Nmap Development mailing list archives

Re: new quake3-info script


From: David Fifield <david () bamsoftware com>
Date: Wed, 21 Sep 2011 16:22:32 -0700

On Thu, Sep 22, 2011 at 02:19:32AM +0300, Toni Ruottu wrote:
We would need to collect lots of version lines first to see the
different formats. Here are the two I got from my servers.
version: tremulous 1.1.0 linux-x86_64 Aug  5 2010
version: ioq3 1.36+svn1933-1/Ubuntu linux-x86_64 Apr  4 2011

I think Debian in your case and Ubuntu above are parts of the software
version number and not operating system identifiers. We know that the
protocol is quake3. It seems safe to assume that the first part is the
product name, and the second part is the version number. I would
prefer to leave Ubuntu or Debian as a part of the version number. It
might make sense to look at the product name first and parse the rest
based on that. In that case we would only register version information
for the products explicitly mentioned in the script. At least I need
to find out what Windows servers look like before implementing this
feature.

Don't overthink it. Just split on whitespace and set product = $1,
version = $2, and grep $3 for "linux" to set ostype. If it turns out not
to work for some servers, then we can fix it.

David FIfield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/


Current thread: