Nmap Development mailing list archives
Re: [NSE] hadoop-* / hbase-* - false positives
From: John Bond <john.r.bond () gmail com>
Date: Sat, 2 Mar 2013 18:41:31 +0100
Hi Tom, Thanks for the feedback, i need to look at these scritps again because they are broken with the latest releases of hadoop/hbase. On 2 March 2013 17:50, Tom Sellers <nmap () fadedcode net> wrote:
All, The hadoop-* and hbase-* family of scripts will generate false positives against any HTTP service that returns status code 200 when any page is requested. There are quite a few "broken" web services that will return 200 to any request.
I agree this should be an easy fix The following scrips have been verified to be affected:
hadoop-datanode-info.nse hadoop-jobtracker-info.nse hadoop-namenode-info.nse hadoop-tasktracker-info.nse hbase-master-info.nse hbase-region-info.nse In the case of these scripts the issue is somewhat more problematic as they overwrite any fingerprint that has already been applied to the port.
I have to admit im not sure what the etiquette is here. if my script is confident that of what service is running on a port then it should overwrite the description (in this case i admit my script is being a bit arrogant). Im not sure what should happen if 2 scripts claim confidence about the same port port. At the moment im not sure how to handle this, sorry if i have missed something. It would be nice to have a system where you could register how confident you where that the service was yours. i.e. my script runs and says it is 70% confident, your script runs says it is 95% confident. standard view shows highest match, if there are two scripts that claim the same score they are both displayed. extra -v switches shows the other candidates
These scripts should probably be reworked to positively match content that is known to always been on pages. Alternately, the version detection logic should be moved further down in the logic after a more solid match is made. For example, in hbase-master-info.nse, on lines 70 and 71 the port name and version are overwritten. This should probably be moved down into body:match sections below. agreed should be an easy fix, wil send a patch in tomorrow so it stops
annoying you. i will also try to work onupdating the script for newer versions of hadoop/hbase/flume thanks for the feedback john _______________________________________________ Sent through the dev mailing list http://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/
Current thread:
- [NSE] hadoop-* / hbase-* - false positives Tom Sellers (Mar 02)
- Re: [NSE] hadoop-* / hbase-* - false positives Tom Sellers (Mar 02)
- Re: [NSE] hadoop-* / hbase-* - false positives John Bond (Mar 02)
- Re: [NSE] hadoop-* / hbase-* - false positives David Fifield (Mar 04)
- Re: [NSE] hadoop-* / hbase-* - false positives John Bond (Mar 05)
- Re: [NSE] hadoop-* / hbase-* - false positives David Fifield (Mar 05)
- Re: [NSE] hadoop-* / hbase-* - false positives Tom Sellers (Mar 05)
- Re: [NSE] hadoop-* / hbase-* - false positives David Fifield (Mar 04)