Carlton Foster <[EMAIL PROTECTED]> writes:
> How can I scan our entire address space without causing all of the
> network attached printers to spew paper?
Can you try this plugin and tell us if it works?
Note: this version cannot work with the standalone NASL
interpreter. It has to be run by Nessusd
If it does not work properly, please provide more information on the
target system (especially open ports)
# This script was written by Michel Arboi <[EMAIL PROTECTED]>
#
# Released under GPLv2
#
if(description)
{
script_id(11933);
script_version ("$Revision$");
name["english"] = "Exclude AppSocket & socketAPI printers";
script_name(english:name["english"]);
desc["english"] = "
The host seems to be an AppSocket or socketAPI printer.
Scanning it is useless and will waste paper.
You might also crash the IP stack, forcing you to reset the device.
Risk factor : None";
script_description(english:desc["english"]);
summary["english"] = "Exclude AppSocket & socketAPI printers from scan";
script_summary(english:summary["english"]);
script_category(ACT_SETTINGS);
# script_add_preference(name:"Exclude printers from scan", type:"checkbox",
value:"no");
script_copyright(english:"This script is Copyright (C) 2003 by Michel Arboi");
family["english"] = "Settings"; # Or maybe a "scan option" family?
script_family(english:family["english"]);
exit(0);
}
# pref= script_get_preference("Exclude printers from scan");
# if (!pref || pref == "no") exit(0);
if (! safe_checks()) exit(0);
# First try UDP AppSocket
port = 9101;
if (get_udp_port_state(port))
{
soc = open_sock_udp(port);
send(socket: soc, data: '\r\n');
r = recv(socket: soc, length: 512);
if (r)
{
set_kb_item(name: "Host/dead", value: TRUE);
security_note(port: 0);
exit(0);
}
}
# open ports?
ports = get_kb_list("Ports/tcp/*");
# Host is dead, or all ports closed, or unscanned => cannot decide
if (isnull(ports)) exit(0);
# Ever seen a printer with more than 4 open ports?
if (max_index(ports) > 4) exit(0);
# Test if open ports are seen on a printer
# http://www.lprng.com/LPRng-HOWTO-Multipart/x4981.htm
appsocket = 0;
foreach p (ports)
{
p = int(p - "Ports/tcp/");
if ( p == 35 # AppSocket for QMS
|| p == 2000 # Xerox
|| p == 2501 # AppSocket for Xerox
|| (p >= 3001 && p <= 3005) # Lantronix - several ports
|| (p >= 9100 && p <= 9105) # AppSocket - several ports
|| p == 10001) # Xerox - programmable :-(
appsocket = 1;
# Look for common administration or printing port
else if (
p != 21 # FTP
&& p != 23 # telnet
&& p != 80 # www
&& p != 139 && p!= 445 # SMB
&& p != 515 # lpd
&& p != 631 ) # IPP
# Unknown port => not a printer
# We could be more precise and test for "forbidden port".
# Even seen a printer with SSH, SMTP, DNS, finger...?
exit(0);
}
# OK, this might well be an AppSocket printer
if (appsocket)
{
set_kb_item(name: "Host/dead", value: TRUE);
security_note(port: 0);
}
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
