Home page logo

nmap-dev logo Nmap Development mailing list archives

Service integration highlights
From: David Fifield <david () bamsoftware com>
Date: Wed, 17 Jul 2013 20:48:57 -0700

Here are the highlights of integrating 737 service fingerprint
submissions and 5 corrections since January 7. For help understanding
the format of matchlines, see http://nmap.org/book/vscan-fileformat.html#vscan-db-match.

match bitcoin 
 p/Bitpeer/ v/$1/
        This is really interesting. Bitcoin needed to make a
        backward-incompatible protocol change to add checksums to
        certain messages. But because all nodes need to be able to
        communicate with each other, they couldn't make this change
        incrementally. So they put a time check in the source code, and
        on February 20, 2012, all nodes instantly and simultaneously
        began to speak a different protocol.


        The source code literally said this:
                // Version 0.2 obsoletes 20 Feb 2012
                if (GetTime() > 1329696000)

        Nmap's bitcoin.lua was patched in the nick of time in r28104.

        Unfortunately I think that this coordinated change instantly
        obsoleted all our existing Bitcoin matchlines! They'd only work
        against extremely old software that didn't know to change the
        protocol with everyone else, and there's no reason why that
        software would ever be used since it can't communicate with the
        rest of the network. Just imagine minding your own business and
        suddenly everyone in the world starts speaking a different

match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: BQTWWW/([\w._-]+) \(RSX\) \(RSX-11M-PLUS V([\w._-]+)\)\r\n| 
p/BQTWWW/ v/$1/ cpe:/o:dec:rsx_11m_plus:$2/ o/RSX-11M-PLUS $2/
        I previously wrote about the work of Johnny Billquist at
        http://seclists.org/nmap-dev/2012/q4/221. But I think I made a
        mistake there--the TCP/IP stack attributed to him should have
        been that of RSX-11M-PLUS, not DG/UX. Anyway, this is a web
        server for RSX-11M-PLUS, also written by Billquist. It's running
        on an emulated PDP-11!

match http m|^HTTP/1\.1 401 UNAUTHORIZED\r\nWWW-Authenticate: Basic realm=\"CouchPotato Login\"\r\nContent-Type: 
text/html; charset=utf-8\r\nContent-Length: 54\r\nServer: TornadoServer/([\w._-]+)\r\n\r\nThis is not the page you are 
looking for\. \*waves hand\*$| p/Tornado httpd/ v/$1/ i/CouchPotato downloader/
        "This is not the page you are looking for\. \*waves hand\*" This
        is an automatic downloader program.

match telnet 
 your nickname for this session \(Alt\+1\)\xe2\x95\x90| p/dfterm2 telnetd for Dwarf Fortress game/
        This is a utility that allows you to play the video game Dwarf
        Fortress over Telnet. Telnet signature are often highly unique,
        even without identifying text, because of ANSI escape sequences
        and Telnet options.

match http m|^HTTP/1\.0 \xff\xfbAllow: GET \r\nAccept-Ranges: bytes\r\nCache-Control: no-cache\r\nCache-Control: 
no-store\r\nConnection: Keep-Alive\r\nServer: GoPro Web Server v([\w._-]+)\r\nContent-Type: 
text/plain\r\nContent-Length: 2\r\n\r\n$| p/GoPro HERO3 camera http interface/ v/$1/ cpe:/h:gopro:hero3/ d/webcam/
        This is quite a strange interpretation of HTTP. Note the mangled
        \xff\xfb in the status-line, that seems to run right into the
        header fields. It says the content-length is 2, but the body is

match http m|^HTTP/2\.0 404 Not Found\r\n.*Server: Restlet-Framework/@major-number () \ 
@minor-number@@release-type@@release-number () \r\n *<p>The server has not found anything matching the request 
URI</p>|s p/Serviio media server http status/
        This is supposedly "HTTP 2.0". Look at the broken variable
        substitution (@major-number@) where a version number should be.

match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: HTTP Server\r\n.*<!--\n    M Comeau Dec 19, 2011\n    This page 
is used to redirect to the URL below\.  It is necessary to do this\n    so the http server properly redirects to the 
CGI\.\n-->\n<head>\n<title>BSE Redirect</title>|s p/Chrysler wiTECH VCI Pod automotive diagnostic device/ d/specialized/
        I think this is one of those things a service technician plugs
        into your car to interpret the error codes.

match telnet m|^\xff\xfd\x03\xff\xfb\x03\xff\xfd\x18\xff\xfd\x17Please wait\. The connection to your station is still 
in the process of being established\. Your last input has been discarded\.\r\nPlease wait\. The connection to your 
station is still in the process of being established\. Your last input has been discarded\.\r\n| p/Burroughs MCP 
telnetd/ o/Burroughs MCP/ cpe:/o:burroughs:mcp/
        The Wikipedia page for this OS says "Initial release: 1961; 52
        years ago." (But the system this fingerprint was taken from was
        probably a much newer release.)

match telnet m|^\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x01\xff\xfb\x03\r\r\nGET / HTTP/1\.0\r\n\r\n\r\nPartedMagic login: 
login: loginprompt\.c:164: login_prompt: Assertion `wlen == \(int\) len -1' failed\.\r\n| p/Busybox telnetd/ v/1.19.4/ 
i/Parted Magic pkg-shadow login/
        Nmap apparently crashes the login program that comes with the
        shadow suite. You can see the assertion in the source code here:
        Parted Magic is a distro with disk partitioning programs.

David Fifield
Sent through the dev mailing list
Archived at http://seclists.org/nmap-dev/

  By Date           By Thread  

Current thread:
  • Service integration highlights David Fifield (Jul 18)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]