Recent changes to bugs

NMapProperties.getFullyFormattedCommand() not using sudoUser and sudoUserPassword properties

Justin Cranford — Fri, 02 Oct 2015 17:46:45 -0000

I integrated Nmap4j into my application for nmap TCP SYN scanning. I tested on Windows and it works. When I test on Linux it fails because my application is running as non-root user.

https://nmap.org/book/man-port-scanning-techniques.html

Almost all scan types for nmap require root privileges, so nmap4j should ideally support sudo. In NMapProperties.java, I see variables sudoUser and sudoUserPassword are present. However, they are private with no way to set them.

Ideally Nmap4j() constructor is overloaded to accept optional sudo user, or optional sudo user and password. The values would be passed through to NMapProperties.java, and NMapProperties.getFullyFormattedCommand() would construct the command using sudo user, or sudo user and password, as appropriate.

For me, the password is optional. I can add an entry to /etc/sudoers for my user to be able to run the nmap command without password. However, I am sure others would appreciate the option to specify the username and password. The end goal is the same, to have Nmap4J support privilege escalation required by nmap.

Nmap4j.getResult() is not thread safe

Justin Cranford — Thu, 02 Apr 2015 19:48:07 -0000

Nmap4j.getResult() is not thread safe. Add synchronized keyword to Nmap4j.getResult(), or fix thread safety inside OnePassParser and NMapXmlHandler.

Script output is not handled

Jon Svede — Wed, 31 Oct 2012 05:18:26 -0000

If users want to run scripts via NSE there is no way to return or retrieve the output in Nmap4j.

CPE element from XML is not handled

Jon Svede — Wed, 31 Oct 2012 05:17:36 -0000

Common Platform Enumeration (CPE) is colon delimited string that is optionally provided by Nmap on either the service tag or the osclass that contains variable information about the target that is useful. It is documented here:

http://nmap.org/book/output-formats-cpe.html

Nmap4j needs to include this information.

Addresses are not enumerated

Jon Svede — Wed, 31 Oct 2012 03:53:20 -0000

When I scan a host on which both MAC address and IP address present, only one is present in the Nmap4j.

ArgumentProperties.rdeplaceFlag() doesn't work as expected

Jon Svede — Thu, 09 Jun 2011 03:22:37 -0000

The ArgumentProperties.replaceFlag() has an unexpected issue. If a user wants to override the -oX option (which defaults '-' for std out) the rest of the code still assumes it is getting the XML from processes output stream but instead it needs to get it from the file.