fix: Statically generated payloads (nmap-payloads) for UDP scanning #746
+106
−75
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes the parsing of the
nmap-payloadsfor UDP scanning.Currently the HEX-Bytes are not interpreted correctly with the rust
build.rsparser.This issue can be easily verified when comparing the original
nmap-payloads(e.g. https://github.com/RustScan/RustScan/blob/master/nmap-payloads#L43) with the generated rust equivalent (e.g. https://github.com/RustScan/RustScan/blob/master/src/generated.rs#L13).If we convert the rust vec! back to HEX values, we can see that they don't match. This PR fixes this issue.
As a result of this issue rustscan does send incorrect payloads to the services running on the specified port, which causes the service to not answer such an invalid request. Therefor rustscan does not find some open UDP ports.
Note
I also noticed, that currently only the last entry for a given port form the
nmap-payloadsis used, if there are multiple available payloads for a port.The previous payload is overwritten (here: https://github.com/RustScan/RustScan/blob/master/build.rs#L228), so only the last payload for a port is included in
generated.rs.Maybe I will look into this in the future ...
For now I have just moved the SNMPv3GetRequest down (so that it is used first), as it had better results for findig open SNMP (161/UDP) ports.