Re: Sounds like ftp-anon needs work?

[Rob Nicholls <robert () robnicholls co uk>]

On Thu, 20 May 2010 12:37:00 -0600, David Fifield <david () bamsoftware com>
wrote:
> 202 Command not implemented, superfluous at this site.
>
> I was thinking about 202 in particular when I suggested looking for all
> 2?? error codes.

The script only sends USER or PASS at this stage. I can't imagine many FTP
servers wouldn't support them ;-) Perhaps it won't support PASS if a
password isn't required after supplying the username, but if it doesn't
support PASS it's a bit strange to have previously sent us a 331 requesting
a password (and we only ever send PASS if the server returns a 331).

The 200 code would probably make more sense in my opinion, in case a
server only returns a 200 instead of 230 after a successful logon (still
very odd behaviour though).

> Let me say again that I'm very comfortable with
> accepting false positives in this case.

As previously mentioned, my current working version does support other 2xx
codes, and will display any non-230 FTP server code as part of the output,
making it easier to spot potential false positives. I just wanted to make
sure that we're not introducing false positives when there could never be a
false negative. It does sounds like it would be safer/best to initially
support all 2xx codes and only modify the script if/as required.

Thanks for the debate, hope you didn't mind me playing devil's advocate :)

Rob

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/