Re: Nmap-LUA release candidate

[Fyodor <fyodor () insecure org>]

On Sun, Jul 30, 2006 at 03:22:33PM +0200, Diman Todorov wrote:
> Hello,
> there is now a quite complete, stable and portable version of Nmap-LUA.
> Nmap-LUA does for nmap what NASL does for nessus.

I've been playing with it a bit more this evening.  Not as much as I
had hoped, since I got distracted reading the LUA book while writing
one of my own scripts :).  But I have a few suggestions, though they
are mostly just trivial script changes.

in showHTMLTitle.lua, you have:

> url = "http://"; .. host.name
> request = "GET " .. url .. " HTTP/1.0\n\n"

I don't know what web server lets you do this, but mine don't.  I
think the url (path actually) should probably be "/" and the request
should end in "\r\n\r\n" instead of "\n\n".  With those changes, it
worked against a thttpd instance I was testing against.

In the process, I tried the trace support and noticed:

SCRIPT ENGINE: UDP 69.232.206.50:40665 > 193.0.0.135:43 | CONNECT
SCRIPT ENGINE: UDP 127.0.0.1:59410 > 127.0.0.1:80 | GET http://flog HTTP/1.0
SCRIPT ENGINE: UDP 127.0.0.1:45826 > 127.0.0.1:22 | SSH-2.0-OpenSSH_4.3

I'm not sure why it says UDP, but it probably shouldn't.  Is this
related to one of the nsock fixes you sent me (which I checked in) or
is it something else?

I also noticed in harmless/ripeQuery.lua:

> --      socket:connect("whois.ripe.net", 43)
>        socket:connect("193.0.0.135", 43)

Why not use the DNS entry?

For debugging, it may be worthwhile to have scripts return some text
in many/all instances.  But for the release version, we shouldn't
print anything unless it is particularly informative.  For example, we
can take out the "site doesn't have a title" report string from
showHTMLTitle.  In fact, we'll probably move that whole script to a
non-default location for the release (though it is still very handy to
have for debugging).

I'm also hoping we'll get some scripts or ideas from other Nmap
developers.

Cheers,
Fyodor


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev