Fails to parse nmap data of osclass tag

[chencoyote]

Hi :
When the nmap scan OS, my output is follow:

<os>
    <osmatch name="Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, or Windows 8" accuracy="100" line="53077">
      <osclass type="general purpose" vendor="Microsoft" osfamily="Windows" osgen="7" accuracy="100">
          <cpe>cpe:/o:microsoft:windows_7::-</cpe> 
          <cpe>cpe:/o:microsoft:windows_7::sp1</cpe> 
      </osclass>
    </osmatch>
</os>

the <osclass> is under <osmatch> but i see the parser.py like this:

504         for xos in xelement:
505             if xos.tag == 'osclass':
506                 os_class_proba = cls.__format_attributes(xos)
507                 os_class_probability.append(os_class_proba)
508             elif xos.tag == 'osmatch':
509                 os_match_proba = cls.__format_attributes(xos)
510                 os_match_probability.append(os_match_proba)
511             elif xos.tag == 'portused':
512                 os_portused = cls.__format_attributes(xos)
513                 os_ports_used.append(os_portused)
514             elif xos.tag == 'osfingerprint':
515                 os_fp = cls.__format_attributes(xos)

I think you handle <osclass> and <osmatch> in a same level.
So the NmapHost.os_class_probabilities() has no result
My nmap version is:

linux-b8h2:~ # nmap
Nmap 6.40 ( http://nmap.org )

I'm not sure whether the nmap version problem

Thinks 😄

[savon-noir]

yep. this changed in nmapv6. in nmapv5 it is on the same "level". There is already a bug filed for this. I'll try to fix it this week along with issue #25 both should be quickly fixed.

Thanks for bug reporting.

[savon-noir]

this is the explanation from the nmap-dev mailing list. I will base the fix on this input from nmap's devs http://seclists.org/nmap-dev/2012/q2/252

I will probably do the nesting by accuracy matching when osclass is not nested and still have untied osclass array internally.

[savon-noir]

approach for solving this out

create an osmatch class which will contain:

• list of osclass dict
• cpe data (optional). cpe shall be implemented in a class which needs to be also supported in tag
• osclass will be matched against osmatch based on accuracy
• unmatched osclass dict will be embedded in a osmatch object:
  • with OsMatch.line attribute =-1
  • with as name a concat of osclass mandatory attributes (vendor and osfamily)
• fingerprint shall be made of a list: API needs to be adapted a bit

this approach will also close issue #11

[savon-noir]

fixed in commit 01096b4