F

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org