Re: [NSE] IKE information extraction

[stripes <stripes () tigerlair com>]

If you have a system I can test it against, I'll test the patch.

-Anne

On Tue, May 21, 2013 at 12:38:39AM +0200, Jesper Kückelhahn wrote:
> Hi list,
>
> I've attached a script for extracting information from an IKE service and a
> patch for ike.lua.
>
> The IKE response might contain useful information such as the internal IP
> address, domain name or username, which the script displays. Also matched
> vendor IDs are displayed.
>
> The ike.lua.patch adds extra functionality to support the extraction (and
> some minor refactoring).
>
> Example outputs:
>
> PORT    STATE SERVICE REASON       VERSION
> 500/udp open  isakmp  udp-response SonicWall
> | ike-info:
> | Information
> |   ID details
> |     Type
> |       ID_USER_FQDN
> |     Value
> |       DJ-G005
> |   Vendor IDs
> |_    SonicWall
>
> PORT    STATE SERVICE REASON
> 500/udp open  isakmp  udp-response
> | ike-info:
> | Information
> |   ID details
> |     Type
> |       ID_IPV4_ADDR
> |     Value
> |       10.0.0.99
> |   Vendor IDs
> |     Cisco Unity
> |     XAUTH
> |     Dead Peer Detection v1.0
> |     IKE FRAGMENTATION
> |     Cisco VPN Concentrator 3000 4.0.7
> |_    Cisco VPN Concentrator 3000
>
> Currently there's a minor bug, as both the ike version detection script and
> ike-info.nse both try to bind to port 500 UDP. Is there a nice way to wait
> for the port to become available ?
>
>
> Regards
>   Jesper Kückelhahn



> _______________________________________________
> Sent through the dev mailing list
> http://nmap.org/mailman/listinfo/dev
> Archived at http://seclists.org/nmap-dev/
--
If you don't know there's a        (\`--/') _ _______ .-r-.  
trampoline in the room, you're      >.~.\ `` ` `,`,`. ,'_'~`.          
not going to dust the ceiling for  (v_," ; `,-\ ; : ; \/,-~) \            
fingerprints. -Law & Order:SVU      `--'_..),-/ ' ' '_.>-' )`.`.__.')   
stripes at tigerlair dot com       ((,((,__..'~~~~~~((,__..'  `-..-'fL    
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/