官术网_书友最值得收藏!

Comparing scan results with Ndiff

Ndiff was designed to address the issues of using diff with two XML scan results. It compares files by removing false positives and producing a more readable output, which is perfect for anyone who needs to keep a track of the scan results.

This recipe describes how to compare two Nmap scans to detect the changes in a host.

Getting ready

Ndiff requires two Nmap XML files to work, so make sure you have previously saved the scan results of the same host. If you haven't, you can always scan your own network, deactivate a service, and scan again to get these two test files. To save the results of an Nmap scan into an XML file use -oX <filename>.

How to do it...

  1. Open your terminal.
  2. Enter the following command:
    $ ndiff FILE1 FILE2
    
  3. The output returns all the differences between FILE1 and FILE2. New lines are shown after a plus sign. The lines that were removed on FILE2 are displayed after a negative sign.
    How to do it...

How it works...

Ndiff uses the first file as a base to compare against the second one. It displays the state differences for host, port, services, and OS detection.

There's more...

If you prefer Zenmap, you can use the following steps instead:

  1. Launch Zenmap.
  2. Click on Tools on the main toolbar.
  3. Click on Compare Results (Ctrl + D).
  4. Select the first file by clicking on Open in the section named A scan.
  5. Select the second file by clicking on Open in the section named B scan.
    There's more...

Output format

A human readable format is returned by default. However, Ndiff can return the differences in XML format, if preferred, by using the flag --xml.

Verbose mode

Verbose mode includes all of the information including hosts and ports that haven't changed. To use it, enter the following commands:

$ ndiff -v FILE1 FILE2
$ ndiff –verbose FILE1 FILE2 

See also

  • The Monitoring servers remotely with Nmap and Ndiff recipe
  • The Managing multiple scanning profiles with Zenmap recipe
  • The Geo-locating an IP address recipe in Chapter 3, Gathering Additional Host Information
  • The Getting information from WHOIS records recipe in Chapter 3, Gathering Additional Host Information
  • The Fingerprinting the operative system of a host recipe in Chapter 3, Gathering Additional Host Information
  • The Discovering UDP services recipe in Chapter 3, Gathering Additional Host Information
  • The Detecting possible XST vulnerabilities recipe in Chapter 4, Auditing Web Servers
主站蜘蛛池模板: 西青区| 石狮市| 河源市| 淮阳县| 益阳市| 北宁市| 肃宁县| 乌拉特中旗| 阳原县| 科技| 贡觉县| 璧山县| 吉首市| 万载县| 三江| 榆中县| 大姚县| 霍山县| 屏边| 马尔康县| 巩留县| 广水市| 手机| 广德县| 谢通门县| 西华县| 牟定县| 涿州市| 杭锦旗| 汉寿县| 新龙县| 囊谦县| 濉溪县| 鲁山县| 颍上县| 朝阳区| 永宁县| 苗栗县| 临夏市| 南皮县| 冕宁县|