                         Preliminary Specification of
                      The Multifuctional Network Scanner 
                              Version 0.80beta

                                May 5, 1999
 

[ Contents ]

1. Introduction
2. Authors & Copyright
3. Usage & Features
4. Vulnerabilities mns scans for
5. Notes & Guidelines


1. [ Introduction ]

The purpose of this program was to exercise our programming ability and
create a powerful, configurable, fast, and portable network vulnerability
scanner.

We heard it compiled under:
   RedHat Linux 5.1, 5.2
   Slackware Linux 2.x, 3.x
   Linux 2.0.34 - 2.0.36 - 2.2.7
   NetBSD 1.3.3
   FreeBSD 3.1

If you get it to compile under another OS, email us and tell us your joyful
experience.  If you don't get it to compile, email us with the entire make
error output.  Jee, thanks!

2. [ Authors & Copyright ]

The Multifuctional Network Scanner
Copyright (C) bind & aempirei 1999

bind      -  bind@san.rr.com 
aempirei  -  chrisa@eeye.com  -  http://www.thegrid.net/gravitino/

MS-DOS and Microsoft Windows are trademarks of Microsoft Corporation.
All other product names mentioned herein are the trademarks of their
respective owners.


   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

3. [ Usage & Features ]

Running mns without arguments will show the following usage.

 usage: mns-i386-linux < <target> | <-F <file>> > [options...]
   <target>         single scan where target is an IP Addresse or hostname
   <-f <file>>      file containing a list of IP Addresses and hostnames
   [-qifcr]         enable vulnerability checks which consist of
                    the following vulnerability scanning options
                       -q  QPOP
                       -i  IMAP
                       -f  FTP
                       -c  CGI
                       -r  RPC
   [-C <children>]  set maximum child processes (2-200)
   [-V]             display version information
   [-R]             try to resolve IPs to hostnames
   [-A]             enable all vulerability checks

4. [ Vulns mns scans for ]

MNS Features:

Operating system detection via TCP/IP fingerprinting
Stealth Port Scanning via TCP/IP FIN method

QPOP/SCOPOP vulnerability checking: 
  QPOP v2.2
  QPOP v2.41beta1
  QPOP v2.4
  QPOP v2.3
  QPOP 2.1.4-R3
  SCOPOP 2.1.4-R3
  SCOPOP 5.0.0

IMAP vulnerability checking:
  IMAP4rev1 v10.223
  IMAP4rev1 v10.205
  IMAP4rev1 v10.203
  IMAP4rev1 v10.171
  IMAP4rev1 v10.183
  IMAP4rev1 v10.166
  IMAP4rev1 v10.233
  IMAP4rev1 v10.190
  IMAP4rev1 Service 9.0

CGI vulnerability checking: 
  phf
  Count.cgi
  test-cgi
  php.cgi
  handler
  webgais
  websendmail
  webdist.cgi
  faxsurvey
  htmlscript
  pfdisplay
  perl.exe
  wwwboard.pl
  www-sql
  aglimpse
  man.sh
  view-source
  campas
  nph-test-cgi

RPC vulnerability checking:
   rpc.mountd
   rpc.nlockmgr
   rpc.statd
   rpc.status
   rpc.nisd
   rpc.autofsd
   rpc.ttdb
   
WuFTPD and ProFTPD vulns:
   Wu-FTPD 2.4.2-academ[BETA-18]
   Wu-FTPD 2.4.2-academ[BETA-16]
   Wu-FTPD 2.4.2-academ[BETA-15]
   ProFTPD 1.2.0pre1

Coming Soon:
   Exported X Servers
   Exported Nfs Volumes
   Open Wingates
   NetBios / SMB Scanning

5. [ Notes & Guidelines ]

To compile osprint, a tcp fingerprint maker, type the following at the
command line in the highest-level mns directory.

   gcc -O2 osprint.c ipv4.c -o osprint

