Re: [NSE] hadoop-* / hbase-* - false positives

[John Bond <john.r.bond () gmail com>]

Hi Tom,

Thanks for the feedback, i need to look at these scritps again because they
are broken with the latest releases of hadoop/hbase.


On 2 March 2013 17:50, Tom Sellers <nmap () fadedcode net> wrote:

> All,
>
>   The hadoop-* and hbase-* family of scripts will generate false positives
> against any HTTP service that returns status code 200 when any page is
> requested.  There are quite a few "broken" web services that will return
> 200 to any request.
I agree this should be an easy fix

The following scrips have been verified to be affected:
> hadoop-datanode-info.nse
> hadoop-jobtracker-info.nse
> hadoop-namenode-info.nse
> hadoop-tasktracker-info.nse
> hbase-master-info.nse
> hbase-region-info.nse
>
> In the case of these scripts the issue is somewhat more problematic
> as they overwrite any fingerprint that has already been applied to the
> port.
I have to admit im not sure what the etiquette is here. if my script is
confident that of what service is running on a port then it should
overwrite the description  (in this case i admit my script is being a bit
arrogant).  Im not sure what should happen if 2 scripts claim confidence
about the same port port.  At the moment im not sure how to handle this,
sorry if i have missed something.

It would be nice to have a system where you could register how confident
you where that the service was yours.  i.e. my script runs and says it is
70% confident, your script runs says it is 95% confident.  standard view
shows highest match, if there are two scripts that claim the same score
they are both displayed.  extra -v switches shows the other candidates

> These scripts should probably be reworked to positively match content
> that is known to always been on pages.  Alternately, the version detection
> logic should be moved further down in the logic after a more solid match is
> made.  For example, in hbase-master-info.nse, on lines 70 and 71 the port
> name and version are overwritten.  This should probably be moved down into
> body:match sections below.
>
> agreed should be an easy fix, wil send a patch in tomorrow so it stops
annoying you.  i will also try to work onupdating the script for newer
versions of hadoop/hbase/flume

thanks for the feedback john
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/