logstash-codec-nmap 0.0.8 → 0.0.9
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/logstash/codecs/nmap.rb +3 -1
- data/logstash-codec-nmap.gemspec +1 -1
- data/spec/codecs/nmap_spec.rb +7 -1
- data/spec/fixtures/full_scan.xml +261 -0
- metadata +3 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 9b915c7826f05f545606e74a99585c670f3cf1e0
|
|
4
|
+
data.tar.gz: 49b35f3cf3d483d5c4e0c54a5b51c6d27137a9f2
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a03fbdfe80a2d20230dde379fe416f51844e909d259bfc28164518b674d61aa4b0c573aa264ca1d80465d970fd2e4d043561fd1f526b69670dc7b633bc5fdd45
|
|
7
|
+
data.tar.gz: f3aa9ea6a1976e59a2bc8f6bfc2a62c2a20edcd0f7e8f5ac63eadac5b2f320ed2620ba86c79bee5676021935b78eae5af99d5606e55a73da8c418c4c20b49fcc
|
data/lib/logstash/codecs/nmap.rb
CHANGED
|
@@ -76,6 +76,7 @@ class LogStash::Codecs::Nmap < LogStash::Codecs::Base
|
|
|
76
76
|
end
|
|
77
77
|
end
|
|
78
78
|
rescue StandardError => e
|
|
79
|
+
raise e
|
|
79
80
|
@logger.warn("An unexpected error occurred parsing nmap XML",
|
|
80
81
|
:input => data,
|
|
81
82
|
:message => e.message,
|
|
@@ -193,9 +194,10 @@ class LogStash::Codecs::Nmap < LogStash::Codecs::Base
|
|
|
193
194
|
def hashify_traceroute(traceroute)
|
|
194
195
|
return unless traceroute
|
|
195
196
|
|
|
197
|
+
protocol = traceroute.protocol rescue nil
|
|
196
198
|
{
|
|
197
199
|
'port' => traceroute.port, # int
|
|
198
|
-
'protocol' =>
|
|
200
|
+
'protocol' => protocol,
|
|
199
201
|
'hops' => traceroute.map.with_index do |hop, idx|
|
|
200
202
|
{
|
|
201
203
|
'address' => hop.addr, # str
|
data/logstash-codec-nmap.gemspec
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
|
|
3
3
|
s.name = 'logstash-codec-nmap'
|
|
4
|
-
s.version = '0.0.
|
|
4
|
+
s.version = '0.0.9'
|
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
|
6
6
|
s.summary = "This codec may be used to decode Nmap XML"
|
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
data/spec/codecs/nmap_spec.rb
CHANGED
|
@@ -53,7 +53,13 @@ describe LogStash::Codecs::Nmap do
|
|
|
53
53
|
end
|
|
54
54
|
|
|
55
55
|
describe "scanme_A.xml" do
|
|
56
|
-
let(:xml_string) { File.open("spec/fixtures/
|
|
56
|
+
let(:xml_string) { File.open("spec/fixtures/scanme_A.xml").read }
|
|
57
|
+
it_should_behave_like "a valid parse"
|
|
58
|
+
end
|
|
59
|
+
|
|
60
|
+
|
|
61
|
+
describe "full_scan.xml" do
|
|
62
|
+
let(:xml_string) { File.open("spec/fixtures/full_scan.xml").read }
|
|
57
63
|
it_should_behave_like "a valid parse"
|
|
58
64
|
end
|
|
59
65
|
|
|
@@ -0,0 +1,261 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
|
|
3
|
+
<!-- Nmap 6.00 scan initiated Sun Jan 17 21:27:08 2016 as: nmap -A -T5 -oX - 192.168.1.0/24 -->
|
|
4
|
+
<nmaprun scanner="nmap" args="nmap -A -T5 -oX - 192.168.1.0/24" start="1453066028" startstr="Sun Jan 17 21:27:08 2016" version="6.00" xmloutputversion="1.04">
|
|
5
|
+
<scaninfo type="syn" protocol="tcp" numservices="1000" services="1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,106,109-111,113,119,125,135,139,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-445,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389"/>
|
|
6
|
+
<verbose level="0"/>
|
|
7
|
+
<debugging level="0"/>
|
|
8
|
+
<host starttime="1453066029" endtime="1453066187"><status state="up" reason="arp-response"/>
|
|
9
|
+
<address addr="192.168.1.1" addrtype="ipv4"/>
|
|
10
|
+
<address addr="10:C3:7B:44:3F:F5" addrtype="mac"/>
|
|
11
|
+
<hostnames>
|
|
12
|
+
<hostname name="router.asus.com" type="PTR"/>
|
|
13
|
+
</hostnames>
|
|
14
|
+
<ports><extraports state="closed" count="998">
|
|
15
|
+
<extrareasons reason="resets" count="998"/>
|
|
16
|
+
</extraports>
|
|
17
|
+
<port protocol="tcp" portid="53"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="domain" product="dnsmasq" version="2.72test3" method="probed" conf="10"><cpe>cpe:/a:thekelleys:dnsmasq:2.72test3</cpe></service><script id="dns-nsid" output="
 NSID: rose-cns02 (726f73652d636e733032)
 id.server: rose-cns02
 bind.version: dnsmasq-2.72test3
"/></port>
|
|
18
|
+
<port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="http" product="Linksys wireless-G WAP http config" extrainfo="Name RT-N56U" devicetype="WAP" method="probed" conf="10"/><script id="http-methods" output="No Allow or Public header in OPTIONS response (status code 501)"/><script id="http-auth" output="
HTTP/1.0 401 Unauthorized
 Basic realm=RT-N56U
"/><script id="http-title" output="401 Unauthorized"/></port>
|
|
19
|
+
</ports>
|
|
20
|
+
<os><portused state="open" proto="tcp" portid="53"/>
|
|
21
|
+
<portused state="closed" proto="tcp" portid="1"/>
|
|
22
|
+
<portused state="closed" proto="udp" portid="43706"/>
|
|
23
|
+
<osmatch name="Linux 2.6.8 - 2.6.27" accuracy="100" line="39673">
|
|
24
|
+
<osclass type="general purpose" vendor="Linux" osfamily="Linux" osgen="2.6.X" accuracy="100"><cpe>cpe:/o:linux:kernel:2.6</cpe></osclass>
|
|
25
|
+
</osmatch>
|
|
26
|
+
</os>
|
|
27
|
+
<uptime seconds="608348" lastboot="Sun Jan 10 20:30:39 2016"/>
|
|
28
|
+
<distance value="1"/>
|
|
29
|
+
<tcpsequence index="196" difficulty="Good luck!" values="423560BA,4213027E,41CC9F3A,41CB07DB,422DC3A7,41E632B5"/>
|
|
30
|
+
<ipidsequence class="All zeros" values="0,0,0,0,0,0"/>
|
|
31
|
+
<tcptssequence class="other" values="9109F86,9109F9F,9109FB8,9109FD1,9109FEA,910A003"/>
|
|
32
|
+
<trace>
|
|
33
|
+
<hop ttl="1" ipaddr="192.168.1.1" rtt="0.41" host="router.asus.com"/>
|
|
34
|
+
</trace>
|
|
35
|
+
<times srtt="407" rttvar="48" to="50000"/>
|
|
36
|
+
</host>
|
|
37
|
+
<host starttime="1453066029" endtime="1453066187"><status state="up" reason="arp-response"/>
|
|
38
|
+
<address addr="192.168.1.130" addrtype="ipv4"/>
|
|
39
|
+
<address addr="04:15:52:E5:96:E5" addrtype="mac"/>
|
|
40
|
+
<hostnames>
|
|
41
|
+
<hostname name="AndrewTV" type="PTR"/>
|
|
42
|
+
</hostnames>
|
|
43
|
+
<ports><extraports state="closed" count="500">
|
|
44
|
+
<extrareasons reason="resets" count="500"/>
|
|
45
|
+
</extraports>
|
|
46
|
+
<extraports state="filtered" count="498">
|
|
47
|
+
<extrareasons reason="no-responses" count="498"/>
|
|
48
|
+
</extraports>
|
|
49
|
+
<port protocol="tcp" portid="3689"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="daap" product="Apple iTunes DAAP" version="11.1b37" ostype="OS X" method="probed" conf="10"/></port>
|
|
50
|
+
<port protocol="tcp" portid="62078"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="tcpwrapped" method="probed" conf="8"/></port>
|
|
51
|
+
</ports>
|
|
52
|
+
<os><portused state="open" proto="tcp" portid="3689"/>
|
|
53
|
+
<portused state="closed" proto="tcp" portid="4"/>
|
|
54
|
+
<portused state="closed" proto="udp" portid="30548"/>
|
|
55
|
+
<osmatch name="Apple iOS 4.4.2 - 5.0.1 (Darwin 11.0.0)" accuracy="100" line="2951">
|
|
56
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="100"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
57
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="100"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
58
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="100"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
59
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="100"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
60
|
+
</osmatch>
|
|
61
|
+
</os>
|
|
62
|
+
<uptime seconds="472254" lastboot="Tue Jan 12 10:18:53 2016"/>
|
|
63
|
+
<distance value="1"/>
|
|
64
|
+
<tcpsequence index="262" difficulty="Good luck!" values="CD649027,A26474D9,3DBC0136,481DA3D2,D7045104,74255443"/>
|
|
65
|
+
<ipidsequence class="Randomized" values="E3BE,6CE3,FA52,D788,3938,5BE4"/>
|
|
66
|
+
<tcptssequence class="1000HZ" values="1C25F483,1C25F4E8,1C25F54A,1C25F5AE,1C25F612,1C25F675"/>
|
|
67
|
+
<trace>
|
|
68
|
+
<hop ttl="1" ipaddr="192.168.1.130" rtt="1.54" host="AndrewTV"/>
|
|
69
|
+
</trace>
|
|
70
|
+
<times srtt="1538" rttvar="207" to="50000"/>
|
|
71
|
+
</host>
|
|
72
|
+
<host starttime="1453066029" endtime="1453066187"><status state="up" reason="arp-response"/>
|
|
73
|
+
<address addr="192.168.1.132" addrtype="ipv4"/>
|
|
74
|
+
<address addr="3C:15:C2:EA:B8:72" addrtype="mac"/>
|
|
75
|
+
<hostnames>
|
|
76
|
+
<hostname name="andrew-bfg" type="PTR"/>
|
|
77
|
+
</hostnames>
|
|
78
|
+
<ports><extraports state="closed" count="960">
|
|
79
|
+
<extrareasons reason="resets" count="960"/>
|
|
80
|
+
</extraports>
|
|
81
|
+
<extraports state="filtered" count="34">
|
|
82
|
+
<extrareasons reason="no-responses" count="34"/>
|
|
83
|
+
</extraports>
|
|
84
|
+
<port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="rpcbind" version="2-4" extrainfo="rpc #100000" method="probed" conf="10" rpcnum="100000" lowver="2" highver="4" proto="rpc"/><script id="rpcinfo" output="
 program version port/proto service
 100000 2,3,4 111/tcp rpcbind
 100000 2,3,4 111/udp rpcbind
 100003 2,3 2049/tcp nfs
 100003 2,3 2049/udp nfs
 100005 1,3 895/udp mountd
 100005 1,3 1023/tcp mountd
 100011 1,2 994/udp rquotad
 100011 1,2 999/tcp rquotad
 100021 0,1,3,4 733/udp nlockmgr
 100021 0,1,3,4 1017/tcp nlockmgr
 100024 1 896/udp status
 100024 1 1021/tcp status
"/></port>
|
|
85
|
+
<port protocol="tcp" portid="999"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="garcon" servicefp="SF-Port999-TCP:V=6.00%I=7%D=1/17%Time=569C0760%P=armv7l-unknown-linux-gnueabi%r(RPCCheck,1C,"\x80\0\0\x18r\xfe\x1d\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x03");" method="table" conf="3"/></port>
|
|
86
|
+
<port protocol="tcp" portid="1021"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="exp1" servicefp="SF-Port1021-TCP:V=6.00%I=7%D=1/17%Time=569C0760%P=armv7l-unknown-linux-gnueabi%r(RPCCheck,1C,"\x80\0\0\x18r\xfe\x1d\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x03");" method="table" conf="3"/></port>
|
|
87
|
+
<port protocol="tcp" portid="1023"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="netvenuechat" servicefp="SF-Port1023-TCP:V=6.00%I=7%D=1/17%Time=569C0760%P=armv7l-unknown-linux-gnueabi%r(RPCCheck,1C,"\x80\0\0\x18r\xfe\x1d\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x03");" method="table" conf="3"/></port>
|
|
88
|
+
<port protocol="tcp" portid="2049"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="tcpwrapped" method="probed" conf="8"/></port>
|
|
89
|
+
<port protocol="tcp" portid="3689"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="daap" product="Apple iTunes DAAP" version="12.3.2.35" ostype="OS X" method="probed" conf="10"/></port>
|
|
90
|
+
</ports>
|
|
91
|
+
<os><portused state="open" proto="tcp" portid="111"/>
|
|
92
|
+
<portused state="closed" proto="tcp" portid="1"/>
|
|
93
|
+
<portused state="closed" proto="udp" portid="38850"/>
|
|
94
|
+
<osmatch name="Apple iOS 4.4.2 - 5.0.1 (Darwin 11.0.0)" accuracy="96" line="2951">
|
|
95
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
96
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
97
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
98
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
99
|
+
</osmatch>
|
|
100
|
+
<osmatch name="Apple Mac OS X 10.7.0 - 10.7.2 (Lion) (Darwin 11.0.0 - 11.2.0)" accuracy="96" line="5120">
|
|
101
|
+
<osclass type="general purpose" vendor="Apple" osfamily="Mac OS X" osgen="10.7.X" accuracy="96"><cpe>cpe:/o:apple:mac_os_x:10.7.0</cpe></osclass>
|
|
102
|
+
</osmatch>
|
|
103
|
+
<osmatch name="Apple Mac OS X 10.7.0 - 10.7.2 (Lion) (Darwin 11.0.0 - 11.2.0) or iOS 4.2 - 4.3.5" accuracy="96" line="5281">
|
|
104
|
+
<osclass type="media device" vendor="Apple" osfamily="Mac OS X" osgen="10.7.X" accuracy="96"><cpe>cpe:/o:apple:mac_os_x:10.7</cpe></osclass>
|
|
105
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
106
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
107
|
+
</osmatch>
|
|
108
|
+
<osmatch name="Apple iPad tablet computer (iOS 4.3.3)" accuracy="95" line="3029">
|
|
109
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="95"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
110
|
+
</osmatch>
|
|
111
|
+
<osmatch name="Apple iOS 5.0.1" accuracy="95" line="3243">
|
|
112
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="95"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
113
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="95"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
114
|
+
</osmatch>
|
|
115
|
+
<osmatch name="Apple Mac OS X 10.7.2 (Lion) (Darwin 11.2.0)" accuracy="95" line="5162">
|
|
116
|
+
<osclass type="general purpose" vendor="Apple" osfamily="Mac OS X" osgen="10.7.X" accuracy="95"><cpe>cpe:/o:apple:mac_os_x:10.7</cpe></osclass>
|
|
117
|
+
</osmatch>
|
|
118
|
+
<osmatch name="Apple iOS 4.2 - 4.3.4" accuracy="94" line="2885">
|
|
119
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="94"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
120
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="94"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
121
|
+
</osmatch>
|
|
122
|
+
<osmatch name="Apple iOS 4.3.3 - 4.3.5" accuracy="93" line="2926">
|
|
123
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="93"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
124
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="93"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
125
|
+
</osmatch>
|
|
126
|
+
<osmatch name="Apple iPad tablet computer (iOS 4.3.2)" accuracy="93" line="2993">
|
|
127
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="93"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
128
|
+
</osmatch>
|
|
129
|
+
<osmatch name="Apple iPad tablet computer or iPhone mobile phone (iOS 4.0 - 4.1)" accuracy="93" line="3126">
|
|
130
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="93"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
131
|
+
</osmatch>
|
|
132
|
+
</os>
|
|
133
|
+
<uptime seconds="328190" lastboot="Thu Jan 14 02:19:57 2016"/>
|
|
134
|
+
<distance value="1"/>
|
|
135
|
+
<tcpsequence index="257" difficulty="Good luck!" values="33207C1A,1CC7D5FC,75E4778,4B5E4C3,47A0936F"/>
|
|
136
|
+
<ipidsequence class="Randomized" values="78D5,C238,6666,879C,2760"/>
|
|
137
|
+
<tcptssequence class="1000HZ" values="138FB522,138FB570,138FB5D1,138FB634,138FB712"/>
|
|
138
|
+
<trace>
|
|
139
|
+
<hop ttl="1" ipaddr="192.168.1.132" rtt="4.51" host="andrew-bfg"/>
|
|
140
|
+
</trace>
|
|
141
|
+
<times srtt="4515" rttvar="5884" to="50000"/>
|
|
142
|
+
</host>
|
|
143
|
+
<host starttime="1453066189" endtime="1453066202"><status state="up" reason="localhost-response"/>
|
|
144
|
+
<address addr="192.168.1.223" addrtype="ipv4"/>
|
|
145
|
+
<hostnames>
|
|
146
|
+
<hostname name="raspberrypi" type="PTR"/>
|
|
147
|
+
</hostnames>
|
|
148
|
+
<ports><extraports state="closed" count="998">
|
|
149
|
+
<extrareasons reason="resets" count="998"/>
|
|
150
|
+
</extraports>
|
|
151
|
+
<port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ssh" product="OpenSSH" version="6.0p1 Debian 4+deb7u2" extrainfo="protocol 2.0" ostype="Linux" method="probed" conf="10"><cpe>cpe:/a:openbsd:openssh:6.0p1</cpe><cpe>cpe:/o:linux:kernel</cpe></service><script id="ssh-hostkey" output="1024 ac:75:c8:bb:ed:0a:34:72:66:9c:34:22:73:d2:e2:7b (DSA)
2048 ae:6f:19:45:61:88:eb:61:15:b8:07:fe:e7:e1:ad:3e (RSA)"/></port>
|
|
152
|
+
<port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="upnp" product="Microsoft Windows UPnP" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service><script id="http-methods" output="No Allow or Public header in OPTIONS response (status code 200)"/><script id="http-open-proxy" output="Potentially OPEN proxy.
Methods supported: CONNECTION"/></port>
|
|
153
|
+
</ports>
|
|
154
|
+
<os><portused state="open" proto="tcp" portid="22"/>
|
|
155
|
+
<portused state="closed" proto="tcp" portid="1"/>
|
|
156
|
+
<portused state="closed" proto="udp" portid="38217"/>
|
|
157
|
+
<osmatch name="Netgear DG834G WAP or Western Digital WD TV media player" accuracy="96" line="54647">
|
|
158
|
+
<osclass type="WAP" vendor="Netgear" osfamily="embedded" accuracy="96"/>
|
|
159
|
+
<osclass type="media device" vendor="Western Digital" osfamily="embedded" accuracy="96"/>
|
|
160
|
+
</osmatch>
|
|
161
|
+
<osmatch name="AXIS 210A or 211 Network Camera (Linux 2.6)" accuracy="92" line="6344">
|
|
162
|
+
<osclass type="webcam" vendor="AXIS" osfamily="Linux" osgen="2.6.X" accuracy="92"><cpe>cpe:/o:axis:linux:2.6</cpe></osclass>
|
|
163
|
+
</osmatch>
|
|
164
|
+
<osmatch name="HP P2000 G3 NAS device" accuracy="92" line="22329">
|
|
165
|
+
<osclass type="storage-misc" vendor="HP" osfamily="embedded" accuracy="92"/>
|
|
166
|
+
</osmatch>
|
|
167
|
+
<osmatch name="Crestron XPanel control system" accuracy="91" line="13468">
|
|
168
|
+
<osclass type="specialized" vendor="Crestron" osfamily="2-Series" accuracy="91"><cpe>cpe:/o:crestron:2_series</cpe></osclass>
|
|
169
|
+
</osmatch>
|
|
170
|
+
<osmatch name="Linux 2.4.26 (Slackware 10.0.0)" accuracy="91" line="30040">
|
|
171
|
+
<osclass type="general purpose" vendor="Linux" osfamily="Linux" osgen="2.4.X" accuracy="91"><cpe>cpe:/o:linux:kernel:2.4.26</cpe></osclass>
|
|
172
|
+
</osmatch>
|
|
173
|
+
<osmatch name="Linux 2.6.24" accuracy="90" line="35144">
|
|
174
|
+
<osclass type="general purpose" vendor="Linux" osfamily="Linux" osgen="2.6.X" accuracy="90"><cpe>cpe:/o:linux:kernel:2.6.24</cpe></osclass>
|
|
175
|
+
</osmatch>
|
|
176
|
+
<osmatch name="Tomato 1.27 - 1.28 (Linux 2.4.20)" accuracy="90" line="30716">
|
|
177
|
+
<osclass type="WAP" vendor="Linux" osfamily="Linux" osgen="2.4.X" accuracy="90"><cpe>cpe:/o:linux:kernel:2.4</cpe></osclass>
|
|
178
|
+
</osmatch>
|
|
179
|
+
<osmatch name="Linksys WRV54G WAP" accuracy="90" line="29022">
|
|
180
|
+
<osclass type="WAP" vendor="Linksys" osfamily="embedded" accuracy="90"><cpe>cpe:/h:linksys:wrv54g</cpe></osclass>
|
|
181
|
+
</osmatch>
|
|
182
|
+
<osmatch name="Check Point SBox-200 firewall" accuracy="89" line="9047">
|
|
183
|
+
<osclass type="firewall" vendor="Check Point" osfamily="embedded" accuracy="89"/>
|
|
184
|
+
</osmatch>
|
|
185
|
+
<osmatch name="Check Point VPN-1 UTM appliance" accuracy="89" line="9191">
|
|
186
|
+
<osclass type="firewall" vendor="Check Point" osfamily="Linux" osgen="2.4.X" accuracy="89"><cpe>cpe:/o:checkpoint:linux:2.4</cpe></osclass>
|
|
187
|
+
</osmatch>
|
|
188
|
+
</os>
|
|
189
|
+
<uptime seconds="99778" lastboot="Sat Jan 16 17:47:04 2016"/>
|
|
190
|
+
<distance value="0"/>
|
|
191
|
+
<tcpsequence index="258" difficulty="Good luck!" values="87BBB03A,213E2AAE,F4DC2F81,156010B4,CA190AB2,A93B3C87"/>
|
|
192
|
+
<ipidsequence class="All zeros" values="0,0,0,0,0,0"/>
|
|
193
|
+
<tcptssequence class="100HZ" values="983E67,983E71,983E7B,983E85,983E8F,983E99"/>
|
|
194
|
+
<times srtt="130" rttvar="13" to="50000"/>
|
|
195
|
+
</host>
|
|
196
|
+
<host starttime="1453066187" endtime="1453066218"><status state="up" reason="arp-response"/>
|
|
197
|
+
<address addr="192.168.1.251" addrtype="ipv4"/>
|
|
198
|
+
<address addr="48:D7:05:B7:10:BF" addrtype="mac"/>
|
|
199
|
+
<hostnames>
|
|
200
|
+
<hostname name="ZJ0071JessicaN" type="PTR"/>
|
|
201
|
+
</hostnames>
|
|
202
|
+
<ports><extraports state="closed" count="629">
|
|
203
|
+
<extrareasons reason="resets" count="629"/>
|
|
204
|
+
</extraports>
|
|
205
|
+
<extraports state="filtered" count="369">
|
|
206
|
+
<extrareasons reason="no-responses" count="369"/>
|
|
207
|
+
</extraports>
|
|
208
|
+
<port protocol="tcp" portid="497"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="retrospect" product="Dantz Retrospect backup client" method="probed" conf="10"/></port>
|
|
209
|
+
<port protocol="tcp" portid="5900"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="vnc" product="Apple remote desktop vnc" ostype="Mac OS X" method="probed" conf="10"><cpe>cpe:/o:apple:mac_os_x</cpe></service><script id="vnc-info" output="
 Protocol version: 3.889
 Security types:
 Mac OS X security type (30)
 Mac OS X security type (35)
"/></port>
|
|
210
|
+
</ports>
|
|
211
|
+
<os><portused state="open" proto="tcp" portid="497"/>
|
|
212
|
+
<portused state="closed" proto="tcp" portid="1"/>
|
|
213
|
+
<portused state="closed" proto="udp" portid="40440"/>
|
|
214
|
+
<osmatch name="Apple iOS 4.4.2 - 5.0.1 (Darwin 11.0.0)" accuracy="96" line="2951">
|
|
215
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
216
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
217
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
218
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
219
|
+
</osmatch>
|
|
220
|
+
<osmatch name="Apple Mac OS X 10.7.0 - 10.7.2 (Lion) (Darwin 11.0.0 - 11.2.0)" accuracy="96" line="5120">
|
|
221
|
+
<osclass type="general purpose" vendor="Apple" osfamily="Mac OS X" osgen="10.7.X" accuracy="96"><cpe>cpe:/o:apple:mac_os_x:10.7.0</cpe></osclass>
|
|
222
|
+
</osmatch>
|
|
223
|
+
<osmatch name="Apple Mac OS X 10.7.0 - 10.7.2 (Lion) (Darwin 11.0.0 - 11.2.0) or iOS 4.2 - 4.3.5" accuracy="96" line="5281">
|
|
224
|
+
<osclass type="media device" vendor="Apple" osfamily="Mac OS X" osgen="10.7.X" accuracy="96"><cpe>cpe:/o:apple:mac_os_x:10.7</cpe></osclass>
|
|
225
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
226
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="96"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
227
|
+
</osmatch>
|
|
228
|
+
<osmatch name="Apple iPad tablet computer (iOS 4.3.3)" accuracy="95" line="3029">
|
|
229
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="95"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
230
|
+
</osmatch>
|
|
231
|
+
<osmatch name="Apple iOS 5.0.1" accuracy="95" line="3243">
|
|
232
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="95"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
233
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="5.X" accuracy="95"><cpe>cpe:/o:apple:iphone_os:5</cpe></osclass>
|
|
234
|
+
</osmatch>
|
|
235
|
+
<osmatch name="Apple Mac OS X 10.7.2 (Lion) (Darwin 11.2.0)" accuracy="95" line="5162">
|
|
236
|
+
<osclass type="general purpose" vendor="Apple" osfamily="Mac OS X" osgen="10.7.X" accuracy="95"><cpe>cpe:/o:apple:mac_os_x:10.7</cpe></osclass>
|
|
237
|
+
</osmatch>
|
|
238
|
+
<osmatch name="Apple iOS 4.2 - 4.3.4" accuracy="94" line="2885">
|
|
239
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="94"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
240
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="94"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
241
|
+
</osmatch>
|
|
242
|
+
<osmatch name="Apple iPad tablet computer (iOS 4.3.2)" accuracy="93" line="2993">
|
|
243
|
+
<osclass type="media device" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="93"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
244
|
+
</osmatch>
|
|
245
|
+
<osmatch name="Apple iPad tablet computer or iPhone mobile phone (iOS 4.0 - 4.1)" accuracy="93" line="3126">
|
|
246
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="93"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
247
|
+
</osmatch>
|
|
248
|
+
<osmatch name="Apple iPhone mobile phone (iOS 4.3.2)" accuracy="93" line="3162">
|
|
249
|
+
<osclass type="phone" vendor="Apple" osfamily="iOS" osgen="4.X" accuracy="93"><cpe>cpe:/o:apple:iphone_os:4</cpe></osclass>
|
|
250
|
+
</osmatch>
|
|
251
|
+
</os>
|
|
252
|
+
<uptime seconds="988514" lastboot="Wed Jan 6 10:55:04 2016"/>
|
|
253
|
+
<distance value="1"/>
|
|
254
|
+
<trace>
|
|
255
|
+
<hop ttl="1" ipaddr="192.168.1.251" rtt="1.73" host="ZJ0071JessicaN"/>
|
|
256
|
+
</trace>
|
|
257
|
+
<times srtt="1727" rttvar="307" to="50000"/>
|
|
258
|
+
</host>
|
|
259
|
+
<runstats><finished time="1453066218" timestr="Sun Jan 17 21:30:18 2016" elapsed="193.66" summary="Nmap done at Sun Jan 17 21:30:18 2016; 256 IP addresses (5 hosts up) scanned in 193.66 seconds" exit="success"/><hosts up="5" down="251" total="256"/>
|
|
260
|
+
</runstats>
|
|
261
|
+
</nmaprun>
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-codec-nmap
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.0.
|
|
4
|
+
version: 0.0.9
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elastic
|
|
@@ -73,6 +73,7 @@ files:
|
|
|
73
73
|
- lib/logstash/codecs/nmap.rb
|
|
74
74
|
- logstash-codec-nmap.gemspec
|
|
75
75
|
- spec/codecs/nmap_spec.rb
|
|
76
|
+
- spec/fixtures/full_scan.xml
|
|
76
77
|
- spec/fixtures/ipv6_all.xml
|
|
77
78
|
- spec/fixtures/localscan.xml
|
|
78
79
|
- spec/fixtures/pingsweep.xml
|
|
@@ -108,6 +109,7 @@ specification_version: 4
|
|
|
108
109
|
summary: This codec may be used to decode Nmap XML
|
|
109
110
|
test_files:
|
|
110
111
|
- spec/codecs/nmap_spec.rb
|
|
112
|
+
- spec/fixtures/full_scan.xml
|
|
111
113
|
- spec/fixtures/ipv6_all.xml
|
|
112
114
|
- spec/fixtures/localscan.xml
|
|
113
115
|
- spec/fixtures/pingsweep.xml
|