Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add OPC UA TCP service detection #2791

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+22 −2
Open

Add OPC UA TCP service detection #2791

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5b518af
Add OPC UA TCP probe and match
ValtteriL Mar 2, 2024
af3691b
Merge with #2730
ValtteriL Apr 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
20 changes: 20 additions & 0 deletions nmap-service-probes
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14938,6 +14938,26 @@ match distccd m|^DONE00000001.*ccache: failed to create /usr/share/distcc/\.ccac
match distccd m|^DONE00000001.*CRITICAL! distcc seems to have invoked itself recursively!\n|s p/distccd/ i/broken/
match distccd m|^[\w._-]+DONE[\w._-]+ .*ERROR: attempt to use unknown compiler aborted: ([\w._-]+)\n|s p/distccd/ i/broken: compiler $1 doesn't exist/

##############################NEXT PROBE##############################
Probe TCP OPCUA q|HELF\x2e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x00\x40\x00\x80\x00\x00\x0e\x00\x00\x00opc.tcp://nmap|
rarity 6
ports 49320,62541,4897,53530,48050,4885,4840,4855,26543
sslports 4843
match opcua m|^ACKF\x1c\x00\x00\x00\x00\x00\x00\x00|s p/OPC UA Binary Connection Protocol/
match opcua m|^ERRF..\x00\x00(....)..\x00\x00([ -~]*)|s p/OPC UA Binary Connection Protocol/ i/Error $I(1, "<") $2/

##############################NEXT PROBE##############################
Probe UDP KNX q|\x06\x10\x02\x03\x00\x0e\x08\x01\x00\x00\x00\x00\x00\x00|
rarity 7
ports 3671
match knxip m|^\x06\x10\x02\x04..\x36\x01\x02.....................([ -~]*)|s d/KNXnet-IP GW/ p/$1/

##############################NEXT PROBE##############################
Probe TCP KNX q|\x06\x10\x02\x03\x00\x0e\x08\x02\x00\x00\x00\x00\x00\x00|
rarity 7
ports 3671
match knxip m|^\x06\x10\x02\x04..\x36\x01\x02.....................([ -~]*)|s d/KNXnet-IP GW/ p/$1/

##############################NEXT PROBE##############################
# Java Remote Method Invocation, version 2, stream protocol
# https://docs.oracle.com/javase/9/docs/specs/rmi/protocol.html
Expand Down
4 changes: 2 additions & 2 deletions nmap-services
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7140,8 +7140,8 @@ casanswmgmt 3669/tcp 0.000076 # CA SAN Switch Management
casanswmgmt 3669/udp 0.000330 # CA SAN Switch Management
smile 3670/tcp 0.000076 # SMILE TCP/UDP Interface
smile 3670/udp 0.000330 # SMILE TCP/UDP Interface
efcp 3671/tcp 0.000000 # e Field Control (EIBnet)
efcp 3671/udp 0.000330 # e Field Control (EIBnet)
knxip 3671/tcp 0.000000 # KNXnet/IP(EIBnet/IP)
knxip 3671/udp 0.000330 # KNXnet/IP(EIBnet/IP)
lispworks-orb 3672/tcp 0.000076 # LispWorks ORB
lispworks-orb 3672/udp 0.000330 # LispWorks ORB
mediavault-gui 3673/tcp 0.000000 # Openview Media Vault GUI
Expand Down