pkgsrc-Users archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[pkgsrc] nmap update now conficker detection is available ?
Is there any chance of an update to the version of nmap in pkgsrc now that
Conficker/downanup detection is (apparently) available ?
---8<-----
From: Fyodor <fyodor_at_insecure.org>
Date: Mon, 30 Mar 2009 13:03:19 -0700
Hi All! We found out just yesterday about new research by Tillmann
Werner and Felix Leder of a way to anonymously scan for Conficker worm
infections! Ron sprang into action and added the detection to the
smb-check-vulns NSE script! I even had to infect one of my own
systems for Ron to test with. David and Brandon helped too. And now
we're happy to release Nmap 4.85BETA5, which includes the Conficker
detection!
You can find it on the download page:
http://nmap.org/download.html
Here is an example command for detecting Conficker:
nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1
[targetnetworks]
It is worth scanning soon, since Conficker nodes are set to be updated
with new instructions on Wednesday if they aren't cleaned by then!
Note that I've removed 4.76 from the D/L page as I think 4.85BETA5 is
the way to go in general.
Test this out soon, if you can, and send your results to nmap-dev, as
this release is sure to get a lot of attention and interest :).
Here are the changes since 4.85BETA4 a couple weeks ago:
o Ron (in just a few hours of furious coding) added remote detection
of the Conficker worm to smb-check-vulns. It is based on new
research by Tillmann Werner and Felix Leder. You can scan your
network for Conficker with a command like: nmap -PN -T4 -p139,445 -n
-v --script=smb-check-vulns --script-args safe=1 [targetnetworks]
[...]
Thanks,
/DHS
Home |
Main Index |
Thread Index |
Old Index