Nmap Security Scanner

Mentors: Student: Vinamra Bhatia

<p>Nmap has become my fascination ever since I started actively using it. It is undoubtedly one of the best security tools. My project Idea is "Vulnerability and Exploitation Specialist" and I would be spending my summers looking for the vulnerabilities that would be suitable to be added to Nmap Scripting Engine and will implement them. I will also be working on some web scanning scripts.</p>

Mentors: Student: Rewanth Cool

<p>I will be working in several areas like adding new features, optimizing existing scripts and developing new scripts for Nmap.</p> <p>In nutshell during this whole period of 3 months my overall focus will be on developing NSE scripts for the latest vulnerabilities and optimize some of existing modules which consume lot of time for scanning. When it comes to writing new vulnerability scripts I will follow the CVE and CWE updates carefully and will craft them perfectly within no time. I will also add new features to Nmap which will be very helpful to both the basic and advanced Nmap users.</p>

Mentors: Student: Evangelos Deirmentzoglou

<p>This proposal describes the plan to merge the SSH support branch to the nmap project. Also, Ncrack modules will be developed for the MsSQL, MongoDB, Oracle, LDAP, SMTP, SVN and rlogin protocols while the Winrm module will be extended to support more authentication methods.</p>

Mentors: Student: Wong Wai Tuck

<h3>Development of vuln, exploit, auth and malware scripts</h3> <p>I will seek to research on the newest vulnerabilities that have been made public and either a) translate the existing PoC into a NSE Lua script or b) implement the thing myself on Lua, if no existing PoCs exist yet and the vulnerability is widespread enough.</p> <p>The metric which I will benchmark myself against is 1 high-impact/high-difficulty script per week, as if time allows I will implement other scripts as well.</p>

Mentors: Student: Sergey

<p>I am going to work on improvement of NSE brute-force performance and add additional support of such protocols like ssh and rdp. Currently there are more than 60 brute-forcing scripts but there is still room for improvement of NSE's parallelism, performance and protocol support.</p> <p>Main tasks:</p> <ul> <li>Improve NSE brute force performance to match Ncrack as close as possible</li> <li>Develop ssh-brute script for brute forcing SHH credentials</li> <li>Develop rdp-brute script for Remote Desktop Protocol</li> <li>Improve internals of NSE for better parallelism</li> </ul> <p>Possible mini projects:</p> <ul> <li>SSH key acceptance checker</li> <li>Remote ssh commands from within NSE scripts</li> </ul>