Re: [NSE Script] Skype v2 service detection

[Matthew Boyle <mb2263 () bristol ac uk>]

hi Brandon,

seems you beat me to it :-)

Brandon Enright wrote:
> > With his latest NSE release, I think scripts can
> > modify the service table so that this skype protocol 2 information can
> > be output just as if it had been discovered by VD.
>
> Great!  I was going to ask for this.  Looking back at the final release
> notes I see:
>
> "* scripts can now belong to multiple categories
> * the execution order of scripts can be predetermined by providing a  
> unixish runlevel
> * you can now get/set the version information of a port."
>
> However I haven't seen any sample scripts do any of this and can't seem
> to find any documentation describing these features.  If you can point
> me in the right direction I'd like to play with some of these features.

i've just been messing around with that, and it seems that you need to 
set the keys in the port.version table, then use nmap.setPortVersion() 
to apply the changes.  so, for example:

        port.version.name = "skype-v2"
        port.version.product = "skype VoIP server, protocol version 2"
        -- <any other details you can glean from the responses> --
        nmap.setPortVersion(host, port, "softmatched")
        return

at the end of the script seems to do what we want.

according to the man-page, you can also modify the fingerprint, but 
whether you can make it vanish completely i'm not sure (and i've got no 
way of checking right now, i'm afraid).  maybe set it to nil?

the man page does look like it needs a bit of a clean-up though...i'll 
try and remember to have a look at it later, see what i can make of it.

a couple of other thoughts:

+ the script currently runs against any and all ports 80/443 it finds. 
would there be any benefit in not running it if that port has already 
been determined to be an http(s) server?  `and (port.service ~= "http" 
or port.service ~= "https")` on the end of the portrule, for instance.

+ more generally, the `return on socket error` code crops up a lot. 
would it be a good candidate for a library of useful functions?

--matt

-- 
et je triche, et je mens, et je m'éclate, et je touche à tout.


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org