Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for using wildcards "*" to create masks in the "target_string" value when scanning ports #45

Open
EpicNet opened this issue Aug 20, 2021 · 2 comments

Comments

@EpicNet
Copy link

EpicNet commented Aug 20, 2021

Good afternoon. Many values in a directive target_string can have the same beginning, but completely different endings. To do this have to create many lines in order to make the bot respond to the detected open port.

target_string = "SSH-2.0-dropbear_0.51";
target_string = "SSH-2.0-dropbear_0.52";
target_string = "SSH-2.0-dropbear_0.53.1";
target_string = "SSH-2.0-dropbear_2012.55";
target_string = "SSH-2.0-dropbear_2013.62";
target_string = "SSH-2.0-dropbear_2014.63";

But this method is not efficient enough, because it is impossible to know in advance all the possible answers given by open ports.

Can I use wildcard "*" data masks to combine all of these values into one string to find similarities in different responses during a port scan?

For example:
target_string = "*SSH-2.0*"; or target_string = "*SSH-*.0*";

There is probably some other way to combine similar answers into one search string, but I do not know this and did not find descriptions in the documentation for your bot. If I am wrong, please tell me similar method.

If at the moment the use of such symbols is not possible to create masks, then please, make this improvement into the future update, because it will be very useful.

@miwob
Copy link
Member

miwob commented Aug 21, 2021

Wildcards are currently not supported as hopm uses strstr for string matching in this case. So all of the examples you listed above would have been covered with a single target_string = "SSH-2.0-dropbear_"; directive.

@EpicNet
Copy link
Author

EpicNet commented Aug 21, 2021

1. Can I summarize (covered) all the answers this way and will this work for all similar responses when scanning ports?

target_string = "SSH";

2. Please tell me if there is a need to prescribe such directives in each next scanner name, or is it enough to indicate this only in the topmost first one?

For example:
name = "ssh";
protocol = SSH:22;
target_string = "SSH";

name = "http";
protocol = SSH:22;
protocol = HTTP:80;
target_string = "SSH";
target_string = "200 OK";

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants