NAME¶

ScanPBNJ - a program for running Nmap scans and storing the results in
a PBNJ 2.0 database.

SYNOPSIS¶

scanpbnj [Options] {target specification}

DESCRIPTION¶

ScanPBNJ performs an Nmap scan and then stores the results in
a database. The ScanPBNJ stores information about the machine that has
been scanned. ScanPBNJ stores the IP Address, Operating System,
Hostname and a localhost bit. The localhost bit, is simply a single
bit which is 1 when the target machine is localhost, otherwise it is
0. It also stores two timestamps for the machine table. The first is
a human readable version and the second is the unix time. Both of
these timestamp correspond to the first time that the machine was
scanned.

ScanPBNJ stores information about the services that are found to be
running on the target machine. ScanPBNJ stores typical information
about the service, by storing the port and protocol. Also, ScanPBNJ
stores version, product and service state information about each
service. The service state can either be up or down. Two timestamps
are also inserted for each instance of every service. The first is a
human readable version and the second is the unix time. Both of
these timestamp correspond to the time that the service was scanned.

This tool can give an admin a clear network layout with of
all the machines with all the services they are running.

Apart of PBNJ 2.0 suite of tools to monitor changes on a network.

OPTIONS¶

Usage: scanpbnj [Options] {target specification}

Target Specification:
Can be a IP Address, hostname, network etc.
Ex: microsoft.com, 10.0.0.0/24, 192.168.1.1, 10.0.0.0-100
-i --iplist <iplist> Scan using a list of IPs from a file
-x --xml <xml-file> Parse scan/info from Nmap XML file

Scan Options:
-a --args <args> Execute Nmap with args (needs quotes)
-e --extraargs <args> Add args to the default args (needs quotes)
--inter <interface> Perform scan with non default interface
-m --moreports <ports> Add ports to scan ex: 8080 or 3306,5900-5910
-n --nmap <path> Path to Nmap executable
-p --pingscan Ping Target then scan the alive host(s)
--udp Add UDP to the scan arguments
--rpc Add RPC to the scan arguments
-r --range <range> Ports for scan [def 1-1025]

--diffbanner Parse changes of the banner

Config Options:
-d --dbconfig <config> Config for results database [def config.yaml]
--configdir <dir> Directory for the database config file

--data <file> SQLite Database override [def data.dbl]
--dir <dir> Directory for SQLite or CSV files [def .]

General Options:
--nocolors Don't Print Colors
--test <level> Testing information
--debug <level> Debug information
-v --version Display version
-h --help Display this information

Send Comments to Joshua D. Abraham ( jabra@ccs.neu.edu )

THINGS TO NOTE¶

* ScanPBNJ requires root privileges to perform a scan.

* If you do not pass a specific ports range, 1-1025 is used.

* If there are configs in the current directory, they are used
instead of those in the user's config directory.

* ScanPBNJ does not modify previous database entries. It simply
inserts new information when a change is found.

* One thing that should be done when performing scans is to make
sure to use the same ports or you will get false positives.

EXAMPLE SINGLE SCAN¶

1) Scan a class B network on ports 1-9000

sudo ./scanpbnj -r 1-9000 10.0.0.0/16

2) Scan an IP Address on ports 1-9000

sudo ./scanpbnj -r 1-9000 10.0.0.100

EXAMPLE AUTOMATED SCANS¶

The following examples can be added to /etc/crontab

1) Scan a Class C network every 2 hours

30 */2 * * * root scanpbnj 10.0.0.

2) Scan a Class C network everyday at 2:30

30 2 * * * root scanpbnj 10.0.0.

TARGET SPECIFICATION¶

The target specified is a typical method of probing the network.
Therefore, any of the following can be used:
(e.g. 10.0.0.1, 10.0.0.1-254, 10.0.0.0/24 or 10.0.0.).
The first example is simply an IP address. The second example is
the scanning of a range. The third is a range in CIDR notation.
The fourth example is the IP with the star which specifies to scan
255 hosts. This is the same format that Nmap uses with the only
exception being the on the last octet. This is needed because it
needs to not interpret the star when it is being executed.

Another option, is to use a hostname or domain name. ScanPBNJ will
then resolve the name to the correct IP address. If you pass a
debug flag with level 1 or greater, ScanPBNJ will display what IP
address, the hostname resolved too.

SCAN OPTIONS¶

DATABASE OPTIONS¶

GENERAL OPTIONS¶

DEFAULT SCAN¶

Here are the default arguments that are used during a default scan:

-vv -O -P0 -sSV -p 1-1025

FILES¶

PBNJ's data files are stored in ScanPBNJ and OutputPBNJ. When either
of these programs is run the configuration files will be generated
for the user if they don't already exists and placed in the
$HOME/.pbnj-2.0 directory. Again, if there is a configuration file
in the current directory it is used instead of the version in the
configuration directory.

$HOME/.pbnj-2.0/config.yaml - holds settings for connecting to
the database which store the information from PBNJ scans.

$HOME/.pbnj-2.0/query.yaml - lists all queries that can be used to
retrieve information from the database. Also, includes the name and
description for each query. This is only generated when you executed
OutputPBNJ.

For Windows, the pbnj-2.0 config directory is in the APPDATA
directory, which contains both config.yaml and query.yaml. Depending
on your environment, the APPDATA directory may be a different location
from other environments. Therefore, when the configs are executed for
the first time they will display the path where the configs were
generated.

FEATURE REQUESTS¶

Any feature requests should be reported to the online
feature-request-tracking system available on the web at :
http://sourceforge.net/tracker/?func=add&group_id=149390&atid=774489
Before requesting a feature, please check to see if the features has
already been requested.

BUG REPORTS¶

Any bugs found should be reported to the online bug-tracking system
available on the web at :
http://sourceforge.net/tracker/?func=add&group_id=149390&atid=774488.
Before reporting a bug, please check to see if the bug has already been
reported.

When reporting PBNJ bugs, it is important to include a reliable way to
reproduce the bug, version number of PBNJ and Nmap, OS
name and version, and any relevant hardware specs. And of course,
patches to rectify the bug are even better.

SUPPORTED DATABASES¶

The following databases are supported:

* SQLite [default]
* MySQL
* Postgres
* CSV

DATABASE SCHEMA¶

The following is the SQLite version of the database schema:

CREATE TABLE machines (
mid INTEGER PRIMARY KEY AUTOINCREMENT,
ip TEXT,
host TEXT,
localh INTEGER,
os TEXT,
machine_created TEXT,
created_on TEXT);
CREATE TABLE services (
mid INTEGER,
service TEXT,
state TEXT,
port INTEGER,
protocol TEXT,
version TEXT,
banner TEXT,
machine_updated TEXT,
updated_on TEXT);

SEE ALSO¶

outputpbnj(1), genlist(1), nmap(1)

AUTHORS¶

Joshua D. Abraham ( jabra@ccs.neu.edu )

LEGAL NOTICES¶

This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details at
http://www.gnu.org/copyleft/gpl.html, or in the COPYING file included
with PBNJ.

It should also be noted that PBNJ has occasionally been known to
crash poorly written applications, TCP/IP stacks, and even operating
systems. While this is extremely rare, it is important to keep in
mind. PBNJ should never be run against mission critical systems
unless you are prepared to suffer downtime. We acknowledge here that
PBNJ may crash your systems or networks and we disclaim all liability
for any damage or problems PBNJ could cause.