Re: NSE Professional Feed

[Daniel Miller <bonsaiviking () gmail com>]

Hi,

I'm not exactly sure what you're proposing, but here are a few things we've
tried along the lines of a NSE script feed:

First, we used to have a "New VA Modules" email that went out daily and
included any new NSE scripts committed since the previous day, as well as
aggregating from the Nessus feed and Metasploit modules. We turned it off
in January 2015 since it was broken and nobody noticed.

Second, we developed a "Nmap update" program that is intended to provide a
way to get new NSE scripts, OS and service fingerprints, and other data
files. The biggest problem this system solved was incompatibilities between
Nmap versions with regard to what scripts they were able to run: we often
make changes that break binary compatibility, such as adding new library
bindings or upgrading Lua language versions. While this was solved from a
technical standpoint by having "release channels," it increased the level
of work required to maintain separate versions of scripts for each channel.
The system has never been released beyond developer's alpha.

What kind of system were you suggesting?

Dan

On Wed, Aug 10, 2016 at 5:15 AM, <nse () sigaint org> wrote:

> Apologies for the slightly off-topic query, but I'm curious if there is
> any interest here for a "professional feed" repository of NSE scripts.
> This would be something similar to Nessus's feed but obviously much easier
> to embed within other scripts and tools. I imagine this could be really
> useful for pen testers and sysadmins who want to automate vulnerability
> scanning, but would like some feedback on the idea before investing more
> resources on further development. Besides for the amount of work involved
> in maintaining such a repo, is there a reason this hasn't been done yet?
>
>
>
> _______________________________________________
> Sent through the dev mailing list
> https://nmap.org/mailman/listinfo/dev
> Archived at http://seclists.org/nmap-dev/
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/