Re: Service Detection: SIP end point (1 match, 2 softmatch)

[Tom Sellers <nmap () fadedcode net>]

Brandon Enright wrote:


> This is good work.  The issue though with match lines that are too
> generic is that they will prevent more accurate service fingerprints
> from ever being printed or submitted.
>
> The line could probably be better suited as a softmatch like so:
>
> softmatch sip m|^SIP/2\.0 ([-\w\s.]+)\r\n| i/SIP end point; Status: $1/
>
> Can you give that a whirl and report back if you see any issue with it?
>
> Brandon

Ok, I have been able to scan a few more devices that have the
SIP endpoint open to get a broader sampling of responses.  The
attached patch has 1 match line and 2 softmatch lines.  The
match line is for a SIP Gateway service that runs on Cisco routers.
This service returns Cisco-SIPGateway and the IOS family (i.e. 11.x)
in the Server field.  I have flagged this match as d/router/.
This may need to be changed later if the service shows up on other
Cisco equipment.

The first softmatch line is for services that return a Server:
banner in the response.  The match line places all of this
data in p// and the SIP response code and status in i//. This
has been tested on equipment from vendor other than Cisco.

The second softmatch line is exactly as you entered it above.
It is a generic SIP match for SIP responses that don't contain
a Server: field or otherwise break the pattern matching.

Tom

Attachment: patch_SIP_softmatch_and_Cisco
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org