full-disclosure - Looking for linux code of a rpc dcom Scanner

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <873cf1x7w4.fsf@deneb.enyo.de>
From: fw at deneb.enyo.de (Florian Weimer)
Subject: Looking for linux code of a rpc dcom Scanner

"Carl Belanger" <carl.belanger@...e-hosting.net> writes:

> http://www.k-otik.com/exploits/09.11.dcom2_scanner.c.php

This scanner classifies many hosts as "wierd", which is a bit
unfortunate.  The recent NASL script seems to be better in this
regard.

I've ported the NASL script to the doscan framework:

  <http://www.enyo.de/fw/software/doscan/>

(Be sure to read the manpage, it explains how to achieve a decent
scanning rate.)

However, this doscan module reports a suspiciously high number of
patched hosts for my test network, and I'm not sure if this is a
result of the admins' care or a defect in the module. 8-/