zgrab2/zgrab2_schemas
Elliot Cubit 17a5257565
Add NativeOS, NTLM, and GroupName to SMBv1 results (#286)
* add smbv1 session setup scan

* remove unused values

* rename os_name to native_os to match smb documentation

* remove superfluous comment

* update zschema to include new SMB fields

* improve clarity on bounds checking for SMBv1 requests
2021-03-15 09:23:55 -04:00
..
zgrab2 Add NativeOS, NTLM, and GroupName to SMBv1 results (#286) 2021-03-15 09:23:55 -04:00
README.md schemas.zgrab2 -> zgrab2_schemas 2018-05-04 11:15:09 -04:00
__init__.py schemas.zgrab2 -> zgrab2_schemas 2018-05-04 11:15:09 -04:00

ZGrab 2.0 schemas for zschema

Validating

integration_tests.sh automatically validates output from the integration tests; to manually validate a zgrab2 result, you can follow these steps:

  1. Get zschema (e.g. git clone https://github.com/zmap/zschema)
  2. Run the zschema validator:
    1. Run the zschema module's main function
    2. Pass it the validate command
    3. Give the path to the zgrab2 schema schemas/__init__.py:zgrab2
    4. Pass in the zgrab2 JSON file to validate
    • echo 127.0.0.1 | ./cmd/zgrab2/zgrab2 mysql > output.json
      PYTHONPATH=/path/to/zschema python -m zschema validate schemas/__init__.py:zgrab2 output.json
      

Adding new module schemas

There are two steps to adding a new zgrab2 module schema:

  1. Add the module a. Register the response type with the zgrab2 schema
  2. Register the module in __init__.py

Add the module

Create your python file; if your protocol identifier (the default name in the result table) is my_protocol, name the file my_protocol.py (this allows a static schema validation from protocol_name to protocol_schema; unfortunately, this means that multiple scans on a single host, or scans using custom identifiers, will not validate).

Your module should include a SubRecord that extends from zgrab2.base_scan_response, specifically, overridding the result field. See schemas/mysql.py for an example.

Register the module

In schemas/__init__.py, add an import for your module (e.g. import my_protocol). This will ensure that the module code is executed and that the response type is registered with the zgrab2 module.