Foro - Perl en Español

por **situ** » 2007-10-02 15:50 @701

Buenas estoy tratando de parsear los resultados de un escaneo de red con nmap, cabe aclarar que es para un lab que estoy haciendo.

Obtengo como resultado:

Sintáxis: [ Descargar ] [ Ocultar ]

Using xml Syntax Highlighting

<!-- Nmap 4.20 scan initiated Tue Oct  2 14:33:46 2007 as: nmap -sS -oX tcp.xml -iL ips.lst -->
<nmaprun scanner="nmap" args="nmap -sS -oX tcp.xml -iL ips.lst" start="1191346426" startstr="Tue Oct  2 14:33:46 2007" version="4.20" xmloutputversion="1.01">
<scaninfo type="syn" protocol="tcp" numservices="1697" services="1-1027,1029-1033,1040,1043,1050,1058-1059,1067-1068,

1076,1080,1083-1084,1103,1109-1110,1112,1127,1139,1155,1158,1178,

1212,1214,1220,1222,1234,1241,1248,1270,1337,1346-1381,1383-1552,

1600,1650-1652,1661-1672,1680,1720,1723,1755,1761-1764,1827,1900,

1935,1984,1986-2028,2030,2032-2035,2038,2040-2049,2053,2064-2065,

2067-2068,2105-2106,2108,2111-2112,2120-2121,2201,2232,2241,2301,

2307,2401,2430-2433,2500-2501,2564,2600-2605,2627-2628,2638,2766,

2784,2809,2903,2998,3000-3001,3005-3006,3025,3045,3049,3052,3064,

3086,3128,3141,3264,3268-3269,3292,3299,3306,3333,3372,3389,

3397-3399,3421,3455-3457,3462,3531,3632,3689,3900,3984-3986,

3999-4000,4002,4008,4045,4125,4132-4133,4144,4224,4321,4333,4343,

4444,4480,4500,4557,4559,4660,4662,4672,4899,4987,4998,5000-5003,

5010-5011,5050,5060,5100-5102,5145,5190-5193,5232,5236,5300-5305,

5308,5400,5405,5432,5490,5510,5520,5530,5540,5550,5555,5560,

5631-5632,5679-5680,5713-5717,5800-5803,5900-5903,5977-5979,

5997-6009,6017,6050,6101,6103,6105-6106,6110-6112,6141-6148,

6346-6347,6400-6401,6502,6543-6544,6547-6548,6558,6588,6666-6668,

6699,6881,6969,7000-7010,7070,7100,7200-7201,7273,7326,7464,7597,

7937-7938,8000,8007,8009,8021,8076,8080-8082,8443,8888,8892,9090,

9100-9107,9111,9152,9535,9876,9991-9992,9999-10000,10005,

10082-10083,11371,12000,12345-12346,13701-13702,13705-13706,

13708-13718,13720-13722,13782-13783,14141,15126,15151,16444,16959,

17007,17300,18000,18181-18185,18187,19150,20005,22273,22289,22305,

22321,22370,26208,27000-27010,27374,27665,31337,31416,32770-32780,

32786-32787,38037,38292,43188,44334,44442-44443,47557,49400,50000,

50002,54320,61439-61441,65301" />
<verbose level="0" />
<debugging level="0" />
<host><status state="up" />
<address addr="192.168.1.100" addrtype="ipv4" />
<hostnames />
<ports><extraports state="closed" count="1694" />
<port protocol="tcp" portid="22"><state state="open" /><service name="ssh" method="table" conf="3" /></port>
<port protocol="tcp" portid="902"><state state="open" /><service name="iss-realsecure-sensor" method="table" conf="3" /></port>
<port protocol="tcp" portid="1723"><state state="open" /><service name="pptp" method="table" conf="3" /></port>
</ports>
</host>
<runstats><finished time="1191346426" timestr="Tue Oct  2 14:33:46 2007"/><hosts up="1" down="0" total="1" />
<!-- Nmap run completed at Tue Oct  2 14:33:46 2007; 1 IP address (1 host up) scanned in 0.120 seconds -->
</runstats></nmaprun>Coloreado en 0.002 segundos,  usando GeSHi 1.0.8.4

Me gustaría parsear dicha salida y que me guarde el resultado en un archivo externo.

Quisiera que me quede en el otro archivo lo siguiente:

Sintáxis: [ Descargar ] [ Ocultar ]

Using xml Syntax Highlighting

<address addr="192.168.1.100" addrtype="ipv4" />
<ports><extraports state="closed" count="1694" />
<port protocol="tcp" portid="22"><state state="open" /><service name="ssh" method="table" conf="3" /></port>
<port protocol="tcp" portid="902"><state state="open" /><service name="iss-realsecure-sensor" method="table" conf="3" /></port>
<port protocol="tcp" portid="1723"><state state="open" /><service name="pptp" method="table" conf="3" /></port>
</ports>Coloreado en 0.001 segundos,  usando GeSHi 1.0.8.4

Digamos las líneas donde aparece "address addr", "port protocol" y "portid".

Estuve leyendo los posts sobre XML del foro pero la verdad que no obtuve resultados favorables.

Gracias

#!/bin/perl
open SALIDATCP,"> tcpreporte.txt";

foreach(qx( nmap -sS -oX --iL ips.lst )){
$salida.=$_if/port|address/;

if(/<address addr=\"([.0-9]+)\".*|portid=\"([0-9]+)\".*<service name=\"([a-z0-9-]+)\"/){
print SALIDATCP "$1 $2 $3\n"
}

}

close(SALIDATCP);
Coloreado en 0.001 segundos,  usando GeSHi 1.0.8.4

Resultado:

Código: Seleccionar todo: 192.168.1.100 22 ssh 902 iss-realsecure-sensor 1723 pptp 9999 abyss

por **Jenda** » 2007-10-29 18:09 @798

No es muy sencilo parsear o filtrar XML usando regexps. Al encontrar un XML solo un poquito diferente todo va a romperse. Hay muchos módulos diferentes en CPAN para tratar XML, es mejor usarles.

Algo así:

Sintáxis: [ Descargar ] [ Ocultar ]