Re: Payload Hexdump in --packet-trace and -d4 output

["Luis MartinGarcia." <luis.mgarc () gmail com>]

Hi J,

I think letting users see the hex dump is a really good idea. Nping does
this already if verbosity level is high enough. As far as I know, Nmap
is supposed to print the hexdump of captured packets, but I've been
testing it and it doesn't (we'll have to check with David).

However, what I was going to say is that there is already a function in
nmap that lets you print the raw hex of a buffer. I wrote a a generic
function for nbase called hexdump() and then, there is a wrapper for it
in nmap/utils.cc, called nmap_hexdump().

So, maybe it's better to use nmap_hexdump() instead of your
implementation because this has been discussed already [1].

Apart from that, I'd like to know your opinion on this. Do you think we
should just print the payload, or better print the whole packets that
Nmap sends? Maybe we could add a call to nmap_hexdump() right before
calling functions like send_ip_packet() or maybe even inside those
functions (as they already depend on the NmapOps object, and therefore
are not reusable for the other tools. What do you guys think? pros and cons?

Luis MartinGarcia.


[1] http://seclists.org/nmap-dev/2009/q3/669




On 06/02/2010 07:24 PM, jrf wrote:
> All,
>
> Attached is a patch of perhaps limited interest. While testing the
> payloads from a file code David wrote a nice print function to dump
> out the UDP payload. I thought it would be cool if we could include
> this as part of a trace/debug output. I adapted David's function and
> have attached it for anyone interested. Note this should be printing
> all UDP payloads not just those we load up from the file. 
>
> Per David's suggestion to invoke this type:
>
>  nmap -sU --packet-trace -d4 [host[s] spec]
>
> For speedier test results I suggest using --top-ports<=64
>
> Comments, suggestions, bricks all welcome.
>
>
> Thanks,
>  j
>
> Index: utils.h
> ===================================================================
> --- utils.h     (revision 17780)
> +++ utils.h     (working copy)
> @@ -240,4 +240,5 @@
>  int win32_munmap(char *filestr, int filelen);
>  #endif /* WIN32 */
>  
> +void print_hexdump(const unsigned char *data, size_t len); /* XXX jrf
> UDPPrint */
>  #endif /* UTILS_H */
> Index: utils.cc
> ===================================================================
> --- utils.cc    (revision 17780)
> +++ utils.cc    (working copy)
> @@ -925,3 +925,32 @@
>  }
>  
>  #endif
> +
> +/* XXX jrf - UDP Printer */
> +void print_hexdump (const unsigned char *data, size_t len) {
> +  unsigned int i, j;
> +
> +  i = 0;
> +  while (i < len) {
> +    printf("%04X ", i);
> +    for (j = 0; j < 16; j++) {
> +      if (j == 8)
> +        printf(" ");
> +      if (i + j < len)
> +        printf(" %02X", data[i + j]);
> +      else
> +        printf("   ");
> +    }
> +    printf("  ");
> +    for (j = 0; j < 16; j++) {
> +      if (j == 8)
> +        printf(" ");
> +      if (i + j < len)
> +        printf("%c", isprint(data[i + j]) ? data[i + j] : '.');
> +      else
> +        printf(" ");
> +    }
> +    i += j;
> +    printf("\n");
> +  }
> +}
> Index: scan_engine.cc
> ===================================================================
> --- scan_engine.cc      (revision 17780)
> +++ scan_engine.cc      (working copy)
> @@ -3193,6 +3193,10 @@
>  
>      payload = get_udp_payload(pspec->pd.udp.dport, &payload_length);
>  
> +    /* XXX jrf UDP payload print */
> +    if ((o.packetTrace()) && (o.debugging > 3)) 
> +      print_hexdump((unsigned char *) payload, payload_length);
> +
>      for(decoy = 0; decoy < o.numdecoys; decoy++) {
>        packet = build_udp_raw(&o.decoys[decoy],
> hss->target->v4hostip(),
>                              o.ttl, ipid, IP_TOS_DEFAULT, false,
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/
>
>   

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/