Home page logo
/

nmap-dev logo Nmap Development mailing list archives

Re: [NSE] All-Seeing Eye version detection and info
From: Marin Maržić <marzic () gmail com>
Date: Mon, 25 Nov 2013 22:10:25 +0100

The All-Seeing Eye was an application that would track game servers, display their status, etc. for various games.
There is also the All-Seeing Eye protocol for querying game servers about their status, that various games had
implemented so they could be queried for their status in a "standardized" way.

The project and game server tracking program have been dead for a while, but game servers that had decided to use
the protocol still seem to be responding to status queries from anyone (including Nmap :)).

There were dozens of games that implemented ASE at the time, and the script has been tested on a few.

These resources (included in the script's doc) list a combined total of ~15 games that use it:
http://int64.org/docs/gamestat-protocols/
http://sourceforge.net/projects/gameq/ (relevant files: games.ini, packets.ini, ase.php)

I do doubt its usefulness myself. Sort of submitted it just for completeness, nostalgia, and because archiving stuff
is neat. Also because I didn't (still don't) really know how many different servers respond to ASE, and the idea of
covering them all with one script seemed attractive.

Wasn't aware scanning speed was a consideration for rarity 9 scans :S The poor rare and endangered services.

Peace out,
Marin

On 20.11.2013. 5:24, Fyodor wrote:
On Tue, Nov 12, 2013 at 12:42 PM, Marin Maržić <marzic () gmail com <mailto:marzic () gmail com>> wrote:

    Here's a version detection solution for All-Seeing Eye, an old-school
    game server service that can (rarely) still be found lying around.


Thanks Marin.  I noticed from the Wikipedia page for this game (http://en.wikipedia.org/wiki/The_All-Seeing_Eye) that 
it was discontinued more than 5 years ago and supposedly the installer stopped working way back then too.  Do you 
know if/how folks are still running it?    Adding version detection probes, payloads, and scripts can make certain 
scans a bit slower, so we only want to do it if there is some reasonable chance of finding the service in the wild.  
It doesn't need to be popular, but at least has to have some decent number of people (maybe at least a thousand) 
still using it.  I don't know if ASE qualifies or not.

Cheers,
Fyodor

_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]