Home page logo
/

nmap-dev logo Nmap Development mailing list archives

Re: Nmap NSE: Bad Behaviour
From: bensonk () acm wwu edu
Date: Thu, 29 May 2008 22:59:08 -0700

I'd like to suggest picking a user-agent and sticking with it unless
it's specifically overridden.  There are a lot of people out there
breaking the HTTP protocol, and I don't see any reason for nmap to be
one of them.  Specifying a user-agent on the command line or
specifically in a script is one thing, but I'd like to see the "right" 
user-agent unless it's explicitly asked that we not.  Web servers may
provide different results based on user-agent, so I think picking random
ones would lead to nondeterministic scan results, which seems like a bad
plan to me.  Does that sound reasonable?

Benson

On Fri, May 30, 2008 at 12:37:41AM -0500, Kris Katterjohn wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Kris Katterjohn wrote:
What about adding a function to the HTTP library to return a random user
agent?  There can be a table of, say, 8-10 user agents ranging from IE to
Firefox to Opera and with different OS's in the information.  And maybe a
generic name can be passed to the function to grab a specific browser's
user-agent data, like http.get_user_agent("Firefox") (although maybe that's
going overboard).

Then the HTTP library can use it, and anybody else using HTTP, but not the
library, can get it too.


Wow, that sounded really stupid :) I meant to say anybody not using the
library to build/send the HTTP data, like my HTTPtrace.nse for instance.

Thanks,
Kris Katterjohn

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIVAwUBSD+Sov9K37xXYl36AQKKjhAAtouKujtBJQXdnB2TFlSP/7riTPidc2O8
R4TIDzvM0Mvs378R3be0SrUODk2UcslE8wX6Twz3OwHAQT3dHv8D+gt1VGV0Tedv
1ZD0HqdiH+5x1N++/6fzQ6iQdULirVB38lJYOq9p12cYthb/SxevI0i/CJy9knwi
4melOuYIUkpXQnMFupjXgjfU/0E2JnhlGUFodAKd8bt54t72wuZz4epYiKTboG9k
7za/PuJ3DBgxaz9CfpabCnYidXnpBWAybVztRLIyfxKJofiN7rwO4zJ2lHGVYYJC
0EBaKX8uljUvrQKhJ8yEhCMFYcmz4eTYeETxWrw0DGOuIZSJpll1G1TnIX3KeDhv
N76SqJYRXmbqYa73LVIXGTPzPgFa20JWUfEZlb9fwo/Ut3Vqq7/8kCJFJAjNrXjj
+wZT46BBhgNANqf4/nFsVgtB0eZZnAqcPlz0DqXA9D2bw8qJm/Sgzs6TykQq0Ln4
2nyJ00SJvK8iJYt7Ub+0j4BCt++tXsluP5HKvIRsvwZS/4GCptIl2X4uXffrk0Rv
xPG3AAbkjnF2R/xoA7bj1o4smwNCCtevfA7gIIvXQG6HtHsKPHt16fYFiontQDLQ
3jS+TZMHKRsemG3+1pXcl6y8hOgww7LC5mIxNnjZZN/X3B1nbrgySVIwdq0K2PuV
ZfUd9q8FTRc=
=Zka9
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org

Attachment: _bin
Description:


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]