I didn't find any public nmap bug reporting system, so I'm sending this
here. While writing some new service signatures, I got the following
message.
Commands, and output:
---------------------
~$ /usr/local/bin/nmap --append-output --log-errors -oA alpha2 -r -sV --version-all -T4 -P0 172.16.104.1 -p 80
Starting Nmap 4.21ALPHA1 ( http://insecure.org ) at 2007-02-06 20:26 PST
nmap: service_scan.cc:621: int substvar(char*, char**, char*, int, const u8*, int, int*, int): Assertion `offstart >= 0 && offstart < subjectlen' failed.
Aborted
--
The section from nmap-service-probes:
-------------------------------------
Probe TCP RTSPRequest q|OPTIONS / RTSP/1.0\r\n\r\n|
rarity 5
ports 80,554,3052,3372,5000,7070,8080,10000
fallback GetRequest
match stop m|^HTTP/1.1 400 Bad Request \r\nConnection: close\r\n.*\r\nContent-Type: text/html\r\nServer: WEBrick/1\.3\.1 \(Ruby/1\.8\.4/2005-12-24\) OpenSSL/0\.9\.7f\r\nContent-Length: \d+\r\n\r\n(.*)| p/grrr6 $1/
--
What the service is spewing out: (EOL: Header is "\r\n", the HTML is "\n")
--------------------------------
HTTP/1.1 400 Bad Request
Connection: close
Date: Wed, 07 Feb 2007 04:06:18 GMT
Content-Type: text/html
Server: WEBrick/1.3.1 (Ruby/1.8.4/2005-12-24) OpenSSL/0.9.7f
Content-Length: 312
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<HTML>
<HEAD><TITLE>Bad Request</TITLE></HEAD>
<BODY>
<H1>Bad Request</H1>
bad Request-Line `OPTIONS / RTSP/1.0'.
<HR>
<ADDRESS>
WEBrick/1.3.1 (Ruby/1.8.4/2005-12-24) OpenSSL/0.9.7f at
[etc...]
--
With "nmap -d9":
----------------
[...]
Starting probes against new service: 172.16.104.1:80 (tcp)
NSOCK (0.0500s) TCP connection requested to 172.16.104.1:80 (IOD #1) EID 8
NSOCK (0.0500s) nsock_loop() started (no timeout). 1 events pending
NSOCK (0.0500s) Callback: CONNECT SUCCESS for EID 8 [172.16.104.1:80]
NSOCK (0.0500s) Read request from IOD #1 [172.16.104.1:80] (timeout: 6000ms) EID 18
NSOCK (6.0500s) Callback: READ TIMEOUT for EID 18 [172.16.104.1:80]
NSOCK (6.0500s) Write request for 18 bytes to IOD #1 EID 27 [172.16.104.1:80]: GET / HTTP/1.0....
NSOCK (6.0500s) Read request from IOD #1 [172.16.104.1:80] (timeout: 5000ms) EID 34
NSOCK (6.0500s) Callback: WRITE SUCCESS for EID 27 [172.16.104.1:80]
NSOCK (6.0620s) Callback: READ SUCCESS for EID 34 [172.16.104.1:80] (325 bytes)
NSOCK (6.0620s) Read request from IOD #1 [172.16.104.1:80] (timeout: 4985ms) EID 42
NSOCK (6.0660s) Callback: READ SUCCESS for EID 42 [172.16.104.1:80] (87 bytes)
NSOCK (6.0660s) Read request from IOD #1 [172.16.104.1:80] (timeout: 4978ms) EID 50
NSOCK (6.0720s) Callback: READ EOF for EID 50 [172.16.104.1:80]
NSOCK (6.0720s) TCP connection requested to 172.16.104.1:80 (IOD #2) EID 56
NSOCK (6.0730s) Callback: CONNECT SUCCESS for EID 56 [172.16.104.1:80]
NSOCK (6.0730s) Write request for 22 bytes to IOD #2 EID 67 [172.16.104.1:80]: OPTIONS / HTTP/1.0....
NSOCK (6.0730s) Read request from IOD #2 [172.16.104.1:80] (timeout: 5000ms) EID 74
NSOCK (6.0730s) Callback: WRITE SUCCESS for EID 67 [172.16.104.1:80]
NSOCK (6.0740s) Callback: READ SUCCESS for EID 74 [172.16.104.1:80] (187 bytes)
NSOCK (6.0740s) Read request from IOD #2 [172.16.104.1:80] (timeout: 4995ms) EID 82
NSOCK (6.0780s) Callback: READ EOF for EID 82 [172.16.104.1:80]
NSOCK (6.0780s) TCP connection requested to 172.16.104.1:80 (IOD #3) EID 88
NSOCK (6.0780s) Callback: CONNECT SUCCESS for EID 88 [172.16.104.1:80]
NSOCK (6.0780s) Write request for 22 bytes to IOD #3 EID 99 [172.16.104.1:80]: OPTIONS / RTSP/1.0....
NSOCK (6.0780s) Read request from IOD #3 [172.16.104.1:80] (timeout: 5000ms) EID 106
NSOCK (6.0790s) Callback: WRITE SUCCESS for EID 99 [172.16.104.1:80]
NSOCK (6.1320s) Callback: READ SUCCESS for EID 106 [172.16.104.1:80] (193 bytes)
nmap: service_scan.cc:621: int substvar(char*, char**, char*, int,
const u8*, int, int*, int): Assertion `offstart >= 0 && offstart <
subjectlen' failed.
Aborted
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org
Received on Feb 06 2007
Intro
