nmap-web-1.3/004075500255470005670000000000000707563774400132245ustar00alekcadds00002600000223nmap-web-1.3/HISTORY010064400255470005670000000022420707665333000142730ustar00alekcadds0000260000022304/17/00 Release as version1.3 04/15/00 Fix bug in daytime port parsing on timezone diffs around midnight 04/15/00 Use machine readable code instead of human readable 04/15/00 Add option to show ports NOT open 04/15/00 Change require to use to get compile time checks 04/14/00 Add stuff to handle POP and IMAP 04/11/00 Release as 1.3b 04/11/00 Add some timers so we don't timeout 04/11/00 Add ability to highlight exception conditions in red 04/11/00 Expand documentation a bit 04/11/00 Simplify top menu and make select box 04/11/00 Move around the include files still a little more (getting solid! ;-) 04/07/00 Release as 1.2 04/07/00 Add sample getnetgroup command 04/07/00 Minor bug fixes as suggested by folks 04/07/00 Make a bit more modular 04/06/00 Add ability to port query code for FTP, SSH, Sendmail per suggestions 04/06/00 Latest nmap BETA changed format a little - add a s/\/.*$// line! ;-) 04/05/00 Release as 1.1 04/05/00 Re-write selection code to make more portable 04/05/00 Add ability to do queries against port 13 & 80 and report results 03/23/00 Release as 1.0 [Unless otherwise stated, changes made by Alek Komarnitsky, alek@komar.org] nmap-web-1.3/LICENSE010064400255470005670000000006740706634551700142270ustar00alekcadds00002600000223 *************************************************************************** * nmap-web: Quick-n-Dirty Web Interface to nmap * * Copyright 2000 by Alek Komarnitsky, alek@komar.org * http://www.komar.org/komar/alek/ * *************************************************************************** Use and distribution of this software is covered by the GNU COPYING license. Please refer to this for terms and conditions. nmap-web-1.3/README010064400255470005670000000040520707510344300140620ustar00alekcadds00002600000223 nmap-web: A quick-n-dirty Web interface to nmap nmap (http://www.insecure.org/nmap/) is a very powerful and easy to use tool to check which ports are open/responding on your computer. Note that a LOT more things can be done with it (ex: remote OS fingerprinting) ... check out the web site for more info. It is LIGHTENING fast ... depending on the number of ports you scan, rates of 100+hosts/seconds are easily obtainable. While this can (IS!) be used by the "bad guys" ... it is actually a very useful tool for the "good guys" for a couple of reasons: - You should be aware of what ports are open on your machines and insure that only those you want/need/know (!) are open. Using nmap allows you to easily determine this so you can then take appropriate action. - If a "bad guy" does install a back door that listens on a port, then you should be able to detect that something is amiss by using nmap. - Say you are interested in: How many of my machines are web servers? nmap is pretty darn good for stuff like this. - You can also say "show me what VERSION" is running on well-known ports. This is handy to make sure you upgrade all of your software The later reasons are mostly why I wrote nmap-web ... which is basically a web interface to nmap and allows you to (via a web interface) quickly and easily select a list of ports and a list of hosts and it tells you which machines have which open ports. nmap generates this output itself; but nmap-web makes it just a little bit easier. nmap-web requires Perl (and nmap! ;-) and should be runnable under any Web Server running on any *NIX platform. Note that nmap-web only scans tcp ports, so it can be run as a "normal" user - i.e. no root access is required, which would be needed to scan udp ports. That could easily be changed, but I wanted to keep it simple. Pls see the INSTALL document for the misc. tweeks you'll need to make to get it working at your site. Pls send me any suggestions and/or comments. Alek Komarnitsky, alek@komar.org (http://www.komar.org/komar/alek) nmap-web-1.3/TODO010064400255470005670000000013070707665366500137130ustar00alekcadds00002600000223Things I would really like to do and/or have done: - Add additional code for other ports FTP/etc. should look at multiple lines, Check given URL ... - nmap-web should show those machines not pingable ... waiting for nmap to return this data for us. - Perl code should "use Strict" ... but I'm lazy (lousy excuse!) - A LOT more could be done ... but I wanted to keep this simple; i.e. KISS principal applies ... so rather than try to give you access to every single nmap options/etc., this is a quick-n-dirty way to do some scans of the tcp ports and optionally get what is running there. Pls send me suggestions/bug fixes/etc. Alek Komarnitsky, alek@komar.org (http://www.komar.org/komar/alek) nmap-web-1.3/INSTALL010064400255470005670000000035220707665575000142520ustar00alekcadds00002600000223 nmap-web: A quick-n-dirty Web interface to nmap Installing nmap-web is pretty straighforward. - Get/compile/install nmap from http://www.insecure.org/nmap/. - Create a directory under your Web Site and put all the files there. Optionally create log and counter directories (see nmap_web_local.pm) - Copy cgi-bin/check-for-web.pl into the appropriate cgi-bin directory. Modify the location of Perl and the "INCLUDE" directory - There are several "include" files that are used ... the idea being that you should NOT have to change any of these except the *local* ones; and those should be relatively constant between releases. - Use the sample misc/getnetgroup if you want (see nmap_web_local.pm). - Point your browser to the directory listed above and rock-n-roll It should be fairly self-explanatory. BTW, if you peruse the code; you'll see there is the ability to put a "-ports" manually into the host field ... this is handy if you decide there is a new port you want to scan and you don't want to have to change the code. Pls send me any suggestions and/or comments. Alek Komarnitsky, alek@komar.org (http://www.komar.org/komar/alek) P.S. If you want a URL that just "does it", here's an example that has nmap web generate time data on example-clients: http://YOUR-SERVER/cgi-bin/nmap-web.pl?do_nmap=true&keyword=example-clients&port_selection=0000013-time&get_port_data=true Change "13-time" to "80-httpd" to get what web server you are running. PPS. NOTE: nmap-web was recently changed to parse the machine readable format (rather than the human readable format). I should have done this in the first place. There some misc. code blocks for stuff that I have not seen/tested yet for Machine stuff - pls send me anything amiss!!! This was tested with nmap2.30Beta20. /check-for-web.pl into the appropriate cgi-bin directory. Modify the location of Perl and the "INCLUDE" directory - There are several "include" files that are usednmap-web-1.3/help.html010064400255470005670000000100070707510371700150210ustar00alekcadds00002600000223 Check for Web Servers and more There's a fairly simple way to determine if a machine is a Web Server; just try to connect to it! ;-)

An easy way is to type the address into your browser; but the simplest way is to just "telnet 80" which connects to port 80 (the default httpd port) and sees if anything is listening.

Note that you can do that with most services by connecting to that port, and nmap-web allows you do to that.

That's basically all this web page does ... using a "telnet on steroids" program called nmap which opens connections up pretty darn fast (like about a thousand a minute! ;-) and sees if there is an answer.

NOTE: Just because something is listening on port 80 does not guarantee that it is a web server, but since that is the dafault port, it probably is. Also, you can run Web Servers on ANY port ... but it makes little sense to unless it is a well-known port. For example, 443 is reserved for secure HTTP - https.

Note that some other tricks (Firewalls, TCP Wrappers, etc.) can be used to prevent a scanning machine from connecting to a web server that is actually running.

If you are only checking port 80, this program will do it at a rate will do 'em at a rate of about 1000 hosts/minute. "MORE" will be about 500 hosts/minutes, and LOTS about 200 hosts/minute. These numbers are VERY approximate and can increase dramatically if a lot of hosts are unresolveable and/or are down.

NOTE ALSO: this program does not check the web server to see if the pages are "protected" or meet any compliance standards ... it just checks to see if a web server exists at some address so you can then investigate further ... you can ask it to tell you what Web Server version is reported.

Here's a list of definitions for the "well known" ports .. again, remember that ANYTHING can be running on ANY port ... 


tcpmux            1/tcp      # TCP Port Service Multiplexer [rfc-1078]
echo              7/tcp      #
discard           9/tcp      # sink null
systat            11/tcp     # Active Users
daytime           13/tcp     # Date
qotd              17/tcp     # Quote of the Day
chargen           19/tcp     # ttytst source Character Generator
ssh               22/tcp     # Secure Shell Login
time              37/tcp     # timeserver
nameserver        42/tcp     # Host Name Server
tftp              69/tcp     # Trivial File Transfer
finger            79/tcp     # Finger Daemon
http              80/tcp     # World Wide Web HTTP
pop-2             109/tcp    # PostOffice V.2
pop-3             110/tcp    # PostOffice V.3
auth              113/tcp    # ident, tap, Authentication Service
uucp-path         117/tcp    # UUCP Path Service
nntp              119/tcp    # Network News Transfer Protocol
netbios-ns        137/tcp    # NETBIOS Name Service
netbios-dgm       138/tcp    # NETBIOS Datagram Service
netbios-ssn       139/tcp    # NETBIOS Session Service
imap2             143/tcp    # Interim Mail Access Protocol v2
snmp              161/tcp    #
snmptrap          162/tcp    # snmp-trap
http-mgmt         280/tcp    # 
asip-webadmin     311/tcp    # appleshare ip webadmin
https             443/tcp    # secure http (SSL)
printer           515/tcp    # spooler (lpd)
klogin            543/tcp    # Kerberos (v4/v5)
kshell            544/tcp    # krcmd Kerberos (v4/v5)
http-rpc-epmap    593/tcp    # HTTP RPC Ep Map
sco-websrvrmg3    598/tcp    # SCO Web Server Manager 3
ipcserver         600/tcp    # Sun IPC server
webster           765/tcp    # 
xaudio            1103/tcp   # Xaserver	# X Audio Server
webster           2627/tcp   # Network dictionary
www-dev           2784/tcp   # world wide web - development
squid-http        3128/tcp   #
dec-notes         3333/tcp   # DEC Notes
mmcc              5050/tcp   # multimedia conference control tool
pcanywhere        5632/tcp   #
http-proxy        8080/tcp   # Common HTTP proxy/second web server port

nmap-web-1.3/index.html010064400255470005670000000006150707510373500152040ustar00alekcadds00002600000223  


Check for Web Servers and more 


    
    
 
nmap-web-1.3/middle.html010064400255470005670000000002040706635012100153160ustar00alekcadds00002600000223  




nmap-web-1.3/include/004075500255470005670000000000000707577221200146355ustar00alekcadds00002600000223nmap-web-1.3/include/nmap_web_local_ports.pm010075500255470005670000000035060707665567600214070ustar00alekcadds00002600000223#nmap-web-ports-local.ph file - should not change much between releases
#---- Modify stuff below as appropriate for your site ----         

# Define what ports will be presented as options
#   $ports is the actual port number used by nmap
#   $names is what is shows up in the select box as
#   $expected is the string you expect to see - if not, it will highlight in red# Note: the "#-" is used to sort 'em in the order you want in the select box
$ports{'000000-ping'} = "0";
$names{'000000-ping'} = "Check pingability";
$ports{'0000013-time'} = "13";
$names{'0000013-time'} = "Daytime port";
$expec{'0000013-time'} = "15";     # This is actually deviation in seconds
$ports{'0000021-ftp'} = "21";
$names{'0000021-ftp'} = "FTP port";
$ports{'0000022-ssh'} = "22";
$names{'0000022-ssh'} = "ssh port";
#$expec{'0000022-ssh'} = "SSH-1.5.1.2.27";
$ports{'0000025-mail'} = "25";
$names{'0000025-mail'} = "mail port";
$expec{'0000025-mail'} = "Sendmail 8.9.3";
$ports{'0000080-httpd'} = "80";
$names{'0000080-httpd'} = "Port 80 (Default for HTTP)";
$expec{'0000080-httpd'} = "Apache";
$ports{'0000110-pop3'} = "110";
$names{'0000110-pop3'} = "POP3";
$ports{'0000143-imap2'} = "143";
$names{'0000143-imap2'} = "IMAP2";
$ports{'8000010-more_httpd'} = "80,280,443,591,593,598,3128,7777,8000,8080";
$names{'8000010-more_httpd'} = "Check commonly used HTTP ports";
$ports{'8000020-many_httpd'} = "80-99,280,311,443,591,593,598,765,2250-2259,2627,2784,3030,3128,3131,3232,3333,5050,7457,7777,8000-8100,9090";
$names{'8000020-many_httpd'} = "Check LOTS of HTTP ports";
$ports{'9000000-special'} = "1,7,9,11,17,19,22,37,42,69,79,109,110,113,117,119,137,138,139,143,161,162,515,543,544,600,1103,5632";
$names{'9000000-special'} = "Misc. ports usually disabled";
#Only if you REALLY want this ...
#$ports{'9999999-all'} = "1-65535";
#$names{'9999999-all'} = "ALL ports";

1; 
pect to see - if not, it will highlight in red# Note: the "#-" is used to sort 'em in the order you want in the select box
$ports{'000000-ping'} = "0";
$names{'000000-ping'} = "Check pinnmap-web-1.3/include/nmap_web_local.pm010075500255470005670000000044510707665571700201540ustar00alekcadds00002600000223#nmap-web-local.ph file - should not change much between releases
#---- Modify stuff below as appropriate for your site ----         

# Location of the namp executeable
$nmap_exec = "/usr/local/bin/nmap";

# initial_rtt_timeout basically ends up being HUNDRETHS of a second and
# controls how long we wait for a ping response from a SINGLE host.
# host_timeout controls how long we allow the probe to go in milliseconds.
# I had original set these as shown below ... but I suspect (?!?) that some
# random/unrepeatable inetd hangs might be attributable to it.
$nmap_options  = "-oM - -vv -sT --initial_rtt_timeout 1000 --host_timeout 60000";
$nmap_options  = "-oM - -vv -sT";
$nmap_ping_options = "-oM - -vv -sP";

# Define what will be show as options in the pull-down.
# Do this if for no other reason so the user will know the syntax of things
@select_options = ("wolfman-clients" , "jester-clients" , "160.205.75.135-165");

# We have a "getnetgroup" command that expands a netgroup/host list
# to a list of hosts one per line. Define this if you have it ... leave
# it commented out if you do not.
$getnetgroup_exec = "/usr/local/share/bin/getnetgroup";
$getnetgroup_ignore = "!ignore-hosts !ss4040 !mlinkwtn !docutech !snt-view"; 

#Root directory in filesystem space where you installed this
$root_dir = "/usr/local/web/htdocs/nmap-web";

# Misc. Help File that includes some info from the nmap services file
$help_file = "$root_dir/help.html";

# OPTIONAL File where we log who ran this program on what ports on what hosts
# If you don't define this, then it won't be used
$log_file = "$root_dir/logs/logfile";

#OPTIONAL: Some misc. counters to keep track of accesses ... 
#          Yea, there are better ways to do this!  ;-)
#Don't define these and they won't be used ... but if so, they MUST be 
#   writeable by httpd!!!   Create 'em and stuff a zero in 'em to start things
$count_file1 = "$root_dir/counters/web-check-used";
$count_file2 = "$root_dir/counters/web-check-machines-yes";
$count_file3 = "$root_dir/counters/web-check-machines";

#Define this as a Perl regular expression to restrict access to the web page
# Example: $ips_who_can_use = "^10.20.30";  #Only allow from 10.20.30 subnet
$ips_who_can_use = "^.*";

#The person who wrote this abomination - also displayed on the web page
$author = "alek\@komar.org";

1; 
nmap-web-1.3/include/nmap_web_ports_parse.pm010075500255470005670000000105700707600403100213730ustar00alekcadds00002600000223sub get_port_data{ 
   my ($host,$port,$port_selection) = @_; 
   my $timeout = 5; $max_socket_lines = 20;
   my $found_server = 0; my $return_value = "zippo"; my $diff = 999;
   use IO::Socket;
   $socket = IO::Socket::INET->new(PeerAddr => $host,
                                   PeerPort => $port,
                                   Proto    => "tcp",
                                   Type     =>SOCK_STREAM,
                                   Timeout  => $timeout)
          or return "Socket Open failed on $host:$port : $@ ";
   if ($port eq "13" ) {
      print $socket "";
      $remote_date = get_socket_value($timeout);
      if ($remote_date =~ /Socket timed out/) {
         $return_value = $remote_date;
      } else {
         $diff = &get_diff_seconds($remote_date);
         $return_value = sprintf("%5s%s" ,"$diff" , "   $remote_date");
      }
   } elsif (( $port eq "21" ) || ( $port eq "22" ) || ( $port eq "25" ) || ( $port eq "110") || ( $port eq 143)) {
      print $socket "quit\n\n";
      $return_value = get_socket_value($timeout);
   } elsif ( $port eq "80" ) {
      print $socket "HEAD / HTTP/1.0\n\n";
      $return_value = "Stopping after getting more than $max_socket_lines of output";
      for ( $line =1 ; $line < $max_socket_lines ; $line++ ) {
         if ( eof($socket) ) { 
            $return_value = "Could not determine Web Server" if (! $found_server); 
            last; 
         } else {
            $_ = get_socket_value($timeout);
            if ( /Server/ ) {
               s/Server: //;
               $return_value = "$_";
               $found_server=1;
               last; 
            }
         }
      }
   } else {
      $return_value = "We do not have code to handle $port - let $author know";
   }
   close($socket); 
   if (( defined($expec{$port_selection}) ) && ( $return_value !~ /Socket timed out/) ){ 
      if ($port eq "13" ) {
         $return_value = "" . "$return_value" . "" if ( abs($diff) > $expec{$port_selection} );
      } else {
         $return_value = "" . "$return_value" . "" if ( $return_value !~ /$expec{$port_selection}/ );
      }
   }
   return $return_value;
}


sub get_socket_value {
   my ($timeout) = @_; 
   $SIG{ALRM} = sub { die "timeout" };
   eval {
      alarm ($timeout);
      $_ = <$socket>;
      alarm(0);
   };
   if ( $@ ) {
      if ( $@ =~ /timeout/ ) {
         $_ = "Socket timed out after $timeout seconds";
      } else {
         alarm(0);
         die;
      }
   }
   chomp();
   s/\r//;
   return $_;
}



sub get_diff_seconds{ 
   # CPAN stuff could do this easier for you ...
   # But this is complicated by the fact that you don't know the timezone ...
   my ($remote_date,$rdaytime,$rmday) = @_; 
   my ($seconds,$minutes,$hours,$daytime,$mday,$month,$year);
   my ($local_date,$local_sec,$remote_sec,$diff);
   use Time::Local;
   $local_date = localtime;

   # NT adds commands and moves the year around ...
   $remote_date =~ s/\,//g;
   ($_,$_,$rmday,$rdaytime) = split(/\s+/,$remote_date); 
   ($_,$_,$_,$rmday,$rdaytime) = split(/\s+/,$remote_date) if ( ! ($rdaytime =~ /\:/)); 
   ($hours,$minutes,$seconds) = split(/:/,$rdaytime);

   ($_,$_,$_,$mday,$month,$year)=localtime();
   $remote_sec = timelocal($seconds,$minutes,$hours,$mday,$month,$year);

# Giant kludge to work around time zone stuff and testing around midnight ...
   if ( $rmday == $mday ) {
      #NOOP
   } elsif (( $rmday == ($mday+1)) || ( ($rmday == 1) && ( $rmday !=e $mday ))) {
      $remote_sec = $remote_sec + ( 24*60*60);
   } elsif (( $mday == ($rmday+1)) || ( ($mday == 1) && ( $rmday != $mday ))) {
      $remote_sec = $remote_sec - ( 24*60*60);
   } else {
      print "something wierd happening here with timezones ...\n";
      print "local date is $local_date and remote date is $remote_date ...\n";
      print "Let the $author know ... \n";
   }

   ($_,$_,$_,$daytime) = split(/\s+/,$local_date); 
   ($hours,$minutes,$seconds) = split(/:/,$daytime);
   ($_,$_,$_,$mday,$month,$year)=localtime();
   $local_sec = timelocal($seconds,$minutes,$hours,$mday,$month,$year);
   $diff = $remote_sec - $local_sec;
# timezone correction - we assume you are at least withen an hour!   ;-)
   if (abs($diff) > 3500) {
      $diff = $diff - ( 3600*int(($diff*1.2)/3600)); 
   }
   return $diff;
}

1; 
nmap-web-1.3/include/nmap_web_web_routines.pm010075500255470005670000000057050707600266500215560ustar00alekcadds00002600000223# HTML parsing ...
sub ReadParse {
   if (@_) { local (*in) = @_; }
   local ($i, $loc, $key, $val);
   # Read in text
   if ($ENV{'REQUEST_METHOD'} eq "GET") {
      $in = $ENV{'QUERY_STRING'};
   } elsif ($ENV{'REQUEST_METHOD'} eq "POST") {
      for ($i = 0; $i < $ENV{'CONTENT_LENGTH'}; $i++) {
         $in .= getc;  }
   }
   @in = split(/&/,$in);
   foreach $i (0 .. $#in) {
      # Convert plus's to spaces
      $_ = $in[$i];
      $in[$i] = &sanitize($_);
      $in[$i] =~ s/\+/ /g;
      # Convert %XX from hex numbers to alphanumeric
      $in[$i] =~ s/%(..)/pack("c",hex($1))/ge;
      # Split into key and value.
      $loc = index($in[$i],"=");
      $key = substr($in[$i],0,$loc);
      $val = substr($in[$i],$loc+1);
      $in{$key} .= '\0' if (defined($in{$key})); # \0 is the multiple separator
      $in{$key} .= $val;
  }
}


sub get_env_variable{
   $env_variable = $_[0]; 
   @env = `env`;
   @array=();
   push(@array,grep(/$env_variable/,@env));
   chomp($_ = $array[0]); 
   $_ = &sanitize($_);
   s/^.*=//s;
   return $_;
}


# Added per CERT advistory - send Alek EMail if you want changes here ...
sub sanitize {
   # This is opened up a bit 'cause we want to allow Perl regular expressions ...
   local ($OK_CHARS);
   $OK_CHARS='-a-zA-Z0-9_.@=/+ \,\(\)\s';
# Hack to handle comma & parens ...
   s/%2C/\,/g;
   s/%28/\(/g;
   s/%29/\)/g;
   s/[^$OK_CHARS]/_/go;
   return $_;
}


sub clear_window {
      $frame = $_[0];
      print "";
}


# This is misc. counter stuff ... better ways to do this, but this is pretty portable ...
sub Increment_Accumulator {
   local ($Accumulator,$inc) = @_; local ($accum);
   open (LOG,"<$Accumulator") || return "-111";
   chomp($accum = );
   close (LOG);
   $accum =  $accum + $inc;
   $_ = &get_lock_file($Accumulator,5);
   if ( /Not able to/ ) {
      return "-111";
   } elsif ( /could not get lock/ ) {
      return "-222";
   } else {
      print LOCKFILE "$accum\n";
      close (LOCKFILE); 
      return $accum;
   }
}


sub Get_Accumulator {
   local ($Accumulator) =@_;local ($accum);
   open (LOG,"<$Accumulator") || die " Problem opening the accumulator file $Accumulator\n";
   chomp($accum = );
   close (LOG);
   return $accum;
}


sub get_lock_file {
   my($lock_file,$how_long_to_wait) = @_;
   my $sleep_time = 0;
   open(LOCKFILE,">$lock_file" ) || return "Not able to open $lock_file: $!";
# Some trickery from the Perl Book to flush the buffer so other instances can read
   select((select(LOCKFILE),$| =1)[0]);
   while ( ! (flock(LOCKFILE,2|4))) {
      if (( -t STDIN) && ( -t STDOUT)) {
         if ($sleep_time % 5 == 0) {
            print "$lock_file is locked - waiting ...\n";
         }
      }
      sleep(1);
      $sleep_time++;
      if ( $sleep_time > $how_long_to_wait ) {
         close(LOCKFILE);
         return "could could not get lock";
      }
   }
   return "lock acquired";
}

1; 
nmap-web-1.3/counters/004075500255470005670000000000000706635025400150525ustar00alekcadds00002600000223nmap-web-1.3/counters/web-check-machines010064400255470005670000000000020706635024700204010ustar00alekcadds000026000002231
nmap-web-1.3/counters/web-check-machines-yes010064400255470005670000000000020706635025100211720ustar00alekcadds000026000002231
nmap-web-1.3/counters/web-check-used010064400255470005670000000000020706635025700175530ustar00alekcadds000026000002231
nmap-web-1.3/logs/004075500255470005670000000000000706645376700141715ustar00alekcadds00002600000223nmap-web-1.3/logs/logfile010064400255470005670000000000000706645376700155200ustar00alekcadds00002600000223nmap-web-1.3/cgi-bin/004075500255470005670000000000000707273221200145135ustar00alekcadds00002600000223nmap-web-1.3/cgi-bin/nmap-web.pl010075500255470005670000000250530707665516700166040ustar00alekcadds00002600000223#!/usr/local/share/bin/perl -w -I/usr/local/web/docs/nmap-web/include
#
# ^^^ Update path-to-perl and include directory above ^^^


#-------------- Should be fairly boilerplate from here on out --------------
# nmap-web - a quick-n-dirty Web interface to nmap
# Copyright 2000  by Alek Komarnitsky, 
#     alek@komar.org, http://www.komar.org/komar/alek/
# See LICENSE for conditions of use. 

$version="1.3 (04/17/00)";

use nmap_web_local;
use nmap_web_local_ports;
use nmap_web_ports_parse;
use nmap_web_web_routines;
require 5.004;
$| = 1;           # Buffer out

print "Content-type: text/html\n\n\n" ;
print "\n";
print "\n";
print "\n";
print "\n";
print "\n";

&ReadParse;
&check_if_ip_ok_to_run();

$thisURL = get_env_variable("^SCRIPT_NAME");
$counter1 = &Get_Accumulator($count_file1) if ((defined($count_file1)) && (-r $count_file1));
$counter2 = &Get_Accumulator($count_file2) if ((defined($count_file2)) && (-r $count_file2));
$counter3 = &Get_Accumulator($count_file3) if ((defined($count_file3)) && (-r $count_file3));
$tempvar = "$counter1-$counter2-$counter3" if (defined($counter1) && defined($counter2) && defined($counter3)); 

if ( defined($in{'show_top_frame'}) ) {
   print "
\n";
   print "\n";
   print "Select port(s) to check:     ";
   print "\n";
   print "                              
\n";
###   print "";
###   print "Show machines that do not appear to be up
\n";
   print "";
   print "Show machines that don't answer at any of the selected ports
\n";
   print "";
   print "Get program/version info running on an INDIVIDUAL port selected
\n";
   print "
Select one of these groupings: ";
   print "         ";
   print "*OR* enter a space-separated list to scan: ";
   print "
\n"; 
   print "";
   print "                                  ";
   print "                              
\n";
   print "
";
} elsif ( defined($in{'show_middle_frame'}) ) {
   print "A quick-n-dirty way to see which machines are running Web Servers and other services
";
   print "Questions/comments/suggestions to $author - $version";
   print "($tempvar)" if (defined($tempvar));
   print "
\n";
} elsif ( defined($in{'Help'}) ) {
   system("cat $help_file");
} elsif ( defined($in{'PORT_INFO'}) ) {
   print "
";
   foreach $_ (sort keys %ports) {    
      print "$names{$_}: expected=";
      if ( defined($expec{$_})) {
         print $expec{$_};
      } else {
         print "N/A";
      }
      print "    $ports{$_}\n";
   }
} elsif ( defined($in{'do_nmap'}) ) {
   print "
";
   if ( defined($ports{$in{'port_selection'}})) {
      $nmap_ports = $ports{$in{'port_selection'}};
   } else {
      print "do not know what to do with $in{'port_selection'} - exiting\n";
      print "";
      exit(2);
   }
   if ( defined($in{'get_port_data'})) {
      if ( ! ($nmap_ports =~ /^\d+$/) ) {
         print "You requested program/version info on $nmap_ports\n\n\n";
         print "You can not get program/version info if more than one port selected
";
         print "";
         exit(); 
      }
   }
   $counter1 = &Increment_Accumulator($count_file1,1) if ((defined($count_file1)) && ( -w $count_file1));
   $hosts_sel = "NONE" ; 
   if ((defined($in{'grouping'})) && ( $in{'grouping'} ne "NONE")) {
      $hosts_sel = $in{'grouping'}; 
   }
   if ((defined($in{'keyword'})) && ( $in{'keyword'} ne "")) {
      $hosts_sel = $in{'keyword'};
      if ( $hosts_sel =~ /-ports \d+/ ) {
         $nmap_ports = $hosts_sel;
         $nmap_ports =~ s/^.*-ports (\S+)\s+.*$/$1/;
         $hosts_sel =~ s/^.*-ports \S+\s+(.*)$/$1/;
      }
   }
   if ($hosts_sel eq "NONE") {
      print "nothing entered ...";
      print "";
      exit(2); 
   }
   @HOSTS = split(/\s+/,$hosts_sel);
   foreach (@HOSTS) {
      chomp(); 
      if (( /^\w[\w\,\.\-]*$/ ) && ( ! (/\-[\/\.\,\*\d]+\-/ ))) {
         # Looks like we got a "real" host/netgroups name
      } else {
         print "not allowed to enter funky wildcards ... sorry ...";
         print "";
         exit(2);
      }
   }
   if ( defined($getnetgroup_exec)) {
      @HOSTS = `$getnetgroup_exec $hosts_sel $getnetgroup_ignore | sort -u 2>&1` ;
   } else {
      @HOSTS = split(/\s+/,$hosts_sel);
   }
   $hosts_sel = "$hosts_sel $getnetgroup_ignore" if (defined($getnetgroup_ignore)); 
   print "There are " , $#HOSTS + 1 , " machines in $hosts_sel  - scanning ports $nmap_ports ...\n\n"; 
   $hosts_all_string = ""; 
   foreach (@HOSTS) {
      chomp(); 
      $hosts_all_string .= " $_";
   }
   print "";
   if ( $nmap_ports eq "0") {
      printf "%-50s%s" , "Hostname/IP address" , "   Ping Status\n";
   } elsif (( $nmap_ports eq "13") && ( defined($in{'get_port_data'}))) {
      printf "%-50s%s" , "Hostname/IP address" , "   Delta   Remote Date\n";
   } elsif ((( $nmap_ports eq "21") || ( $nmap_ports eq "22") || ( $nmap_ports eq "25"))  && ( defined($in{'get_port_data'}))) {
      printf "%-50s%s" , "Hostname/IP address" , "   Version\n";
   } elsif (( $nmap_ports eq "80") && ( defined($in{'get_port_data'}))) {
      printf "%-50s%s" , "Hostname/IP address" , "   Web Server Type/Version\n";
   } else {
      printf "%-50s%s" , "Hostname/IP address" , "   Ports that are Open from $nmap_ports \n";
   }
   print "";
   &log_actions(); 
   if ( $nmap_ports eq "0" ) {
      open(NMAP_OUT,"$nmap_exec $nmap_ping_options $hosts_all_string 2>&1 |");
   } else {
      open(NMAP_OUT,"$nmap_exec $nmap_options -p $nmap_ports $hosts_all_string 2>&1 |");
   }
   $how_many_web_servers = 0; 
   while () { 
      chomp();
      $line = $_;
      if ( /Nmap run completed/ ) { 
         print "\n
$how_many_web_servers machines found answering the above ports\n$_ END\n"; 
      } elsif (( /^#/ ) || ( /^$/ ) || ( /^Starting nmap/ )) { 
         # Ignore all of these ...
      } elsif ( /Failed to resolve given/ ) { 
         $host = $line;
         $host =~ s/Note that you can.*$//;
         $host =~ s/Failed to resolve given hostname\/IP: //;
         $host =~ s/\.\s*$//;
         printf "%-50s%s" , "$host:" , "   UNRESOLVABLE\n";
      } elsif (/^Host: / ) {
         if ( $nmap_ports eq "0") {
            ($host,$_) = split(/\t/,$line);
            $host =~ s/Host: //;
            $host =~ s/\(\)/\(UNRESOLVEABLE\)/;
            printf "%-50s%s" , "$host:" , "   PINGABLE\n";
            $how_many_web_servers++;
         } else {
            ($host,$open,$_) = split(/\t/,$line);
            $host =~ s/Host: //;
            $host =~ s/\(\)/\(UNRESOLVEABLE\)/;
            if ( $open =~ /Status: Up/ ) {
               if (( defined($in{'show_no_ports'})) && ($in{'show_no_ports'} eq "on")) {
                  printf "%-50s%s" , "$host:" , "   Nothing Open\n";
               }
            } else {
               printf "%-50s" , "$host:";
               $how_many_web_servers++;
               @ports_open = split(/\s+/,$open);
               @ports_all = (); 
               foreach $_ (@ports_open) {
                  next if ( /^Ports/ );
                  ($portnum,$_) = split(/\//,$_);
                  $portnum =~ s/ *//;
                  push(@ports_all,$portnum);
               }
               if ( defined($in{'get_port_data'})) {
                  $host =~ s/ \(.*$//; 
                  $_ = &get_port_data($host,$nmap_ports,$in{'port_selection'});
                  print "   $_";
               } else {
                  foreach $_ (@ports_all) { print "   $_"; } 
               }
               print "\n"; 
            }
         }
      } elsif ( /Skipping host/ ) { 
         print "STRANGE SKIPPING CONDITION WITH $_ END\n";
         next;
         s/Skipping host //;
         $host = $_ ;
         $host =~ s/^(.*)\(\d+.*$/$1/ ;
         $host = "UNRESOLVEABLE" if ( $host =~ /^ *$/);
         $ip = $_ ;
         $ip =~ s/^.*\(([\d\.]+)\).*$/$1/ ;
         printf "%-50s%s" , "host $host (ip is $ip):" , "   Timed Out";;
      } elsif ( /due to host timeout/ ) {
         print "STRANGE HOST TIMEOUT CONDITION WITH $_ END\n";
         next;
         s/Interesting ports on //;
         $host = $_ ;
         $host =~ s/^(.*)\(\d+.*$/$1/ ;
         $host = "UNRESOLVEABLE" if ( $host =~ /^ *$/);
         $ip = $_ ;
         $ip =~ s/^.*\(([\d\.]+)\).*$/$1/ ;
         printf "%-50s%s" , "host $host (ip is $ip):" , "   Timed Out too";;
      } else {
         print "should NOT have gotten here with $_ END
\n";
      }
   }
   print "

";
   $counter2 = &Increment_Accumulator($count_file2,$how_many_web_servers) if ((defined($count_file2)) && (-w $count_file2));
   $counter3 = &Increment_Accumulator($count_file3,$#HOSTS +1) if ((defined($count_file3)) && (-w $count_file3));
} else {
   print "Should NOT get here - some sort of error with frame select (?)...";
}
print "";
exit(); 


sub log_actions {
   my ($browserhost,$ip,@iplist);
   $_ = get_env_variable("^REMOTE_ADDR");
   if ( $_ ne "" ) {
      s/^.*=//s;
      @iplist = split(/\./,$_);
      $ip = pack('C4',@iplist);
      $browserhost = gethostbyaddr($ip,AF_INET);
   }
   $browserhost = get_env_variable("^REMOTE_ADDR") if ( $browserhost eq "");
   $_ = "JUST_OPEN";
   $_ = "GET_RESULTS" if (defined($in{'get_port_data'})) ;
   system ("echo \"`date`	$browserhost	-p $nmap_ports	$_	$hosts_sel\" >> $log_file") if (defined($log_file)); 
}


sub check_if_ip_ok_to_run {
   $_ = get_env_variable("^REMOTE_ADDR");
   if ( ! /$ips_who_can_use/ ) { 
      print "You are not allowed to use this ... contact $author for more info
";
      print "";
      exit(2);
   }
}
nmap-web-1.3/misc/004075500255470005670000000000000707345605700141515ustar00alekcadds00002600000223nmap-web-1.3/misc/getnetgroup010075500255470005670000000023020707345624700164350ustar00alekcadds00002600000223#!/usr/local/share/bin/perl -w
#^^^^^^^^^^^^^^^^^^^^ Update pathname to where you have Perl installed

# A quick-n-dirty example of a getnetgroup command - use as you see fit

&setup_defaults;
&parse_args;
&doit;
exit(); 

sub usage {
   print <