diff --git a/agent/nmap_agent.py b/agent/nmap_agent.py index c156887..bec88b0 100644 --- a/agent/nmap_agent.py +++ b/agent/nmap_agent.py @@ -166,6 +166,7 @@ def _scan_host(self, host: str, mask: int) -> Tuple[Dict[str, Any], str]: options = nmap_options.NmapOptions( dns_resolution=False, ports=self.args.get("ports"), + tcp_syn_ping_ports=self.args.get("tcp_syn_ping_ports"), top_ports=self.args.get("top_ports"), fast_mode=self.args.get("fast_mode", False), no_ping=self.args.get("no_ping", False), @@ -184,6 +185,7 @@ def _scan_domain(self, domain_name: str) -> Tuple[Dict[str, Any], str]: options = nmap_options.NmapOptions( dns_resolution=False, ports=self.args.get("ports"), + tcp_syn_ping_ports=self.args.get("tcp_syn_ping_ports"), top_ports=self.args.get("top_ports"), fast_mode=self.args.get("fast_mode", False), no_ping=self.args.get("no_ping", False), diff --git a/agent/nmap_options.py b/agent/nmap_options.py index 8f5798d..3a4c31b 100644 --- a/agent/nmap_options.py +++ b/agent/nmap_options.py @@ -44,8 +44,9 @@ class NmapOptions: dns_resolution: bool = True dns_servers: List[str] | None = None - ports: Optional[str] = None - top_ports: Optional[int] = None + ports: str | None = None + tcp_syn_ping_ports: str | None = None + top_ports: None | int = None fast_mode: bool = False timing_template: TimingTemplate = TimingTemplate.T3 script_default: bool = False @@ -76,11 +77,13 @@ def _set_version_detection_option(self) -> List[str]: command_options.append("-sV") return command_options - def _set_no_ping_options(self) -> List[str]: + def _set_host_discovery_options(self) -> List[str]: + options = [] if self.no_ping is True: - return ["-Pn"] - else: - return [] + options.append("-Pn") + if self.tcp_syn_ping_ports is not None: + options.append(f"-PS{self.tcp_syn_ping_ports}") + return options def _set_privileged(self) -> List[str]: if self.privileged is True: @@ -158,7 +161,7 @@ def command_options(self) -> List[str]: command_options.extend(self._set_ports_option()) command_options.extend(self._set_timing_option()) command_options.extend(self._set_port_scanning_techniques()) - command_options.extend(self._set_no_ping_options()) + command_options.extend(self._set_host_discovery_options()) command_options.extend(self._set_privileged()) command_options.extend(self._set_scripts()) command_options.extend(self._set_script_default()) diff --git a/ostorlab.yaml b/ostorlab.yaml index 288d01e..5068e3b 100644 --- a/ostorlab.yaml +++ b/ostorlab.yaml @@ -88,6 +88,10 @@ args: type: "string" description: "List of ports to scan." value: "0-65535" + - name: "tcp_syn_ping_ports" + type: "string" + description: "List of ports to use for host discovery (-PS). Accepts list of ports: 21,22... OR a range 0-100" + value: "21,22,25,53,68,80,110,123,143,443,465,631,993,995,3306,3389,8080" - name: "top_ports" type: "number" description: "Top ports to scan." diff --git a/tests/nmap_wrapper_test.py b/tests/nmap_wrapper_test.py index 5a74f3d..ad156b0 100644 --- a/tests/nmap_wrapper_test.py +++ b/tests/nmap_wrapper_test.py @@ -189,3 +189,43 @@ def testNmapWrapperParseOutput_whenXmlIsValid_returnsParsedXml() -> None: }, } } == parsed_output + + +def testNmapWrapper_whenTcpSynPingPortsIsUsed_returnCommand( + nmap_agent_fast_mode: agent.nmap_agent.NmapAgent, +) -> None: + args = nmap_agent_fast_mode.args + options = nmap_options.NmapOptions( + dns_resolution=False, + ports=args.get("ports"), + top_ports=args.get("top_ports"), + fast_mode=args.get("fast_mode", False), + no_ping=args.get("no_ping", False), + tcp_syn_ping_ports=args.get("tcp_syn_ping_ports"), + timing_template=nmap_options.TimingTemplate[args["timing_template"]], + scripts=args.get("scripts"), + script_default=args.get("script_default", False), + version_detection=args.get("version_info", False), + ) + client = nmap_wrapper.NmapWrapper(options) + + command = client.construct_command_host("127.0.0.1", 24) + + assert command == [ + "nmap", + "-O", + "-sV", + "-n", + "-F", + "-T3", + "-sS", + "-PS21,22,25,53,68,80,110,123,143,443,465,631,993,995,3306,3389,8080", + "--script", + "banner", + "-sC", + "-oX", + "/tmp/xmloutput", + "-oN", + "/tmp/normal", + "127.0.0.1/24", + ]