Nmap-Banners

Description

This project is based on adding the ability for Nmap to display banner information for the services which responded to network connections. The two types of output which this functionality was added to are the standard output and XML.

Nmap-Banners(nmap-4.10 patch)

Applying the Patch
wget http://insecure.org/nmap/dist/nmap-4.10.tgz
tar zxvf nmap-4.10.tgz
patch -p0 < nmap-banner-4.10.patch
cd nmap-4.10
./configure --without-nmapfe
make
mv nmap nmap-banners
./nmap-banners
Examples
Standard Output grepping for the Banners

$ ./nmap-banners -sV -vvvvv localhost |grep Banners

The outputs is:

Banner on 127.0.0.1:22/tcp matches ssh: SSH-2.0-OpenSSH_4.3p2 Debian-5ubuntu1.
Banner on 127.0.0.1:25/tcp matches smtp: 220 localhost ESMTP Exim 4.62 Wed, 14 Nov 2007 21:06:10 -0500..
Banner on 127.0.0.1:902/tcp matches vmware-auth: 220 VMware Authentication Daemon Version 1.10: SSL Required, MKSDisplayProtocol:VNC ..

Output to XML file 

$ ./nmap-banners -sV -v -oX nmap-banners.xml localhost

The relevent aspect of the XML is:

<port protocol="tcp" portid="22">
    <state state="open" />
    <service name="ssh" product="OpenSSH" version="4.3p2 Debian-5ubuntu1" extrainfo="protocol 2.0" banner="SSH-2.0-OpenSSH_4.3p2
Debian-5ubuntu1." method="probed" conf="10" /> </port> <port protocol="tcp" portid="25"> <state state="open" /> <service name="smtp" product="Exim smtpd" version="4.62" hostname="localhost" banner="220 localhost ESMTP Exim 4.62
Wed, 14 Nov 2007 21:14:43 -0500.." method="probed" conf="10" /> </port> <port protocol="tcp" portid="902"> <state state="open" /> <service name="vmware-auth" product="VMware GSX Authentication Daemon" version="1.10" banner="220 VMware Authentication
Daemon Version 1.10: SSL Required, MKSDisplayProtocol:VNC .." tunnel="ssl" method="probed" conf="10" /> </port>
License
GPL v2. This project is a derivative of Nmap

Author
jabra@spl0it.org