Nmap Development mailing list archives

November 2010 service detection highlights

From: David Fifield <david () bamsoftware com>
Date: Tue, 28 Dec 2010 13:32:33 -0800

I just finished integrating 1,840 service submissions and 10 corrections
between April and November 2010. nmap-service-probes grew in size from
6,663 to 7,354 match lines (+13%). Here are a few interesting
submissions and matches I came across.

match http-proxy m|^HTTP/1\.1 403 Forbidden\r\nServer: Lusca/([\w._-]+)\r\n| p/Lusca http proxy/ v/$1/
        There is a theme of sea life in HTTP proxies. He have matches
        for Squid, Polipo, and Lusca. A Lusca is a sea monster.
        http://en.wikipedia.org/wiki/Lusca

match http m|^HTTP/0\.9 400 Bad Request\r\n\r\n$| p/Ganeti httpd/
match http m|^HTTP/2\.0 302 Found\r\nServer: SmarterTools/([\w._-]+)\r\n.*X-AspNet-Version: ([\w._-]+)\r\n.*Location: 
/Login\.aspx\r\n|s p/SmarterTools httpd/ v/$1/ i/ASP.NET $2/ o/Windows/
        Past and future versions of HTTP. HTTP/0.9 exists, but not like
        this, because it isn't supposed to return any response header
        (http://www.w3.org/Protocols/HTTP/AsImplemented.html). HTTP/2.0
        doesn't exist.

Here are a couple of SMTP servers that tell you where to go if you ask
for help:
---------- Help ----------
"220 mx\.google\.com ESMTP bq20sm7560916bkb\.4\r\n214 2\.0\.0 http://www\.google\.com/search\?btnI&q=RFC\+2821 
bq20sm7560916bkb\.4\r\n"
---------- Help ----------
"220 hostname ESMTP service ready\r\n214 2\.0\.0 try reading the RFCs: http://www\.imc\.org/rfcs\.html\r\n";

match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nConnection: 
close\r\n\r\n<!---CAS:0003--><HTML><HEAD>\n<TITLE> Broadband NAT Router Web-Console           </TITLE>|s p/D-Link 
DGE-530T network adapter http config/
        This is an httpd embedded within a PCI network adapter.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

Current thread:

November 2010 service detection highlights David Fifield (Dec 28)