8

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database?

It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result into a good object structure.

It would be very nice if the tool could also compare scans to easily check for differences between one time and another.

Any recommendations? I'm currently writing my own, but why invent the wheel if it's already been done before.

UPDATE: The tool has to be able to take NMAP XML, and must not rely on using the scans itself.

Improve this question
6

I've now written my own nmap scan parser. Unfortunately the tools listed in the answers, and the tools Ive tried have not been what I've needed. I also been using some nmap script output aswell which needs to be stored in a way to allow easy aggregating of data. I found that writing my own script was easy enough to deal with my situation.

Thank you for answers!

UPDATE: Source code can be found here . Anyone wanting to participate can send me their email, and I'll add you.

Improve this answer
  • So, are ya gonna share...? – AviD♦ Dec 11 '10 at 22:09
  • Yes, I will be putting it up on Google code eventually. I just wanna finish polishing it up a bit. Right now its very rough edged. – Chris Dale Dec 12 '10 at 16:14
3

Fyodor has some links on the Nmap Output to a Database page which could give you a starting point. I have had an excellent perl script for this in the past, but no longer have access to that one.

Or you could go for the Nessus import of nmap results, as Nessus can make it a lot easier to consistently output reports.

Improve this answer
3

Zenmap will do scan aggregation, combining the results of many scans into one view, as a built-in feature: http://nmap.org/book/zenmap-scanning.html#aggregation

Ndiff is a tool that comes with nmap for comparing exported xml data from different nmap scans: http://nmap.org/book/ndiff-man.html

As far as an actual database connection, I know of one good set of perl scripts and a mysql schema for doing that which unfortunately is not publically available. You can start from the same place they did, though; http://nmap.org/book/output-formats-xml-with-perl.html

Improve this answer
  • 1
    Use ndiff to generate the diffs, and since they're in XML, they come with a built in XSLT, which you can then use to transform into a very nice looking HTML report of what's new, what disappeared, etc. – Marcin Nov 30 '10 at 16:04
1

PBNJ might be along the lines of what you are looking for. It can run NMAP scans on an automated basis, and alert you to changes.

I'm not sure if it is still in active development.

Improve this answer
  • I have to investigate this. Hopefully it can take xml as input, and not only an IP/hostname – Chris Dale Dec 6 '10 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.