Dash in character set issue with ~400 lines of nmap-service-probes

[William Stearns <wstearns () pobox com>]

Good afternoon, fyodor, all,
        Thank you all for your work on nmap.  *sincere smile*

        While I was parsing nmap-service-probes in python (*), about 400 
of the match strings were rejected by python's regex compiler.  I took a 
few minutes to see why; all were related to the "-" character in character 
sets, such as "[\w\d-_]".
        Friedl's book showed two ways the dash could be used in a 
character set; as part of a range ("[A-Z0-9]") or as a flat character in 
the set.  If one wants the latter, a dash character, the dash must be 
either the first or last character in the set, such as: "[-abc]" or 
"[abc-]", or backslash escaped, I suppose.
        If that makes sense to you and I haven't missed something :-), 
here are the character sets in nmap-service-probes that need dashes moved 
(lefthand string), and a replacement with dash in first or last position 
(righthand string):

#First block
"[\w\d-_.]","[\w\d_.-]"
"[\w\d-_]","[\w\d_-]"
"[.-\w]","[.\w-]"
"[\s-\w.,]","[\s\w.,-]"
"[\w\d-.]","[\w\d.-]"
"[\d\.-\w]","[\d\.\w-]"
"[^-A-Z0-9]","[^A-Z0-9-]"

#Second block
"[\w-_.]","[\w_.-]"
"[\w-.]","[\w.-]"
"[\d-.]","[\d.-]"
"[\w-_. ]","[\w_. -]"
"[\w-_.@]","[\w_.@-]"
"[\w-_.\s]","[\w_.\s-]"
"[\w-_]","[\w_-]"
"[\d-_.]","[\d_.-]"
"[\w-_.)(/]","[\w_.)(/-]"
"[\w-_+. ]","[\w_+. -]"
"[\w-_.+]","[\w_.+-]"
"[\w-_+. ()]","[\w_+. ()-]"
"[\w-+.]","[\w+.-]"
"[\w-.+]","[\w.+-]"
"[\w-_./]","[\w_./-]"
"[\w-+]","[\w+-]"
"[\w-+/.]","[\w+/.-]"
"[\w-_.:/]","[\w_.:/-]"
"[\w-_.;]","[\w_.;-]"
"[\d-/]","[\d/-]"
"[\w-. ]","[\w. -]"

        If you're doing a search and replace on the file, skip the second 
block and instead do just these two:

"[\w-","[-\w"
"[\d-","[-\d"

        Thanks again!
        Cheers,
        - Bill

* http://www.stearns.org/passer/

---------------------------------------------------------------------------
         perl -le '$_="6110>374086;2064208213:90<307;55";tr[0->][ LEOR!AUBGNSTY];print'
(Courtesy of George Bakos)
--------------------------------------------------------------------------
William Stearns (wstearns () pobox com, tools and papers: www.stearns.org)
Top-notch computer security training at www.sans.org , www.giac.net
--------------------------------------------------------------------------

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org