Re: EXPERT IPv6 network scaning

[Patrik Karlsson <patrik () cqure net>]

On Mon, Apr 9, 2012 at 7:52 AM, niteesh kumar <niteesh3 () gmail com> wrote:

> On Mon, Apr 9, 2012 at 8:34 AM, David Fifield <david () bamsoftware com>wrote:
>
> > On Mon, Apr 09, 2012 at 01:01:23AM +0200, Patrik Karlsson wrote:
> > > Thanx patrik for that great patch. but still i cannot see the scanning
> > > > > result on screen though i could see the packets coming in wireshark.
> > I am
> > > > > running ubuntu in Vmware. Can you please test it your system once
> > again.
> > > > >   Please  find the new script attached which include patch given by
> > > > > Patrik and also some parameter changes that improve the result
> > further.
> > > > > Niteesh
> > > I've been working with Niteesh off list to iron out the last bugs and
> > just
> > > committed the latest version of the script r28418.
> > > Great work Niteesh!
> >
> > Thanks for your work guys. The NSE description is the same as for
> > targets-ipv6-invalid-dst; looks like just an oversight.
> >
> > I'm getting this error:
> >
> > ~/nmap-git$ sudo ./nmap -6 --script=targets-ipv6-mld --script-args
> > interface=br0 -e br0 --packet-trace -d
> >
> > Starting Nmap 5.61TEST5 ( http://nmap.org ) at 2012-04-08 20:01 PDT
> > PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)
> > --------------- Timing report ---------------
> >  hostgroups: min 1, max 100000
> >  rtt-timeouts: init 1000, min 100, max 10000
> >  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
> >  parallelism: min 0, max 0
> >  max-retries: 10, host-timeout: 0
> >  min-rate: 0, max-rate: 0
> > ---------------------------------------------
> > NSE: Loaded 1 scripts for scanning.
> > NSE: Script Pre-scanning.
> > NSE: Starting runlevel 1 (of 1) scan.
> > NSE: Starting targets-ipv6-mld.
> > Initiating NSE at 20:01
> > NSOCK (0.0380s) PCAP requested on device 'br0' with berkeley filter
> > 'ip6[40:1] == 58' (promisc=0 snaplen=1500 to_ms=200) (IOD #1)
> > NSOCK (0.0380s) PCAP created successfully on device 'br0' (pcap_desc=5
> > bsd_hack=0 to_valid=1 l3_offset=14) (IOD #1)
> > NSOCK (0.1410s) Pcap read request from IOD #1  EID 13
> > NSOCK (0.1410s) Callback: READ-PCAP SUCCESS for EID 13
> > NSE: Error while parsing IPv6 extension headers.
> > NSOCK (0.1410s) Pcap read request from IOD #1  EID 21
> > NSOCK (10.1410s) Callback: READ-PCAP TIMEOUT for EID 21
> > NSE: > | CLOSE
> > NSE: Finished targets-ipv6-mld.
> > NSE: Finished targets-ipv6-mld.
> > Completed NSE at 20:01, 10.10s elapsed
> > NSOCK (10.1410s) nsi_delete() (IOD #1)
> > NSE: Script Post-scanning.
> > NSE: Starting runlevel 1 (of 1) scan.
> > Read from /home/david/nmap-git: nmap-services.
> > WARNING: No targets were specified, so 0 hosts scanned.
> > Nmap done: 0 IP addresses (0 hosts up) scanned in 10.15 seconds
> >           Raw packets sent: 0 (0B) | Rcvd: 0 (0B)
> > NSOCK (10.1410s) nsi_delete() (IOD #1)
> >
> > Here's what tcpdump sees (just one packet):
> >
> > 20:03:31.628811 IP6 fe80::1e6f:65ff:feb6:cad3 > ff02::1: HBH ICMP6,
> > multicast listener querymax resp delay: 0 addr: ::, length 24
> >        0x0000:  6000 0000 0020 0001 fe80 0000 0000 0000  `...............
> >        0x0010:  1e6f 65ff feb6 cad3 ff02 0000 0000 0000  .oe.............
> >        0x0020:  0000 0000 0000 0001 3a00 0502 0000 0100  ........:.......
> >        0x0030:  8200 322f 0000 0000 0000 0000 0000 0000  ..2/............
> >        0x0040:  0000 0000 0000 0000                      ........
> >
> > David Fifield
>
>
> Patrix would you mind changing description to
>
>
> description = [[
> Sends an MLD query with maximum response delay 0 to the
> to discover available hosts on the LAN. This works because
> hosts will respond to this probe with an MLD report packet and
> as maximum response delay is 0 nobody gets time to wait for others`
>  report even in the same multicast group.
> ]]
I've changed this, renamed the script to target-ipv6-multicast-mld, and
committed a new version.
Also I made a slight change to the timeout argument, that I added.
Basically it now works :)


>  the script is working for me without error what about you Patrik?

The script works great for me, although it finds less hosts than the other
targets-ipv6-multicast scripts do.
Initially I though it could be a Mac OS X thing, but based on then I saw
Dells, and Sonys among the sample Niteesh sent, so it's probably not that.
I just tried to change the first byte in the payload from 00 to something
else and it gave me an additional host.

I'm not sure what's happening for you David? Maybe someone else on the list
could give the script a go and report back?
It's very easy, just run the following (as a privileged user): nmap -6
--script=targets-ipv6-multicast-mld.nse -sP

Cheers,
Patrik
-- 
Patrik Karlsson
http://www.cqure.net
http://twitter.com/nevdull77
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/