[NSE] DRDA protocol

[Patrik Karlsson <patrik () cqure net>]

Hi all,

While looking at Informix 11.50 I realized that the database server has support for DRDA [1].
DRDA is the protocol that I've implemented a small piece of in the db2.lua library which is used by db2-info and my 
db2-brute scripts.
It turns out that both these scripts work great against an Informix servers with a DRDA instance running.

The db2-info script currently identifies Informix servers as DB2 servers and sets the service field to ibm-db2.
I'm attaching a patch that allows it to detect both Informix and DB2 servers properly and sets the service field to 
drda instead.

In order to reflect the change I propose the following name changes:
db2.lua => drda.lua
db2-info.nse => drda-info.nse
db2-brute.nse => drda-brute.nse

I noticed that the db2-brute script fails to run against ports that are not specified in the port_or_services function.
As far as I can tell the db2-info properly sets all detected fields, but I guess it does this "too late" for the 
db2-brute script to pick it up?
I tried to add the db2-info script as dependency for the db2-brute script without success.

When I added a new probe for the drda service in the nmap-services-probe and a softmatch the db2-info script properly 
detects all information and the db2-brute script runs.
In addition the time taken for a service scan against that single port is largely reduced from 106 to 26 seconds. I'm 
attaching the probe with corresponding softmatch.
Although the nmap-service-probes already contains some db2 probes, they work for db2 but not with the DRDA instance of 
Informix so the drda addition is needed. 
The drda probe on the other hand works with db2, but as the result is returned in EBCDIC encoding it won't provide as 
much information as the current db2 probes do.

//Patrik

[1] http://en.wikipedia.org/wiki/DRDA
--
Patrik Karlsson
http://www.cqure.net
http://www.twitter.com/nevdull77

Attachment: db2-brute-drda.patch
Description:

Attachment: db2-info-drda.patch
Description:

Attachment: nmap-service-probes-drda.patch
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/