Anthony Persaud » Nmap Parser

Nmap-Parser 1.13 Release with Servicefp support.

Anthony Persaud — Tue, 12 Feb 2008 04:51:57 +0000

Just released Nmap-Parser-1.13 with support in parsing the servicefp attribute in the service tag. This is also known as the service fingerprint. See documentation for more details.

Thanks to jpomiane for sending in the patch.

Migrated project to Google Code!

Anthony Persaud — Mon, 19 Nov 2007 21:11:44 +0000

I have finally had the chance to migrate this small project over to Google Code. To be honest, that was the most easiest things I have ever done. They have really made the work flow for developing and releasing code extremely easy (MUCH easier than SourceForge). With that said, all further development will be done over at Google Code.

Here is the link: http://code.google.com/p/nmap-parser/

Nmap-Parser 1.11 Released (yes, it's a miracle)

Anthony Persaud — Thu, 14 Jun 2007 23:17:28 +0000

Yeah, well I have to apologize for all the delay in releasing and fixing all the bugs that were submitted through email/sourceforge. I finally took the time to go over the new enhancements to the nmap xml output and see what I was missing. Anyways, enjoy!

Changes:

– Added parsing of distance information.
- Added ignoring of taskend,taskbegin and taskprogress information.
- Added tests for nmap 4.20.
- Changed lisence to MIT.
- Fixed protocol for the service handler – a bug that always returns null

Nmap Parser 1.11 on SourceForge

Nmap-Parser-1.11.tar.gz on CPAN

Will start updating as soon as…

Anthony Persaud — Wed, 10 May 2006 23:16:45 +0000

Well, I have received a LOT of emails on updates and suggestions to Nmap::Parser. Just as a general announcement, I am currently STILL finishing up my thesis for my MS Degree, so it will take a little while before I can sit back down and start programming again and going through all the emails.

So that I can track all the stuff I need to do for the next version, please make sure you go to the project page and submit Bug/Feature Request. I would appreciate it very much and I thank you for your patience

Nmap-Parser 1.05 Released

Anthony Persaud — Sat, 13 Aug 2005 01:02:13 +0000

The main reason for this release is major speed improvements and reduction in memory usage. Most functions are now genereated on the fly, reducing compile time (as well as saving memory). It was one of those days when I realized I could do things better (thanks to the Cookbook). I have also updated the documentation (I had mistyped some words and function names).

Where has get_host_objects() gone?

Anthony Persaud — Fri, 12 Aug 2005 01:02:04 +0000

I have been getting a lot of questions about this method in the new version of Nmap::Parser with

all_hosts

all_hosts($status)

Returns an array of all the Nmap::Parser::Host objects for the scan. If the optional status is given, it will only return those hosts that match that status. The status can be any of the following: (up|down|unknown|skipped)

Qualys perl module for QualysGuard

Anthony Persaud — Wed, 27 Jul 2005 12:52:14 +0000

For those who are in the corporate world and use the Qualys (QualysGuard) vulnerability scanner, and wish to write your own applications using their API – I have created a simple connection wrapper to their API. I have uploaded this initial version to CPAN found here: http://search.cpan.org/~apersaud/Qualys-0.02/

Nmap-Parser-1.01 Released (finally)

Anthony Persaud — Mon, 04 Jul 2005 00:50:02 +0000

After much rewriting and reworking – I am finally proud to announce that 1.01 is released. Why not 1.00? Well, I did not like my CPAN file just having a 1 by its name. Also it did pass 7 of the CPAN testers, so it should be good to go.

Please read the documentation carefully because there have been MAJOR changes. (If you do not want to install and have all your old script breaking). I know some people are going to get mad because of the major changes, but trust me they had to be done. In most cases, you should like the new framework.

Thanks for your patience and understanding. Happy 4th of July!

New Nmap-Parser website up and running!

Anthony Persaud — Fri, 01 Jul 2005 00:46:56 +0000

After learning PHP and MySQL and a whole bunch of javascript – I can finally get out of using blogger (not that there is anything wrong with that), but now I wrote my own self-maintaining website! I can now write articles, post updates and manage the website right from sourceforge.

If you ever want to contribute articles (tutorials or anything) to the webiste, go to the articles section and use the link provided to send me your content. I will post it for you so everyone else enjoy (it should be Nmap-Parser or Nmap related).

Thanks,

Anthony G Persaud

Using Nmap-Parser to check for suspicioius new services

Anthony Persaud — Sat, 13 Nov 2004 01:08:56 +0000

((no less 'of'; my $self) Using multiple instances of Nmap::Parser is extremely useful in helping audit/monitor the network Policy (ohh noo! its that ‘P’ word!). In this example, we have a set of hosts that had been scanned previously for tcp services where the image was saved in base_image.xml. We now will scan the same hosts, and compare if any new tcp have been open since then (good way to look for suspicious new services). Easy security Compliance detection. (ooh noo! The ‘C’ word too!).

use Nmap::Parser;
 use vars qw($nmap_exe $nmap_args @ips);
 my $base = new Nmap::Parser;
 my $curr = new Nmap::Parser;

 $base->parsefile('base_image.xml'); #load previous state
 $curr->parsescan($nmap_exe, $nmap_args, @ips); #scan current hosts

 for my $ip ($curr->get_ips )
 {
        #assume that IPs in base == IPs in curr scan
        my $ip_base = $base->get_host($ip);
        my $ip_curr = $curr->get_host($ip);
        my %port = ();

        #find ports that are open that were not open before
        #by finding the difference in port lists
        my @diff =  grep { $port{$_} < 2}
                   (map {$port{$_}++; $_}
                   ( $ip_curr->tcp_open_ports ,
                     $ip_base->tcp_open_ports ));

        print "$ip has these new ports open: ".join(',',@diff)
                 if(scalar @diff);

        for (@diff){
                   print "$_ seems to be ",
                            $ip_curr->tcp_service($_)->name,
                   "\n";
}

 }