| Current Path : /usr/local/share/nmap/scripts/ |
FreeBSD hs32.drive.ne.jp 9.1-RELEASE FreeBSD 9.1-RELEASE #1: Wed Jan 14 12:18:08 JST 2015 root@hs32.drive.ne.jp:/sys/amd64/compile/hs32 amd64 |
| Current File : //usr/local/share/nmap/scripts/ircZombieTest.nse |
--- Checks if the target is an IRC zombie.
id = "IRC zombie"
description = "If port 113 responds before we ask it then something is fishy.\
Usually this means that the host is an irc zombie."
author = "Diman Todorov <diman.todorov@gmail.com>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"malware"}
require "comm"
require "shortport"
portrule = shortport.port_or_service(113, "auth")
action = function(host, port)
local status, owner = comm.get_banner(host, port, {lines=1})
if not status then
return
end
return owner
end