Skip to content

Ars 1485 wing ftp is detected as forti ssh#569

Open
Pepitoh wants to merge 3 commits intodevelopfrom
ARS-1485-WingFTP-is-detected-as-FortiSSH
Open

Ars 1485 wing ftp is detected as forti ssh#569
Pepitoh wants to merge 3 commits intodevelopfrom
ARS-1485-WingFTP-is-detected-as-FortiSSH

Conversation

@Pepitoh
Copy link
Copy Markdown
Contributor

@Pepitoh Pepitoh commented Mar 5, 2026

To fixe this issue, we need to change the default file used by nmap in /usr/share/nmap in the engine.
Regarding the nmap documentation. https://nmap.org/man/fr/man-misc-options.html >

A --datadir option could be set on each scan to specify a new directory where to find "template" file used by nmap to determine which kind of service is running on which ports nmap-service-probes, nmap-services, nmap-protocols, nmap-rpc, nmap-mac-prefixes et nmap-os-fingerprint(note that the documentation is not updated and the last file is nmap-os-dband not nmap-os-fingerprint.

But, this option would required to be set on all scan policies, and, most of all, if a problem exists on the specific "datadir" set, nmap will then search in the default directory, this could create some confusion as old fixed template could then be used in specific cases and will make debug much more harder (we will never know which template nmap is actualy using).

Then, I decide to create all nmap-* templates file in the nmap-files directory, and COPY theses files directly in /usr/share/nmap default folder. This allows us to be sure our template are used, and also avoid us to have unwanted nmap changes on a specific release, as we are managing directly the template used by nmap.

For this PR, i've just add a regex at the begning engines/nmap/nmap-files/nmap-service-probes allowing to fix false positive, and keep default nmap files which are working well for the time being.

In the future, we can add/modify specific regex directly in theses files, to be then used globally by Nmap.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant