Home page logo

nmap-dev logo Nmap Development mailing list archives

Re: Nmap comprehensive scan problem via Armitage
From: Fyodor <fyodor () insecure org>
Date: Sun, 19 Jun 2011 16:26:43 -0700

On Fri, Jun 17, 2011 at 12:41:57AM -0700, David Fifield wrote:
On Fri, Jun 17, 2011 at 10:12:08AM +0300, Shinnok wrote:

We already undocumented --script=all. I think the plan is just to remove
it because it's basically useless, for the reasons you cite.

I'm glad we undocumented it.  We might keep it for the rare times it
is useful.  For example "--script-help all" or "--script 'all and not
intrusive'".  I think the latter could be reduced to just "not
intrusive", but some users intuitively use the more verbose version.

It looks like Armitage got the command line from our "Slow comprehensive
scan" Zenmap profile:

command = nmap -sS -sU -T4 -A -v -PE -PS80,443 -PA3389 -PP -PU40125 -PY --source-port 53 --script all

We should change that. What do you think, maybe "discovery and safe"?

Great point!  As Shinook noted, there are some default scripts which
don't match this query.  So maybe "default or (discovery and safe)"
would be better.  Thee are default scripts which aren't in both discovery
and safe categories:

auth-owners.nse:categories = {"default", "safe"}
dns-recursion.nse:categories = {"default", "safe"}
ftp-anon.nse:categories = {"default", "auth", "safe"}
ftp-bounce.nse:categories = {"default", "safe"}
http-auth.nse:categories = {"default", "auth", "safe"}
http-methods.nse:categories = {"default", "safe"}
http-vmware-path-vuln.nse:categories = {"vuln", "safe", "default"}
imap-capabilities.nse:categories = {"default", "safe"}
p2p-conficker.nse:categories = {"default","safe"}
realvnc-auth-bypass.nse:categories = {"auth", "default", "vuln", "safe"}
smbv2-enabled.nse:categories = {"default", "safe"}
sshv1.nse:categories = {"default", "safe"}
sslv2.nse:categories = {"default", "safe"}
wdb-version.nse:categories = {"default", "version", "discovery"}
x11-access.nse:categories = {"default", "safe", "auth"}

Admittedly some of these should probably be added to discovery.

Sent through the nmap-dev mailing list
Archived at http://seclists.org/nmap-dev/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]