Re: VMware-fingerprint nse

[David Fifield <david () bamsoftware com>]

On Thu, May 30, 2013 at 05:14:29PM -0400, Mark Baseggio wrote:
> I've created a nse that fingerprints vmware ESX/ESXi servers. This is my
> first foray into both Lua and nmap scripting, so please excuse any noob
> mistakes I might have made with this--I tried to follow the examples and
> tutorials as closely as possible. I would like to submit it for inclusion
> in nmap so others can benefit from it as well.

Thanks for this contribution.

It looks like this script would be better written as a version
probe--all it does is send one stereotyped request and then do pattern
matching on the reply. See http://nmap.org/book/vscan.html.

In fact, it looks like we already have a service probe that makes a
request similar to the one your script makes. However I wouldn't be
surprised if it is broken, because it is missing an "HTTP POST" and
doesn't have any matchlines.

Probe TCP vmware-esx q|<soap:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema"; ...

Do you get anything useful from a "nmap -sV --version-all" against a
port running this service? What if you modify the existing vmware-esx
probe in nmap-service-probes?

David Fifield
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/