I have an nmap script that run tests for open-relays on a list of IPs. Initially I had to return only the hostname and the IP of a host if it was found that it has an open port from the specified ports in the command, but this seems to be not accurate because an open port doesn't mean the NSE tests are successful. so, I want to return the hostname and IP + the NSE result in one row.
The command I used is:
nmap --script smtp-open-relay.nse --open -p 25,2525,587,465,2526 -iL ./short_servers_list.txt
The example output from this command is:
*Starting Nmap 6.40 ( http://nmap.org ) at 2017-08-08 07:25 PDT
Nmap scan report for foo01.bar.com (10.10.10.1)
Host is up (0.0020s latency).
Not shown: 3 closed ports
PORT STATE SERVICE
25/tcp open smtp
|_smtp-open-relay: Server is an open relay (5/16 tests)
2526/tcp open unknown
Nmap scan report for foo02.bar.com (10.10.10.2)
Host is up (0.082s latency).
Not shown: 4 closed ports
PORT STATE SERVICE
25/tcp open smtp
|_smtp-open-relay: SMTP EHLO nmap.scanme.org: failed to receive data: connection closed
Nmap done: 10 IP addresses (6 hosts up) scanned in 2.16 seconds*
I need to output the following:
foo01.bar.com (10.10.10.1) smtp-open-relay: Server is an open relay (5/16 tests)
foo02.bar.com (10.10.10.2) smtp-open-relay: SMTP EHLO nmap.scanme.org: failed to receive
how can I do that using common bash tools/commands (grep or sed etc.)?
nmap
has-oG
for "greppable" output or-oX
for XML output, if you need something more easily processable by script