Re: [PATCH] Probe and matchline for Apache AJP 1.4 protocol

[Fyodor <fyodor () insecure org>]

On Mon, Jul 06, 2009 at 06:02:11AM -0500, Tom Sellers wrote:
> The attached patch adds a probe and matchline for the Apache JServ
> Protocol (AJP) version 1.3.  The probe is a server-to-container
> CPing packet (Code 10) and the match is the CPong reply (Code 9).

Looks good, I've applied this too.

Cheers,
-F



> Tom Sellers
>
>
> 1:  http://en.wikipedia.org/wiki/Apache_JServ_Protocol
> 2.  http://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html

> Index: nmap/nmap-service-probes
> ===================================================================
> --- nmap/nmap-service-probes    (revision 14006)
> +++ nmap/nmap-service-probes    (working copy)
> @@ -7384,3 +7384,13 @@
>  ports 1583,3351
>  rarity 8
>  match psql-btrieve m|^A\0K\0\0\0....\0\0\0\0\0\0\xff\xff\xff\xff\0\0\n\x04\xa0|s p/Pervasive.SQL Server - Btrieve 
> Engine/
> +
> +
> +##############################NEXT PROBE##############################
> +# Apache JServe Protocol (ajp) v1.3 Ping request
> +Probe TCP ajp q|\x12\x34\x00\x01\x0a|
> +rarity 8
> +ports 8008,8009
> +
> +# AJP 1.3 Ping response
> +match ajp13 m|^\x41\x42\x00\x01\x09$| p/Apache Jserv/ i/Protocol v1.3/
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://SecLists.Org

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org