Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove masking of s7 protocols errors #322

Merged
merged 1 commit into from
Jul 30, 2021
Merged

remove masking of s7 protocols errors #322

merged 1 commit into from
Jul 30, 2021

Conversation

hmcguinn
Copy link
Contributor

This MR removes the masking of errors for the siemens s7 protocol scanner.

The current behaviour:

➜  zgrab2 git:(hmcguinn/s7-misidentification) ✗ echo $IP | ./zgrab2 siemens                   
INFO[0000] started grab at 2021-07-20T20:58:16-04:00    
{"ip":"$IP","data":{"siemens":{"status":"success","protocol":"siemens","result":{"is_s7":true},"timestamp":"2021-07-20T20:58:16-04:00"}}}
INFO[0001] finished grab at 2021-07-20T20:58:18-04:00   
{"statuses":{"siemens":{"successes":1,"failures":0}},"start":"2021-07-20T20:58:16-04:00","end":"2021-07-20T20:58:18-04:00","duration":"1.552316484s"}

The scan is marked as a success when no information is returned.

The updated behaviour:

➜  zgrab2 git:(hmcguinn/s7-misidentification) ✗ echo $IP | ./zgrab2 siemens         
INFO[0000] started grab at 2021-07-20T20:44:09-04:00    
{"ip":"$IP","data":{"siemens":{"status":"unknown-error","protocol":"siemens","result":{"is_s7":true},"timestamp":"2021-07-20T20:44:09-04:00","error":"not a S7 packet"}}}

How to Test

echo $IP | ./zgrab2 siemens

Notes & Caveats

The S7 protocol scanner currently masks errors and will silently fail if a host responds with a ISO 8327-1 "Abort" packet. The scan will be incorrectly marked as a false positive.

@codyprime codyprime merged commit a70b933 into zmap:master Jul 30, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants