Re: Java API for NMap

[Jon Svede <jsvede () gmail com>]

Thanks for the feedback!

I've only briefly looked at the Perl API and their approach is similar
to what I am thinking of.

I have a high level approach sketched out that currently is using the
Process class as you suggest.  Well, actually that is already written.
:-)

My goal was more focused on what would be useful to someone who wanted
to use the API.

So for example, in my previous experience, what would have been useful
is something like this:

...
...
String[] hosts = {"locahost",
"intranetbox.domain.com","externalhost.anotherdomain.com"};
String ports = "22,80,389,443,8080,7001";
ServiceScan scan = new ServiceScan( hosts, ports ) ;
scan.execute() ;  //synchronous - so this blocks
ScanResult result = scan.getResults() ;

Another example might be:

MyCallback callback = new MyCallback() ; //instance of a Callback
interface that is part of the API
String[] hosts = {"locahost",
"intranetbox.domain.com","externalhost.anotherdomain.com"};
String ports = "22,80,389,443,8080,7001";
ServiceScan scan = new ServiceScan( hosts, ports, callback ) ;
scan.execute() ; // because we passed in a Callback, it's asynchronous now


It's a contrived example but my goal is to make it very easy to use
NMap with Java in simple use cases but also make it possible for
expert NMap users to define their own classes for commonly run scans.

I've used NMap only for host discovery - finding boxes with services
exposed.  I am certain there are more use cases that are commonly used
that would be equally convenient to encapsulate in a class.

While I could do the Python to Java thing, for my purposes a pure a
Java API is more desirable.  I suspect other Java developers might
agree as this cuts down the number of other things that have be
accounted for when building an app.

XML parsing would be via SAX to avoid hitting out of memory errors on
large scans.  Additionally, this approach allows users of the API to
hook into the parser notifications as well.

Jon


On Wed, May 19, 2010 at 11:09 AM, Giorgio Zoppi <giorgio.zoppi () gmail com> wrote:
> > I recommend looking at the APIs of the Perl and Ruby interfaces to Nmap.
> > These have already been tested by some real-world use.
> >
> > http://nmap.org/book/output-formats-xml-with-perl.html
> > http://sourceforge.net/projects/nmap-scanner/
> > http://anthonypersaud.com/category/nmap-parser/
> > http://rubynmap.sourceforge.net/
> Currently there's an other valuable option.
>  As far i know Zenmap it's written in python and there are some python
> modules (i.e
> http://nmap.org/svn/zenmap/zenmapCore/NmapCommand.py) which are used
> to instruct nmap (correct me David if i'm wrong).
> An option could be Jepp - http://jepp.sourceforge.net/ which embeds
> CPython in Java and then you could use that module.
> - For a pure Java option you might use (just sketching one possible solution):
> String processExe;
> Runtime runtime = Runtime.getRuntime()
> processExe = "/usr/bin/nmap"
> /* cmdarray is an array which contains the nmap options, see the doc*/
> cmdarray[0] = processExe
> cmdarray[1] = .......
> etc.
> runtime.exec(cmdarray)
>
> and then parse the xml results with your DOM or SAX parser.
> Unfortunately Nmap currently don't have a frontend C API, so using
> Java JNI is not a possible solution to your problem.
> Just 1c,
> Giorgio.
> --
> Quiero ser el rayo de sol que cada día te despierta
> para hacerte respirar y vivir en me.
> "Favola -Moda".
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/