NMAP output

[ankushgoel27]

Is your feature request related to a problem? Please describe.
When I try to run rustscan with multiple hosts and the nmap output command such as -oX nmap.xml, I get 1 file with the last host output in it. The output doesn't include all the hosts in it.

rustscan -u 5000 www.yahoo.com,login.yahoo.com -- -A -sC -sT -T4 -Pn -oX nmap.xml

Describe the solution you'd like
I should be able to describe an output like nmap XML file which I can then send to xsltproc for HTML output and send it to brutespray for further exploitation.

Describe alternatives you've considered
I don't have an alternative

Additional context
Add any other context or screenshots about the feature request here.

[issue-label-bot]

Issue-Label Bot is automatically applying the label feature_request to this issue, with a confidence of 0.84. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[niklasmohrin]

Thank you for your report! This probably happens because rustscan invokes nmap for every specified address. Therefore, your output file gets overwritten by every next nmap run. As a quick fix, you could redirect the output of rustscan to the file to get all results (note that rustscan has flags to mute some of it's own output). To get the XML from nmap in stdout, you will have to use -oX - as a flag for nmap. The full command would look something like this:

rustscan -u 5000 some.site -- -A -sC -sT -T4 -Pn -oX - > nmap.xml

We'll have to see how we can make this more convenient.

[ankushgoel27]

i ran your command but i am unable to pipe it in any of other tools because its not formatted as a proper XML file. Looking forward for any new output formats that you introduce later.

Also, can you share how can I mute the rustscan's output?

[niklasmohrin]

@ankushgoel27 I was going to recommend --greppable to you, but this won't work because nmap will not run if this flag is passed. I don't think there is a way to achieve what you want to do, we will have to look into this. In the meantime, the only thing that can slightly help would be the --accessible flag which hides the opening and doesn't make the output colorful, so you don't have these bytes in the output anymore. Still, this is not very convenient 😥

[iiiusky]

@ankushgoel27 I was going to recommend --greppable to you, but this won't work because nmap will not run if this flag is passed. I don't think there is a way to achieve what you want to do, we will have to look into this. In the meantime, the only thing that can slightly help would be the --accessible flag which hides the opening and doesn't make the output colorful, so you don't have these bytes in the output anymore. Still, this is not very convenient 😥

I am going to add an option myself, specifically for outputting the results of nmap xml to the screen, there will be no other output besides the xml results of nmap.

[niklasmohrin]

@iiiusky I am currently working on #277 where there is a similar problem. Maybe both our solutions can work hand in hand to make this consistent and convenient in the end. I am going to propose something at the end of the thread for you.

[UnstableAlpha]

I'm looking for this functionality too - quite a lot of tools are able to take an nmap xml file as input for further enumeration. Would it maybe possible to save each host's output to a file prefixed by the hostname?

So, say for example I have a list of hosts in a file and call
rustscan -a "hosts.txt"

Rustscan enumerates the live hosts and ports, and then runs nmap with the -oX flag for each with a filename of .xml?

[niklasmohrin]

@UnstableAlpha The closest I could find was this paragraph from the nmap manpage:

All of these arguments support strftime-like conversions in the filename. %H, %M, %S, %m, %d, %y, and %Y are all exactly the same as in strftime. %T is the same as %H%M%S, %R is the same as %H%M, and %D is the same as %m%d%y. A % followed by any other character just yields that character (%% gives you a percent symbol). So -oX 'scan-%T-%D.xml' will use an XML file with a name in the form of scan-144840-121307.xml.

This way could get different files for every host, without the info which host it was in the filename though (but this can be found in the xml then).

[Anu-bhav]

Hi all, I was also searching for this issue, I'm currently using docker so at first I though maybe i have to mount a path to get an output.

Finally, I read the work around that @niklasmohrin posted and used it as a oneliner:

rustscan -a google.com -- -Pn -sV --script="('vulners.nse')" --stylesheet 'https://raw.githubusercontent.com/honze-net/nmap-bootstrap-xsl/master/nmap-bootstrap.xsl' -oX - > tmp && < tmp sed -n '/<?xml version="1.0"/,$p' > google.xml && sed -i '1 s/^.*$/<?xml version="1.0" encoding="UTF-8"?>/' google.xml && rm tmp && cat google.xml

Here's the output

and in firefox:

you can make it into a simple bash script if you want it like this.

[evantoday]

Hi all, I was also searching for this issue, I'm currently using docker so at first I though maybe i have to mount a path to get an output.

Finally, I read the work around that @niklasmohrin posted and used it as a oneliner:

rustscan -a google.com -- -Pn -sV --script="('vulners.nse')" --stylesheet 'https://raw.githubusercontent.com/honze-net/nmap-bootstrap-xsl/master/nmap-bootstrap.xsl' -oX - > tmp && < tmp sed -n '/<?xml version="1.0"/,$p' > google.xml && sed -i '1 s/^.*$/<?xml version="1.0" encoding="UTF-8"?>/' google.xml && rm tmp && cat google.xml

Here's the output

and in firefox:

you can make it into a simple bash script if you want it like this.

is it wil work if using hostfile for scanning ?
like this
rustscan -a cok -p 445 -- -A -Pn -sC -sV --script 'smb-os-discovery' --stylesheet 'https://raw.githubusercontent.com/honze-net/nmap-bootstrap-xsl/master/nmap-bootstrap.xsl' -oX - > tmp && < tmp sed -n '/<?xml version="1.0"/,$p' > google.xml && sed -i '1 s/^.*$/<?xml version="1.0" encoding="UTF-8"?>/' google.xml && rm tmp && cat google.xml

[p1gp1g]

If many output files are a solution :
rustscan -a foo -- -oA {{ip}}