Re: [Plugins-writers] Writing a plugin to detect a service on any port

From: George A. Theall (theall@private)
Date: Thu Jul 27 2006 - 17:16:56 PDT

On Thu, Jul 27, 2006 at 02:41:39PM -0400, Shawn Duffy wrote:

> So I started messing with the tips you gave me from my initial
> question and I am still running into difficulty...
> Below is a segment of code from the plugin... it should send a string
> of data to any "unknown" port and check the response for an indication
> that a proprietary service is running.  

The code looks ok. You may want to add some debugging statements, for
example, to show you what ports are being probed.

> When I look at a pcap of the
> exchange, it only appears to be connecting to each port but is not
> actually sending the request to any of the ports:

Are you sure Nessus is marking those ports as unknown services? Grep the
appropriate KB for "Services/unknown="; the values will be port numbers.

Plugins-writers mailing list

This archive was generated by hypermail 2.1.3 : Thu Jul 27 2006 - 17:17:38 PDT