Preliminary Specification of
                      The Multifuctional Network Scanner 
                              Version 0.95beta

                            [<  Jan 11, 2000  >]
 

[ Contents ]

1. Introduction
2. Authors & Copyright
3. Installation
4. Usage & Features
5. MNS Features
6. Notes & Guidelines


1. [ Introduction ]

The purpose of this program was to exercise our programming ability and
create a powerful, configurable, fast, and portable network vulnerability
scanner.

MNS currently compiles under:
   x86 / sparc
   Linux 2.0.x 2.2.x
   NetBSD 1.3.3
   FreeBSD RELEASE-3.1
   FreeBSD RELEASE-4.0

If you get it to compile under another OS, email us and tell us your joyful
experience.  If you don't get it to compile, email us with the entire make
error output. 


2. [ Authors & Copyright ]

The Multifuctional Network Scanner
Copyright (C) bind & aempirei 2000

bind      -  bind@san.rr.com 
aempirei  -  chrisa@eeye.com  -  http://aempirei.entropy.net


   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.


3. [ Installation ]

Needed Librarys:
   libpcap.a : ftp.ee.lbl.gov/libpcap-0.4.tar.Z
   libX11.a  : 

To install MNS:
   tar -zxvf mns-v.95beta.tar.gz
   cd mns-v.95beta && make

4. [ Usage & Features ]

 usage: ./mns [options...] {target|-F file}
   target           single scan where target is an IP Address or hostname
   -F file          file containing a list of IP Addresses and hostnames
   [-qifcrwx]       enable vulnerability checks which consist of
                    the following scanning options
                       -q  QPOP
                       -i  IMAP
                       -f  FTP
                       -c  CGI
                       -r  RPC
                       -w  WINGATE
                       -x  XSERV
   [-v]             verbose output and promiscious scanning
   [-u]             scan for listening UDP service ports
   [-C children]    set maximum child processes (2-200)
   [-I interface]   set active packet capturing interface
   [-V]             display version information
   [-R]             try to resolve IPs to hostnames
   [-A]             enable all vulerability checks
   [-S]             force SYN port scanning

5. [ MNS Features ]

Operating system detection via TCP/IP fingerprinting

TCP Sequence Assesment via Hamming Methods

Stealth Port Scanning via:
  TCP/IP FIN/NUL/PUSH method
  TCP/IP SYN method

UDP Port Scanning 

QPOP/SCOPOP vulnerability checking: 
  QPOP v2.2
  QPOP v2.41beta1
  QPOP v2.4
  QPOP v2.3
  QPOP 2.1.4-R3
  SCOPOP 2.1.4-R3
  SCOPOP 5.0.0

IMAP vulnerability checking:
  IMAP4rev1 v10.223
  IMAP4rev1 v10.205
  IMAP4rev1 v10.203
  IMAP4rev1 v10.171
  IMAP4rev1 v10.183
  IMAP4rev1 v10.166
  IMAP4rev1 v10.233
  IMAP4rev1 v10.190
  IMAP4rev1 Service 9.0

CGI vulnerability checking: 
  phf
  Count.cgi
  test-cgi
  php.cgi
  handler
  webgais
  websendmail
  webdist.cgi
  faxsurvey
  htmlscript
  pfdisplay
  perl.exe
  wwwboard.pl
  www-sql
  aglimpse
  man.sh
  view-source
  campas
  nph-test-cgi

RPC vulnerability checking:
   rpc.mountd
   rpc.nlockmgr
   rpc.statd
   rpc.status
   rpc.nisd
   rpc.autofsd
   rpc.ttdb
   
WuFTPD and ProFTPD vulns:
   Wu-FTPD 2.4.2-academ[BETA-12]
   Wu-FTPD 2.4.2-academ[BETA-15]
   Wu-FTPD 2.4.2-academ[BETA-16]
   Wu-FTPD 2.4.2-academ[BETA-17]
   Wu-FTPD 2.4.2-academ[BETA-18]
   ProFTPD 1.2.0pre1

Verbose Output and Promiscious Scanning:
   Extended output of all RPC services
   Complete cgi-bin/ listing if avaliable
   Display newly found OS fingerprints
   

Coming Soon:
   Open X Servers
   Open Wingates
   Exported NFS Volumes
   NetBios / SMB Scanning

6. [ Notes & Guidelines ]

The forced SYN port scanning option was introduced because our standard
combo scan of FIN/PSH/NUL is not as accurate on some types of machines as
SYN scanning is.  Once such machine is MS-Windows based machines, but mns
can automatically detect these, and roll back the scan method. Targets where
a forced roll back may be necessary are firewalled machines or IRIX based
systems. There are many other instances where it may be necessary.