Persisting and comparing NMAP scans

Question

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database?

It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result into a good object structure.

It would be very nice if the tool could also compare scans to easily check for differences between one time and another.

Any recommendations? I'm currently writing my own, but why invent the wheel if it's already been done before.

UPDATE: The tool has to be able to take NMAP XML, and must not rely on using the scans itself.

Answer 1

I've now written my own nmap scan parser. Unfortunately the tools listed in the answers, and the tools Ive tried have not been what I've needed. I also been using some nmap script output aswell which needs to be stored in a way to allow easy aggregating of data. I found that writing my own script was easy enough to deal with my situation.

Thank you for answers!

UPDATE: Source code can be found here . Anyone wanting to participate can send me their email, and I'll add you.

Answer 2

Fyodor has some links on the Nmap Output to a Database page which could give you a starting point. I have had an excellent perl script for this in the past, but no longer have access to that one.

Or you could go for the Nessus import of nmap results, as Nessus can make it a lot easier to consistently output reports.

Answer 3

Zenmap will do scan aggregation, combining the results of many scans into one view, as a built-in feature: http://nmap.org/book/zenmap-scanning.html#aggregation

Ndiff is a tool that comes with nmap for comparing exported xml data from different nmap scans: http://nmap.org/book/ndiff-man.html

As far as an actual database connection, I know of one good set of perl scripts and a mysql schema for doing that which unfortunately is not publically available. You can start from the same place they did, though; http://nmap.org/book/output-formats-xml-with-perl.html

Answer 4

PBNJ might be along the lines of what you are looking for. It can run NMAP scans on an automated basis, and alert you to changes.

I'm not sure if it is still in active development.