Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updated regex for SSH scanning to include more matches #1012

Merged
merged 2 commits into from
Feb 17, 2025

Conversation

pUrGe12
Copy link
Contributor

@pUrGe12 pUrGe12 commented Feb 16, 2025

Proposed change

The current regex for SSH port matching is correct for matching banners from Ubuntu, Debian, FreeBSD SSH banners, however a lot of services have SSH banners that are like this

SSH-2.0-ad34f3baf

For example, running the following reveals the same for github.com,
nc -v github.com 22

Thus, to match these as well, I have updated the regex.

Type of change

  • New core framework functionality
  • Bugfix (non-breaking change which fixes an issue)
  • Code refactoring without any functionality changes
  • New or existing module/payload change
  • Localization improvement
  • Dependency upgrade
  • Documentation improvement

Checklist

  • I've followed the [contributing guidelines][contributing-guidelines]
  • I've run make pre-commit, it didn't generate any changes
  • I've run make test, all tests passed locally

Additional info

Future work includes creating NULL probes to capture banners of services that reveal it without any explicit probing (like SSH, FTP) along with the arbitrary probe that is currently defined.

@securestep9
Copy link
Collaborator

Thank you for your contribution @pUrGe12 !

@securestep9 securestep9 added this pull request to the merge queue Feb 17, 2025
Merged via the queue into OWASP:master with commit d143f43 Feb 17, 2025
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants