jargij/passivescanningtool

PassiveNLSurvey

Welcome to the passive survey tool source code!

From this repository you can build the passive survey tool for Windows, Linux and other platforms compatible with mono. Modify it in any way you can imagine, and share your changes with others!

The passive survey tool uses zmap and zgrab results found at the scans.io repository. These results are then compared to a list of hosts. The format is shown in this example. All services found will be written to the output file in addition to all information that is available about this service.

Branches

We publish source for the engine in a single rolling branch.

The master branch tracks live changes by the team. This is the cutting edge and may be buggy - it may not even compile. Battle-hardened developers eager to work lock-step with us on the latest and greatest should head here.

Getting up and running

The steps below will take you through cloning your own private fork, then compiling and running the tool yourself:

Windows

1. Install GitHub for Windows then fork and clone our repository. To use Git from the command line, see the Setting up Git and Fork a Repo articles.

   If you'd prefer not to use Git, you can get the source with the 'Download ZIP' button on the right. The built-in Windows zip utility will mark the contents of zip files downloaded from the Internet as unsafe to execute, so right-click the zip file and select 'Properties...' and 'Unblock' before decompressing it. Third-party zip utilities don't normally do this.

2. Install Visual Studio 2013. All desktop editions of Visual Studio 2013 can build the tool, including Visual Studio Community 2013, which is available for free.

3. Load the project into Visual Studio by double-clicking on the PassiveScanning.sln file. Right click on the PassiveScanning target and select Build.

Mac

1. Set up Git and fork our repository. If you'd prefer not to use Git, use the 'Download ZIP' button on the right to get the source as a zip file.

2. In order to be able to compile, set up Mono.

3. Open your source folder and run make.

Linux

1. Set up Git and fork our repository. If you'd prefer not to use Git, use the 'Download ZIP' button on the right to get the source as a zip file.

2. Installing the complete mono package will allow you to build the project. For apt based operating systems this can be done using apt-get install mono-complete.

3. Open your source folder and run make.

Usage

In order to run the program it will need pairs of zmap and zgrab inputs found at the scans.io repository. One of these pairs can for example be Full IPv4 HTTPS Handshakes, zgrab-results and zmap-results. Additionally the program will require a list of IP ranges that you are interested in as shown in this example. TODO add full example.

You are now ready to run the program, once the program is done running it will output a CSV format file (ip;service;json-data) in addition to the analysis.