Re: Microsoft SQL Server fingerprints for SQL 2000 and 2005

[Fyodor <fyodor () insecure org>]

On Thu, Feb 28, 2008 at 08:35:08PM -0600, Tom Sellers wrote:
> I have produced two patches, one with the Build number in the info
> field and another with the Service Pack number in the info field.
> I prefer the one with the Build number in the info field, but you
> folks know what best fits with nmap conventions.  Please let me
> know if the patch files are not correct or if they need to be
> improved.

Looks good!  I've applied your patch.  I made slight changes to use
version/info fields (combined them) as in this example:

match ms-sql-s 
m|^\x04\x01\x00\x25\x00\x00\x01\x00\x00\x00\x15\x00\x06\x01\x00\x1b\x00\x01\x02\x00\x1c\x00\x01\x03\x00\x1d\x00\x00\xff\x08\x00\x02\xf8|
 p/Microsoft SQL Server 2000/ v/8.00.760; SP3/ o/Windows/

Cheers,
-F

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org