trimstray/sandmap

Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles.

Hi!

I'm a System and Network Administrator. I post my ongoing research at blkcipher.pl.

Some of my blog posts ^[PL]

• Czym jest i jakie znaczenie ma średnie obciążenie systemu?
• TLS: Jaki rozmiar powinien mieć klucz prywatny?
• Co jeśli kill -9 nie działa?
• NGINX: Usprawnienie zamykania procesów roboczych
• Dlaczego pamięć SWAP jest nadal istotna?
• Negocjacja wersji TLS i pakiet szyfrów sygnalizacyjnych

sandmap's Issues

Module: nse_other-network

Module name: nse_other-network
Category: nse
Status: In Progress

NSE scripts for the other network service.

Module: service_detection

Module type: INTERNAL
Module name: service_detection

Category: detection
URL: https://nmap.org/book/man-version-detection.html

Status: In Progress

Point Nmap at a remote machine and it might tell you that ports 25/tcp, 80/tcp, and 53/udp are open. Using its nmap-services database of about 2,200 well-known services, Nmap would report that those ports probably correspond to a mail server (SMTP), web server (HTTP), and name server (DNS) respectively.

Module: nse_remote-access

Module name: nse_remote-access
Category: nse
Status: In Progress

NSE scripts for the Remote Access services (ssh, telnet, vnc).

Module: nse_snmp

Module name: nse_snmp
Category: nse
Status: In Progress

NSE scripts for the SNMP Protocol.

Module: os_detection

Module type: INTERNAL
Module name: os_detection

Category: detection
URL: https://nmap.org/book/man-os-detection.html

Status: In Progress

OS detection enables some other tests which make use of information that is gathered during the process anyway.

Problem with saving values of session variables.

Status: In Progress

Problem with saving values of session variables.

Incorrect assigning of session variables.

Status: In Progress

Incorrect assigning of session variables.

cli(main)> config dest

  Description: Destination
    Examples: '127.0.0.1,example.com'
    { "dest":"127.0.0.1" }

cli(main)> set dest 8.8.8.8
cli(main)> config dest

  Description: Destination
    Examples: '127.0.0.1,example.com'
    { "dest":"8.8.8.8" }

cli(main)> use awesome_nmap
cli(awesome_nmap)> show

  ID   Alias                                    Nmap Parameters
  --   -----                                    ---------------

  0    open_ports                               -F --open 

cli(awesome_nmap)> init 0

terminal:
> internal

command:
> nmap -F --open  127.0.0.1

[...]

Nmap done: 1 IP address (1 host up) scanned in 2.77 seconds

Result: pass

cli(awesome_nmap)> exit

Create Sandmap Wiki page.

Status: In Progress

Creating a wiki with description of all options and examples.

Profile searches throughout the entire script.

Status: In Progress

Profile searches throughout the entire script.

Module: host_discovery

Module type: INTERNAL
Module name: host_discovery

Category: discovery
URL: https://nmap.org/book/man-host-discovery.html

Status: In Progress

Nmap does host discovery and then performs a port scan against each host it determines is online.

Module: nse_dos

Module type: NSE
Module name: nse_dos

Category: nse
URL: https://nmap.org/nsedoc/categories/dos.html

Status: In Progress

Scripts in this category may cause a denial of service. Sometimes this is done to test vulnerability to a denial of service method, but more commonly it is an undesired by necessary side effect of testing for a traditional vulnerability. These tests sometimes crash vulnerable services.

Module: zenmap

Module type: INTERNAL
Module name: zenmap

Category: zenmap
URL:

Status: In Progress

Zenmap predefined commands.

Module: port_scan

Module type: INTERNAL
Module name: port_scan

Category: ports
URL: https://nmap.org/book/man-port-scanning-techniques.html

Status: In Progress

This section documents the dozen or so port scan techniques supported by Nmap.

Module: nse_other-version

Module name: nse_other-version
Category: nse
Status: In Progress

NSE scripts for the Other Version technique.

Module: nse_external

Module type: NSE
Module name: nse_external

Category: nse
URL: https://nmap.org/nsedoc/categories/external.html

Status: In Progress

Scripts in this category may send data to a third-party database or other network resource.

Module: nse_intrusive

Module type: NSE
Module name: nse_intrusive

Category: nse
URL: https://nmap.org/nsedoc/categories/intrusive.html

Status: In Progress

These are scripts that cannot be classified in the safe category because the risks are too high that they will crash the target system, use up significant resources on the target host (such as bandwidth or CPU time), or otherwise be perceived as malicious by the target's system administrators.

Module: nse_vuln-scanners

Module name: nse_vuln-scanners
Category: nse
Status: In Progress

NSE scripts for the vulnerability scanners.

Module: nse_default

Module type: NSE
Module name: nse_default

Category: nse
URL: https://nmap.org/nsedoc/categories/default.html

Status: In Progress

These scripts are the default set and are run when using the -sC or -A options rather than listing scripts with --script. This category can also be specified explicitly like any other using --script=default.

Module: nse_broadcast

Module name: nse_broadcast
Category: nse
Status: In Progress

Scripts in this category typically do discovery of hosts not listed on the command line by broadcasting on the local network. Use the newtargets script argument to allow these scripts to automatically add the hosts they discover to the Nmap scanning queue.

Module: nse_malware

Module type: NSE
Module name: nse_malware

Category: nse
URL: https://nmap.org/nsedoc/categories/malware.html

Status: In Progress

These scripts test whether the target platform is infected by malware or backdoors.

Module: nse_other-discovery

Module name: nse_other-discovery
Category: nse
Status: In Progress

NSE scripts for the Other Discovery technique.

Module: nse_databases

Module name: nse_databases
Category: nse
Status: In Progress

NSE scripts for the Databases.

Module: nse_smb-vuln

Module name: nse_smb-vuln
Category: nse
Status: In Progress

NSE scripts for the SMB vulnerabilities.

Module: nse_mail

Module name: nse_mail
Category: nse
Status: In Progress

NSE scripts for the Mail Protocols (pop, smtp, imap).

Module: nse_socks

Module name: nse_socks
Category: nse
Status: In Progress

NSE scripts for the SOCKS.

Module: vtty

Module name: vtty
Category: nse
Status: In Progress

NSE scripts for the Virtual Terminals.

Module: nse_ftp

Module name: nse_ftp
Category: nse
Status: In Progress

NSE scripts for the FTP protocol.

Module: nse_other-auth

Module name: nse_other-auth
Category: nse
Status: In Progress

NSE scripts for the Other Authentication services.

Module: nse_whois

Module name: nse_whois
Category: nse
Status: In Progress

NSE scripts for the Whois Database.

Module: nse_dns-dhcp

Module name: nse_dns-dhcp
Category: nse
Status: In Progress

NSE scripts for the dns and dhcp service.

Module: nse_ssl

Module name: nse_ssl
Category: nse
Status: In Progress

NSE scripts for the SSL Protocol.

Module: nse_smb

Module name: nse_smb
Category: nse
Status: In Progress

NSE scripts for the SMB protocol.

CLI: commands history

Status: In Progress

The mechanism for saving, displaying and using specific entries in the command history.

Module: nse_fuzzer

Module type: NSE
Module name: nse_fuzzer

Category: nse
URL: https://nmap.org/nsedoc/categories/fuzzer.html

Status: In Progress

This category contains scripts which are designed to send server software unexpected or randomized fields in each packet. While this technique can useful for finding undiscovered bugs and vulnerabilities in software, it is both a slow process and bandwidth intensive.

Module: nse_oracle

Module name: nse_oracle
Category: nse
Status: In Progress

NSE scripts for the Oracle services.

Module: nse_auth

Module type: NSE
Module name: nse_auth

Category: nse
URL: https://nmap.org/nsedoc/categories/auth.html

Status: In Progress

These scripts deal with authentication credentials (or bypassing them) on the target system. Scripts which use brute force attacks to determine credentials are placed in the brute category instead.

Module: nse_brute

Module type: NSE
Module name: nse_brute

Category: nse
URL: https://nmap.org/nsedoc/categories/brute.html

Status: In Progress

hese scripts use brute force attacks to guess authentication credentials of a remote server. Nmap contains scripts for brute forcing dozens of protocols, including http-brute, oracle-brute, snmp-brute, etc.

Module: nse_http

Module name: nse_http
Submodules: nse_http-protocol, nse_http-services, nse_http-vulns and nse_http-cve.
Category: nse
Status: In Progress

NSE scripts for the HTTP/HTTPS service.

Module: nse_exploit

Module type: NSE
Module name: nse_exploit

Category: nse
URL: https://nmap.org/nsedoc/categories/exploit.html

Status: In Progress

These scripts aim to actively exploit some vulnerability. Examples include jdwp-exec and http-shellshock.

Module: nse_safe

Module type: NSE
Module name: nse_safe

Category: nse
URL: https://nmap.org/nsedoc/categories/safe.html

Status: In Progress

Scripts which weren't designed to crash services, use large amounts of network bandwidth or other resources, or exploit security holes are categorized as safe.

Module: nse_vuln

Module type: NSE
Module name: nse_vuln

Category: nse
URL: https://nmap.org/nsedoc/categories/vuln.html

Status: In Progress

These scripts check for specific known vulnerabilities and generally only report results if they are found.

Module: nse_citrix

Module name: nse_citrix
Category: nse
Status: In Progress

NSE scripts for the Citrix services.

Module: dhcp

Module name: dhcp
Category: nse
Status: In Progress

NSE scripts for the dhcp service.

Module: nse_other-services

Module name: nse_other-services
Category: nse
Status: In Progress

NSE scripts for other services.

Module: awesome

Module type: INTERNAL
Module name: awesome

Category: other

Status: In Progress

Awesome Nmap predefined commands module.

Module: nse_hadoop

Module name: nse_hadoop
Category: nse
Status: In Progress

NSE scripts for the Hadoop services.

Module: nse_discovery

Module type: NSE
Module name: nse_discovery

Category: nse
URL: https://nmap.org/nsedoc/categories/discovery.html

Status: In Progress

These scripts try to actively discover more about the network by querying public registries, SNMP-enabled devices, directory services, and the like.

Module: nse_version

Module type: NSE
Module name: nse_version

Category: nse
URL: https://nmap.org/nsedoc/categories/version.html

Status: In Progress

The scripts in this special category are an extension to the version detection feature and cannot be selected explicitly. They are selected to run only if version detection (-sV) was requested.

Easier use of arguments in nse scripts.

Status: In Progress

Easier use of arguments in nse scripts. At this time, the user must provide them as a command argument. Preparation of default values.

nmap --script dns-check-zone -sn -Pn --script-args='dns-check-zone.domain=example.com' ns1.example.com 

Editing command parameters (profiles).

Status: In Progress

Editing command parameters (profiles).

-sn -Pn ns1.example.com --script dns-check-zone --script-args='dns-check-zone.domain=example.com' $_cmd_params

Editable:

• ns1.example.com
• dns-check-zone.domain=example.com