Re: [NSE] Stuxnet detection

[Mak Kolybabi <mak () kolybabi com>]

On 2010-12-06 20:39, Mak Kolybabi wrote:
> Future versions of this script will include the ability to detect the exact
> version of a Stuxnet infection, and offer the option to download a copy of the
> executable.

Here's the final -- assuming nobody has problems -- version of the script,
submitted for (hopefully) inclusion into Nmap. It includes the version number of
Stuxnet (a 64-bit value rendered in hex), and the ability to download the remote
host's Stuxnet executable (disabled by default).

Comments, concerns, criticism, and testing are appreciated.

--
Mak Kolybabi
<mak () kolybabi com>

() ASCII Ribbon Campaign | Against HTML e-mail
/\  www.asciiribbon.org  | Against proprietary extensions

Attachment: stuxnet-detect.nse
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/