1

I'd like to print all ips (IP space Port) which have open https ports given a gnmap file.

An example output for a line that has only https running on port 443:

123.123.123.123 443

A more elaborate example input and desired output (not all test-cases in there):

Host: 123.123.123.123 ()  Ports: 80/open/tcp//http?///, 443/open/tcp//https?///, 8083/closed/tcp//us-srv///, 65001/closed/tcp/////        Ignored State: filtered (65531) Seq Index: 262  IP ID Seq: Randomized
Host: 123.123.123.124 ()  Ports: 80/open/tcp//http?///, 443/open/tcp//https?///, 10443/open/tcp//https///, 65001/closed/tcp/////        Ignored State: filtered (65531) Seq Index: 262  IP ID Seq: Randomized
Host: 123.123.123.125 ()  Ports: 80/open/tcp//http?///, 443/open/tcp//https?///, 8083/closed/tcp//us-srv///, 8445/open/tcp//https///, 65001/closed/tcp/////        Ignored State: filtered (65531) Seq Index: 262  IP ID Seq: Randomized
Host: 123.123.123.126 ()  Ports: 1337/open/tcp//https?///, 8083/closed/tcp//us-srv///, 65001/closed/tcp/////        Ignored State: filtered (65531) Seq Index: 262  IP ID Seq: Randomized

The output for this file should be:

123.123.123.123 443
123.123.123.124 443
123.123.123.124 10443
123.123.123.125 443
123.123.123.125 8445
123.123.123.126 1337

What would be the awk solution for this?

  • By "it needs to have two open ports where the second is the https port" do you mean that if ports 80, 123, and 443 were open, you do not want to see that line, because the third port, not the second port, is 443? – Mark Plotnick Jan 20 '14 at 13:32
  • No the solution I've tried needs that to work, but I'd rather have it find out all https ports and print "ip port". – user857990 Jan 20 '14 at 14:06
3

If I got the “more or less open ports below 443” case correctly, this should be a generic solution handling it correctly:

awk '/\/https\// {for(i=5;i<=NF;i++)if($i~"/open/.+/https/"){sub("/.*","",$i); print $2" "$i}}' nmap-synscan.gnmap
  • if "there are more or less open ports below 443", your solution will failed. – cuonglm Jan 20 '14 at 12:56
  • Yes. I intended to ask clarification for that case. No idea how the input and output would look in that case. – manatwork Jan 20 '14 at 13:00
  • The question was poorly formulated, it's re-formulated. My bad – user857990 Jan 20 '14 at 16:18
  • If by “only https” you mean strictly just “https”, excluding “https?”, then this edit does it. However in this case none of them is “running on port 443” in your example. – manatwork Jan 20 '14 at 17:33
  • The answer has been accepted, but I don't see the rules to find open ports. So the command should be updated to (if part): if($i~"/https/"&&$i~"/open/") – BMW Jan 22 '14 at 1:55
0

This is better suited to parsing by regular expressions than by fields. Why not use Perl?

$ perl -lne '/Host:\s*([\d\.]+)/; $h=$1; 
            print "$h $_" for (/(\d+)\/open[^\s]+https/g);
           ' file 
123.123.123.123 443
123.123.123.123 10443
123.123.123.123 443
123.123.123.123 8443
123.123.123.123 443
123.123.123.123 443

The first line just captures the host IP and saves it as $h. The second line, matches all numbers that are followed by /open then one or more non-whitespace characters and then https. That should match all open https ports. The print statement will print the host name ($h) and each of the matched ports (saved as the special variable $_).

  • Unnecessarily complicated – MariusMatutiae Jan 20 '14 at 17:38
  • @MariusMatutiae revenge voting huh :) ? At least it returns what the OP asked for and is the shortest answer on the page so I don't see how it is complicated. – terdon Jan 20 '14 at 17:41
  • No, not revenge voting: the OP asks for an awk solution, yours falls clearly outside the OP – MariusMatutiae Jan 20 '14 at 18:08
  • @MariusMatutiae fair enough. In general though, answers providing different approaches are encouraged here (not asking you ti change your vote, not really bothered, just so you know for other As). – terdon Jan 20 '14 at 18:11
0

awk's split function can be used to extract fields from the gnmap output.

split("443/open/tcp//https?///, a, "/"); print a[1] gives you 443.

Use this to print the ip and port for the lines that show at least one open https port:

awk '{ for (f=5; f <= NF; f++) {
         split($f,a,"/");
         if (a[2] != "open") continue;
         if (a[5] ~ /https.*/) {
           print $2, a[1];
         }
       }
      }' nmap-synscan.gnmap

Use this to print the ip and port for the lines that show an open https port and at least one open port below https:

awk '{ lowopen = 0;
       for (f=5; f <= NF; f++) {
         split($f,a,"/");
         if (a[2] != "open") continue;
         if (a[1] < 443) lowopen++;
         if (lowopen && a[5] ~ /https.*/) {
           print $2, a[1];
         }
       }
      }' nmap-synscan.gnmap

Edit: to answer your second question, use this to print the ip and port for lines where exactly the second open port is https:

awk '{ split($6,a,"/");
       if (a[5] ~ /https.*/) {
         print $2, a[1];
       }
      }' nmap-synscan.gnmap
0

You can give nmap(1) a set of ports to check directly, i.e., in this case just add -PS80,443.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.