Re: RFC - nmap "crawl" feature / script

["DePriest, Jason R." <jrdepriest () gmail com>]

On Tue, Jul 8, 2008 at 11:56 PM, DePriest, Jason R. <> wrote:
> On Tue, Jul 8, 2008 at 11:13 PM, Brandon Enright <> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On Tue, 8 Jul 2008 13:00:22 -0500
> > "DePriest, Jason R." <> wrote:
> > ...snip...
> > > But before I start doing anything, has anyone else ever considered
> > > this a desirable feature?  If so, has someone already written a script
> > > to handle it?
> > >
> > > Thank you.
> > >
> > > -Jason
> >
> > I've chatted with Fyodor about a similar idea involving host discovery
> > via SNMP from the detected routers (hops) from a --traceroute.
> >
> > The idea is that most bigger organisations have routing gear for which
> > you can extract the ARP/CAM table via SNMP to discover new hosts.  If
> > you learn about the local router for a host, a few SNMP queries later
> > and you can have all the hosts in that VLAN, or even all the hosts
> > for any VLAN routed out of that router.
> >
> > After really flushing the ideas out though we both agreed that while
> > that ability could be very useful, it is best left to an external
> > script.  Nmap is a great _port_scanner_ but probably shouldn't have
> > every darn networking task we can think of stuffed into it.
> >
> > One thing that /would/ be nice though is to expose --traceroute
> > information to NSE so that a script can try to query the local router
> > for the target's MAC address.  IIRC this would require re-ordering NSE
> > to come after --traceroute.
> >
> > Brandon

Sorry about the last one.  Apparently, I accidentally hit a key
combination in GMail and sends messages.  Oops.

What I was going to say is that I have this perl snippet that is ugly but works.

It can read an XML file from Nmap, pull out the targets, then
determine the systems in the trace route.

It is very ugly, but here it is.

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
#!/usr/bin/perl -w

use Data::Dumper;
BEGIN { $ENV{HARNESS_ACTIVE} = 1 } # hack to fix cannot find
ParserDetails.ini error message
use XML::Simple qw(:strict);

my $fileName = $ARGV[0];
chomp($fileName);
my $xref = XMLin("$fileName", ForceArray => 1, keyattr => []);

for (my $i=0;$i<=$#{${$xref}{host}};$i++) { # each host you scanned
        print "For target system ",
${${${${${$xref}{host}}[$i]}{address}}[0]}{addr}, " traceroute minus
target was\n";
        for (my $j=0;$j<=$#{${${${${$xref}{host}[0]}{trace}}[0]}{hop}}-1;$j++) {
                print ${${${${${${$xref}{host}[0]}{trace}}[0]}{hop}}[$j]}{ttl}, "\t";
                print ${${${${${${$xref}{host}[0]}{trace}}[0]}{hop}}[$j]}{ipaddr}, "\n";
        }
}
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

You really don't *need* Data::Dumper, but it is what I used to figure
out how to create the ugly reference nightmares.

Output looks like this.
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
C:\Tools\Code\projects\nmap-crawl>perl nmap-crawl.pl test-data.xml
For target system 10.x.x.5 traceroute minus target was
1       10.x.x.1
2       10.x.x.18
3       10.x.x.66
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

-Jason

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org