Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 38 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Programmingarrow Nmap Grep Help
EH-Net
May 24, 2013, 04:43:32 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Nmap Grep Help  (Read 4217 times)
0 Members and 1 Guest are viewing this topic.
Medeoker
Newbie
*
Offline Offline

Posts: 3


View Profile
« on: May 21, 2012, 02:27:15 PM »

Hey there,

I've been doing some searching and I'm having a tough time trying to figure out what I'm trying to do.

I'm running an nmap scan with the -oG option to grep the info.

I am looking to end up with a test file with the following format:

IP,Port

I'm grepping for specific services and want to output it in that format, as the next tool I want to run needs the data that way.

I can grep the IP with:

cat logfile |grep http |cut -d" " -f2

And I can grep the port with:
cat logfile |grep http |cut -d" " -f4 |cut -d"/" -f1

I just need to figure out how to grep those two things out and put the out put on the same line with a comma separating them.

I'm doing this for an automation exercise I'm working on.

Any help would be greatly appreciated! Thanks
Logged
chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #1 on: May 21, 2012, 02:56:40 PM »

use awk not cut. $2,$4 might work

so something like:

awk '{print $2","$4}'

really awk is probably your best bet in this case.

My awk is rusty, but I'm pretty sure you could do the whole thing with a single awk statement.
« Last Edit: May 21, 2012, 03:01:52 PM by chrisj » Logged

OSWP, Sec+
Medeoker
Newbie
*
Offline Offline

Posts: 3


View Profile
« Reply #2 on: May 21, 2012, 03:05:00 PM »

Sweet

I'll figure it out. Just need someone to point me in the right direction.

Thanks!
Logged
sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #3 on: May 21, 2012, 03:53:21 PM »

Your cat is what is known as a UUOC https://www.google.com/search?q=uuoc You don't need it.

[root@kenji ~]# cat nmap.scan | grep http
80/tcp  open   http
443/tcp closed https


[root@kenji ~]# grep http nmap.scan
80/tcp  open   http
443/tcp closed https

When using awk, you won't even need to bother with grep either:

[root@kenji ~]# awk '/http/' nmap.scan
80/tcp  open   http
443/tcp closed https

[root@kenji ~]# awk -F / '/http/ && /open/{print $1}' nmap.scan
80

[root@kenji ~]# awk -F / '/http/ && /open/{print "WHATEVER_YOU_WANT,"$1}' nmap.scan
WHATEVER_YOU_WANT,80

Anyhow, this is the easiest way for you to get the output you want:

awk '/http/{print $2","$5}' logfile | awk -F / '{print $1}'

Logged

sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #4 on: May 21, 2012, 03:56:34 PM »

Should have added the example beforehand:

[root@kenji ~]# more nmap.scanned
# Nmap 6.00 scan initiated Mon May 21 16:56:39 2012 as: nmap -sS -p 80,442 -oG nmap.scanned 10.4.4.72
Host: 10.4.4.72 (kenji.infiltrated.net) Status: Up
Host: 10.4.4.72 (kenji.infiltrated.net) Ports: 80/open/tcp//http///, 442/closed/tcp//cvc_hostd///
# Nmap done at Mon May 21 16:56:41 2012 -- 1 IP address (1 host up) scanned in 2.17 seconds

[root@kenji ~]# awk '/http/{print $2","$5}' nmap.scanned | awk -F / '{print $1}'
10.4.4.72,80

Logged

chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #5 on: May 22, 2012, 10:40:59 AM »

Like I said, my Awk was rusty, the grep option didn't look all that appealing when I messed with it yesterday. But with the rest of the awk hints from Sil it really is cool.

Now to upgrade to nmap6.
Logged

OSWP, Sec+
Medeoker
Newbie
*
Offline Offline

Posts: 3


View Profile
« Reply #6 on: May 22, 2012, 12:15:42 PM »

Should have added the example beforehand:

[root@kenji ~]# more nmap.scanned
# Nmap 6.00 scan initiated Mon May 21 16:56:39 2012 as: nmap -sS -p 80,442 -oG nmap.scanned 10.4.4.72
Host: 10.4.4.72 (kenji.infiltrated.net) Status: Up
Host: 10.4.4.72 (kenji.infiltrated.net) Ports: 80/open/tcp//http///, 442/closed/tcp//cvc_hostd///
# Nmap done at Mon May 21 16:56:41 2012 -- 1 IP address (1 host up) scanned in 2.17 seconds

[root@kenji ~]# awk '/http/{print $2","$5}' nmap.scanned | awk -F / '{print $1}'
10.4.4.72,80



This worked perfectly! Thanks again guys!
Logged
camelCase
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #7 on: May 25, 2012, 01:24:12 PM »

Came here to say what Sil already covered.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.111 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.