irczombietest.nse

Overview是Linux,FreeBSD,UNIX,Windows下的网络扫描和嗅探工 具包,其基本功能有三个,一是探测一组主机是否在线 其次是扫描 主机端口,嗅探所提供的网络服务 还可以推断主机

id = "IRC zombie"

description = "If port 113 responds before we ask it then something is fishy.\
Usually this means that the host is an irc zombie."

author = "Diman Todorov <[e-mail]>"

license = "See nmaps COPYING for licence"

categories = {"malware"}

require "shortport"

portrule = shortport.port_or_service(113, "auth")

action = function(host, port)
	local status = 0
	local owner = ""

	local client_ident = nmap.new_socket()

	client_ident:connect(host.ip, port.number)

	status, owner = client_ident:receive_lines(1)

	client_ident:close()

	if owner == "TIMEOUT" then
		return
	end

	return owner
end